@phnx-labs/agents-cli 1.20.35 → 1.20.37

package/dist/lib/session/types.d.ts

@@ -46,6 +46,12 @@ export interface SessionMeta {
     shortId: string;
     agent: SessionAgentId;
     timestamp: string;
+    /**
+     * Last-activity time (ISO): the last message timestamp when a parser computed
+     * it, else file mtime, else `timestamp`. This is the recency signal the
+     * listing sorts and labels by; `timestamp` stays the creation time.
+     */
+    lastActivity?: string;
     project?: string;
     cwd?: string;
     filePath: string;
@@ -78,6 +84,23 @@ export interface SessionMeta {
      * `entrypoint` field ('sdk-cli' for team spawns, 'cli' for real sessions).
      */
     isTeamOrigin?: boolean;
+    /**
+     * The machine (normalized hostname) this session's transcript originated on:
+     * the local machine for live-home sessions, or the origin machine parsed from
+     * the cross-machine mirror path (backups/<agent>/<machine>/…, see
+     * sync/agents.ts). Populated by discoverSessions for the listing/picker;
+     * undefined for sessions obtained outside that path.
+     */
+    machine?: string;
+    /**
+     * True only for rows pulled from another machine over the live cross-machine
+     * fan-out (`remote-list.ts`) — their transcript is on that peer's disk, so
+     * reading/resuming has to hop back over SSH. Distinct from `machine`, which is
+     * also set on locally-readable synced mirrors: a mirror is machine-tagged but
+     * its `filePath` is a local path, so it must NOT be treated as remote. Set by
+     * `parseRemoteList`; transient (never persisted, stripped from --json).
+     */
+    _remote?: boolean;
     /** Terms that matched the current search query */
     _matchedTerms?: string[];
     /** BM25 relevance score from the most recent content-index search */

package/dist/lib/shims.d.ts

@@ -77,7 +77,7 @@ export interface ConflictInfo {
  *         top-level entry add/remove — deep edits to plugin contents won't
  *         trigger auto-resync, run `agents sync` for that.
  */
-export declare const SHIM_SCHEMA_VERSION = 21;
+export declare const SHIM_SCHEMA_VERSION = 22;
 /**
  * Generate the full bash shim script for the given agent. The returned string
  * is written to ~/.agents/shims/{cliCommand} and made executable.
@@ -134,8 +134,19 @@ export declare function removeShim(agent: AgentId): boolean;
  *        generic node_modules/.bin branch.
  *  v10 — guard grok's `command -v grok` fallback against resolving to our own
  *        shims dir (same infinite re-exec loop), mirroring droid.
- */
-export declare const VERSIONED_ALIAS_SCHEMA_VERSION = 10;
+ *  v11 — export DISABLE_AUTOUPDATER=1 for claude aliases so a pinned per-version
+ *        install can't self-mutate via Claude Code's background auto-updater.
+ *        Explicit user value wins.
+ *  v12 — Windows: stop writing the extensionless bash alias next to the `.cmd`
+ *        (and delete a lingering one). The version suffix contains dots, so
+ *        cmd.exe and PowerShell treat `claude@2.1.201` as a complete filename
+ *        with extension `.201`, exact-match the bash script AHEAD of PATHEXT
+ *        probing, and ShellExecute it to the `.sh` editor association — the
+ *        editor opens the script and the agent never launches. The `.cmd` is
+ *        now the only Windows artifact and carries this alias marker so
+ *        staleness checks read it directly.
+ */
+export declare const VERSIONED_ALIAS_SCHEMA_VERSION = 12;
 /**
  * Generate a versioned alias script that directly execs a specific version.
  * e.g., claude@2.0.65 -> directly runs that version's binary
@@ -157,20 +168,39 @@ export declare function isVersionedAliasCurrent(agent: AgentId, version: string)
  */
 export declare function ensureVersionedAliasCurrent(agent: AgentId, version: string): 'created' | 'updated' | 'current';
 /**
- * Get the filesystem path for a versioned alias script.
+ * Get the filesystem path for a versioned alias script — the logical
+ * (extensionless) launch name. On Windows this is not a real file (see
+ * versionedAliasOnDiskFile); stat/read checks must use the on-disk path.
  */
 export declare function getVersionedAliasPath(agent: AgentId, version: string): string;
+/**
+ * The file createVersionedAlias actually materializes for a platform:
+ * `<cmd>@<version>.cmd` on Windows, the bare bash script on POSIX. Pure —
+ * testable on any host. Mirrors onDiskShimFile for the main shim.
+ */
+export declare function versionedAliasOnDiskFile(cliCommand: string, version: string, platform: NodeJS.Platform): string;
 /**
  * Create a versioned alias for a specific agent version.
  * e.g., claude@2.0.65
+ *
+ * Same platform split as createShim (shimTargetsFor): POSIX writes the
+ * extensionless bash script; Windows writes ONLY the `.cmd`. Unlike the main
+ * shim — where the bash file was merely dead weight — a bash alias next to the
+ * versioned `.cmd` is actively harmful: the dotted version suffix makes
+ * cmd.exe/PowerShell treat `claude@2.1.201` as a complete filename (extension
+ * `.201`), so the exact match wins over PATHEXT probing and the shell
+ * ShellExecutes the bash script to the `.sh` editor association — the editor
+ * opens, the agent never launches. Any legacy bash alias is deleted here.
  */
 export declare function createVersionedAlias(agent: AgentId, version: string): string;
 /**
- * Remove a versioned alias for a specific agent version.
+ * Remove a versioned alias for a specific agent version. Removes whichever
+ * companions exist — the extensionless script (POSIX, or a legacy Windows
+ * install that wrote it) AND the `.cmd` (Windows) — mirroring removeShim.
  */
 export declare function removeVersionedAlias(agent: AgentId, version: string): boolean;
 /**
- * Check if a versioned alias exists.
+ * Check if a versioned alias exists (the on-disk artifact for this platform).
  */
 export declare function versionedAliasExists(agent: AgentId, version: string): boolean;
 /**

package/dist/lib/shims.js

@@ -208,7 +208,10 @@ async function promptConflictStrategy(conflictInfos) {
 //        re-exec-looped through `command -v kimi` (the dispatcher itself).
 // v21 — guard grok's `command -v grok` fallback against resolving to our own
 //        shims dir (same infinite re-exec loop), mirroring droid.
-export const SHIM_SCHEMA_VERSION = 21;
+// v22 — export DISABLE_AUTOUPDATER=1 for claude shims so a pinned per-version
+//        install can't self-mutate: Claude Code's background auto-updater would
+//        otherwise rewrite the pinned binary in place. Explicit user value wins.
+export const SHIM_SCHEMA_VERSION = 22;
 /** Internal marker string used to embed the schema version in shim scripts. */
 const SHIM_VERSION_MARKER = 'agents-shim-version:';
 function shellQuote(value) {
@@ -236,6 +239,10 @@ export function generateShimScript(agent) {
 # selected version's config directory so switching versions also switches the
 # live Claude account.
 export CLAUDE_CONFIG_DIR="$VERSION_DIR/home/${configDirName}"
+# Managed installs are pinned in a per-version dir; Claude Code's background
+# auto-updater would rewrite the pinned binary in place. Disable it so a pin
+# stays a pin. An explicit user value always wins.
+export DISABLE_AUTOUPDATER="\${DISABLE_AUTOUPDATER:-1}"
 # On Linux sandboxes (no keychain), fall back to a per-version token file.
 # The env var always wins if already set; no-op on macOS.
 if [ "\$(uname -s)" = "Linux" ] && [ -z "\${CLAUDE_CODE_OAUTH_TOKEN:-}" ] && [ -f "\$CLAUDE_CONFIG_DIR/.oauth_token" ]; then
@@ -580,12 +587,18 @@ export function createShim(agent) {
  * `cliCommand@version` for a versioned alias. node + the dist entrypoint are
  * resolved at generation time so the launcher does not depend on `agents`
  * already being on PATH.
+ *
+ * `extraMarkerLines` lets callers stamp additional schema markers into the
+ * header — versioned aliases embed their own alias-schema marker so
+ * readVersionedAliasSchemaVersion can stat the `.cmd` (the only Windows
+ * artifact) the same way it reads the bash script on POSIX.
  */
-function writeWindowsCmdShim(cmdPath, spec) {
+function writeWindowsCmdShim(cmdPath, spec, extraMarkerLines = []) {
     const indexJs = getAgentsBinForGeneratedShim();
     const content = `@echo off\r\n` +
         `rem Auto-generated by agents-cli - do not edit\r\n` +
         `rem ${SHIM_VERSION_MARKER} ${SHIM_SCHEMA_VERSION}\r\n` +
+        extraMarkerLines.map((line) => `rem ${line}\r\n`).join('') +
         `node "${indexJs}" __shim ${spec} %*\r\n`;
     fs.writeFileSync(cmdPath, content);
 }
@@ -640,8 +653,19 @@ export function removeShim(agent) {
  *        generic node_modules/.bin branch.
  *  v10 — guard grok's `command -v grok` fallback against resolving to our own
  *        shims dir (same infinite re-exec loop), mirroring droid.
+ *  v11 — export DISABLE_AUTOUPDATER=1 for claude aliases so a pinned per-version
+ *        install can't self-mutate via Claude Code's background auto-updater.
+ *        Explicit user value wins.
+ *  v12 — Windows: stop writing the extensionless bash alias next to the `.cmd`
+ *        (and delete a lingering one). The version suffix contains dots, so
+ *        cmd.exe and PowerShell treat `claude@2.1.201` as a complete filename
+ *        with extension `.201`, exact-match the bash script AHEAD of PATHEXT
+ *        probing, and ShellExecute it to the `.sh` editor association — the
+ *        editor opens the script and the agent never launches. The `.cmd` is
+ *        now the only Windows artifact and carries this alias marker so
+ *        staleness checks read it directly.
  */
-export const VERSIONED_ALIAS_SCHEMA_VERSION = 10;
+export const VERSIONED_ALIAS_SCHEMA_VERSION = 12;
 /** Internal marker string used to embed the schema version in versioned alias scripts. */
 const VERSIONED_ALIAS_VERSION_MARKER = 'agents-versioned-alias-version:';
 // The version string is interpolated into a generated bash script and into
@@ -669,6 +693,10 @@ export function generateVersionedAliasScript(agent, version) {
 # Claude stores OAuth credentials in the macOS keychain. Scope them to this
 # version's config directory so direct aliases also switch the live account.
 export CLAUDE_CONFIG_DIR="$HOME/.agents/.history/versions/${agent}/${version}/home/${configDirName}"
+# Managed installs are pinned in a per-version dir; Claude Code's background
+# auto-updater would rewrite the pinned binary in place. Disable it so a pin
+# stays a pin. An explicit user value always wins.
+export DISABLE_AUTOUPDATER="\${DISABLE_AUTOUPDATER:-1}"
 `
         : agent === 'codex'
             ? `
@@ -765,7 +793,7 @@ exec "$BINARY"${launchArgs} "$@"
  * alias doesn't exist or is a pre-v2 alias (no marker — treated as stale).
  */
 export function readVersionedAliasSchemaVersion(agent, version) {
-    const aliasPath = getVersionedAliasPath(agent, version);
+    const aliasPath = versionedAliasOnDiskPath(agent, version);
     if (!fs.existsSync(aliasPath))
         return null;
     try {
@@ -792,11 +820,19 @@ export function isVersionedAliasCurrent(agent, version) {
  * was upgraded.
  */
 export function ensureVersionedAliasCurrent(agent, version) {
-    const aliasPath = getVersionedAliasPath(agent, version);
-    if (!fs.existsSync(aliasPath)) {
+    if (!fs.existsSync(versionedAliasOnDiskPath(agent, version))) {
         createVersionedAlias(agent, version);
         return 'created';
     }
+    // A lingering extensionless bash alias on Windows shadows the `.cmd` in both
+    // cmd.exe and PowerShell (the dotted version reads as a file extension, and
+    // an exact filename match beats PATHEXT probing), ShellExecuting the bash
+    // script to the `.sh` editor association instead of launching the agent.
+    // Regenerate regardless of the `.cmd`'s stamp so the shadow gets deleted.
+    if (shimTargetsFor(process.platform).cmd && fs.existsSync(getVersionedAliasPath(agent, version))) {
+        createVersionedAlias(agent, version);
+        return 'updated';
+    }
     // Upgrade-only (newest-wins), same rationale as ensureShimCurrent: never
     // downgrade an alias stamped by a newer install sharing the shims dir.
     const onDisk = readVersionedAliasSchemaVersion(agent, version);
@@ -807,14 +843,38 @@ export function ensureVersionedAliasCurrent(agent, version) {
     return 'current';
 }
 /**
- * Get the filesystem path for a versioned alias script.
+ * Get the filesystem path for a versioned alias script — the logical
+ * (extensionless) launch name. On Windows this is not a real file (see
+ * versionedAliasOnDiskFile); stat/read checks must use the on-disk path.
  */
 export function getVersionedAliasPath(agent, version) {
     return path.join(getShimsDir(), `${AGENTS[agent].cliCommand}@${version}`);
 }
+/**
+ * The file createVersionedAlias actually materializes for a platform:
+ * `<cmd>@<version>.cmd` on Windows, the bare bash script on POSIX. Pure —
+ * testable on any host. Mirrors onDiskShimFile for the main shim.
+ */
+export function versionedAliasOnDiskFile(cliCommand, version, platform) {
+    const name = `${cliCommand}@${version}`;
+    return shimTargetsFor(platform).cmd ? `${name}.cmd` : name;
+}
+/** The on-disk versioned-alias path for the current platform. */
+function versionedAliasOnDiskPath(agent, version) {
+    return path.join(getShimsDir(), versionedAliasOnDiskFile(AGENTS[agent].cliCommand, version, process.platform));
+}
 /**
  * Create a versioned alias for a specific agent version.
  * e.g., claude@2.0.65
+ *
+ * Same platform split as createShim (shimTargetsFor): POSIX writes the
+ * extensionless bash script; Windows writes ONLY the `.cmd`. Unlike the main
+ * shim — where the bash file was merely dead weight — a bash alias next to the
+ * versioned `.cmd` is actively harmful: the dotted version suffix makes
+ * cmd.exe/PowerShell treat `claude@2.1.201` as a complete filename (extension
+ * `.201`), so the exact match wins over PATHEXT probing and the shell
+ * ShellExecutes the bash script to the `.sh` editor association — the editor
+ * opens, the agent never launches. Any legacy bash alias is deleted here.
  */
 export function createVersionedAlias(agent, version) {
     assertSafeVersion(version);
@@ -822,40 +882,42 @@ export function createVersionedAlias(agent, version) {
     const shimsDir = getShimsDir();
     const agentConfig = AGENTS[agent];
     const aliasPath = path.join(shimsDir, `${agentConfig.cliCommand}@${version}`);
-    const script = generateVersionedAliasScript(agent, version);
-    fs.writeFileSync(aliasPath, script, { mode: 0o755 });
-    if (IS_WINDOWS) {
-        writeWindowsCmdShim(aliasPath + '.cmd', `${agentConfig.cliCommand}@${version}`);
+    const targets = shimTargetsFor(process.platform);
+    if (targets.bash) {
+        fs.writeFileSync(aliasPath, generateVersionedAliasScript(agent, version), { mode: 0o755 });
+    }
+    else {
+        try {
+            fs.unlinkSync(aliasPath);
+        }
+        catch { }
+    }
+    if (targets.cmd) {
+        writeWindowsCmdShim(aliasPath + '.cmd', `${agentConfig.cliCommand}@${version}`, [`${VERSIONED_ALIAS_VERSION_MARKER} ${VERSIONED_ALIAS_SCHEMA_VERSION}`]);
     }
     return aliasPath;
 }
 /**
- * Remove a versioned alias for a specific agent version.
+ * Remove a versioned alias for a specific agent version. Removes whichever
+ * companions exist — the extensionless script (POSIX, or a legacy Windows
+ * install that wrote it) AND the `.cmd` (Windows) — mirroring removeShim.
  */
 export function removeVersionedAlias(agent, version) {
-    const shimsDir = getShimsDir();
-    const agentConfig = AGENTS[agent];
-    const aliasPath = path.join(shimsDir, `${agentConfig.cliCommand}@${version}`);
-    if (fs.existsSync(aliasPath)) {
-        fs.unlinkSync(aliasPath);
-        if (IS_WINDOWS) {
-            try {
-                fs.unlinkSync(aliasPath + '.cmd');
-            }
-            catch { }
+    const aliasPath = getVersionedAliasPath(agent, version);
+    let removed = false;
+    for (const p of [aliasPath, aliasPath + '.cmd']) {
+        if (fs.existsSync(p)) {
+            fs.unlinkSync(p);
+            removed = true;
         }
-        return true;
     }
-    return false;
+    return removed;
 }
 /**
- * Check if a versioned alias exists.
+ * Check if a versioned alias exists (the on-disk artifact for this platform).
  */
 export function versionedAliasExists(agent, version) {
-    const shimsDir = getShimsDir();
-    const agentConfig = AGENTS[agent];
-    const aliasPath = path.join(shimsDir, `${agentConfig.cliCommand}@${version}`);
-    return fs.existsSync(aliasPath);
+    return fs.existsSync(versionedAliasOnDiskPath(agent, version));
 }
 /**
  * Get the path to the agent's config directory in HOME.

package/dist/lib/ssh-exec.js

@@ -103,6 +103,7 @@ export function sshExec(target, remoteCmd, opts = {}) {
         encoding: 'utf-8',
         timeout: opts.timeoutMs,
         stdio: ['pipe', 'pipe', 'pipe'],
+        windowsHide: true,
     });
     const timedOut = !!(res.error && res.error.code === 'ETIMEDOUT');
     return {
@@ -128,6 +129,7 @@ export function sshExecRaw(target, remoteCmd, opts = {}) {
         // No `encoding` → spawnSync returns Buffers.
         timeout: opts.timeoutMs,
         stdio: ['pipe', 'pipe', 'pipe'],
+        windowsHide: true,
     });
     const timedOut = !!(res.error && res.error.code === 'ETIMEDOUT');
     return {

package/dist/lib/ssh-tunnel.js

@@ -23,6 +23,7 @@ import * as path from 'path';
 import { fileURLToPath } from 'url';
 import { randomBytes } from 'crypto';
 import { sshExec, SSH_OPTS } from './ssh-exec.js';
+import { backgroundSpawnOptions } from './platform/process.js';
 import { encodePowerShell } from './browser/drivers/ssh.js';
 import { getDevice } from './devices/registry.js';
 import { sshTargetFor } from './devices/connect.js';
@@ -56,7 +57,7 @@ export function startSSHTunnel(user, host, localPort, remotePort, opts = {}) {
         const args = buildTunnelArgs(user, host, localPort, remotePort);
         const tunnel = spawn('ssh', args, {
             stdio: opts.detached ? 'ignore' : ['ignore', 'ignore', 'pipe'],
-            detached: Boolean(opts.detached),
+            ...(opts.detached ? backgroundSpawnOptions() : { detached: false, windowsHide: true }),
         });
         let stderr = '';
         tunnel.stderr?.on('data', (data) => {

package/dist/lib/startup/command-registry.d.ts

@@ -49,6 +49,7 @@ export declare const loadPrune: ModuleLoader;
 export declare const loadTrash: ModuleLoader;
 export declare const loadRestore: ModuleLoader;
 export declare const loadDoctor: ModuleLoader;
+export declare const loadCheck: ModuleLoader;
 export declare const loadStatus: ModuleLoader;
 export declare const loadProfiles: ModuleLoader;
 export declare const loadSecrets: ModuleLoader;
@@ -57,6 +58,7 @@ export declare const loadHelper: ModuleLoader;
 export declare const loadMenubar: ModuleLoader;
 export declare const loadBeta: ModuleLoader;
 export declare const loadSync: ModuleLoader;
+export declare const loadLock: ModuleLoader;
 export declare const loadRefreshRules: ModuleLoader;
 export declare const loadDrive: ModuleLoader;
 export declare const loadFactory: ModuleLoader;
@@ -66,6 +68,7 @@ export declare const loadBudget: ModuleLoader;
 export declare const loadAlias: ModuleLoader;
 export declare const loadPty: ModuleLoader;
 export declare const loadTmux: ModuleLoader;
+export declare const loadWatchdog: ModuleLoader;
 export declare const loadBrowser: ModuleLoader;
 export declare const loadComputer: ModuleLoader;
 export declare const loadHosts: ModuleLoader;
@@ -79,6 +82,9 @@ export declare const loadSetup: ModuleLoader;
 export declare const loadSessions: ModuleLoader;
 export declare const loadTeams: ModuleLoader;
 export declare const loadCloud: ModuleLoader;
+export declare const loadMessage: ModuleLoader;
+export declare const loadServe: ModuleLoader;
+export declare const loadAudit: ModuleLoader;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help

package/dist/lib/startup/command-registry.js

@@ -27,6 +27,7 @@ export const loadPrune = async () => (await import('../../commands/prune.js')).r
 export const loadTrash = async () => (await import('../../commands/trash.js')).registerTrashCommands;
 export const loadRestore = async () => (await import('../../commands/trash.js')).registerRestoreCommand;
 export const loadDoctor = async () => (await import('../../commands/doctor.js')).registerDoctorCommand;
+export const loadCheck = async () => (await import('../../commands/check.js')).registerCheckCommand;
 export const loadStatus = async () => (await import('../../commands/status.js')).registerStatusCommand;
 export const loadProfiles = async () => (await import('../../commands/profiles.js')).registerProfilesCommands;
 export const loadSecrets = async () => (await import('../../commands/secrets.js')).registerSecretsCommands;
@@ -35,6 +36,7 @@ export const loadHelper = async () => (await import('../../commands/helper.js'))
 export const loadMenubar = async () => (await import('../../commands/menubar.js')).registerMenubarCommands;
 export const loadBeta = async () => (await import('../../commands/beta.js')).registerBetaCommands;
 export const loadSync = async () => (await import('../../commands/sync.js')).registerSyncCommand;
+export const loadLock = async () => (await import('../../commands/lock.js')).registerLockCommand;
 export const loadRefreshRules = async () => (await import('../../commands/refresh-rules.js')).registerRefreshRulesCommand;
 export const loadDrive = async () => (await import('../../commands/drive.js')).registerDriveCommands;
 export const loadFactory = async () => (await import('../../commands/factory.js')).registerFactoryCommands;
@@ -44,6 +46,7 @@ export const loadBudget = async () => (await import('../../commands/budget.js'))
 export const loadAlias = async () => (await import('../../commands/alias.js')).registerAliasCommand;
 export const loadPty = async () => (await import('../../commands/pty.js')).registerPtyCommands;
 export const loadTmux = async () => (await import('../../commands/tmux.js')).registerTmuxCommands;
+export const loadWatchdog = async () => (await import('../../commands/watchdog.js')).registerWatchdogCommand;
 export const loadBrowser = async () => (await import('../../commands/browser.js')).registerBrowserCommand;
 export const loadComputer = async () => (await import('../../commands/computer.js')).registerComputerCommand;
 export const loadHosts = async () => (await import('../../commands/hosts.js')).registerHostsCommand;
@@ -57,6 +60,9 @@ export const loadSetup = async () => (await import('../../commands/setup.js')).r
 export const loadSessions = async () => (await import('../../commands/sessions.js')).registerSessionsCommands;
 export const loadTeams = async () => (await import('../../commands/teams.js')).registerTeamsCommands;
 export const loadCloud = async () => (await import('../../commands/cloud.js')).registerCloudCommands;
+export const loadMessage = async () => (await import('../../commands/message.js')).registerMessageCommand;
+export const loadServe = async () => (await import('../../commands/serve.js')).registerServeCommand;
+export const loadAudit = async () => (await import('../../commands/audit.js')).registerAuditCommands;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help
@@ -64,7 +70,7 @@ export const loadCloud = async () => (await import('../../commands/cloud.js')).r
  * inherit the root's custom help formatter rather than getting the per-command
  * recursive pass. Keeping that ordering preserves their `--help` output exactly.
  */
-export const LAZY_COMMAND_NAMES = new Set(['sessions', 'teams', 'cloud']);
+export const LAZY_COMMAND_NAMES = new Set(['sessions', 'teams', 'cloud', 'message', 'serve']);
 /**
  * User-typed top-level command name -> ordered list of module loaders to run.
  *
@@ -113,6 +119,7 @@ export const COMMAND_LOADERS = {
     trash: [loadTrash],
     restore: [loadRestore],
     doctor: [loadDoctor],
+    check: [loadCheck],
     status: [loadStatus],
     profiles: [loadProfiles],
     secrets: [loadSecrets],
@@ -121,6 +128,7 @@ export const COMMAND_LOADERS = {
     menubar: [loadMenubar],
     beta: [loadBeta],
     sync: [loadSync],
+    lock: [loadLock],
     'refresh-rules': [loadRefreshRules],
     drive: [loadDrive],
     factory: [loadFactory],
@@ -130,6 +138,7 @@ export const COMMAND_LOADERS = {
     alias: [loadAlias],
     pty: [loadPty],
     tmux: [loadTmux],
+    watchdog: [loadWatchdog],
     browser: [loadBrowser],
     computer: [loadComputer],
     hosts: [loadHosts],
@@ -144,4 +153,7 @@ export const COMMAND_LOADERS = {
     sessions: [loadSessions],
     teams: [loadTeams],
     cloud: [loadCloud],
+    message: [loadMessage],
+    serve: [loadServe],
+    audit: [loadAudit],
 };

package/dist/lib/state.d.ts

@@ -120,6 +120,8 @@ export declare function getRoutinesDir(): string;
 export declare function getProjectRoutinesDir(cwd?: string): string | null;
 /** Path to routine execution logs (~/.agents/.history/runs/). */
 export declare function getRunsDir(): string;
+/** Root for per-agent mailboxes (~/.agents/.history/mailbox/). */
+export declare function getMailboxRootDir(): string;
 /** Path to installed agent CLI binaries (~/.agents/.history/versions/). */
 export declare function getVersionsDir(): string;
 /** Path to version-switching shim scripts (~/.agents/.cache/shims/). */
@@ -226,6 +228,17 @@ export declare function getEnabledExtraRepos(): Array<{
 export declare function ensureAgentsDir(): void;
 /** Return an empty Meta object used when no agents.yaml exists yet. */
 export declare function createDefaultMeta(): Meta;
+/**
+ * Per-device machine-local version pins — `~/.agents/devices/<machine>/agents.yaml`.
+ * Committed and synced, but each machine only ever writes its OWN folder, so
+ * pulls never conflict. `<machine>` = machineId() (Tailscale-aligned short name).
+ */
+export declare function getDeviceMetaPath(): string;
+/**
+ * Machine-local per-version resource tracking — `~/.agents/.history/version-resources.json`.
+ * Gitignored (under .history/) and regenerable; never synced.
+ */
+export declare function getVersionResourcesPath(): string;
 /**
  * Read and cache ~/.agents/agents.yaml, migrating from legacy locations if needed.
  *

package/dist/lib/state.js

@@ -28,6 +28,7 @@ import * as os from 'os';
 import * as yaml from 'yaml';
 import { ensureLockTarget, atomicWriteFileSync, withFileLock } from './fs-atomic.js';
 import { SEEDED_REGISTRIES } from './types.js';
+import { machineId } from './machine-id.js';
 const HOME = process.env.HOME ?? os.homedir();
 /**
  * Compare two filesystem paths for identity, resolving symlinks and (on
@@ -87,6 +88,7 @@ const RUNS_DIR = path.join(HISTORY_DIR, 'runs');
 const TEAMS_AGENTS_DIR = path.join(HISTORY_DIR, 'teams', 'agents');
 const BACKUPS_DIR = path.join(HISTORY_DIR, 'backups');
 const TRASH_DIR = path.join(HISTORY_DIR, 'trash');
+const MAILBOX_DIR = path.join(HISTORY_DIR, 'mailbox');
 // Cache bucket (regenerable).
 const SHIMS_DIR = path.join(CACHE_DIR, 'shims');
 const HOOK_SHIMS_DIR = path.join(SHIMS_DIR, 'hooks');
@@ -309,6 +311,8 @@ export function getProjectRoutinesDir(cwd = process.cwd()) {
 }
 /** Path to routine execution logs (~/.agents/.history/runs/). */
 export function getRunsDir() { return RUNS_DIR; }
+/** Root for per-agent mailboxes (~/.agents/.history/mailbox/). */
+export function getMailboxRootDir() { return MAILBOX_DIR; }
 /** Path to installed agent CLI binaries (~/.agents/.history/versions/). */
 export function getVersionsDir() { return VERSIONS_DIR; }
 /** Path to version-switching shim scripts (~/.agents/.cache/shims/). */
@@ -495,13 +499,37 @@ function safeMtimeMs(filePath) {
         return 0;
     }
 }
-/** Compute the combined cache stamp for the user + system agents.yaml files. */
+/**
+ * Per-device machine-local version pins — `~/.agents/devices/<machine>/agents.yaml`.
+ * Committed and synced, but each machine only ever writes its OWN folder, so
+ * pulls never conflict. `<machine>` = machineId() (Tailscale-aligned short name).
+ */
+export function getDeviceMetaPath() {
+    return path.join(USER_AGENTS_DIR, 'devices', machineId(), 'agents.yaml');
+}
+/**
+ * Machine-local per-version resource tracking — `~/.agents/.history/version-resources.json`.
+ * Gitignored (under .history/) and regenerable; never synced.
+ */
+export function getVersionResourcesPath() {
+    return path.join(HISTORY_DIR, 'version-resources.json');
+}
+/**
+ * Combined cache stamp across all four Meta sources: central + system
+ * agents.yaml, this machine's device pins, and the version-resources tracking.
+ * A delimited string, NOT a numeric sum — summing down-scaled epoch-ms values
+ * loses precision (float64 rounds sub-unit terms away at ~1.75e12), so a change
+ * in any one file must contribute at full resolution.
+ */
 function currentMetaStamp() {
-    return safeMtimeMs(META_FILE) + safeMtimeMs(SYSTEM_META_FILE) * 1e-3;
+    return safeMtimeMs(META_FILE)
+        + '|' + safeMtimeMs(SYSTEM_META_FILE)
+        + '|' + safeMtimeMs(getDeviceMetaPath())
+        + '|' + safeMtimeMs(getVersionResourcesPath());
 }
 /** Memoize a parsed Meta against the current file mtimes. */
 function rememberMeta(meta) {
-    metaCache = { mtime: currentMetaStamp(), meta };
+    metaCache = { stamp: currentMetaStamp(), meta };
     return meta;
 }
 function withMetaLock(fn) {
@@ -526,11 +554,78 @@ function withMetaLock(fn) {
         }
     });
 }
+/** Atomic write only when the on-disk content differs — avoids needless mtime
+ * bumps (which would thrash the meta cache) on no-op field routing. */
+function writeIfChanged(filePath, content) {
+    let current = null;
+    try {
+        current = fs.readFileSync(filePath, 'utf-8');
+    }
+    catch { /* absent */ }
+    if (current === content)
+        return;
+    atomicWriteFileSync(filePath, content);
+}
+/**
+ * Partition the in-memory Meta across three files by sync-domain:
+ *   - central  `~/.agents/agents.yaml`             — portable, everything else
+ *   - device   `~/.agents/devices/<machine>/agents.yaml` — `agents:` pins (per-device)
+ *   - history  `~/.agents/.history/version-resources.json` — `versions:` (machine-local)
+ * All callers funnel through writeMeta → here, so nothing else changes. Empty
+ * `agents:` / `versions:` are not written (no empty committed files).
+ */
 function writeMetaUnlocked(meta) {
-    const content = META_HEADER + yaml.stringify(meta);
-    atomicWriteFileSync(META_FILE, content);
+    const { agents, versions, ...central } = meta;
+    // Write the machine-local files FIRST, then strip central — so a crash mid-write
+    // never removes pins/versions from central before they're persisted elsewhere.
+    const devicePath = getDeviceMetaPath();
+    if (agents && Object.keys(agents).length > 0) {
+        fs.mkdirSync(path.dirname(devicePath), { recursive: true });
+        writeIfChanged(devicePath, META_HEADER + yaml.stringify({ agents }));
+    }
+    else if (fs.existsSync(devicePath)) {
+        // Every pin was cleared. Persist the emptied map instead of skipping the
+        // write — otherwise the stale device file survives and overlayMachineLocal
+        // re-applies the removed pin on the next read, leaving a dangling default
+        // (e.g. a launcher pointing at a version that was just uninstalled).
+        writeIfChanged(devicePath, META_HEADER + yaml.stringify({ agents: {} }));
+    }
+    if (versions && Object.keys(versions).length > 0) {
+        const vrPath = getVersionResourcesPath();
+        fs.mkdirSync(path.dirname(vrPath), { recursive: true });
+        writeIfChanged(vrPath, JSON.stringify(versions, null, 2) + '\n');
+    }
+    writeIfChanged(META_FILE, META_HEADER + yaml.stringify(central));
     metaCache = null;
 }
+/**
+ * Overlay this machine's local state onto a central-portable Meta:
+ *   - `agents:` from the device file (device wins; the union both preserves the
+ *     one-level merge and self-heals a pre-migration central that still has pins)
+ *   - `versions:` from the history JSON (wholesale replace; falls back to
+ *     whatever central carried when the history file doesn't exist yet)
+ */
+function overlayMachineLocal(meta) {
+    const devicePath = getDeviceMetaPath();
+    if (fs.existsSync(devicePath)) {
+        try {
+            const dm = yaml.parse(fs.readFileSync(devicePath, 'utf-8'));
+            if (dm?.agents)
+                meta.agents = { ...meta.agents, ...dm.agents };
+        }
+        catch { /* ignore malformed device file */ }
+    }
+    const vrPath = getVersionResourcesPath();
+    if (fs.existsSync(vrPath)) {
+        try {
+            const vr = JSON.parse(fs.readFileSync(vrPath, 'utf-8'));
+            if (vr)
+                meta.versions = vr;
+        }
+        catch { /* ignore malformed history file */ }
+    }
+    return meta;
+}
 function applyRegistrySeeds(meta) {
     const seeded = new Set(meta.seededPresets || []);
     let changed = false;
@@ -590,10 +685,7 @@ export function readMeta() {
     // what we last parsed. Reduces N readMeta calls per CLI invocation to ~2 stat
     // syscalls plus an in-memory object spread.
     if (metaCache) {
-        const userMtime = safeMtimeMs(META_FILE);
-        const systemMtime = safeMtimeMs(SYSTEM_META_FILE);
-        const stamp = userMtime + systemMtime * 1e-3;
-        if (stamp === metaCache.mtime) {
+        if (currentMetaStamp() === metaCache.stamp) {
             return metaCache.meta;
         }
     }
@@ -666,6 +758,7 @@ export function readMeta() {
                 ...userMeta?.registries,
             };
         }
+        overlayMachineLocal(meta);
         if (applyRegistrySeeds(meta)) {
             writeMeta(meta);
             return rememberMeta(meta);
@@ -673,6 +766,7 @@ export function readMeta() {
         return rememberMeta(meta);
     }
     const meta = createDefaultMeta();
+    overlayMachineLocal(meta);
     if (applyRegistrySeeds(meta)) {
         writeMeta(meta);
     }