@phnx-labs/agents-cli 1.20.42 → 1.20.44

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 1.20.44
+
+- **Every `logs` command is concise by default; the token-heavy raw dump is now opt-in behind `--full`.** Agents that spin up agents on other machines or add teammates were pulling whole transcripts just to glance at status — `agents logs <session>` printed the full markdown transcript, and `agents hosts logs` / `agents teams logs` / `agents routines logs` each `cat`'d their entire captured stdout, because each subsystem had hand-rolled its own "cat the log" verb over its own storage. All four now default to a bounded, concise view, with `-m/--full` for the raw log: `agents logs <session>` renders the same summary digest as `agents sessions <id>` (a real session shrank 92% — 29.9 KB → 2.6 KB); `agents routines logs <name>` shows a status header + the extracted report (a real run shrank 99.5% — 386 KB → 1.8 KB), falling back to a bounded stdout tail when no report was extracted; `agents teams logs <teammate>` renders the teammate's session summary (its agentId **is** the session id), with `-n <lines>` / `--full` for raw stdout; `agents hosts logs <id>` shows a bounded tail of the captured stdout (`tailLines`, with a "… N earlier lines hidden — pass --full" note) instead of the whole log. `renderSessionLog` now takes a mode and defaults to `'summary'`; `agents sessions <id>` was already summary-by-default and is unchanged. Regression-tested: `tailLines` truncation/elision math (`hosts/logs.test.ts`) and `formatRunDuration` human-time formatting (`routines-logs.test.ts`). Source: `apps/cli/src/commands/{logs,sessions,hosts,teams,routines}.ts`, `apps/cli/src/lib/hosts/logs.ts`. Scoped follow-up (not in this PR): host-task and sandboxed-routine runs write their real transcript on the remote / in an overlay HOME, so `logs` can't yet resolve them to the full `renderSummary` — making those runs discoverable is a separate change; until then the bounded tail / extracted report is the safe concise default.
+- **The daemon now self-heals the `pane-died` hook on already-running `agents run` sessions.** The v1.20.42 fix that stops exiting a split from kicking you out of tmux is installed once, at session creation — so sessions already alive under the long-lived shared tmux server keep the old, unconditional `detach-client` hook until they exit or the server is recycled. On a machine that's never "between sessions," that meant hand-repairing live sessions. The daemon now runs `reconcileSessionHooks()` ~20s after startup and every ~5 min: it walks the managed `ag-` sessions on the shared socket and retrofits the `#{hook_pane}`-guarded hook onto any whose hook predates the current schema. It is strictly **non-destructive — `set-hook` only, never a `kill-pane` or `detach-client`** — so it is safe to run against sessions you're attached to; a per-session `@ag_hook_schema` marker makes steady-state a no-op. The hook string is now built in one place (`agentPaneDiedHook`) shared by the spawn-wrap and the reconcile so they can't drift. Source: `apps/cli/src/lib/tmux/session.ts`, `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/exec.ts`.
+- **NEW: `agents run` self-heals a gutted install instead of crashing with `ENOENT`.** The recurring failure: an npm agent whose native binary ships as an optional per-arch dependency (codex → `@openai/codex-<platform>`) can have that tarball extract **partially** — the platform package's `package.json` lands, its `vendor/<triple>/…/codex` binary does not (an interrupted or concurrently-raced `agents add` into the same version dir). The CLI's wrapper `require.resolve`s the platform package, finds the `package.json`, and sails straight past its own "missing optional dependency" guard into a `spawn(binaryPath)` that dies with a raw `ENOENT`. `agents run` now probes the version it's about to launch and, if the binary can't run, **repairs it in place** (a *clean* reinstall — the partial `node_modules` is wiped first, because npm treats the present-but-gutted platform package as already installed and would otherwise skip re-fetching it), then falls back to another installed version that launches (re-pinning it as the default so the shim path heals too), then to installing `latest` — only erroring if nothing can be made runnable. `installVersion` gained a `{ clean }` option for the wipe-then-reinstall. Source: `apps/cli/src/lib/versions.ts` (`ensureAgentRunnable`), `apps/cli/src/commands/exec.ts`.
+- **Fix: a broken agent install no longer launches into a silent `[detached]` — the real crash is surfaced.** When an interactive `ag run <agent>` wrapped the agent in tmux and the agent died the instant it spawned (e.g. a gutted install crashing with `spawn … ENOENT`, a bad flag, a startup crash), the `pane-died` hook detached the client before you could read anything — you got a bare `[detached (from session …)]` with zero indication of why. `runInTmux` now recaps the dead pane's last output (read from scrollback via `capture-pane -S -200`, since the pane's visible screen is just the "Pane is dead" banner) plus the exit code to stderr, and points you at `--no-tmux`. Fast failures (dead before attach) always recap; a post-attach nonzero exit recaps too (a clean exit or a manual detach stays quiet). Source: `apps/cli/src/lib/exec.ts`, `apps/cli/src/lib/tmux/session.test.ts`.
+- **NEW: `--no-tmux` / `--disable-tmux` on `agents run`.** The interactive tmux wrapper (which gives `%pane` addressing + re-attach) already had an opt-out, but it was hidden behind the opaquely-named `--raw`. `--no-tmux` (and its alias `--disable-tmux`) spawn the agent directly with full stdio inherited — the fastest way to see an agent's real startup output when a launch is failing. Same effect as `--raw` and `AGENTS_NO_TMUX=1`. Source: `apps/cli/src/commands/exec.ts`.
+- **Fix: `agents add <agent>@<version>` no longer records a gutted install as healthy (root cause of the ENOENT crash + a broken default pin).** npm packages that ship their native binary via an optional per-arch dependency (e.g. codex → `@openai/codex-<platform>`) can land the JS wrapper at `node_modules/.bin/<cli>` while the real platform binary is missing (interrupted install, omitted optional dep, `--ignore-scripts`). `getBinaryPath()` only checked the wrapper, so the broken version read as installed, got pinned as the default, and got picked to run — then died with ENOENT. `installVersion` now probes `<binary> --version` (under the version's isolated HOME) after install and **fails the install** if the binary can't launch, so a broken version is never silently pinned. The check is deliberately narrow — only the missing-binary signature (`ENOENT`/"no such file"/"command not found") fails it; a plain nonzero exit or a timeout is treated as healthy, so a well-behaved agent that dislikes `--version` is never false-failed. Source: `apps/cli/src/lib/versions.ts`, `apps/cli/src/lib/versions-integrity.test.ts`.
+- **Security fix: the routines daemon log no longer leaks GitHub / AWS / npm tokens.** `daemon.ts` carried its own private `redactSecrets` (used by every `log()` write to `logs.jsonl`) that predated and diverged from the canonical `redact.ts` — it caught `sk-`, `eyJ…`, `Bearer …`, and a narrow `NAME=value` list, but **not** `ghp_` (GitHub PAT), `AKIA…` (AWS access key), or `npm_` (npm token), so any of those appearing in a daemon message (a git push URL, a bundle-env dump, an error string) was written to the log in the clear. The private copy is deleted; `log()` now routes through the canonical `redactSecrets` in `redact.ts`, which covers all of those classes with a stronger quote-aware `NAME=value` pattern. The one pattern the daemon copy had and the canonical lacked — `Bearer <token>` — is added to `redact.ts`, so the shared redactor (also used by session-transcript export in `session/render.ts`) is now a strict superset. New `redact.test.ts` pins every token class as a regression guard. Source: `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/redact.ts`, `apps/cli/src/lib/redact.test.ts`.
+
+## 1.20.43
+
+- **NEW: `agents run --name <slug>` — a durable, human/agent-friendly handle for any run.** An agent that dispatches another agent had no cheap status handle: the host-task id was never even printed (the `--no-follow` tip showed a literal `<id>` placeholder), and only Claude's session id is known up front (pre-minted `--session-id`) — every other agent's id is discovered later by scanning transcripts, so callers fell back to `agents logs`, which dumps the raw, token-heavy transcript. `--name` is chosen at launch, agent-agnostic, and stored on the structures that already back these views: a first-class `name` column on `sessions.db` (schema v9, additive, no rescan) parallel to `label` — `agents sessions <ref>` resolves against **both** name and label; the HostTask sidecar (forwarded to the remote run, so `agents hosts ps` gains a NAME column and `agents hosts logs <name>` resolves by name); and a run-name sidecar (`~/.agents/.cache/run-names/`) that joins a local run's name onto the index by id every scan via `syncNames` — the same idempotent pattern as `/rename` label sync. The `name` column is deliberately left out of the upsert `ON CONFLICT … SET` clause, so a discovery rescan can never null an existing name (regression-tested in `db.names.test.ts`). Omitting `--name` is a strict no-op: `name` stays unset and every id-based path is unchanged. The `--no-follow` dispatch tip now prints the real handle and steers to the compact `agents sessions` digest over the raw log. Source: `apps/cli/src/commands/exec.ts`, `apps/cli/src/lib/session/{db,run-names,discover}.ts`, `apps/cli/src/lib/hosts/{dispatch,tasks}.ts`.
+- **New terminals (and teammates) no longer launch into a rate-limited account; `balanced` is now the default run strategy.** Two coupled fixes. (1) A bare `agents run <agent>` — every new agent terminal the extension spawns, and every non-version-pinned `agents teams add`/`start` teammate, since both route through bare `agents run` — used to default to the `available` strategy, which *prefers the pinned default version when it looks healthy*. But "healthy" was judged by the router's `getRoutingUsedPercent`, which **excluded the 5-hour session window** and looked at weekly usage only. So a session-maxed account with weekly headroom (e.g. session 100% / week 60%) was deemed eligible and kept getting launched — while `agents view` showed it "rate-limited" (its badge, `deriveUsageStatusFromSnapshot`, *counts* the session window). The router and the badge disagreed. Now `hasUsageAvailable` shares the badge's exact signal: an account maxed on **any** blocking window (session or weekly) is ineligible and skipped by both `available` and `balanced` — you never spin up an agent on an account that can't serve the next request. Capacity *weighting* still ranks eligible accounts by weekly headroom, so a brief session spike doesn't distort long-run routing. (2) The default strategy is now `balanced` (was `available`): a bare run spreads load across all healthy accounts by remaining headroom instead of sticking to the pinned default. Override per-workspace with `run.<agent>.strategy` in `agents.yaml`, or per-invocation with `--strategy` / `-b`. Source: `apps/cli/src/lib/rotate.ts`, `apps/cli/src/lib/usage.ts`, `apps/cli/src/commands/exec.ts`.
+- **[browser] Logins survive browser restarts: sandboxed profiles keep memory-only session cookies, without restoring tabs.** Sites that issue login cookies with `expires=-1` (idealista, many banking/classifieds sites) logged the profile out on every browser restart, because Chromium purges memory-only session cookies at startup unless the session-restore preference is set — a constraint that had already leaked into agent designs as "sessions can't survive restarts". Every launch now pins `session.restore_on_startup: 1` ("continue where you left off") in the profile's `Default/Preferences`, which is the switch Chromium's cookie purge actually keys off — and pairs it with `--no-startup-window` so the *visible* side of restore never happens: no window exists at startup for restore to fill, no ghost tabs from the last task reopen, and the task flow creates its own tab over CDP exactly as before. Verified live on Windows/Comet: a memory-only cookie planted pre-restart was still present after a full stop/start, with OS-level window enumeration confirming a single window and zero restored tabs. The Preferences patch runs pre-spawn (browser down, so Chromium can't overwrite it on exit), stamps the profile name only on first launch, skips malformed files untouched, and is a no-op when already set. Electron profiles keep the old name-only seeding — they manage their own storage and need their startup window (the CDP driver binds to it). Bare `agents browser start` (no `--url`) recreates the old startup-window affordance by opening a blank page target when none exists, unregistered on the task like the startup window always was. Server-side session TTLs still apply — this removes the restart logout, not the site's own expiry. Source: `apps/cli/src/lib/browser/chrome.ts` (`ensureProfilePreferences`, launch args), `apps/cli/src/lib/browser/service.ts`.
+- **Security fix: `agents sessions --host <target>` no longer accepts a leading-dash target (SSH argv-flag smuggling).** `session/remote.ts` carried its own copy of `assertValidSshTarget` that omitted the `host.startsWith('-')` guard every other SSH path enforces, so a bare flag like `-l` or `-F/path` — which passes the character allowlist — was handed straight to `ssh` as an argument (`-oProxyCommand=…`-class injection) before any connection. The duplicate validator (and its `SSH_TARGET_RE`) is deleted; `runRemoteSessions` now routes through the canonical `assertValidSshTarget` in `ssh-exec.ts`, whose dash guard is already regression-tested (`ssh-exec.test.ts`). Source: `apps/cli/src/lib/session/remote.ts`.
+
 ## 1.20.42
 
 - **Fix: exiting a split pane inside an interactive `ag run` session kicked you out of tmux entirely.** When you split the window of an interactive agent session (`ag run claude`) with Ctrl-b `"`/`%` and then `exit`ed *your* split, the whole tmux client detached and dumped you back to the parent shell — even though the agent was still running in the other pane. Cause: `runInTmux` installed a session-wide `pane-died` hook (`detach-client`) meant to fire only when the AGENT pane exits (so the attach returns and the exit status is read), but with no `#{hook_pane}` guard it fired for *any* pane's death. The hook is now scoped to the agent pane; a user split that exits is closed in place (`kill-pane`, no lingering dead husk) and the agent keeps running full-window. Source: `apps/cli/src/lib/exec.ts`, `apps/cli/src/lib/tmux/session.test.ts`.

package/README.md

@@ -243,7 +243,8 @@ agents hosts check gpu-box              # reachable? which agents-cli version?
 
 # Run there instead of locally
 agents run claude --host gpu-box "profile this build"   # follows live by default
-agents logs --host gpu-box              # pick a dispatched run and view its log
+agents logs --host gpu-box              # pick a dispatched run — concise summary by default
+agents logs <id> --full                 # the full raw transcript / stdout (token-heavy)
 agents logs <id> -f                     # re-attach to a running one and follow
 agents view claude --host gpu-box       # inspect the remote install
 agents sync --host gpu-box              # make the remote machine current
@@ -274,7 +275,7 @@ agents teams start auth-feature     # Fires teammates whose deps are done
 agents teams status auth-feature    # Who's working, what they changed, what they said
 ```
 
-Teammates run detached -- close your terminal, they keep working. Check in with `teams status`, read full output with `teams logs <name>`, clean up with `teams disband`.
+Teammates run detached -- close your terminal, they keep working. Check in with `teams status`, glance at a teammate's summary with `teams logs <name>` (add `--full` for the raw output), clean up with `teams disband`.
 
 Team state is observable via `agents teams list --json` / `agents teams status --json` (compact by default; add `--verbose` for the full per-teammate shape). External tools join it with `sessions --json` (teammates get `isTeamOrigin: true`) and `cloud list --json` (for `--cloud` teammates) to build a unified fleet view. See [docs/06-observability.md](docs/06-observability.md).
 
@@ -534,7 +535,7 @@ agents routines add daily-digest \
 
 agents routines list                   # All jobs + next run times
 agents routines run daily-digest       # Test it now, ignore the schedule
-agents routines logs daily-digest      # Check last execution
+agents routines logs daily-digest      # Last execution — status + report (add --full for raw stdout)
 ```
 
 Jobs run sandboxed -- agents only see directories and tools you explicitly allow.

package/dist/commands/exec.js

@@ -218,12 +218,15 @@ export function registerRunCommand(program) {
         .option('-i, --interactive', 'Force interactive mode even when a prompt is provided. Mutually exclusive with --headless.')
         .option('--resume [id]', 'Resume a previous conversation. Accepts a full or partial session id (prefix-matched against the index); omit the id to pick from recent sessions interactively. Resumes under the version that started the session. claude/codex resume natively; other agents replay via a /continue first message. Pair with a prompt to continue headlessly.')
         .option('--session-id <id>', 'Force a NEW conversation to use this exact session UUID (Claude only). This CREATES a session — to resume an existing one, use --resume.')
+        .option('--name <slug>', 'Give the run a durable name — a stable handle you can check on later with `agents sessions <name>` (and `agents hosts logs <name>` for --host runs), instead of an opaque id. Optional; omitting it keeps today\'s id-only behavior.')
         .option('--verbose', 'Show detailed execution logs')
         .option('--raw', 'Interactive runs on macOS/Linux launch inside a shared tmux session (for %pane addressing + re-attach). Pass --raw to spawn the agent directly instead. Also disabled by AGENTS_NO_TMUX=1.')
+        .option('--no-tmux', 'Spawn the agent directly instead of wrapping it in the shared tmux session. Same effect as --raw / AGENTS_NO_TMUX=1. Use this to see the agent\'s full startup output when a launch is failing.')
+        .option('--disable-tmux', 'Alias for --no-tmux.')
         .option('--timeout <duration>', 'Kill the agent after this duration (e.g., 30m, 1h, 2h30m)')
         .option('--fallback <agents>', 'Comma-separated agents to try on rate-limit failure. Each entry accepts an optional @version pin (e.g., codex@0.116.0,gemini). The primary runs first; if it exits with a rate-limit error, the next agent picks up via /continue handoff.')
         .option('-b, --balanced', 'Shortcut for --strategy balanced. Ignored when @version is pinned.')
-        .option('--strategy <strategy>', 'Version/account selection strategy: pinned | available | balanced. Defaults to run.<agent>.strategy, then pinned. (Legacy `rotate` accepted as alias for `balanced`.)')
+        .option('--strategy <strategy>', 'Version/account selection strategy: pinned | available | balanced. Defaults to run.<agent>.strategy, then balanced (spreads load across healthy accounts and skips any that are rate-limited). (Legacy `rotate` accepted as alias for `balanced`.)')
         .option('--acp', 'Route through the Agent Client Protocol instead of direct exec. Supported for gemini, claude (via @zed-industries/claude-code-acp adapter). Unified event stream; emits ndjson when --json.')
         .option('-y, --yes', 'Skip the interactive budget-confirm prompt (require_confirm_over). Never skips a hard budget block.', false)
         .option('--loop', 'Re-inject the prompt/entrypoint each iteration until a stop condition (issue #332). Guards (--max-iterations, --budget, --until) are enforced outside the agent. Writes a checkpoint after every iteration for --resume-checkpoint.')
@@ -275,9 +278,10 @@ export function registerRunCommand(program) {
         Legacy 'full' is silently rewritten to 'skip'.
 
       Run strategy (set via --strategy or run.<agent>.strategy in agents.yaml):
-        pinned     use the workspace/global pinned version (default)
-        available  use pinned if usage available; otherwise switch to another signed-in version
-        balanced   distribute load across healthy accounts by remaining capacity
+        pinned     use the workspace/global pinned version
+        available  use pinned if it can run right now; otherwise switch to another signed-in version
+        balanced   distribute load across healthy accounts by remaining capacity (default)
+        A version/account is skipped when it is rate-limited right now — any usage window (incl. the 5-hour session window) at 100%, matching the 'agents view' badge.
         --balanced is shorthand for --strategy balanced. Ignored when @version is pinned, when a profile is used, or with --fallback.
 
       Fallback: --fallback codex,gemini retries on rate-limit failure via /continue handoff. Each entry accepts @version.
@@ -404,15 +408,22 @@ export function registerRunCommand(program) {
                     model: options.model,
                     remoteCwd: options.remoteCwd,
                     sessionId: hostSessionId,
+                    name: options.name,
                     resume: resumeId,
                     follow: options.follow !== false,
                 });
                 // Register the dispatched run in the LOCAL session index so it shows
-                // up in `agents sessions` and resolves by id, even though its
+                // up in `agents sessions` and resolves by id/name, even though its
                 // transcript lives on the host. No-op when no session id was captured.
                 registerHostSession(task, { cwd: process.cwd(), prompt });
                 if (options.follow === false) {
-                    console.log(chalk.green(`Dispatched to ${host.name}.`) + chalk.gray(' Track: agents hosts ps · Follow: agents hosts logs <id> -f'));
+                    // The handle the caller uses to check on the run: the name if given,
+                    // else the real host-task id (never the old literal `<id>`). Steer
+                    // to the compact `agents sessions` digest over the raw log first.
+                    const handle = task.name ?? task.id;
+                    console.log(chalk.green(`Dispatched to ${host.name}${task.name ? ` as "${task.name}"` : ''}.`) + '\n' +
+                        chalk.gray(`  Status:  agents sessions ${handle}`) + chalk.gray('   (compact digest — use this)') + '\n' +
+                        chalk.gray(`  Raw log: agents hosts logs ${handle} -f`) + chalk.gray('   (heavy, only if needed)'));
                     process.exit(0);
                 }
                 // -1 = the follow window closed but the run continues on the host (the
@@ -516,7 +527,7 @@ export function registerRunCommand(program) {
             });
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, defaultModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, defaultModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
@@ -924,6 +935,29 @@ export function registerRunCommand(program) {
                 }
             }
         }
+        // Self-heal the launch target. A gutted install (JS wrapper present,
+        // native binary missing — a partial/raced npm extraction of the optional
+        // per-arch dependency) would otherwise spawn and die with a raw ENOENT
+        // inside the agent's own wrapper. Repair it in place (or fall back to a
+        // runnable version, re-pinning it) BEFORE we build the launch command.
+        // Skipped for headless resume-native/acp/loop paths only if it errored;
+        // here it runs for every normal dispatch. Best-effort log to stderr.
+        {
+            const launchTarget = version ?? resolveVersion(agent, cwd) ?? undefined;
+            if (launchTarget) {
+                const healed = await ensureAgentRunnable(agent, launchTarget, options.quiet ? undefined : (m) => process.stderr.write(chalk.yellow(`[agents] ${m}\n`)));
+                if (healed === null) {
+                    console.error(chalk.red(`agents: ${agent}@${launchTarget} is not runnable and could not be repaired. Try: agents add ${agent}@latest`));
+                    process.exit(1);
+                }
+                // Always adopt the healed version explicitly. In the version-undefined
+                // path a fallback re-pins the GLOBAL default, but `resolveVersion`
+                // prefers a PROJECT pin — so leaving `version` undefined would let the
+                // shim re-resolve the still-broken project pin and crash anyway. Pinning
+                // the runnable version here is a no-op when nothing changed.
+                version = healed;
+            }
+        }
         const defaultVersion = version ?? resolveVersion(agent, cwd);
         const runDefaults = fromProfile
             ? { sources: {} }
@@ -1062,9 +1096,13 @@ export function registerRunCommand(program) {
             json: options.json,
             headless: options.headless,
             sessionId: resumeSessionId ?? options.sessionId,
+            name: options.name,
             resume: resumeNative,
             verbose: options.verbose,
-            raw: options.raw,
+            // --raw, --no-tmux (commander negation → options.tmux === false), and
+            // --disable-tmux all bypass the interactive tmux wrapper. AGENTS_NO_TMUX=1
+            // does the same via the env check in exec.ts.
+            raw: options.raw || options.tmux === false || options.disableTmux === true,
             timeout: options.timeout,
             env,
             toolsRestrict: workflowToolsRestrict,

package/dist/commands/hosts.js

@@ -15,7 +15,7 @@ import { sshTargetFor } from '../lib/hosts/types.js';
 import { listSshConfigHosts, listKnownHosts, isSshConfigHost } from '../lib/hosts/ssh-config.js';
 import { probeHost, remoteAgentsVersion, bootstrapAgentsCli, localCliVersion, } from '../lib/hosts/ready.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
-import { listTasks } from '../lib/hosts/tasks.js';
+import { listTasks, loadTask, findTaskByName, findTaskBySessionId } from '../lib/hosts/tasks.js';
 import { reconcileRunningTasks } from '../lib/hosts/reconcile.js';
 import { showHostTaskLog } from '../lib/hosts/logs.js';
 /** Parse `user@host` or `host` into its pieces. */
@@ -179,18 +179,22 @@ async function doPs(json) {
         return;
     }
     const cols = terminalWidth();
-    console.log(chalk.bold('ID').padEnd(11) + chalk.bold('HOST').padEnd(16) + chalk.bold('AGENT').padEnd(10) + chalk.bold('STATUS').padEnd(11) + chalk.bold('PROMPT'));
+    console.log(chalk.bold('ID').padEnd(11) + chalk.bold('NAME').padEnd(16) + chalk.bold('HOST').padEnd(16) + chalk.bold('AGENT').padEnd(10) + chalk.bold('STATUS').padEnd(11) + chalk.bold('PROMPT'));
     for (const t of tasks) {
         const status = t.status === 'completed' ? chalk.green(t.status) : t.status === 'failed' ? chalk.red(t.status) : chalk.yellow(t.status);
+        const nameCol = truncateToWidth(t.name ?? chalk.gray('-'), 15).padEnd(16);
         // Prompt fills the remaining width instead of a fixed 50-char byte slice (98-char rows).
-        const promptCol = truncateToWidth(t.prompt, Math.max(12, cols - (11 + 16 + 10 + 11)));
-        console.log(t.id.padEnd(11) + t.host.padEnd(16) + t.agent.padEnd(10) + status.padEnd(11) + promptCol);
+        const promptCol = truncateToWidth(t.prompt, Math.max(12, cols - (11 + 16 + 16 + 10 + 11)));
+        console.log(t.id.padEnd(11) + nameCol + t.host.padEnd(16) + t.agent.padEnd(10) + status.padEnd(11) + promptCol);
     }
 }
-async function doLogs(id, follow) {
-    const res = await showHostTaskLog(id, follow);
+async function doLogs(ref, follow, full) {
+    // Resolve the ref as a task id first, then fall back to a `--name` handle so
+    // `agents hosts logs <name>` works, not just the opaque id.
+    const id = loadTask(ref) ? ref : (findTaskByName(ref)?.id ?? findTaskBySessionId(ref)?.id ?? ref);
+    const res = await showHostTaskLog(id, follow, full);
     if (!res.found) {
-        console.log(chalk.red(`Unknown task "${id}".`));
+        console.log(chalk.red(`Unknown task "${ref}".`));
         process.exitCode = 1;
         return;
     }
@@ -231,7 +235,8 @@ export function registerHostsCommand(program) {
         .action((opts) => doPs(!!opts.json));
     hosts
         .command('logs <id>')
-        .description('Show a host task log; -f to follow a running one.')
+        .description('Show a host task’s concise summary; --full for the raw log, -f to follow a running one.')
         .option('-f, --follow', 'Follow live output')
-        .action((id, opts) => doLogs(id, !!opts.follow));
+        .option('-m, --full', 'Show the full raw combined-stdout log instead of the concise summary')
+        .action((id, opts) => doLogs(id, !!opts.follow, !!opts.full));
 }

package/dist/commands/logs.d.ts

@@ -5,6 +5,10 @@
  *  - host-dispatch tasks (`agents run --host`) → combined-stdout log, offset-tailed
  *  - sessions (the local index) → transcript, tailed via the sessions tailer
  *
+ * Concise by default: a bare `agents logs <id>` prints the same summary digest as
+ * `agents sessions <id>` — cheap for an agent to glance at. The token-heavy full
+ * transcript / raw stdout is opt-in behind `--full` (alias `-m/--markdown`).
+ *
  * `[id]`/`--session` load directly (host task tried first, then session). With no
  * id, `--host`/`--agent`/`--version` filter a merged candidate list; one match is
  * shown, several open the fuzzy picker (or, non-TTY, print the list).

package/dist/commands/logs.js

@@ -5,6 +5,10 @@
  *  - host-dispatch tasks (`agents run --host`) → combined-stdout log, offset-tailed
  *  - sessions (the local index) → transcript, tailed via the sessions tailer
  *
+ * Concise by default: a bare `agents logs <id>` prints the same summary digest as
+ * `agents sessions <id>` — cheap for an agent to glance at. The token-heavy full
+ * transcript / raw stdout is opt-in behind `--full` (alias `-m/--markdown`).
+ *
  * `[id]`/`--session` load directly (host task tried first, then session). With no
  * id, `--host`/`--agent`/`--version` filter a merged candidate list; one match is
  * shown, several open the fuzzy picker (or, non-TTY, print the list).
@@ -33,8 +37,8 @@ function candidateLabel(c) {
     const title = s.label || s.topic || '';
     return `${chalk.gray('sess')} ${s.shortId.padEnd(9)} ${(s.agent + ver).padEnd(14)} ${chalk.gray(s.timestamp.slice(0, 16))}  ${title.slice(0, 40)}`;
 }
-/** Show a resolved session — follow (tail) or render its transcript. */
-async function showSession(session, follow) {
+/** Show a resolved session — follow (tail), concise summary, or (`full`) transcript. */
+async function showSession(session, follow, full) {
     if (follow) {
         if (!isTailable(session.agent)) {
             console.error(chalk.red(`Tailing is supported for claude and codex sessions only (got ${session.agent}).`));
@@ -43,20 +47,20 @@ async function showSession(session, follow) {
         await streamSessionTail(session, {});
         return;
     }
-    await renderSessionLog(session);
+    await renderSessionLog(session, full ? 'markdown' : 'summary');
 }
-async function showCandidate(c, follow) {
+async function showCandidate(c, follow, full) {
     if (c.kind === 'task') {
-        const res = await showHostTaskLog(c.task.id, follow);
+        const res = await showHostTaskLog(c.task.id, follow, full);
         if (res.exitCode !== undefined)
             process.exitCode = res.exitCode;
         return;
     }
-    await showSession(c.session, follow);
+    await showSession(c.session, follow, full);
 }
 /** Resolve an explicit id/--session: host task first, then a session. */
-async function showById(id, follow) {
-    const hostRes = await showHostTaskLog(id, follow);
+async function showById(id, follow, full) {
+    const hostRes = await showHostTaskLog(id, follow, full);
     if (hostRes.found) {
         if (hostRes.exitCode !== undefined)
             process.exitCode = hostRes.exitCode;
@@ -68,13 +72,14 @@ async function showById(id, follow) {
         console.error(chalk.red(`No run or session found matching "${id}".`));
         process.exit(1);
     }
-    await showSession(matches[0], follow);
+    await showSession(matches[0], follow, full);
 }
 async function runLogs(id, opts) {
     const follow = !!opts.follow;
+    const full = !!opts.full;
     const directId = opts.session ?? id;
     if (directId) {
-        await showById(directId, follow);
+        await showById(directId, follow, full);
         return;
     }
     const { agent, version } = parseAgentFilter(opts.agent);
@@ -99,7 +104,7 @@ async function runLogs(id, opts) {
         process.exit(1);
     }
     if (candidates.length === 1) {
-        await showCandidate(candidates[0], follow);
+        await showCandidate(candidates[0], follow, full);
         return;
     }
     // Multiple sessions matched → picker if interactive, else a list to pick from.
@@ -123,17 +128,18 @@ async function runLogs(id, opts) {
     });
     if (!picked)
         return;
-    await showCandidate(picked.item, follow);
+    await showCandidate(picked.item, follow, full);
 }
 /** Register the top-level `agents logs` command. */
 export function registerLogsCommand(program) {
     program
         .command('logs [id]')
-        .description('Show a run’s log — a host-dispatch task or a session. -f to follow a live one.')
+        .description('Show a run’s concise summary — a host-dispatch task or a session. --full for the raw transcript, -f to follow a live one.')
         .option('--host <name>', 'Scope to runs dispatched to a host')
         .option('-a, --agent <agent>', 'Filter by agent (e.g. claude, codex@0.116.0)')
         .option('--version <version>', 'Filter by agent version')
         .option('--session <id>', 'Select a session/run by id (same as the positional id)')
         .option('-f, --follow', 'Follow live output')
+        .option('-m, --full', 'Show the full raw transcript / stdout instead of the concise summary')
         .action((id, opts) => runLogs(id, opts));
 }

package/dist/commands/routines.d.ts

@@ -6,5 +6,11 @@
  * Also exposes scheduler lifecycle controls (start/stop/status/logs).
  */
 import type { Command } from 'commander';
+/**
+ * Human-friendly wall-clock a run took (e.g. "  · 3 min", "  · 45 sec"), or ""
+ * when it hasn't completed or timestamps are unparseable. Leading separator lets
+ * callers drop it straight into a status line.
+ */
+export declare function formatRunDuration(startedAt: string, completedAt: string | null): string;
 /** Register the `agents routines` command tree. */
 export declare function registerRoutinesCommands(program: Command): void;

package/dist/commands/routines.js

@@ -22,6 +22,27 @@ import { JobScheduler } from '../lib/scheduler.js';
 import { detectOverdueJobs } from '../lib/overdue.js';
 import { isInteractiveTerminal, requireInteractiveSelection } from './utils.js';
 import { setHelpSections } from '../lib/help.js';
+/**
+ * Human-friendly wall-clock a run took (e.g. "  · 3 min", "  · 45 sec"), or ""
+ * when it hasn't completed or timestamps are unparseable. Leading separator lets
+ * callers drop it straight into a status line.
+ */
+export function formatRunDuration(startedAt, completedAt) {
+    if (!completedAt)
+        return '';
+    const ms = Date.parse(completedAt) - Date.parse(startedAt);
+    if (!Number.isFinite(ms) || ms < 0)
+        return '';
+    const sec = Math.round(ms / 1000);
+    if (sec < 60)
+        return `  · ${sec} sec`;
+    const min = Math.round(sec / 60);
+    if (min < 60)
+        return `  · ${min} min`;
+    const hr = Math.floor(min / 60);
+    const rem = min % 60;
+    return rem ? `  · ${hr} hr ${rem} min` : `  · ${hr} hr`;
+}
 /**
  * Human label for what fires a job: its cron schedule, or its event trigger
  * for schedule-less (trigger-only) routines.
@@ -660,30 +681,67 @@ export function registerRoutinesCommands(program) {
     });
     routinesCmd
         .command('logs [name]')
-        .description('Read stdout from the most recent execution. Use --run to see a specific past run.')
+        .description('Show a run’s concise summary — status + extracted report. --full for the raw stdout stream; --run for a specific past run.')
         .option('-r, --run <runId>', 'Show logs from this run ID instead of the latest')
+        .option('-m, --full', 'Show the full raw stdout stream instead of the concise summary')
         .action(async (name, options) => {
         if (!name) {
             name = await pickJob('Select job to view logs', undefined, ['agents routines logs <name>', 'agents routines logs <name> --run <run-id>']) ?? undefined;
             if (!name)
                 return;
         }
-        let runId = options.run;
-        if (!runId) {
-            const latest = getLatestRun(name);
-            if (!latest) {
-                console.log(chalk.yellow(`No runs found for job '${name}'`));
+        // Resolve the run: an explicit --run row, else the latest.
+        const run = options.run
+            ? listRuns(name).find((r) => r.runId === options.run)
+            : getLatestRun(name);
+        if (!run) {
+            console.log(chalk.yellow(options.run ? `No run '${options.run}' for job '${name}'` : `No runs found for job '${name}'`));
+            return;
+        }
+        const runId = run.runId;
+        const logPath = path.join(getRunDir(name, runId), 'stdout.log');
+        // --full: the raw combined stdout stream (the old default).
+        if (options.full) {
+            if (!fs.existsSync(logPath)) {
+                console.log(chalk.yellow(`Log not found: ${logPath}`));
                 return;
             }
-            runId = latest.runId;
+            console.log(chalk.gray(`Run: ${runId}\n`));
+            console.log(fs.readFileSync(logPath, 'utf-8'));
+            return;
         }
-        const logPath = path.join(getRunDir(name, runId), 'stdout.log');
-        if (!fs.existsSync(logPath)) {
-            console.log(chalk.yellow(`Log not found: ${logPath}`));
+        // Concise by default: a status header + the extracted report (final
+        // assistant message). Routine runs are sandboxed (transcript in an overlay
+        // HOME, not the session index), so the captured report — not renderSummary —
+        // is the concise view. Falls back to a bounded stdout tail when no report
+        // was extracted (e.g. the run failed before finishing).
+        const statusColor = run.status === 'completed' ? chalk.green
+            : run.status === 'failed' || run.status === 'timeout' ? chalk.red
+                : chalk.yellow;
+        console.log(chalk.bold(name) + chalk.gray(`  run ${runId}`));
+        console.log(statusColor(run.status) +
+            chalk.gray(`  ${run.startedAt}`) +
+            chalk.gray(formatRunDuration(run.startedAt, run.completedAt)) +
+            (run.exitCode !== null && run.exitCode !== undefined ? chalk.gray(`  exit ${run.exitCode}`) : ''));
+        console.log(chalk.gray('─'.repeat(60)));
+        const reportPath = path.join(getRunDir(name, runId), 'report.md');
+        if (fs.existsSync(reportPath)) {
+            console.log(fs.readFileSync(reportPath, 'utf-8').trimEnd());
+            console.log(chalk.gray('\n(pass --full for the raw stdout stream)'));
             return;
         }
-        console.log(chalk.gray(`Run: ${runId}\n`));
-        console.log(fs.readFileSync(logPath, 'utf-8'));
+        // No report — show a bounded tail rather than dumping the whole stream.
+        if (fs.existsSync(logPath)) {
+            const lines = fs.readFileSync(logPath, 'utf-8').split('\n');
+            const tail = lines.slice(-40).join('\n').trimEnd();
+            console.log(chalk.gray('(no report extracted — showing the last lines of stdout)'));
+            if (tail)
+                console.log(tail);
+            console.log(chalk.gray('\n(pass --full for the raw stdout stream)'));
+        }
+        else {
+            console.log(chalk.gray('(no output captured for this run)'));
+        }
     });
     routinesCmd
         .command('report [name]')

package/dist/commands/sessions.d.ts

@@ -1,5 +1,5 @@
 import type { Command } from 'commander';
-import type { SessionAgentId, SessionMeta } from '../lib/session/types.js';
+import type { SessionAgentId, SessionMeta, ViewMode } from '../lib/session/types.js';
 import { type ActiveSession } from '../lib/session/active.js';
 import { type PickedSession } from './sessions-picker.js';
 /**
@@ -149,11 +149,12 @@ export declare function buildOverviewGroups(pool: SessionMeta[], perProjectCap:
     projectCount: number;
 };
 /**
- * Render a session's full transcript to stdout — the non-follow view behind
- * `agents logs <sessionId>`. Reuses the same markdown renderer as
- * `agents sessions <id> --markdown`.
+ * Render a resolved session to stdout — the non-follow view behind
+ * `agents logs <sessionId>`. Defaults to the concise `summary` digest (same as
+ * `agents sessions <id>`); pass `'markdown'` for the full transcript
+ * (`agents logs <id> --full`). Reuses the shared `renderSession` renderer.
  */
-export declare function renderSessionLog(session: SessionMeta): Promise<void>;
+export declare function renderSessionLog(session: SessionMeta, mode?: ViewMode): Promise<void>;
 /** Column-visibility flags for the picker row, computed once over the whole pool. */
 export interface PickerColumns {
     /** Render the machine column (only when the pool spans more than one machine). */