Changelog

1.22.52

• agents artifacts share --visibility me|org — identity-gated share pages (PHNX-3260). Extends the P1 public|unlisted tiers (RUSH-3135) with two Phoenix-gated GET visibilities. me is visible only to the signed-in owner (the viewer's Phoenix userId must equal the stamped owner); org is visible to any signed-in Phoenix user whose verified email domain matches the owner's company domain (org_domain, stamped from the owner's verified email on PUT). A mismatch on either returns 404 — the same body as a missing object — so a wrong viewer cannot even learn the page exists. Both are hidden from the public gallery and share list, like unlisted. Publishing org from a public inbox (gmail/googlemail/outlook/hotmail/live/icloud/me) is refused with 400, and me/org PUT without a Phoenix identity is a loud 400 (a BYO WRITE_TOKEN alone cannot publish them). Browser GET of an unauthenticated me/org URL 302s to ${PHOENIX_ID_BASE}/login?return=<url> (the same Google OAuth as /device, no new IdP); the returned one-time phoenix_ticket is redeemed once via POST /api/v1/auth/ticket and exchanged for an HttpOnly, HMAC-signed __Host-phoenix_share cookie on the share host. An existing CLI Authorization: Bearer still works with no redirect. me/org responses send Cache-Control: private, no-store and X-Robots-Tag: noindex; public/unlisted GET is unchanged (anonymous 200). Because the Worker template changed, already-provisioned BYO endpoints need agents artifacts share update to serve the new gate. Source: cli/src/lib/share/worker-template.ts, cli/src/lib/share/{backend,publish}.ts, cli/src/commands/share.ts.

• Harden the browser daemon against the socket-timeout wedge (PHNX-3289). Four fixes to the browser/daemon reliability surface. agents daemon status no longer errors on macOS with ps: etimes: keyword not found — the process-uptime probe now shells the portable ps -o etime= and parses it with the same helper the keychain reaper uses. waitForSocket raises its ceiling from a flat 6s to 15s and re-probes across an IPC-server restart (requiring two stable accepts), so a browser start/navigate that lands in a restart window no longer intermittently throws Timeout waiting for browser daemon socket. New agents browser stop --daemon stops the browser daemon and clears a stale/wedged browser.sock, failing loud if a live server still holds it, so the next start comes up clean. And agents browser start --device <host> now resolves the browser/profile on the TARGET device instead of the local one — a bare start from a browserless box forwards to --device instead of failing with a misleading No supported browser found. Source: cli/src/commands/daemon.ts, cli/src/lib/browser/ipc.ts, cli/src/commands/browser.ts.

• Managed share: a BYO-published page no longer locks the rightful Phoenix owner out of their own handle (PHNX-3291). The share Worker's handle-ownership check (assertHandleOwner) scanned every page under a namespace and 409'd handle taken when any page's stamped owner differed from the writer's Phoenix userId. But a BYO WRITE_TOKEN publish stamps owner = SHARE_NAMESPACE (the namespace string, e.g. octocat), not a userId — so once a namespace held any BYO page, its legitimate Phoenix handle owner got a 409 on every subsequent publish, and could neither publish nor change a page's --visibility (which blocked the me/org tiers from PHNX-3260 for that user entirely). The __handles/<handle> claim object is now authoritative when it exists: the recorded userId may write and anyone else is refused, regardless of a stray page's owner stamp. The page-owner scan remains as the pre-claim fallback but ignores BYO namespace stamps (owner === handle), so a first Phoenix publish can still claim a handle previously used only by BYO pages. Source: cli/src/lib/share/worker-template.ts. Requires agents artifacts share update on already-provisioned endpoints (the Worker template hash changed).

• sessions resume/sessions attach/sessions focus no longer SSH-probe the fleet before attaching a live local tmux pane (PHNX-3292). First unique match now wins: a selector naming a live pane on THIS box — the full ag-<agent>-<8hex> alias agents tmux ls prints, or its bare 8-hex suffix when it names exactly one live local pane — attaches with zero SSH, for bare sessions resume <alias> and deprecated sessions attach <alias> too, not just --attach-only. Previously collectSessionCandidates ran first — two fleet sweeps (transcript pool + live roster) that stall on offline devices (~2 minutes measured on yosemite-s0, two copies of unreachable or no agents CLI — skipped) — and bare resume of a live alias didn't even reach the tmux-attach path at all. A miss still races the reachable fleet in parallel: isDefinitiveMatch/selectorAllowsEarlyExit (RUSH-2203) now cover a tmux alias and an exact 8-hex short id, not just a full UUID, so the first peer to answer with that pane aborts the rest of the sweep instead of waiting out every offline box's timeout. Two LIVE panes (local or fleet-answered) sharing the same 8-hex suffix fail closed with both names printed, rather than guessing; a dead/retained pane is never attached. --device skips the local gate entirely and scopes the race to the named box(es). Source: cli/src/lib/session/local-tmux-attach.ts (new, attachLocalLiveSelector), cli/src/commands/{sessions,sessions-resume,attach,focus}.ts.

• agents tmux attach tears the session down when the agent exits (PHNX-3293). Attaching to a wrapped pane and exiting the agent (/exit, Ctrl-c) used to print [detached] and leave the tmux session in tmux ls — the v6 pane-died hook only detach-clients when a client is attached, and the attach verbs never killed the remain-on-exit husk. tmux attach, sessions focus / resume --attach-only, and go's local-tmux attach now destroy the session when every pane is dead and still keep it on Ctrl-b d. A piped (no-TTY) local agents run --interactive no longer wraps in tmux, so session-tracker tests cannot leak live "trust this folder" panes. agents tmux kill with no name opens a picker whose preview is the pane's last screen (so a leaked first-run dialog is distinguishable from real work); tmux ls prints that snippet on each row. Source: cli/src/lib/tmux/session.ts, cli/src/commands/tmux.ts, cli/src/commands/focus.ts, cli/src/lib/exec.ts.

• agents browser start no longer silently mints a logged-out auto-chrome (PHNX-3296). With no configured default and no existing launchable profile, start now errors and points at agents setup / agents browser use <name> / the browser.device fleet hub instead of popping a signed-out Chrome. A pre-existing auto-chrome or legacy default still resolves. agents setup's browser pick replaces the misleading "auto-detect on first use" opt-out with an explicit "None — this box uses the fleet hub" choice. Source: cli/src/lib/browser/profiles.ts, cli/src/commands/setup-preferences.ts, cli/src/commands/browser.ts.

• sessions detach / sessions stop of a unique live local session no longer wait for fleet SSH timeouts (PHNX-3298). A live pane already visible locally is the hit: a full UUID or a unique 8-hex prefix skips gatherRemoteActive entirely, so a sleeping peer cannot print unreachable or no agents CLI or stall SIGTERM. Two local matches fail closed without waiting for unanswered boxes. A genuine miss still races the fleet and aborts remaining SSH on the first unique reachable live row; browse / focus with no id stays all-settle. Source: cli/src/commands/go.ts, cli/src/commands/detach.ts, cli/src/commands/sessions-stop.ts.

• agents monitors add refuses immediately when a reachable peer already has the same watcher (PHNX-3299). The fleet duplicate guard used to collect every peer before reporting a clash, so a single slow box forced the full 12-second timeout even when another peer had already answered with the same fingerprint. The fan-out now aborts remaining SSH captures the moment a peer reports a matching monitor, while the no-match path still waits for the whole fleet so uniqueness can be proved. Source: cli/src/commands/monitors.ts, cli/src/lib/monitors/remote.ts.

• agents repo sync user self-heals a non-git or partial ~/.agents by adopting it in place — no re-clone, no data loss (PHNX-3301). When the user-layer checkout lost (or never had) its .git, sync hard-failed with Not a git repo: ~/.agents and the only fix was a destructive re-clone that wiped runtime state (.cache / .history / scratch / device config). It now git-backs the existing directory in place with plumbing only (init / remote / fetch / update-ref / read-tree / checkout-index / restore, so it never trips the fleet git-guard): materializes only the MISSING tracked files, restores a stale-stub top-level agents.yaml from origin (backing up the previous copy to .history/agents.yaml.pre-adopt.bak first), preserves gitignored runtime state, and surfaces (never clobbers) real local edits. The remote URL is resolved from an existing origin, AGENTS_USER_REPO_URL, or a device-local record left by a prior healthy sync — never hardcoded. agents sync status now flags a non-git ~/.agents as a distinct drift state instead of burying it as "N missing". Source: cli/src/lib/git.ts, cli/src/commands/sync.ts, cli/src/commands/repo.ts, cli/src/lib/sync-status.ts, cli/src/commands/status.ts.

• Owner notifications forward to a capable fleet peer when this box can't deliver (PHNX-3303). The owner's delivery provider for the rush-backed channels (imessage / telegram / slack / discord via the rush CLI) is macOS-only, so agents feed post --level important / --blocked, agents notify, and monitor notify actions run from a headless Linux worker used to record the post but fail to reach the owner with owner failed: … rush CLI not found on PATH. They now hand the delivery over SSH to a reachable macOS peer that DOES have the provider — the same reroute agents message already uses — instead of stranding the important post. It is best-effort: it never throws or blocks the post, only the macOS-only rush family triggers a forward (a Linux-capable transport like openclaw-telegram stays local), and when no capable peer is reachable the existing clean local error stands. A box that received a forward never forwards onward (AGENTS_OWNER_NO_FORWARD guard). Source: cli/src/lib/channels/owner-forward.ts, cli/src/lib/notify.ts, cli/src/lib/feed-broadcast.ts.

• agents artifacts share <file> now derives a stable slug automatically (PHNX-3310). The default comes from the HTML <title> or Markdown frontmatter title:, then the filename, so repeat publishes of a long-running artifact update the same URL; --slug remains an optional explicit override. Source: cli/src/lib/share/publish.ts, cli/src/commands/share.ts.

• The release attestation now shards its test suite across the fleet instead of pinning one box. release-attestation-produce.sh — the full-suite run that mints a release's exact-tree attestation — ran the ~13k-test suite on a single auto-picked box at --maxWorkers=2 (~880s measured, ~14 min per attestation). It now fans the suite across the fleet via test.sh --shard N by default, resolving N from the eligible workers agents devices pick reports (capped) and falling back to a single box only when fewer than two are eligible. The suite is throughput-bound, so this is ~1/N the wall time (~269s on one box → ~31s on nine). Each shard still runs vitest at --maxWorkers=2 --retry=2, so the RUSH-3015 per-box flake mitigation is unchanged — sharding adds machines, not per-box concurrency. New --test-shard <n> / --test-devices a,b,c overrides mirror test.sh. Source: cli/scripts/release-attestation-produce.sh.

• Shared pages now show who shared them and — the point — a visibility cue (PHNX-3260 follow-up). The share Worker injects a slim attribution bar at the top of every served HTML page: Shared by <handle>, Made with <agent>, the date, and a colour-coded visibility chip — 🔒 Only you (me), 🏢 Anyone at <org> (org), 🌐 Public, 🔗 Unlisted — so a viewer can tell at a glance who can see the page, the thing the raw served HTML never surfaced. All values come from metadata the Worker already stamps (visibility, owner/handle, org_domain, agent, date); no new publish-time metadata and no CLI change, so it ships with agents artifacts share update. Non-HTML assets (images, JSON, the OG cover) are served byte-for-byte; metadata is HTML-escaped; the rewritten body drops the now-stale R2 etag. Source: cli/src/lib/share/worker-template.ts.

1.22.51

• publish-computer-helper-mac.sh cuts the helper's own tag (PHNX-3228). It published ComputerHelper.app.zip to the CLI's v<version> release, but since the client was repointed at per-helper tags the resolver asks for computer-mac/v<x.y.z> (helperTag in cli/src/lib/helper-versions.ts). The asset therefore landed at an address nothing requests, and there was no way to cut a new computer-mac release at all — the last publisher still coupled to the CLI's version line. It now cuts computer-mac/v<x.y.z>, requires the helper's version explicitly instead of defaulting to cli/package.json (that default was the coupling), and refuses an existing tag, since the upload uses --clobber and would otherwise replace a binary an installed CLI already pins. Symmetric with publish-computer-win.sh. Source: cli/scripts/publish-computer-helper-mac.sh. It also cuts the tag itself now. gh release create --verify-tag refuses to invent a tag absent from the remote, and nothing else pushed computer-mac/v<x.y.z> — release.sh delegates helper tagging to "where the helper is released", which is this script. So it ran green through build + notarize and then failed at the release step, meaning no new helper version could be cut. The tag is pushed AFTER a successful build, deliberately: pushing first would leave a published, immutable address with nothing behind it whenever notarization failed. Origin, not the local ref, is what makes a helper release immutable. Adding tag creation introduced a wedge: a run that tagged and then failed to push left a local tag, and the guard read that as "published" and told the operator to cut the next patch — burning a version over a transient network error, and (since the guard precedes the build) making that version uncuttable from the checkout without a manual git tag -d. A local-only tag now resumes the interrupted publish instead. Immutability keys on the published RELEASE, not the tag. A tag with no release is an interrupted run — whether the push failed or the release creation did — and both now resume rather than burning the version. The asset is what an installed CLI downloads, so the release is the thing that must never be replaced. The published-release check fails CLOSED. A non-zero gh is not evidence of absence — unauthenticated, offline, and rate-limited all exit non-zero — so reading that as "not published" would have carried on into gh release upload --clobber over a live binary, the exact outcome the guard exists to prevent. Only an explicit not-found means not-found; anything else stops the release and prints what gh actually said.

• agents traces sync retains and reports failed sessions instead of stranding them (PHNX-3267). The sync watermark advanced to the max mtime of successful uploads, so a later success moved it past an earlier failed session and the next run's file_mtime_ms > watermark filter skipped that session forever — the "failures are retried" comment was false. A live 1.22.49 sync on a real device reported 11,073 uploaded and 6,050 errors with no way to tell a transcript cleaned off disk from a genuine upload failure. Sync now records each failed session's identity and typed, redacted evidence in the ledger and unions those retry-worthy ids back into the row query regardless of the watermark, so a stranded session is re-attempted until it succeeds. Failures are classified transcript-unavailable (the file is gone — expected history, not re-read, aged out after 14 days), parse-failed, or upload-failed (both retried); agents traces sync prints the breakdown (… errors (N transcripts no longer on disk · M parse/upload failures — will retry)) and agents traces status lists the outstanding retry set with example detail. Source: cli/src/lib/traces/sync.ts, cli/src/commands/traces.ts.

• Helper binaries no longer download through a repository-rename redirect. HELPER_RELEASE_REPO still named phnx-labs/agents-cli after the repository was renamed to phnx-labs/agi-cli. Nothing was broken — GitHub redirects a renamed repo, and both slugs returned HTTP 200 — but every signed helper asset (MenubarHelper.app.zip, Agents_CLI.app.zip, ComputerHelper.app.zip, computer-helper-win.exe) was resolving through that redirect, which is one re-created repository away from pointing elsewhere. What actually protects the download is the sha256 + codesign + designated-requirement + Team ID verification in helper-download.ts; this removes the reliance on the redirect. The agents.yaml $schema URL, the CHANGELOG link, the star nudge, and the package.json repository/issues metadata moved with it. The npm package name is deliberately unchanged — it is still @phnx-labs/agents-cli, and renaming it would orphan every installed CLI. That distinction is now pinned by a test. Source: cli/src/lib/helper-download.ts. publish-computer-helper-mac.sh carried the old slug too, and that one is a write path: REPO_SLUG reaches gh release view (the immutability guard), gh release create, and gh release upload --clobber. Publishing signed helper binaries was going through the rename redirect. Found by sweeping scripts/ and .github/ after the source tree was already clean — the source sweep alone would have missed it. Three further live paths carried the old slug and were missed by the first sweep: ssh-tunnel.ts:170 WIN_HELPER_RELEASE_REPO (a separately hardcoded constant — the download URL for computer-helper-win.exe, the fourth signed asset, which the first version of this change claimed to cover and did not); commands/feedback.ts:14, which opens real GitHub issues; and factory/snapshot.ts:30, which polls this repo's PRs. installations/migrate.ts also wrote the old URL into the agents.yaml header it generates. Separately, .github/workflows/tests-windows-host-e2e.yml:54 gated on github.repository == 'phnx-labs/agents-cli', which is permanently false after a rename — that job had silently stopped running on every push to main and on its daily cron. The JSON Schema's own $id moved with it — state.ts and migrate.ts write that URL as the $schema hint into every user's agents.yaml, so a mismatched $id would make editors reject their own config.

• The menu-bar helper's staleness check compares the HELPER's version, not the CLI's (RUSH-3230). installAndStartService stamped getCliVersion() as the installed helper's version, and menubarSetupStale() compared against getCliVersion() too. Once helpers gained their own version line that was wrong in both directions: every CLI release made an unchanged helper look stale and reinstalled it — recopying the bundle under the running helper, which KeepAlive then restarts (the #2109 storm: a new pid every 5-15s, 578 launches in one log) — while a genuinely newer helper at the same CLI version never looked stale at all, so it could never install. The stamp is now JSON recording what the helper actually IS: release with its helper version, or local with the source path + mtime for a dev build (menubar's build.sh hardcodes CFBundleShortVersionString, so a local build has no version to compare). Staleness compares like with like, treats a kind change (local <-> release) as stale, and never downgrades when the installed helper is ahead of the floor. A pre-JSON stamp is stale exactly once and is re-stamped in the new format, so the migration cannot loop. agents menubar status / doctor now print three labelled lines — helper installed, helper available, CLI version — instead of conflating two axes into one, and the permanent false "(mismatch — agents menubar setup updates it)" hint is gone. Source: cli/src/lib/menubar/install-menubar.ts.

• The Windows helper's "asset missing" error names a tag that exists (RUSH-3230). downloadWinHelperExe built its error message from `v${version}` — the CLI's tag shape — while the URL it had just tried came from helperTag('computer-win', version). So a genuine 404 sent the reader looking for v1.0.0, which does not exist, instead of computer-win/v1.0.0, which does. The mac path was corrected when helpers moved to their own tags; the Windows path was left behind. Also drops a getCliVersion import that had no call site — the last trace of the old CLI-version coupling in that file. Source: cli/src/lib/computer/ssh-tunnel.ts.

• Claude status-line delegate no longer fork-bombs the machine. The delegate self-reference guard compared the saved command against the exact literal agents __claude-statusline, so a delegate seeded with the same private subcommand under a different binary name (e.g. agents-dev __claude-statusline from a dev install, or an absolute path) was not recognized as us. Every status-line render then spawnSynced that command, which read the same delegate and spawned another — unbounded recursion. Observed on a real box: ~4,900 live node __claude-statusline processes accumulated over a 2-day uptime, exhausting 96 GB of swap and driving load past 300, so keystrokes lagged. The guard now matches the __claude-statusline subcommand under any binary name or path (isStatusLineSelfReference), installClaudeStatusLine refuses to persist such a command as a delegate (and deletes an already-poisoned delegate on re-install), a AGENTS_CLAUDE_STATUSLINE_DELEGATED env marker hard-caps delegation at one hop, and the delegate spawnSync now carries a 5 s timeout. Source: cli/src/lib/claude-statusline.ts.

1.22.50

Fixed

• Teams now persist observed teammate failure evidence and keep independent DAG branches moving. Placement, local/remote launch, cloud dispatch, dependency, and process-exit failures carry a stable code, sanitized message, exit code, retryability, and observation time in teams status text/JSON. A runnable node with a durable placement failure fails independently; a node blocked only by pool capacity or load stays pending with retryable evidence so a later wave can launch it. Descendants name failed or missing --after blockers instead of spinning until --max-waves. teams start (no --watch) reports teammates that failed during the wave in a Failed this wave section (JSON: failed[] with evidence) and exits non-zero when a wave produced only failures. Because a failed launch now keeps its record (evidence) instead of deleting it, re-running the identical teams add --name <name> after a failure requires teams remove <team> <name> first. Successfully resuming a failed teammate clears the prior attempt's evidence as the replacement enters running; a replacement that fails to launch restores the original terminal state and evidence intact.

• Register the Phoenix session with Prix after sync (PHNX-3257). A successful (non-dry-run) agents traces sync now fire-and-forget POSTs the Phoenix bearer to api.prix.dev/api/v1/traces/link, so the Prix web console can mint a token and serve live trajectories instead of fixtures. Scoped to the managed Phoenix backend only — a BYO/self-hosted AGENTS_TRACES_WRITE_TOKEN is never sent to Prix. Source: cli/src/lib/traces/sync.ts.

• Ship traces-daily-sync routine (PHNX-3258). Daily agents traces sync at 02:00 UTC to accumulate bucketHistory for drift signals; requires a device pin (agents routines devices traces-daily-sync --set <name>) before it fires. Source: cli/routines/traces-daily-sync.yml.

• --strategy balanced now spreads across your provider accounts, not just native logins (RUSH-3182). A setup-token or API-key account added with agents accounts add is now a first-class balancing candidate for every harness its provider can authenticate — claude, codex, grok, cursor, opencode (a harness with only a native login and no provider adapter, like kimi, keeps balancing its native logins). Before, balanced only rotated across accounts that sat in a version home, so a worker's shared setup-tokens never participated and --account couldn't select them. The run path folds those provider accounts into the candidate list and injects the picked one through the existing --account path (a setup-token still authenticates via CLAUDE_CODE_OAUTH_TOKEN); the other candidate consumers — the watchdog, session recovery, teams placement — keep the native-only list, so nothing else changes. On a box dominated by verified native logins a usage-less provider account is deprioritized until the daemon fetches its usage; on a worker (setup-token majority) it participates immediately. Source: cli/src/lib/accounting/account-pool.ts, cli/src/lib/accounting/account-pool-collect.ts, cli/src/lib/accounting/rotate.ts, cli/src/commands/exec.ts.

• The attestation producer skips the helper manifest by default too (RUSH-3216). release.sh gained --with-helpers so an ordinary release does no helper work, but release-attestation-produce.sh kept the same unconditional release-manifest.sh verification — so the coupling survived one step upstream. Found live: a one-line comment fix in native/computer-mac/scripts/build.sh (an apps/cli/ → cli/ path in prose) changed that helper's input digest and aborted an otherwise-clean 1.22.49 attestation, for a helper the tarball no longer ships and the CLI resolves from its own tag. The producer now takes the same --with-helpers flag, default off. Source: cli/scripts/release-attestation-produce.sh.

• scripts/publish-computer-win.sh — a publish path for the Windows helper (RUSH-3228). Its release now triggers on computer-win/v<x.y.z> rather than the CLI's v* tag, but nothing in the repo cut such a tag, so the trigger would have been dead — trading a wasteful 165 MB rebuild on every CLI release for no rebuild at all. The tag is the publish action (release-exe builds, smokes on a real windows-latest runner, and uploads the exe + sha256), so a mis-shaped tag is a silent no-op: the script refuses a v-prefixed or non-semver version, refuses an existing tag because the upload uses --clobber and an installed CLI may already pin it, and is dry-run by default. Symmetric with publish-computer-helper-mac.sh. Source: cli/scripts/publish-computer-win.sh.

• scripts/test.sh --shard <n> — fan the suite across n fleet workers (RUSH-3230). Uses vitest's own --shard=i/n, drawing workers from the same auto pool a single --device auto run uses, so role=worker/role=personal marks govern the fan-out too. This is the change that moves release time, and the reason is arithmetic: a measured full run is 3,079s of CPU at 11.5× parallelism on one box, so wall equals CPU/workers (269s) — the suite is throughput-bound, not bound by any single slow file. Adding boxes divides the CPU: 3 ≈ 93s, 6 ≈ 47s, 9 ≈ 31s. Shards run concurrently and every one is waited on before reporting, so a failure in one does not hide the others. Requires agents ≥ 1.22.49 for devices pick --json; an older CLI fails naming the version and the fix rather than passing through a commander error. Source: cli/scripts/test.sh.

• scripts/test.sh --devices a,b,c — name the shard workers explicitly (RUSH-3230). Pins the fan-out to known-idle boxes instead of auto-picking, and skips the devices pick --json dependency, so sharding also works from a machine whose installed CLI predates 1.22.49. Source: cli/scripts/test.sh.

• --shard fails loud on a count below 2 and on a conflicting target flag (RUSH-3230). --shard 0 previously passed the numeric check, ran zero shards, and still printed All 0 shards passed. with exit 0 — a false green that reported success having run no tests. It now requires at least 2 (a single worker is --device auto). Separately, MODE was last-write-wins with no cross-flag validation, so --shard 6 --device box silently dropped one of the two purely on argument order; conflicting target flags now die naming both. Source: cli/scripts/test.sh.

• --devices obeys the same 2-worker floor, and is validated before prerequisites (RUSH-3230). --devices onebox derived the shard count from the list length and skipped the floor entirely, running a one-shard fan-out. The list is now resolved and checked immediately after argument parsing rather than inside the dispatch branch, so a bad invocation reports its own problem instead of dying on a missing rsync first. Source: cli/scripts/test.sh.

• Split ssh.device-config.test.ts, the second-slowest file (RUSH-3230). 18 subprocess tests in one file at ~44s locally (151s on a loaded worker) — 8.4s per test. Now three files along its existing describe boundaries (per-device config / fleet-wide defaults + role + describe / retired-subcommand tombstones) over a shared device-config-test-harness.ts: 45s → 19s wall, all 18 tests still passing, none changed, skipped, or dropped. Source: cli/src/commands/device-config-test-harness.ts.

• Split daemon.test.ts, the suite's floor (RUSH-3230). It was 35 subprocess tests in one file at ~53s locally (159s on a loaded worker) — the slowest file in the repo, and therefore the whole suite's floor, because vitest parallelises across files and runs one file's tests sequentially in a single worker. Now three files by theme (command surface / services + webhooks / doctor + logs) over a shared daemon-test-harness.ts, so they run concurrently: 53.5s → 26s wall, all 35 tests still passing. No test was changed, skipped, or dropped. Source: cli/src/commands/daemon-test-harness.ts.

1.22.49

• Check CLI benchmark numbers into docs/benchmarks.md (RUSH-2385). Commander-bootstrap and audit-hook means from the yosemite-s1 vitest bench (PR #2349) plus pointers to OPT-01/OPT-02 live in git. Linear is not the ledger. Source: cli/docs/benchmarks.md.

fix(view): keep Claude session/week quota slots aligned, render omitted windows as unavailable, and show only the unlabeled last-active timestamp

• No native binary ships in the npm tarball (RUSH-3100). Agents CLI.app (2.6 MB) and MenubarHelper.app (3.3 MB) were copied into dist/ by build, listed in files, and hard-gated by two prepack checks — so every Linux and Windows user downloaded 5.9 MB of signed macOS bundles, and the tarball could only be packed on a Mac holding them. All three are gone; helpers are fetched on demand from their own release tags and verified exactly as before (sha256 + Developer ID team + notarization + designated-requirement pin). Unpacked tarball: 21,337,724 → 15,629,419 bytes. build still clears any stale bundle from dist/ so an upgrade cannot leave one behind. This is what lets an ordinary release be produced without a signing Mac: the prepack gates required the signed .apps to be present at pack time, which is why the attestation was macOS-only. Both gate scripts are retained — they remain the right check for cutting a helper release. Source: cli/package.json.

• The attestation producer no longer seeds signed helper apps into its worktree (RUSH-3100). That seeding existed only because prepack refused to pack without them, so it was the workaround for the coupling above; its comments claimed "the prepack gates still decide … fails the pack exactly as before", which stopped being true the moment those gates were removed. Source: cli/scripts/release-attestation-produce.sh.

• Trace storage can now be deployed from the CLI (RUSH-3140). agents traces setup provisions the isolated agents-traces R2 bucket and Worker, uploads the canonical private trace Worker, binds its write and Phoenix identity secrets, enables its workers.dev route, and maps traces.agents-cli.sh.

• agents traces sync emits the rich Phoenix Evals index shard (RUSH-3142 M3). The per-device index.json now carries duration/error stats, ranked sessions needing attention, derived topic counts, and structured tool-failure counts split into real failures, repository guards, and auto-mode permission denials recorded on failed tool calls. Topic classification uses only session metadata plus tool mix and is lazily cached in a self-healing session_topics table keyed by transcript mtime + size; per-session trajectory JSON and the incremental upload ledger are unchanged. Source: apps/cli/src/lib/traces/{classify,sync}.ts, apps/cli/src/lib/session/db.ts.

• The offloaded suite no longer unpacks inside your DotAgents repo. scripts/test.sh --device shipped the tree to ~/.agents/test-runs/agents-cli — but ~/.agents is itself a git repo, so anything in the suite calling git rev-parse --show-toplevel resolved to ~/.agents instead of the shipped tree (release-manifest.test.ts went looking for ~/.agents/native/computer-mac/Sources and four tests failed with a confusing "helper input missing"), and the tree showed up as ?? test-runs/ in the operator's own repo status on every worker. The tree now lands in ~/.cache/agents-cli/test-runs/tree, which has no git ancestor — the same reason sandbox.sh's ~/workspaces choice never hit this. The shipped tree is still given its own blank git repo, because parts of the suite resolve paths from a repo root and would otherwise hard-fail. Source: apps/cli/scripts/test.sh, apps/cli/scripts/bound-repo-root.sh.

• scripts/test.sh — the suite is offloaded by default and can no longer land on your machine by accident. The full vitest suite pins a box for several minutes, and the only offloaded path used to be the test:remote package.json alias. Offloading was opt-in at each call site because scripts/sandbox.sh took a hand-composed command string rather than a verb, so every call site opted out: scripts/build.sh and scripts/release-attestation-produce.sh both ran bun run test on whatever machine invoked them. New scripts/test.sh is the one entry point — it offloads to a crabbox by default, takes --device <box> to run on any fleet Linux box, and runs locally only under an explicit, loudly-warned --here. When the offload target is unavailable it fails naming the exact --device command instead of silently falling back. build.sh and the attestation producer now both call it (the producer gains --test-device / --test-here), so a macOS signing box no longer doubles as the test runner just because a native helper needs notarizing. sandbox.sh gains the sibling projects' verb vocabulary (sandbox.sh test), which also fixes its bare default running bun install && bun run test at the monorepo root, where no test script exists. Source: apps/cli/scripts/test.sh, apps/cli/scripts/sandbox.sh, apps/cli/scripts/build.sh, apps/cli/scripts/release-attestation-produce.sh.

• A helper-only GitHub release no longer blocks the CLI release train. release-attestation-produce.sh seeded its helper manifest from gh release list --limit 1 — unconditionally the newest release. But not every release is a CLI release: the Windows computer-helper workflow publishes helper-only releases (assets computer-helper-win.exe + .sha256) into the same v<version> tag namespace. One of those shadows the last real CLI release, the manifest seed silently misses, every helper then reads as "changed", and the producer hard-fails on computer-mac — a helper it never rebuilds — with helper computer-mac input changed but this producer never rebuilds it. Observed live: v1.22.48 (helper-only, published 09:54Z) shadowed v1.22.47 and blocked the release. The seed now walks back through recent releases to the newest one that actually carries a release-manifest.json. Source: apps/cli/scripts/release-attestation-produce.sh.

• Watchdog, device-probe, self-heal, keychain-reap, and state-dir-check are now supervised daemon services (RUSH-3193 #3). These five bare setInterval timers in runDaemon() are now PeriodicServices registered on ServiceSupervisor, alongside secrets-broker, browser-ipc, account-state, session-index, and monitors — each gets the same per-tick deadline, error boundary, and park/backoff circuit breaker, and now reports measured health through agents daemon services instead of an inferred running (unsupervised) label. scheduler and webhook-receiver remain outside the supervisor (neither fits the PeriodicService shape — see cli/src/lib/daemon/AGENTS.md). Source: cli/src/lib/daemon/watchdog-service.ts, device-probe-service.ts, self-heal-service.ts, keychain-reap-service.ts, state-dir-check-service.ts, cli/src/lib/daemon/daemon.ts.

• agents daemon services shows every service's live health, with live enable/disable/restart (RUSH-3193 #4). The daemon services view now reports state / last-run / consecutive-failures / last-error for every supervised service (secrets-broker, browser-ipc, monitor-engine, account-state, session-index), not just the two socket services; --json gains the full service list while keeping the existing secretsBroker/browserIpc fields. agents daemon services enable/disable/restart <id> now take effect live through the supervisor instead of requiring a daemon restart. Source: cli/src/commands/daemon.ts, cli/src/lib/daemon-services.ts, cli/src/lib/daemon/supervisor.ts.

• Self-heal's staggered boot-time tick is restored (RUSH-3193 #17). The ServiceSupervisor migration (RUSH-3193 #3) fired every periodic service's first tick immediately at daemon start, including self-heal — dropping the ~30s post-boot stagger the old inline timer used so shims/PATH could settle before self-heal's first sweep, without making daemon launch itself busy. PeriodicService gains an optional startupDelayMs (default 0, no change for other services); SelfHealService sets it to 30s. Also fixes a stale comment on watchdog-service.ts claiming an SSH fan-out that runWatchdogPass does not do (it's host-local). Source: cli/src/lib/daemon/service.ts, cli/src/lib/daemon/supervisor.ts, cli/src/lib/daemon/self-heal-service.ts, cli/src/lib/daemon/watchdog-service.ts.

• Usage refresh is per-device — the usage.primary-host broadcast is gone (RUSH-3193 #15). Every host now reads its own usage directly from the provider APIs, so the old model where one primary device fetched fleet usage and SSH-broadcast a token-free derived envelope for subscribers to import is removed. The usage.primary-host config key (and its interactive.host fallback for usage) is deleted, along with the publisher/subscriber role split; each daemon runs the local usage refresh on every host. Source: cli/src/lib/daemon-ticks.ts, cli/src/lib/usage-fleet.ts, cli/src/lib/usage-refresh.ts, cli/src/lib/device-config.ts, cli/src/lib/config-keys.ts.

• Daemon service supervisor: per-service contract, error boundaries, deadlines, health (RUSH-3193 P1). The daemon's background services used to be bare setInterval closures sharing one event loop — a throw escaping a tick's local try/catch killed the whole daemon, and a hung tick (an unbounded SSH/keychain await) latched its overlap guard forever, silently freezing that one service for the daemon's life (observed ~51h). A new DaemonService/PeriodicService contract plus a ServiceSupervisor give every registered service its own timer, a per-service error boundary that can never propagate to process.exit, and a hard per-tick deadline that always releases the overlap guard even when the tick itself hangs; repeated failures park the service and retry it with exponential backoff while every sibling service keeps ticking, and supervisor.health() reports state/last-run/consecutive-failures for every registered service. The session-index warm service is migrated onto it as the first proof of concept — agents daemon services list now shows it as session-index. Other background services are unchanged; they migrate in follow-up PRs. Source: cli/src/lib/daemon/{service,supervisor,session-index-service}.ts, cli/src/lib/daemon/daemon.ts, cli/src/lib/daemon-services.ts.

• Managed Cursor accounts now use the account they display (RUSH-3196). Cursor runs and direct version aliases force Cursor's HOME-relative file credential store (~/.cursor/auth.json) inside the selected version home instead of silently falling through to one macOS Keychain login. Stale cli-config.json metadata no longer counts as signed in; existing Keychain credentials are left untouched and an unseeded managed version asks for Cursor's normal login flow.

• Grok billing events now reach agents view (RUSH-3197). The daemon publishes freshly collected local-event snapshots instead of rejecting every last_seen source as a failed refresh. Current Grok weekly meters cache normally; an expired or missing event tells the operator which grok@version to run once rather than leaving a silent plan-only gap.

• Rebuilt the internal documentation as a compact architecture and decisions corpus, with command syntax remaining generated from the CLI.

Added

• agents devices pick — prints the device automatic placement would choose for offloaded machine work: the least-loaded reachable POSIX box from the same auto pool agents run --device auto draws from, so role=worker / role=personal marks govern it. The name alone goes to stdout so scripts can consume it (box="$(agents devices pick)"); candidates and load go to stderr. --json adds every candidate and each exclusion reason. Fails loud with the excluded devices named when no worker is eligible — it never answers "run it locally".

Changed

• scripts/test.sh now auto-picks a fleet worker by default instead of requiring crabbox. --device auto says the same thing explicitly, --crabbox selects the previous disposable-crabbox path, and --device <box> / --here are unchanged. The old default needed the crabbox binary plus provider credentials, so the no-argument invocation failed on any box without them. An auto-pick that lands on the local machine runs in place without the --here warning when that machine is itself a pool worker.
• scripts/release-attestation-produce.sh gains --test-crabbox, so all three of test.sh's lanes are reachable from a release. It previously exposed only --test-device and --test-here, leaving a release on a box with no fleet worker in reach unable to ask for the disposable crabbox it can still use.

Changed

• Native helper downloads are decoupled from the CLI release. helper-download.ts used to build releases/download/v${cliVersion}/<asset>, keying every helper to the CLI's own tag. That was coupled in both directions: a CLI release had to re-stage every helper asset onto its new tag or the download 404'd, and a helper fix could not reach anyone without cutting a CLI release. Helpers now publish to their own tags (menubar/v1.0.0, keychain/v1.0.0, computer-mac/v…) and the CLI records a per-helper floor in helper-versions.ts — the build it was tested against, and the immutable tag it falls back to offline.

Fixed

• The keychain helper download could never have worked. GitHub rewrites a space in a release-asset name to a dot on upload, so an asset staged as Agents CLI.app.zip is served as Agents.CLI.app.zip while the CLI requested the spaced name — a permanent

  404. The asset is now published as Agents_CLI.app.zip: a name GitHub preserves verbatim, chosen deliberately rather than mirroring GitHub's rewrite (matching Agents.CLI.app.zip would work only for as long as that normalization rule holds). helperAssetUrls additionally refuses any spec whose asset name contains a space, rather than minting a URL that cannot resolve. The extracted bundle directory keeps its space (Agents CLI.app) — that is the on-disk bundle name macOS and the TCC grant key on, and it is unchanged.

• The Windows helper exe is decoupled too. ssh-tunnel.ts is a separate implementation that never routed through helper-download.ts, and it still keyed computer-helper-win.exe to v${cliVersion} — the identical coupling, meaning every CLI release had to re-stage a ~165 MB binary or the download 404'd. It now resolves computer-win/v<x.y.z> from the same floor table.

Removed

• release.sh no longer stages helper fallback assets onto the CLI's own tag, and no longer gates a release on one. With helpers resolving from their own tags, those assets were work nothing reads — and the keychain one was republished on every release under Agents CLI.app.zip, a name GitHub rewrites to a dot and no client can fetch. The hard die on a missing ComputerHelper.app.zip is gone with them: it would have failed an otherwise-good release over an asset the runtime no longer consults.

Fixed

• The menu-bar helper build could emit a Developer-ID-signed bundle that was never notarized, and say nothing. Notarization was gated on [ "$MODE" = "release" ] && [ "$SIGN_ID" != "-" ], so any invocation without the release argument on a machine holding a Developer ID produced a real signed bundle, passed every self-test, and exited 0 — while spctl reported rejected / source=Unnotarized Developer ID with no stapled ticket. Gatekeeper on macOS 26+ rejects such a bundle as "damaged" and crashes AppKit at launch. The three credential guards meant to fail loud on missing Apple creds also lived inside that branch, so they were unreachable in exactly the case that needed them. The gate is now the signature ([ "$SIGN_ID" != "-" ]): a Developer-ID signature always implies notarization, whatever the mode. Ad-hoc builds are unchanged — they cannot be notarized by construction and prepack already stops them shipping.

  A credential-less debug build on a machine that holds a Developer ID now signs ad-hoc (with the .dev bundle id) instead of failing: SIGN_ID is auto-detected from the keychain, so demanding notary creds unconditionally would have broken the local build loop on every signing-capable Mac. The downgrade is resolved before Info.plist is written — a late one would emit an ad-hoc bundle carrying the production bundle id and poison the user's Accessibility grant. MENUBAR_HELPER_SIGN_ID=- remains the explicit opt-out and is now documented in the script.

Fixed

• The full test suite was red on main, and pull-request CI could not see it. A top-level await import('bun:sqlite') in src/lib/sqlite.ts made that module un-lowerable to CJS, so every test that spawns a subprocess through tsx died at transform time with Top-level await is currently not supported with the "cjs" output format — 49 failures across 7 files, none of which touch SQLite. Both runtime arms now load through createRequire, so there is no top-level await to lower. The specifier is held in a variable rather than written inline, keeping the off-Bun collector from trying to resolve a module that only exists under Bun (what the old as string cast did for the dynamic import).

  This mattered beyond the suite: release-attestation-produce.sh runs the full suite fail-closed, while PR CI runs only the tests selected for a diff. A failure outside every recent diff's selection is therefore invisible until release time, where it blocks the attestation and with it any publish.

Fixed

• Restored operator-facing master-key custody guidance to docs/secrets.md. The docs reset (2d96d05d6) rewrote the page from a manual into an architecture summary and dropped the section that names the machine-local key path (~/.agents/.secrets-key/passphrase), states that resolution is non-interactive, points headless sync at AGENTS_SYNC_PASSPHRASE rather than the master key, and forbids exporting the master key from a shell rc file — the exact advice that caused RUSH-1968 on seven machines. Four docs-hygiene guards had been failing ever since, which is the alarm working as designed rather than test staleness.

• Restored the **Severity rubric** section to docs/observability.md, removed by the same reset. doctor-findings.test.ts pins this prose copy against FINDING_SEVERITY, so its absence meant the docs-cannot-drift guard was simply not running.

• add-targets-user-repo.test.ts no longer enumerates the state.js surface. Its partial mock hand-listed every export, so adding getCliVersionCachePath to state.ts took the whole file down with No "getCliVersionCachePath" export is defined on the mock. It now spreads importActual and overrides only the directory resolvers it redirects, so a new export cannot break it again.

• release.sh --with-helpers — an ordinary release publishes the CLI and nothing else (RUSH-3216). Two couplings survived helpers moving to their own tags, and both are now behind this opt-in (default off): staging ComputerHelper.app.zip onto the CLI's v<version> tag, which publishes an asset no client requests; and release-manifest.sh require, which re-derives every helper's input digest and aborts when one moved without a rebuild — failing a good CLI release over Swift the CLI does not ship. Source: cli/scripts/release.sh.

• A new release.sh flag is inert until it is merged (RUSH-3216). release.sh execs release-worktree.sh, which checks out origin/<default> and re-runs the script from there, so the second parse is the merged copy and an unmerged flag dies as unknown flag even though the local parser handles it. Pass --orchestration-phase to skip the re-exec when exercising a new flag pre-merge. Source: cli/scripts/release.sh.

• Managed share URLs use your Phoenix handle, not a UUID (RUSH-3224). agents artifacts share now publishes to share.agents-cli.sh/<handle>/<slug> where <handle> is the local-part of the signed-in email ([email protected] → muqsitnawaz), and the default slug is <readable>-<16hex> (a short view-id). Owner metadata is still the Phoenix userId; the Worker 403s a PUT to someone else's handle and 409s if two accounts collide on the same local-part. HTML publishes rewrite Chrome-saved file://…#section TOC links to in-page hashes and inline local sibling images as data URIs, so a self-contained plan (including a 1 MB page with embedded screenshots) stays viewable after upload. Source: cli/src/lib/share/{backend,worker-template,html,publish}.ts.

• A remote interactive --device run now prints its session id as it connects (RUSH-3227). When Claude (or a resume) already has a real id before the TTY is taken, stderr shows Session <uuid> on <host> and agents sessions resume <uuid> so the id exists while the connection is live, not only after OpenSSH closes. A launch id is not printed as a session id. Source: cli/src/lib/hosts/reconnect.ts, cli/src/commands/exec.ts.

• A remote interactive session that closes now prints its id (RUSH-3227). After agents run --device (including --raw), sessions focus/resume over SSH, or a remote tmux attach ends, the CLI writes the full session id and agents sessions resume <id> under OpenSSH's Shared connection … closed. line, so a dropped tab is not a bare shell. Auto-reconnect still swallows the 255 it will retry; this fires only when the user is actually back locally. Source: cli/src/lib/hosts/reconnect.ts, cli/src/commands/{exec,go,focus,resume,attach,sessions}.ts, cli/src/lib/session/remote/remote-list.ts.

• Re-pin the keychain helper to the binary that actually shipped in 1.22.47. scripts/verify-keychain-helper.sh compared bin/Agents CLI.app to beb02d…, but @phnx-labs/[email protected] and keychain/v1.0.0 both contain a49080…. Linux npm pack therefore died at prepack and blocked every release attestation. Same class of fix as #835 / #912. Source: cli/scripts/Agents CLI.app.sha256.

• A session with no observer no longer reports as healthy (RUSH-3125). classifyHostLink decides a session's host link from two local signals — the owning IDE window's heartbeat and tmux's attached-client count — and when it had neither it fell through to connected. That is the wrong default for a detector: the rows it silently blessed were exactly the ones with no observer (a bare terminal, a team spawn, a cloud task, or any --device session whose pane lives on another machine, since every signal it reads is local). There is now an unknown link, which says the question is open rather than answering it; connected is returned only on positive evidence — a counted client or a republishing window. unknown is not a loss signal: it never promotes a status, and it no longer clears a derived attached presence, so a plain terminal session you are sitting in keeps its marker. Everything else is unchanged and deliberately so — a deliberate agents sessions detach is still excluded first, tmuxClients === 0 is still authoritative, an absent client count still never reads as zero, and per SES-18a a running session still keeps its status. Source: cli/src/lib/session/host-link.ts, cli/src/lib/session/active.ts, spec SES-18a.

• A tmux status bar can show which agent session a pane is running — and never a fabricated one. agents run wraps an interactive agent in a tmux session named ag-<agent>-<8 chars>, built from (options.sessionId ?? randomUUID()).slice(0, 8) (cli/src/lib/exec.ts). Reading those 8 characters as a session id is quietly wrong: the launcher pre-assigns an id only for Claude, so on a box running two harnesses ag-claude-c8c4a2c8 carries a real, resumable short id while ag-codex-364cd550 carries a throwaway that resolves to nothing — and the two are indistinguishable on sight. createSession now stamps two session-scoped tmux user options, @ag_session_id and @ag_agent, so a format like #{?#{@ag_session_id},#{@ag_session_id},#{@ag_agent}} renders a real handle where one exists and falls back to the harness name where none does, instead of printing something agents sessions <id> would reject. The id is published only when the harness actually received it — a new isHarnessKnownSessionId mirrors the two branches in buildExecCommand that put an id on the command line (a native resume on any harness with a resume spec, and Claude's create-with---session-id), so agents run codex --session-id X without --resume, where X never reaches codex, correctly publishes nothing. This is the in-tmux counterpart to the existing name-parsing recovery tier (shortIdFromName + resolveNamesToSessionIds in cli/src/lib/session/active.ts), which validates a short id against the session DB; a tmux format cannot do a DB lookup, so the option carries the answer instead. Best-effort throughout: a failed stamp never fails a launch, and an unset option renders empty. Source: cli/src/lib/tmux/session.ts, cli/src/lib/exec.ts.

traces: drift signal for topic buckets

agents traces sync now computes a drift signal for each topic bucket by comparing today's error and stall rates against a 14-day rolling history stored inside the shard. Buckets that cross a 0.20 absolute-delta threshold are marked degrading or improving; the rest are stable. Buckets with fewer than 3 historical days are skipped to avoid noise on fresh deployments.

The shard now carries two new fields:

• bucketHistory — rolling 14-day array of per-bucket BucketStats (errorRate, stallRate)
• driftSignals — DriftSignal[] for the current sync, sorted by errorDelta descending

--dry-run --out <dir> seeds history from the previously written index.json in the output directory, so successive local runs accumulate signal without hitting the network.

• agents traces sync --dry-run --out <dir> computes the derived trace shards from your local sessions.db and writes them to a directory — no Phoenix sign-in, no worker, no upload — so you can verify your real trajectories before the hosted path is wired.
• The per-session drill-down (sessions/<id>.json) now emits a SessionDetail (a meta summary — spanMs/turns/tools/errorCount/tokens/cost/outcome/repo — plus a plain-language whereItWentWrong) that the Phoenix Evals console consumes directly, instead of the raw internal trajectory shape.

1.22.48

• On your own machine, every Claude run uses your normal login — not the worker setup-token (RUSH-2395). The credential now follows device role, not run mode. A device marked config.role: personal (your interactive box — set it with agents devices role <name> personal) authenticates every Claude run from its per-version login, whether it opens a TUI or is a headless one-shot like agents run claude "fix the bug". Before, the choice keyed only on whether a prompt was present ("this opens a TUI", not "a human is present"), so a headless run on your laptop grabbed the reserved auth-bundle setup-token and took the session off your login — surfacing as /status reporting Auth token: CLAUDE_CODE_OAUTH_TOKEN. The setup-token stays the credential for headless runs on worker devices (and unmarked boxes), which have no keychain login to defer to. Routines follow the same role gate. Source: apps/cli/src/lib/harness/adapters/claude.ts, apps/cli/src/lib/exec.ts, apps/cli/src/lib/daemon/runner.ts, apps/cli/src/lib/device-config.ts.

• A hand-cut release no longer dead-ends on a fresh attestation store or a lost RELEASE_ATTESTATION_DIR (RUSH-2970). Three traps that cost roughly eight failed release attempts across 1.22.43-1.22.46 are fixed at the source. (1) release-attestation-produce.sh now seeds release-manifest.json from the last published GitHub release before falling back to an empty one — a fresh store had no recorded computer-mac inputDigest, so the helper loop read "input changed" and told the operator to run publish-computer-helper-mac.sh, which does not write a manifest, so the instruction looped forever on a byte-identical helper. (2) release-worktree.sh now exports RELEASE_ATTESTATION_DIR to the caller's store when it is unset: the throwaway release worktree resolved its own empty .release-attestations, so require reported missing exact attestation key with ? for every key component — which reads like a key mismatch rather than a wrong directory. An explicit export still wins. (3) publish-computer-helper-mac.sh now sources headless-sign-context.sh itself: its own documented invocation (agents secrets exec apple.com -- ...) injected the notary creds but left the Developer ID signing keychain locked, so a headless publish died in codesign with errSecInternalComponent unless the operator knew to source that context first — which nothing said. On a Mac without the release-box pass files it is a no-op. Source: apps/cli/scripts/{release-attestation-produce,release-worktree,publish-computer-helper-mac}.sh.

• Session rows show what the agent DID, and dead crash-orphans stop piling up (RUSH-3011). The agents sessions watch --json row (which the AGI EXT Fleet reads) now carries a recap so a row reads as the agent's work, not its stale first prompt: title follows a best-source-wins ladder — a /rename/harness label (which also holds an agent-generated title) → the last agent line → the first-prompt topic — and recapSource ('label'|'last'|'prompt') names which rung won, so a session that produced work shows an agent-derived line. The first user turn is cleaned into userPromptClean/userPromptKind (with lastAgentLine exposed) so a screenshot path folds to [image], a pasted $ cmd to the command, and a /skill install path to /<name> — path noise never shows on the "You" line — and the recap card's Prompt: line uses the same cleaning. Separately, a crash-leaked --device tunnel session that is genuinely dead and days-stale (abandoned + dead pid) is folded OUT of the reconnectable set (resumable: false, recovery: null), so the "Needs reconnecting" list stops ballooning; a live pid (idle-but-unfinished) or a recently-closed session is never reaped. Source: apps/cli/src/lib/session/{prompt,active,render}.ts, apps/cli/src/lib/session/remote/watch.ts, apps/cli/docs/sessions.md.

• Keep generated session names in label, separate from the first-prompt topic (RUSH-3011). Claude ai-title and /rename events now populate the canonical name field consumed by fleet clients, and an empty live metadata record can no longer erase an existing generated title or launch handle. Source: apps/cli/src/lib/session/discover.ts, apps/cli/src/lib/session/db.ts.

• fix(teams): observe AgentManager's fire-and-forget init rejection so a lost init race (dir removed mid-mkdir) fails the awaiting caller instead of crashing the process as an unhandled rejection — the flake that failed two fully-green release attestation runs

• Per-account 429 backoff + auth verdicts derived from fresh usage fetches — the last four 'usage unavailable' accounts recover (RUSH-3036). After the 20-min probe throttle shipped, four of eight Claude accounts still showed usage unavailable: the 429 backoff was per-PROVIDER, so the first account to hit its quota in a refresh pass parked claude entirely and every account after it in the loop's fixed iteration order was never fetched — the same accounts starved every pass. The backoff is now scoped per account (usage-backoff.ts records claude@<usageKey>.<deadline>; a provider-wide penalty still parks everyone, and callers with no account identity keep the old behavior). Second, the auth-health probe no longer spends a second request on the same endpoint: a fresh (≤20 min) successful usage snapshot is the same authenticated request with the same shared setup-token, so probeAuthHealth derives a live verdict from it and only fires a network probe when no fresh evidence exists — roughly halving fleet endpoint load. agents devices ping --strict passes forceLive, which skips the derivation entirely — its contract stays a genuinely live request that surfaces revoked immediately — and derivation additionally requires a local credential (signedIn), so a fleet-imported snapshot on an unsigned home never reads as live. The auth probes themselves are account-scoped too, so a probe 429 parks only its account. Source: apps/cli/src/lib/usage-backoff.ts, apps/cli/src/lib/accounting/usage.ts (UsageOptions.usageScope), apps/cli/src/lib/auth-health.ts (verdictFromFreshUsage), apps/cli/src/lib/usage-refresh.ts, apps/cli/src/lib/daemon-ticks.ts.

• agents menubar doctor no longer claims a healthy just-upgraded helper is "running the OLD binary" (RUSH-3038). The stale-process check compared a pid start time parsed from ps -o lstart, which prints whole seconds, against the installed bundle's sub-second mtime. restartMenubarHelperAfterSwap restarts the helper within the same second as the swap that triggered it, so a correct upgrade always tripped the strict <: on zion at 1.22.46 the pid started at …353000 and the bundle was written at …353700 — 700 ms apart, one second — and doctor reported the helper stale and told the user their Accessibility grant "may not be trusted", after an upgrade that had already restarted it onto the new binary. The bundle mtime is now truncated to the same whole second before comparing, so a pid that started in the swap's own second reads fresh while a pid a full second or more older is still caught. Source: apps/cli/src/lib/menubar/install-menubar.ts.

• agents run codex --mode auto stops prompting for approval. Codex declared only plan/edit/skip, so --mode auto silently degraded to edit — and edit is approval_policy="on-request", which asks before every command the sandbox denies. Every unattended caller that passes --mode auto (AGI EXT's agent launches, teams teammates, routines) therefore sat on an approval dialog nobody was there to answer. Codex now has a real auto: the agents-auto permission profile, identical sandbox to agents-edit (workspace, ~/.agents, the regenerable toolchain cache roots, network on), with approval_policy="never" — a sandbox-denied command surfaces to the model as a plain command failure it can work around instead of stopping the run. Autonomy is the approval axis only: auto does not widen the sandbox, and --mode skip remains the only mode that removes it. Interactive shim launches (a bare codex at your own terminal) still pin edit, where an approval prompt is the useful outcome. Source: apps/cli/src/lib/codex-policy.ts, apps/cli/src/lib/harness/adapters/codex.ts, apps/cli/src/lib/agent-spec/agents.ts, apps/cli/src/lib/exec.ts.

• Hooks can be scoped to a permission mode: new matches.permission_mode predicate (RUSH-3050). A hooks.yaml / subrule hooks.yaml entry may declare matches: { permission_mode: plan } (string or array) so the hook fires only when the harness reports that mode in the hook's stdin JSON (permission_mode, or Grok-style permissionMode). The predicate is deliberately fail-open on absence: a harness that never reports a mode (Codex, and most others — Claude Code is the one that does) keeps firing the hook, so declaring it never silently disables a hook fleet-wide. Enforced in both the TS reference evaluator (shouldFire()) and the generated shim gate, pinned together by the existing conformance suite. Motivating case: the plan-presentation Stop hook fired on every stop in every session and false-positived on ordinary answers that mentioned plans; it can now declare permission_mode: plan. Source: apps/cli/src/lib/types.ts (HookMatches), apps/cli/src/lib/hooks/match.ts, apps/cli/src/lib/hooks/cache.ts, apps/cli/docs/hooks.md.

• New device config key description — a one-line, fleet-synced answer to "what is this box FOR". agents devices config <name> description "gpu box — cuda 12.4" stores a single-line summary in the device's tracked ~/.agents/devices/<name>/agents.yaml under config.description, so it syncs to every machine via agents repo push/pull exactly as role does, and any box may set it for any device (shared visibility). Because it will be shown by the device-list renderer it is validated: a newline is rejected outright and the value is capped at 80 characters — over-long input fails with a readable error naming the cap, never a silent truncation. notes is unchanged: it stays the appended list of long-form operator scratch, and both key descriptions now state the distinction. Source: apps/cli/src/lib/device-config.ts.

• Dismissing a discovered device is now a fleet-wide fact (RUSH-3062). The ignore-list lived at ~/.agents/.history/devices/ignored.json — a gitignored, per-machine path — so a node dismissed on one box kept re-surfacing as an auto-discovery suggestion on every other box. It now lives in the tracked, synced central ~/.agents/agents.yaml under fleet.ignored, a list of { name, ignoredAt, ignoredOn } entries (who dismissed it, when, on which box — the read side for a future agents devices ignored). An ignored node is deliberately not a device, so it has no per-device doc; central agents.yaml is the established home (it already carries fleet.defaults). Writes go through the existing updateMeta path (withMetaLock + atomic write), and a malformed fleet.ignored block is still a hard error rather than a silently-emptied set. A one-shot migration folds any existing ignored.json into fleet.ignored (union by name, legacy updatedAt kept as ignoredAt) and removes the legacy file only after the central write lands; running it twice is a no-op. The loadIgnored / isIgnored / addIgnored / removeIgnored signatures are unchanged, so no call site churn. Source: apps/cli/src/lib/devices/registry.ts, apps/cli/src/lib/devices/config-migration.ts, apps/cli/src/lib/state.ts.

type: feat

Collect root-disk capacity in the existing device health probe and cache static hardware specifications for seven days.

type: feat

Put real capacity in the default agents devices list — a spec cell (cores / total RAM / total disk), a disk used column beside load and mem, and the per-device description as the tail column (truncated first on narrow terminals, then role; the numbers never truncate). Add agents devices describe <name> <text> (task-shaped sugar over the description config key) and agents devices ignored (dismissed nodes — when, and which machine dismissed them). devices list --json gains description and disk totals inside health (additive only).

• Interactive agents run now spawns directly by default (RUSH-3066). tmux.enabled is an explicit per-device opt-in for addressable panes instead of the default wrapper: the wrap's benefit (a unique %pane so agents sessions --active can tell co-located agents apart, and agents focus re-attaching without forking) accrues to the control plane, while the cost — mouse, scrollback and clipboard behavior — is paid by whoever is at the terminal. Turn it back on per device with agents config set devices.<name>.tmux on. --no-tmux and --disable-tmux remain compatible no-ops while wrapping is off.

type: fix

Make opt-in tmux-wrapped runs default to mouse interaction, OSC 52 system clipboard integration, and 20,000 lines of scrollback while preserving the user's tmux configuration.

• agents sessions trace --no-redact reads honestly in compare and lineage too (RUSH-3077). The single-trajectory footer already said Unredacted (local only) under --no-redact, but the compare (--compare) and lineage (--tree) renderers hardcoded a Secret-redacted footer regardless of the flag — claiming a redaction that never happened. Both now share the single-trajectory labelling logic (redactionLabel): compare derives it from the two compared trajectories' own redacted state (a mixed pair still reads redacted, never a false safe-to-share claim), and lineage takes the trace's redaction flag. Redacted-by-default output is unchanged. Source: apps/cli/src/lib/session/trajectory-html.ts, apps/cli/src/commands/sessions-trace.ts.

• BREAKING: the top-level agents usage command is removed (RUSH-3079). It was a second, worse surface for the same data agents view already renders — per-account quota/rate-limit usage with the account, version, and auth state beside it — and in practice most harnesses printed stale or "does not publish usage data" there. Use agents view (optionally agents view <agent>, --refresh for an explicit collection, --json for scripts). The name is retired: agents usage fails as an unknown command and never auto-corrects into a live command. The shared usage library behind agents view and rotation/backoff is untouched. Source: apps/cli/src/commands/usage.ts (deleted), apps/cli/src/cli/command-registry.ts, apps/cli/src/lib/startup/command-registry.ts.

• agents browser binds --device at start (RUSH-3086, RUSH-3087). --device stays on agents browser start and is rejected on later verbs; the starting machine records a local task → device index so type/click/screenshot --task post resolve the device without repeating the flag. A verb naming an unknown or killed task exits non-zero and lists the open tasks (real URL + device), and never opens a second browser. screenshot -o /path/x.png now writes exactly that path — the daemon still sandboxes its own cache, and the CLI copies out. Source: apps/cli/src/lib/browser/task-index.ts, apps/cli/src/commands/browser.ts.

type: fix

• An offline device keeps its spec cell (RUSH-3096). agents devices list rendered a down box as a bare ci-runner-fsn1 linux offline, because a failed probe wrote a row with no hardware facts over the cached one. Cores, total RAM, and root-disk capacity now survive an unreachable probe and render beside the offline marker — ci-runner-fsn1 linux 8c 16G 500G offline. Load, memory, and disk-used stay blank (there is no current reading for a box that did not answer), and the Fleet capacity footer still counts only reachable devices. Source: apps/cli/src/lib/devices/stats-cache.ts, apps/cli/src/commands/ssh.ts.

• The macOS keychain broker (Agents CLI.app) now has a download-on-demand fallback (RUSH-3100). The signed + notarized keychain helper still ships inside the npm tarball, but a release now also publishes an Agents CLI.app.zip GitHub release asset per tagged version. A machine whose tarball lacks the bundle fetches that asset for its exact CLI version on the explicit agents setup secrets path (and the upgrade self-heal) — verified by sha256 + codesign + Developer ID Team + notarization before install — reusing the shared helper-download machinery already behind the computer and menu-bar helpers. The secrets hot path (getKeychainHelperPath) stays synchronous and network-free: when no bundled helper exists it now fails loud pointing at agents setup secrets rather than a bare "reinstall". Unlike the menu-bar helper it pins no designated requirement, since keychain items are gated by the access-group entitlement + biometry, not a DR-keyed grant. Source: apps/cli/src/lib/secrets/download-keychain.ts, apps/cli/src/lib/secrets/install-helper.ts, apps/cli/scripts/release.sh.

• The menu-bar helper can be fetched on demand, mirroring the computer helper (RUSH-3100 Stage N). MenubarHelper.app is now ALSO published as a signed + notarized MenubarHelper.app.zip GitHub release asset, so a machine whose npm tarball lacks the bundle can fetch + verify it from the v<version> release. agents menubar enable / agents menubar setup download it when no bundled or local .app is present; a downloaded bundle is verified (sha256 + codesign --verify --deep --strict + Developer ID Team 2HTP252L87 + a designated-requirement pin on bundle id com.phnx-labs.agents-menubar + spctl notarization) before it is ever installed — the DR pin is what keeps the Accessibility grant alive across upgrades, so a substituted bundle is refused loud, never silently accepted. The .app STILL ships inside the npm tarball this release (bundled-first, download-fallback); the download runs only on the explicit enable/setup path, never on the every-invocation startup self-heal, which stays synchronous and no-ops when no local source exists. The download and verify machinery is shared with the computer helper in a new src/lib/helper-download.ts (no duplicated code path). Source: apps/cli/src/lib/helper-download.ts, apps/cli/src/lib/menubar/download-menubar.ts, apps/cli/src/lib/menubar/install-menubar.ts, apps/cli/src/lib/computer/download.ts, apps/cli/scripts/release.sh.

• Fix: the menu-bar helper's Accessibility row now reads "AGI Menu", not "MenubarHelper" (RUSH-3101). Since the RUSH-3076 grant-persistence fix, the compiled executable was still named MenubarHelper, and launchd execs that Mach-O directly — bypassing LaunchServices name resolution — so macOS fell back to CFBundleExecutable for both the Accessibility list row (blank icon) and the "would like to control this computer" prompt. The executable inside the bundle is now named AGI Menu; the bundle folder (MenubarHelper.app), bundle id (com.phnx-labs.agents-menubar), and designated requirement are all unchanged, so the existing Accessibility grant is unaffected by the upgrade. Every basename-matching check moved with the rename: classifyMenubarProcesses/installedExecutablePath (install-menubar.ts), the orphan-reap.ts protected-service regex, and the Swift side's SingleInstance.swift/ChildProcessSelfTest.swift, now reading a shared HelperIdentity.executableName constant. Source: apps/cli/menubar/Package.swift, apps/cli/menubar/scripts/build.sh, apps/cli/menubar/Sources/MenubarHelper/HelperIdentity.swift, apps/cli/src/lib/menubar/install-menubar.ts, apps/cli/src/lib/tmux/orphan-reap.ts.

• Fixed a module-initialization cycle that crashed any entry point reaching helper-download first. helper-download.ts imported two pure sha256 helpers (parseSha256Asset, sha256File) from computer/ssh-tunnel.ts, whose import graph runs browser/drivers/ssh → browser/chrome → secrets/* → secrets/download-keychain, which imports back into helper-download while it is still evaluating — before EXPECTED_TEAM_ID is bound. The result was a hard ReferenceError: Cannot access 'EXPECTED_TEAM_ID' before initialization thrown from secrets/download-keychain.ts:45, which took down the drift-sync apply path and the self-heal isolated-home sweep (both run real subprocesses) and blocked release attestation, since the producer runs the full suite fail-closed. The two helpers now live in a dependency-free leaf module, lib/sha256-asset.ts, so nothing in the download path pulls the ssh/browser/secrets graph in at module-init time. Source: apps/cli/src/lib/sha256-asset.ts, apps/cli/src/lib/helper-download.ts, apps/cli/src/lib/computer/ssh-tunnel.ts.

• agents accounts label reads like the task: label by <harness>@<version>, or pick from a list (RUSH-3126). Labeling the account behind a specific install used to require knowing its email — agents accounts label codex work --account [email protected] — even though the user is looking at agents view codex, which is organized by version. The first argument now also accepts <harness>@<version>: agents accounts label [email protected] work labels whatever account is signed in there, and the label stays bound to the account identity, so codex#work keeps selecting it after that account moves to a newer install. A bare-harness call with several signed-in logins opens an interactive picker (identity · default marker · versions) instead of erroring; the same account signed into multiple versions counts as ONE login, so it never demands a selector. Non-interactive callers keep the loud error, now naming both script-safe forms, and --account <email|id> still works. Passing both @<version> and --account is refused as contradictory. Source: apps/cli/src/commands/accounts.ts (groupLabelIdentities).

• Managed artifact sharing: sign in and publish with zero Cloudflare setup (RUSH-3135, Phase 1). Signed-in users (agents auth login) publish to the already-live managed endpoint at share.agents-cli.sh — the Phoenix access_token from phoenix-session.json is the bearer, so there is no R2 bucket, Worker, or write token to provision. share status, share list, share revisions, and unshare/share delete resolve through the same resolveShareBackend seam, so a managed-only user can see and take down what they just published instead of being told to run agents artifacts setup. share analytics is a scoped P1 exclusion (Cloudflare Web Analytics is BYO): a managed user gets a message naming that, not the generic "Not configured" error. The Worker verifies Authorization: Bearer against Phoenix ID (GET ${PHOENIX_ID_BASE}/api/v1/auth/me), stamps customMetadata.owner with the verified userId, and namespaces the R2 key by that userId so one user cannot write another's prefix. --visibility public|unlisted (default public) replaces the --unlisted/--private booleans; those flags stay as hidden aliases mapping to --visibility unlisted. Unlisted GET now sends X-Robots-Tag: noindex (it was already hidden from the gallery/list). org visibility is 400 — that is Phase 2. --meta owner= / visibility= / expires-at= is rejected client-side (those keys are Worker-stamped). BYO Cloudflare is unchanged: a static WRITE_TOKEN is still honored when the bearer matches it (checked first, so the platform endpoint may set both principals); AGENTS_SHARE_BACKEND=byo or a caller-supplied write token forces the BYO path while signed in. Already-provisioned BYO endpoints need agents artifacts share update to pick up the new Worker (template hash changed). Source: apps/cli/src/lib/share/{backend,worker-template,publish,delete,config}.ts, apps/cli/src/commands/share.ts.

• Managed share deploy wires PHOENIX_ID_BASE so Phoenix-bearer auth survives agents artifacts share update (RUSH-3138). Cloudflare's script-upload API clears Worker bindings/secrets wholesale; the managed Worker reads env.PHOENIX_ID_BASE to verify bearers at ${PHOENIX_ID_BASE}/api/v1/auth/me, so every update wiped it and Phoenix PUTs 401'd while BYO WRITE_TOKEN kept working. The deploy path now re-applies PHOENIX_ID_BASE as a secret_text after every script upload (same Secrets API as WRITE_TOKEN), sourced from the CLI's PHOENIX_ID_BASE (env, else the deployed Phoenix ID service). Pure-BYO deploys do not set it. Source: apps/cli/src/lib/share/{provision,backend}.ts, apps/cli/src/commands/share.ts.

• Security: the remote browser-control consent gate now covers the whole launch path. agents browser remote-control off (the default) was only enforced on the browser start command, but navigate, click, screenshot, evaluate and the other page verbs open a browser implicitly when the caller has no live task. A browser navigate --device <box> therefore opened a browser on a machine whose owner never opted in, while browser start --device <box> was correctly refused. The gate now sits in the daemon at the two points that can launch a browser (BrowserService.start and the create branch of resolveOrCreateTask), so every implicit-LAUNCH verb is covered. It does not cover attaching: a request naming an existing task (--task, or the single-match-by-caller path) returns before the gate and can drive that task's tabs. That is pre-existing and tracked separately — remote-control off means "no new browser", not "no access". The consent marker rides the IPC request rather than the daemon's environment: a daemon auto-started by a fleet-remote CLI inherits AGENTS_FLEET_REMOTE=1 permanently, and reading that would have refused every later local drive. Source: src/lib/browser/service.ts, src/lib/browser/remote-control.ts, src/lib/browser/ipc.ts, src/lib/browser/types.ts.

• agents browser profiles edit. An existing profile's description, endpoints, secrets, viewport, and binary could not be changed without deleting and recreating it — -d/--description existed only on create, and updateProfile() had no CLI caller at all. profiles edit <name> reuses create's flag spellings (minus -b/--browser, which keys the on-disk profile cache) and validates the merged record, so a binary edit re-resolves the browser path and a --target-filter edit re-checks the --electron gate. Source: src/lib/browser/profiles.ts, src/commands/browser.ts.

• profiles doctor flags a profile that resolves to the wrong machine's browser. A profile declared by one device but bound to cdp://localhost:PORT is evaluated on the machine running the command, so the name meant a different browser on every box — silently handing an agent a logged-out stranger instead of the credentialed profile it asked for. The check now names both the declaring device and this one. ssh:// profiles are unaffected: they address a host, so they mean the same browser from anywhere. Source: src/lib/browser/runtime-state.ts (identityLoopbackMismatch).

• Fixed: editing a profile's endpoint could collide with itself. The local port scan createProfile runs was never applied on update, and applying it naively would have failed every edit against the profile's own stored port. Extracted as assertLocalPortFree(profile, { ignore }) and now used by both. Source: src/lib/browser/profiles.ts.

• agents browser profiles rename <from> <to>. A profile could not be renamed at all: profiles edit refuses a name change because the name keys the on-disk runtime dir, every endpoint/fork dir derived from it, and the browser.profile pointer. The only route was delete-and-recreate, which silently abandons the browser's --user-data-dir — where a profile's logins live. On a real agent browser that is gigabytes of session state and every account it has ever signed into. rename moves the config (staying in whichever store it already lives in), moves every cache dir belonging to the old name, and repoints both browser.profile and browser.viewer when either pointed there — a dangling browser.viewer sends every artifact back to the OS default handler, which is the exact bug the viewer seam was built to fix. Refuses while the profile is in use, because moving a --user-data-dir out from under a running browser corrupts it; refuses when the name exists in BOTH stores, since rewriting one would leave the other listed under the old name with its data already moved away; and validates every destination BEFORE moving any of them, so a collision on the second endpoint cannot strand the first one's logins under a name with no config entry. os joins default as a name a profile may not take — it is the reserved browser.viewer value meaning the OS handler. Source: src/lib/browser/profiles.ts, src/commands/browser.ts.

• Profile-name validation is shared between create and rename. The shape rule lived inline in profiles create, so a second caller would have accepted names create rejects. Now assertRegistrableProfileName, which also refuses default — the reserved alias meaning "this machine's configured profile" (RUSH-2709), not a name. Source: src/lib/browser/profiles.ts.

• User-facing pages open in your configured browser profile, not the OS default. agents browser navigate honoured browser.profile and nothing else did: agents fleet login, agents devices lease, agents feedback, agents sessions trace --open, and agents browser sessions --open each shelled straight to open/xdg-open, so every one of them landed in whatever the OS handler happened to be — on a Mac with Arc set as default, all of them opened in Arc while the configured Comet profile sat unused. They now route through one seam (showUrl/showFile), which resolves the viewer once. This matters beyond tidiness: the configured profile is where the fleet's logins accumulate, so a page opened there is one you are already signed in for, and a login it acquires is inherited by every later agent. The seam does not auto-start the browser daemon: showing a page is a side errand, so blocking it on a cold start would be a surprising stall. Daemon already running -> the viewer; not running -> the OS handler. Source: src/lib/open-url.ts.

• New browser.viewer config key (device scope) — a profile name, or os to keep using the OS default handler. Unset follows browser.profile. Deliberately distinct from browser.profile: one is the profile agents drive, the other is the browser that shows you a page. Source: src/lib/device-config.ts.

• New show IPC action — opens a tab bound to no task, so the abandoned-task reaper never closes a page you are reading. That is the whole reason it is not navigate. Screenshots, PDFs and recordings still go to the OS app, where Preview and QuickTime are the better viewer. Source: src/lib/browser/service.ts, src/lib/browser/ipc.ts.

• New agents browser show <url|file> — the CLI entry point to that seam, so external tools (a renderer's --open, a script) can show a page in the configured profile instead of shelling to open. Use it instead of navigate for anything a person will read: navigate binds a task and the reaper closes a task's tabs. --os-browser forces the OS handler; --json reports where it landed. Source: src/commands/browser.ts.

• --device interactive resolves to the machine the human is at. --device auto picks a box by load; this picks the one box someone is actually looking at, pinned as interactive.host. It resolves in the shared host matcher rather than per command, so browser, run, sessions and secrets inherit it; teams and ssh resolve it explicitly because they leave the fleet passthrough before the matcher runs. A few narrower --device surfaces do not consult the matcher. None of them mis-routes: most fail loud, and devices harnesses filters to an empty result. Wiring them up is a follow-up. It exists because a skill cannot teach a host name: guidance that says "deliver it to " is wrong on every other fleet and stale the moment the pin changes, so agents were left inferring the target or skipping the step. A fixed token is something documentation can state literally and have be correct everywhere. When no host is pinned it refuses and names the command that fixes it, rather than falling back to the local machine — running on a headless worker with nobody watching is the exact failure the sentinel prevents, and it would fail invisibly. Source: src/lib/devices/interactive-host.ts.

• agents sessions stop <id> ends a live agent outright, and a tmux-wrapped agent no longer leaves an orphaned dead session behind (graceful shutdown, #5a/#5b). Two halves of one gap — a single close should tear down every layer (agent → tmux mux → tab):

  • New verb agents sessions stop <id> on the session-lifecycle axis (beside detach/attach): it stops the interactive process and tears down its tmux/mux session — reusing detach's exact stopInteractive teardown (kill-session when tmux-hosted, else SIGTERM→SIGKILL the pid) and resolution (remote sessions stopped over SSH, cloud/team refused) — but does NOT resume it headless. Use detach to keep an agent working unattended, stop when the work is over. AGI EXT calls it when a user genuinely closes an agent tab so the agent + mux shut down instead of lingering idle. Source: apps/cli/src/commands/sessions-stop.ts.
  • The tmux-wrap pane-died hook is now session_attached-aware (AGENT_HOOK_SCHEMA v6): with a client attached it detach-clients as before (so resolveAfterAttach reads the exit status, EXEC-23b unchanged); with no client attached it kill-sessions outright. A wrapped agent that exits unattended — a closed terminal, or a /exit after the user detached — previously left a dead remain-on-exit husk on the socket until the daemon's periodic reap, showing as an orphaned idle session. Source: apps/cli/src/lib/tmux/session.ts, apps/cli/src/lib/exec.ts.

• agents accounts list is grouped, aligned, and label-first (RUSH-3053). The native-logins section was a ragged, ungrouped wall — 15 logins in one flat list, no columns, no labels, opaque ids dumped raw. It now groups logins by harness (printed once per group), aligns label · identity · version into columns, marks the default account per harness with *, and prints the run <harness>#<label> / run <harness> --account <name> selector hints inline. Provider bundles keep their own aligned section. --json output is unchanged. This completes RUSH-3053's list-redesign track — the <harness>#<label> account selector itself shipped in 1.22.47. The renderer is extracted as the pure, unit-tested renderAccountList. Source: apps/cli/src/commands/accounts.ts.

type: breaking

Browser profiles now live only in each declaring machine's devices/<machine>/agents.yaml. The fleet registry is the read-time union of those files: a name declared once is identity-bearing, while the same name declared by several devices is fungible. Leftover central browser: entries are not claimed on first read — run agents browser profiles claim on the machine that hosts the browser. Only profiles that machine can actually launch are moved into its device file; the rest stay central until that machine claims them. A configured default that no device declares is now an error on agents browser start, not a silent fallback to a logged-out auto-chrome. profiles prune only considers profiles this device declares (--fleet is gone; deleting a peer's declaration is not possible).

type: feat

• agents browser profiles list shows WHERE, not a stored scope. The column is the devices whose own devices/<machine>/agents.yaml declares the name — true by construction, no field to drift. --json adds devices and kind (identity when exactly one device declares the name, fungible when several do). profiles add is an alias of create and prints Added "<name>" on <device> (port N). Source: src/commands/browser.ts.
• profiles doctor fails where on the original comet-local shape. An identity-bearing name whose endpoint is loopback, viewed from a box that is not the declaring device, exits non-zero and names both machines. Local binary/port/onboarding checks are skipped so they cannot paint a green local chromium over someone else's logins. ssh:// endpoints and fungible names are unaffected. Source: src/lib/browser/runtime-state.ts (identityLoopbackMismatch), src/commands/browser.ts.

type: breaking

agents browser no longer asks the caller which machine a profile lives on. The daemon reads the device-declaration registry: a name this machine declares connects locally; a name only other machines declare is tunnelled to a reachable declaring device (and the command output names which one); a name nobody declares fails loudly, listing similar names, and never auto-creates a logged-out local browser. Identity-bearing profiles share one connection (no Electron fork, no second chrome-data). Runtime keys are <profile>@<device> instead of <profile>@endpoint-N; leftover @endpoint-N dirs are renamed onto the new key.

• browser remote-control off now gates attaching to a running browser, not just launching one (RUSH-3064). PR #2932 moved the consent gate to BrowserService.start and the create branch of resolveOrCreateTask, closing the implicit-launch bypass — but the two early-return attach paths (an explicit --task, or a lone caller-identity match) returned before it, and tabAdd reached createPageTarget unconditionally. So on a machine whose browser was already running with live tasks, a fleet-remote caller could act in the owner's authenticated profile with consent off (agents browser tab-add --device <box> --task <name> — and task names are discoverable through the ungated status). The gate now sits at the top of resolveOrCreateTask, the one chokepoint every page/close verb resolves through, so a fleet-remote attach is refused exactly as a fleet-remote create already was. It stays per-request (IPCRequest.fleetRemote), never the daemon's env, so an auto-started daemon that inherited AGENTS_FLEET_REMOTE=1 never refuses a subsequent local drive. Local drives are unaffected. Source: apps/cli/src/lib/browser/service.ts.

type: fixed

A leftover local comet-local@endpoint-N chrome-data on a worker is no longer renamed onto the declaring device's key and attached over localhost when the daemon should tunnel. Identity-bearing browsers stay on the declaring machine.

type: fix

agents devices capture no longer wipes fleet.ignored — the captured manifest carries device dismissals forward instead of rebuilding the fleet block without them.

type: feat

• Deletion verbs normalize on remove (specific item) and prune (bulk stale), old spellings kept as hidden aliases. The CLI had drifted into seven different words for "delete" across groups — remove, rm, delete, gc, cleanup, plus prune. The canonical pair remove <name> / prune (already the pattern in commands, hooks, skills, versions) is now applied to the stragglers: agents route rm / agents devices rm / agents projects rm make remove the primary spelling (rm stays an alias); agents browser profiles delete → remove (alias delete); and the bulk-stale sweeps agents browser gc, agents lease gc, agents mailboxes gc, and agents routines cleanup become prune (each old verb stays a hidden alias). No invocation breaks — the old verbs still resolve; they just no longer appear in --help. agents secrets remove/delete (key vs whole-bundle) and agents artifacts share delete/unshare are deliberately left as-is: those pairs encode a real distinction, not drift. Source: apps/cli/src/commands/{route,ssh,projects, browser,lease,mailboxes,routines}.ts.

• An interactive --device agent now survives a dropped connection, and one blink no longer takes out every tab (RUSH-3125). A remote interactive agent was a direct child of the sshd session holding its TTY, so a brief network disruption SIGHUPed it and the in-flight turn was lost — while the auto-reconnect layer re-attached on the stated premise that "the agent is still running there." Durability had been gated on the peer's tmux.enabled, which defaults off (and was off across the whole fleet), even though that toggle is an ergonomics preference about tmux's mouse, clipboard, and scrollback at the local operator's keyboard. The two are now separate: the interactive dispatch exports AGENTS_REMOTE_INTERACTIVE=1 and the peer wraps the run in a detached tmux session regardless of the local toggle, so the agent outlives the link that carries it. --raw, --no-tmux, and AGENTS_NO_TMUX=1 still win, so the escape hatch keeps working over --device; a remote run on a peer with no tmux installed is now refused with an install hint rather than started as something a blink would kill. Separately, the interactive stream no longer rides the shared ControlMaster — ControlPath=cm-%C hashes only host/port/user, so every agent tab pointed at a peer shared one master and OpenSSH closes all its channels when it dies (six tabs on one socket, observed live). Probes and fan-outs keep multiplexing. Source: apps/cli/src/lib/exec.ts (shouldWrapInTmux → resolveTmuxWrap), apps/cli/src/lib/hosts/dispatch.ts, apps/cli/src/lib/types.ts.

type: feat

Feed attention is now modeled as an explicit lifecycle the CLI reconciles, the foundation for a feed-driven Needs-You surface. OpenBlock carries generation/source/state/sourceCursor (back-compatible — derived for existing blocks), the answer/continue/clear paths write a resolution tombstone before the block clears so a resolved ask can no longer silently resurrect, and a new pure reconcileAttention merges the open-block ledger, session lifecycle, and a CLI-supplied PR signal into one canonical AttentionItem.

• Stream and answer the canonical operator feed. agents feed watch --json now emits one versioned agents, attention, activity, and scope projection for thin clients, including retained peer rows across disconnects. agents feed answer <attention-key> atomically claims the first answer and routes it over the recorded reply rail; concurrent losers return already_answered without injecting twice. Pull-request attention is refreshed by the CLI on a bounded TTL. Source: apps/cli/src/lib/feed/{watch,answer,pr-status}.ts.

• agents auth help no longer claims plan tiers. The command's description now reads "the account layer behind team spaces" — there are no plan tiers — and its help notes state that signing in is optional: every local feature works with no account, and team spaces are the one thing an account unlocks. READMEs and docs updated to match, and license references now name FSL-1.1-Apache-2.0. Source: apps/cli/src/commands/auth.ts.

• The git-output tests no longer fail on any box that exports a git identity (unblocks the release attestation). git-output.test.ts's fixture authored its commits with -c user.email=…, but git's GIT_AUTHOR_EMAIL / GIT_COMMITTER_EMAIL environment variables outrank -c config — so on a machine that exports them (developer laptops and the agent fleet do) every fixture commit was silently re-authored to the ambient identity, collectCommits matched none of them, and four tests failed with a bare expected +0 to be 2. CI never caught it because its runners export no such vars, which made this a local-only failure that also wedged release-attestation-produce.sh — that script is fail-closed, so no attestation was written and no release could be cut from an affected box. The fixture now passes identity through the environment it builds for git, and always assigns those four vars so an ambient value can never decide fixture authorship. Verified by causation: the unchanged test is 4-failed with the vars set and 9-passed with them cleared. Source: apps/cli/src/lib/output/__tests__/git-output.test.ts.

• permission_mode_not was typed, documented, and silently inert — every gated hook fired anyway (RUSH-3116). The predicate shipped in shouldFire() (src/lib/hooks/match.ts:156), but nothing at runtime calls that function: the generated hook shim decides fire/skip with a hand-mirrored Python copy of the same logic embedded in src/lib/hooks/cache.ts, and the mirror was never updated. So matches: {permission_mode_not: plan} fell through to return True and the hook ran in plan mode regardless — fail-open, so nothing was left unguarded, but the predicate did nothing while still charging a Python gate subprocess per fire. Verified on published 1.22.47: MATCHES_JSON='{"permission_mode_not":"plan"}' against a permission_mode: plan payload printed FIRE, while the positive permission_mode control correctly printed SKIP. The Python gate now implements the negative form with the same fail-open-on-absence and camelCase (permissionMode) handling as the TS reference. Source: apps/cli/src/lib/hooks/cache.ts.

• The shim/TS conformance suite now pins itself to the HookMatches surface, so a predicate cannot ship half-implemented again. cache-matches.test.ts already cross-checked the shim's real bash+Python decision against shouldFire() "so the two implementations can't drift" — but only over a hand-written fixture list, and permission_mode_not had no fixture, so the suite stayed green through the drift. A new test reads the HookMatches interface out of types.ts and fails with the offending key name when any declared predicate has no conformance fixture; permission_mode_not, git_dirty and project_has were all uncovered and now have fixtures. Source: apps/cli/src/lib/hooks/cache-matches.test.ts.

• New hook predicate matches.permission_mode_not — gate a hook OFF in one mode without enumerating every other one. The existing permission_mode is an allowlist, so "run everywhere except plan mode" had to be spelled as a list of every other mode — and that list silently stops matching the moment a harness adds or renames one, which for a guard means it quietly stops guarding. The new predicate names the mode to skip instead, so an unknown mode still fires: the failure direction is "ran unnecessarily", never "did not run". Same fail-open-on-absence rule as its positive twin (a harness that reports no mode keeps firing), reads both permission_mode and Grok's camelCase permissionMode, and ANDs with the positive form when both are declared. Motivation, measured from ~/.agents/.cache/perf/perf.db: nine guards fire on every Bash tool call for a combined 292 ms before the command runs, across 285,667 recorded fires of which 284 (0.099%) changed the outcome — and four of them (merge-guard, pr-description-reminder, large-file-add-guard, git-require-clean-tree) cannot fire meaningfully during a planning turn. Source: apps/cli/src/lib/hooks/match.ts, apps/cli/src/lib/types.ts, apps/cli/docs/hooks.md.

• Interactive Claude on a keychain-less Linux worker now authenticates from an attached setup-token, instead of falling back to an empty per-version login and printing "looks logged out". Two gaps combined to break it: (1) generateVersionedAliasScript — the claude@<version> alias shim agents run actually invokes for a pinned/balanced version — carried a hand-copied subset of the config env that had dropped the Linux .oauth_token fallback block the main shim's claudeAdapter.shimConfigEnvBash has (the alias env now reuses that adapter block verbatim via VERSION_DIR, so the two can't drift again); and (2) nothing wrote the .oauth_token file the shim reads — it was referenced only by the read in the shim, never created — so the fallback could never fire. agents accounts attach <setup-token-account> claude@<version> now writes the resolved setup-token to <version-home>/.claude/.oauth_token (mode 0600) on Linux, a no-op on macOS where the credential lives in the keychain. Headless dispatch was unaffected (it injects the token via buildExecEnv); this fixes the interactive path only. Source: apps/cli/src/lib/installations/shims.ts, apps/cli/src/commands/accounts.ts.

• A regression test now pins the claude@<version> alias shim to the .oauth_token fallback, so the alias env cannot silently drop it again. generateVersionedAliasScript('claude', …) is asserted to contain the block, alongside the existing main-shim assertion. Source: apps/cli/src/lib/installations/shims.test.ts.

• agents run claude --interactive on a worker no longer prints a false "⚠ claude looks logged out" banner when it authenticates from a setup-token. The pre-launch check probed only native credentials (empty on a keychain-less worker), so it warned even though the shim's .oauth_token fallback authenticates the run. It now also treats a resolvable per-version setup-token as signed in (no-op on macOS, where the credential is in the keychain). Source: apps/cli/src/commands/exec.ts.

• A leased box that can't finish setup fails loud and is stopped, instead of provisioning a billed box that dies at "agents-cli is not set up". agents run … --lease ran agents setup on the fresh box with >/dev/null 2>&1 || true — output and exit both discarded — so a setup that never left ~/.agents/.system a git repo was invisible, and the agent then ran straight into the run-side gate (ensureInitialized) that refuses with "agents-cli is not set up". The bootstrap now gates on that exact postcondition: it captures agents setup's output, and if the system repo still isn't a git repo it prints the real cause and aborts (exit 97) rather than running the agent. A box this run provisioned whose bootstrap failed is stopped (even without --fresh/--keep-box) so unusable capacity doesn't bill until the idle-GC window; a reused box is never auto-stopped. A ~/.agents config-copy failure is now surfaced instead of silently swallowed. Source: apps/cli/src/lib/crabbox/lease.ts.

• New versions are licensed FSL-1.1-Apache-2.0. Use, modification, and redistribution remain free for every user. Offering agents-cli as a competing commercial product or service is barred. Each version converts to Apache-2.0 two years after it is made available. Already-shipped Apache-2.0 versions are unchanged. Source: LICENSE, apps/cli/LICENSE.

type: fix

AGI Menu no longer re-prompts for Accessibility on dev machines, and the clip-paste hotkey (Cmd-Shift-V) no longer depends on the grant at all. A locally-built (ad-hoc) menu-bar helper now signs under a distinct com.phnx-labs.agents-menubar.dev bundle id, so it can never poison the shipped app's Accessibility grant (macOS keys the grant to the bundle id and revokes it when a same-id binary fails the stored Developer-ID code requirement). An ad-hoc build also can no longer overwrite a healthy Developer-ID install when the recorded owner path vanishes. A release now hard-fails if the shipped helper's designated requirement ever drops the pinned bundle id or Developer ID team, since that would silently revoke every user's grant on upgrade. And when the grant is missing, Cmd-Shift-V now silently copies the host:path reference to the clipboard (press Cmd-V) instead of re-showing the system permission modal on every paste — auto-type stays on only where Accessibility is already granted.

type: fix

Cmd-Shift-V once again pastes the clip reference in a single keystroke. 1.22.47 decoupled the paste from Accessibility so it never prompted — but that meant an ungranted machine silently fell back to copying the token to the clipboard, so you had to press Cmd-V yourself (two keystrokes). The helper now prompts for Accessibility once per launch to restore the one-keystroke auto-type, then falls back to the clipboard silently if you decline (no per-paste nagging). Because dev builds now use a distinct .dev bundle id and the release pins the helper's designated requirement, granting it once sticks across upgrades — so a single prompt is all it takes.

• Auto-reconnect now works for every harness, not just Claude (RUSH-3125). When an interactive --device run lost its link, only Claude ever reconnected. Claude is handed a --session-id before launch, so its id survives the drop; every other harness's real session id is coined on the peer and was read back over SSH after the interactive stream returned — that is, over the link that had just died. The read failed exactly when it was needed, so the run had no id to reconnect with and the process exited straight to a bare shell. A Grok tab therefore showed nothing at all while a Claude tab beside it counted down. Reconnect now falls back to the launcher-minted AGENT_LAUNCH_ID, which is known before the connection exists and so cannot be lost with it, and the peer maps it to the real session with a purely local lookup. Codex, Grok, Kimi, Droid, Cursor, OpenCode and the rest recover for the first time. Source: apps/cli/src/lib/hosts/reconnect.ts (pickReconnectTarget), apps/cli/src/commands/exec.ts.

• agents sessions focus --launch-id <id> targets a run by the launch id its dispatcher minted instead of a session id, resolving it from that machine's own hook records. This is what makes the reconnect above work with no network at the moment there is none; it is also usable directly when you know the launch id but not the session. An unknown launch id fails loudly rather than opening the picker, so an automated reattach can never strand itself at an interactive prompt. Source: apps/cli/src/commands/focus.ts.

• The reconnect give-up notices name a command that still exists (RUSH-3125). When the retry window closed, all three notices told you to run agents reconnect <id> — a command deprecated and hidden in favour of agents sessions resume, so the advice printed at the one moment you needed something that worked was stale. They now name agents sessions resume <id>, or for a launch-id target the peer-side resolver, since no local verb accepts a launch id. Source: apps/cli/src/lib/hosts/reconnect.ts (recoveryHint).

• Reconnect waits minutes instead of 90 seconds, counts down, and Ctrl-C works (RUSH-3125). The retry budget was 6 attempts over a 2/4/8/16/30/30 backoff — about 90 seconds, shorter than a laptop lid close, a Wi-Fi handoff, a VPN or Tailscale re-auth, or a router reboot. Worse, timers are suspended across sleep, so on wake the whole backoff fired back-to-back before the network was up and the budget was gone in seconds. The bound is now a 15-minute wall-clock window over an unproductive streak, and it still resets the moment a reattach reconnects and holds — so a session that blinks all day keeps reconnecting, exactly as before. The notice counts the window down (Reconnecting in 30s · 12m14s left · attempt 7 · Ctrl-C to stop) rather than printing an attempt fraction that no longer says when it stops. Ctrl-C during the wait previously hit node's default handler and killed the whole process mid-notice, dropping you at a bare shell with no hint the agent was still alive on the peer; it now exits the loop cleanly (130) and prints where the agent is and how to get back.

• The terminal is restored after an interactive remote stream dies (RUSH-3125). ssh -tt leaves the local tty in raw mode, and an agent TUI killed by a dropped link never sends its own exit sequences — so focus reporting and the mode/colour-scheme reports stayed armed and the terminal answered back at a shell that was not expecting it, littering the screen with ^[[?997;1n ^[[I ^[[O. Those bytes were also still queued on the tty, so the next reattach handed them to the agent as if they had been typed. A stty -g snapshot is now taken before the spawn and restored after, the DEC modes a TUI arms are reset (focus, bracketed paste, alt screen, mouse tracking, cursor), and the input buffer is drained. Done in sshStream itself, so every caller that opens an interactive remote stream is covered. Source: apps/cli/src/lib/ssh-exec.ts, apps/cli/src/lib/hosts/reconnect.ts.

• A release no longer needs main to hold still — publish is decoupled from live main (RUSH-2395 audit). release.sh used to squash-merge the release PR into origin/main and then refuse to publish unless main's tree byte-matched the attested release tree — so any commit that landed on main during the release (or a CHANGELOG merge conflict) killed it, forcing a ~15-minute quiet window that a busy fleet rarely offers. It now tags and publishes the attested release commit itself — the exact tree CI attested and the tarball was packed from — and merges the version-bump PR asynchronously, after publish, best-effort. The published bytes are the attested tree by construction, so main can churn freely and the bump-merge can be deferred or hand-resolved without ever wedging the release. The attestation of the release-commit tree remains the sole functional gate; the tag push and publish routing stay lease-gated. The catch-up recovery path (registry behind a main already at the target version) is unchanged. Source: apps/cli/scripts/release.sh.

• Fixed: resolve-target.test.ts failed on any machine actually named mac-mini or zion. The fixtures wrote device declarations for two real fleet hostnames and then asserted the resolver would tunnel to them. On a box with that machineId() the resolver correctly reports the profile as locally declared, so the tunnel assertions failed — green on Linux CI, red on both Macs, which is where releases run. The suite is now hermetic: fixtures use peer-alpha/peer-zulu, keeping the sort order the "first reachable declaring device" assertions depend on. Source: src/lib/browser/resolve-target.test.ts.

• A session launched with a skill is no longer named after the skill's install path. Claude derives its generated ai-title from the first turn, so a session opened with /continue (or any skill) was named Base directory for this skill: /home/…/.claude/skills/continue — the scaffolding line the skill injects, not the task. That name lands in SessionMeta.label, which wins on every surface for the session's whole life: the interactive agents sessions preview header, --flat / --tree, the agents feed watch / sessions watch streams, the AGI EXT Fleet row, and the editor tab title. The generated title now goes through classifyUserPrompt and collapses to /<skill> when — and only when — the classifier reports that injected line. A user's /rename (custom-title) is never rewritten, including one that merely names a skills/… path. Fixed at the one point where the label is composed, so every reader inherits it with no reader-side special-casing. Not retroactive: transcript rescans are (mtime, size)-gated with no scan-version invalidation, so a session already indexed under the old derivation keeps its stored label until that file next changes and triggers a rescan — tracked in RUSH-3122. Scoped to Claude's ai-title; a harness that supplies its own title verbatim (e.g. Cursor's chatMeta.title) is unaffected and untouched (RUSH-3123). Source: apps/cli/src/lib/session/discover.ts (finalizeClaudeScan).

• agents sessions preview shows the fan-out a session left behind, on remote rows too (RUSH-3091, RUSH-3095). The Doing line now carries N sub-agents · N background shells. Both counts are persisted at scan time (sessions.sub_agent_count / background_shell_count, schema v40) rather than only recomputed per render, which is what makes them visible on a remote or unindexed row — that path renders from SessionMeta alone through formatMetaOnlyBody, so it had no events to derive from and silently showed no fan-out at all. A freshly derived count still wins when the caller has parsed events, since the column lags the transcript by one scan. Background-shell detection is a per-harness registry probed against real transcripts, not assumed: claude/kimi flag Bash with run_in_background, grok flags run_terminal_command with background; codex and droid record no such concept and cursor persists no tool calls locally, so those render nothing rather than 0 background shells — a zero would assert "none running" where the truth is "cannot know", and NULL (not scanned) stays distinct from 0 (scanned, none found) for the same reason. The counts mean "started / left behind", never "still running": a transcript records a start and never a death, the same trap agents devices ps documents, so live status stays with sessions --active. Source: apps/cli/src/lib/session/highlights.ts, apps/cli/src/lib/session/{db,discover}.ts, apps/cli/src/commands/sessions-picker.ts.

• agents sessions trace now reads newer Codex sessions by program, not a wall of "exec". Codex gpt-5.6-sol (codex ~0.145+) runs every shell command inside a JS cell — a custom_tool_call named exec whose code is await tools.exec_command({cmd:"git status …"}). The trace now unwraps that cell to the real shell command, so a Codex trajectory reads agents 68% · git 15% · scp 13% with git fetch origin / sed -n … steps and exit codes, exactly like Claude's Bash and Droid's Execute — instead of exec 100% with every step labeled exec. Genuine non-shell cells (tools.view_image, raw JS) stay labeled by their code. Source: apps/cli/src/lib/session/parse.ts (extractCodexExecCommand), trajectory.ts (SHELL_TOOLS).

• agents sessions trace compares two sessions. Pass exactly two selectors and the same command renders a compare: the two sessions' tool sequences aligned by tool name, the first divergence point (where the runs' tool order stops lining up), the steps each session ran that the other never did, and a per-session summary — in the same three renderings (HTML with stacked lanes on a shared time axis, compact text, and --json with layout: 'compare'). Three or more selectors, or --tree, still fail loud — lineage (a parent + its team) lands in a follow-up PR. Source: apps/cli/src/lib/session/trajectory-compare.ts, apps/cli/src/commands/sessions-trace.ts.

• agents sessions trace <id> --tree renders a team's lineage. The third layout of the trace surface, after the single trajectory and the two-session compare: the selected session and every session it spawned, drawn as a delegation graph. The edges are read from the session index, not inferred — a teammate's meta.json parent_session_id (teamOrigin.parentSessionId), with the team's agreed-on spawner (groupSessionsByTeam().spawnerSessionId) filling in for a teammate whose own record names none, bounded to that run's own spawn window so a second run of the same team name never adopts the first run's teammates; the edge carries which record established it. A node is always a real session: an inline Task/Agent sub-agent is a step inside one transcript and produces no session, so it is never drawn as a node. Each node carries its handle, harness, role, indexed tool count, span, PR number, and a recency class (active/idle/stale) — recency, not a success verdict, because nothing on a session row records whether the work landed. HTML draws a self-contained inline-SVG graph with clickable per-node summaries; --text prints an indented tree; --json emits layout: 'lineage' with a lineage: { rootId, nodes, edges, teams, unresolvedParentIds } block plus the root's trajectory. Selecting a child roots the graph at its topmost ancestor, so the whole team is always shown; a referenced parent outside the scanned pool is reported rather than dropped. Source: apps/cli/src/lib/session/trajectory-lineage.ts, apps/cli/src/lib/session/trajectory-html.ts, apps/cli/src/lib/session/trajectory-text.ts, apps/cli/src/commands/sessions-trace.ts.

• agents sessions trace v2 — a real session debugger, program-aware. The HTML view is rebuilt from a wall-clock waterfall (which crammed all activity into a sliver on long, idle-gappy sessions) into an analysis hero — where the time went, the slowest steps, the command/program mix, and error/idle KPIs — over a readable, execution-ordered step list with expandable output and clean idle-gap dividers. Every shell step is labeled by the effective program it ran (git, gh, agents, bun, sed… via the shared extractShellPrograms parser; sudo/env/agents ssh unwrapped, bare cd/export skipped) across every harness's shell tool — Claude's Bash, Codex's exec_command, run_shell_command, shell, Execute — so the mix reads git 94 · agents 81 · gh 75 instead of "Bash 98%". Process exit codes show on failures. The "where the time went" share is now keyed by program in both the HTML and --text renderers off one model field — a Bash-heavy run reads git 56% · gh 33% · agents 11%, never Bash 100%. --text and the --json step model gain additive program + exitCode fields, and the trajectory's toolTimeShare is renamed programTimeShare (program-keyed) in the --json envelope. Source: apps/cli/src/lib/session/trajectory.ts, trajectory-html.ts, trajectory-text.ts.

• agents sessions trace (alias agents trace) — visualize a session's trajectory. A tool-call waterfall over a real time axis (durations, errors, idle stalls, delegations) instead of scrolling the Markdown wall. One buildTrajectory() model, rendered three ways and auto-selected by audience: an interactive HTML page on your interactive host for a person, a compact token-bounded text trajectory for an agent (--text, --errors-only), and the versioned sessions-trace JSON envelope (--json) for tools. Single-session in this release; multi-session compare and team lineage follow. Redacted by default, self-contained HTML (no CDN). Source: apps/cli/src/commands/sessions-trace.ts, apps/cli/src/lib/session/trajectory.ts.

type: fix

• agents sessions trace steps read by what the command DID, not their cd prefix. A shell step's label now strips the leading throwaway statements — cd <repo> &&, export X=Y;, set -e, source …, and bare VAR=val assignments — so cd /long/path && git fetch origin renders as git fetch origin, and a multi-line script whose first line is cd <repo> shows its real command instead. Before this, most rows in a coding session rendered an identical cd [HOME]/…/<repo> and the trajectory was unreadable; now every row is distinct and agrees with its program badge. Pipelines are left intact and a command that is nothing but cd is shown as-is. Fixed at the model (buildTrajectory), so the HTML, text, and --json renderings all benefit. Source: apps/cli/src/lib/session/trajectory.ts.

• Trace durations roll into hours past 60 minutes. An overnight idle gap now reads 24h01m instead of 1441m18s, in both the HTML and the compact text renderings. Source: apps/cli/src/lib/session/trajectory-html.ts, trajectory-text.ts.

• agents view stops printing "usage unavailable" for a harness that reports a plan and no meters. Grok's collector writes a subscription tier with no usage windows ({plan: 'SuperGrok Heavy', windows: []}), and the cache deserializer treated "no fresh windows" as "nothing cached" — so --refresh rendered SuperGrok Heavy, the very next plain agents view grok rendered usage unavailable, and reading the row also deleted it. Both grok accounts were permanently stuck in the wrong state because the daemon's periodic refresh re-wrote a row that the next read destroyed. A cached row that carries a plan now survives with no windows; a row with no windows, no plan, and no refusal is still dropped, so an all-expired snapshot keeps pruning (RUSH-2858) and a meterless row can never read as a 0% bar or an available badge — deriveUsageStatusFromSnapshot still returns null for zero windows. Routing keeps the same guarantee from the other side: a windowless snapshot no longer counts as verified usage, so a meterless pool still spreads across its accounts instead of pinning to whichever one ran most recently. Source: apps/cli/src/lib/accounting/usage.ts, apps/cli/src/lib/accounting/rotate.ts (RUSH-3060).

type: feat

The watchdog decider is now an agent, not a heuristic script. Every idle session on the machine (its originating task + transcript tail) is handed to ONE agents run --mode plan call per tick, which judges each: idle-but-unfinished → nudge that drives it to finish; idle-and-done or genuinely-needs-human → skip. The deterministic pre-filter (isLikelyTrulyBlocked, completion/promise regex) and the per-session LLM spawn are gone — one bounded call per tick, only when something is actually idle. A nudge is booked in the cooldown ledger and logged nudge ONLY when delivery is confirmed; tmux/iterm/pty self-confirm, while vscodium's fire-and-forget --open-url is recorded undelivered until the swarm-ext extension acks the verb, ending the phantom-nudge ledger. agents watchdog history gains an undelivered row; the --smart flag is removed (the agent is always the decider). Defaults stay OFF.

• Claude usage now comes from normal Claude Code sessions. Managed Claude homes install a status line that records Claude's native five-hour and seven-day rate limits for the active account, so agents view claude gains fresh bars without reading or copying OAuth credentials. The status line also shows the hostname and active model and preserves any existing status-line command. Compact usage bars now render at one-eighth-cell resolution instead of exaggerating every nonzero value to at least 20%, and the trailing activity and authentication-probe ages identify which event they measure.

1.22.47

• agents traces sync pushes derived, redacted trajectories to your Phoenix account (RUSH-3140). A new agents traces command group increments over sessions.db via the file_mtime_ms gate (only sessions modified since the last sync are uploaded), computes a SessionTrajectory for each (steps + gaps + stats, no raw transcript text), applies redactSecrets() before PUT, and stores the result under <userId>/<device>/sessions/<id>.json in an R2 bucket guarded by Phoenix bearer auth — no public GET path exists anywhere. A per-device index shard (index.json) is updated on each run. Three subcommands: agents traces sync (incremental push), agents traces status (show last sync time), agents traces open (open the Phoenix Evals console). The traces Worker uses cache-control: private, no-store on every response. Source: apps/cli/src/lib/traces/{backend,sync,worker-template}.ts, apps/cli/src/commands/traces.ts.

1.22.46

• agents auth returns, against Phoenix ID instead of a sibling product's backend (RUSH-2581). 1.22.45 removed the account layer that authenticated against Rush's api.prix.dev. It comes back pointed at Phoenix ID (phnx-labs/phoenix-id), agents-cli's own account service: agents auth login runs a device-code flow whose browser page is Phoenix-branded and Google-only, agents auth whoami reports the signed-in account, agents auth logout clears this machine and nothing else, and the team surface nests as agents auth space (list/create/members/invite/role/remove). Everything goes through one new seam, lib/identity/ — one base URL (PHOENIX_ID_BASE), one session file, one HTTP funnel, one error type — replacing the shape that had the backend URL hardcoded in five files and the session token re-read by seven separate functions. agents-cli reads no other product's credentials: there is no ~/.rush/user.yaml fallback. Source: apps/cli/src/lib/identity/{client,index}.ts, apps/cli/src/commands/auth.ts.

• agents auth points at the deployed Phoenix ID service (RUSH-2581). The PHOENIX_ID_BASE default shipped naming id.phnx.sh, a domain that was never registered, so every agents auth login would have failed DNS with nothing behind it. It now defaults to the live service (a workers.dev URL until a custom hostname is attached). Override it with PHOENIX_ID_BASE to point at a local backend. Source: apps/cli/src/lib/identity/client.ts.

• The menu-bar prepack gate hard-fails on an unstapled or thin helper on any OS (RUSH-3031). verify-menubar-helper.sh's notarization check used to silently no-op when xcrun was absent — the exact case a Linux attestation-producer box hits — which let 1.22.44 ship a Dev-ID-signed but un-stapled, thin (single-arch) MenubarHelper.app that Gatekeeper rejected on every Mac. The gate now hard-fails when the stapled ticket (Contents/CodeResources) is missing and xcrun is unavailable, and hard-fails when the bundled executable is not a universal (fat) Mach-O binary, checked portably with od on any platform. Source: apps/cli/scripts/verify-menubar-helper.sh.

• The release-attestation producer no longer arms the real-~/.agents hermeticity guards it needs to get vitest's extended timeout profile (RUSH-3007). CI=true used to control both the vitest hookTimeout/ignore-pool-error profile AND tests/setup.ts's leak tripwires against the real developer home — so a producer run on a box with a live daemon (e.g. mac-mini) false-failed 129/129 test files on a fully green, 12,559/12,559-test suite. release-attestation-produce.sh now sets AGENTS_ATTEST_PRODUCER=1 (and unsets any ambient CI) to opt into the timeout profile without arming the guards; a genuine CI runner's behavior is unchanged. Source: apps/cli/scripts/release-attestation-produce.sh, apps/cli/tests/hermetic-guards.ts, apps/cli/tests/setup.ts, apps/cli/vitest.config.ts.

• Rotation remembers a tokens/credits-exhausted account instead of re-picking it every launch (RUSH-3018). A rate limit resets on a clock; running out of credits / hitting a spend cap does not — yet the two were conflated. A billing refusal (out of usage credits, monthly spend limit) was detected only to trigger one failover and then forgotten, so balanced rotation re-picked the dead account on the next launch, it refused again, failed over again — burning a launch each time. It now persists a clock-less out_of_credits marker per account (noteClaudeOutOfCredits), which the rotation eligibility gate treats as blocking until a later successful run on that account clears it (clearClaudeAccountRefusal) — never a timestamp. Session/rate limits are unchanged (still recover on their reset). Source: apps/cli/src/lib/accounting/usage.ts, apps/cli/src/lib/exec.ts.

• Harness capability probes can no longer leak grandchild processes (RUSH-3028). The version probe behind agents view (<cli> --version) and the async manifest check: runner executed third-party binaries whose own forked children could outlive the probe — the GitHub Copilot npm wrapper forks a platform-binary downloader into ~/Library/Caches/copilot, and under a redirected test HOME that survivor raced teardown rm (the dominant residual ENOTEMPTY suite flake after RUSH-3021). Probes now run in their own process group via probeCapture, and the whole group is reaped when the probe settles — on clean exit, on timeout, and on parent death (a process.on('exit') hook covers the CLI's hard-exit SIGINT path). On win32, where process groups don't apply, the direct child is killed on settle, matching the old execFile timeout behavior. Source: apps/cli/src/lib/probe.ts, apps/cli/src/lib/agent-spec/agents.ts, apps/cli/src/lib/cli-resources.ts.

1.22.45

• BREAKING: the Prix-coupled account layer is removed — agents auth, agents org, and the plan-tier gates (RUSH-2581). 1.22.42 shipped agents auth login/whoami/logout and agents org against the Rush product's backend (api.prix.dev), with entitlement.ts reading the Rush billing tier to cap accounts at 3-per-harness on free and to gate the agents insights friction sections. agents-cli's identity must not ride a separate product's login and database, so all of it is removed: auth and org are retired top-level names (they fail loudly, no auto-correct), account registration is uncapped again, agents accounts output drops the dormant field/suffix, and agents insights renders the full report with no plan/notice JSON fields. The Rush feature integrations are untouched (cloud/rush.ts dispatch, the opt-in secrets sync driver, the owner-notify transport). The replacement — agents-cli's own account backend with Phoenix branding, built for later Phoenix-ID consolidation — is tracked in RUSH-2581. Source: apps/cli/src/lib/{prix-account,entitlement}.ts (deleted), apps/cli/src/commands/{auth,org}.ts (deleted), apps/cli/src/commands/{accounts,insights}.ts, apps/cli/src/{bootstrap.ts,cli/command-registry.ts,lib/startup/command-registry.ts}.

• The menubar prepack gate fails closed off-Mac when the bundle has no stapled notarization ticket (RUSH-3026). 1.22.44 was packed on a Linux box where the gate's codesign/xcrun checks silently no-op'd, so an un-stapled dev bundle shipped and Gatekeeper rejected it on every Mac ("not notarized/valid; skipping launch") — the menu bar died until a rollback to 1.22.43. stapler staple writes the ticket as a plain file (Contents/CodeResources), so its absence is provable anywhere: the gate now hard-fails the pack when it is missing and no xcrun is available, turning that failure into a pack error instead of a shipped regression. Source: apps/cli/scripts/verify-menubar-helper.sh.

• A Linux box can now produce the pretested release tarball — the attestation producer seeds the already-signed helper apps (RUSH-3026). release-attestation-produce.sh runs in a fresh worktree whose bin/ is empty (the signed .app helpers are untracked), so on any non-Mac box npm pack died at the prepack gates and attestation production — and therefore every release — stayed chained to a Mac. Off a macOS signing box the producer now seeds bin/Agents CLI.app and bin/MenubarHelper.app copy-if-absent from the caller checkout; the prepack gates still verify them (keychain sha pin, menubar presence), so a wrong or tampered seed fails the pack exactly as before. A Darwin producer's freshly signed apps are never overwritten. Source: apps/cli/scripts/release-attestation-produce.sh.

1.22.44

• Browser domain-skill discovery is layer-aware (RUSH-2497). agents browser start --url <url> auto-loads a site-specific SKILL.md, but the lookup only ever searched the user layer (~/.agents/skills/browser/domain-skills), so a skill shipped in the system layer (~/.agents/.system/skills/browser/domain-skills) — or a project's .agents/ — was silently invisible: the browser just opened without the guide. resolveDomainSkill now searches project > user > system > extra repos, first layer with a match wins, mirroring resolveResource precedence; $AGENTS_BROWSER_DOMAIN_SKILLS_DIR stays a single-root override for tests. The project layer resolves from the calling process's cwd — the shared browser daemon does not yet receive the CLI caller's cwd over IPC, so there the project layer follows the daemon's own cwd until RUSH-2996 threads it through. A miss still never breaks browser start, but now logs the roots searched at debug level (AGENTS_DEBUG/DEBUG) — the total silence is what hid this. Source: apps/cli/src/lib/browser/domain-skills.ts.

• agents artifacts share list/update/delete (and the unshare alias) had a silently-dropped --json/--github-user (RUSH-2687). Commander resolves an option's long name against the WHOLE ancestor chain, not per-command — share <file> (the parent) already declares --json/--github-user for its own publish-time use, so the same-named flag on list/update/delete was swallowed at parse time even when passed alone (--help still showed it registered, which made it easy to miss). agents artifacts share list --json | jq …, the exact example in docs/share.md, never emitted JSON. Fixed by renaming the colliding options — --list-json/--for-user (list), --update-json (update), --delete-json/--for-user (delete/unshare) — matching the precedent share revisions already set (--revisions-json/--for-user, RUSH-2683). A CLI-wide enablePositionalOptions() fix was evaluated and reverted: commander copies that setting onto every command created via .command(), so enabling it on the root program broke sessions backfill tools/resources --since … --json …, which relies on a parent command's options staying visible to leaf subcommands via optsWithGlobals(). Source: apps/cli/src/commands/share.ts, apps/cli/src/lib/startup/root-command.ts.

• agents artifacts share publishes with a partial share: config (RUSH-2837). status and publish both used to treat a missing/empty accountId as "not set up", even when baseUrl and WRITE_TOKEN were present — so a fleet rewrite that blanked accountId (or a partial writeMeta that dropped share:) silently killed PR evidence uploads. Publish now requires only baseUrl + the write token; status reports the endpoint and names an empty account id instead of pretending nothing is configured; writeShareConfig will not persist accountId: "" over a stored id; serializeCentral no longer deletes share: just because a write omitted the key. Source: apps/cli/src/lib/share/config.ts, apps/cli/src/lib/state.ts, apps/cli/src/commands/share.ts.

• Pick a device-local account after fleet placement (RUSH-2961). agents run <harness>@ now composes with --device <name|auto>: the device resolves first, then the interactive picker lists that peer's installed versions/accounts and pins the selection for this run. Automatic picker placement prefers a ready account, retains signed-out/revoked login targets, and excludes devices whose picker would contain only rate-limited or out-of-credit rows. agents view --json exposes each version's cached authVerdict so remote and local placement apply the same revoked-token gate. Source: apps/cli/src/commands/{exec,view}.ts, apps/cli/src/lib/{smart-launch,hosts/dispatch,hosts/ready}.ts.

• BREAKING: nest agents beta under agents setup beta; retire top-level agents apply; drop harness login/logout (RUSH-2981). Enabling a preview feature is setup, not its own noun — agents setup beta list/enable/disable keep the same ~/.agents/agents.yaml beta.enabled write path. Fleet reconcile is already agents fleet apply / agents devices apply; top-level apply is gone (unknown command, retired from distance-1 auto-correct). Harness credentials live on agents accounts — harness login/logout are removed. Does not touch org/auth/trends/audit/unshare (sibling session 01a02234). Source: apps/cli/src/commands/{beta,setup,apply,harness}.ts, apps/cli/src/lib/startup/command-registry.ts.

• Nest leftover top-level aliases; keep agents org as a deprecated spelling (RUSH-2989). agents unshare moves under agents artifacts unshare (same takedown as artifacts share delete; the top-level name is retired). agents audit moves under agents events audit (still events --include runs, plus verify for the legacy hash-chain). Former top-level agents trends is agents insights mix (also agents insights trends). agents org still works and prints a deprecation line; the canonical tree is agents auth space. Prix login stays off agents accounts (that noun is harness keys). Source: apps/cli/src/commands/{auth,org,artifacts,share,events,audit,insights}.ts, apps/cli/src/lib/analytics/mix-commands.ts.

• agents view shows Claude usage again — the daemon auth-health probe no longer hammers /oauth/usage into a permanent 429 (RUSH-2998). The daemon's fleet auth-health probe (probeLocalFleetAuth → probeClaudeStatus) hit the rate-limited /api/oauth/usage endpoint every ~3 minutes on every device. Across the fleet that drove one per-account request quota to a persistent 429; the shared Retry-After backoff then parked usage fleet-wide and the usage cache froze (windows stale-zeroed → agents view rendered S: 0% (now) W: 0% (now) for weeks). The periodic tick now re-probes the endpoint at most every 20 minutes (AUTH_PROBE_MAX_AGE_MS) and reuses the last real verdict in between — a ~5x cut in endpoint traffic. Fleet status still publishes every tick (it does not ride that endpoint), and every device keeps a real auth verdict, so agents devices ping --strict and the run auth-preflight keep detecting revocation on every host. agents devices ping forces a genuinely live probe (never the throttled cached verdict). Source: apps/cli/src/lib/daemon-ticks.ts (AUTH_PROBE_MAX_AGE_MS, isCachedFleetAuthProbeFresh, refreshLocalFleetAuthState force), apps/cli/src/commands/ssh.ts (runFleetPing).

• BREAKING: remove agents serve, its --control anchor, and agents devices pair-ios (RUSH-3001). The read-only local web companion (agents serve) duplicated what agents sessions, agents teams status, and the AGI EXT Fleet panel already show, and its --control mode existed only to anchor the unshipped iOS Fleet Cockpit prototype (apps/ios, untouched since 2026-07-16, no Xcode project) — both are gone, and so is the prototype itself. agents devices pair-ios (the only writer of the device registry's control role) is removed with it; with no writer left, the control-only dial-exclusion filters (isControlDevice) are removed too, across doctor, apply, fleet status, fleet-capture, smart-launch, the devices host provider, session fan-out, and remote login detection. agents serve now reports unknown command and is retired from distance-1 auto-correct; agents devices pair-ios is rejected by devices as an unexpected argument. Migration — if you previously ran agents devices pair-ios, that phone or tablet is still in your device registry with role: control, and the key is now ignored rather than honoured: it becomes an ordinary fleet target. agents fleet status, agents fleet update/run, agents apply, agents doctor --check --devices, agents insights output --all-hosts, and any --device all passthrough will dial it and wait out a ConnectTimeout; agents hosts list shows it as dispatchable; --device auto can place an agent on it when no device is marked worker; and routine fleet placement can schedule a recurring job onto it, since an unknown-platform device sorts ahead of a real worker alphabetically. Failures are loud, not silent. Remove it with agents devices rm <name>; the stale role key is dropped anyway on that device's next agents devices sync. Session fan-out is unaffected — it still gates on a windows/linux/macos platform. Source: apps/cli/src/commands/{serve,ssh}.ts, apps/cli/src/lib/devices/{registry,fleet,pool,discovery-policy}.ts, apps/cli/src/lib/{smart-launch,remote-agents-json,device-config}.ts, apps/cli/src/lib/hosts/{registry,providers/devices}.ts, apps/cli/src/lib/session/{watch,remote-list}.ts, apps/cli/src/lib/fleet/remote-login.ts, apps/cli/src/cli/command-registry.ts, apps/cli/src/lib/startup/command-registry.ts.

• Menu-bar helper restarts after a bundle swap; one-time TCC migration; agents menubar doctor (RUSH-3019). installMenubarLaunchAgentOnUpgrade() swapped the installed bundle on an upgrade but never restarted the running helper — verified live: a helper pid started 21:44:16 kept running while the bundle under it was replaced at 21:53:46, so it kept requesting Accessibility under the OLD code identity and the grant never stuck. The heal now kickstarts the launchd job (launchctl kickstart -k) after a real content swap (a version bump or the ad-hoc -> Developer ID transition — a plist-only interpreter repoint, RUSH-3005's churn, does not trigger this) and falls back to ending the specific pid(s) still running the old binary when kickstart -k can't reach the GUI launchd domain from a non-Aqua shell context, so launchd's KeepAlive relaunches from the swapped binary. Separately, a machine that transitioned ad-hoc -> Developer ID (6fa36f73a) now gets a one-time tccutil reset Accessibility com.phnx-labs.agents-menubar to clear the dead grant recorded against the old identity, stamped so it never re-runs. The "Paste needs Accessibility" notification now opens System Settings' Accessibility pane on click and names the actual running bundle path. New read-only agents menubar doctor reports install path, installed vs CLI version, signing identity stability, and whether a live helper pid predates the on-disk bundle (the stale-process bug this fixes). Source: apps/cli/src/lib/menubar/install-menubar.ts, apps/cli/src/commands/menubar.ts, apps/cli/menubar/Sources/MenubarHelper/Clip.swift.

• Daemon autostart no longer fires under a redirected (sandbox/test) HOME (RUSH-3021). #2860 gated service-manager registration on isolatedHomeSuffix() but left ensureDaemonStarted()'s detached spawn ungated, so a test-spawned CLI could fork a daemon into the test's temp HOME; the child outlived the test and raced its recursive teardown rm (the ENOTEMPTY flake that cost most full-suite attestation rolls on shared boxes). The launch path now refuses under a redirected HOME via the same serviceManagerRegistrationAllowed() signal and AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME test seam; reporting an already-running daemon is untouched, and agents daemon start remains the operator override. Source: apps/cli/src/lib/daemon/daemon.ts (ensureDaemonStarted), regression test in apps/cli/src/lib/daemon/daemon.registry.test.ts.

• The npm tarball no longer bundles the version-stamped signed CLI binary — releases publish from any OS (RUSH-3026). dist/bin/agents (the Developer-ID-signed arm64 Mach-O, #315) embedded the release version, so every release forced a fresh Mac build + sign even when nothing native changed — chaining publishing to a single provisioned Mac (mac-mini), whose downtime stranded merged fixes unshippable. The binary is dropped from package.json files and the prepack gates; postinstall's existing run-probe falls back to the JS entrypoint when the binary is absent, so macOS installs keep working (it returns as a per-release GitHub asset in a follow-up). release.sh's home-base phase — already promote-only (download attested tarball, verify, install-smoke, npm publish) — drops its vestigial macOS gate, and a new assert_promote_home_base preflight (npm token + gh auth, via scripts/promote-home-base-probe.sh) runs BEFORE the release's first mutation, fixing the tagged-but-unpublished failure shape: the old signing preflight was defined but never invoked. The two .app helpers (keychain, menubar) remain bundled and manifest-reused — unchanged helpers are never rebuilt. Source: apps/cli/package.json, apps/cli/scripts/release.sh, apps/cli/scripts/promote-home-base-probe.sh.

• agents sync restores a resource deleted from a version home — no --force needed (#2398, #2397). The staleness fast-guard decided sync-ness from source fingerprints alone, so a managed artifact deleted from the version home (a subagent, command, skill, hook, MCP config, or rules file) read as "Already in sync" and only --force restored it. The sync manifest now records the artifact paths the last full sync wrote (writtenTargets, reported by each resource writer), and isStale treats a missing path as stale — one existsSync per path, no content reads, so the fast-guard budget holds. A manifest written by an older agents-cli lacks the field and reads as stale once; that full sync establishes the baseline. Relatedly, four commands (agents commands/skills/hooks/subagents remove) claimed a removed resource "will re-sync on next agent launch" — the shim's launch hook (agents sync --launch) is project-scoped only and deliberately skips version-home reconciliation, so the messages now name the real recovery: agents sync <agent>@<version> --yes. agents doctor --fix was already immune (it heals from the live-home diff, not the manifest). Source: apps/cli/src/lib/staleness/{index,types}.ts, apps/cli/src/lib/staleness/writers/{types,commands,skills,hooks,mcp,subagents,rules}.ts, apps/cli/src/lib/installations/versions.ts, apps/cli/src/commands/{commands,skills,hooks,subagents,prune}.ts.

• agents devices list no longer serves fossilized load/mem numbers (#2666). The fleet stats cache (.fleet-stats.json) had no age bound and — since RUSH-2061 removed the daemon's N² fleet warm — no background writer, so the load/mem columns froze at the last manual --refresh and re-rendered as current fleet state indefinitely (observed: a 9-day-old row reporting an idle Mac at 1058% load). Cached rows are now bounded by STATS_STALE_MS (3 minutes, the same window as the agent-count mirror): a row past the bound is treated like a missing one — re-probed live this call and rewritten — so the default devices list / devices status read is itself the cache's writer and a stale value can never be presented as current. This cache feeds the fleet scheduler, --device auto affinity, and the session-start fleet banner. Source: apps/cli/src/lib/devices/stats-cache.ts, apps/cli/src/commands/ssh.ts.

1.22.43

• Rush Cloud no longer has a helper that reads the interactive Claude login (RUSH-2359 / incident #1767). Dispatch already sends an email-only account manifest (SING-1b) and never uploaded a token; the leftover readClaudeCredentialsBlob still read Keychain / .credentials.json — the exact shape that captured a claude setup-token TTY banner as an Authorization header. That helper is deleted. --lease SING-1b detection now reads the wrapped rotating blob itself and ignores anything that is not { claudeAiOauth.accessToken }. Source: apps/cli/src/lib/cloud/rush.ts, apps/cli/src/lib/crabbox/runtimes.ts.

• fix: agents sync <agent> self-heals version pointers left aimed at an uninstalled version (RUSH-2471). removeVersion reassigns the default and clears the ~/.<agent> config symlink only when it removes the pointed-at version, so a version-home whose launch binary vanished by any other route — grok self-updating its per-version binary out from under the old dir, a manual delete, a half-finished install that seeded the home but never landed the binary — left the global default and/or the symlink resolving to a dead version. Because agents use <agent>@<v> sets the default and the symlink together, both dangled in lockstep once <v>'s binary went away: agents sync <agent> would print Repointed <agent> config symlink … and then still fail <agent>@<v> is not installed, because the version to sync is resolved from the raw global default. agents sync <agent> now repoints the global default, the isolated default, and the config symlink off any not-installed version before resolving — the default to the newest non-isolated installed version (never auto-promoting an isolated install), the symlink to the resolved default else the newest non-isolated installed version (the user's real ~/.<agent> is never repointed at an isolated install). A pointer already on an installed version (a deliberate agents use choice), a real config directory, and isolated-only agents are left untouched. Source: apps/cli/src/lib/installations/versions.ts, apps/cli/src/commands/sync.ts.

• Session preview groups metadata into verb-led rows (RUSH-2757, part 3). agents sessions preview (and the picker pane) replaces the flat labeled block (Prompt/Todos/Dirs/Repos/Changes/Artifacts/Skills/Plugins/Hooks/Links/Errors/Meta/Tools/Tests) with five scannable verb rows in a fixed gutter — Asked (the originating prompt, quoted), Doing (checklist progress, team lineage, sub-agents), Made (file deltas, reads, artifacts, plan, PR), Health (errors + last test verdict, absent when clean), Cost (msgs, tokens, tool mix) — then Latest (the full wrapped last message, formerly Last response:) and one width-capped Details ▸ fold (session id, skills, plugins, hooks, links, dirs, repos) that shows … +N more instead of wrapping and swamping the pane. Msgs/tokens/session-id move out of the header's third line into Cost/Details, so they render once. The metadata-only card (remote/unindexed sessions) uses the same rows. Source: apps/cli/src/commands/sessions-picker.ts (formatCompactPreview, formatMetaOnlyBody, formatHeader, joinWidthCapped — now ANSI-aware).

• pr-merge-on-green can actually select a PR (RUSH-2848). The built-in's poll ran gh pr list --author @me with no --repo, so gh inferred the repository from cwd; the daemon's cwd is not a git repo and every poll returned empty. The poll now walks registered project slugs (~/.agents/projects/*.yaml), canonicalizes renamed repos (phnx-labs/agents-cli → phnx-labs/agi-cli), and lists with --repo. Verdict matches merge-guard.sh: a formal GitHub APPROVED review or an APPROVE comment on THIS PR (carried-from citations do not count). Hidden agents _internal mergeable-prs prints owner/repo#n (cwd-independent). Source: apps/cli/src/lib/github/pr-verdict.ts, apps/cli/src/lib/github/pr-mergeable.ts. Companion: phnx-labs/.agents-system#347.

• BREAKING: nest agents status under agents sync status (RUSH-2864). status was the unified sync-drift report sitting as its own top-level command next to sync. It now lives as agents sync status (--json UnifiedSyncStatus contract and --yes reconcile unchanged). Top-level agents status is gone, not deprecated: it reports unknown command, and status is retired from distance-1 auto-correct. agents sync <agent> still treats the positional as an agent spec; status is reserved as the subcommand. agents sync status --device from a non-TTY does not inherit umbrella --yes (that flag is reconcile on this command, not "don't prompt"). Source: apps/cli/src/commands/{status,sync}.ts, apps/cli/src/lib/hosts/passthrough.ts, apps/cli/src/lib/startup/command-registry.ts.

• Custom harnesses (deepseek, kimi-chat, glm, …) now work in routines and monitors, and their profiles survive fleet sync (RUSH-2930). agents routines add --agent deepseek and agents monitors add --run deepseek used to refuse any name outside the native registry; both now accept a custom harness (agents harness list), and the daemon delegates the job to agents run <name> — the same path workflow jobs take — so the profile's host binary, model env, and provider auth resolve exactly as an interactive run. The profile pins its own host version and auth, so @version pins, balanced rotation, and account-env injection don't apply to these jobs. Separately, agents harness add/fork/edit and the legacy-auth migration stored the account's per-device id in the profile, while profiles sync fleet-wide via agents repo push — every synced custom harness then died on other machines with Unknown account '<uuid>'. The portable account name is stored now, and a profile with a dangling ref reports which harness is broken and the exact agents harness edit <name> --account <name> repair instead of the bare registry error. Source: apps/cli/src/lib/daemon/runner.ts, apps/cli/src/lib/scheduling/routines.ts, apps/cli/src/lib/monitors/config.ts, apps/cli/src/commands/{routines,harness,profiles}.ts, apps/cli/src/lib/profiles.ts.

• BREAKING: remove the top-level agents tickets command (RUSH-2932). Ticket reads go through linear (linear-cli) and gh issue. agents tickets reports unknown command, and tickets is retired from distance-1 auto-correct. AGI EXT now calls those CLIs directly. Source: apps/cli/src/cli/command-registry.ts, apps/cli/src/lib/startup/command-registry.ts, apps/ext/src/vscode/tasks.vscode.ts.

• Expired cached usage windows read as unknown, not 0% (RUSH-2936). A cached Claude usage window whose reset time had passed was zeroed but kept, so a frozen cache (Anthropic has been 429-ing /api/oauth/usage per account since ~Aug 5) rendered every account as S: 0% (now) W: 0% (now) with usageStatus: "available" — and balanced rotation kept dispatching into genuinely rate-limited accounts (RUSH-2858). deserializeClaudeUsageSnapshot now drops expired windows (the same rule the Grok collector already applied); an all-expired snapshot deserializes to null, the dead cache entry self-cleans, agents view renders usage unavailable plus the recorded throttle reason, and rotation falls back to the coarse cached status instead of trusting a fake 0%. Source: apps/cli/src/lib/accounting/usage.ts.

• agents doctor <agent>@<version> no longer marks every missing resource critical (RUSH-2947). Target mode's computeVerdict hardcoded severity: 'critical' for any status: 'missing' resource of any kind, while fleet mode's FINDING_SEVERITY — whose own docblock calls it "the single source of truth" — rates the same fact warning for everything except missing-hook/missing-plugin. A missing command, skill, permission, subagent, rule, or MCP entry now reads warning in target mode too, matching fleet mode; a missing hook or plugin stays critical in both. computeVerdict reads severity from FINDING_SEVERITY via a new missingResourceSeverity(kind) helper instead of re-hardcoding it. Source: apps/cli/src/commands/doctor.ts.

• BREAKING: nest agents alias under agents setup alias (RUSH-2965). Setting up a PATH shorthand is a setup action, not its own noun. agents setup alias add/list/remove keep the same shim behavior (~/.agents/.cache/shims/ + ~/.agents/aliases.json). Top-level agents alias is gone, not deprecated: it reports unknown command, and alias is retired from distance-1 auto-correct. Source: apps/cli/src/commands/{alias,setup}.ts, apps/cli/src/lib/startup/command-registry.ts.

• Block service-manager registration under a redirected HOME on macOS/Linux (RUSH-2968). launchctl and systemctl --user are per-user-session and ignore $HOME, so a CLI running under a sandbox/redirected HOME (including every vitest fork) still talked to the user's real service manager. service-manifest.ts already namespaces the job label, but that only changes the identifier — the registration still lands in real launchd/systemd (measured: 89 dead …sandbox-<hash> services accumulated in one user's real launchd from test runs, KeepAlive-retrying torn-down executables). Every registration path now consults serviceManagerRegistrationAllowed() (false when isolatedHomeSuffix() is non-null) and skips with a stated reason rather than touching the real service manager: daemon startDaemon/stopDaemon, menubar restartMenubarLaunchAgent/disableMenubarService, secrets retireLegacySecretsAgentService, and agents computer start. A test seam AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME=1 lets the existing shim-based tests continue to exercise the registration code path. Source: apps/cli/src/lib/service-manifest.ts, apps/cli/src/lib/daemon/daemon.ts, apps/cli/src/lib/menubar/install-menubar.ts, apps/cli/src/lib/secrets/agent.ts, apps/cli/src/commands/computer.ts.

• BREAKING: the top-level agents inbox command is removed — use agents feed (RUSH-2984). inbox was a Phase-3 observe alias that re-parsed as agents feed (needs-you is already the feed default), the same leftover class as timeline (RUSH-2692). It is gone entirely, not deprecated: agents inbox now reports unknown command, and inbox is retired from distance-1 auto-correct. agents feed / feed post / feed post --blocked are unchanged. Source: apps/cli/src/commands/feed.ts, apps/cli/src/lib/startup/command-registry.ts, apps/cli/src/bootstrap.ts.

• agents auth and agents org now print a clean one-line error (and a structured {"error"} payload under --json) for signed-out, expired-token, and bad-input states, instead of dumping a raw Node stack trace.

• Fixed balanced Claude account rotation recording session-limit refusals until their stated reset, skipping those accounts, and surfacing session-limited in agents view instead of idle usage.

• Sandboxed monitor --run and routine children now inherit this host's GitHub CLI auth (RUSH-2860). A monitor fire recorded ok while the spawned child had no ~/.config/gh, so gh auth status reported "not logged into any GitHub hosts" and the PR it was meant to act on stayed open. The routine sandbox overlay replaces HOME with a disposable dir, and gh was never linked into it. prepareJobHome now links the host's gh config dir into the overlay (and only that — ~/.agents is deliberately not linked, since it holds the secrets master key and the encrypted store), buildSpawnEnv pins GH_CONFIG_DIR and forwards GH_TOKEN/GITHUB_TOKEN, and the runner refuses to launch when a routine's own env: overrides GH_CONFIG_DIR such that this host's gh auth would still be hidden — a regression tripwire rather than a runtime guarantee. Not covered on Windows, where gh stores config under %AppData%\GitHub CLI.

• agents webhooks now advertises /hooks/slack. The receiver has accepted signed Slack deliveries since the Slack bridge landed, but agents webhooks serve and agents daemon webhooks list still printed only /hooks/github, /hooks/linear — the one URL you must paste into the Slack app was missing from the banner. The slash-command ack now also says "replying in this channel", matching where the reply actually posts (a slash command carries no thread). Source: apps/cli/src/commands/webhook.ts, apps/cli/src/commands/daemon.ts, apps/cli/src/lib/triggers/webhook.ts.

• Slack/webhook handlers that run an agent actually dispatch now. A run.agent or run.workflow webhook handler was gated by the routine activation manifest (~/.agents/devices/<machine>/agents.yaml). A handler is not a routine, so its name could never be a member — on any box that had materialized that manifest, every delivery was recorded skipped with an empty allowlist (can only run on: ) while the receiver logged it as fired, and agents routines enable <handler> refuses the name, so there was no way out. Verified live: a real HMAC-signed /agents slash command reached the public receiver, acked 200, and started no agent. The job now carries dispatchedBy: 'webhook', the same escape RUSH-2681 gave monitors; a handler's routine: delegate still keeps its gate.

• {{slack.response_url}} is now available to handler prompts. It was parsed off the wire but never reached the {{slack.*}} namespace. Slack accepts a POST there for 30 minutes with no token and no channel membership, so it is the only reply that works before the app has been invited to a channel — the shipped example handler now uses it. Source: apps/cli/src/lib/triggers/handlers.ts, apps/cli/src/lib/scheduling/routines.ts.

1.22.42

• Plan-tier gates for agents accounts and agents insights (RUSH-2424). A new apps/cli/src/lib/entitlement.ts reads the live subscription tier from GET /api/v1/billing/subscription?agent=agi-cli (the session token in ~/.rush/user.yaml), caches it on disk for 15 minutes, and stays offline-tolerant: a stale cache is honored over a failed network call, and no session file at all resolves straight to the free tier. agents accounts add / name / attach now cap registered accounts at 3 per harness on free, 10 on paid/admin — a 4th add on free refuses before any write (free plan is capped at 3 claude accounts (3/3). agents upgrade — up to 10 per harness.) and the 3rd prints a one-line notice. Downgrading a plan never deletes a credential: over-cap accounts fall out of accounts switch/set-default (excluded from listSwitchableAccounts) and are listed dormant (upgrade to reactivate) in agents accounts. agents insights keeps top-line counts, harness mix, insights mix, and agents perf free on every tier; the Friction / Friction-thrash / Dissatisfaction-corrections sections, grouping --by account (the default), and --narrative are paid — a gated section is replaced by the in-voice notice Friction and account-split analysis are on the paid plan. in both the text report and --json (a new plan: {tierName, isPaid} field, groups: null when the account breakdown is gated, and the friction/correction facet keys stripped per group otherwise). Source: apps/cli/src/lib/entitlement.ts, apps/cli/src/commands/accounts.ts, apps/cli/src/commands/insights.ts.

• --profile <name> means the same profile in every browser command, and a profile's name never carries its endpoint (RUSH-2709). BrowserService.start used to overwrite BrowserProfile.name with the composite <profile>@<endpoint> runtime key, so the key leaked into profiles list, status, history, and the feed, and six consumers each invented their own rule for turning one back into the other — which is why status --profile default could report "No browser tasks running" while that profile was running. The two concepts are now distinct types: ProfileName (user-facing, always bare), EndpointName, and a branded ConnectionKey built at exactly one site, so connections.get(someProfileName) — the original miss — no longer compiles. One rule, keyBelongsToProfile, replaces the four ad-hoc reconciliations in status, stopProfile, findTask, and listProfileCacheDirs, which also fixes a legacy <name>.<n> fork directory being matched by some of those paths and missed by others. status renders comet-local (endpoint: endpoint-0, port 9222, pid …) instead of the raw key, and status --json carries name (bare), endpoint, and key as separate fields. Source: apps/cli/src/lib/browser/{types,service,profiles,runtime-state}.ts, apps/cli/src/lib/browser/drivers/{local,ssh}.ts, apps/cli/src/commands/browser.ts, apps/cli/docs/browser.md.

• default is now purely an alias, and the auto-detected browser profile is named auto-chrome (RUSH-2709). default used to name BOTH a concrete auto-detected profile and the "whatever you configured" alias, and only start honored the alias (its own comment: "narrowly scoped … only here in start") — so --profile default reached one profile in start and a different one, or nothing, in stop / status / navigate. One resolver, resolveProfileRef, now serves every command. Nothing existing breaks: a browser.profile config value of default still resolves (to the auto-detected profile), a profile you literally named default still resolves to itself and outranks the alias, and a machine that already carries a default profile keeps using it — ensureDefaultBrowserProfile reuses and regenerates it in place rather than creating a second one, so a running browser and its on-disk runtime dirs are not orphaned. Source: apps/cli/src/lib/browser/profiles.ts, apps/cli/src/commands/{browser,setup,setup-browser,setup-preferences}.ts, apps/cli/src/lib/installations/migrate.ts.

• agents auth login/whoami/logout and agents org create/list/view/invite/members/role/remove/leave — the account-layer client over the existing api.prix.dev backend. agents auth login runs the already-shipped RFC 8628 device-code flow (POST /api/v1/auth/device/authorization + poll /token) and writes its own session file, separate from rush login's ~/.rush/user.yaml — so agents auth logout never signs you out of rush, while agents auth whoami/agents org fall back to a live rush login session automatically if you never ran agents auth login. agents org maps to the backend's /api/v1/spaces routes (not /api/v1/orgs — spaces already enforce the free-tier caps of 1 owned space / 3 members and can exist standalone). Every subcommand takes --json; --space <id-or-slug> is optional and defaults to your sole space. Source: apps/cli/src/lib/prix-account.ts, apps/cli/src/commands/{auth,org}.ts.

• agents accounts switch <harness> [account] picks the default account for a harness. Interactive mode reuses the run-account picker layout (usage %, headroom, signed-out / rate-limited) and writes the existing per-harness default — the same binding as accounts set-default, which balanced rotation already honors. Pass an account name to skip the picker; --json lists or reports the result. Native accounts name / attach now refuse an unsupported harness with a named reason (kimi accounts can't be isolated by agents-cli yet (device-scoped login). Supported today: claude, codex, grok.); provider accounts add --provider is unchanged. Source: apps/cli/src/commands/accounts.ts, apps/cli/src/commands/run-account-picker.ts, apps/cli/src/lib/account-capabilities.ts.

• agents browser navigate now reuses a tab in Arc instead of refusing outright (#2786, #2778). Arc crashes on Target.createTarget, so every navigate was answered with "use a Chromium-family browser" — which meant the document was never shown at all and callers fell back to a raw open, a new tab per call, i.e. exactly the tab-spam #2779 set out to end. Arc does expose page targets and does honor Page.navigate on them (measured against a live Arc: 33 targets, navigate reused one, tab count unchanged, no crash), so navigate now reuses in place, the same shape as the existing Electron branch. Reuse is narrow and non-destructive: only a tab ALREADY showing the requested URL, or an empty new-tab page, and a target another task owns is left alone. A reused tab is recorded as borrowed — the task drives it but never closes it, so a tab that was open before the task survives done (the rule adoptTabShowing states for unowned pages, kept here where reuse is unavoidable). When nothing is safe to reuse the actionable refusal stands. The Target.createTarget guard from #2778 is unchanged. Source: apps/cli/src/lib/browser/service.ts.

1.22.41

• BREAKING: the top-level agents timeline command is removed — use agents feed --filter updates (RUSH-2692). timeline was a pure alias of agents feed --filter updates (its own description said so), a second door to one stream against the CLI-surface convention of one owned noun with no duplicated surface. It is gone entirely, not deprecated: agents timeline now reports unknown command, and timeline is retired from distance-1 auto-correct so a stale invocation fails loudly instead of running a neighbouring command. agents feed --filter updates is unchanged, and the sibling observe aliases agents inbox and agents roster are unaffected. Source: apps/cli/src/commands/feed.ts, apps/cli/src/lib/observe-aliases.ts, apps/cli/src/lib/startup/command-registry.ts, apps/cli/src/bootstrap.ts.

• Session preview leads with the title and wraps the last response to the pane (RUSH-2757). agents sessions preview now opens its header with the session's title (session.label — an agent-generated name / /rename / the --name launch handle) instead of burying it, and the agent's last response is wrapped to the terminal width rather than running off the right edge as one long line. Wrapping measures visible width (ANSI-aware), so coloured output is not miscounted, and lines that already fit keep their rendered-markdown indentation. Source: apps/cli/src/commands/sessions-picker.ts, apps/cli/src/lib/wrap.ts.

• release-manifest.sh helper digests are keyed by path relative to --repo-root, and release-attestation-produce.sh now writes the helper manifest it needs (RUSH-2766). hash_tree used to bake the ABSOLUTE file path into every helper's input-digest, so a digest recorded in one worktree could never match the same recomputation elsewhere — require_helpers structurally could not pass for any release, and v1.22.40 was finished only by hand-recomputing the manifest inside a fixed-path worktree on mac-mini and re-uploading it to the GitHub release. Paths are now hashed relative to the repo root, so the same digest reproduces across machines and worktrees (demonstrated: identical sha256: for all three helpers computed from two independent checkouts). Separately, release.sh has always consumed release-manifest.json (require at :231, upload_release_proof at :976) with no producer writing it — the same consumer-without-producer gap RUSH-2749 fixed for the attestation itself. release-attestation-produce.sh now writes/updates it alongside ATTEST.json: an unchanged helper carries its prior record forward, keychain/menubar are re-recorded from the fresh signed assets this script's own Darwin block builds, and a drifted computer-mac digest with no prior record fails the producer closed rather than shipping a stale or missing helper record. Source: apps/cli/scripts/release-manifest.sh, apps/cli/scripts/release-attestation-produce.sh, apps/cli/docs/release.md.

• BREAKING: agents secrets no longer prints bundle values — the plaintext export and bundle-key get are removed; run commands under agents secrets exec instead (RUSH-2774). The eval "$(agents secrets export <bundle> --plaintext)" one-liner put every value of a bundle onto stdout, which inside a coding-agent session means the model's context and the synced session transcript — and agents copied it reflexively from the CLI's own help and scripts. secrets export is now transfer-only (--device, --to-1password, --to-file; anything else refuses, naming the alternatives); secrets get <bundle> <KEY> refuses, naming agents secrets exec <bundle> -- printenv <KEY>; secrets view --reveal refuses inside an agent session (AGENTS_RUNTIME/AGENT_SESSION_ID/CLAUDECODE markers) and its non-TTY --reveal --plaintext escape is gone; the raw-item secrets get <item> stays available everywhere — fleet shell hooks running inside sessions capture single ad-hoc tokens into their own variables, the accepted narrower residual. The SSH remote resolve behind secrets exec --device and run --secrets <b>@<host> still works: it rides a hidden, marker-gated transport (AGENTS_SECRETS_REMOTE_TRANSPORT), so a newer CLI keeps resolving from an older remote during a fleet rollout, while an older CLI against a newer remote fails loud with an upgrade hint. First-party scripts (sandbox.sh, both release.sh) now re-enter themselves under agents secrets exec, so values ride the child environment and never touch stdout. Migration for eval scripts: agents secrets exec <bundle> -- <your command>, or VAR="$(agents secrets exec <bundle> -- printenv KEY)" for a single value. Spec: SEC-9/SEC-9b/SEC-9c, SEC-GAP-10. Source: apps/cli/src/commands/secrets.ts, apps/cli/src/lib/secrets/{headless,remote}.ts, apps/cli/scripts/{sandbox,release}.sh, apps/ext/scripts/release.sh.

• Fix a publish crash on any non-latin1 label, meta value, or repo name (RUSH-2784). fetch encodes header values as a ByteString, so a title containing an ellipsis, a curly quote, an emoji, or CJK text threw TypeError: Cannot convert argument to a ByteString mid-publish — an unhandled stack trace after the body had already been read and the OG cover uploaded. Every free-text header (x-share-label, x-share-repo, x-share-host, x-share-meta, and the provenance set) now goes through toHeaderValue(), which transliterates common typographic punctuation to ASCII and drops the rest of the non-latin1 range. Still lossy for a title in a non-latin script, which publishes as (unnamed); full Unicode needs percent-encoding plus a matching Worker decode, tracked as RUSH-2786. Source: apps/cli/src/lib/share/publish.ts.

• agents sessions share <id> publishes a session as a link (RUSH-2784). Sharing a session took three commands and a detour through the external artifacts-cli, so nobody ran it — every piece already existed (sessions render produces a redacted transcript, and the R2-backed share Worker has served artifacts for a month), but nothing wired them together. One verb now renders the session as a self-contained branded HTML page and publishes it: agents sessions share a1b2c3d4 prints https://share.agents-cli.sh/<you>/session-a1b2c3d4. Unlisted by default, unlike agents artifacts share — a transcript carries file paths, command output, and error text, so it stays out of the public gallery until --public asks for it (the URL is still world-readable: unlisted is a capability URL, not a secret). The page is escaped rather than passed through, so a session that merely printed a <script> tag does not ship an executable one. Publishing inherits the existing email/credential scan and the 30d default expiry; --reasoning fold keeps the model's reasoning in collapsible sections, --expire never opts out of decay. Source: apps/cli/src/commands/sessions-share.ts, apps/cli/src/lib/session/share-html.ts, apps/cli/src/lib/share/publish.ts.

• agents browser use [name] is the one command for choosing this machine's default browser profile (RUSH-2820). A name writes the existing device-scoped browser.profile config key; a bare interactive invocation opens a picker over configured profiles and installed browsers, while a headless invocation prints the current default and usage. --unset and auto restore auto-detect. agents browser profiles use is an alias, and the hidden profiles set-default compatibility alias now points users to browser use. Source: apps/cli/src/commands/browser.ts.

• Claude workspace trust now carries across pinned version homes (#2776). Every pinned claude version gets an isolated home, and workspace trust (projects[<path>].hasTrustDialogAccepted in .claude.json) never carried into a new one — so the first interactive launch of each newly pinned version re-showed the workspace-trust dialog once per project, complete with the "this folder pre-approves N tool permissions" warning on repos trusted for months (headless runs skip the dialog, so the re-prompt could surface weeks after pinning and read as a trust regression). agents add / agents use now carry trust via a new claude-trust manifest strategy that projects ONLY the accepted trust flags out of the source .claude.json — the login (oauthAccount) and per-session stats stay per-version, same posture as the removed .codex/auth.json carry. A target entry's stamped-default false is promoted (Claude Code never persists a decline), all its other keys are preserved, the target is backed up before modification, and the write is atomic (a running Claude session rewrites this exact file). Codex was already covered: projects.*.trust_level rides along in config.toml. Source: apps/cli/src/lib/settings-manifest.ts.

• Arc is a recognized browser type, and agents browser now refuses to drive it with a clear error instead of crashing it (#2779, #2778). arc joins the Chromium-family BrowserType (detected at /Applications/Arc.app, macOS-only; agents browser profiles seed creates an arc-local profile). But Arc answers Browser.getVersion while exposing zero CDP page targets and crashing the moment a new tab is requested (Target.createTarget), so it is not actually drivable. Every tab-creating path now routes through one guard (createPageTarget) that throws an actionable "use Comet/Chrome/Chromium/Brave" error for an Arc profile rather than crashing the user's Arc window. The browser skill documents this and teaches showing a review doc/plan/report via agents browser navigate --url file://<path> (one reused tab, refreshed in place) instead of a raw open <file> that spawns a duplicate tab every call. Source: apps/cli/src/lib/browser/service.ts, apps/cli/src/lib/browser/chrome.ts, apps/cli/src/lib/browser/cdp.ts, skills/browser/SKILL.md.

• Slack can now trigger an agent on your box and reply in-thread. The signed webhook receiver (agents webhooks serve and the daemon webhook-receiver) accepts a third source, POST /hooks/slack: it verifies Slack's v0 request signature with a 5-minute replay guard, answers the one-time url_verification handshake, and parses both slash commands (/agents AGI: …) and app_mention events. A matching ~/.agents/webhooks/*.yml handler with source: slack (and optional command/channel filters) runs an agent scoped to the project named in the message — a handler may now template project/cwd from the delivery (project: "{{slack.project}}"), with the new {{slack.*}} namespace exposing prompt, project, channel, thread_ts, user, text, and command. The agent replies into the same thread through the existing agents send --channel slack --to <channel> --thread <ts> — no new outbound code. The receiver bundle gains SLACK_SIGNING_SECRET (and SLACK_BOT_TOKEN when the reply uses the Slack Web API). Setup, a ready-to-paste app manifest, and an example handler are in docs/routines.md and docs/examples/slack/. Source: apps/cli/src/lib/triggers/webhook.ts, apps/cli/src/lib/triggers/handlers.ts, apps/cli/src/lib/daemon-webhooks.ts, apps/cli/src/commands/webhook.ts.

1.22.40

type: feat scope: devices

Device approvals and dismissals now follow the user DotAgents repo across the fleet (RUSH-2377). agents devices register, add, sync, ignore, unignore, and remove persist a three-state decision under the central agents.yaml fleet.discovery map: approved, ignored, or absent/pending. After agents repo pull user, the CLI reconciles those portable decisions into the local .history/devices registry and ignore-list, resolving approved connection details live from Tailscale. IPs, SSH users/auth, and reachability remain machine-local and never enter Git. Source: apps/cli/src/lib/devices/discovery-policy.ts, apps/cli/src/commands/{ssh,repo}.ts.

• Legacy tmux pane-died hooks now self-heal at attach and daemon startup instead of relying on a poll that no longer exists (RUSH-2435). The 5-minute tmux-reconcile daemon routine that used to retrofit a stale hook onto a managed tmux session was deleted in an earlier pass (RUSH-2495), leaving reconcileSessionHooks with zero production callers — a session a pre-fix binary left with a stale hook had nothing to repair it. reconcileSessionHooks (full sweep) now runs once at daemon startup and once from the upgrade-time migration (runMigration) as the version-skew one-shot, and the new ensureSessionHookRepaired(name, socket) repairs a single session right before it's attached to — wired into prepareSessionForResume (native agents run --resume) and the manual agents focus/agents go/agents tmux attach attach paths. Both share one non-destructive repairSessionHookIfStale implementation so the full sweep and the single-session repair can never drift on what counts as repaired. docs/routines.md and docs/specifications.md no longer describe the deleted builtin-routines.ts/tmux-reconcile machinery as live. Source: apps/cli/src/lib/tmux/session.ts, apps/cli/src/lib/tmux/index.ts, apps/cli/src/lib/daemon.ts, apps/cli/src/lib/migrate.ts, apps/cli/src/commands/focus.ts, apps/cli/src/commands/go.ts, apps/cli/src/commands/tmux.ts.

• agents sessions resume <id> / focus <id> for a local indexed session no longer runs the write-heavy discovery scan or dials the fleet, so a crash-restart storm of resumes stops crashing on database is locked (RUSH-2477). After a machine crashes and reboots, every previously-open tab relaunched sessions resume <id> at once. Each resume ran the full discoverSessions path, whose tryClaimScan/releaseScan bookkeeping are BEGIN IMMEDIATE writer transactions (lib/sqlite.ts), so even a process that skipped the scan still took the writer lock — dozens at once exhausted busy_timeout and threw an unhandled SQLITE_BUSY ("database is locked"), and on a local miss the resume fanned out over SSH to the whole fleet before the tailnet was up, hanging and printing the doubled unreachable … skipped list. The direct-id path now resolves against the local SQLite index first through a new resolveIndexedSessionById (lib/session/discover.ts) — a plain WAL read (skipExistenceCheck) with the same origin-machine attribution and managed scoping every indexed read gets, no scan claim and no fleet fan-out. focusAction (commands/focus.ts) takes that fast path for a local indexed id: on a single logical match owned by this box it routes straight to recovery (joining a still-live pane via the local live index, or resuming a crashed one in place); a genuine miss, an ambiguous prefix, or a peer-owned row falls through to the existing fleet resolver unchanged. dedupeSessionsByLogicalId collapses the self-vs-attribution split of one id, so a full uuid that used to read as "ambiguous (2 sessions)" now resolves to one. Verified: >= 20 concurrent resolveIndexedSessionById calls complete with zero SQLITE_BUSY, and the resolve issues no SSH fan-out. Source: apps/cli/src/lib/session/discover.ts, apps/cli/src/commands/focus.ts.

• agents monitors now correctly reports a failed action dispatch — ok:false and the specific reason — when the runner declines to start or fails to start the agent process (RUSH-2500). Previously, dispatchAction in lib/monitors/dispatch.ts treated any non-throwing return from executeJobDetached as success (ok: true). But executeJobDetached calls runWithAttempt, which can return a RunMeta with status: 'skipped', 'blocked', or 'failed' without throwing — e.g. when the non-overlap active_run guard fires because a prior monitor-triggered run is still live, or when the auth preflight fast-path (dead-verdict credit exhaustion) marks the run failed and returns instead of throwing. The skipped or failed run was recorded in ~/.history/runs/ with the real status, but the fire record in ~/.history/monitors/ got ok: true, so monitors runs showed success while monitors logs showed skipped. The engine's drought escalation also got a false healthy signal and never notified the owner. The fix checks runMeta.status after executeJobDetached and returns { ok: false, error: runMeta.errorMessage ?? runMeta.status } for skipped, blocked, or failed results, making the fire record agree with the runner record. Applies to both run and routine action types. Source: apps/cli/src/lib/monitors/dispatch.ts.

• agents sessions --active now distinguishes "genuinely nothing running" from "discovery failed and was silently swallowed" (RUSH-2507). Previously getActiveSessions folded every tmux/teams/terminals source failure into a bare [] — a wedged tmux server, a spawn error, or a nonzero list-panes exit read identically to an idle machine, and the same collapse happened on the fleet fan-out side, where an unreachable/skipped peer or a failed device-list load produced the exact same "No active agent sessions." as a genuinely idle fleet. listTmuxAgentSessions now throws TmuxDiscoveryDegradedError when the tmux socket exists but couldn't be read (still returning [] when no socket has ever existed — that case is legitimately empty), and the new describeActiveDiscoveryHealth() re-probes it only on an empty result to report which local source degraded. RemoteActiveResult now carries skipped/discoveryFailed from gatherRemoteAgentsJson instead of dropping them. The empty-result message in agents sessions --active names the degraded source or unheard peer instead of a flat "No active agent sessions.". Source: apps/cli/src/lib/session/active.ts, apps/cli/src/lib/session/remote-active.ts, apps/cli/src/lib/session/session-cache.ts, apps/cli/src/commands/sessions.ts.

type: feat scope: projects

agents projects pull <name> fast-forwards every fleet checkout of a named project to its remote's default branch.

• Safety contract: dirty trees, checkouts on a non-default branch, and local commits ahead of upstream are blocked and reported — never overwritten. Fast-forward only; no rebase, no reset.

• Every checkout is verified against the project's declared repo slug before it is fast-forwarded, on every fleet device — a bound path that hosts a different repo is blocked. A checkout whose origin cannot be resolved to a slug is blocked too.

• Missing checkouts are skipped (never cloned) and do not drive a non-zero exit. Blocked or failed checkouts do.

• Fleet fan-out reuses the same gatherRemoteAgentsJson seam as projects status, with a 120-second per-device timeout for large repos and slow links.

• --device / --devices scope the pull to one or more named fleet boxes.

• --json emits a machine-readable result array (one row per path per device), and reports devices that did not answer (unavailable) or answered unverifiably (unverified) on stderr — matching projects status --json.

• A device whose answer cannot be verified is reported as unverified and drives a non-zero exit, rather than being silently folded in as a device with nothing to report.

• agents projects pull-local (hidden peer command) is the per-device fast-forward runner invoked by the fleet fan-out. It receives the full {path, expectedSlug} target list, so slug verification runs on remote devices exactly as it does locally, and a malformed or spoofed peer response is rejected loudly rather than partially applied.

• routines.test.ts: daemon spawned by startIsolatedDaemon no longer inherits the real production AGENTS_HISTORY_DIR (RUSH-2545). The test helper spread ...process.env into the daemon's environment without overriding AGENTS_HISTORY_DIR, so the detached daemon process read its ~/.agents/.history record — the live production history — and its SIGTERM sweep killed real tmux-wrapped Claude and cgraph-mcp processes on every five-minute tick while the test suite ran. The fix adds AGENTS_HISTORY_DIR: path.join(home, '.agents', '.history') to the daemon spawn env so the sweep is fully confined to the test's tmp directory. A new regression test (daemon env isolation — AGENTS_HISTORY_DIR must not leak) reads /proc/<pid>/environ on Linux to assert the daemon's env carries the isolated path, not the parent vitest process's real one. Source: apps/cli/src/commands/routines.test.ts.

• The daemon hosts signed webhook receivers as a supervised service (RUSH-2548). Public Linear/GitHub → agent webhooks no longer depend on a nohup'd agents webhooks serve tied to an agent session: declare a receiver with agents daemon webhooks add --secrets-bundle <name> [--port n] [--funnel-port 443] and the daemon's new webhook-receiver service binds it, restarts it on crash, and brings it back after a reboot. agents daemon webhooks list [--json] and agents daemon webhooks remove <port> manage the declarations. The signing secret resolves headlessly through the secrets broker, so there is no AGENTS_SECRETS_PASSPHRASE; a locked bundle fails that receiver loud in agents daemon logs instead of binding ingress it cannot verify. Source: apps/cli/src/lib/daemon-webhooks.ts, apps/cli/src/commands/daemon.ts.

• Webhook deliveries are acked before dispatch, not after (RUSH-2548). The receiver held the HTTP response open for the whole 15-20s agent run, which exceeded Linear's delivery timeout and filled its Delivery failures log with timeouts and retries. A verified delivery is now answered 202 {"ok":true,"accepted":true,"deliveryId":…} immediately and dispatched afterwards. Delivery-id dedup is unchanged, including for a retry that lands mid-dispatch; the response body no longer carries fired/runs/handlers, and a post-ack failure surfaces as the new webhook.failed event plus a line in the receiver's log. Source: apps/cli/src/lib/triggers/webhook.ts.

• Add named routers -- agents route (RUSH-2556, RUSH-2562, RUSH-2563, RUSH-2564). A router is a reusable, task-typed allowlist of harnesses x models/tiers x linked accounts -- a generalization of a profile (a profile is a router pinned to one harness and one account). routers is a new ResourceKind, resolved project > user > system like other resources; agents route create/list/show/allow/link-account/unlink-account/rm manage it. Harness ids and model/tier tokens are validated on create/allow against the real agent registry and each harness's resolved tier map/catalog -- an unknown token fails loud, printing the invalid token, and writes nothing. Source: apps/cli/src/lib/routers.ts, apps/cli/src/commands/route.ts.

• The browser tab reaper now actually runs, and you can trigger it on demand (RUSH-2622). agents browser done/stop always closed a task's tabs, but agents routinely never called them, so leftover tabs piled up in the shared profile window. The daemon now closes them itself, on a 5-minute tick: a task whose owning agent session has exited, or one idle past browser.task-idle-minutes (default 30, new device config key — 0 disables idle reaping only, a dead-session task is still closed). agents browser gc [--dry-run] [--idle-minutes <n>] runs the same pass on demand. Only tabs the daemon opened for that task are ever touched — a tab you opened yourself, or the shared profile window, is never closed. Source: apps/cli/src/lib/browser/hygiene.ts, apps/cli/src/lib/daemon.ts (runBrowserTaskReap), apps/cli/src/lib/device-config.ts (browser.task-idle-minutes), apps/cli/src/commands/browser.ts (gc).

• The macOS menu-bar helper now recovers an alive-but-frozen daemon after sleep/wake (RUSH-2636). Its separate launchd process reads the daemon heartbeat as well as the PID; after a confirmed stale heartbeat it runs one scoped agents daemon restart and reports the recovery. Missing, malformed, or PID-mismatched heartbeat state fails closed. Source: apps/cli/menubar/Sources/MenubarHelper/DaemonLiveness.swift, apps/cli/menubar/Sources/MenubarHelper/StatusItemController.swift.

• daemon.ts: the launchd Label / systemd unit name is namespaced under a redirected HOME (RUSH-2639, residual). An earlier RUSH-2639 fix baked the caller's HOME into the daemon's plist/unit content so a service-manager-started daemon lands in the right sandbox — but launchctl unload/load/list route by the service identifier alone, and that identifier (com.phnx-labs.agents-daemon / agents-daemon.service) was still one literal, global string. Confirmed directly against real launchctl: when a different plist is already loaded under that label, a new instance's own unload (written to be a no-op for a plist that was never loaded) silently kills the other job instead — exactly what let concurrent hermetic test forks (and a developer's own test suite next to their real always-on daemon) collide. The identifier is now namespaced with a hash of HOME whenever HOME differs from os.userInfo().homedir (the OS/passwd record, which ignores $HOME) — every hermetic test process, never a real interactive/production invocation. Source: apps/cli/src/lib/daemon.ts.

• Fixed the macOS test regression introduced by the vitest HOME sandbox, which blocked release 1.22.40. RUSH-2639 sandboxed $HOME for the whole suite so tests can no longer write into the developer's real ~/.agents. macOS resolves the login keychain from $HOME, so usage.test.ts's setKeychainToken call had no keychain to write and died with security: SecKeychainItemCreateFromContent (<default>): The authorization was canceled. It surfaced only in the release matrix — PR CI runs Linux, which has no keychain — so it halted a release after the changelog was folded and the PR opened, rather than failing on the PR that introduced it. The test now installs an in-memory backend via the existing setKeychainBackendForTest seam, which is strictly better than what it did before: writing a token into the real login keychain was the same class of bug RUSH-2639 exists to prevent. Source: apps/cli/src/lib/__tests__/usage.test.ts.

type: fix scope: services

The menu-bar helper's and the agents computer helper's launchd plists now carry HOME, closing the last RUSH-2639 escape. The earlier RUSH-2639 fixes covered exactly one of the three service manifests this CLI writes: the daemon's. generateServicePlist (menu bar) declared only PATH/AGENTS_NODE/AGENTS_ENTRY/AGENTS_BIN, and renderLaunchAgentPlist (computer helper) had no EnvironmentVariables dict at all. launchd applies that dict on top of the login session's environment, never the environment of whoever called launchctl bootstrap, so both helpers resolved the account home whatever home their caller was running under. The menu-bar helper reaches the CLI through its baked AGENTS_NODE/AGENTS_ENTRY, and every agents invocation runs the audit hook → readMeta → ensureAgentsDir, so each call bootstrapped that home's ~/.agents (.system, .history, .cache, routines). Under the hermetic test harness that is a write into the developer's or the CI runner's REAL home — the macOS-only leak that failed the 1.22.40 release matrix. Captured live on a CI runner: pid 10817, parent 1 (launchd), executable <sandbox>/Library/Application Support/agents-cli/MenubarHelper.app/Contents/MacOS/MenubarHelper, registered under the bare label com.phnx-labs.agents-menubar while the real ~/Library/LaunchAgents held no phnx plist. Both manifests now bake HOME + AGENTS_REAL_HOME, and both identifiers get the HOME-namespacing the daemon's already had, so a sandboxed instance can no longer bootout the operator's live helper. The rule lives in one module, apps/cli/src/lib/service-manifest.ts, with a per-generator test so a fourth manifest cannot ship without it. Production identifiers and behavior are unchanged: the namespace suffix is empty whenever HOME matches the passwd home. Source: apps/cli/src/lib/service-manifest.ts, apps/cli/src/lib/menubar/install-menubar.ts, apps/cli/src/commands/computer.ts, apps/cli/src/lib/daemon.ts.

• fix: the vitest suite can no longer write into the developer's real ~/.agents (RUSH-2639). tests/setup.ts pinned only specific hot spots (AGENTS_DEVICES_DIR, AGENTS_EVENTS_PATH, hook-shim/cache/logs/perf/state dirs) to fork-private temp dirs, leaving HOME itself untouched — and state.ts's HOME (and several sibling modules') is a module-level constant captured once at import time, so any test or subprocess spawn that didn't happen to override HOME before its first import resolved against the real home. Two confirmed live offenders: src/lib/routines.test.ts wrote fixture routine YAML into the real ~/.agents/routines/ and ~/.agents/.system/routines/, and a src/lib/daemon.test.ts describe block registered/reaped real daemon-instance pid markers under ~/.agents/.cache/helpers/daemon/instances/. tests/setup.ts now redirects HOME/USERPROFILE to a fork-private sandbox before any test file's imports run, so every HOME-derived path — including ones with no dedicated escape hatch, and subprocesses spawned with env: {...process.env} — resolves under the sandbox with no per-test effort; new CI-only leak tripwires assert the real ~/.agents top level and ~/.claude/settings.json are untouched. A new tests/global-setup.ts also sweeps stale /tmp/agents-vitest-* dirs left behind by killed workers from past runs. Source: apps/cli/tests/setup.ts, apps/cli/tests/global-setup.ts, apps/cli/vitest.config.ts.

• Routines: a terminal run no longer wedges the scheduler's active-run slot (RUSH-2640). A run that reached any terminal state (failed / timeout / completed) used to keep holding the slot while its recorded pid stayed alive, so every later scheduled fire was refused with already has an active run while the routine sat silently dead. The slot is now released the moment a run reaches a terminal state; a still-running record is also aged out once it passes its own timeout, and the daemon no longer stamps its own never-dying pid on a run's provisional claim (which was what made the slot look permanently occupied and drew the process reaper at the daemon itself). A routine whose run failed now fires again on its next slot with no daemon restart. Three or more consecutive slot-skips for the same routine are surfaced in the daemon log instead of accumulating silently. Source: apps/cli/src/lib/runner.ts.

type: fix scope: menubar, extension

Resolve the standalone Linear CLI from executable GUI-safe paths before ticket creation, and show the underlying launch error when creation fails.

• Branding: rebrand the OSS product name from agents-cli to agi-cli in user-facing prose, docs, and repo-path URLs, now that the GitHub repo itself has been renamed phnx-labs/agi-cli (RUSH-2660). Root README.md, CONTRIBUTING.md, DESIGN.md, SECURITY.md, NPM_CONSOLIDATION.md, apps/ext/README.md, assets/videos/README.md, demo/src/scenes.ts, packages/agi-cli/README.md, packages/swarmify-mirror/README.md, and the apps/cli/docs/ markdown headers and body prose that use "agents-cli" as the product name now read "agi-cli". Every github.com/phnx-labs/agents-cli reference in those user-facing files, plus the repository/bugs/homepage URL fields in packages/agi-cli/package.json and packages/swarmify-mirror/package.json and the hardcoded repo defaults in apps/cli/scripts/release.sh, root scripts/release.sh, scripts/bottle.sh, .github/ISSUE_TEMPLATE/config.yml, and scripts/release.test.sh (plus the companion apps/ext/app/package.json repository.url its test asserts against), now point at phnx-labs/agi-cli. This is docs/branding only — no runtime behavior change. Not touched: the npm package name fields (@phnx-labs/agents-cli stays canonical; the package-name flip is a separate ticket), the npm install -g @phnx-labs/agents-cli line in apps/cli/scripts/install.sh, the agents-cli shell-rc marker in src/lib/shims.ts, ~/.agents/~/.agents-system, the agents/ag command names, the VS Code ext identity (swarmify/swarm-ext), keychain-item naming patterns (agents-cli.<provider>.token, agents-cli.hmackey, etc.), literal runtime message strings quoted in docs (e.g. doctor.ts's "older agents-cli — can't report per-version sign-in"), and repo-path/project-name examples in code blocks. Source: README.md, apps/cli/docs/*.md, packages/agi-cli/package.json, packages/swarmify-mirror/package.json, apps/cli/scripts/release.sh, scripts/release.sh, scripts/bottle.sh, .github/ISSUE_TEMPLATE/config.yml, scripts/release.test.sh.

• Affected-test Linux CI gate (RUSH-2666). The required Tests / test check is one GitHub-hosted Linux job: scripts/ci-scope.ts plus apps/cli/ci/test-ownership.yaml select the companion, statically related, and declared-owner tests, fail immediately on an unmapped path, and reuse a proof only for the exact candidate tree. Windows is post-merge best-effort and does not block merge or release. Source: scripts/ci-scope.ts, .github/workflows/tests.yml.

• Ordinary release.sh promotes the exact pretested tarball instead of rebuilding and notarizing (RUSH-2666). Functional proof is an immutable attestation bound to the candidate tree, toolchain, lockfile digest, and test-policy version — parent commits and nearby SHAs are rejected, and a missing record fails with that exact key. Helpers are reused from the release manifest or the release stops; sign/notarize is outside this path. The home base install-smokes the attested .tgz and publishes those bytes (npm publish <tgz>, OIDC provenance when GitHub's token exchange is present). Target: ordinary release P99 ≤180 seconds. Source: apps/cli/scripts/release.sh, apps/cli/scripts/release-attestation.sh, apps/cli/scripts/release-manifest.sh, apps/cli/scripts/release-install-smoke.sh.

• agents permissions list now answers for every harness whose permissions the CLI writes, not 3 of them (RUSH-2676). applyPermissionsToVersion writes claude, opencode, codex, cursor, antigravity, grok, kimi, droid, copilot, kiro, openclaw and hermes, but the read side was a hand-written 3-arm switch: readAgentPermissions returned null for everything except claude/opencode/codex, and the config-file import behind agents permissions add <path> gated on a .claude/.opencode/.codex substring, which also excluded kiro/goose/hermes twice over because their configs are YAML. So permissions were installed and then reported as absent — measured against the real write path, 13 written, 3 reported back. A new PERMISSION_TARGETS registry (apps/cli/src/lib/permissions-registry.ts) declares each harness's config path plus how to read it back into the canonical PermissionSet, mirroring SUBAGENT_TARGETS; a completeness test pins the key set to capableAgents('allowlist'), so a newly added allowlist harness cannot be written-but-unreadable. Path detection now matches each harness's own declared filename, longest suffix winning, so .kiro/settings/permissions.yaml is never claimed by a shorter match. The registry also owns the canonical↔native tool vocabularies (GROK_TOOL_BY_CANONICAL, KIRO_CAPABILITY_BY_TOOL, and the rest), which permissions.ts imports for the forward serializers, so the two directions cannot drift into disagreeing about what fs_read means. Every reverse projection is lossy in a way the harness's format forces — Kiro collapses Read/Grep/Glob onto fs_read, Kimi expands one Bash arg-glob into two picomatch patterns, Codex has no rule list at all — and each target names its own loss rather than pretending the round trip is exact. agents permissions list renders the canonical allow/deny for the harnesses that had no renderer; claude, opencode and codex keep their native renderings.

• BREAKING: Goose no longer supports permissions. goose reads allowlist: false in the capability table, and its converter, writer, detector and config path are gone. Goose's permission.yaml gates whole tools (developer__shell, developer__text_editor), so several distinct canonical rules collapse onto one entry and cannot be read back faithfully — a half-supported capability that reported success while losing information. agents sync goose no longer writes .config/goose/permission.yaml, and applyPermissionsToVersion('goose', …) now refuses with Agent 'goose' does not support permissions rather than silently writing a lossy approximation. An existing permission.yaml on disk is left untouched; nothing removes it. Goose keeps hooks, MCP, skills, commands, plugins, subagents and workflows.

• MCP sync no longer writes nothing and calls it success (RUSH-2677). capabilities.mcp is true for every harness, but the code behind it was four independent switch (agentId) chains with four different membership sets — a config-path resolver, a config writer, an installer, and a parser. A harness present in one and absent from another resolved a real path and then fell straight through the writer: no file, no error, and agents sync <that harness> printed Already in sync. Antigravity was the visible case, and pi, muse and warp had writers the installer never called. They are now one table, MCP_TARGETS (apps/cli/src/lib/mcp-registry.ts), pinned to capableAgents('mcp') by a completeness test — so a newly added harness must declare a format, or declare with a stated reason that its format is not implemented. A refusal now reaches the user: installMcpServers reports it, the staleness writer forwards it instead of discarding it, and agents sync prints a Not written to <agent>@<version>: block naming the harness and the reason (copilot, amp, kiro and goose are the four with no schema verified against an installed CLI). Three path bugs fell out of the consolidation, each verified against the harness itself: antigravity MCP goes to ~/.gemini/config/mcp_config.json in the user's REAL home — only ~/.gemini/antigravity-cli is symlinked into a version home, so a version-home path lands where agy never reads — and its remote transport is keyed serverUrl, not url; grok MCP is [mcp_servers.<name>] in ~/.grok/config.toml, so the resolver no longer answers .grok/mcp.json and the parser no longer reads that TOML as JSON; kimi is read back from the .kimi-code/mcp.json the installer writes rather than .kimi-code/settings.json, so a synced server stops reporting as missing. Claude's user-scope MCP path is ~/.claude.json, where Claude reads mcpServers. A malformed existing config is now refused rather than rewritten from scratch — these files hold far more than MCP (hermes' whole config.yaml, openclaw's openclaw.json), and the previous parse-or-reset would have destroyed the rest of them. Source: apps/cli/src/lib/mcp-registry.ts, apps/cli/src/lib/mcp.ts, apps/cli/src/lib/agents.ts, apps/cli/src/lib/staleness/writers/mcp.ts, apps/cli/src/commands/sync.ts.

• A monitor's --run action actually runs now — every one of them was silently skipped, fleet-wide (RUSH-2681). Detection worked (the poll ran, the regex matched, the fire was recorded), but the action never executed: agents monitors logs <name> showed the run as skipped with no output. A monitor synthesizes a one-off JobConfig named after itself and hands it to the routines dispatch seam (executeJobDetached), which gates it on checkJobDeviceEligibility → jobRunsOnThisDevice. That function consulted the per-device ROUTINES activation manifest first and short-circuited on its answer — and a monitor's name can never be in that manifest, because nothing under monitors/ ever writes one. Every fire therefore recorded skipReason: "wrong_owner" with the empty-allowlist message Job '<name>' can only run on: . Measured on one box at 1.22.39: 5 of 5 fires skipped, zero successful action runs ever. The synthesized job now carries an explicit dispatchedBy: 'monitor' marker and jobRunsOnThisDevice skips the routine activation manifest for it — a monitor already resolves exactly-once ownership through its own device: pin (monitorRunsOnThisDevice) before dispatching, so re-gating on the routines manifest was double-gating on the wrong key. The exemption is deliberately narrow: a monitor's routine action fires a real routine, which keeps its activation gate, so a routine that is defined but not activated on this device is still refused with wrong_owner. Monitor names are NOT registered into the device routines manifest — that would conflate two ownership models and pollute agents routines.

  A second gate sat directly behind it and would have kept every run action inert on its own: with the manifest no longer swallowing the job first, the run was blocked with execution_context_missing, because resolveJobExecutionContext refuses an agent job carrying neither project nor cwd (lib/routine-context.ts) and MonitorConfig had no field able to supply one. Monitors now take an optional cwd (agents monitors add … --cwd <path>, home-relative or ~/…) and the synthesized job defaults it to the execution target's home, which stays portable across a runOn: SSH hop. Verified end to end on one box: the same monitor fires skipped / skipReason: "wrong_owner" / no output on installed 1.22.39, and completed with its agent's captured output on the fixed build. Source: apps/cli/src/lib/monitors/dispatch.ts, apps/cli/src/lib/monitors/config.ts, apps/cli/src/commands/monitors.ts, apps/cli/src/lib/routines.ts.

  dispatchedBy is runtime-only and closed at both ends of the schema boundary: writeJob strips it and readJobFileResult refuses a routine definition that carries it (inert-and-loud, like the existing device:/devices: guards), so a hand-authored YAML cannot use the marker to fire a routine on every box regardless of activation — the daemon's load path never calls validateJob.

• agents sessions preview <id> (and the id behind resume/focus) no longer says "No session matching" for a session that is actually running (RUSH-2682). Transcript indexing was lazy — only discoverSessions wrote the index and nothing scheduled it — so a session THIS box just started was listed as running by agents sessions --active while agents sessions preview <id> answered "No session matching" until an unrelated agents sessions* call happened to scan. Measured on zion (agents-cli 1.22.39): a locally-started session took 7.6 minutes to enter the index, while peer sessions arriving via sync landed in ~0s — a box indexed other machines faster than itself. Three fixes: (1) the id resolver now unions the indexed rows with the live-session registry (the same source --active reads) on a cold id miss, so a running session resolves and renders even with no transcript row yet — locally and, because the fan-out peer answers from the same union, cross-device; (2) the daemon incrementally scans this host's transcript dirs into the local index every 20s, so a locally-started session is discoverable within seconds instead of on the next unrelated invocation; (3) the cold-miss repair now waits (bounded) for a concurrent scan to finish instead of returning the pre-scan snapshot as if it were the answer. Source: apps/cli/src/lib/session/live-metadata.ts, apps/cli/src/commands/sessions.ts (computeLocalMetadataMatches, liveMetadataMatches), apps/cli/src/lib/session/discover.ts (waitForScanToSettle), apps/cli/src/lib/session/db.ts (scanInProgressByLivePid), apps/cli/src/lib/daemon-ticks.ts (runSessionIndexWarmTick), apps/cli/src/lib/daemon.ts.

• agents artifacts share now carries provenance and a title, and agents artifacts share list is a real "what have I shared" gallery, not just slugs (RUSH-2683). Every publish auto-captures agent (AGENTS_AGENT_NAME), session (AGENTS_SESSION_ID/AGENT_SESSION_ID), host (os.hostname()), repo (the current git repo), and date from the exec env/git/clock — never invented, sent only when the environment genuinely carries it. --label <text> (alias --title) sets a human display title shown in the gallery and share list; omit it and one is derived from the HTML <title>, a Markdown frontmatter title:, or the filename, with a one-line nudge toward --label in the human output — never a blocking prompt. --meta key=value (repeatable) attaches structured metadata (recommended keys: kind, project, ticket, status); reserved keys (agent/session/host/repo/date/label/label-source) are rejected client-side and enforced again in the Worker. agents artifacts share list gains --agent/--session/--label-contains filters (named to avoid a real, pre-existing option-name collision with the parent share command — see below) and returns label/agent/session/host/repo/revisionCount/meta per item (every --meta key=value an agent attached is readable again, in both --json and the human table — not write-only); the JSON shape is an additive superset of the prior one. Reserved provenance/label keys are now stripped from stored --meta unconditionally in the Worker (not just overwritten when the matching provenance header happens to be present), so a same-named --meta entry can't smuggle through on a publish that carries no agent/session/host/repo/date at all. The pre-publish email/credential scan now also covers --label and every --meta value (previously body-only), since both land in the same public customMetadata as the page itself — gated by the same --force. An explicit --label/derived title with an embedded newline is sanitized to a single line before use, instead of crashing the publish on an invalid header value. Republishing an existing slug now keeps the prior version — R2 has no native object versioning, so the Worker copies the current object to <slug>/rev-<ts>-<rand> before overwriting the canonical key (default keep-all; --no-revision skips it). The new agents artifacts share revisions <target> command lists a slug's retained history, newest first, via --for-user/--revisions-json (see below for why not --github-user/--json); revisions never appear on the public gallery or in share list beyond a revisionCount, and each keeps its own recorded expiry. The Worker template changed (customMetadata capture, revision-on-overwrite, the ?revisions=json route, gallery/listing display) — existing endpoints need agents artifacts share update to adopt it (agents artifacts share status reports when one is due). Verified against the live production share.agents-cli.sh endpoint: publish, list with filters, and revisions all round-trip real provenance. Also discovered, and fixed where introduced here: commander resolves a long option name against the whole ancestor chain, not per-command, so a subcommand option sharing a name with the parent share command's own option is silently dropped even when passed alone (verified with an isolated commander repro). This is pre-existing on share list/update/delete (predates this change) and out of scope to fix CLI-wide here — a real generalized fix needs enablePositionalOptions() audited across 552 commands, tracked as RUSH-2687; list's new filters were named to sidestep it too (--label-contains instead of --label), though its own --json/--github-user remain affected. share revisions is new in this change, so it was given non-colliding names from the start instead of shipping a fourth broken instance: --for-user (not --github-user) and --revisions-json (not --json). agents artifacts share delete / agents unshare now also delete a target's retained revisions by default (--keep-revisions to leave them) — a republished-then-deleted share previously left its prior world-readable version(s) live until the bucket's 366-day lifecycle sweep; fetching the revisions list to purge is best-effort and never blocks the primary page delete. Known limitation, tracked as RUSH-2701: the revision copy-then-overwrite isn't atomic, so two genuinely concurrent publishes to the same slug can race and silently drop the losing writer's content (no worse than pre-revisions last-write-wins, but it breaks the "keep-all" guarantee for that narrow case). Source: apps/cli/src/lib/share/publish.ts, apps/cli/src/lib/share/worker-template.ts, apps/cli/src/lib/share/delete.ts, apps/cli/src/commands/share.ts.

• The menu bar no longer groups a session under its harness name or a machine name, and its header now shows the installed CLI version (RUSH-2688). The ACTIVE dropdown grouped a Codex cloud task under a project literally named codex: a queued Codex Cloud task carries no local cwd and no repo, and the menu's cold-start cloud reader keyed the group repo ?? provider ?? "cloud", so a repo-less task fell through to the provider — the harness name — as its "project" (a repo-less task on zion: repo=NULL, provider='codex', prompt='Read README.md…'). The one project-key derivation is now explicit and shared: a working dir → its repo (worktree-aware); a row with no local cwd → its own repo when the provider names one (phnx-labs/agents-cli → agents-cli, grouping cloud work with the matching local repo), else the single explicit cloud bucket — never the harness or a machine name, no fallback chain (activeSessionProjectKey in src/commands/sessions.ts, LocalState.groupKey in the helper). Separately, the dropdown header hardcoded agents-cli; it now reads agents-cli <version> from the snapshot's cliVersion (getCliVersion(), the value agents --version prints), resolved at runtime so a menu-bar helper left running across an agents upgrade shows the stale version at a glance. Source: apps/cli/src/commands/sessions.ts, apps/cli/src/lib/menubar/snapshot.ts, apps/cli/menubar/Sources/MenubarHelper/{LocalState,StatusItemController,Models,ActiveSessionSelfTest}.swift.

• agents monitors runs/view now show a fire's REAL outcome, reconciled against the run's current status, instead of the frozen ok written at fire time (RUSH-2690). dispatchAction (lib/monitors/dispatch.ts) only checks a synchronous snapshot: executeJobDetached writes status: 'running' before spawning and returns immediately (lib/runner.ts's executeJobDetachedClaimed), while the real outcome — completed, failed, timeout, or a process that exits with no captured output — lands later, asynchronously, in that function's own settle() on child exit/error. RUSH-2500/RUSH-2681 fixed the SYNCHRONOUS skip/blocked/wrong-owner cases; this closes the async gap. A run action's fire record was persisted with ok: true off that transient running state and nothing ever revisited it, so agents monitors runs showed a healthy fire history forever while agents monitors logs (which reads the run record fresh) already showed skipped/failed — the exact divergence the ticket reproduced (fire ok at T, run skipped 3ms later). resolveFireOutcome (lib/monitors/state.ts) re-reads the run's real, current status by runId at render time and corrects ok against it; agents monitors runs and agents monitors view's Recent fires now call it instead of trusting the stored ok, and runs also surfaces the corrected status inline (ok (run failed)) when it diverges from the frozen write. The engine additionally stamps a best-effort runStatusAtFire on the fire record (schema-compatible, additive) so a future daemon-tick reconciliation pass has a cheap signal for exactly which historical fires were frozen mid-flight. Source: apps/cli/src/lib/monitors/state.ts, apps/cli/src/lib/monitors/engine.ts, apps/cli/src/commands/monitors.ts.

• agents sessions preview <id> can no longer render a DIFFERENT session's transcript (RUSH-2691). For every harness except Claude, the live-row transcript lookup took a session id and threw it away: it answered WHERE agent = ? AND cwd = ? ORDER BY last_activity DESC LIMIT 1, i.e. the newest transcript in that cwd. With two same-harness agents in one directory — measured on this fleet: two codex sessions in one checkout, ids 01a00504-8ac6-… and 01a00504-8bd8-… — both rows resolved to a third session's file. Before 1.22.39 that only mis-set a status badge; once the live row began backing preview/resume/focus it started showing users another session's content, and the picker cached that body against the wrong id. A known id now selects its own transcript, and an id the index has not reached yet renders the honest "not indexed here" card instead of a neighbour's. The id-less fallback (a single session in a cwd) is unchanged. Source: apps/cli/src/lib/session/active.ts.

• The daemon's session-index tick now reports what it actually indexed, and stops paying for a listing query it never used (RUSH-2691). The tick scanned correctly — that part of the warm index worked — but it called discoverSessions() with no options, so the number it reported came from that function's trailing listing query, whose cwd filter defaults to process.cwd() (the daemon's, $HOME) and caps at 50. The count therefore meant "sessions whose cwd is exactly $HOME, max 50": 0 on any normal box, every 20 seconds, regardless of how much the scan had indexed, with nothing logged either way. The query was also not free — it ran an archived_at-writing existence check and a Linear fetch on every tick. The tick now calls a new scanSessionsIncremental (the scan half of discoverSessions, split out so both share one implementation), reports transcripts actually parsed, and skips the listing query. The daemon logs when a tick indexes something or yields the scan claim, so a tick that goes quiet is visible rather than silent. scanOpenCodeIncremental and scanOpenClawIncremental gained the progress callback the other eleven scanners already had, so the count covers every harness. Source: apps/cli/src/lib/daemon-ticks.ts, apps/cli/src/lib/session/discover.ts, apps/cli/src/lib/daemon.ts.

• Deleted eight unreachable resource handlers (RUSH-2695). apps/cli/src/lib/resources/ held ten ResourceHandler implementations, and eight of them — commands, hooks, mcp, memory, permissions, rules, skills, subagents — had no consumer anywhere outside their own test files. This was not harmless dead weight: RUSH-2677 was filed against McpHandler.sync as the site of a silent MCP no-op, pointing the fix at a code path that never runs, and the real defect turned out to be in installMcpServers. Eight dead handlers is eight ways to repeat that. resources/workflows.ts stays — it is genuinely live (lib/resources.ts:16, :530) — as does resources/types.ts, which it imports. Note lib/resources.ts (singular, resolveResource/listResources) is a different, live module; conflating it with the lib/resources/ directory is what made this look like a whole-layer deletion at first. Refactor only, no behavior change. Source: apps/cli/src/lib/resources/.

• agents sync --yes and the --device all fan-out no longer report a refused write as a clean sync (RUSH-2700). RUSH-2677 made a declined resource visible, but only on the interactive and per-agent surfaces: agents sync <agent>@all --json and the umbrella payload still emitted a hardcoded ok: true and omitted declined entirely, and refresh() returned void so the umbrella never saw a decline in the first place. Since the fleet fan-out injects --json on each peer, a harness whose MCP config format is unimplemented (copilot, amp, kiro, goose) reported success fleet-wide while writing nothing — the exact silent-success class RUSH-2677 set out to remove, surviving on the surface machines read. refresh() now returns the declines it collected and prints a Not written: block on the human path; the umbrella carries them; both JSON emitters derive ok from whether anything was refused; and the fan-out roster renders N not written for a peer that declined, instead of a flat green ok. Audited every emitJson call site in commands/sync.ts rather than only the two that were reported: three payload shapes can carry a decline and all three now do — the rest are failure payloads, nothing to sync, dry runs, repo-git, or launch, none of which run a resource sync (runLaunchSync returns a LaunchSyncResult and never calls syncResourcesToVersion). Documented in docs/resource-sync.md alongside the pruned precedent. Source: apps/cli/src/lib/refresh.ts, apps/cli/src/lib/sync-umbrella.ts, apps/cli/src/commands/sync.ts, apps/cli/src/lib/hosts/passthrough.ts.

• agents permissions add ~/.config/opencode/opencode.json now imports instead of printing "No permission sets found" (RUSH-2702). Harness detection built its match suffixes by calling each registry target's home(''), and OpenCode's entry probes the filesystem to choose between the two spellings OpenCode accepts (opencode.jsonc / opencode.json). With an empty root that probe resolved against process.cwd(), so the same file detected differently depending on where the CLI happened to be run. Detection now reads an explicit altSuffixes list covering both spellings OpenCode accepts, so the probe can no longer change which harness a path resolves to (home('')/project('') are still consulted, but every spelling they could return is already an explicit candidate); resolving a real root still probes, which is correct there. Regression-tested for each spelling from a cwd carrying decoy configs and from a bare one — the decoy cwd is what reproduces the bug, which is why single-cwd coverage passed before.

• The capability matrix in docs/concepts.md said Goose supports permissions. RUSH-2676 removed that support and updated AGENTS.md and docs/resource-sync.md, but missed concepts.md — in the very table whose header names src/lib/agents.ts as its source of truth. Both the row and the prose list of allowlist-gated agents now match the code.

• New browser profiles are machine-local by default, and agents browser profiles prune cleans up the dead ones (RUSH-2716). A profile pins an OS-specific binary: path and a locally chosen CDP port, so the fleet-synced copy was already wrong on every other box — and because agents mint throwaway profiles freely, every ad-hoc one was landing in the shared agents.yaml and syncing to the whole fleet as junk that nothing removed. agents browser profiles create <name> now writes to this machine's own devices/<machine>/agents.yaml; pass --fleet for a profile that really is fleet config (a remote ssh:// endpoint, or a shape you want on every box). Existing profiles are not migrated — this only decides where a NEW entry is written, so a fleet profile created before this change keeps syncing. The auto-detected default stays machine-local regardless, as it has since 1.22.38. agents browser profiles prune removes local profiles that are dead — their browser is not installed here, or they have never been started — with --dry-run to preview, --fleet to opt into the synced ones (removing one removes it from EVERY machine), and --json. It never removes a profile that is in use (live browser, SSH tunnel, or open task on any of its runtime dirs, composites included), this machine's configured default, or the auto default. Source: apps/cli/src/lib/browser/profiles.ts, apps/cli/src/lib/browser/runtime-state.ts, apps/cli/src/commands/browser.ts.

• agents browser profiles list no longer breaks its own columns, and default means one thing again (RUSH-2710). The name column was a bare padEnd(20), which returns a longer name unchanged rather than bounding it, so any profile named past 20 characters shifted every later column on its row out of alignment. Columns are now sized to the content, capped at 28 characters, and truncated with an ellipsis — via one padColumn helper every column goes through, never a bare padEnd. Separately, the listing used the word "default" for two different things with no way to tell them apart: the profile literally NAMED default (the auto-detected one) and whichever profile this machine resolves a bare agents browser start to (agents config set browser.profile <name>), which are frequently not the same profile. Only the second is a marker now — a * in a leading column with a legend naming it — so default in the name column always means the profile of that name. A new SCOPE column says whether each entry is local (this machine) or fleet (synced), and --json carries scope plus isConfiguredDefault. Source: apps/cli/src/lib/browser/profiles.ts (formatProfilesTable, padColumn), apps/cli/src/commands/browser.ts.

Added

• agents routines add/edit accept the same launch-target vocabulary as agents run (RUSH-2719): --agent <agent[@version]> splits into persisted bare agent + exact version fields (previously the compound string failed validation with agent must be one of: ...); --strategy pinned|available|balanced (and --balanced) persists a per-routine selection policy that overrides the firing device's run.<agent>.strategy; --run-on auto places the job body on a healthy, signed-in, unloaded fleet device re-picked at each fire via the same picker as agents run --device auto.

Removed

• gemini is no longer a routine target: dropped from ROUTINE_AGENT_COMMANDS, so routines add --help stops advertising a hard-deprecated harness the add-gate refuses anyway. A legacy on-disk gemini routine still lands a visible blocked run record with the deprecation message (the RUSH-2202 gate now keys on deprecation alone, not command-table membership).

Fixed

• A hard-deprecated harness pinned with @version no longer slips past the routines add deprecation gate (the check ran resolveAgentName on the raw compound string and silently matched nothing).

• A routine pinned to a version that is not installed locally now saves paused with pinned <agent>@<version> is not installed on the target and an agents add repair, instead of activating and failing at fire time.

• Branding: fix the remaining agi-cli hero + marketing-domain inconsistencies the first rebrand pass missed. Root README.md hero (<h1>/logo alt) now reads "agi-cli" instead of "agents", and the marketing-domain references in README.md, DESIGN.md, demo/src/AgentsDemo.tsx, and apps/cli/docs/README.md now point at agi-cli.sh (the live marketing domain) instead of the retired agents-cli.sh. This is docs/branding only — no runtime behavior change. Not touched: the share.agents-cli.sh links (that subdomain is not live on agi-cli.sh), the npm package name @phnx-labs/agents-cli and its install lines, and historical CHANGELOG.md/.changelog/ entries. Source: README.md, DESIGN.md, demo/src/AgentsDemo.tsx, apps/cli/docs/README.md.

• agents browser resolves the task from the caller's identity — no more No task specified / export AGENTS_BROWSER_TASK=… in the common path. --task and $AGENTS_BROWSER_TASK still win when set; otherwise the CLI stamps sessionId/launchId once inside sendIPCRequest (from the session-tracker state file at the harness pid, else the process-table anchor via agentKindFromComm, stamped as launchId so the reaper never treats it as a dead session) and the daemon picks the single live task for that caller. Multiple tasks list label/id/url/age and name --task; page verbs create a task when none resolve; observation verbs and done/stop never create. Tasks get a human label (--title, else first navigated host, else untitled) while the short machine id remains the address. After a daemon restart, live tasks rehydrate from tasks.json via the profile endpoint. Version reconciliation restarts the daemon forward only so an older CLI rides a newer daemon. status --profile <bare> matches composite name@endpoint keys. Grammar: navigate [url] (alias goto), evaluate [expr] (alias eval), logs --task. Errors name a next command. Source: apps/cli/src/commands/browser.ts, apps/cli/src/lib/browser/{service,ipc,types,caller-identity}.ts.

• CLI surface consolidation — nest or remove overlapping top-level commands.

  • Synced vault unlock/lock moves to agents secrets vault unlock|lock (replaces top-level login/logout). Harness-native OAuth sign-out is agents accounts logout <harness> (API-key accounts keep accounts remove).
  • Spend caps live under agents config budget (was top-level budget).
  • Cost and shipped-output rollups nest under agents insights cost / agents insights output.
  • White-label manage verbs nest under agents setup mine (init/list/toggle/remove); top-level mine is gone.
  • Fleet poll snapshot moves to agents devices snapshot (not config).
  • Matrix runs use agents run --broadcast (with --list-tasks / --results / --task); top-level bench is removed.
  • Top-level agents profiles is removed — use agents harness (same ~/.agents/profiles/*.yml).
  • Top-level agents cp is removed — use plain scp (or scp -3 for host-to-host); no fleet broadcast advantage.
  • Top-level agents resume folds into agents sessions resume (strict id/prompt path + multi-select picker).
  • Top-level agents roster is removed — use agents sessions --active. Source: apps/cli/src/commands/{secrets-vault,accounts,budget,config,cost,output,insights,mine,setup-mine,snapshot,ssh,exec,run-broadcast,harness,profiles,resume,sessions-resume}.ts, apps/cli/src/lib/startup/command-registry.ts.

• Device config moves to per-device files; agent pins leave the tracked tree. The agents devices config <name> store is now three layers, read in order — built-in default < fleet default < per-device value: per-device settings land in the TRACKED ~/.agents/devices/<name>/agents.yaml config: block (conflict-free by construction — each machine writes only its own folder), and a new --fleet flag (agents devices config --fleet <key> <value>) writes fleet-wide defaults to central fleet.defaults.config. This supersedes #2458's central fleet.devices.<name>.config block, which a one-time migration folds into the per-device docs (central wins); the same migration extracts agents:/isolatedAgents: pins from the tracked docs into the untracked ~/.agents/.history/devices/pins-<host>.json — the root-cause fix for the commit churn that kept devices/ gitignored — and folds the legacy auto-launch.json in too. Reads report effective values; --json gains a per-key source (device | fleet | default); the TTY menu shows effective values and edits the device layer. Shims resolve default pins from the pins JSON first (device-doc and central fallbacks kept for unmigrated installs); agents fleet capture --from-pins now records only this machine's pins (peer pins no longer sync). AGI EXT reads the same per-device docs layered over fleet.defaults.config. Source: apps/cli/src/lib/device-config.ts, apps/cli/src/lib/state.ts, apps/cli/src/lib/devices/config-migration.ts, apps/cli/src/lib/shims.ts, apps/ext/src/core/deviceAutoLaunch.ts.

• A project renamed in Linear kept its old label in agents projects forever — linear.name was written once and never refreshed. agents projects link knew the current name (it printed it in the success line) but wrote only the id: def.linear = { ...def.linear, projectId: p.id } spread the prior block, preserving the stale name. projects import --from-linear did not write the field at all. Nothing in the tree ever set it, so every recorded label dated from some older version. Measured on a real registry after a workspace consolidated six Linear projects into three: agents-cli.yaml read name: Agents CLI for a project the board calls AGI, rush-app.yaml read Rush App for Rush, and three defs still pointed at project ids Linear had deleted. The label is not inert — apps/ext/src/core/managedProjects.ts surfaces it as linearProjectName in the AGI EXT Fleet panel, and agents read it when naming the work, so both reported a project name that no longer existed. link and import now write name from the live Linear row every run, link reports the replacement (renaming "Agents CLI" → "AGI" (Linear is authoritative)) and drops a url belonging to the project it just unlinked, and the projects status card leads with the name instead of the bare uuid (linear AGI 8eb8f5b1-…). Re-run agents projects link <name> --linear "<project>" to repair an existing def. Source: apps/cli/src/commands/projects.ts, apps/cli/src/lib/project-import.ts.

• One canonical formatBytes, and byte sizes now read the same everywhere. Five copies had drifted into three different renderings of the same number. Four of the five call sites change output at some boundary: agents prune showed 1.50 GB where every other surface showed 1.5 GB; session artifact sizes capped at MB, so a 1.4 GiB transcript rendered as 1433.6 MB; and agents share plus the browser artifact list capped at GB, so a 2.3 TiB entry rendered as 2355 GB and now reads 2.3 TB. Only agents inspect is byte-identical to before — its implementation is the one all five now share. Source: apps/cli/src/lib/format.ts, apps/cli/src/commands/{prune,share,inspect,sessions}.ts, apps/cli/src/lib/browser/sessions-list.ts.

• Capability version gates now honor OpenClaw's -N rebuild suffix. supports() and the command version gate each carried a private compareVersions that split on . and dropped the trailing -N, so 2026.2.19-2 compared equal to 2026.2.19. Both now use the canonical comparator in lib/agent-spec/primitives.ts, which treats a higher -N as newer. No capability currently declares a -N floor, so nothing changes today — the gate is simply no longer wrong for the version scheme OpenClaw actually ships. Source: apps/cli/src/lib/capabilities.ts, apps/cli/src/lib/commands.ts.

• SESSION_AGENTS and the sessions command surface documented accurately. The spec said "exactly these 12" while the code has 13 (muse was missing), and both it and SES-IF-2 required a sessions sync subcommand that has never existed. The command list also omitted seven real subcommands (render, bookmark, stats, insights, optimize, watch, backfill resources) while still listing verbs that 655b22512 retired behind resume. Source: apps/cli/docs/specifications.md, apps/cli/docs/architecture.md.

• The sessions picker now shows a real preview for a peer's session, not just its metadata. Arrow onto a row another device owns in agents sessions (the fleet browser or the query picker) and the pane fetches that peer's already-computed preview digest over SSH — prompt, checklist, dirs, changes, skills, errors, tests, and last response, the same card a local row gets — repainting in place when it lands (a "fetching preview from over SSH…" note shows meanwhile, and an unreachable peer degrades to the old metadata card without re-dialing on every keystroke). Peer-supplied digest strings are scrubbed of terminal escapes before they reach the TTY, and a version-skewed peer that can't answer the digest envelope falls back cleanly. Source: apps/cli/src/commands/sessions-picker.ts (sanitizeRemoteDigest), apps/cli/src/lib/session/remote-list.ts (fetchPeerPreviewDigest), apps/cli/src/lib/picker.ts (registerPreviewRepaint).

• Resource pickers number their rows. The interactive lists behind agents inspect <repo> --commands (and the other resource views built on the same picker — plugins, skills, hooks) prefix every row with its position in the filtered list ( 1. … 12.), right-aligned so labels stay columnar. Where the caller prints a total — agents inspect shows commands (12) above the picker — the row numbers read against it. Filtering renumbers from 1 over the matches. Source: apps/cli/src/lib/picker.ts (PickerConfig.numbered), apps/cli/src/commands/resource-view.ts.

Breaking

• Fleet routing: --device / -D only. The -H/--host routing flag is removed from every command that used it for remote dispatch. Use --device <name> (or -D). Scripts using --host for fleet routing must switch. Legacy --host is still stripped from forwarded remote argv for mixed-version fleets, but is no longer registered or documented as a user flag. Unchanged: agents hosts noun, Docker -H/--host, webhook bind host, harness model --host.

• Unify native logins and provider credentials under one account model (RUSH-2527). agents accounts name <agent@version> <name> gives a durable name to a harness's own signed-in login — metadata only in meta.accounts.native (a stable id + identity key + scope), never the harness's OAuth/session credential, which stays in the harness home. Native and provider accounts now share one name namespace and one accounts / accounts view renderer (text + --json). New positional grammar: accounts name <source> <name>, accounts attach <account> <target> / detach <account> <target>, and accounts sync <account> <device>. Only version-scoped nameable harnesses (Claude/Codex/Grok, plus Muse when a live email is present) can be named or attached, always to an exact agent@version. Device-scoped harnesses (Cursor/OpenCode/Antigravity/Kimi/Droid) are unsupported for native naming — their API-key path is a provider account. attach validates the live identity before binding and injects no secret or env; resolveAccountSelection resolves explicit → exact-target binding → device-scoped binding → per-harness default. remove refuses while a binding, a default, or a harness profile still references the account. Bindings are honored end-to-end: agents run and routines select the bound account at spawn — a provider account injects its env, a native account is validated live and pins the installed version that holds it (never forwarded/injected, fails closed for a remote/cloud target or a cross-harness login) — and agents view plus the fleet/harness inventories render the durable account name. Source: apps/cli/src/lib/account-registry.ts, apps/cli/src/lib/account-capabilities.ts, apps/cli/src/commands/accounts.ts, apps/cli/src/commands/exec.ts, apps/cli/src/lib/runner.ts, apps/cli/src/commands/view.ts, apps/cli/src/lib/devices/{fleet,harness}-inventory.ts, apps/cli/src/lib/types.ts.

• agents cloud run (Rush) never reads or uploads a native Claude OAuth login (RUSH-2527, SING-1b, breaking). Two changes: (1) the account manifest sent on every non-balanced dispatch no longer includes a cred_fp hash computed by reading each Claude version's OAuth token — it carries version + account email only; (2) the token-upload retry path is removed entirely — the --upload-account-tokens flag, the AGENTS_RUSH_UPLOAD_TOKENS env var, the recorded consent file, and buildAccountTokensPayload are gone. There is no consented way to copy a rotating harness login to the cloud (it would be invalidated on its next refresh and log the fleet out). When Rush Cloud asks for a token (a new account or a rotation), dispatch now fails loud and steers to a portable provider account: agents accounts add <name> --provider anthropic --auth api-key (or setup-token), then dispatch under that account. Source: apps/cli/src/lib/cloud/rush.ts, apps/cli/src/commands/cloud.ts.

• agents run --host --copy-creds and agents run --lease no longer copy a native OAuth / session login to another device (RUSH-2527, breaking for those flags). Both used to serialize each signed-in runtime's rotating login — the Claude OAuth token and codex/grok/gemini auth.json files — onto a persistent host (--copy-creds) or an ephemeral leased box (--lease) so it booted logged-in. A rotating harness login copied across machines is invalidated on its next server-side token refresh and logs the rest of the fleet out, and the fleet-auth contract forbids it on every device, ephemeral or not (docs/specifications.md SING-1b). Both now fail loud when asked to copy a signed-in native runtime and steer to the portable, non-rotating path: create a provider account (agents accounts add) and push it with agents accounts sync <name> --device <host> (a policy-never bundle, safe to reuse on many devices). A profile-dispatch --lease run carrying its own portable auth (a BYOK gateway) still works; only the native-login copy is refused. Explicit agents accounts sync and secrets export --host are unchanged. Sources: apps/cli/src/lib/hosts/credentials.ts, apps/cli/src/lib/crabbox/runtimes.ts (buildCredentialScript); shared predicate isNativeOAuthRuntime.

• agents apply / agents fleet apply no longer propagates a harness login between devices (RUSH-2527, SING-1b). login: sync used to copy each agent's portable login file (Claude .credentials.json, codex/grok/opencode/kimi/ antigravity auth.json) from the source box to every target — a rotating token that a single refresh then invalidates fleet-wide. apply now emits no push-login action and captures no credential (snapshotAuth reads nothing); every login: sync agent that needs a login is surfaced as needs-login with the honest reason and the portable alternative — log in on the box itself, or agents accounts sync <name> --device <host> a policy-never provider account. The internal apply --recv-auth receive path is gone. Sources: apps/cli/src/lib/fleet/auth-sync.ts (isCredentialSafeToPropagate), apps/cli/src/lib/fleet/apply.ts, apps/cli/src/commands/apply.ts.

• $HOME is never compiled as a "project" ruleset anymore, ending the double injection of the entire ruleset into every session (RUSH-2725). compileRulesForProject treated any cwd with .agents/rules as a project — and the user layer's own home at ~/.agents satisfies that test — so it wrote a compiled ~/AGENTS.md plus per-agent symlinks (~/CLAUDE.md, ~/GEMINI.md, …), and every session whose cwd sat under the home directory then loaded the whole ruleset twice: once as global memory from the version home, once as "project" memory from ~/. Measured on one machine: ~145 KB / ~36,000 duplicated tokens per session, on every agent, on every box — and the two copies also diverged, so an agent resolving the stale project copy silently missed the newest rules. The compiler now consults the same reserved-root predicate getProjectAgentsDir already used (isReservedAgentsDir in state.ts: the user layer, the system layer, or a git checkout of either canonical DotAgents repo never compile as a project), and a one-shot migration deletes the compiled ~/AGENTS.md, its per-agent symlinks, and header-carrying copy fallbacks already written on each machine — hand-authored files without the compiled header are untouched. Source: apps/cli/src/lib/rules/compile.ts, apps/cli/src/lib/state.ts, apps/cli/src/lib/installations/migrate.ts (removeHomeCompiledProjectRules).

1.22.39

• The auto-detected default browser profile no longer sits in the fleet-shared agents.yaml, which was wedging agents repos pull user fleet-wide (RUSH-2161). browser is a central key because named profiles a user creates are real fleet config, but the one default entry inside it is machine-local: its binary is an OS-specific path and its endpoint is a locally chosen free port. createProfile/updateProfile have routed that entry to the per-device file since 1.22.38 (isMachineLocalProfile), but nothing removed the copy older versions had already written into the shared file, and serializeCentral could not — it deletes whole device-scoped KEYS, and browser is not one. So the stale entry stayed committed and every box rewrote it with its own browser. Measured across three boxes all running 1.22.38: zion chrome + /Applications/Google Chrome.app/..., yosemite-s1 brave + /opt/brave.com/brave/brave, mark-1 the same shape, each with an empty deviceBrowser. Because the pull refuses when an incoming change touches a locally modified path, a permanently dirty agents.yaml blocked fleet config sync outright — those boxes sat 5, 8 and 79 commits behind, so merged config (a notify.owner block, device roles) reached zero machines. A new migration moves the entry into devices/<machine>/agents.yaml and deletes it from central, writing the device file first so a crash cannot lose the profile and keeping an existing device entry when one is already there. Central is edited through a YAML Document, so the hand-written comments in the committed file survive rather than being flattened by a re-stringify — which would have re-created the same churn. Named profiles are untouched. Source: apps/cli/src/lib/migrate.ts, apps/cli/src/bootstrap.ts.

• agents config set devices.<name>.tmux off turns the interactive tmux wrap off for one machine (RUSH-2620). Interactive agents run wraps the harness in the shared-socket tmux session so every agent gets an addressable %pane — that is what lets agents sessions --active tell co-located agents apart and agents focus re-attach without forking. Until now the only ways out were per-run (--raw / --no-tmux / --disable-tmux) or the AGENTS_NO_TMUX=1 env var, so a box whose tmux is broken needed the flag retyped on every launch. The new key is machine-local by design (a broken tmux is a property of one machine): it never enters the fleet-shared agents.yaml and is refused for a peer. Unset still means wrap. agents devices config <name> tmux.enabled off sets the same key. Source: apps/cli/src/lib/device-config.ts (isTmuxEnabled), apps/cli/src/lib/exec.ts (shouldWrapInTmux).

• agents devices role <name> worker marks which boxes agents run on, and --device auto follows it. Roles are fleet-wide (worker / personal), stored in the shared fleet.devices.<name>.config.role block of ~/.agents/agents.yaml, so a mark set on any box travels with agents repo push/pull — the per-device files under ~/.agents/devices/ are written only by the machine they name, so they could never carry a fleet-wide statement about a different box. Marking ANY device worker turns automatic placement into an allowlist: agents run --device auto, agents teams add --device auto, and the AGI EXT launch commands then pick only from the marked workers. A device marked personal (a machine you sit at) is never picked automatically, under any mode, and a paired cockpit stays excluded through its existing registry control role. When roles leave the pool empty, --device auto fails loud naming the fix instead of quietly running on the local machine — through agents ssh auto and the --host auto passthrough too, not just agents run. Nothing marked = today's behavior, every online device. Widen it back with agents config set auto.pool all. agents devices role with no arguments prints who is marked what and exactly which devices --device auto would consider; agents devices list tags marked rows and --json carries role plus an autoPool boolean per device. Source: apps/cli/src/lib/devices/pool.ts, apps/cli/src/lib/device-config.ts, apps/cli/src/lib/smart-launch.ts.

1.22.38

• Webhook stateTo triggers and handlers now fire only on the delivery that actually moved a Linear issue INTO that state, not on every later update while it still sits there. Previously a stateTo: Plan handler re-matched on any subsequent Issue/update — a label edit, an assignee change, a description touch — because it checked the issue's current state instead of the transition, which accumulated 11 duplicate plan comments on one issue. It now additionally requires the delivery's updatedFrom to record a state change. (RUSH-2539)

• A new release home base no longer needs the provisioning profile hand-copied over (RUSH-2541). apps/cli/bin/embedded.provisionprofile became a committed, tracked file in commit 2567004b4 (RUSH-2535), but release.sh's home-base seed step and signing-home-base-probe.sh's preflight both still checked only the home base's own on-disk working tree -- so a legitimately new home base (or one whose local checkout simply predated that commit) still reported "unprovisioned" or died at the sign step with a misleading "generate at developer.apple.com" message, even though git fetch origin (which both already run) had the file the whole time. Both now recover the blob from the freshly fetched origin/<default> ref when it is absent on disk, and the seed step fails loud with the correct recovery guidance (recover from git history; do not regenerate at Apple's portal) instead of limping forward on a warning. Source: apps/cli/scripts/release.sh, apps/cli/scripts/signing-home-base-probe.sh, apps/cli/scripts/build-keychain-helper.sh.

• release.sh's home-base provisionprofile recovery no longer dies silently under set -e on a freshly bootstrapped checkout (RUSH-2541 follow-up). The DEFAULT_BRANCH="$(git symbolic-ref ...)" assignment added to recover embedded.provisionprofile from origin/<default> ran under home_base_wt_snippet's own set -euo pipefail; git symbolic-ref returns non-zero whenever refs/remotes/origin/HEAD is unset, which is the normal state of a checkout bootstrapped via init && remote add && fetch rather than clone -- plausibly a brand-new fleet home base, exactly the box this feature targets. Under set -e the bare failing assignment tripped errexit at that line, killing the whole home-base phase with zero output before even the "main" fallback on the next line ran. Guarded with || true, matching the pattern assert_signing_home_base already established for the identical anti-pattern. Source: apps/cli/scripts/release.sh.

• Top-level agents set is removed — use agents models set (RUSH-2579). agents set [email protected] --model opus-5 moves to agents models set [email protected] --model opus-5, unchanged otherwise: same selector forms (<agent>@<version>, <agent>:*), same --model/--mode flags, same underlying run.defaults store (agents config get run.<agent@version>.model still reads it). agents set now reports unknown command. Source: apps/cli/src/commands/models.ts, apps/cli/src/lib/startup/command-registry.ts.

• BREAKING: agents share moved under a new agents artifacts group (RUSH-2580). artifacts is the noun and share the action on it, so the surface now reads noun-then-action like the rest of the CLI. The whole subtree moved down one level — agents artifacts share <file> publishes, and agents artifacts share list|delete|analytics|join|status|update are unchanged under it. The two provisioning doors collapsed into one: agents artifacts setup replaces both agents share setup (flag-driven) and agents setup share (the wizard). It runs the wizard only when no endpoint flag is typed on a TTY; type any of --bundle/--worker/--bucket/ --account/--token/--domain/--analytics-token, or run non-interactively, and it provisions directly with what you named. The top-level agents share group and the agents setup share subcommand no longer exist; share is retired from distance-1 auto-correct, so a stale invocation fails loudly instead of running a neighbouring command. agents unshare <targets...> is unchanged and stays top-level. Source: apps/cli/src/commands/artifacts.ts, apps/cli/src/commands/artifacts-setup.ts, apps/cli/src/commands/share.ts, apps/cli/src/commands/setup.ts, apps/cli/src/lib/startup/command-registry.ts.

Fixed

• The daemon orphan reaper no longer terminates live agents after a tmux server restart. A missing tmux session is now treated as unknown; helper processes are reaped only when their pane owner is present and confirmed dead, or a harness-specific rule proves their declared spawner exited.

• agents browser stops leaving duplicate and orphan tabs behind (RUSH-2622). The about:blank that a bare agents browser start opens is now registered on the task, so done/stop actually closes it — it never was, which made every bare start leak one tab permanently. agents browser start --url now reclaims a tab that an abandoned task is still holding on that exact URL instead of opening a duplicate; a tab held by a live task, or one you opened yourself, is never taken, and the new --fresh skips the reclaim entirely. Tasks also carry a lastActionAt stamp in tasks.json now. Source: apps/cli/src/lib/browser/service.ts, apps/cli/src/lib/browser/types.ts.

1.22.37

• agents.yaml's five writers now emit identical bytes, closing the rest of the sync-blocking drift (RUSH-2505). Unpadding flow sequences fixed one half of this; the other half was that the five in-place writers of agents.yaml disagreed on collection style. state.ts and manifest.ts pass collectionStyle: 'block', while feed.ts, activity.ts and the notify.owner migration in migrate.ts did not — so an empty map rendered as mcp: with an indented {} from one group and mcp: {} from the other, and the two rewrote each other forever. Measured against the real committed ~/.agents/agents.yaml, the block group round-tripped and the other group did not. All five now serialize through one stringifyDoc() helper that pins the committed shape, so a write produces no diff regardless of which command ran. routines.ts keeps its padding-only form: it writes routine YAML, which has no second writer to disagree with. Source: apps/cli/src/lib/yaml-io.ts.

• agents routines add <file> no longer rewrites the file you hand it. When the source is already the canonical routine YAML — the normal case for a definition tracked in ~/.agents — the definition is left byte-for-byte alone instead of being re-serialized with its devices: pin stripped. A source from anywhere else is still copied in.

• A devices: pin now says it applies to this box only and names agents routines devices <name> --set, instead of silently reading as Devices: all on every peer.

• agents routines edit <name> --cwd <path> and --project-anchor <name> apply and save without opening $EDITOR, so the repair the readiness gate prints is one an agent can actually run.

• A paused routine now names agents routines resume <name> as the follow-up.

• Agent helper processes are reaped when the agent exits (RUSH-2521). An interactive agent runs as the leaf of a detached tmux pane, and tearing that pane down only SIGHUPs its foreground process group — so an MCP server or a harness background daemon that had moved out of that group survived its session and kept its memory indefinitely. Measured on the fleet: one pane holding 2.5 GB of Claude Code background daemons 22 days after its session ended, and 34 orphaned cgraph-mcp --daemon processes on one worker. agents sessions reap and the routines daemon's 5-minute sweep now terminate those helpers as well as the dead panes, and killSession collects a session's helpers as it tears the session down. A helper is attributed to its session (tier 1) through the AGENT_TMUX_SESSION_NAME the pane exports and every descendant inherits — the one handle that survives reparenting — and is killed only when that session is gone, or has no attached client AND its agent process has exited; a tmux query that never actually answered (missing/unsupported tmux, a spawn failure, a timed-out server) disables tier 1 for that sweep entirely rather than being treated as "no sessions", and agents sessions reap --json's warnings array (plus a daemon log line) says when that happens. Tier 1 needs another process's environment, which is a plain /proc read on Linux; on macOS, modern ps -E no longer exposes it at all, so tier 1 safely finds nothing there today (known gap, not a regression — only tier 2 reaps on macOS). A harness that detaches its daemons from the environment (Claude Code's daemon run) is matched instead (tier 2) on the spawner pid it declares in its own argv, anchored on the process's real executable rather than a substring match anywhere in its command line, and excludes anything still owned by a live/attached pane — checked two independent ways, tmux's own live pane-pid data (expanded to that pane leaf's current process-tree descendants, so it protects a live agent's own subprocesses too, and works even with no env marker readable anywhere in that tree, covering macOS and any claude started outside an agents-cli pane) and the env marker when one is present — so a grep/cat/pager, or an agent's own prompt (or a subprocess it spawns) quoting this exact pattern, can never become a kill seed. A process that has genuinely reparented away from every live pane leaf remains reapable. Reaped only once the declared spawner pid is dead. agents sessions reap --dry-run lists what would be collected without killing anything. Source: apps/cli/src/lib/tmux/orphan-reap.ts, apps/cli/src/lib/tmux/session.ts, apps/cli/src/commands/sessions-reap.ts.

• sessions migrate --host stops leaving remain-on-exit on server-wide, and lands the migrated session where its reaper can see it (RUSH-2521). The remote launch set the tmux server default to on and never put it back, so every later pane on that box — user splits included — retained a dead corpse when its command finished; it now keeps the option on the migrated agent's own pane (which the liveness probe reads) and restores the server default to off, matching createSession. Separately, the remote session was created on tmux's bare default OS socket instead of the target's agents socket, so the reaper above never found it and killed the just-migrated, still-live agent as tmux-session-gone on its next tick — it now targets the same agents socket the reaper queries. Source: apps/cli/src/commands/sessions-migrate.ts.

• release.sh fails fast when the --device home base cannot sign, instead of merging + tagging and then dying at publish. The privileged phase (build + sign + notarize + npm publish) runs only at the very end, after the release PR is merged and the tag pushed. A --device <box> fallback that was never provisioned as a signing home base -- the documented "mac-mini is down, use --device zion" path on a box that has a Developer ID cert only in its login keychain, no headless-unlockable rush-signing.keychain-db, and no apple.com/npmjs.com secrets bundles -- failed there, after both irreversible acts, leaving a tagged-but-unpublished release (RUSH-2535: npm stuck at 1.22.35 with v1.22.36 tagged). A new preflight runs a read-only readiness probe (scripts/signing-home-base-probe.sh) ON the resolved home base, over the same agents ssh hop the publish uses, BEFORE the crabbox/PR/merge/tag phases; an unprovisioned box aborts at the preflight naming the exact missing piece. Provisioning a new signing home base remains RUSH-2541. Source: apps/cli/scripts/release.sh, apps/cli/scripts/signing-home-base-probe.sh, apps/cli/scripts/signing-home-base-probe.test.ts.

• Collapse routine enablement to one enabled/disabled flag; remove enable-project (RUSH-2540). A routine now has exactly one state — enabled or disabled — owned by this device (meta.deviceRoutines). agents routines enable <name> materialises a project routine (from the current project or a registered one) and turns it on in one step; agents routines disable <name> turns it off. The separate project opt-in (agents routines enable-project / disable-project / projects and the meta.routines.projects allowlist) is gone, and agents routines resume/pause remain as hidden aliases. agents routines list now shows discoverable project routines from your registered projects as disabled rows. Safety is unchanged: a cloned repo's .agents/routines/*.yml can never auto-fire — enablement lives in user-owned local state and a project YAML's own enabled: is never trusted for firing, and sync only refreshes definitions, never enablement. Source: apps/cli/src/lib/routines-project.ts, apps/cli/src/commands/routines.ts, apps/cli/src/lib/types.ts, apps/cli/src/lib/state.ts.

• Project / --add-dir grants reach Claude, Codex, Cursor, Kimi, and Grok — not just Claude and Codex. Multi-repo projects already attached sibling checkouts as grants on agents run --project / agents teams --project; only Claude (--add-dir) and Codex (workspace_roots) consumed them, so a Cursor / Kimi / Grok agent on the same project saw the primary cwd alone. Now: Cursor and Kimi take the native --add-dir flag (same as Claude); Grok always gets a short --rules note naming the siblings, and when a non-off OS sandbox is active (GROK_SANDBOX / --sandbox) writes a project-local .grok/sandbox.toml profile (agents-project) with those paths as read_write and selects it. Codex is unchanged. Harnesses with no multi-root surface (OpenCode, Droid, …) still ignore the grants — that is a harness limitation, stated in the capability map (lib/add-dir.ts) rather than papered over. Source: apps/cli/src/lib/add-dir.ts, apps/cli/src/lib/exec.ts, apps/cli/docs/projects.md, apps/cli/docs/teams.md.

• Writing agents.yaml no longer pads flow sequences, so ~/.agents keeps syncing fleet-wide. The YAML emitter defaults to padded flow output ([ a, b ]), but the committed agents.yaml uses [a, b]. Installing the feed / activity-log hooks (ensureFeedPublishHook, ensureActivityLogHook — run back-to-back on agents feed) re-serialized the whole document, flipping any committed flow node — e.g. a notify hook's command: [agents, notify, "{message}"] — to the padded form. That left the git-backed ~/.agents working tree permanently dirty on that one file, so agents repo pull refused and seven fleet boxes silently fell 37-52 commits behind, receiving no new project definitions, routines, or rules (RUSH-2505). All the writers that round-trip committed agents.yaml/routine YAML now pass flowCollectionPadding: false, matching the committed formatting exactly so a write produces no diff: feed.ts, activity.ts, the notify.owner migration in migrate.ts, and the routine-definition writer serializeJob (same synced repo).

• The generated HTML command reference is now browsable, not search-only. docs/command-reference.html gains a sticky sidebar tree covering all 104 command groups and every subcommand — collapsed by default, one entry per card, so the surface can be explored without knowing what to type. Search filters the tree alongside the cards and auto-expands the groups holding matches; clicking a group scrolls to it, expands it, and highlights it, and the active entry follows as you scroll. The root agents card is anchorable at #agents instead of shipping an empty id="". Still one self-contained file with no external assets. Source: apps/cli/scripts/gen-command-index.ts, apps/cli/scripts/gen-command-index.test.ts.

• agents daemon services exposes every hosted responsibility as an independent, toggleable service. The daemon previously ran all of its hosted subsystems together — secrets broker, browser IPC, scheduler, monitors, watchdog, device probe, self-heal, keychain reap, account-state refresh, and state-dir checks — with only coarse daemon.enabled and scheduler.enabled kill switches. Now each responsibility is listed under agents daemon services, and agents daemon services enable|disable <id> persists per-service state in ~/.agents/daemon/services.yaml. Missing keys default to enabled, so upgrades are no-ops. The running daemon reads the catalog at startup and gates each timer or hosted process by its toggle; a few services (scheduler, monitor engine) also re-evaluate on SIGHUP reload. Source: apps/cli/src/lib/daemon-services.ts, apps/cli/src/commands/daemon.ts, apps/cli/src/lib/daemon.ts.

• A disabled secrets broker fails loud instead of falling back to per-request Touch ID. When secrets-broker is disabled, agents secrets unlock/status/start report the disabled state up front, and any keychain-backed bundle read throws a clear error naming the agents daemon services enable secrets-broker recovery step. This closes the path where disabling the daemon's broker silently turned every secret read into a fresh biometric prompt. Direct keychain reads remain available when explicitly opted in via AGENTS_SECRETS_NO_AGENT=1. Source: apps/cli/src/lib/secrets/agent.ts, apps/cli/src/lib/secrets/bundles.ts, apps/cli/src/commands/secrets.ts.

• One event engine: events is the source of truth; audit and logs are aliases. The unified event stream already covered ops + agent activity; run-dispatch outcomes now land there too as run.dispatched (written from the same exec chokepoint that used to append the separate hash-chained ~/.agents/.history/audit/log.jsonl). New CLI surface:

  • agents events --include / --exclude families: ops, activity, commands, runs, security (sessions-style, mutually exclusive).
  • agents events --exclude commands drops high-churn command.start/command.end noise.
  • agents events --include runs lists dispatched-run outcomes (what audit list used to show).
  • agents events stats / agents events rotate own housekeeping (moved off the logs tree as the canonical home).
  • agents audit ≡ events --include runs; agents audit list same; agents audit verify still walks a legacy hash-chain file if present, else reports clean and points at the events stream.
  • agents logs ≡ events; logs audit ≡ events --include ops; logs stats/rotate re-dispatch. A bare logs <id> redirects to sessions / hosts logs for content.
  • Coverage: secrets/keychain (secrets.*), browser, computer, daemon lifecycle (daemon.start/stop/error/info mirrored from the daemon log), plus every module already covered by the CLI command.start/command.end choke point. Source: apps/cli/src/lib/event-families.ts, event-stream.ts, events.ts, audit/log.ts, daemon.ts, commands/events.ts, commands/audit.ts, commands/logs.ts.

• Nest disposable leases under devices. Manage crabbox leases with agents devices lease setup|list|stop|gc; the removed top-level agents lease command now fails as unknown, while agents run --lease and --box keep their existing behavior. Source: apps/cli/src/commands/lease.ts.

• Nest Funnel management under the daemon command. Use agents daemon funnel status|up|down for webhook ingress; the former top-level agents funnel command has been removed. Source: apps/cli/src/commands/daemon.ts.

Fixed

• Menu bar NEW DEVICES no longer lists already-registered or ignored boxes. The daemon's pending-device sentinel writer (reconcilePendingSentinels) now re-subtracts the registered roster as well as the ignore-list, so a hermetic run that empties the registry view while writing the live devices-pending/ dir cannot surface every fleet box as "new". Soft-fail probe ticks (no tailscale) still prune dismissed sentinels, and the probe fires once on daemon start so leftover pollution clears without waiting for the 3-minute interval.

• release.sh no longer deadlocks when the stuck release is one nothing can finish. Two guards could each name the other as the way out, leaving no version publishable: the stuck-tag guard refused to bump past an unpublished v<main-version> ("finish that release first"), while the catch-up guard refused that same version ("no complete merged release PR ... cut the next patch through the normal release PR flow"). Hit on 2026-08-10 with npm at 1.22.35 and v1.22.36 tagged: 1.22.36 could not be finished at all, because its CI-tested tree predates the prepack version-gate fix (1dffc78bc) and so its own npm publish rejects a correct binary. scripts/stuck-release.sh now takes the resolved bump kind and main's version, and exempts exactly one case — patch-from-main stepping over main's own version, which is precisely what validate-bump.sh documents that bump kind for. Every other stuck version still blocks, and every other bump kind still blocks on this one, so a genuine died-between-tag-and-publish jam is reported exactly as before. Source: apps/cli/scripts/stuck-release.sh, apps/cli/scripts/release.sh, apps/cli/scripts/stuck-release.test.ts.

type: breaking

Remove the top-level agents wallet command and its payment-card storage implementation. Payment-card management will return under agents secrets in RUSH-2532.

Removed the top-level agents whoami command. Use agents login and agents logout to manage synced-secrets access.

type: breaking

Remove the top-level agents worktree command. Team worktree isolation remains available through agents teams --worktree and --enable-worktrees.

• Remove the top-level agents defaults and agents export commands. Configure run defaults and the projects root through agents config; isolated installs are removed with agents remove <agent>@<version> --isolated.

• Removed the top-level agents hosts command group. agents devices is now the sole user-facing fleet registry. The registry subcommands map to devices: agents hosts list|add|remove → agents devices list|add|rm. The per-host agents hosts check <name> probe has no standalone replacement — fleet health is agents devices status (a rollup over every registered device, no per-host argument), and the per-host readiness probe still runs internally via ensureHostReady at dispatch time. The two dispatched-task commands with no devices equivalent moved under devices: agents hosts ps → agents devices ps (list tasks dispatched with agents run --device <name> --no-follow; reconciles running records; --json), and agents hosts stop <id> → agents devices stop <id> (alias kill). agents hosts logs <id> is dropped because agents logs <id> already views and follows host-dispatch task logs. The dispatch fabric is unchanged: agents run --host/--device, teams remote, and cloud --provider host all still work. Source: apps/cli/src/commands/ssh.ts, apps/cli/src/lib/startup/command-registry.ts.

• Removed the top-level agents lock and agents helper commands. agents lock (the agents.lock SHA-256 resource manifest, generation + --frozen verification) and agents helper (the macOS Keychain .app install/status/where surface) are gone, along with src/lib/lock.ts and its tests. The signed Keychain helper still installs and repairs itself automatically — the postinstall installs it, and getKeychainHelperPath()'s lazy staleness check reinstalls it on the next agents secrets use (or when you reinstall agents-cli) — so no user action replaces agents helper install. Verify: agents lock and agents helper now print an unknown-command error.

• Removed the top-level agents publish command. Skill registry search and install remain available for existing indexes, but generating and pushing an index is no longer a built-in agents-cli surface.

• Remove the resource-profile command tree. agents profile and the resource-profile aliases agents profiles use/status no longer register; agents profiles remains the provider/host profile surface for Kimi, DeepSeek, and other custom harnesses. Source: apps/cli/src/commands/profiles.ts, apps/cli/src/lib/startup/command-registry.ts.

• Remove top-level pull and push commands. agents pull and agents push are no longer registered; use agents repo pull <alias> and agents repo push <alias> instead. Source: apps/cli/src/lib/startup/command-registry.ts.

• agents sessions watch --json is the canonical incremental session-state stream for AGI EXT and other long-lived consumers (RUSH-2484). It reads one startup snapshot, then tails the canonical publisher's row-delta journal rather than re-running live-session or fleet gathers. Versioned NDJSON reset, upsert, remove, device-scope availability, and heartbeat envelopes carry opaque row keys and monotonic per-stream sequence numbers. Rows include CLI-owned recovery metadata, and unavailable device scopes retain their last rows. --local disables fleet aggregation.

• Fleet readiness now comes from the existing device/account JSON contracts (RUSH-2484). agents devices list --json includes effective config and resource health; agents devices status --json includes each row's effective profile/config; and agents devices accounts --json exposes quota verdict, capture/reset timestamps, and an explicit unavailable reason. agents run auto --interactive --device auto --strategy balanced --mode auto excludes unreachable, overloaded, signed-out, rate-limited, and out-of-credits choices and fails loud when no eligible placement exists.

• agents tickets list --json is the canonical Linear/GitHub backlog read for UI consumers (RUSH-2484). It returns one stable task shape, cycle metadata, and independent availability/error state for each tracker so one failed source does not erase another source's rows.

• Skills and commands can declare aliases: in their frontmatter. Resource resolution now matches a declared alias in addition to the canonical file/dir name, so resolveResource('skills', 'browser') finds a skill that lists browser among its aliases:. The canonical name always wins a collision — a real resource named browser beats any resource that merely aliases it, in any layer — and layer precedence (project > user > system) still applies among aliases. listResources surfaces each resource's aliases. This is the prerequisite for housing a resource under a plugin namespace (e.g. agi:browser) while a bare name keeps resolving. (RUSH-2504)

• Credential pushes now ride a hardened SSH posture: pinned host keys + no connection reuse (RUSH-2527). Every agents secrets operation that moves credential bytes across the fleet — agents accounts sync <name> --device, agents secrets export <bundle> --host, agents fleet apply --provision-secrets, and a remote bundle resolve (run --secrets b@host / secrets exec --host) — now verifies the destination against the CLI-managed known_hosts store (a changed host key is refused) and never leaves a reusable 60s SSH ControlMaster socket behind that an unrelated later agents invocation could silently reuse. This matches the posture the --copy-creds dispatch already used, extended to the explicit provider-account and secrets-export transports. Read-only browse calls (secrets list --host) are unaffected and keep the fast multiplexed baseline. Source: apps/cli/src/lib/secrets/remote.ts (credentialTransportSshOpts), apps/cli/src/lib/secrets/push.ts.

• Daemon routines and watchdog emit first-class events. Scheduler fires write routine.start / routine.end (including spawn failures, host-monitor finalization, and terminal cloud dispatch) and each watchdog pass writes watchdog.action with live/stalled/nudged counts onto the unified stream — filterable via agents events --module routine|watchdog or --event routine.start. Daemon process lifecycle remains the existing log mirror (daemon.start/stop/error/info). Source: apps/cli/src/lib/daemon.ts, runner.ts, events.ts.

• One verb gets you back into a session. Getting back in used to mean choosing among seven commands, where the right one depended on internal state you could not see — sessions focus, sessions attach, sessions reconnect, sessions resume, sessions go, top-level agents resume, and raw agents tmux attach. agents sessions resume <id-or-alias> now detects the state instead: it attaches a live tmux pane, brings a headless session to the foreground, or recovers an ended one on its owning device. It accepts a full id, an id prefix, or an ag-<agent>-<shortid> tmux alias, and takes --attach-only (attach one living process or refuse, never fork a copy). Bare agents sessions resume keeps the multi-select history picker. agents sessions --help drops from 21 commands to 16.

• Retired, hidden but still working for one release — each prints the replacement on stderr: agents sessions attach <id> and agents reconnect [id] → agents sessions resume; agents sessions go <id> → agents sessions resume <id> --attach-only. agents sessions focus is hidden and becomes the internal lifecycle dispatcher (resume delegates to it), so it is deliberately not warned. One behaviour is deliberately dropped: bare agents reconnect (no id) auto-attached the most recent session started in the current directory with no prompt; bare agents sessions resume opens the picker instead, so that zero-typing path goes away when reconnect is deleted after its deprecation window (tracked on RUSH-2498). Kept: agents sessions detach (the genuine inverse — it stops the interactive process and respawns the agent headless, which nothing else does), fork, migrate, and the raw agents tmux attach <name> escape hatch.

• A live tmux alias now attaches instead of being keyword-searched. agents sessions resume ag-kimi-632c1fbc attached nothing before: the alias fell through to a keyword query and returned unrelated text matches while the pane was alive and attachable. The alias's hex is the launch id, not the harness session id, and a harness that writes no state/sessions/<pid>.json record cannot be mapped back to a session at all — so such a pane had no working selector and raw tmux -S … attach was the only way in. The pane name is now a sufficient handle. #{pane_dead} is still queried at attach time, so a dead pane routes to recovery rather than attaching a corpse.

• A full UUID is one session, not an ambiguity. agents sessions focus <full-uuid> could answer "…" is ambiguous (2 sessions). Use more of the id. with no longer id to give: a transcript that had synced to a second machine counted twice, and one copy had no transcript file left. Synced copies sharing one full id now count as one logical session (SES-IF-2a). A genuine prefix collision between different ids still reports both.

• agents sessions reap is removed (it shipped in 1.22.36 alongside the dead-pane reaper). The 5-minute daemon sweep stays — it is the part that matters, and it only kills sessions where all panes are dead. The daemon calls the reaper directly, and agents tmux kill <name> (idempotent) already covers the manual case.

Source: apps/cli/src/commands/sessions-resume.ts, apps/cli/src/commands/focus.ts, apps/cli/src/commands/{attach,reconnect,go}.ts, apps/cli/src/lib/session/types.ts.

• A tmux-wrapped run killed mid-work no longer reports success (EXEC-23b). agents run wraps an interactive run in tmux and reads the agent's exit status back off the pane. On the three paths where tmux could not report one — the pane unreadable because the server or session went away, or dead with no #{pane_dead_status} — it returned 0. So an interactive run whose tmux server died under it ([server exited unexpectedly], the agent stranded at an approval prompt) printed a failure banner reading exit 1 and handed its caller 0: anything scripting agents run counted a killed run as a clean finish. Those cases now resolve 1 and print an explicit "outcome unknown" banner, matching the rule the --host follow path already used ("the remote's own exit code, or 1 if unknown"). Exit 0 is reserved for an outcome tmux actually reported: a confirmed-alive pane (a clean Ctrl-b d detach) or a dead pane whose status tmux read as 0. One helper, tmuxRunExitCode(pane, knownAlive), is now the single decision behind every runInTmux return path, so the banner and the returned code cannot disagree. That includes the native-resume attach (agents run <agent> --resume), which previously returned a hardcoded 0 without ever querying tmux — prepareSessionForResume now returns the pane it resolved so the resumed run can be asked about too. Known cost, accepted deliberately: the daemon's 5-minute dead-pane reap can remove a cleanly-exited session in the moment between its pane dying and the status read, so such a run reports 1; once the pane is gone there is no other evidence, and a false unknown beats a false success. Source: apps/cli/src/lib/exec.ts, apps/cli/src/lib/tmux/session.ts, apps/cli/docs/specifications.md.

• agents sessions --browser / --computer now name the agent session that drove the task (RUSH-2549). Every browser row used to read unlinked with last known owner: UNRESOLVED@<host>, because task identity lived only in the browser daemon's tasks.json — a file saveTaskState rewrites from the LIVE task map, so agents browser stop erased the link and a daemon restart emptied it. Observed on a real machine: a profile's tasks.json was {} while its sessions/ dir held dozens of task dirs full of captures. Identity is now written once at task start to a durable browser_sessions row and is never deleted, so a finished task still resolves its session. The link also keys on AGENT_SESSION_ID — carried by every agent, measured on 5 of 5 live agent processes — in addition to AGENT_LAUNCH_ID, which was on only 2 of 5 and was previously the sole join key. Computer-use invocations get the same durable computer_sessions row: they already resolved identity correctly (stampProvenance reads the session env) but recorded it only in the event ledger, which prunes at 7 days / 50 MiB, so a run vanished on day 8; the row keeps it listed with identity, timing and a total action count (rendered as N actions (per-verb detail pruned from the event log)), and never reconstructs the pruned per-verb detail. The table carries its own long retention (TOOL_SESSION_MAX_AGE_DAYS, swept from the listing path) so it cannot grow without bound, and reads are limit-bounded. Both tables are metadata only — screenshots, PDFs and recordings stay on disk under .cache/browser/<profile>/sessions/<task>/, referenced by path; nothing copies bytes into SQLite. Identity is resolved in the calling CLI process, never daemon-side (the shared daemon would attribute every task to itself). Schema v39, additive. Forward-only: captures taken before this cannot be linked retroactively, because their identity was already discarded — those rows read unlinked honestly. Known gap: agents browser start --host <device> still records no session, because the SSH dispatch forwards AGENTS_ACTOR* / AGENT_TERMINAL_ID but not AGENT_SESSION_ID (lib/hosts/dispatch.ts withActorEnv); tracked on RUSH-2549, not fixed here. Source: apps/cli/src/lib/session/db.ts, apps/cli/src/lib/browser/service.ts, apps/cli/src/lib/browser/sessions-list.ts, apps/cli/src/lib/computer/sessions-list.ts, apps/cli/src/commands/browser.ts, apps/cli/src/commands/computer-actions.ts, apps/cli/docs/browser.md, apps/cli/docs/computer.md.

type: feature

Add usage.primary-host, a user-scope agents config key that pins the device authoritative for fleet usage while falling back to interactive.host when unset.

• Fleet usage primary runtime. When usage.primary-host (or interactive.host) is set, only that device runs frequent live usage API refreshes; peers pull a token-free snapshot. Standalone mode keeps per-host refresh when no pin is set.

• VSCodium agent tabs get the right chip on focus/resume (#2478). The vscodium-agent spawn URI now carries agent / sessionId / title from sessions focus and sessions resume, so remote ssh … tmux attach tabs open with the harness icon and status bar instead of a generic shell. The terminal engine's SurfaceItem / LaunchRequest plumb the optional identity through; other backends ignore it.

• Rename the top-level webhook receiver command to agents webhooks. The singular spelling is no longer registered; use agents webhooks serve.

1.22.36

• agents cp <src> <dst> — first-class fleet file transfer (RUSH-2297). New top-level command that copies files and directories between fleet hosts (local-to-remote, remote-to-local, and remote-to-remote) using the same SSH/device fabric as agents ssh. Either endpoint is host:path (remote) or an absolute local path. Remote ~ and literal $HOME in a path are resolved on the remote host before transfer — never in the caller's shell — preventing the silent-failure class where a shell variable expands to the local user's home directory instead of the remote one. Unknown devices fail loudly with a human-readable error before any SSH connection is attempted. Recursive directory copies use -r; two-remote transfers route through the local machine (-3) so no direct SSH trust between fleet boxes is required. Source: apps/cli/src/commands/cp.ts.

• Faster warm CLI bootstrap: skip redundant sync spawn + multi-install PATH scan (RUSH-2324). Ordinary (non---help/--version) invocations no longer fork the detached auto-pull worker when a cycle finished in the last five minutes (parent inspects the .last-sync stamp and fresh *.lock mtimes under the fetch cache), and the multi-install install-root scan is memoized beside .update-check for the same window. Saves the measured ~7.3ms spawn + ~1ms PATH walk on the warm path without changing sync semantics. Source: apps/cli/src/lib/auto-pull.ts, apps/cli/src/lib/auto-pull-worker.ts, apps/cli/src/lib/self-update.ts, apps/cli/src/bootstrap.ts.

• Unknown / typo'd top-level commands no longer load every command module (RUSH-2329). A misspelled name used to call registerAllEagerCommands (and the lazy sessions/teams/cloud tree) solely to build the "did you mean" candidate list — ~250–330ms of dynamic import on cold start. Spellcheck now walks the plain-string KNOWN_TOP_LEVEL_COMMANDS set (same first-seen order for tie-breaks) and registers only the auto-corrected command before reparse. Distance-1 auto-correct and --host re-routing after correction are unchanged. Source: apps/cli/src/index.ts, apps/cli/src/lib/startup/spellcheck.ts.

• CLI bootstrap no longer loads versions.ts via the brand edge (RUSH-2331). Every agents invocation statically imports brand.js for resolveBrandName / disabledCommandsForActiveBrand. That module used to import agents.js solely for reservedBrandNames() / validateBrandName() (mine/setup only), and agents.js pulls the full versions.ts graph — ~90ms of module evaluation on the --version / secrets-broker / bare-help path. brand.ts now reads the zero-dep agent-cli-commands leaf (pinned equal to AGENTS[*].cliCommand by test); the self-update → primitives redirect from the same ticket remains. Source: apps/cli/src/lib/brand.ts, apps/cli/src/lib/agent-cli-commands.ts.

• Synchronous secrets-broker reads no longer pay ~140ms of CLI bootstrap (RUSH-2335). dist/index.js is now a slim shell that statically imports only the leaf lib/secrets/sync-commands.js and dispatches __secrets-get / __secrets-ping / __secrets-lock (plus __vault-age-helper, __shim, __daemon-run, __daemon-tick) before loading the full commander graph. Everything else arrives via await import('./bootstrap.js'). Cold node dist/index.js __secrets-ping was measured at ~160–180ms against a ~22ms bare-node floor; the leaf-only path evaluates in roughly one bare-node spawn plus the agent handler. Source: apps/cli/src/index.ts, apps/cli/src/bootstrap.ts.

• agents --help / --version no longer run the macOS menu-bar self-heal (RUSH-2346). On darwin the startup self-heal (installMenubarLaunchAgentOnUpgrade()) ran on every invocation, including the pure documentation paths, dynamically importing lib/menubar/install-menubar.js and doing its filesystem checks before deciding to no-op. It now carries the same helpOrVersionRequested gate the update check, background sync, and ensureInitialized already use, so help and version skip the self-heal's filesystem work and its installMenubarLaunchAgentOnUpgrade() call. (On the default path the lib/menubar/install-menubar.js module is still pulled into the import graph via the static migrate.ts → routine-readiness → hosts chain; shedding that residual import cost is tracked separately.) Source: apps/cli/src/index.ts.

• 1Password import now captures each item's notes as a description (RUSH-2348). agents secrets import --from 1password:<vault> previously read only an item's credential value and dropped its notesPlain notes entirely. The importer now extracts a NOTES-purpose field (1Password's notesPlain, or a field labelled notes) as descriptive metadata on the imported secret, while the CONCEALED credential remains the value — notes are never selected as the secret itself. Source: apps/cli/src/lib/onepassword.ts.

• buildExecEnv strips an ambient CLAUDE_CODE_OAUTH_TOKEN on non-interactive Claude runs when no per-account setup-token resolves (RUSH-2360). A run dispatched on a provisioned box inherits the launcher's shared, rotating CLAUDE_CODE_OAUTH_TOKEN through sanitizeProcessEnv(process.env). When the reserved auth bundle carried this version home's own setup-token it was injected over that ambient value, but when NONE resolved the ambient token was left in place — so agents run claude "<prompt>" could silently authenticate as the shared token, the RUSH-1822 fleet-wide-logout hazard. The non-interactive path now mirrors the routines path (runner.ts:1017-1021) unconditionally: inject the resolved setup-token, else delete the ambient one, so a missing login fails loud (401) against this home's own credential rather than borrowing another's. The strip also runs when no version resolves (version === null), matching the routines guard. Interactive runs are unchanged — they still keep a deliberately-exported token and drop only an inherited copy of their own setup-token by value (#2383). Source: apps/cli/src/lib/exec.ts (buildExecEnv).

• Add DeepInfra profiles, accounts, and usage (RUSH-2362). agents accounts add deepinfra --provider deepinfra --auth api-key stores the API key in the existing prompt-free account bundle, and agents profiles add deepinfra --account deepinfra configures Codex for https://api.deepinfra.com/v1/openai with deepseek-ai/DeepSeek-V3. The daemon-owned BYOK refresh path reads DeepInfra's documented /payment/checklist endpoint so agents view can show current usage and prepaid credit without raising a credential prompt. Source: apps/cli/src/lib/profiles-presets.ts, apps/cli/src/lib/account-provider-registry.ts, apps/cli/src/lib/byok-usage.ts.

• Faster CLI bootstrap: skip --host passthrough module graph when no routing flag (RUSH-2374). Ordinary named invocations (agents view, agents sync, …) no longer dynamically import lib/hosts/passthrough.js (~187ms cold module graph measured on yosemite-s1) just for maybeRunOnHost to return false. Bootstrap now gates that import on a leaf hasHostRoutingFlag scan of --host/-H/--device/--hosts/--devices (~0.001ms). Also import machineId from the leaf machine-id.js instead of the session/sync/config.js re-export on the routed path. Source: apps/cli/src/bootstrap.ts, apps/cli/src/lib/hosts/routing-flag.ts, apps/cli/src/lib/hosts/passthrough.ts.

• agents teams status shows PR OPEN instead of bare COMPLETED when a teammate finished with an unmerged PR (RUSH-2380). Process-exit success was reported as COMPLETED even when the PR was still open, so orchestrators composed on top of unlanded work (3/3 edit-mode teammates one day). Delivery is now a separate postcondition (delivery: pr_open | pr_merged | no_pr | …) on status JSON; the human status label is PR OPEN (magenta) when process status is completed and a PR URL is present without a known merge. Process status still drives the DAG (--after); only the display/JSON delivery signal changed. Source: apps/cli/src/lib/teams/delivery.ts, apps/cli/src/lib/teams/api.ts, apps/cli/src/commands/teams.ts.

• Live agents no longer leave the active set (and become unreachable by agents message) when the by-pid registry is empty (RUSH-2384). A mid-run headless/teams process can keep working with --session-id on its argv while ~/.agents/.cache/terminals/by-pid/ has zero files (wrapper pid exited and was pruned, or the launch never recorded one). The headless scan only consulted the registry / SessionStart hook / newest-jsonl heuristic, so foldSubordinateAgents could collapse that process into a parent and drop its id from agents sessions --active — and agents message <id> resolved purely from that set, so the only recovery was kill-and-redispatch. The scan now reads --session-id from the live process argv (Linux /proc/<pid>/cmdline, Darwin ps), treats argv identity as "own session" so those children are not folded away, and agents message falls back to the same process-table proof before reporting no match. Source: apps/cli/src/lib/session/pid-registry.ts, apps/cli/src/lib/session/active.ts, apps/cli/src/commands/message.ts.

• agents view names the setup-token usage-scope gap instead of painting healthy headless Claude accounts as broken (RUSH-2392). claude setup-token mints user:inference only; Anthropic's usage endpoint requires user:profile and returns HTTP 403. The probe and live usage read previously treated that 403 like any other rejection — auth-health mapped it to revoked, and formatUsageSummary stamped cached bars unverified. The accounts best provisioned for unattended work therefore looked the least healthy. The Claude usage path now detects the known scope-denial body (user:profile / "scope requirement"), surfaces usage unavailable (headless), and auth-health classifies reason: usage_scope as unverified (benign) rather than revoked. Minting another setup-token cannot fix bars; interactive login (or device-role strategy, RUSH-2395) is the only path to usage meters. Source: apps/cli/src/lib/usage.ts, apps/cli/src/lib/auth-health.ts, apps/cli/src/commands/view.ts, apps/cli/src/commands/versions.ts.

• A headless run that exits with its branch on an OPEN PR now says so (RUSH-2394). A headless agents run that backgrounds gh pr checks --watch and exits strands its own PR: that watcher is a child of the agent process tree and dies with it, so nothing merges on green and the PR sits open with nobody watching. A headless writable run that exits (or crashes) with the branch still on an OPEN pull request now prints a loud stderr warning naming the PR. Advisory only — it never throws and never blocks the run's exit. Source: apps/cli/src/lib/pr-land-detach.ts, apps/cli/src/commands/exec.ts.

Breaking

• Replace version-bound account labels with durable credential accounts. Create API-key, Claude setup-token, or bearer-token accounts with agents accounts add; native OAuth logins remain harness-managed.

New

• Reuse one named provider credential across compatible native and custom harnesses with agents run --account <name> or a harness account: default, and rotate it without changing the account id.

• The daemon can no longer crash-loop unbounded (RUSH-2418). Crash-loop prevention existed only as the OS supervisor's retry, uncapped: the launchd plist set KeepAlive with no ThrottleInterval, so a daemon dying during startup was relaunched on launchd's ~10s default — six times a minute, forever — and the systemd unit's Restart=always had no StartLimitIntervalSec/StartLimitBurst to ever give up. Three layers now bound it. The plist carries a ThrottleInterval (the same fix the menu-bar helper already ships), the unit carries StartLimitIntervalSec/StartLimitBurst in [Unit] (where systemd 229+ actually reads them) with RestartSec paced so the bursts fit inside the window, and agents __daemon-run installs top-level uncaughtException/unhandledRejection handlers — there were none anywhere in the CLI — that route the failure into the daemon's own logs.jsonl and exit non-zero deterministically instead of dying on Node's default handler with a raw stack. Separately, daemon-health.ts's consecutiveFailures was write-only telemetry; a new daemon-start record now drives an auto-start circuit breaker. Starts are counted up front and cleared only by a daemon that finishes booting, because the crash loop is invisible from the launcher's side — a daemon that spawns and then dies returns a perfectly real pid, so there is no error to observe. After 5 consecutive starts that never report healthy, the implicit auto-start (ensureDaemonStarted, reached from secrets unlock, browser start, the watchdog) refuses instead of relaunching a broken daemon on every foreground command, and agents daemon doctor reports the streak and its recorded cause. An already-running daemon is still reported, and the explicit agents daemon start override is never gated. Source: apps/cli/src/lib/daemon.ts, apps/cli/src/lib/daemon-health.ts, apps/cli/src/commands/daemon.ts, apps/cli/src/index.ts.

• agents daemon stop now proves the daemon's state files were released, not just its sockets (RUSH-2421). The stop postcondition checked the daemon process and the two sockets (browser IPC, secrets broker) but not the three files a graceful shutdown removes: the lifetime marker, the heartbeat, and the daemon's instance-registry entry. Those are cleaned up in handleShutdown, which never runs on the escalated killTree path or on Windows — so a wedged daemon that had to be killed left all three behind while the stop reported ok: true. That is not cosmetic: a leftover heartbeat is what resolveLiveDaemonPid consults to re-adopt a daemon whose pid file is gone, so a dead daemon could read as running, and a leftover registry entry is what the stray-daemon reaper enumerates. Each is now checked and reclaimed the same way the sockets are, and reported in released/surviving — with the same ownership rule the broker socket already used: a marker naming a pid that is alive and is not the daemon just stopped belongs to a live successor and is left untouched. Separately, BrowserIPCServer.stop() called net.Server.close() without awaiting its 'close' event, so it resolved while the socket was still bound; since the daemon awaits it before exiting and a successor treats that exit as proof the predecessor's resources are free (SING-11), the proof was false. It now waits for the real release — ending held client connections so the binding is freed immediately, with a 1.5s backstop kept well below the daemon's SIGTERM grace window so a slow close can never be what gets the daemon killed. Source: apps/cli/src/lib/daemon.ts, apps/cli/src/lib/browser/ipc.ts.

• A graceful agents daemon stop no longer escalates to a kill when a browser client is attached (RUSH-2421 follow-up). The awaited-close fix shipped with its timeout set to 5s — exactly the daemon's own SIGTERM grace window. net.Server.close() does not complete while any connection is open, and browser clients hold one open on purpose (the socket stays warm between actions), so handleShutdown was still inside browserIPC.stop() when stopDaemon gave up waiting and ran killTree. Measured: 5512ms for a stop that should take milliseconds. stop() now ends the tracked client connections instead of waiting for them, so the binding is released immediately; the timeout is a backstop only, cut to 1.5s so a slow close can never be what gets the daemon killed. stop() is also idempotent now — a second SIGTERM awaits the same close rather than racing past it because the server handle was already cleared. Separately, the stop's registry-entry check treated its own pid as residue unconditionally, so a daemon that survived the kill lost the record findSurvivingStateDirDaemons reads and the next stop would report ok: true with it still running; ownership is now decided by the stop's own survivor scan rather than isAlive, which also fixes the zombie case (a SIGKILLed daemon stays signalable until reaped, so kill(pid, 0) reports it alive). Source: apps/cli/src/lib/browser/ipc.ts, apps/cli/src/lib/daemon.ts.

• Repeated SIGTERMs during daemon shutdown now run the shutdown once (RUSH-2423). handleShutdown is reachable from SIGTERM, SIGINT, and the state-dir self-check, and two can arrive together — a service manager SIGTERMing a daemon whose state dir was just removed. It was safe only because every step inside happens to be idempotent, which is a property each newly added step would silently have to re-earn; single-shot is now a property of the function. Alongside it, three internals cleanups with no behaviour change: the daemon's log path is exported as getDaemonLogPath() and the two commands that rebuilt it from a hardcoded 'logs.jsonl' literal (agents daemon logs, agents routines) now call it, so renaming the file cannot silently point them at nothing; the background-tick cadences that were inline literals at their setInterval are named beside the existing tick constants, each with why that cadence and not another; and the comments settle on one term, "state dir", replacing a daemon-dir/state-dir/state-tree mix. Source: apps/cli/src/lib/daemon.ts, apps/cli/src/commands/daemon.ts, apps/cli/src/commands/routines.ts.

• A torn meta.json write no longer permanently disables orphan-worktree cleanup for every worktree name in every team (RUSH-2429). saveMeta() wrote with a bare fs.writeFile — no tmp file, no rename — so a process killed mid-write left a truncated, unparseable meta.json. loadFromDisk() returned null for that file from a bare catch, indistinguishable from the file never having existed, so loadExistingAgents()/rescanFromDisk() silently skipped it forever and isWorktreeClaimed() (which reads meta.json directly, not through the cache) then failed CLOSED on it globally: it scans every record and answers "claimed" the first time it can't read one, so one corrupt record permanently blocked teams add's orphan-worktree teardown for every name in every team. saveMeta() now writes to a sibling tmp file and fs.renames it into place — atomic on POSIX, so a killed write leaves either the previous valid record or the new one, never a torn one. loadFromDisk() now quarantines a record whose content is corrupt — a torn or unparseable meta.json, the case that actually breaks cleanup — by renaming it to meta.json.corrupt with a warning, so it stops masquerading as "no record" and a subsequent isWorktreeClaimed() scan sees real absence for that entry instead of failing closed on it forever. A transient read error (EACCES/EIO/EMFILE) is NOT corruption: the file is intact and simply could not be read that moment, so loadFromDisk() returns null without renaming it — renaming a valid record away would itself be the fail-open this fix exists to prevent. isWorktreeClaimed()'s fail-closed behavior for a record that is genuinely present-but-unreadable at decision time is unchanged — a spurious "unclaimed" would run git worktree remove --force over a live teammate's checkout, so the guard stays as strict as before; only a corrupt record's permanence is fixed. Source: apps/cli/src/lib/teams/agents.ts.

• Daemon routines can no longer resolve a stale agents binary from the Node prefix (RUSH-2431). The daemon service manifest now puts the directory containing the running agents launcher first on PATH, ahead of the Node bin directory. This stops scheduled routines from shadowing the current binary with an older agents installed inside the same Node prefix. As a runtime backstop for already-running daemons, command routines also inject a shell-function guard (and a PATH prepend fallback) so bare agents invocations use the same binary that launched the routine. agents doctor now reports a binary-shadow warning when another agents binary on PATH or in a well-known install directory could preempt the running one. Source: apps/cli/src/lib/daemon.ts, apps/cli/src/lib/runner.ts, apps/cli/src/lib/cli-entry.ts, apps/cli/src/lib/binary-shadow.ts, apps/cli/src/lib/devices/doctor-findings.ts, apps/cli/src/commands/doctor.ts.

• agents computer sessions / agents sessions --computer is task-first, grouped by run (RUSH-2432). The computer counterpart of agents browser sessions (RUSH-2407): every computer.action event (already written by every agents computer <verb> and the embedded run --task loop) is read back from the durable event ledger and grouped by a unique CLI invocation identity — one row per invocation without conflating later OS pid reuse. Each row shows machine, target app/window when known, per-verb action counts, and — when the run's sessionId/launchId resolves — the owning agent session's canonical digest. A run with an unindexable identity shows unresolved; one with no agent-session identity at all shows unlinked. On a TTY the picker is interactive with search and an action-list drill-down (no artifact to open, unlike browser); --no-interactive/--json print the flat table. The agents sessions --computer alias also preserves --limit, --host, and --device. Nothing sensitive is added to the ledger: typed text stays length-only, and a --task description is bounded to 200 characters before it is ever written. Source: apps/cli/src/lib/computer/sessions-list.ts, apps/cli/src/commands/computer-sessions-picker.ts, apps/cli/src/commands/computer.ts.

• A session no longer vanishes when its transcript file is deleted — the local DB is authoritative for its user turns (RUSH-2436). Session history was a file-anchored index: delete the .jsonl (via agents remove's trash, a manual rm, a .history version-home rotation, or a box reimage) and the session silently disappeared from every agents sessions listing and could not render, even though a DB row and its user-turn text still existed. The user-turn content for every harness is already stored durably in the session_text FTS content column, so querySessions/topSessionsByCost now KEEP a file-gone session whose content survives — flagged archived — instead of dropping it, agents sessions <id> --include user renders those user turns from the DB (with an archived — transcript file removed banner) instead of a bare metadata dump, and the picker preview does the same. A row whose file is gone and whose content is empty (a phantom — a stale/moved file_path) stays suppressed. Merely listing a file-gone session also no longer PURGES its redacted tool-call evidence: that destructive purge-on-read (purgeToolCalls from the querySessions missing-file branch) is removed. A row whose file returns (a recoverable-trash restore) is un-archived on the next listing. A new persisted archived_at column (schema v38) stamps the first confirmation that a scanned file went missing. Source: apps/cli/src/lib/session/db.ts, apps/cli/src/lib/session/tool-store.ts, apps/cli/src/commands/sessions.ts, apps/cli/src/commands/sessions-picker.ts.

• Optional off-box session backup to Cloudflare R2 (agents sessions export --to-r2 / import --from-r2). A durable, on-demand backup target for session transcripts — protection against losing the whole box, not just a file on it. export --to-r2 uploads each selected session as its own encrypted object under sessions/<machine>/<agent>/<session> in the r2.backups bucket; import --from-r2 downloads and restores them through the normal placement (deduped, local-always-wins). Bodies are sealed client-side with AES-256-GCM under the shared R2_SYNC_ENC_KEY (zero-knowledge — Cloudflare only ever stores ciphertext); credentials come only from the r2.backups secrets bundle (keychain, never env/disk). It is a pure backup target: on-demand only, no daemon cycle, and not the retired multi-writer sync. A missing/locked r2.backups bundle fails loud with an actionable message, never a silent no-op. Source: apps/cli/src/lib/session/sync/r2.ts, apps/cli/src/commands/sessions-export.ts, apps/cli/src/commands/sessions-import.ts.

• agents sync now prunes resources removed from source, instead of only ever adding (RUSH-2438). A command or skill deleted from a DotAgent repo used to linger in every installed version home forever — observed: 8 removed commands stayed live in the / menu of all 7 Claude homes, and --force did not clear them. The gap was that the repo-scope reconcile forms (agents sync <agent>@all system, agents sync <agent> system --force) pass a selection, which turned off the full-sync orphan sweeps; those forms now reconcile deletions too. The prune is manifest-bounded so it never over-deletes: the removal set is (names the last full sync recorded) − (names still present in source across ALL layers), intersected with what is actually in the home. Three guarantees follow — a file you hand-authored into ~/.claude/… was never recorded so is never touched; a system command removed while a same-named user command still exists is kept (still provided by a layer); and with no sync manifest yet the reconcile prints a one-line notice and prunes nothing rather than guessing. Every harness prunes through the same writer that installed the resource — a native command file (Claude/Grok/Cursor), a command-as-skill dir (Codex ≥ 0.117, Kimi), a Goose recipe. Removals are shown under a Pruned from <agent>@<version> block and carried in the --json payload as pruned: { commands, skills }. Hooks are out of scope here — pruning a hook must also GC its settings.json/hooks.json registration, a Windows-portable-path surface; tracked in RUSH-2456. Hook files stay reconciled by the existing in-write orphan sweep. Source: apps/cli/src/lib/staleness/prune.ts, apps/cli/src/lib/staleness/writers/{commands,skills}.ts, apps/cli/src/lib/versions.ts, apps/cli/src/commands/sync.ts.

• Stop agents run from triggering a broad Keychain scan (RUSH-2440). Agent-only bundle reads now resolve exact items from bundle metadata instead of enumerating the macOS Keychain, preventing unrelated biometry-protected secrets from raising a Touch ID sheet on every launch. Interactive reads retain the existing enumeration-plus-declared-item union. Source: apps/cli/src/lib/secrets/bundles.ts.

• Restore the stale-ACL'd hmackey heal on the hot read path (RUSH-2441). v1.22.7 moved the once-per-machine no-ACL re-store of agents-cli.hmackey onto readHmacKeyRecord so every hashed keychain lookup (including the SessionStart agents devices list stats probe) converged a biometry-ACL'd key to silent. v1.22.10 (bf79dc885 / #1995) put the heal back inside maybeAutoRekey, which is bypassed for the hmackey and hashed-name lookups themselves (prepareServiceName returns early for HMAC_KEY_ITEM), so an already-migrated machine prompted forever again — and the 1.22.7 changelog still claimed the read-path guarantee. The heal is back on readHmacKeyRecord: first hashed lookup re-stores no-ACL once (guarded by healedNoAcl), silent forever after. Source: apps/cli/src/lib/secrets/index.ts.

• scripts/install.sh restarts a running routines daemon after a dev install (RUSH-2442). The dev install strips the npm postinstall hook (so it doesn't nudge PATH for a side-by-side prefix), which was also the only place that bounced the daemon onto the just-staged code. A long-lived daemon kept hosting a secrets broker built from the previous install; version skew then wiped held bundles and re-armed Touch ID on the next secrets read. After linking bins, install.sh now reloads a running daemon onto the just-linked binary (best-effort, skipped in CI / AGENTS_NO_HEAL=1, never starts a daemon that wasn't already up). Source: apps/cli/scripts/install.sh.

• agents share gains --unlisted/--private, a 30-day default expiry, and a pre-publish sensitive-content scan (RUSH-2443). Root cause of the RUSH-2428 incident: every publish was world-readable with no private option, no default expiry, and no content gate. Unflagged publishes now expire in 30 days (--expire never for permanent). --unlisted (alias --private) stores visibility=unlisted so the public gallery and agents share list omit the page while the direct URL still works (capability URL — unlisted, not secret). Before upload the CLI refuses files that contain email addresses or credential-shaped strings (ghp_…, sk-…, AKIA…, Bearer …) unless --force. Requires agents share update on already-provisioned endpoints so the Worker filters unlisted objects. Source: apps/cli/src/lib/share/{publish,worker-template}.ts, apps/cli/src/commands/share.ts.

• agents share list shows what you've published (RUSH-2444). There was no way to ask the CLI which pages are live under your share namespace — during the RUSH-2428 incident the only way to answer "is anything else of mine public?" was to fetch the gallery HTML and grep it. The Worker now exposes a machine-readable listing at GET /<user>?format=json (a ?format=json discriminator on the existing single-segment gallery path, gated on the SAME "does <user>/ hold objects" check the gallery uses — so the HTML gallery is untouched AND a legacy flat slug with ?format=json still serves its real page rather than a fake empty listing), and agents share list reads it: a human table newest-first by default, or the raw listing with --json (each object carries slug, url, size, contentType, publishedAt, and expiresAt). It lists the ACTIVE pages only — expired links and the sibling <slug>.png OG covers are omitted, mirroring the public gallery. An empty namespace 404s at the Worker, which list reads as "nothing published" (via the template-hash signal) and reports cleanly. Because this adds a route to worker-template.ts, the feature only reaches an endpoint after agents share update (RUSH-2449) deploys the current template; an endpoint that predates the route makes list fail loud with a "run agents share update" hint (reusing the agents share status template-hash signal, and detecting a live 404 on an unknown-template endpoint / a non-JSON gallery body) rather than returning a wrong or empty result. Source: apps/cli/src/lib/share/worker-template.ts, apps/cli/src/commands/share.ts.

• agents fleet update now verifies each box actually runs the new version, instead of trusting exit 0 (RUSH-2446). The rollout ran agents upgrade --yes per device and called a box ok on the exit code alone. That exit code only says the npm global moved — it says nothing about which copy agents resolves to on that box, and on any dev box scripts/install.sh puts a side-by-side build at ~/.local/agents-cli-dev with ~/.local/bin/agents pointing at it, earlier on PATH than the npm global. So the rollout reported a clean sweep while those boxes kept running old code, and nothing in the fleet surfaces answered "which boxes actually run the shipped version?" — agents fleet status reports version skew as a separate glance, and the local multi-install banner is advisory stderr on the box itself that never crosses the SSH hop. After each successful upgrade the rollout now asks the box what agents resolves to (symlinks followed) and what version that copy reports. A box on the target reads ok runs <version>; a box whose resolved agents is a dev build reads stale NOT upgraded — agents resolves to a dev build (0.0.0-dev.<sha>) at <path>, shadowing the upgraded <version> global; a box on some other released version reads stale with both versions and its resolved path. Those boxes are counted in a new N not upgraded tally, excluded from the ok count, and make the command exit non-zero. A box whose probe cannot answer — no POSIX shell, or agents unresolvable — reads unverified and is likewise not counted as a success, because "we could not check" and "it is upgraded" are different answers. A failed or skipped box is not re-probed, so one fault still produces one row. With no explicit version argument the target is derived as the highest released version any probed box reports; dev stamps are never elected as the target, so a fleet of dev builds cannot declare itself upgraded. Source: apps/cli/src/lib/devices/rollout-verify.ts, apps/cli/src/commands/ssh.ts, apps/cli/src/lib/startup/dev-build.ts.

• agents share update — push a worker-template.ts change out to an already-provisioned endpoint (RUSH-2449). agents share setup only ever wrote the Worker script during first provisioning, so every endpoint was pinned to whatever template it got on day one — there was no way to ship a Worker-side fix or feature (private publishing, share list, access logging) to someone who already ran setup. agents share update re-deploys the current template to the existing account/worker/bucket with no re-provisioning (no bucket creation, no route/domain changes) and never regenerates WRITE_TOKEN: Cloudflare's script-upload endpoint replaces a Worker's bindings/secrets wholesale on every upload, so the existing token is re-applied via the Secrets API immediately after the script upload. Idempotent — re-running it when the deployed template already matches is a no-op (--force to redeploy anyway). ShareConfig now records a templateHash, and agents share status reports current / outdated / unknown (a config from before this field existed reads as unknown, never as stale). agents setup share, run against an already-configured endpoint, now offers "update the deployed Worker" alongside "keep" and "reconfigure from scratch". Source: apps/cli/src/lib/share/provision.ts (hashWorkerScript, updateWorker), apps/cli/src/commands/share.ts (runShareUpdate, shareTemplateStatus), apps/cli/src/commands/setup-share.ts.

• teams disband is terminal — PENDING teammates cannot resurrect or re-start (RUSH-2450). Disband deleted log dirs and the registry entry but left the in-memory AgentManager cache intact; a concurrent teams start --watch supervisor then re-persisted those records via saveMeta, so a second disband still found N logs to clear and teams start could re-launch already-merged work. Disband now drops the registry entry first (writing a durable disband tombstone), then purges every teammate record from disk and the manager cache (AgentManager.purgeByTask). saveMeta refuses to re-persist a teammate whose team carries a disband tombstone. A second disband is a clean no-op; teams start on a disbanded name fails loud. Source: apps/cli/src/lib/teams/agents.ts, apps/cli/src/lib/teams/registry.ts, apps/cli/src/commands/teams.ts.

• Usage and authentication refresh now have one device-level owner (RUSH-2451). The daemon maintains shared per-account usage snapshots and auth-health metadata; agents run, view, versions, teams, device inventory, and Factory remain cache-only readers. agents usage <agent> --refresh and other explicit refresh paths enter the same cross-process lease, so simultaneous CLI processes reuse one provider request or local-log scan. BYOK budget reads use the same persisted, atomic cache model. OAuth stays harness-managed and per-device; only safe health/account metadata is shared, while named API keys, setup tokens, and bearer tokens continue to use device-local credential storage. Source: apps/cli/src/lib/account-state-service.ts, apps/cli/src/lib/refresh-coordinator.ts, apps/cli/src/lib/usage.ts, apps/cli/src/lib/byok-usage.ts, apps/cli/src/lib/auth-health.ts, apps/cli/src/lib/fleet-status.ts, apps/cli/src/commands/usage.ts.

• agents share update names the partial-failure window when the write token fails to re-apply (RUSH-2453). Cloudflare's script upload clears Worker secrets; update re-applies WRITE_TOKEN immediately after. If that second call fails (network blip, expired API token, rate limit), the live endpoint has no write token and every publish/delete 401s. The error now says so and tells you to re-run agents share update. Config is only rewritten after both steps succeed, so a re-run does not short-circuit on a matching hash — a test pins that self-heal property. Source: apps/cli/src/lib/share/provision.ts, apps/cli/src/commands/share.ts.

• agents --help / --version no longer load the migration graph (RUSH-2454). Follow-up from RUSH-2346: the menu-bar self-heal was already gated, but foldLegacySystemRepo() and the v19 runMigration() hop still ran on pure documentation paths and dynamically imported lib/migrate.js — whose static imports pull the hosts/routine/teams/daemon/menubar graph (~287 modules). Both hops now share the same helpOrVersionRequested gate. The always-on fold itself moved to a leaf lib/migrate-fold.ts (fs + createLink only), and the full migrate.js import is deferred until a missing/stale v19 sentinel actually requires runMigration(). Source: apps/cli/src/index.ts, apps/cli/src/lib/migrate-fold.ts, apps/cli/src/lib/migrate.ts.

• Grok's binary resolver could silently launch a different agent's binary (RUSH-2459). When no grok-* filename in a version-home's .grok/downloads carried the pinned version string — which happens routinely, since grok self-updates its binary in place — the dispatcher shim, the direct grok@<version> alias, and getBinaryPath all fell back to whatever a plain directory listing returned first, with no validation that the candidate was actually a grok binary. On one machine a stale, unrelated 99-byte wrapper script (exec cursor-agent "$@") sorted before the real ~127MB self-updated binary and was launched instead, so agents run grok and Factory's "New Grok" silently ran Cursor. A second, compounding bug made the shim's "exact version match" a no-op for the versioned home: it grepped ls's full path output, and the version-home's own path always contains the version string, so it matched every candidate unconditionally. Both are fixed: the exact-match check now scopes to each candidate's filename, and when no filename genuinely carries the version, the fallback rejects any candidate under 1MB (real grok binaries are ~100MB+) and prefers the most recently modified survivor — never guessing among untrusted artifacts. Source: apps/cli/src/lib/versions.ts, apps/cli/src/lib/shims.ts.

• agents add warp installs the new Warp Agent CLI (curl installer), not the removed oz brew cask (RUSH-2461). agents add warp@latest failed with Error: Cask 'oz' is unavailable: No Cask with this name exists. — the registry modeled Warp's older oz platform runner via brew install --cask oz, a cask that only lives in the warpdotdev/warp tap, not homebrew-core. The warp entry now points at Warp's current standalone agent CLI (docs.warp.dev/cli): install via the official cross-platform curl -fsSL https://app.warp.dev/download/agent-cli | bash, binary warp at ~/.local/bin/warp (self-updating, like droid/muse). It is an interactive TUI — bare warp opens the agent and there is no headless one-shot form (the documented flags are --api-key/--auto-approve/--resume <token>/--version, with no -p/--model/JSON output), so agents run warp launches the TUI and the exec spec drops the stale oz agent run -p --output-format json mapping. The oz→warp binary rename is propagated across version detection (findInPath('warp')), the runtime + generated shims, the reserved-brand list, and the sign-in hint (bare warp opens browser sign-in, or set WARP_API_KEY). Source: apps/cli/src/lib/agents.ts, apps/cli/src/lib/exec.ts, apps/cli/src/lib/versions.ts, apps/cli/src/lib/shims.ts, apps/cli/src/lib/agent-cli-commands.ts, apps/cli/src/lib/signin-badge.ts.

• The 8 daemon-housekeeping routines are now daemon-owned built-ins instead of .agents-system config-repo files (RUSH-2465). usage-refresh, fleet-cache-warm, session-cache-warm, device-probe, auto-dispatch, watchdog, tmux-reconcile, and launch-health were shipped as routines/*.yml in gh:phnx-labs/.agents-system (RUSH-2353, to gain declaration, run history, pause, and device pin over the old hardcoded setIntervals). A daemon's own housekeeping does not belong in the config repo every install pulls, so the definitions now live in daemon code (lib/builtin-routines.ts) and are injected as the lowest layer of listJobs() — below project > user > system. The same pid-claimed JobScheduler schedules and fires them via agents __daemon-tick <name> (lib/daemon-ticks.ts) exactly as before, so scheduling, run-tracking, pausability (agents routines pause <name>), and device pinning (agents routines devices <name> --set) are unchanged — the singularity guarantees (auto-dispatch's owner-pin, the cache-warms' publish-own/read-union, usage-refresh's per-account cadence/backoff) are preserved because they were never properties of the definition file. Because built-ins are the lowest layer, a same-named ~/.agents/routines/ file still overrides one, and a still-shipped .agents-system YAML shadows it during the removal transition (so exactly one definition ever fires). agents routines list tags each with (built-in) and the --json output carries builtin: true. .agents-system keeps only check-updates.yml; its removal PR (phnx-labs/.agents-system#272) merges only after this ships, or fleet/session/usage caches, the watchdog, and auto-dispatch would stop fleet-wide. Source: apps/cli/src/lib/builtin-routines.ts, apps/cli/src/lib/routines.ts, apps/cli/src/lib/daemon.ts, apps/cli/src/lib/daemon-ticks.ts, apps/cli/src/commands/routines.ts.

• Use one secret bundle as an account across compatible agents. agents accounts now keeps provider, authentication type, optional URL, stable identity, and API key or long-term setup token in the account's own agents secrets bundle. Account bundles are permanently prompt-free (policy: never), can be selected explicitly or as a per-harness default, and can be explicitly synced to a worker with agents accounts sync <name> --device <device>. Harness-native auth remains owned by each harness and is never copied. Existing v2 accounts.yaml entries migrate transactionally into bundles and retain their stable IDs. Source: RUSH-2470.

• scripts/release.sh takes --device <name> to pick the release Mac, instead of a hardcoded mac-mini. The build/sign/notarize/npm-publish phase still needs a Mac (codesign/notarytool + the signed binaries in the tarball), but which Mac is no longer welded into the script: it defaults to mac-mini and --device zion (alias --host) routes the privileged phase to any capable Mac at the same tagged commit — so a release is no longer stuck when mac-mini is offline. The git/PR/merge/tag orchestration still runs on whatever box invoked it, and the origin-side lease still guarantees a single releaser. scripts/remote-sign-mac.sh gained the same flag. Source: apps/cli/scripts/release.sh, apps/cli/scripts/remote-sign-mac.sh, apps/cli/scripts/release.test.ts.

• agents sessions --active --device <box> lists only sessions actually running on that box, and an offloaded session previews again (RUSH-2479). A run dispatched with agents run --device <peer> leaves a live shim process on the dispatching machine carrying the remote run's session id, and nothing attributed that row to the peer — so --device zion listed sessions executing on yosemite-s0, tagged [host/yosemite-s0], and every one of them rendered an empty preview ("Live session — full transcript not indexed here") because the transcript lives on the peer. Three things changed. machine is now the execution host: foldExecutionMachine folds the machine the dispatch already recorded in the session index back onto the live row before it leaves the box, and the cross-machine fan-out no longer overwrites a peer-reported machine that names a third box. A host scope is then enforced on that field — --host/--device means where the session runs, not which box answered — applied inside the single gather so the interactive browser and --active --json cannot disagree. And because the dispatcher's shim and the executing machine's own row now share a dedupe key, the merged fleet view keeps the row that owns the transcript instead of the [host/<peer>] placeholder. A peer's own self-report still outranks this box's index copy, so a genuinely remote row is never re-tagged. New field offloadedFrom on ActiveSession / --active --json marks the dispatcher's shim row. Contract: docs/specifications.md SES-23a; narrows SES-GAP-5. Source: apps/cli/src/lib/session/active.ts, apps/cli/src/lib/session/remote-active.ts, apps/cli/src/commands/sessions.ts.

• Monitors record a per-poll liveness heartbeat, so a watcher that never fires is no longer indistinguishable from one that never ran (RUSH-2485). Change-detection state (lastValue/lastFiredAt) was written only when a monitor fired or set a baseline, so a --match monitor that polled steadily but never matched left state.json empty — and agents monitors view <name> showed state: null, exactly what a monitor the engine never touched looks like. A monitor added as the durable lander for a PR read healthy (enabled, daemon active, test evaluating on demand) while doing nothing for ~40 minutes. The engine now writes a liveness record on every poll — lastCheckedAt, checkCount, lastError, consecutiveErrors — kept in its own liveness.json so it never perturbs the baseline logic. agents monitors list and view surface it: never polled (yellow), checked Nx · no match yet, STALLED — last poll <ago> (red, when an enabled+owned monitor's last poll falls >3 intervals behind), and per-poll errors. --json on both gains lastCheckedAt, checkCount, lastError, consecutiveErrors, and stalled. agents monitors add now asserts the postcondition — it waits for the engine's first poll and reports whether the monitor was actually picked up, instead of reporting success on config acceptance. And after 5 consecutive failed checks (a source that errors every poll, or an action that fails every fire), the engine notifies the owner once that the monitor is doing nothing. Source: apps/cli/src/lib/monitors/state.ts, apps/cli/src/lib/monitors/engine.ts, apps/cli/src/commands/monitors.ts.

• agents sessions attributes offloaded work to the box it runs on, consistently. Resuming a live host-dispatched run by id (agents sessions <id> for an agents run --device <peer> session) no longer fails with "ambiguous (2 sessions)": queryIndexedSessions kept the machine derived from the transcript path for every row, and an empty file path (a remote transcript) fell back to this box — re-attributing the dispatcher's own pool row to itself so it no longer deduped against the executing peer's fan-out row. It now keeps the execution host the dispatch recorded on that row. And a remote teams teammate (agents teams add … --device <peer>) is now attributed to its execution host too: listTeamsActive folds the teammate's hostName into machine/offloadedFrom the same way agents run --device rows are folded, so agents sessions --active --device <orchestrator> no longer lists a teammate that is executing on a peer (RUSH-2486, closing SES-GAP-10; the residual of RUSH-2479). Source: apps/cli/src/lib/session/discover.ts, apps/cli/src/lib/session/active.ts.

• A project is now a set of directories, and every spawn path reaches all of them (RUSH-2489). ProjectDef.repos[] could already name additional checkouts, but nothing wrote it and nothing that started an agent read it: agents run --project rush landed in defaultPath ?? root and every other repo the project bound was invisible to the agent. Work spanning a CLI, its website, and the DotAgents repo it ships into needed three agents or a hand-passed --add-dir.

  Writing. agents projects add gains a repeatable --dir <path...>; agents projects set gains repeatable --add-dir <path> / --rm-dir <path> plus --slug <owner/repo>. Each value names a local directory and the slug is read from that directory's own origin remote, never inferred from its path — a checkout at ~/src/github.com/muqsitnawaz/agents-cli whose origin is phnx-labs/agents-cli records what it actually pushes to. --slug covers a directory with no origin and applies to a single --add-dir. Removals apply before additions, so --rm-dir old --add-dir new re-points a directory in one command. Binding a directory twice, unbinding one that is not bound, and naming a path that does not exist are all refused with the fix named.

  Spawning. agents run --project keeps returning the primary directory as cwd — unchanged — and merges the project's other directories into --add-dir, deduped against anything passed explicitly, locally and over --host (forwarded ~/…, which the receiving agents run expands against the host's own $HOME). agents teams create gains --project <slug>: it is validated at create time rather than at the first teams add, the project's primary directory becomes a local teammate's base cwd, and the sibling directories are attached as grants. The teammate record stores the project name, not a frozen list of directories, and the grants resolve per launch — an unpinned teammate on a --devices pool only learns its host from the scheduler at launch time, so add-time resolution would have handed it this box's absolute paths (and already dropped any directory that exists only on the host it landed on). The team cwd precedence is now worktree → --cwd → project directory → process.cwd(), so an explicit --cwd still wins; the grants are attached either way, since the siblings are what the project binds rather than where the teammate sits. A --project slug@worktree run keeps the worktree as cwd and grants the main checkout alongside the siblings. A teammate staged behind --after resolves its grants when the supervisor finally launches it, so a restart in between changes nothing.

  Two honest limits, stated rather than papered over. Only Claude and Codex consume --add-dir (Claude takes the native flag, Codex folds the paths into workspace_roots); every other harness ignores the grants and sees the cwd alone. And a bound directory that is absent from the current box is skipped for a local spawn rather than erroring — but is kept for a --host run, because the target machine has its own checkouts and this box's filesystem must not decide what exists there.

  --add-dir values are now ~-expanded at the consumer (buildExecCommand, for both the Claude flag and Codex's workspace_roots). Nothing was doing it: a forwarded grant crosses the SSH boundary single-quoted, so the remote login shell left ~/… literal and the harness resolved it as a directory actually named ~ — a silent no-op. This also fixes the pre-existing case of a user typing --add-dir '~/x' on a --host run.

  The repos[] walk is now one function shared by the spawn path and the fleet workspace probe (projects status), which previously had its own copy. The probe keeps its own primary (root, not defaultPath, so a monorepo subproject still probes its checkout) and keeps missing directories so it can still report ✗ missing. Also corrects the agents projects help note, which still told users to sync definitions with the long-removed agents push/pull instead of agents repo push user. Source: apps/cli/src/lib/projects.ts (projectDirsAbs, projectProbeTargets), apps/cli/src/lib/project-root.ts (resolveProjectDirs), apps/cli/src/commands/projects.ts (projectRepoFromDir), apps/cli/src/commands/exec.ts, apps/cli/src/commands/teams.ts, apps/cli/src/lib/teams/{registry,agents,api}.ts, apps/cli/docs/projects.md.

• agents daemon status now reports a daemon running code that has been deleted (RUSH-2493). A daemon keeps running from memory after its entry file is removed — so it answers every probe, systemctl --user is-active reads active, and the status command reported healthy, while the process cannot restart and is executing whatever was loaded before the delete. Observed on a dev box: a daemon ran 4h14m from a worktree that had been deleted, silently holding a second routine scheduler (the double-fire class the one-scheduler-one-executor rule exists to prevent), and nothing anywhere named it. status now carries a Stale code section listing each such pid with its missing entry, marks the Binary: line (MISSING from disk) when it is this device's own daemon, and daemon doctor raises it as a problem with the right remediation — agents daemon restart for your own, kill <pid> for a stray this install owns. --json gains binaryMissing and staleBinaries, each stale row carrying actionable so a machine caller can tell a ghost it may act on from one that is merely visible.

  Detection and accusation are scoped separately. Anything actionable — a doctor problem, a non-zero exit, a kill instruction — is limited to this device's daemon plus this install's instance registry, the scope RUSH-2368 established after a leaked test fixture was reported as a stray to kill. Merely showing a stale daemon extends to any process running as the same uid, because the incident that motivated this was neither the tracked pid nor registered: it ran from an ephemeral /tmp cwd, which lib/daemon.ts documents as invisible to the registry by design, so registry-gating the display would have left the command silent on the exact case it exists for. A different uid is never named at all — its entry cannot be reliably stat'd and could not be signalled anyway.

  Three further limits keep it from accusing a healthy daemon: it reports only a provable ENOENT (statSync with throwIfNoEntry, since existsSync also returns false on a permission error — a root-owned daemon under an unreadable parent would otherwise be named); it considers absolute entry paths only, so node -e '<code>' __daemon-run is never mistaken for deleted code; and that last guard also exempts entry paths containing spaces, which ps renders unquoted — a healthy daemon on such a path is never accused, at the cost of not detecting a genuinely deleted one. Source: apps/cli/src/commands/daemon.ts, apps/cli/src/commands/daemon.test.ts.

• Fixed a Windows-only CI failure in the binary-shadow test. detectAgentsBinaryShadows was already comparing files by identity, but its test still compared two path spellings through fs.realpathSync. On Windows realpathSync does not expand an 8.3 short name, so a where-resolved path and one built from os.tmpdir() compare unequal even when they name the same file — which is why every PR touching apps/cli saw windows fail on a GitHub runner (C:\Users\RUNNER~1\... vs C:\Users\runneradmin\...). The test now identifies the file by basename plus contents, which is spelling-independent and asserts the stronger property.

• The auto-detected browser default profile no longer churns the fleet-shared agents.yaml. ensureDefaultBrowserProfile regenerates that profile on every agents browser start without --profile, writing an absolute binary: path and a port chosen by probing the local machine. Because it lived in the synced file, a macOS box wrote /Applications/Google Chrome.app/..., a Linux box found that unlaunchable and rewrote /usr/bin/chromium-browser, and the two flipped the tracked file back and forth forever — the single largest source of churn on it. The auto default now lives in that box's own ~/.agents/devices/<machine>/agents.yaml, which is gitignored. User-created named profiles stay central and still sync; reads merge both maps, with the machine-local copy winning a name collision (it was written by this box, for this box). Source: apps/cli/src/lib/browser/profiles.ts, apps/cli/src/lib/state.ts.

• projectRoot is machine-local too. ensureProjectRoot infers it from whatever directory the CLI happened to run in, so it is machine state rather than fleet policy; it was being cached into the file every machine syncs. Source: apps/cli/src/lib/state.ts.

• Browser profile writes no longer clobber a concurrent write. createProfile / updateProfile / deleteProfile did an unlocked readMeta(), mutated, then writeMeta(meta) — persisting a snapshot taken before the lock, so a newer write from another process was silently lost. They now go through updateMeta, which re-reads under the lock. Source: apps/cli/src/lib/browser/profiles.ts.

• A config read no longer rewrites the fleet-shared agents.yaml. The legacy device-config fold hung off getConfigValue / setConfigValue / unsetConfigValue, so an ordinary agents config get could rewrite ~/.agents/agents.yaml — a file every machine in the fleet tracks and syncs. With 13 machines each dirtying one shared path on nearly every command, boxes stopped being able to pull at all (yosemite-s0 sat 4 commits behind, unable to fast-forward past its own local rewrite). The fold now runs only from a lifecycle entry point (daemon boot, runMigration), never from a read or write. Source: apps/cli/src/lib/device-config.ts.

• The device-config migration is additive instead of destructive. It used to fs.rmSync the per-device devices/<host>/agents.yaml and fs.rmdirSync its directory after folding. Deleting the source mid-rollout meant a box still on the previous CLI lost the config it was still reading, and a box that re-created the doc got stripped again on its next command. The fold now leaves every legacy store in place; the redundant copy is pruned later by one explicit operator command rather than by each machine independently. Source: apps/cli/src/lib/devices/config-migration.ts.

• agents devices capture no longer erases a peer's config. captureFleet rebuilt fleet.devices from the captured roster alone, so a device the capturing box had not seen was dropped along with its config: block — observed for real, a capture on yosemite-s0 deleted zion's entire config from the shared file. A dropped device now carries its config: forward; the roster fields still reflect live state. Source: apps/cli/src/lib/fleet/capture.ts.

• Clearing the last model-tier override no longer leaves model: {tiers: {}}. The emptied container was written back to the shared agents.yaml, showing up as a spurious local change on whichever box ran the command. It now drops the key, matching how an emptied hosts: is already handled. Source: apps/cli/src/lib/model-tier-overrides.ts.

• The agents daemon starts at install/upgrade and on first agents setup / setup --force, not only after routines add. scripts/postinstall.js healLongRunningProcesses calls startDaemon on darwin and linux when daemon.enabled is not false (bounce when already running so upgrades load the new binary; cold start writes the LaunchAgent/systemd unit so KeepAlive/Restart=always apply). If the daemon was running under daemon.enabled=false, postinstall stops it and leaves it down. First-run / --force agents setup calls startDaemon() after the system repo is ready (hub re-entry without --force does not). The CLI hot path is unchanged — no per-invoke ensure. Companion: phnx-labs/.agents-system#291 (check-updates daily + agents repo sync system + agents sync --local -y when HEAD moved). Source: apps/cli/scripts/postinstall.js, apps/cli/src/commands/setup.ts.

• A dev build no longer takes over the installed agents command. scripts/install.sh published its side-by-side build into ~/.local/bin under the production names agents, ag, and browser, so which code ran was decided by PATH order rather than by what you typed — and once the dev prefix was cleaned, those links dangled and the production command failed with no such file or directory. The dev build is now exposed as agents-dev (and ag-dev); the script never creates or overwrites agents, ag, or browser, and on each run it removes any such shadow link an earlier revision of itself left pointing into the dev prefix — including a dangling one, which [[ -e ]] cannot see. browser leaves the dev link set entirely: agents-dev browser … reaches the same code. The restart of the shared routines daemon (secrets broker, browser IPC, scheduler) is now opt-in behind --bounce-daemon instead of automatic, because pinning that daemon to a working-tree build changes what the everyday agents talks to while agents itself still looks untouched. The PATH-precedence warning is gone — a distinct name makes ordering irrelevant. Root AGENTS.md now states the rule for agents working in this repo: never npm i -g from the working tree, and never claim the production bin names. This supersedes the dev-build shadow described in the RUSH-2446 entry above — that rollout probe stays as the general backstop for any other install that takes the agents name. If removing the shadow leaves agents unresolvable (npm skipped its own ~/.local/bin link because the shadow already answered the probe), the install says so and prints the one command that restores it, instead of claiming agents is untouched. Source: apps/cli/scripts/install.sh, apps/cli/scripts/install.test.ts, AGENTS.md, apps/cli/AGENTS.md.

• agents devices config <name> [key] [value] is the one settings surface for a device. Bare opens an interactive settings menu on a TTY (and prints the resolved config when piped or given --json); key reads a value back, key value sets it with validation (booleans take on/off/true/false), key --unset restores the default, and notes <text> appends an operator note. Device-scope settings — the existing agents.max-concurrent / scheduler.enabled / daemon.enabled / watchdog.enabled / browser.remote-control / browser.profile / notes, plus new ssh.user, ssh.auth, ssh.bundle, ssh.bundle-key, ssh.identity-file, platform, auto-launch.enabled, and auto-launch.preferred keys — now live centrally in ~/.agents/agents.yaml under fleet.devices.<name>.config (synced and backed up with the repo; a fleet.devices: all declaration upgrades to an explicit roster map on the first write). The ssh.* / platform / user values overlay the registry's discovery record at dial time, so agents ssh, the ssh_config render, host dispatch, and devices list all honor them. The retired subcommands (configure, note, set, set-interactive, enable/disable/prefer/unprefer) keep working as hidden tombstones that print a deprecation notice on stderr and forward into devices config. Existing per-device config (devices/<name>/agents.yaml config, defaultBrowserProfile) and .history/devices/auto-launch.json fold into the central block via a one-time migration (first config read/write, daemon boot, or runMigration); device docs keep their agent pins. Source: apps/cli/src/commands/ssh.ts, apps/cli/src/lib/device-config.ts, apps/cli/src/lib/devices/resolve-profile.ts, apps/cli/src/lib/devices/config-migration.ts.

• agents devices --help is an intent-based menu instead of a flat 27-command list. The subcommands are grouped by what the operator is trying to do — Discover & register, Inspect, Configure a device, Factory auto-launch, Fleet operations — via the existing registerCommandGroups formatter (the same pattern browser, computer, and secrets already use), and the "Typical workflow" block moves from the bottom of the help (.addHelpText('after', …)) into a workflow-first Examples: section right under the description via setHelpSections. No commands, flags, or behavior change. Source: apps/cli/src/commands/ssh.ts, apps/cli/src/lib/help.test.ts.

• The VS Code extension is now AGI EXT; its dashboard is Fleet. apps/factory moved to apps/ext — the component is a thin UI wrapper over the CLI, not a factory. The webview tab and navbar read AGI EXT, and the agent-status dashboard formerly called "Factory Floor" is now Fleet. A dashboard tab restored from a pre-rename build is reclaimed rather than left beside the new one. Marketplace identity is unchanged (publisher swarmify, name swarm-ext), so installs and the swarm-ext:// URI keep working. Unrelated systems that share the word keep every identifier, path, and env var they had — Factory.ai/droid (~/.factory, FACTORY_API_KEY, the factory cloud provider), the beta-gated agents factory Software Factory command (FACTORY_FLOOR_URL, ~/.agents/factory.yml), and Rush Cloud's own Factory Floor. Their comments and their user-facing labels still name them — agents teams --task-type remains a "Factory label" because it configures the Software Factory worker, not this dashboard.

• agents feed post --notify raises a local desktop banner on top of any configured broadcast. A feed post already forwards outward through feed.broadcast sinks (a Linear comment, an owner-channel iMessage), but reaching the local desktop meant hand-declaring a channel: desktop sink in agents.yaml. --notify is the per-post, config-free equivalent — the same notifyDesktop banner agents run --notify fires — added on top of whatever delivery is already configured, never replacing it. It routes through the real desktop channel provider like every other channel: sink, so it appears in the post's broadcast outcomes and the --json payload rather than a side path. Two properties follow: it carries no minLevel, so a routine milestone post can raise a local heads-up without an important-gated phone sink buzzing the phone; and the banner is local (it reaches whoever is at the machine the post was authored on, a no-op with a stated reason where no notifier exists), so a headless post never mis-fires at the operator's Mac — reaching a phone stays the job of an important-level owner/broadcast sink. Source: apps/cli/src/lib/feed-broadcast.ts (withDesktopNotify), apps/cli/src/commands/feed.ts.

• agents subagents list no longer reports every Codex target as missing while the .toml files are present (#2399). Codex custom agents are flat TOML (name / description / developer_instructions) under ~/.codex/agents/, but the registry reader used the markdown YAML-frontmatter parser, which returns null on TOML and dropped every entry from the rich listing. Codex still loaded the files at runtime — only the listing surface was wrong. The Codex target now uses a TOML metadata reader (same escape hatch as Kiro JSON / Goose YAML). Source: apps/cli/src/lib/subagents-registry.ts.

• agents sessions focus <id> reaches a session on another device without --device. Focus resolves an id/identity selector across the reachable fleet (the same resolver resume and preview use), but it then required the resolved session to ALSO appear in its filtered candidate pool — which is scoped by project, time window, and device — so a peer-owned, older, or other-project session was found and then rejected with Session <id> does not match the selected focus filters unless you passed --device <host> to pull it into the pool. Focus now uses the fleet-resolved session directly (focusTargetForResolved), hopping to the owning device via the existing recovery path; the display filters scope the browsable picker, not an exact id lookup. resume already resolved fleet-wide and is unchanged. Source: apps/cli/src/commands/focus.ts.

Grok usage bars ignore expired / missing last-seen billing

agents view grok reads weekly usage from each machine's local .grok/logs/unified.jsonl (network: false). Two bugs made the bars disagree across devices and lie after a weekly reset:

1. A billing line with no creditUsagePercent was coerced to 0%, so a fresh period looked empty instead of unknown.
2. An expired period (e.g. last week's 100%) was still rendered, so one box showed rate-limited after the window had already reset.

Expired windows are dropped via the same freshness check used for the Claude usage cache; missing percents no longer invent a bar. Live cross-device parity still requires a Grok session on that box to write a new billing line — there is no network usage probe for Grok yet.

• agents inspect --<kind> now uses the same interactive picker + live preview as agents skills list. The drill-down listings were the last ones printing a bespoke two-line-per-entry dump with a [source] tag repeated on every row — 13 of 80 columns spent on one bit of information — and a description truncated mid-Triggers on: boilerplate, which is what 15 of the 20 skills in .system append to theirs. Rows are now one line (Name · Size · Description) showing the description's first sentence, and the preview pane below refreshes as the selection moves, carrying the full text plus per-kind metadata: a hook shows what fires it and whether it is wired (previously the drill-down showed only a size, less than the summary view printed); a skill shows its frontmatter triggers, model and tools; a plugin lists its bundled skills and commands one per line. The piped path keeps its plain table plus each plugin's bundled skills and commands, and the picker only appears on a TTY. --json keeps its shape (one description value changes, per the next entry). Also fixes the overview's resource preview cutting its own …(+16) tail at any terminal width, 1 files, and the Hooks section leading with *_test scaffolding instead of registered hooks. Source: apps/cli/src/commands/inspect.ts, apps/cli/src/commands/resource-view.ts.

• agents inspect --hooks no longer shows a line of shell as each hook's description. All 53 hooks in .system rendered !/usr/bin/env bash — the "first prose line" fallback is a Markdown heuristic, and on a script it returned the shebang with its # stripped. Skipping that line only promoted the next one (set -euo pipefail, a Python docstring), so the agent path now reports a hook as having no description at all — matching what the repo path already did — and the column shows the hook's firing events instead, which is the information that view is for. Descriptions read from the first line of non-Markdown resources (an mcp .yaml, a .toml) are unaffected. Source: apps/cli/src/commands/inspect.ts.

• agents inspect --hooks now shows what fires each hook, in the column that was blank. The Description column for a hook was either code or nothing; it now carries the same event summary the overview prints (PreToolUse(Bash), SessionStart), and a hook the manifest does not register shows a blank events cell, with the preview pane spelling out not registered. A repo target resolves those events from that repo's own agents.yaml rather than whatever is installed centrally. Source: apps/cli/src/commands/inspect.ts.

• agents inspect <repo> --routines shows what a DotAgents repo schedules, and whether it actually fires. inspect could drill into eight resource kinds but not routines, so the one kind carrying live operational state was the one you could not inspect — agents inspect . --routines errored with unknown option. --routines lists every routine the repo declares with its schedule, what it runs, the devices whose allowlist enables it, and how it last ran; --routine <name> drills into one; and the plain overview gains a Routines section beside Hooks/Plugins/MCP. The listing folds in live state deliberately, because the YAML alone is misleading: a routine's own devices: pin does not enable it — membership in a device's routines: allowlist does (applyDeviceActivation → routineEnabledOnThisDevice) — so a definition-only view reports git-review → zion for a routine that has not fired in days. When routines sit on no device's allowlist the section says so outright and names the agents routines devices <name> --set <device> fix; --json reports devices (the YAML pin) beside enabledDevices (the live fleet answer), reusing agents routines list --json field names where they overlap so one script consumes both. Rows sort broken-first (inert config, then fires-nowhere, then disabled, then failing) because the overview section shows only the first six — with 24 routines the sort is the section. Three supporting fixes: a config that fails closed (unparseable YAML, a legacy device: key, a non-list devices:) is now listed with the reason instead of silently vanishing (readJobFileResult, extracted from the private readJobFile); a corrupt peer device file is collected and reported rather than thrown, so one bad file cannot blank the whole listing (routineDeviceIndex, a non-throwing single-pass sibling of devicesWithRoutineEnabled); and ResourceItem.extra now reaches --json for every kind, not just plugins, so the detail view and its own preview pane cannot disagree. The collector reads *.yml files only — routines/ also holds <name>/home/ sandbox overlay HOMEs, and a flat readdir counted 49 routines where the repo declares 24. A bare routines/ directory is deliberately not a DotAgents marker: shipping example routines is a normal pattern (this repo's own apps/cli/routines/), and counting it made agents inspect apps/cli resolve a source tree as a repo. Source: apps/cli/src/commands/inspect.ts, apps/cli/src/lib/routines.ts, apps/cli/src/lib/routine-activation.ts.

• Kimi subagents are written in the format kimi-code actually reads, and gated at 0.29.0. The integration emitted a <name>.yaml + <name>.system.md pair plus a managed _agents-cli.yaml parent index, targeting the version: 1 / agent: agentspec of the older, separate kimi-cli product. @moonshot-ai/kimi-code has no loader for that schema — system_prompt_path appears nowhere in its bundle — so every synced Kimi subagent was written to disk and never loaded by any session. Kimi now gets one Claude-shaped <name>.md (frontmatter name/description + body), which kimi-code discovers from its brand home's agents/ dir. Discovery landed in kimi-code 0.29.0; 0.28.x and earlier compile their four agent profiles into the bundle with no filesystem loader, so the subagents capability is now >= 0.29.0 and older installs skip with a stated reason instead of writing files nothing reads. Verified against a real kimi 0.29.0: --agent no-such-agent reports Available profiles: plan, agent, coder, explore, code-reviewer. Source: apps/cli/src/lib/subagents-registry.ts, apps/cli/src/lib/agents.ts.

  Homes synced before this fix carry stale <name>.yaml, <name>.system.md, and _agents-cli.yaml files in ~/.kimi-code/agents/. A one-shot migration (migrateKimiSubagentsToMarkdown, migration schema v19) removes them from every kimi version home on the first run after upgrading — not agents prune cleanup, which could never reach the two .yaml files because they match no subagent enumerator. Without it the leftover <name>.system.md would be listed as a phantom subagent named <name>.system and warned about by kimi-code once per session, since it ends in .md and carries no frontmatter. A legacy pair is matched by its signature (a <name>.yaml with a sibling <name>.system.md), so a subagent you named <x>.system yourself is left alone.

• Per-machine config no longer lives in the fleet-shared agents.yaml. Every device-scope config key now declares visibility, which asks who READS it. shared keys stay in the synced fleet.devices.<name>.config because a peer resolves them — the ssh fields and platform are needed to dial a box before it is reachable, agents.max-concurrent drives teams placement, auto-launch.* and notes feed fleet views. machine keys — browser.profile, browser.remote-control, scheduler.enabled, daemon.enabled — move to that box's own ~/.agents/devices/<machine>/agents.yaml, which is gitignored. That is what stops 13 machines writing one tracked path. Source: apps/cli/src/lib/device-config.ts, apps/cli/src/lib/state.ts.

• browser.remote-control was a consent leak. It gates whether OTHER machines may drive this box's browser, and its own help text promised "device-local, never synced" — but it was stored in the file the fleet syncs, so one box's opt-in propagated to the rest on pull. It is now machine-local, and setting or reading a machine-local key for a peer is refused outright with the agents ssh <device> form to use instead. Source: apps/cli/src/lib/device-config.ts.

• A new config key cannot silently pick the wrong home. ConfigKeySpec is a discriminated union, so omitting visibility on a device-scope key is a COMPILE error — the same discipline META_KEY_SCOPE already applies to Meta. The migration no longer folds machine-local keys at all: they already sit where the new read path looks, and copying a peer's would spread that consent flag fleet-wide. Values an older CLI wrote centrally are still honored until overwritten, so a mixed-version fleet keeps working. Source: apps/cli/src/lib/config-machine-keys.ts, apps/cli/src/lib/devices/config-migration.ts.

• Monitor condition: { mode: every } no longer fires on an empty observation (RUSH-2488). every previously returned fire: true for every tick regardless of the observation, so a poll whose command produced no rows still dispatched the action with an empty {event}. It now stays silent on an empty or whitespace-only observation and fires on every tick that carries real output. This gives a poll-driven monitor the "re-fire while the watched set is non-empty" semantics that a silently-failed action dispatch needs to be retried — an action failure leaves the same non-empty observation next tick, so every re-fires (bounded by rateLimit), where match/on-change would dedupe and never retry. No shipped monitor used every, so there is no behavior change to an existing monitor. Source: apps/cli/src/lib/monitors/engine.ts, apps/cli/src/lib/monitors/engine.test.ts.

• agents monitors add refuses a monitor that duplicates one you already have. A monitor's NAME was not its identity: writeMonitor overwrites by name and nothing compared arguments, so two watchers polling the same source on the same interval and firing the same action were one trigger fired twice — under different names, with no warning. One real box accumulated open-pr-watch, pr-ci-fail, three stale pr2222-* watchers and an agent-added lander all polling the same PR queue. add now refuses a same-name collision (which would silently overwrite) and a same-behavior collision — checked across the fleet, not just this box, because the case that actually bites is two agents on two different machines creating a watcher for the same work item with the same arguments, and neither can see the other's monitors dir. The check reuses the cross-machine fan-out sessions --active already runs, names the device and monitor it clashed with, and when a peer is unreachable says so explicitly rather than treating "could not ask" as "no duplicate"; --force proceeds anyway. Identity is a fingerprint over source + condition + action, deliberately excluding name, description, enabled, and placement (device/devices/runOn) — placement is who executes, not what runs, and hashing it would let the same watcher be re-added by varying only the owner. Different arguments still coexist — a watcher for PR #2517 and one for #2600 are two monitors, not a clash; that is the common case. Also documents the split the subsystem already had but never stated: a durable monitor is config, an agent's per-work-item watcher is running state, and runtime (last-seen value, fires, rate-limit counters) lives under ~/.agents/.history/monitors/. Source: apps/cli/src/lib/monitors/fingerprint.ts, apps/cli/src/lib/monitors/remote.ts, apps/cli/src/commands/monitors.ts, apps/cli/docs/10-monitors.md.

• agents sessions focus/attach/resume/preview, the bare agents sessions <id>, run --resume, and sessions --resolve no longer hard-fail when a fleet device is offline. Resolving a session id used to abort the moment any registered device was unreachable — even when the session lived on a box that WAS reachable — printing Could not resolve session while these devices were unavailable. Now an unreachable peer is a one-line warning: the session resolves against the reachable fleet and attaches, and the command fails only when the id is found on no reachable device (worded so the offline, unchecked peers are named, not blamed). The exit code for that offline-peer resolution failure changes from 2 to 1 (an ordinary not-found failure, no longer a distinct "could not decide" code) across every resolver consumer — focus.ts, attach.ts, resume.ts, exec.ts, and all three resolveSessionMetadataValue call sites in sessions.ts. (RUSH-2492)

• Dead tmux sessions are now reaped automatically every 5 minutes. Sessions stay open after their process exits because remain-on-exit on is set so the harness can inspect the exit status. Previously they accumulated indefinitely — 127 tmux sessions with 48 dead (~38%) observed on a production fleet machine. The daemon now cleans them up on a 5-minute timer (same cadence as the keychain reaper) and immediately on startup to clear the backlog. Safety invariant: only sessions where all panes are dead (pane_dead=1) are killed; any session with a live pane is never touched. On-demand cleanup is also available: agents sessions reap [--json] [--socket <path>]. Source: apps/cli/src/lib/tmux/session.ts, apps/cli/src/lib/daemon.ts, apps/cli/src/commands/sessions-reap.ts.

• agents sessions --active now attributes cursor/grok/kimi/droid sessions. The ps-scan identity path fell back to loadHookSessionIndex(), which scans terminals/sessions/ — a directory populated only by the @agents/session-tracker package, which is not deployed on most fleet machines. The SessionStart hook that IS deployed writes state/sessions/<pid>.json instead. The ps-scan path now also tries readStateSessionRecord(pid) after the index lookup finds nothing, so non-Claude harnesses that carry no --session-id argv can be attributed from the deployed hook's state file. Source: apps/cli/src/lib/session/active.ts.

• agents routines is now an interactive browser. On a terminal, the bare command opens a filterable, grouped picker (reusing the same picker primitive behind agents sessions) instead of printing nothing but help. The project / device group headers show as inline dividers, and selecting a routine drills into four blocks — Definition, Next fire, Recent runs, Stats. agents routines --json and any non-interactive shell keep the exact agents routines list output, so pipes and the menu bar are unaffected. (RUSH-2503)

• agents secrets export --host raises Touch ID at a terminal instead of demanding a prior agents secrets unlock. Pushing a locked keychain-backed bundle to another machine failed with "Secrets bundle '' is not unlocked in the secrets agent" even for a human typing the command at a TTY — resolveBundleForPush passed agentOnly: true unconditionally, while its sibling reads (view --reveal, exec) already decided this per-invocation with isHeadlessSecretsContext() || !isInteractiveTerminal(). The push is strictly less exposed than the view --reveal that already prompts: it prints a key count, never a value, and nothing captures its stdout, so the prior-unlock requirement was an inconsistency rather than a boundary. An agent launch, a piped/CI run, and pushBundleToHost (fleet apply) are unchanged — they stay broker-only and still fail fast with the unlock hint, which is what keeps the RUSH-2440 keychain-enumeration prompt storm off the agent path. export --plaintext / --to-file / --to-1password are also unchanged: they emit values into a pipeline or onto the screen, so they remain unconditional automation primitives. Spec updated in lockstep (SEC-13b and the §4.2 materialization table). Source: apps/cli/src/lib/secrets/push.ts, apps/cli/src/commands/secrets.ts, apps/cli/docs/secrets.md, apps/cli/docs/specifications.md.

• A short session id resolves even when a fleet peer is offline. agents sessions preview <shortid>, agents resume <shortid>, agents sessions attach, and sessions --resolve --json previously refused to resolve whenever any registered device failed to answer the fan-out — printing Partial session resolution: <peers> did not answer and rendering nothing, even though exactly one session on the reachable fleet matched — so on a fleet carrying any permanently offline device, every short-id lookup was voided. Once the sweep is over, a selector that is a complete id or at least 8 hex characters wide (the printed shortId width) now resolves from a single reachable match. Deliberately unchanged: a keyword-shaped query still fails closed even when it is all hex characters (facade, decade — searches, not identifiers); a label still fails closed at any length, because labels are free-form and collide by design; a prefix collision between peers that did answer still never resolves — it fails closed while a peer is missing, and surfaces as an ambiguity listing both machines once every peer has answered; and RUSH-2203's mid-sweep early-exit stays full-UUID-only. This amends the normative SES-9a requirement, which previously mandated fail-closed for every short prefix; the accepted collision risk is stated there, including that a time-ordered UUIDv7/ULID prefix collides far more readily than a random UUIDv4 one and the residual exposure is a collision hiding on the peer that did not answer. Source: apps/cli/src/commands/sessions.ts (isUniqueEnoughSelector, metadataResolveOutcome, renderSessionPreview), apps/cli/docs/specifications.md §SES-9a / §SES-IF-2a, apps/cli/docs/sessions.md.

• agents teams add warns and blocks when the base checkout is behind origin/main, requiring --confirm to proceed. Pointing a team at a stale repo (local cwd, or the repo provisioned on a --device host) meant teammates reasoned and built against code that had already moved on — the real incident was a 71-commit-stale checkout on another box that nobody had fetched. teams add now fetches origin, counts how far behind origin/<default> the base is, and refuses with a sync command (git … merge --ff-only origin/main) unless you pass --confirm; with --confirm it prints a one-line advisory and continues. An offline/unreachable/non-git base can't be assessed and never blocks. Cloud teammates clone fresh in the provider and are skipped. Source: apps/cli/src/commands/teams.ts, apps/cli/src/lib/teams/worktree.ts, apps/cli/src/lib/teams/remoteWorktree.ts.

• Webhook handlers (~/.agents/webhooks/*.yml) can now anchor a dispatched agent in a project. A handler's run.agent/run.workflow action previously always ran at the target box's $HOME with no repo checkout and a hard-coded auto mode, so an inbound GitHub/Linear event could not fire an agent that actually edits a repo without routing through a routine. Handlers gain three top-level fields mirroring a routine's job config: project (named agents projects execution anchor — the run lands in that project's base directory), cwd (portable execution directory, resolved under project or $HOME), and mode (plan/edit/auto/skip/full, default auto). They thread into the dispatched JobConfig for the run.agent/run.workflow path and override the routine: delegate; run.command is unaffected (use a cd in the command). Source: apps/cli/src/lib/triggers/handlers.ts.

1.22.35

• agents doctor --fix and agents upgrade purge stale multi-install agents-cli copies instead of only warning (RUSH-2415). Pre-1.22.30 installs (and "unsafe legacy helper installer" / npx-cache trees) re-introduce the Touch ID storm + usage-API revocation class fixed in v1.22.30. Detection already existed (findAgentsCliInstalls / multi-install warning) but left remediation to the user. Bare agents doctor --fix and a successful agents upgrade now delete npx-cache installs, non-atomic helper installs, and pre-1.22.30 package roots when a fixed peer already exists on the box — never the running copy, never a lone pre-fixed install that would strand the machine. The multi-install warning points at agents doctor --fix. Source: apps/cli/src/lib/self-update.ts, apps/cli/src/commands/doctor.ts, apps/cli/src/index.ts.

• agents share delete (alias agents unshare) takes down a published page (RUSH-2428). agents share publishes to a public URL with no way to take one down — the Cloudflare Worker already implements an authed DELETE, the CLI just never exposed it. The new command accepts a full share URL, <user>/<slug>, or a bare <slug> (resolved against your own namespace exactly as publish does), takes several targets at once, and by default also deletes the sibling <slug>.png OG cover (--keep-cover opts out) — without it, republishing over a slug replaced the page but left the old cover screenshot publicly readable, which is what made a real takedown slow. {"ok":true} from the Worker is not treated as proof: a follow-up check must resolve 404 before the command reports success, and it errors loudly (non-zero) instead of if it can't verify the object is actually gone. An already-missing target is an error by default; --if-exists treats it as a no-op success. Source: apps/cli/src/lib/share/delete.ts, apps/cli/src/commands/share.ts.

• Codex edit runs can write under the repo's .agents/ again. Codex's workspace-write sandbox hardcodes any .agents/ (and .codex/) directory as read-only, but agents-cli keeps every git worktree at <repo>/.agents/worktrees/<slug> — so a Codex session whose cwd was the repo root hit EROFS: read-only file system on any write into a worktree (a build's dist/, generated files) and then had to prompt for per-command approval to escalate. Every interactive, headless, and direct-launch Codex path now makes the run's <repo-root>/.agents writable: agents run codex (and the Windows shim delegate) add it to the agents-edit profile's workspace_roots, and the adopted POSIX codex shim resolves the repo's .agents from $PWD at run time (worktree-aware) and passes it via Codex's own --add-dir. (Routines use a separate overlay-HOME sandbox with their own allow.dirs and are unchanged.) Naming the .agents directory itself is the only override Codex honors — a nested sub-path makes bwrap refuse the mount. Only an existing .agents is added; out-of-workspace and ~/.config writes stay gated, network unchanged. Source: apps/cli/src/lib/codex-policy.ts, apps/cli/src/lib/project-key.ts, apps/cli/src/lib/exec.ts, apps/cli/src/lib/shims.ts.

1.22.34

• A failed agents teams add no longer strands an agents/<name> branch that breaks every retry (RUSH-2356). The worktree was created before the teammate record was persisted and nothing removed it when the add failed, so the next teams add with the same --worktree name died on fatal: a branch named 'agents/<name>' already exists — observed 2026-08-07, forcing three renames before a teammate could be created. Two guarantees now hold. Name uniqueness and the --after dependency graph are validated before createWorktree runs (AgentManager.validateAddPreconditions), so a duplicate name, unknown dependency, or cycle never creates a branch at all. A failure after the worktree exists — a missing harness CLI, a launch error, a cloud dispatch failure — removes the worktree and its branch before the command exits non-zero, and prints the exact git worktree remove / git branch -D pair if that teardown itself fails. Teardown is scoped twice over, because deleting a live teammate's worktree would destroy real work: only a worktree that same add created is a candidate, and only when no live teammate claims it (AgentManager.isWorktreeClaimed, a raw meta.json scan across every team, counting only non-terminal records). That second check matters because the add can fail after the record is durably saved — spawn() saves a staged teammate and only then runs the retention pass, which refreshes every sibling and can throw on a distributed one — so a teammate already recorded and waiting on an --after dependency keeps its worktree. If we can't prove a worktree is an orphan, it is left in place with the manual removal printed — the claim check fails closed, so an unreadable or half-written record answers "claimed" rather than "free": only a genuinely absent record (ENOENT) proves nothing claims the worktree, because the alternative error deletes a running teammate's uncommitted work. The pr-watch fixer path (reactWithTeammate) and a partially-failed createWorktree (branch ref created, checkout not) run the same guarded teardown — the fixer path matters because it stages its teammate with --after when it follows a source teammate, so it can reach the failure branch with a live, durably-recorded, merely-pending teammate already owning the worktree.

  One user-visible surface change: a duplicate name, unknown --after dependency, or dependency cycle is now rejected before the worktree step, so it surfaces as the raw validation message under the friction id teams/add-precondition-failed rather than wrapped in Could not add <agent> to <team>: under teams/add-failed. Source: apps/cli/src/commands/teams.ts, apps/cli/src/lib/teams/agents.ts.

• teams add no longer silently discards pending teammates past the retention cap (RUSH-2356). listCompleted() classified every non-RUNNING status — including pending — as "completed", so cleanupOldAgents() reaped staged --after teammates once the team's history crossed the 50-record cap: teams add --after printed a full success block for a teammate whose record then vanished. Retention now filters on a real terminal-status set (completed/failed/stopped); a pending or running teammate is never a reap candidate. spawn() also asserts its record is durably on disk right after writing it, so a failed write can no longer report success for a teammate that doesn't exist. Source: apps/cli/src/lib/teams/agents.ts.

• A session recorded on Windows no longer has its cwd corrupted when read on macOS or Linux (RUSH-2358). normalizeCwd() is the shared cwd-normalisation path for every harness's session filtering and display, and its fallback used path.isAbsolute(cwd) — which is platform-relative. A Windows-rooted path (C:\Users\dev\repo\...) is not absolute on POSIX, so it fell through to path.resolve(), which silently prefixed the reading process's own working directory onto it. Transcripts sync across the fleet, so any session captured on a Windows box and indexed on a POSIX box has carried a corrupted cwd since the fallback was introduced — visible as wrong directory attribution in agents sessions filtering and display, and as a lost worktree_slug. The normalisation now recognises a Windows-rooted path (drive letter or UNC) on POSIX and treats it as already absolute, mirroring the existing branch that recognises a POSIX-rooted path on Windows. Source: apps/cli/src/lib/session/discover.ts.

• A dead --device teammate no longer reports RUNNING forever, and resume relaunches it (RUSH-2366). The remote liveness probe only distinguished ".exit sentinel present" from "absent" — a process killed before it could write its exit code (SIGKILL, OOM, box lost) fell into the same "absent" bucket as a still-running teammate and stayed RUNNING indefinitely, so agents teams resume kept routing it to steer/mailbox instead of relaunching. The probe now resolves three states (ALIVE / EXITED / GONE) in one round-trip; GONE (process confirmed dead, no sentinel) latches FAILED. A separate stale-manager race is also fixed: a long-lived teams start --watch supervisor's cached teammate could re-persist a stale in-memory RUNNING over a terminal status a different CLI invocation (agents teams stop) had just written to disk — updateStatusFromProcess() and rescanFromDisk() now adopt a newer on-disk terminal status instead of overwriting it. Source: apps/cli/src/lib/teams/agents.ts.

• agents message can now reach a detached agents run --device <host> --no-follow dispatch (RUSH-2366 follow-up). getActiveSessions() has no visibility into a detached dispatch's live remote process — only ~/.agents/.cache/hosts/<id>.json (the record agents hosts ps reads) does — so agents message <name> reported "No running agent... matches" for a dispatch agents hosts ps showed running with a live pid, and the only recovery was killing and re-dispatching it (losing all context). agents message now resolves the same host-task records and reroutes the message over the existing --host passthrough to the box that actually owns it, or fails with an actionable "already <status>" message when the dispatch has already finished. It heals the dispatch record with reconcileRunningTasks before deciding, the same step agents hosts stop/ps already take — a detached record never self-updates, so a finished run stays stamped running on disk and would otherwise be routed through an SSH reroute that could only fail instead of being reported finished locally. Source: apps/cli/src/commands/message.ts, apps/cli/src/lib/mailbox-target.ts, apps/cli/src/lib/hosts/tasks.ts.

• teams add --worktree no longer nests a new worktree inside another teammate's worktree (RUSH-2366 follow-up). When the caller's ambient cwd was already inside a linked worktree (e.g. an orchestrator agent dispatching teams add from within its own worktree), createWorktree resolved the placement root via git rev-parse --show-toplevel, which returns that worktree's OWN root rather than the main checkout's — landing the new worktree at .../worktrees/A/.agents/worktrees/B. Cleaning up A then destroyed B along with it, even though B's commit history survived on its branch ref. createWorktree/removeWorktree now resolve via getMainRepoRoot() (the existing git-common-dir-based helper), which always points at the main checkout regardless of which worktree the caller is standing in. Source: apps/cli/src/lib/teams/worktree.ts.

• An interactive Claude run authenticates from your own login again, not the headless setup-token (RUSH-2395). buildExecEnv injected the auth bundle's per-account setup-token into CLAUDE_CODE_OAUTH_TOKEN for every resolved Claude launch, so a hand-driven session on a personal machine reported Auth token: CLAUDE_CODE_OAUTH_TOKEN in /status and ran on the probe credential instead of the login the user had established. That token exists for runs with no human present (usage probes, routines, dispatched runs), and it is user:inference-scoped, so it also cannot read usage (RUSH-2392). Injection is now gated on the run resolving headless; an interactive run is left on its per-version login, and an inherited copy of that same token is dropped so a nested interactive launch from inside a headless agent's shell does not keep authenticating as it. A token the caller exported themselves is matched by value and left alone. Source: apps/cli/src/lib/exec.ts.

• Multiple Cursor accounts are now real — each run authenticates as the account you pick (RUSH-2400). Previously agents view cursor showed several Cursor accounts and balanced rotation picked one, but every run silently authenticated as the single live ~/.cursor login: buildExecEnv gave Cursor no per-account isolation, so the version/account you selected was discarded at exec. Cursor has no config-dir env var, but its OAuth token — the login gate — lives at $XDG_CONFIG_HOME/cursor/auth.json (verified empirically; ~/.cursor/cli-config.json is only metadata). buildExecEnv and the versioned-alias shim now pin XDG_CONFIG_HOME at the version home for Cursor (the same XDG mechanism muse uses), so agents run cursor@<account>, the account picker, and balanced rotation each launch cursor-agent authenticated as that account's own token — isolated per child process, so two accounts run concurrently without clobbering one another. agents view cursor now verifies each account's signed-in state against its own token (CREDENTIAL_FILE_SEGMENTS.cursor), and a migration seeds the current global login into the active account's home so no one is logged out on upgrade. The routine overlay path is unchanged (seeds from the active login by design). Source: apps/cli/src/lib/exec.ts, apps/cli/src/lib/shims.ts, apps/cli/src/lib/agents.ts, apps/cli/src/lib/migrate.ts.

• agents browser sessions / agents sessions --browser is task-first, with agent outcome previews (RUSH-2407). On a TTY, the picker now groups every screenshot, PDF, and recording by browser task instead of printing one row per file, newest task first. A task whose launchId still resolves to an indexed agent session shows the canonical session digest (prompt, changes, tests, last response) before its captures; a task whose owning run already stopped is labeled unlinked rather than silently dropped. Downloads get their own group. Search matches task name, profile, the linked session's agent/topic, or an artifact filename; enter opens the highlighted capture (or drills into a capture list first for a multi-capture task). New --no-interactive flag prints the previous flat table; --json output is unchanged. Source: apps/cli/src/lib/browser/sessions-list.ts, apps/cli/src/commands/browser-sessions-picker.ts.

• agents sessions --routine is outcome-aware: run history, then linked sessions (RUSH-2409). Selecting a routine now renders its canonical run history first — every run's id, trigger, status (completed/failed/blocked/skipped/missed), start/duration, exit/error, execution type (agent/command/workflow), placement (local/host/cloud), and log/report paths — and links each run to the indexed agent session(s) it produced (agent/version/account/model/token/cost/duration/tool metadata). A command-only routine (e.g. auto-dispatch, which produces no transcript) no longer dead-ends into the generic "No sessions found" copy: it shows its runs and states plainly that no agent session is produced, and command/blocked/skipped/missed attempts appear with no fabricated session row. Counts distinguish run records from linked sessions, and routine selection stays global across every working directory. The drilldown is the default routine view; an explicit --flat/--tree or a session id/query keeps the scoped session listing/picker. The canonical source is the run history under ~/.agents/.history/runs/<routine>/ (listRuns), not the session index — no divergent state added. Source: apps/cli/src/commands/sessions.ts.

• Inspect Watchdog decisions and actions from the CLI (RUSH-2410). agents watchdog history [sessionId] renders every session inspection plus persisted decisions, nudges, rotates, and errors newest-first, with duration/limit filters, optional heartbeat rows, and safe JSON that excludes transcript content. The audit retains 5,000 events, and persisted transcript context is capped at 4,096 characters per event. agents watchdog status points to the history command instead of leaving the audit log undiscoverable. Source: apps/cli/src/commands/watchdog.ts, apps/cli/src/lib/watchdog/{runner,log,history}.ts.

• agents ssh <device> mirrors your project directory on interactive login (RUSH-2412). An interactive agents ssh <device> with no command now starts the remote login shell in the same home-relative directory you launched from — agents ssh yosemite-s0 from ~/src/app lands in ~/src/app on the target when it exists, else the remote home — matching agents run --host. It reuses the one canonical portable-cwd resolver (deriveMirroredCwd / remoteCdPrefix), is best-effort (a missing checkout never fails the login), injection-safe for paths with spaces or metacharacters, and covers POSIX and Windows PowerShell. An explicit agents ssh <device> <cmd…> is unchanged. Source: apps/cli/src/lib/devices/connect.ts, apps/cli/src/lib/project-root.ts, apps/cli/src/commands/ssh.ts.

• Make live Watchdog ticks explain each session (RUSH-2416). agents watchdog now prints the tick date/time and attention-worthy sessions with their stable id, label/topic, agent, host app, machine, project, activity, start/activity ages, cwd, latest preview, and exact decision reason. Healthy/non-actionable inspections collapse into one count; --verbose restores every row and --json remains the complete machine-readable result. Source: apps/cli/src/commands/watchdog.ts, apps/cli/src/lib/watchdog/runner.ts.

• agents daemon start no longer defeats its own launchd/systemd launch (RUSH-2417). startDaemon() and the daemon child's claimDaemonInstance() resolve the same <daemonDir>/daemon.lock, and the launchd/systemd branches busy-waited on waitForPid(3000) while still holding it — the release only happened in startDaemon's outer finally. The freshly-launched daemon therefore hit EEXIST against a holder that was alive (the parent CLI process) and exited with the false "another daemon is mid-takeover" warning, so the service-manager fast-start path failed deterministically on every fresh install and fell back to a detached spawn. The start lock is now released the moment the launch has been issued — after launchctl load / systemctl start / the detached spawn — instead of after the pid wait. The concurrent-start guarantee is unchanged: two startDaemon() calls still cannot both launch, because launchd (one plist label) and systemd (one unit) no-op a second start and the detached path is covered by claimDaemonInstance's last-wins takeover (SING-11). Source: apps/cli/src/lib/daemon.ts.

• Reap orphaned keychain watch-lock helpers after ungraceful daemon death (RUSH-2419); await secrets broker socket release on close (RUSH-2421). The auto-lock-on-sleep watcher is still never killed while its owning daemon is alive, but a separate reaper path now cleans it up once the parent is provably gone (OOM, SIGKILL, killTree) — closing the leak that only close() used to handle. Hosted and standalone broker close() now wait for net.Server's close event with a 2s bound so a successor cannot race a half-released socket. Source: apps/cli/src/lib/secrets/reaper.ts, apps/cli/src/lib/secrets/agent.ts.

• Searchable command API reference. apps/cli/docs/command-reference.html is generated from the complete registered Commander tree and covers every visible command and nested subcommand, argument, flag form, choice, default, alias, example, and note. npm run verify:index now fails when the HTML or canonical JSON drifts from the CLI. Source: apps/cli/scripts/gen-command-index.ts.

• agents inspect drill-downs render readable previews and return the resources that actually exist. The detail view wrapped a description at a hardcoded 100 characters regardless of terminal width, so a long plugin or skill description lost its sentence at 80 columns and wasted the space at 200; it now wraps to the real width, and detail rows are width-aware too. --rules listed the composed AGENTS.md output and its symlinks while hiding every fragment under rules/subrules/, so agents inspect . --rule foundations exited 1 — rules now resolve from subrules/. --hooks did a flat readdir and reported the event directories plus doc files, disagreeing with the count the summary view printed for the same repo (12 vs 39); both now read through listHookEntriesFromDir. Plugin detail gains the bundle's real recursive size instead of (bundle), plus its author, dependencies, and which execution surfaces it ships (hooks/, bin/, .mcp.json, …) — author was present in every plugin.json on disk but missing from the PluginManifest type, so nothing read it. Source: apps/cli/src/commands/inspect.ts, apps/cli/src/lib/types.ts.

• agents inspect no longer crashes when a plugin.json or agents.yaml field's JSON/YAML type contradicts the interface it is cast to. loadPluginManifest and the agents.yaml hook reader both cast parsed input straight to a typed shape and validate almost nothing, so any field can be a string where an array was declared, or a number where a string was. Four crashes came from that: "dependencies": "some-plugin" reached .join() (truthy .length, no .join) while building the plugin list, so one bad manifest took down agents inspect ., --plugins, --json, and even a query for a different, valid plugin; a numeric "version" and a non-string "description" threw later at render, breaking the detail view and (for description) the plugin list; and in agents.yaml, a scalar events: PreToolUse or a numeric matches.prompt_contains threw in summarizeHook, breaking bare agents inspect <repo> and — through the user-level manifest — agents inspect <agent> on every machine. Every uncontrolled field now routes through one of two coercion helpers, so a scalar renders where a list was expected and an object drops its row instead of printing [object Object]. Source: apps/cli/src/commands/inspect.ts.

• One malformed mcp/*.yaml no longer takes down agents inspect <repo> with an unhandled stack trace. validateMcpYamlConfig returns null for some bad shapes but throws for others — args that is not a string array, a non-string command, a non-map env — and the three directory scans that call it (discoverMcpConfigsFromRepo, listMcpServerConfigs, and the layered project/user MCP resource scan in versions.ts) let that throw escape, so a single bad file in a cloned repo crashed the whole command and hid the valid configs beside it. Scans now skip the offending file and name it on stderr, exactly as they already skip a null; explicit single-file operations still throw loudly. Source: apps/cli/src/lib/mcp.ts, apps/cli/src/lib/versions.ts.

1.22.33

• Release tags are annotated with the folded changelog notes. scripts/release.sh now creates v<version> as an annotated tag whose message is Release <version> plus the body of .changelog/<version>.md (the same notes that already become the release PR body). Agents keep writing one fragment under .changelog/next/; there is no separate tag-description channel. The already-published missing-tag recovery path uses the same helper with --force. Source: apps/cli/scripts/release.sh.

agents sessions --routines once again opens the routine picker across every working directory instead of an empty current-repository session browser.

1.22.32

• Routines validate execution context before activation and fire once per schedule slot (RUSH-2290). A routine selects one execution project plus a portable cwd; add/edit save proven blockers paused, durable slot and active-run claims prevent duplicate or overlapping launches, and every blocked/skipped/pre-spawn attempt remains visible without requiring a session transcript. Source: apps/cli/src/lib/routine-context.ts, apps/cli/src/lib/routine-readiness.ts, apps/cli/src/lib/runner.ts.

• Daemon: self-terminates if its own state dir disappears; the routines test suite reaps leaked daemons instead of letting them run for days (RUSH-2367). Three real daemon processes were found alive on a fleet box for up to 3.5 days, each spawned by a vitest fixture under its own /tmp HOME and invisible to every agents daemon guard, since a different HOME resolves a different state dir and instance registry. The daemon now polls (AGENTS_DAEMON_STATE_DIR_CHECK_MS, default 60s) for a per-lifetime marker and exits gracefully if it disappears — unlike the pid and heartbeat files, status repair cannot recreate that marker after deleting the state tree. This is the only defense that survives the whole test runner being killed externally before any in-test cleanup can run. The routines test suite also gained a leak detector that fails the run and force-kills anything it spawned (or, on CI, any daemon it finds under its own fixture prefix from a previous interrupted run) that survived past its own test. Source: apps/cli/src/lib/daemon.ts, apps/cli/src/commands/routines.test.ts.

• Daemon: status/doctor/services no longer misreport test fixtures as duplicate daemons to kill, and no longer render healthy for an unreachable service (RUSH-2368). Duplicate detection used to scan every __daemon-run process on the box, so a fixture daemon under its own HOME (and therefore its own getDaemonDir()/instance registry) — a separate install, or a leaked test process — showed up as a stray for the reader to kill, contradicting the reaper (reapStrayDaemons) and stop's postcondition, which already scope by the instance registry. Duplicates are now read from that same registry (findSurvivingStateDirDaemons), never a raw ps match. Separately, the secrets-broker and browser-IPC health lines derived their healthy/down verdict from the daemon's persisted last-ok record, which is only updated at the daemon's own startup — a broker that went unreachable hours into a still-running daemon rendered healthy (unreachable) on one line. The verdict now comes from the live probe; the persisted record supplies only supporting last-ok/last-error context. Source: apps/cli/src/commands/daemon.ts, apps/cli/src/lib/daemon.ts.

• Agent installations are frozen, and agents update <agent>@<installed-version> moves the release inside one (RUSH-2372). An installation used to be identified only by its version-dir name, so the vendor release was the identity: moving to a new release meant a new directory, which dangled every default, project pin, routine version:, and profile that named the old one — and two installations of the same release could not coexist at all. Each install now carries an installation.json with a stable opaque id plus the release currently on disk; the name is frozen for life and only the release moves, so every reference keeps resolving. Pre-existing version dirs migrate on first read. agents update takes --to <release> (latest by default), --account <label> to disambiguate when several installations match, --json, agents update list <agent>, and routes through --host to update a peer's installation. The target release is fetched into a sibling directory and launched there before it replaces the working one, so a release that cannot start is discarded rather than installed; a post-swap failure restores the previous one. Update strategies are chosen from the agent registry's declared capabilities, so every harness agents add manages is covered (npm package, shared self-updating binary, install script) — and a harness whose binary lives outside the directory being swapped is refused with the reason instead of being recorded as updated. Not to be confused with agents upgrade, which updates agents-cli itself. Source: apps/cli/src/lib/installations/*, apps/cli/src/commands/update.ts, apps/cli/src/lib/versions.ts.

• agents doctor detects and self-heals a hook whose generated shim wrapper is missing or broken, and the menu bar shows it (RUSH-2382). A native hook command could read as wired when its generated ~/.agents/.cache/shims/hooks/<name>.sh target was absent, a dangling symlink, empty, or non-executable — the harness silently never ran the hook. agents doctor now emits a hook-runtime-broken critical finding for every hooks-capable harness (not just the settings formats the wiring inspector understands), and the daemon's safe self-heal regenerates one broken shim per unique path per pass with post-repair verification, never retrying or recursing into resource sync within the same pass. The macOS menu bar System row now reads N critical · M warnings (or all set) from agents doctor --json's findings on the existing 15-minute poll, and the submenu lists up to 5 actionable findings with remediation (any kind, not just this one), with a +N more — run agents doctor row past the cap. Source: apps/cli/src/lib/hooks.ts, apps/cli/src/lib/self-heal/checks/hook-runtime.ts, apps/cli/src/lib/devices/doctor-findings.ts, apps/cli/menubar/Sources/MenubarHelper/{Models,StatusItemController,AgentsCLI}.swift.

• Menu bar: the ROUTINES section is now a collapsible project-group accordion. Routines render the same way ACTIVE sessions do — one collapsible header per project group (a project name, or the Operations / All projects / Cross-project specials the CLI derives from each routine's projects: field), collapsed by default, click ▶ to fold every routine in that group inline. Each header carries per-state glyph counts (◔ upcoming, ✕ failing, ⃠ missed, ⏸ not-ready) and a paused tail, so a collapsed group still shows what is inside it; the header row also names the group count (ROUTINES · … · N groups). Expanding a group orders it attention-first, then by next run, then paused last. This replaces the flat group labels plus the single "All routines…" flyout for a CLI that emits projectGroup; an older CLI falls back to the previous view. Source: apps/cli/menubar/Sources/MenubarHelper/StatusItemController.swift.

1.22.31

• agents secrets unlock --keys folds in the scoped-hold surface; the secrets lease/leases/revoke commands are deleted (RUSH-2350). unlock now takes --keys K1,K2 to hold ONLY that subset of a bundle behind its own expiry instead of the whole bundle — the one capability lease had that unlock did not, now on the command agents already reach for. Without --keys, unlock behaves exactly as before (whole bundle). An unknown or empty key subset fails closed (Unknown secret lease key(s): … / requires at least one key), --keys scopes exactly one local bundle (rejected with --all/--host), and secrets status now names the held keys of a scoped hold; secrets lock <name> releases it. The duplicate secrets lease/secrets leases/secrets revoke trio is gone — it had zero consumers, and its jobs (list holdings, release one) are already secrets status and secrets lock. No alias or deprecation shim (per the repo's no-unasked-shims rule). The underlying lease model (src/lib/secrets/lease.ts) is unchanged — unlock --keys reuses it. Source: apps/cli/src/commands/secrets.ts (scopeHeldEnv, the unlock/status actions), apps/cli/src/lib/secrets/{agent,session-store}.ts, apps/cli/src/commands/secrets.scope.test.ts, apps/cli/src/commands/secrets.flags.test.ts.

• Session previews use bookmark and focus as separate actions (RUSH-2373). The shared interactive browser for ordinary, team, and routine sessions now uses * to bookmark the highlighted row, b / --bookmarks to filter bookmarks, and f to focus the highlighted session through the same attach-or-recover flow as agents sessions focus. Enter still resumes. The non-TTY surface is now agents sessions bookmark; its flag, JSON keys, code symbols, and durable store are bookmark-only, with a one-time migration from ~/.agents/.history/favorites.json to bookmarks.json. The retired favorite command and flag are not aliases. Source: apps/cli/src/commands/sessions-browser.ts, sessions-bookmark.ts, focus.ts, apps/cli/src/lib/session/bookmarks.ts, apps/cli/src/lib/migrate.ts.

1.22.30

• agents secrets import --force now repairs a bundle whose metadata record is undecryptable (#2305). A file store whose key was lost or rotated out from under it leaves bundles present but unreadable — exactly the state provisioning exists to fix. agents secrets export <bundle> --host <box> --remote-backend file --force drives the remote's own import, which died on the unreadable record (Bundle 'x': failed to decrypt) and wrote nothing, so the only route left was deleting the record by hand on an already-degraded store. With --force, an undecryptable record is now treated as absent and recreated.

  Still refused without --force: recreating unconditionally would destroy a healthy bundle for someone who merely forgot to set AGENTS_SECRETS_PASSPHRASE. Only BundleUndecryptableError qualifies — a locked keychain or logged-out vault still throws, so a recoverable state is never mistaken for a lost key. Source: apps/cli/src/commands/secrets.ts (resolveImportBundle).

• Documented the routine reliability contract (RUSH-2290). docs/specifications.md now specifies routines normatively: a new §Routine execution & readiness section (RT-1..RT-11) pins that projects (plural) is grouping metadata only while a singular project/--project-anchor is the execution anchor, that a routine's working directory resolves on the execution target (with a canonical cwd-resolution table — rootless project or bare relative cwd anchors at the target $HOME), that a proven readiness blocker saves the routine paused with a stable code (project_not_found, cwd_missing, codex_workspace_untrusted, agent_auth_failed, execution_context_missing, …), that run history owns attempts while sessions/logs/reports are optional children, and that repo is an external Git/cloud/webhook identity, not a local cwd. §Scheduling & execution singularity gains SING-11..SING-13 (one scheduled fire launches at most once; the slot claim and the active-run claim are separate; a routine never overlaps itself), and run statuses gain blocked/skipped. Most of the contract is marked [Intended] (RT-GAP-1, SING-GAP-3) — the target the reliability work implements — while the landed guarantees (daemon singleton + catch-up consolidation, run-first history, definition/activation split, menu bar read-only) are marked Current. docs/03-routines.md documents the same model for users. Docs-only; no runtime change. Source: apps/cli/docs/specifications.md, apps/cli/docs/03-routines.md.

• Daemon: one instance per state dir via last-wins takeover (RUSH-2352). A second agents __daemon-run for the same state dir — from ANY install path (homebrew, .local dev, nvm, npx) sharing one ~/.agents — now evicts the incumbent and takes over, instead of exiting and leaving it running. This inverts the old first-wins refusal, an owner product decision: a restart always replaces the previous daemon. claimDaemonInstance SIGTERMs the live pid-file owner of its own state dir, waits for its graceful shutdown to release the secrets broker socket and browser IPC binding (hard timeout → killTree → bind), and never binds before that release — closing the two-brokers-on-one-socket orphan. In-flight detached routine children survive and are adopted by the new daemon, never killed. A daemon serving a DIFFERENT state dir (a separate HOME, a test fixture) is never a takeover target. Source: apps/cli/src/lib/daemon.ts.

• Daemon housekeeping ticks are now routines, not a second scheduling concept (RUSH-2353). watchdog, device-probe, tmux-reconcile, launch-health, fleet-cache-warm, session-cache-warm, usage-refresh, and auto-dispatch were hardcoded setInterval timers inside runDaemon() — undeclared, no run history, no pause, no device pin. They are now shipped system routines (gh:phnx-labs/.agents-system routines/*.yml) that invoke the same tick body one-shot via agents __daemon-tick <name> (apps/cli/src/lib/daemon-ticks.ts), fired by the same pid-claimed JobScheduler as every other routine. Same schedules, same effects; each tick now shows up in agents routines list, accumulates history in agents routines runs/stats, and can be individually paused. auto-dispatch — polling Linear for delegated tickets — is the one that mattered most: it previously fired unpinned on every daemon in a fleet with no coordination, and can now be pinned to a single device with agents routines devices auto-dispatch --set <device>. Requires the paired phnx-labs/.agents-system release that ships the new routine YAML. Source: apps/cli/src/lib/daemon.ts, apps/cli/src/lib/daemon-ticks.ts, apps/cli/src/index.ts.

• Existing device activation lists automatically retain all eight formerly always-on daemon ticks during the routine migration.

• Restored agents daemon — runtime, hosted-service, and failure visibility for the always-on daemon (RUSH-2354). agents daemon had been deliberately removed while every mechanism it needs (getDaemonStatus, startDaemon, stopDaemon, readDaemonLog, signalDaemonReload) stayed implemented and unreachable. It's back as status (identity — state/pid/uptime/heartbeat/owning install — plus every duplicate __daemon-run process on the box, plus per-service health), start/stop/restart, enable/disable (a new persisted daemon.enabled device kill switch — disable stops routines add/routines start/routines catchup/webhook auto-start; agents daemon start still starts it explicitly), reload (SIGHUP), services, logs (-n/-f/--level/--since/--json), and doctor. A new persisted per-subsystem health record (apps/cli/src/lib/daemon-health.ts) tracks the secrets broker and browser IPC server's consecutive-failure streaks, so a subsystem failure no longer just scrolls out of the daemon log. There is still no agents daemon jobs — scheduled work stays agents routines; status/doctor point failures at agents routines stats. Source: apps/cli/src/commands/daemon.ts, apps/cli/src/lib/daemon-health.ts, apps/cli/src/lib/device-config.ts.

• Daemon: stop asserts its postcondition instead of assuming it (RUSH-2355). stopDaemon used to fire SIGTERM and report success without checking anything, so a stop that silently left a resource bound still read as "stopped". It now waits for shutdown, escalates via killTree on a wedged daemon, then verifies each resource released — the secrets broker socket, the browser IPC binding, and no surviving __daemon-run for this state dir — reclaiming any stale socket the ungraceful exit left behind. agents daemon stop prints what released vs what survived, exits non-zero when a resource could not be released, and carries a structured result under --json. In-flight detached routine children survive a stop deliberately and are reported, never killed. It never reports success on an unverified stop. Source: apps/cli/src/lib/daemon.ts, apps/cli/src/commands/daemon.ts.

• OpenCode sessions are no longer pruned from every listing (RUSH-2357). OpenCode keeps all sessions in one SQLite file, so the index stores a composite file_path (opencode.db#ses_<id>). The staleness gate split that string with dirname/basename and looked the composite basename up as a directory entry — it never matched, so every OpenCode row was classified as a deleted file and dropped from agents sessions. A second gate then hid it as an "unmanaged" install because its single shared DB is never under a version home. Both now key off the composite FORM: existence is tested against the CONTAINER file, and a single-DB session is treated as managed (there is one canonical store, not a per-install dotfile). Any future single-shared-DB harness inherits the fix. Source: apps/cli/src/lib/session/parse.ts, apps/cli/src/lib/session/db.ts, apps/cli/src/lib/session/discover.ts.

• OpenCode session reads are bounded again, and one bad row no longer hides every OpenCode session (RUSH-2358). parseOpenCode now projects a tool part to just the fields it reads, dropping state.attachments and capping state.output / an oversized state.input: on a real opencode.db the largest tool part is 1.3 MB of base64 image attachment that the previous output-only truncation left whole, inflating one session's loaded payload 6.4×. Every json_extract in the OpenCode scan and parse queries is now guarded by json_valid — SQLite aborts the entire query on a malformed value, so a single unparseable part or message row previously dropped all OpenCode sessions from agents sessions, with no message in a non-TTY run. The todo read is gated by a sqlite_master row count instead of a blanket catch, so a locked or corrupt database no longer reads as "no todos" — and the count avoids the undefined-vs-null split between node:sqlite and bun:sqlite, which a sentinel check would have inverted on the shipped Bun binary. Source: apps/cli/src/lib/session/parse.ts, apps/cli/src/lib/session/discover.ts.

• agents sessions' OpenCode account field now resolves from auth.json, the same source agents view/agents doctor already use (RUSH-2358). The prior resolver queried opencode.db's account/account_state/control_account tables, which are permanently empty on a real, actively-used install (verified: yosemite-s1, OpenCode 1.16.0, 35 applied migrations, zero rows in all three) — so account always read null regardless of login state. resolveOpenCodeAccountId (new export, apps/cli/src/lib/agents.ts) is now the single source of truth for both surfaces: the sorted, +-joined provider ids holding a valid auth.json credential. Source: apps/cli/src/lib/agents.ts, apps/cli/src/lib/session/discover.ts.

• OpenCode sessions now carry the same usage/burn fields as every other harness (RUSH-2358). agents sessions reads what OpenCode's own SQLite DB already records: input_tokens, cache_read_tokens, cache_write_tokens (siblings of the existing output_tokens), cost_usd and model from the session row, duration_ms from its timestamps, tool_call_count from its tool parts, todos from its todo table, recent_directories_touched from the files it edited, and worktree_slug from its cwd. parseOpenCode now truncates only a tool part's output (not the whole part), so large edit parts are no longer dropped. Newer cost/model columns and the todo table are probed, so an older opencode.db still scans. account stays null when no signed-in account is recorded, and account_key/account_org/git_branch/cost_usd_nocache remain not-applicable for OpenCode. Source: apps/cli/src/lib/session/discover.ts, apps/cli/src/lib/session/parse.ts.

• agents sessions preview <uuid-or-8-char-id> resolves rich previews across the fleet (RUSH-2370). ID-shaped lookups use the SQLite ID index rather than scanning recent history; full UUIDs can stop at the first exact owner, while short prefixes wait for every selected peer and surface ambiguity or unreachable peers. The owning device renders remote cards. A bounded lru-cache L1 handles process-local reuse, normalized transcript-derived preview facts are cached durably by actual file mtime + size, and live status stays outside that cache behind a 15-second TTL. Text output now includes plugin provenance alongside skills, hooks, errors, tests, messages, tokens, timing, and artifacts; --json emits a versioned envelope. The existing detailed agents sessions <id> renderer and --preview spelling remain unchanged. Source: apps/cli/src/{commands/{sessions,sessions-picker}.ts,lib/{memory-cache.ts,session/{db,session-cache}.ts}}.

• Full command index doc — docs/command-index.md + docs/command-index.json. Every agents command and subcommand with its argument names and one-line description, on one scannable page, plus a machine-readable tree. Generated deterministically from the CLI's own command tree (npm run gen:index), regenerated on release, and gated in CI (npm run verify:index, in the cli-preflight and cli-docs jobs) so it can never drift from the shipped surface.

• agents secrets drops the vague --for flag: duration is --ttl/--until, harness narrowing is --agent. --for was doing two unrelated jobs on sibling commands — secrets unlock --for <agent> meant a HARNESS while secrets lease --for <duration> meant a DURATION — so an agent that learned the flag from one command passed it wrongly to the other, and unlock --for 8h silently read 8h as a harness name. unlock keeps its existing --ttl/--until and now narrows with --agent <agent>; lease now takes --ttl <duration> (matching unlock) alongside its existing --agent. --for no longer exists anywhere under secrets, and a test asserts Commander's real option tree so it cannot come back. Breaking for anyone scripting secrets unlock --for <agent> — no consumer existed in this repo or the fleet's own tooling, so no alias was added (per the repo's no-unasked-shims rule). Source: apps/cli/src/commands/secrets.ts, apps/cli/src/commands/secrets.flags.test.ts.

• Cursor launches no longer hang in a blank terminal after agents-cli adopts its launcher (RUSH-2345). Native launcher discovery now follows symlinks and rejects any candidate that resolves back into the agents shim, using the durable adopted-original record instead. Imports store the immutable native target, startup migration repairs existing two-hop loops, and generated shims refuse to recursively execute themselves. Cursor is also restored to prompt-less interactive selection because current builds open a native TUI with no arguments. The same centralized repair fixes agents run cursor and Factory Cursor tabs.

• agents view and agents run keep custom harnesses independent from their native host. The unfiltered view still lists each fork as its own custom harness block, while agents view claude (and its filtered JSON form) shows only Claude versions. Exact custom names are resolved before native harness names, so a fork remains viewable and runnable through its configured host even when its name matches a native or hard-deprecated id. Source: apps/cli/src/commands/view.ts, apps/cli/src/commands/exec.ts.

• Fixed a Touch ID storm from version-skewed clients evicting the daemon's secrets broker. When the always-on daemon hosts the secrets broker on one installed version and a differently-versioned client invokes (e.g. a ~/.local dev build alongside the Homebrew/npm install), the client tore the daemon's broker down at zero held bundles. Because teardown only recognizes the standalone broker's pid claim, it unlinked the daemon's socket without stopping the daemon — which then refused to re-host and was orphaned until restart, leaving every secrets read to cold-start a one-off broker and re-prompt Touch ID. ensureAgentRunning now defers to a live daemon (shouldClientEvictSkewedBroker) and never evicts a daemon-hosted broker; daemon version upgrades are handled by the postinstall restart, and the wire protocol is already version-checked, so a code-skewed daemon broker stays wire-compatible. Source: apps/cli/src/lib/secrets/agent.ts.

• The daemon is now one process per device, whatever launch entry started it — stops a duplicate-daemon pile-up that double-fired every routine. One install exposes two launch entries (the compiled dist/bin/agents binary and the node <shim> JS entry) with different process.argv[1], and the stray-daemon reaper keyed on that path — so the two never reaped each other, duplicates accumulated (78 live __daemon-run observed on one box), and each scheduled routine fired from many daemons at once (measured: a once-per-hour routine spawning 10+ times per tick, once-per-day Claude routines spawning ~8 concurrent runs — burning account tokens and colliding into failed). The reaper now enumerates the device singleton from an on-disk instance registry under <daemonDir>/instances/ (keyed by the daemon dir, which is per device — AGENTS_DAEMON_DIR ?? <HOME>/.agents/.cache/helpers/daemon), so every daemon of one device registers in the same place and the survivor reaps the rest regardless of how each was launched; a genuinely separate install/home or test fixture resolves elsewhere and is left alone. Identity rides the shared registry rather than reading another process's environment, which hardened macOS hides from ps. Source: apps/cli/src/lib/daemon.ts (registerDaemonInstance, reapStrayDaemons).

• agents run <agent> now says the harness is not installed instead of exiting 127 (RUSH-2339). On a machine without that harness the launch used to exec the bare CLI name and die with sh: 1: exec: cursor-agent: not found, behind a ⚠ <agent> looks logged out banner that was also wrong. agents run now probes the executable it is about to spawn and exits 1 with agents: <agent> is not installed on this machine. plus the agents add <agent> fix, before any spawn. The probe is existence-based, so a harness you installed yourself (Homebrew, a vendor curl | sh, a distro package) with no agents-cli version home still launches, and a machine with managed versions but no pinned default still gets the shim's own agents use <agent> <version> guidance rather than a wrong "not installed".

• The Claude usage/auth-health probe no longer reads your interactive Claude Code login — the fix for repeated Anthropic logouts. The daemon's usage (~60s) and auth-health (~3min) warms authenticated with a file-based setup-token when one was provisioned, but otherwise fell through to reading Claude Code's interactive OAuth token from the keychain / .credentials.json and firing it at api.anthropic.com/api/oauth/usage. Anthropic sees an interactive login used programmatically from a background loop and revokes it (the fleet-wide-logout class, RUSH-1822). loadClaudeOauth's read-only accessTokenCache path now returns nothing when no setup-token is provisioned — it never reads the interactive login, in the keychain or in a file — matching the "interactive/rotating login is untouchable" invariant in docs/credential-management.md. The now-obsolete no-ACL access-token cache is removed with it. An account without a minted setup-token shows "usage pending" in agents view (seed one via the mint-auth path) but still runs normally; account rotation is unaffected. Source: apps/cli/src/lib/usage.ts.

• Sort agents view <agent> accounts by email after the default. Managed installs previously followed semantic-version order after the default, forcing users with several Claude, Codex, or other harness accounts to scan a shuffled email column. Rows without an email remain deterministic in version-descending order, and --json keeps its existing default-then-version order for automation compatibility. Source: apps/cli/src/commands/view.ts.

• agents sessions accepts version filters in the same forms as other harness commands (RUSH-2363). An installed positional selector such as agents sessions [email protected] now routes to the structured agent/version filter instead of searching for that literal text and returning no matches. The equivalent split form, agents sessions --agent claude --version 2.1.181, is also supported; unknown or uninstalled positional pairs remain ordinary free-text queries. Source: apps/cli/src/commands/sessions.ts.

1.22.29

• Name provider accounts once and find their installed versions automatically (#2300). After completing a harness's normal login, agents accounts discovers distinct signed-in accounts across every installed version and agents accounts name work names one through a picker (--from [email protected] is the non-interactive form). The synced registry stores only the harness id and a SHA-256 identity fingerprint—no OAuth material, email, provider id, per-device binding, or cross-harness account group. agents run <agent> --account <label> live-scans candidates and chooses a healthy matching version; it fails instead of falling back to another identity.

• Sessions: one "favorite" vocabulary, no more "star". The interactive browser (agents sessions) footer read f favorites · * star, presenting two names for one mechanism — * toggles a favorite, f filters to favorited, and both write the single store in lib/session/favorites.ts. The * action, the --favorites flag help, the agents sessions favorite command help, and the docs now all say "favorite"; the ★/☆ glyphs and the favorites/favorite JSON keys are unchanged. Source: apps/cli/src/commands/sessions-browser.ts, sessions-favorite.ts, sessions.ts.

• Menu bar: collapsible DEVICES roster, a Focus action on sessions, and richer routine submenus. The dropdown now has a DEVICES section near the bottom — the full registered fleet as one accordion, folded by default so the long list never walls the menu, each row <name> · <platform> with live load% merged from the warm fleet cache (never a faked online/offline) and a Copy agents ssh <name> action; NEW DEVICES moved to sit just above it. Each live-session › submenu leads with ▶ Focus session (attaches locally or SSHes to the owning box via agents sessions focus). Each routine submenu now leads with a last-run line — ● running now (server-verified), ✓ completed · ran 45s · 2h ago, or ✕ failed exit 1 — plus the next fire. The device roster rides the existing 3-minute menubar snapshot --json poll (a cheap local registry read, MenubarSnapshot.devices); everything else renders from fields the snapshot already carried, so no new timer and no per-open shell-out. Source: apps/cli/src/lib/menubar/snapshot.ts, apps/cli/menubar/Sources/MenubarHelper/{StatusItemController,Models,LocalState}.swift.

• Fix agents view and agents usage labeling Codex's weekly or monthly quota as session usage when the native CLI publishes the long-duration limit in its primary rate-limit window. Codex windows are now labeled from their reported duration (S, W, or M) instead of their primary/secondary position.

1.22.28

• agents run / agents teams --device/--host: fail loud when a pinned harness version is not installed on the target (RUSH-2313). A concrete pin like [email protected] is checked against the remote agents view --json listing during ensureHostReady before the run is marked dispatched. Missing pins exit non-zero naming the box, the pin, what is installed there, and agents ssh <box> -- agents add <agent>@<ver> — so detached fleet drains no longer print Dispatched and then die only in the remote log. Aliases (@latest / …) still resolve on the remote; a bare agent name still only warns. Source: apps/cli/src/lib/hosts/ready.ts, dispatch.ts, teams/agents.ts.

• fix: Windows-host e2e suites can resolve win-mini again under the hermetic device registry. tests/setup.ts (RUSH-2042 / #1572) redirects AGENTS_DEVICES_DIR to an empty fork-private directory so unit fixtures never leak into the real fleet registry. The live ssh-tunnel.e2e / browser/drivers/ssh.e2e suites still need a real DeviceProfile for AGENTS_TEST_WIN_HOST, so after #1572 every tests-windows-host-e2e.yml run failed immediately with Unknown device 'win-mini' — even on a tailnet-joined runner that could ssh to the box. The setup file now seeds the private registry from the real fleet entry (or synthesizes one from ssh -G <host>) when AGENTS_TEST_WIN_HOST is set; the real registry is never written. Source: apps/cli/tests/seed-e2e-win-host.ts, apps/cli/tests/setup.ts.

• OpenCode timeout-sample spool dir is Windows-safe (#1869). The generated agents-cli-hooks.ts plugin used PERF_SPOOL.slice(0, PERF_SPOOL.lastIndexOf("/")) to mkdir the perf spool parent. On Windows getPerfDir() is backslash-separated, so lastIndexOf("/") returned -1 and the slice dropped one character — the sample write was fail-silent and never landed. The plugin now imports node:path and uses path.dirname(PERF_SPOOL). Source: apps/cli/src/lib/hooks.ts.

• Bash-command classifier: single-source tool registry + broader unwrap (#1889). The embedded Python activity-log hook (ACTIVITY_LOG_HOOK_SCRIPT in activity.ts) hand-duplicated bash-command.ts's TOOL_REGISTRY and VALUE_FLAGS with a "keep them in sync" comment — the two had already drifted (Python was missing rmdir, and agents/linear two-level tools). Both tables are now generated from the TypeScript source (pythonToolRegistryLiteral / pythonValueFlagsLiteral) at module load. Separately, unwrapCommand (and the matching Python _unwrap_command) now peels export VAR=…, set -euo pipefail, for/until loop bodies, if/then branches, and (command) subshell prefixes that previously classified as other. Source: apps/cli/src/lib/session/bash-command.ts, apps/cli/src/lib/activity.ts.

• Active-session polls skip re-parsing quiet transcripts (#2047). computeLiveSignals (the per-session tail/parse behind agents sessions --active and the menu-bar badge tick) now memoizes by transcript path + mtime + pidAlive inside the process, so a 30s poll no longer re-tails every live session whose file has not changed. Positive Claude transcript-path resolutions are also memoized while the file still exists, avoiding a full walk of every Claude version-home projects/ tree per pid per tick. Source: apps/cli/src/lib/session/active.ts.

• perf(sessions): throttle headless ps/lsof scan + memoize process table across an active-session poll (#2047)

• agents routines devices --set / --clear no longer abort when a fleet peer is offline (#2118). Pinning a routine used to fan out pause/resume to every registered device and throw on the first unreachable one — often after the pin had already succeeded on the target — so a single asleep laptop made fleet pins unusable and the error looked like the pin failed. Offline peers are now skipped with a warning; the command exits non-zero only when a selected target device cannot be reached. Source: apps/cli/src/commands/routines.ts.

• agents models claude no longer lists a per-cloud bare-minor id as a plain catalog entry (#2233). The id-scan fallback (scanClaudeCatalogIds, used when the structured alias/perCloud maps yield fewer than two models) used to surface short forms like claude-opus-4-1 that only appear as a foundry: / cloud-scoped field next to a real firstParty id (claude-opus-4-1-20250805). dropBareLegacyIds now drops any id that is a dash-boundary prefix of a more-specific sibling also present in the scan — covering both the bare-major .includes("claude-opus-4") artifacts (#1892) and these bare-minor cloud-metadata values — while keeping genuine bare currents with no sibling (claude-sonnet-5) and not collapsing claude-opus-4-1 into claude-opus-4-10. Source: apps/cli/src/lib/models.ts.

• Menu-bar dropdown density toggle removed. The Density: Auto/Rich/Compact footer item and the whole rich/compact rendering fork are gone; the dropdown now always renders the rich rows (session/work titles, expanded Routines and Recent sections). Removes the menubarDensity UserDefaults key and MENUBAR_DENSITY env override, and updates the menu-bar docs to match. Source: apps/cli/menubar/Sources/MenubarHelper/StatusItemController.swift, apps/cli/docs/menubar.md.

• The macOS secrets broker can now hold an explicit key subset under its own lease id and expiry (RUSH-2255). agents secrets lease <bundle> --keys K1,K2 --for 8h authenticates once, stores only those resolved values in broker memory and the restart session, and reports lease metadata without exposing values. Unknown, missing, and expired keys fail closed. Source: apps/cli/src/{commands/secrets.ts,lib/secrets/{agent,lease,session-store}.ts}.

• Scoped leases can now be listed and revoked by id (RUSH-2256). agents secrets leases shows bundle, keys, and remaining lifetime; agents secrets revoke <lease-id> wipes exactly that broker grant and its restart session. Source: apps/cli/src/{commands/secrets.ts,lib/secrets/{agent,session-store}.ts}.

• Fleet devices accept an explicit SSH private-key path (RUSH-2265). agents devices set <name> --auth key --identity-file <path> stores the path on that device and every shared SSH invocation passes it to OpenSSH with -i, so devices no longer depend on whichever key the ambient ssh agent happens to offer. Switching a device from password to key auth also removes stale password-bundle metadata from the registry.

• Detached agent dispatch now runs on Windows OpenSSH hosts (RUSH-2267). Headless agents run … --host <windows> launches through a hidden PowerShell process, preserves actor/session/env context, and uses durable Windows-native log, follow, reconcile, stop, and cleanup operations.

• agents repo pull fast-forwards a clean behind-only checkout instead of failing with "Cannot rebase onto multiple branches" (RUSH-2282). After fetch, a 1-behind tree integrates via merge --ff-only against the tracking ref; only genuinely diverged histories enter rebase. Avoids re-running git pull --rebase on a multi-entry FETCH_HEAD (common after bare fetch when the remote has several branches, or under concurrent fleet fetch). Source: apps/cli/src/lib/git.ts pullRepo.

• agents perf splits intentional deny (exit 2) from crashes (exit 1) — hook health is readable again (RUSH-2294). Deny-by-design guards (ask-user-question-guard, plan-html-reminder, git-guard, …) exit 2 on purpose; the warehouse previously counted any nonzero exit as errorCount, so a working guard read as a "92%-error" hook. Exit 0 = allow, exit 2 = blockCount/blockRate, exit 1 / other = errorCount/errorRate. The hooks table column is now ERR/BLOCK/TO (err:…% block:…% to:…%). JSON rows gain blockCount/blockRate. Source: apps/cli/src/lib/perf/db.ts, apps/cli/src/lib/hooks/profile.ts, apps/cli/src/commands/perf.ts.

• Claude launches reuse an unchanged file-backed setup-token instead of decrypting it on every exec (RUSH-2317). The process-lifetime cache is isolated by version home and invalidates from the encrypted credential file's identity, ctime, mtime, and size; token rotation is picked up on the next launch, missing per-account tokens are negatively cached, and plaintext tokens remain memory-only. Source: apps/cli/src/lib/claude-account-token.ts, apps/cli/src/lib/secrets/filestore.ts.

• Repeated full session listings reuse stable transcript membership (RUSH-2318). The process briefly caches settled transcript directories by mtime+size, rereads recently changed directories, and expires every entry within the filesystem timestamp-precision window, avoiding burst-time repeat reads without hiding filesystem-only creates or deletes. Source: apps/cli/src/lib/session/db.ts.

• agents sync --yes drops ~1s/agent of dead work and reuses still-fresh fingerprints (RUSH-2320). Measured on a real install: getActuallySyncedResources was ~1055 ms/agent on the unattended path that never reads it; buildManifest re-hashed every file (~716 ms) after a no-op force sync; the guard-hit path spent ~12 ms building inventories it then discarded. Unattended sync now skips the interactive inventory, the skills detector is stat-first on size before any content read, buildManifest carries still-fresh fingerprints from the previous manifest, and syncResourcesToVersion runs its no-change guard before pattern expansion (accepting a caller-supplied available inventory so multi-version fan-out does not re-scan). Source: apps/cli/src/lib/refresh.ts, apps/cli/src/lib/versions.ts, apps/cli/src/lib/staleness/.

• fix: agents run <agent> no longer dead-ends when every account is logged out — it launches so you can sign in. A harness with one installed, signed-out version had no reachable login path at all: agents run cursor exited with no healthy cursor account under strategy 'balanced' — excluded: 2026.07.23 (signed_out), the agents run cursor@ account picker marked the logged-out row disabled and offered only No usable accounts — cancel, and agents use cursor only set a default. The zero-healthy guard (RUSH-2132) treated a missing login like an exhausted account, but they are opposites — a throttled account must not be launched, while a signed-out one is fixed precisely BY launching, since the harness's own TUI is the login surface. On a human-facing terminal run (a real TTY and no --json), a single sign-in-recoverable account now launches directly (naming the version and the login command) and several open the account picker with auth-blocked rows selectable and labelled launch to sign in; rate_limited / out_of_credits still fail loud, and off a TTY — or under --json — both classes keep the exact watchdog-parsed error, now with the harness's login command alongside --strategy pinned. Source: apps/cli/src/lib/rotate.ts (isSignInRecoverable, signInRecoverableCandidates), apps/cli/src/commands/run-account-picker.ts (pickSignInLaunchVersion), apps/cli/src/commands/exec.ts. (RUSH-2334)

• sessions --active no longer shows retained dead/queued rows, and every process row now carries its PID (RUSH-2336). Bare --active (CLI table/JSON, the interactive browser, focus, and the menu bar) previously kept a row alive as long as its pid wasn't known dead — so a queued-but-not-started row, or a process of genuinely unverified liveness, could still show up. The canonical selector (isRunningLiveSession) now excludes queued/closed/crashed outright (still reachable via --queued/--closed/--crashed) and requires a real process row to positively verify its machine, a positive pid, and pidAlive === true; a cloud row stays active on its provider + task id alone. Every process-backed --active --json row now guarantees machine/pid/pidAlive: true, and the human CLI row and the menu bar's session detail both show the matching machine:pid (or provider · taskId for cloud) locator. Source: apps/cli/src/commands/sessions.ts, apps/cli/src/lib/menubar/snapshot.ts, apps/cli/menubar/Sources/MenubarHelper/.

• agents projects status card scans faster: grouped warnings, a fleet health summary, and a truthful dead label (RUSH-2337). On a busy fleet the card printed each host's git drift twice — once in the inline fleet table, then again as one 2-line block per host in the warnings footer (18 lines for 3 facts) — and read dead 41 finished or lost (41 crashed), which contradicts itself when every dead session is a crash. Now: (1) the warnings footer groups by root cause — all behind hosts collapse to one warning listing each with its count (4 hosts behind origin/main — mac-mini ↓172, yosemite-m2 ↓217, …) under one shared remediation, dirty/missing the same, a lone host keeps its full sentence, grouped per probed path so two repos never merge (mirrors doctor's emitGroup); (2) a one-line fleet health summary (6/13 clean · 4 behind · 4 dirty · 1 missing) sits above the per-host table, which keeps its branch/drift detail; (3) the dead row names the status directly when singular (dead 41 crashed); (4) the fleet-wide rollup carries a fleet snapshot · as of HH:MM stamp; (5) linear shows a completion percent (468/547 done (86%)). Source: apps/cli/src/lib/project-probe.ts, apps/cli/src/lib/project-status.ts, apps/cli/src/commands/projects.ts, apps/cli/docs/11-projects.md.

1.22.27

• agents sessions --teams groups sessions by team (RUSH-1997). Instead of one flat list with a [team/handle] tag, --teams now prints a report grouped by team: each team names its spawner (the orchestrator session that created it) and spawn time, and every teammate row shows its mode + handle. Team-flagged spawns that carry no teammate meta.json — headless agents run sessions, or teammates whose team record aged out — sink into a trailing (no team) bucket, so a real agents teams teammate and a bare SDK spawn are never shown as the same thing. --teams --flat/--tree keep the plain inline table, and a search query keeps the interactive picker. TeamOrigin (also on --teams --json) now carries the teammate's startedAt spawn time and a source (meta = teammate, entrypoint = bare spawn). Source: apps/cli/src/lib/session/team-filter.ts, apps/cli/src/commands/sessions.ts.

• agents run --device auto and agents teams add --device auto now choose from live fleet health instead of 14-day launch affinity (RUSH-2001). The picker probes candidates in parallel, excludes unreachable, overloaded, and missing-agent machines, prefers signed-in candidates with the lowest normalized load, and keeps execution local when no remote is better. Remote readiness now uses agents view --json, preserving the installed/sign-in split instead of treating every remote sign-in state as unknown. Source: apps/cli/src/lib/smart-launch.ts, apps/cli/src/lib/teams/placement-probe.ts, apps/cli/src/lib/hosts/ready.ts, apps/cli/src/commands/exec.ts, apps/cli/src/commands/teams.ts.

• agents devices harnesses / agents devices accounts — per-device harness + account readiness (RUSH-2003). Two new fleet lenses: harnesses lists every installed agent@version across the fleet with its account, signed-in state, quota (highest usage-window utilization; * = cached snapshot), and a single ready verdict (signed in AND not rate-limited); accounts collapses that to one row per account, naming which harnesses share it. Both SSH-probe each online device (bounded like fleet ping, so one unreachable box can't stall the glance) and read the daemon-warmed usage cache — --refresh (--live) forces a live quota read. Scope with --agents <csv> / --device <csv>; --json emits per-host rows (harnesses) or account groups (accounts). Source: apps/cli/src/lib/devices/harness-inventory.ts, apps/cli/src/commands/ssh.ts.

• A session that ran on another device now resumes ON that device, and a typo'd command with --host says unknown command (RUSH-2022). Two bugs found while recovering ~15 sessions after a machine crash, both of which sent recovery down the wrong path.

  (1) agents resume <id> restarted a remote session locally. The harness keeps its conversation state on the machine that produced the session, but nothing checked which machine that was — so a peer-owned session started the agent here, against state this box had never seen (sessions-resume.ts even swapped in process.cwd() when the recorded directory did not exist locally). agents resume now re-runs itself on the owning device over SSH; --here overrides. The bare agents sessions picker routes the same way, and agents sessions attach hops as an attach (its detach record and the headless process it stops both live on the owner). The multi-select agents sessions resume inherits it: each tab it opens runs the canonical agents resume <id>, which now routes itself, and its no-tab-backend path routes explicitly. Root cause of the population that made this common: a run dispatched with agents run --device <box> was indexed with no origin machine at all, so the index claimed the dispatching box; it now records <box>, which also means such a run finally shows up under agents sessions --host <box>. Source: apps/cli/src/lib/session/resume-owner.ts, apps/cli/src/lib/hosts/session-index.ts, apps/cli/src/commands/resume.ts.

  The hop carries its "don't route again" pin as an exported env var, not a flag, so it works against a peer still on an older CLI. Sessions indexed before this release keep their old machine tag — re-dispatch or a fresh scan corrects them.

  (2) The --host/--device router answered for commands that do not exist. It runs before commander parses, so agents session resume --host <box> (one letter off sessions, which does accept --host) reported `agents session` does not support --host/--device — a true statement about a command nobody typed and the opposite of the truth for the one they meant. Unknown names now fall through to unknown command '<name>' with a did-you-mean, and the spellcheck can suggest the lazily-registered groups (sessions/teams/cloud/…) it previously could not see. A real command with no remote semantics still gets the flag-support error. Source: apps/cli/src/lib/hosts/passthrough.ts, apps/cli/src/lib/startup/command-registry.ts.

• agents publish is in the lazy command table. commands/packages.ts registers it at top level but the registry did not list it, so it only resolved through the unknown-command fallback that loads the whole command tree. Found by the new test that pins the command-name set against the real tree.

• A mistyped command keeps its --host. The distance-1 auto-correct now runs before the router instead of after commander gave up, so agents docto --host <box> corrects to doctor and runs on <box> — previously the corrected command re-parsed locally with a --host it did not accept. Four routing-table entries naming commands that do not exist (cli, packages, versions, daemon) were removed; a test now keeps both routing tables to real command names.

• Cross-machine agents … --json fan-out caps each peer's stdout at 16 MiB instead of buffering it unbounded (RUSH-2065). The shared fan-out (gatherRemoteAgentsJson, behind agents sessions --active, agents feed, and every other fleet-wide JSON sweep) streamed each peer's output into memory with no ceiling, under one Promise.all — so a single peer returning a corrupt or pathologically large payload could retain ~170 MB and OOM the whole sweep. Each peer's capture now stops and SIGKILLs the connection once it would exceed the ceiling, treating that box as unreachable (reported in skipped) so the rest of the fleet still renders. The bound and the UTF-8-safe accumulator now live once in apps/cli/src/lib/ssh-exec.ts, shared with the agents sessions browse fan-out that already had the guard. Source: apps/cli/src/lib/remote-agents-json.ts, apps/cli/src/lib/ssh-exec.ts, apps/cli/src/lib/session/remote-list.ts.

• Auth-health probes once per account, not once per version home (RUSH-2111). The daemon's every-3-minute auth-health refresh fanned probeLocalFleetAuth over every installed version home at once, so a box with several Claude homes signed into one account fired that many concurrent requests at the same provider OAuth endpoint — racing its rate limit into a 429 that then parked the whole box's usage reads behind a Retry-After penalty (usage-backoff.ts survives that penalty; this removes its cause). Installs are now grouped by account and the live probe runs once per (agent, account), fanning the one verdict out to each home's per-version cache row. Homes with no resolvable account are still probed individually. Source: apps/cli/src/lib/auth-health.ts.

• Fallback-chain agents now receive their own active rules preset before dispatch (RUSH-2129). runWithFallback resolves each attempted entry's harness/version home and runs the same skip-fast preset synchronization as the primary agents run path, so a rate-limit handoff cannot launch against stale rules. Source: apps/cli/src/lib/exec.ts, apps/cli/src/lib/rules/run-sync.ts.

• Gemini hard-deprecation: routines daemon can no longer execute a legacy Gemini routine (RUSH-2202). RUSH-2060 gated agents add/import/sync/run/routines add against a hard-deprecated harness, but the routines daemon's own executor (runner.ts) had no equivalent gate — a Gemini routine written before RUSH-2060, or synced/edited on disk directly, would still fire and try to build a gemini … command against a backend Google retired. executeJob/executeJobDetached now reject a hard-deprecated agent up front, before any version/account resolution or sandbox prep, and record a failed run with the same deprecation message every other entry point already shows. Also removed the now-unreachable Gemini model-catalog extractor (models.ts), Factory's Gemini model-catalog fetch (agentModels.ts), and the dead Gemini sandbox-config writer (sandbox.ts/gemini-settings.ts — its generic JSON helpers stay, since Antigravity's permission writer reuses them), plus a stale profiles.md doc line still listing gemini as a live profile agent. Source: apps/cli/src/lib/runner.ts, apps/cli/src/lib/models.ts, apps/cli/src/lib/sandbox.ts, apps/cli/src/lib/gemini-settings.ts, apps/factory/src/core/agentModels.ts.

• Routine transcripts now archive as origin='routine' sessions (RUSH-2271). A Claude (and Codex) routine writes its transcript to the per-version CLAUDE_CONFIG_DIR / CODEX_HOME home, not the sandbox overlay the archiver scanned — so routine runs were indexed as ordinary origin='cli' sessions and never linked to their routine or run. archiveRoutineTranscripts now reads the same per-version home buildExecEnv writes to (re-pointed to each failover attempt's account as the chain advances), scoped by a pre-spawn baseline so it copies only that run's transcript out of the shared home, and agents sessions --routine shows them again. Kimi relocates too but its routine-archive discovery reader is a separate follow-up. Source: apps/cli/src/lib/runner.ts, apps/cli/src/lib/routines.ts.

• Release lease detects a holder killed from outside (RUSH-2274). An externally killed release (SIGKILL, a severed ssh, a rebooted box) left its lease on origin and scripts/release-lease.sh status read held for up to the 30-minute TTL with nothing actually releasing. The lease now records the holding host, pid, and that pid's start time, and status reports holder-alive=yes|no|unknown. A holder that is provably gone is reclaimed by the next claim immediately instead of waiting out the TTL, and a new release-lease.sh clear drops such a lease without starting a release. A live holder is never taken at any age, an unprobeable one (another box, or a lease from an older release) still falls back to the TTL, and a reused pid or an unreaped zombie counts as dead rather than as a live release. Source: apps/cli/scripts/release-lease.sh, apps/cli/scripts/release.sh.

• agents output and the session index no longer under-count Windows hosts (RUSH-2286). A Windows box could report zero token burn / zero sessions even when it was actively used, because two per-harness scanners in session/discover.ts failed on Windows: the OpenClaw scan gated on which openclaw, which is POSIX-only (which throws ENOENT on Windows, so the whole OpenClaw scan silently returned before indexing anything), and the Grok scanner recovered a session's version from summary.grok_home with a /-only regex that never matched a backslash-separated Windows path. The OpenClaw presence check now uses the cross-platform hasCommand, its openclaw invocations route through execFileShellSpec so a Windows .cmd/.ps1 shim actually launches, and the Grok version regex normalizes separators first. Separately, JSON relayed from a Windows peer over SSH (agents output --host <win> --json, agents sessions … --json) is now stripped of any PowerShell #< CLIXML banner before parsing (stripClixml in hosts/remote-cmd.ts), so a fleet-wide rollup that folds in a Windows box no longer drops it on a JSON.parse failure. The banner strip is applied at every remote---json boundary a Windows peer's output flows through: the remote-agents-json fan-out, the session remote-list list/payload/tool-search parsers, the --host fleet passthrough (agents view --host all), and agents output's per-device fetch. Source: apps/cli/src/lib/session/discover.ts, apps/cli/src/lib/hosts/remote-cmd.ts, apps/cli/src/lib/hosts/passthrough.ts, apps/cli/src/lib/remote-agents-json.ts, apps/cli/src/lib/session/remote-list.ts, apps/cli/src/commands/output.ts.

• agents output now reports the burn split and a --pricing no-cache scenario (RUSH-2287). The productivity rollup collapsed token burn into a single counter. It now breaks the burn into uncached input / cache-read / cache-write tokens wherever the harness records a per-message cache split (Claude, Codex, Gemini, Droid) — a burn split: line in the text report and the three counts on burn and every breakdown row in --json. New --pricing no-cache reprices cached tokens at the model's full input rate to model "what would this cost with caching off?"; the text report leads with that figure (breakdown column burn(nc)) while --json always carries both costUsd and costUsdNoCache so a dashboard can choose. The saving is surfaced in actual mode too (caching: actual $X vs no-cache $Y). Backed by four new session columns (input_tokens, cache_read_tokens, cache_write_tokens, cost_usd_nocache, schema v37) populated at scan time; pre-upgrade sessions show total-only until re-scanned. Source: apps/cli/src/commands/output.ts, apps/cli/src/lib/session/{db,discover}.ts, apps/cli/src/lib/pricing/cost.ts.

• Routine failures now reach the owner's phone, not just the local desktop (RUSH-2288). A failed/timeout routine finish, or a pre-spawn failure such as auth_failed, now also pings the owner over the same channel stack agents notify uses (the owner.channels in humans.yaml, or the legacy notify.owner), delivered in-process by the daemon — no shelling out to ssh mac-mini agents notify. This closes the gap where a failed scheduled routine on a headless fleet box was invisible, and specifically covers the auth_failed case the per-routine agents notify prompt can never send (its agent never spawned). If the primary owner channel cannot deliver from the box, the daemon walks the remaining configured channels as fallbacks (Telegram and intrusive/voice channels are excluded). Green routines of any kind stay silent, the existing desktop thresholds are unchanged, and delivery is deduped per job+runId. Source: apps/cli/src/lib/routine-notify-owner.ts, apps/cli/src/lib/daemon.ts.

• Add agents bench list, agents bench run, and agents bench results: benchmark cells fan out through the existing agents run path with isolated fixture copies, bounded concurrency, custom harness names, wall-time/exit/token capture, and durable JSON results under ~/.agents/.history/bench/ (RUSH-2302, RUSH-2303).

• New user quickstart: install, harnesses, teams, fleet. apps/cli/docs/QUICKSTART.md walks a fresh install through agents setup, adding and logging into harnesses, a minimal agents teams smoke test, and setting up a fleet (agents devices sync, agents devices set-interactive, agents apply) — linked from docs/README.md and the root README's Quickstart. Docs only — no runtime change. Source: apps/cli/docs/QUICKSTART.md, apps/cli/docs/README.md, README.md.

• agents insights detects agent silent stalls (model goes idle until you resume). When the assistant is last to speak and the next user message is ≥5 minutes later, facets count duration-bucketed silent stall: 5-15m / 15-60m / 1h+ friction signals; resume nudges (continue, keep going, …) after that silence also count as resume after silent stall. Report, actions, --narrative, and /sessions-insights instruct models to call these out (not reframe as "user was slow"). Extractor version bumped to 5 so cached facets recompute. Source: apps/cli/src/lib/session/insights.ts, commands/insights.ts, docs/06-observability.md.

• agents insights splits silent stalls by harness and model. The By-agent/account table now shows per-group stall and resume-nudge counts (so laziness is visible without --json). Stalls are also attributed to the model that last spoke (silentStallsByModel, "Silent stalls by model" section). Extractor version 6. Source: apps/cli/src/lib/session/insights.ts, commands/insights.ts.

• Redact Claude OAuth setup-tokens (sk-ant-oat01-…) from logs and exports, and reject a malformed one before it reaches the auth header (#1767). The log redactor masked API keys (sk-ant-api03-…) but not OAuth setup-tokens — the generic sk- rule can't reach an oat01 token because the hyphen after ant breaks its run — so a captured setup-token could leak verbatim into a run log or session export. resolveClaudeSetupToken also now validates the stored value: a corrupt auth bundle entry (e.g. a captured claude setup-token TTY banner+ANSI blob, the exact #1767 shape) is refused instead of being injected as CLAUDE_CODE_OAUTH_TOKEN → an invalid Authorization: Bearer header that crashes the run; the caller falls back to the normal login. Source: apps/cli/src/lib/redact.ts, apps/cli/src/lib/claude-account-token.ts.

• Stop the interactive host auto-reconnect spinning forever on a flapping link (#1884). A reattach only refills the retry budget now if it reached the host and held the remote pane for at least 10 seconds. Before, the budget refilled on the preflight probe alone, so a link that reconnected and dropped the user straight back out — or an attach that died at TTY negotiation every time — printed Reconnecting … (attempt 1/6) on every cycle forever and MAX_ATTEMPTS bounded nothing. A link that keeps dropping now spends the budget and gives up with a message that says so ("kept dropping again within 10 seconds of getting back in"), distinct from the unreachable-host "couldn't reconnect". A session that blinks all day and reconnects into a working pane each time is unaffected. Source: apps/cli/src/lib/hosts/reconnect.ts, docs/hosts.md.

• agents models claude no longer lists bare legacy ids that 404 (#1892). The native-binary id-scan fallback (scanClaudeCatalogIds, used when the curated maps come up empty) is now word-boundary anchored and matches the id body atomically, so it can't scrape a bare-major prefix (claude-sonnet-4) out of the binary's own dotted claude-sonnet-4.6 "Typo in model ID" troubleshooting string, out of a suffix-glued token (claude-opus-4-1x), or out of a token glued to a preceding identifier char. The existing dropBareLegacyIds sibling-drop still removes the standalone .includes("claude-opus-4") prefix-check artifacts; genuine bare currents (claude-sonnet-5) are kept. Catalog output is unchanged across all shipped Claude binaries. Source: apps/cli/src/lib/models.ts.

• Make ended-session focus open the correct recovery target (#2108). agents sessions focus <id> now reaps metadata-less dead tmux panes, proves the indexed transcript belongs to the exact active version home before native resume, launches Claude from the transcript's original project directory, and passes replacement-version /continue as an interactive positional prompt. Source: apps/cli/src/lib/session/recovery.ts, apps/cli/src/lib/tmux/session.ts, apps/cli/src/lib/exec.ts.

• The multi-install warning now inventories copies outside PATH and flags legacy installs that can corrupt the shared macOS helper bundle (#2147). Discovery covers NVM, fnm, Volta, Bun, common npm global prefixes, and npm's _npx cache in addition to resolving every agents entry on PATH. Dev installs are no longer hidden: a copy without the atomic app-bundle-install module is labelled unsafe legacy helper installer — remove this copy, because invoking it can still replace a live .app with a partial bundle. Source: apps/cli/src/lib/self-update.ts, apps/cli/src/index.ts.

• Newest signed agents-cli install owns the menu-bar helper (#2210). On multi-install Macs (e.g. Homebrew + nvm), a newer release now takes over the helper immediately and an older install can no longer reclaim or downgrade it. Equal-version foreign installs keep the existing owner; missing-helper, Developer-ID repair, and unversioned legacy cooldown behavior are unchanged. Source: apps/cli/src/lib/menubar/install-menubar.ts.

• Layered resource listing is ~40% faster. getActiveResourceProfile() read agents.yaml twice per call — once up front, then again inside getActiveResourceProfileName() — and listResources() calls it once per resolved resource, so a listing paid two memoized readMeta() round-trips (ensureAgentsDir() plus four stats each) for every entry. Reading it only after the profile name is known drops one of them. Measured on yosemite-s1 against the real ~/.agents: one pass over all eight resource kinds (135 entries) went 10.52 ms → 6.23 ms, and agents doctor --json spends ~243 ms in this path across 95 listings. No behavior change: the read count is never higher on any path and is unchanged whenever a profile name resolves — the one saved read is the up-front one that the if (!name) return null; guard now skips. The ensureAgentsDir() side effect is unchanged because getActiveResourceProfileName() always reaches readMeta(), via brand.ts listBrands() when a brand is set and via resource-profiles.ts otherwise. Source: apps/cli/src/lib/resource-profiles.ts.

• Routine session discovery now supports an interactive picker and fuzzy names (RUSH-1998). agents sessions --routine opens a routine picker on a TTY with each routine's last run, run count, and latest-run session count; the selected sessions are grouped by run ID and timestamp. --routine <name> accepts exact, substring, or unambiguous typo matches, and --routines is an alias for the same session filter.

• Secret leases now have one scoped, time-boxed domain model (RUSH-2254). A lease names one bundle, an explicit validated key subset, an absolute expiry, harness scope, and sleep-persistence posture. Durations use the broker's 1-minute to 30-day safety bounds, duplicate keys normalize once, unknown keys fail closed, and expired leases cannot project values. Source: apps/cli/src/lib/secrets/lease.ts.

• Fleet devices accept an explicit SSH private-key path (RUSH-2265). agents devices set <name> --auth key --identity-file <path> stores the path on that device and every shared SSH invocation passes it to OpenSSH with -i, so devices no longer depend on whichever key the ambient ssh agent happens to offer. Switching a device from password to key auth also removes stale password-bundle metadata from the registry.

• agents doctor diagnoses Windows OpenSSH public-key enrollment (RUSH-2266). On Windows it reads the effective AuthorizedKeysFile, selects the ProgramData administrator file or per-user profile file, verifies a public-key record is present, and checks that the administrator file grants FullControl to only SYSTEM and Administrators. The audit is read-only and never reads or prints private keys or passwords; fleet doctor forwards a locally authored summary and directs operators to run doctor on that box for details.

1.22.26

• Make bare agents setup a re-runnable onboarding hub with live capability status and direct access to browser, computer, secrets, fleet, share, watchdog, and preference wizards.

• agents apply --provision-secrets pushes the manifest's declared secrets bundles to each device, instead of only printing a reminder (RUSH-1968). This gap is a direct cause of the ticket: an operator who needed secrets on a worker box had no supported path — apply said "recreate manually" and nothing else — so they hand-exported the file store's master key across the fleet. The provisioning primitive now exists, and apply runs it as a fifth reconcile phase, last, because it is the most sensitive mutation apply performs.

  It is off by default and is a flag, not a manifest field: agents.yaml is shared, so a file-level default would mean someone else's apply -y silently ships credential values. Three gates, and every refusal still prints a needs-secret reminder so a skipped device is never silent — the flag must be set, the device must be reachable, and its host key must be pinned (the same bar agents exec --copy-creds sets, EXEC-34).

  Backend follows the platform: file on Linux, keychain on macOS/Windows. That is the load-bearing default — a headless Linux box has no keychain and its file store auto-provisions its OWN machine-local key, so each device gets an unshared at-rest key and no passphrase is forwarded. That is the direct alternative to the fleet-wide shared secret this ticket is about.

  With provisioning on, apply runs one extra agents secrets list --json per device (metadata only — names and timestamps, never values) and skips a bundle the device already has; without that, every run re-resolves the bundle locally and a resolve can prompt for Touch ID, so a converged fleet would nag on every apply. It compares presence, not content — --force re-pushes regardless. The --plan matrix gains a secrets column, shown only when the manifest declares bundles, and names the flag when the capability is available but off. Source: apps/cli/src/lib/secrets/push.ts (extracted from the export --host action so a lib no longer needs a command module), apps/cli/src/lib/fleet/apply.ts, apps/cli/src/commands/apply.ts.

• agents teams auto-scheduling is health-, harness-, and load-aware, and fails loud when no pool device can run the agent (RUSH-2002). Placing an unpinned teammate onto a --devices pool used to be a pure roster count that could land it on an unreachable box, an overloaded one, or one where its agent isn't installed. teams start now probes the pool once (reachability + load from the same snapshot agents devices shows, plus whether the teammate's agent is installed there) and: excludes unreachable / overloaded (loaded headroom) / agents.max-concurrent-capped / not-installed devices, then ranks the survivors by agent installed + signed in, then lower load, then fewer running teammates. If no pool device can run a pending teammate's agent, teams start fails loud — No device in the team pool can run [email protected]. Run 'agents devices ping' to see which devices have the agent installed + signed in. — instead of stranding the teammate or silently falling back to a local run; --force downgrades it to a warning. A probe that could not reach the pool does not trigger the failure (no false positives). The pick stays pure and fully unit-tested; teams add is unchanged (no probe on the add path). Source: apps/cli/src/lib/teams/scheduler.ts, apps/cli/src/lib/teams/placement-probe.ts, apps/cli/src/lib/teams/agents.ts, apps/cli/src/commands/teams.ts.

• agents reconnect [session-id] re-enters a dropped remote agent terminal, and the auto-reconnect no longer dead-ends on a dead pane (RUSH-2085). When the network dropped during agents run --device <box> and the peer's tmux pane was gone by the time the link came back, the reattach ran agents sessions focus <id> --local --attach-only, which hard-failed with No live session matching … and dropped the user at a bare shell with the id scrolled off screen. Two fixes: the auto-reconnect reattach now runs agents sessions focus <id> --local (no --attach-only), so a surviving pane is joined and a dead one RESUMES in place instead of dead-ending; and a new agents reconnect (also agents sessions reconnect) is the manual companion for after the auto-loop gave up or a VS Code terminal tab closed — attach the live pane if it survived, else resume the session. With no id it targets the most recent session started from the current directory (the terminal that most likely just dropped), not the full fleet picker. The exhausted / remote-exit notices now print the exact agents reconnect <id> command instead of a raw id and a shell prompt. Source: apps/cli/src/lib/hosts/reconnect.ts, apps/cli/src/commands/reconnect.ts.

• agents routines add now rejects an agent the local daemon can't fire, at add time (RUSH-2102). --agent opencode (or any real, installable agent outside the daemon's AGENT_COMMANDS table — currently claude, codex, gemini, cursor, kimi, droid, muse) used to pass validateJob because it only checked the agent against the full agent registry, not the daemon-runnable subset — the routine was written to disk and only failed once the scheduler fired it (Unsupported agent for daemon jobs: opencode). validateJob now rejects it immediately for the default local placement, with an error naming the supported agents. Routines placed with hostStrategy: host/fleet/cloud are unaffected — those dispatch through agents run/a cloud provider, not this table, so a wider agent set is legitimately supported there. Source: apps/cli/src/lib/routines.ts, apps/cli/src/lib/agents.ts.

• OpenClaw's capability table no longer claims hooks: true with zero hooks ever installed (RUSH-2122). registerHooksToSettings has no openclaw branch and silently returned { registered: [], errors: [] } for it, so agents sync openclaw reported success while installing nothing, and agents doctor treated the agent as hooks-capable with no way to detect the gap. OpenClaw only exposes a fixed set of internal, named hooks (e.g. boot-md, which runs BOOT.md on gateway restart) — there is no general event->shell-command registration surface an agents-cli hooks.yaml manifest could target — so capabilities.hooks and supportsHooks now read false, matching what the CLI can actually do. A new completeness test (hooks-capability-completeness.test.ts) pins every hooks: true agent to a real branch in registerHooksToSettings so a capability flip can never ship again without a registrar behind it. Source: apps/cli/src/lib/agents.ts, apps/cli/src/lib/hooks-capability-completeness.test.ts.

• agents browser stream keeps one Node process and browser-daemon IPC socket warm across repeated actions (RUSH-2149). The newline-delimited JSON interface sends every request through the existing browser daemon and its cached CDP connection, so screenshot/click loops no longer need a fresh agents process or IPC connection per action. --task (or AGENTS_BROWSER_TASK) supplies the default task, a start response becomes the default for later lines, and malformed input returns an error response without ending the stream. Fleet-remote start requests enforce the same device-local browser remote-control consent gate as the ordinary command. Source: apps/cli/src/lib/browser/ipc.ts, apps/cli/src/lib/browser/stream.ts, apps/cli/src/commands/browser.ts.

• agents sessions backfill tools reads a growing transcript incrementally, and the search index compacts itself (RUSH-2208). Incremental discovery already appended tool calls for a Claude/Codex session that grew; the backfill did not. Every ensureToolIndex pass re-read the transcript from byte 0 and deleted the session's stored evidence to rewrite it, so a session backfilled N times cost N full parses of an ever-larger file — measured on a 4.5 MiB, 4000-call transcript that grew by 20 calls: 344 ms and 4020 calls re-parsed, now 12 ms and 20 calls. Schema v36 adds a resume point to tool_scan_ledger (parsed_offset, the byte just past the last complete record consumed, and parser_state, the collector snapshot at that offset), so a transcript that only grew is read from where the last pass stopped and merged into what is already stored; the batch byte budget now counts the bytes a pass actually reads rather than the file's size, so one bounded batch covers far more growing sessions. A different extractor version, a mismatched ledger path, a file shorter than what was parsed, or an unreadable snapshot still re-reads the whole file. Two related fixes ride along: tool_call_text rows are addressed by the rowid of the call they describe instead of the UNINDEXED call_key, which made every delete a full scan of the FTS index, and the scan path now runs a bounded, threshold-gated FTS 'merge' after each batch of writes, so index health no longer depends on someone running agents sessions optimize by hand. Source: apps/cli/src/lib/session/tool-index.ts, apps/cli/src/lib/session/tool-store.ts, apps/cli/src/lib/session/db.ts.

• OpenCode session scans re-index only the sessions that changed (RUSH-2210). OpenCode keeps every session in one shared opencode.db, and the scanner stamped each session with that whole file's mtime/size. Any write to any session therefore invalidated every indexed session, so a single new turn re-emitted up to 1000 sessions — and the indexer re-opened opencode.db once per re-emitted session to re-parse a transcript that had not moved. Each session is now stamped with its own newest write time (across its session row, its messages, and its parts) and the byte length of its message + part payloads, so an unchanged session is skipped; the file-level stat stays only as the cheap "nothing changed at all" short-circuit, and a scan opens opencode.db once instead of once per session. The stamp deliberately does not rely on session.time_updated alone, which real databases leave hours behind the session's newest part. A side effect: sessions.file_size for an OpenCode row is now that session's payload size instead of the whole database's size, so the tool-backfill byte budget and its 16 MiB in-memory parser cap finally reflect the real cost of parsing that one session. Source: apps/cli/src/lib/session/discover.ts.

• Session query hot path is indexable again (RUSH-2211). The default agents sessions listing sort (ORDER BY IFNULL(last_activity, timestamp) DESC) wrapped the sort column in IFNULL(), which defeats idx_sessions_last_activity and forces a full table sort on every list/resume query; a new migration backfills last_activity so it's unconditionally NOT NULL and the sort now runs on the bare column (EXPLAIN QUERY PLAN confirms USING INDEX idx_sessions_last_activity). The post-query existence check now batches fs.existsSync per directory instead of one stat syscall per row — real transcript trees put many sessions in one project directory, so this collapses thousands of stats into a handful of readdirSync calls with the same result. Interactive label search (ftsSearch) no longer runs a leading-wildcard LOWER(label) LIKE '%q%' scan of the whole sessions table on every keystroke; it now queries the already-indexed FTS5 label column. Source: apps/cli/src/lib/session/db.ts.

• The standalone browser binary now routes --host/--device (RUSH-2214). browser start --host <box> dispatches to the remote over SSH, exactly like agents browser start --host <box> already did — previously the standalone bin dropped the flag with unknown option '--host' because it never entered the top-level router. A self-named or absent host still runs locally. Source: apps/cli/src/browser.ts, apps/cli/src/lib/hosts/passthrough.ts.

• agents run --device no longer reports a host as unreachable when the SSH probe times out (RUSH-2249). The ready probe (readyProbe in hosts/ready.ts) now disables SSH multiplexing so a stale control socket cannot hang the local client, and it checks r.timedOut before parsing stdout — a slow login shell (nvm/sdkman init, cold node startup) producing an empty stdout was silently treated as "not reachable". A timeout now surfaces a distinct, actionable error that names the cause and suggests agents ssh <host> agents view to confirm manually, rather than the misleading "not reachable over SSH" message. Source: apps/cli/src/lib/hosts/ready.ts.

• agents teams start nudges the operator toward feed milestones (RUSH-2250). After launching teammates, teams start now prints a one-line tip — teammates are briefed to post IMPORTANT milestones to the feed (watch them with agents feed timeline), and team progress is watched with agents teams status <team>. Print-only in both the single-wave and --watch paths (suppressed under --json); no engine behavior changes. Pairs with the .agents-system guidance that instructs teammates to post those milestones. Source: apps/cli/src/commands/teams.ts.

• secrets list no longer skips every biometry-ACL'd item, so hold/always-policy bundles are readable again (RUSH-2251). A regression first shipped in v1.22.10 added kSecUseAuthenticationUI: kSecUseAuthenticationUISkip to the keychain helper's list data-protection pass. UISkip makes SecItemCopyMatching silently omit every item protected by a biometry access control — which is exactly the value items set writes — so enumeration returned only the no-ACL metadata and never-policy items. Every consumer that builds its keychain read set from that enumeration (secrets exec/get/unlock/ view --reveal/export, agents run --secrets, ssh, browser, share) then reported the real secrets as stored item '…' not found, and unlock could not even warm the broker to work around it. The DP pass is now attributes-only with no kSecUseAuthenticationUI key: kSecReturnAttributes without kSecReturnData never evaluates the ACL, so it neither prompts for Touch ID nor filters the ACL'd items out — restoring the design the code comment already described. The RUSH-2233 timeout bound on that pass is unchanged. Source: apps/cli/src/lib/secrets/keychain-helper.swift.

• Hook-cache background refresh recovers from an orphaned single-flight lock (RUSH-2259). The stale-while-revalidate lock (<cache>.bg.lck) was only released by the background refresh's EXIT trap, so a hard kill (SIGKILL, OOM, reboot) that skipped the trap orphaned the dir and every future refresh's mkdir failed — permanently stalling background refresh while stale cache was served forever. The shim now reclaims a lock older than a 5-minute TTL before acquiring, so a dead lock self-heals on the next fire. Source: apps/cli/src/lib/hooks/cache.ts.

• agents doctor now fails loud when this box cannot reach the owner-delivery lane (RUSH-2262). The feed/notify owner lane (agents notify, agents feed post --level important / --blocked) delivers over the rush-backed owner channel (iMessage), which only works from a context that has rush on PATH and can read its keychain-bound session — so a headless Linux fleet box (no rush) or a non-GUI SSH session on a mac (login keychain locked) silently could not escalate a blocked agent, surfacing only as an after-the-fact owner failed: … line. agents doctor had no signal for it. A new critical finding, owner-sink-unreachable, probes the same transport from the same context doctor runs in (which rush + rush whoami, never ~/.rush/user.yaml, since the token is a keychain item) and reports owner → unreachable: rush CLI not on this box's PATH / rush has no usable session here with the fix. It fires only when owner delivery is configured for the fleet, so an un-opted-in box is never flagged; agents notify --dry-run is not this check (it short-circuits before the which rush preflight and reports success even where rush is absent). Source: apps/cli/src/lib/channels/owner-sink.ts, apps/cli/src/lib/devices/doctor-findings.ts, apps/cli/src/commands/doctor.ts.

• agents insights owns counter mix; agents trends is a deprecated alias. The former top-level trends tree (harness/model mix, tools-per-session, token ratios, secrets/browser recipes, raw usage query) now lives under agents insights mix and agents insights <recipe> / query / recipes. Bare agents insights remains the behavioural report (transcript content, account split). agents trends still works but prints one deprecation line and runs the same mix tree — no second implementation. Why: two peer "analytics" verbs (insights + trends) taught agents and humans to guess; one verb, two engines (content vs counters). Latency stays on agents perf; quota on agents usage; skill/slash popularity on agents sessions stats. Source: apps/cli/src/lib/analytics/mix-commands.ts, commands/insights.ts, commands/trends.ts, docs/06-observability.md.

• The keychain reaper no longer kills the auto-lock-on-sleep watcher (RUSH-2232 follow-up). The reaper (shipped in 1.22.23) classified a process as a reap target purely by the helper binary path, which also matches the broker's deliberately long-lived watch-lock watcher — a healthy child of the live daemon that wipes the in-memory secret store on sleep. Its class-(b) rule ("helper child of a live parent, older than 90s") therefore killed the watcher on its second sweep (~10 min after the daemon started hosting the broker), silently disabling auto-lock-on-sleep. Reap-eligibility now matches the full command line and excludes the watch-lock verb, so only the short-lived keychain reads/writes a wedged coreauthd can hang are ever reaped. Source: apps/cli/src/lib/secrets/reaper.ts (isReapableHelperCommand).