@phnx-labs/agents-cli 1.20.43 → 1.20.44

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 1.20.44
+
+- **Every `logs` command is concise by default; the token-heavy raw dump is now opt-in behind `--full`.** Agents that spin up agents on other machines or add teammates were pulling whole transcripts just to glance at status — `agents logs <session>` printed the full markdown transcript, and `agents hosts logs` / `agents teams logs` / `agents routines logs` each `cat`'d their entire captured stdout, because each subsystem had hand-rolled its own "cat the log" verb over its own storage. All four now default to a bounded, concise view, with `-m/--full` for the raw log: `agents logs <session>` renders the same summary digest as `agents sessions <id>` (a real session shrank 92% — 29.9 KB → 2.6 KB); `agents routines logs <name>` shows a status header + the extracted report (a real run shrank 99.5% — 386 KB → 1.8 KB), falling back to a bounded stdout tail when no report was extracted; `agents teams logs <teammate>` renders the teammate's session summary (its agentId **is** the session id), with `-n <lines>` / `--full` for raw stdout; `agents hosts logs <id>` shows a bounded tail of the captured stdout (`tailLines`, with a "… N earlier lines hidden — pass --full" note) instead of the whole log. `renderSessionLog` now takes a mode and defaults to `'summary'`; `agents sessions <id>` was already summary-by-default and is unchanged. Regression-tested: `tailLines` truncation/elision math (`hosts/logs.test.ts`) and `formatRunDuration` human-time formatting (`routines-logs.test.ts`). Source: `apps/cli/src/commands/{logs,sessions,hosts,teams,routines}.ts`, `apps/cli/src/lib/hosts/logs.ts`. Scoped follow-up (not in this PR): host-task and sandboxed-routine runs write their real transcript on the remote / in an overlay HOME, so `logs` can't yet resolve them to the full `renderSummary` — making those runs discoverable is a separate change; until then the bounded tail / extracted report is the safe concise default.
+- **The daemon now self-heals the `pane-died` hook on already-running `agents run` sessions.** The v1.20.42 fix that stops exiting a split from kicking you out of tmux is installed once, at session creation — so sessions already alive under the long-lived shared tmux server keep the old, unconditional `detach-client` hook until they exit or the server is recycled. On a machine that's never "between sessions," that meant hand-repairing live sessions. The daemon now runs `reconcileSessionHooks()` ~20s after startup and every ~5 min: it walks the managed `ag-` sessions on the shared socket and retrofits the `#{hook_pane}`-guarded hook onto any whose hook predates the current schema. It is strictly **non-destructive — `set-hook` only, never a `kill-pane` or `detach-client`** — so it is safe to run against sessions you're attached to; a per-session `@ag_hook_schema` marker makes steady-state a no-op. The hook string is now built in one place (`agentPaneDiedHook`) shared by the spawn-wrap and the reconcile so they can't drift. Source: `apps/cli/src/lib/tmux/session.ts`, `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/exec.ts`.
+- **NEW: `agents run` self-heals a gutted install instead of crashing with `ENOENT`.** The recurring failure: an npm agent whose native binary ships as an optional per-arch dependency (codex → `@openai/codex-<platform>`) can have that tarball extract **partially** — the platform package's `package.json` lands, its `vendor/<triple>/…/codex` binary does not (an interrupted or concurrently-raced `agents add` into the same version dir). The CLI's wrapper `require.resolve`s the platform package, finds the `package.json`, and sails straight past its own "missing optional dependency" guard into a `spawn(binaryPath)` that dies with a raw `ENOENT`. `agents run` now probes the version it's about to launch and, if the binary can't run, **repairs it in place** (a *clean* reinstall — the partial `node_modules` is wiped first, because npm treats the present-but-gutted platform package as already installed and would otherwise skip re-fetching it), then falls back to another installed version that launches (re-pinning it as the default so the shim path heals too), then to installing `latest` — only erroring if nothing can be made runnable. `installVersion` gained a `{ clean }` option for the wipe-then-reinstall. Source: `apps/cli/src/lib/versions.ts` (`ensureAgentRunnable`), `apps/cli/src/commands/exec.ts`.
+- **Fix: a broken agent install no longer launches into a silent `[detached]` — the real crash is surfaced.** When an interactive `ag run <agent>` wrapped the agent in tmux and the agent died the instant it spawned (e.g. a gutted install crashing with `spawn … ENOENT`, a bad flag, a startup crash), the `pane-died` hook detached the client before you could read anything — you got a bare `[detached (from session …)]` with zero indication of why. `runInTmux` now recaps the dead pane's last output (read from scrollback via `capture-pane -S -200`, since the pane's visible screen is just the "Pane is dead" banner) plus the exit code to stderr, and points you at `--no-tmux`. Fast failures (dead before attach) always recap; a post-attach nonzero exit recaps too (a clean exit or a manual detach stays quiet). Source: `apps/cli/src/lib/exec.ts`, `apps/cli/src/lib/tmux/session.test.ts`.
+- **NEW: `--no-tmux` / `--disable-tmux` on `agents run`.** The interactive tmux wrapper (which gives `%pane` addressing + re-attach) already had an opt-out, but it was hidden behind the opaquely-named `--raw`. `--no-tmux` (and its alias `--disable-tmux`) spawn the agent directly with full stdio inherited — the fastest way to see an agent's real startup output when a launch is failing. Same effect as `--raw` and `AGENTS_NO_TMUX=1`. Source: `apps/cli/src/commands/exec.ts`.
+- **Fix: `agents add <agent>@<version>` no longer records a gutted install as healthy (root cause of the ENOENT crash + a broken default pin).** npm packages that ship their native binary via an optional per-arch dependency (e.g. codex → `@openai/codex-<platform>`) can land the JS wrapper at `node_modules/.bin/<cli>` while the real platform binary is missing (interrupted install, omitted optional dep, `--ignore-scripts`). `getBinaryPath()` only checked the wrapper, so the broken version read as installed, got pinned as the default, and got picked to run — then died with ENOENT. `installVersion` now probes `<binary> --version` (under the version's isolated HOME) after install and **fails the install** if the binary can't launch, so a broken version is never silently pinned. The check is deliberately narrow — only the missing-binary signature (`ENOENT`/"no such file"/"command not found") fails it; a plain nonzero exit or a timeout is treated as healthy, so a well-behaved agent that dislikes `--version` is never false-failed. Source: `apps/cli/src/lib/versions.ts`, `apps/cli/src/lib/versions-integrity.test.ts`.
+- **Security fix: the routines daemon log no longer leaks GitHub / AWS / npm tokens.** `daemon.ts` carried its own private `redactSecrets` (used by every `log()` write to `logs.jsonl`) that predated and diverged from the canonical `redact.ts` — it caught `sk-`, `eyJ…`, `Bearer …`, and a narrow `NAME=value` list, but **not** `ghp_` (GitHub PAT), `AKIA…` (AWS access key), or `npm_` (npm token), so any of those appearing in a daemon message (a git push URL, a bundle-env dump, an error string) was written to the log in the clear. The private copy is deleted; `log()` now routes through the canonical `redactSecrets` in `redact.ts`, which covers all of those classes with a stronger quote-aware `NAME=value` pattern. The one pattern the daemon copy had and the canonical lacked — `Bearer <token>` — is added to `redact.ts`, so the shared redactor (also used by session-transcript export in `session/render.ts`) is now a strict superset. New `redact.test.ts` pins every token class as a regression guard. Source: `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/redact.ts`, `apps/cli/src/lib/redact.test.ts`.
+
 ## 1.20.43
 
 - **NEW: `agents run --name <slug>` — a durable, human/agent-friendly handle for any run.** An agent that dispatches another agent had no cheap status handle: the host-task id was never even printed (the `--no-follow` tip showed a literal `<id>` placeholder), and only Claude's session id is known up front (pre-minted `--session-id`) — every other agent's id is discovered later by scanning transcripts, so callers fell back to `agents logs`, which dumps the raw, token-heavy transcript. `--name` is chosen at launch, agent-agnostic, and stored on the structures that already back these views: a first-class `name` column on `sessions.db` (schema v9, additive, no rescan) parallel to `label` — `agents sessions <ref>` resolves against **both** name and label; the HostTask sidecar (forwarded to the remote run, so `agents hosts ps` gains a NAME column and `agents hosts logs <name>` resolves by name); and a run-name sidecar (`~/.agents/.cache/run-names/`) that joins a local run's name onto the index by id every scan via `syncNames` — the same idempotent pattern as `/rename` label sync. The `name` column is deliberately left out of the upsert `ON CONFLICT … SET` clause, so a discovery rescan can never null an existing name (regression-tested in `db.names.test.ts`). Omitting `--name` is a strict no-op: `name` stays unset and every id-based path is unchanged. The `--no-follow` dispatch tip now prints the real handle and steers to the compact `agents sessions` digest over the raw log. Source: `apps/cli/src/commands/exec.ts`, `apps/cli/src/lib/session/{db,run-names,discover}.ts`, `apps/cli/src/lib/hosts/{dispatch,tasks}.ts`.

package/README.md

@@ -243,7 +243,8 @@ agents hosts check gpu-box              # reachable? which agents-cli version?
 
 # Run there instead of locally
 agents run claude --host gpu-box "profile this build"   # follows live by default
-agents logs --host gpu-box              # pick a dispatched run and view its log
+agents logs --host gpu-box              # pick a dispatched run — concise summary by default
+agents logs <id> --full                 # the full raw transcript / stdout (token-heavy)
 agents logs <id> -f                     # re-attach to a running one and follow
 agents view claude --host gpu-box       # inspect the remote install
 agents sync --host gpu-box              # make the remote machine current
@@ -274,7 +275,7 @@ agents teams start auth-feature     # Fires teammates whose deps are done
 agents teams status auth-feature    # Who's working, what they changed, what they said
 ```
 
-Teammates run detached -- close your terminal, they keep working. Check in with `teams status`, read full output with `teams logs <name>`, clean up with `teams disband`.
+Teammates run detached -- close your terminal, they keep working. Check in with `teams status`, glance at a teammate's summary with `teams logs <name>` (add `--full` for the raw output), clean up with `teams disband`.
 
 Team state is observable via `agents teams list --json` / `agents teams status --json` (compact by default; add `--verbose` for the full per-teammate shape). External tools join it with `sessions --json` (teammates get `isTeamOrigin: true`) and `cloud list --json` (for `--cloud` teammates) to build a unified fleet view. See [docs/06-observability.md](docs/06-observability.md).
 
@@ -534,7 +535,7 @@ agents routines add daily-digest \
 
 agents routines list                   # All jobs + next run times
 agents routines run daily-digest       # Test it now, ignore the schedule
-agents routines logs daily-digest      # Check last execution
+agents routines logs daily-digest      # Last execution — status + report (add --full for raw stdout)
 ```
 
 Jobs run sandboxed -- agents only see directories and tools you explicitly allow.

package/dist/commands/exec.js

@@ -221,6 +221,8 @@ export function registerRunCommand(program) {
         .option('--name <slug>', 'Give the run a durable name — a stable handle you can check on later with `agents sessions <name>` (and `agents hosts logs <name>` for --host runs), instead of an opaque id. Optional; omitting it keeps today\'s id-only behavior.')
         .option('--verbose', 'Show detailed execution logs')
         .option('--raw', 'Interactive runs on macOS/Linux launch inside a shared tmux session (for %pane addressing + re-attach). Pass --raw to spawn the agent directly instead. Also disabled by AGENTS_NO_TMUX=1.')
+        .option('--no-tmux', 'Spawn the agent directly instead of wrapping it in the shared tmux session. Same effect as --raw / AGENTS_NO_TMUX=1. Use this to see the agent\'s full startup output when a launch is failing.')
+        .option('--disable-tmux', 'Alias for --no-tmux.')
         .option('--timeout <duration>', 'Kill the agent after this duration (e.g., 30m, 1h, 2h30m)')
         .option('--fallback <agents>', 'Comma-separated agents to try on rate-limit failure. Each entry accepts an optional @version pin (e.g., codex@0.116.0,gemini). The primary runs first; if it exits with a rate-limit error, the next agent picks up via /continue handoff.')
         .option('-b, --balanced', 'Shortcut for --strategy balanced. Ignored when @version is pinned.')
@@ -525,7 +527,7 @@ export function registerRunCommand(program) {
             });
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, defaultModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, defaultModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
@@ -933,6 +935,29 @@ export function registerRunCommand(program) {
                 }
             }
         }
+        // Self-heal the launch target. A gutted install (JS wrapper present,
+        // native binary missing — a partial/raced npm extraction of the optional
+        // per-arch dependency) would otherwise spawn and die with a raw ENOENT
+        // inside the agent's own wrapper. Repair it in place (or fall back to a
+        // runnable version, re-pinning it) BEFORE we build the launch command.
+        // Skipped for headless resume-native/acp/loop paths only if it errored;
+        // here it runs for every normal dispatch. Best-effort log to stderr.
+        {
+            const launchTarget = version ?? resolveVersion(agent, cwd) ?? undefined;
+            if (launchTarget) {
+                const healed = await ensureAgentRunnable(agent, launchTarget, options.quiet ? undefined : (m) => process.stderr.write(chalk.yellow(`[agents] ${m}\n`)));
+                if (healed === null) {
+                    console.error(chalk.red(`agents: ${agent}@${launchTarget} is not runnable and could not be repaired. Try: agents add ${agent}@latest`));
+                    process.exit(1);
+                }
+                // Always adopt the healed version explicitly. In the version-undefined
+                // path a fallback re-pins the GLOBAL default, but `resolveVersion`
+                // prefers a PROJECT pin — so leaving `version` undefined would let the
+                // shim re-resolve the still-broken project pin and crash anyway. Pinning
+                // the runnable version here is a no-op when nothing changed.
+                version = healed;
+            }
+        }
         const defaultVersion = version ?? resolveVersion(agent, cwd);
         const runDefaults = fromProfile
             ? { sources: {} }
@@ -1074,7 +1099,10 @@ export function registerRunCommand(program) {
             name: options.name,
             resume: resumeNative,
             verbose: options.verbose,
-            raw: options.raw,
+            // --raw, --no-tmux (commander negation → options.tmux === false), and
+            // --disable-tmux all bypass the interactive tmux wrapper. AGENTS_NO_TMUX=1
+            // does the same via the env check in exec.ts.
+            raw: options.raw || options.tmux === false || options.disableTmux === true,
             timeout: options.timeout,
             env,
             toolsRestrict: workflowToolsRestrict,

package/dist/commands/hosts.js

@@ -188,11 +188,11 @@ async function doPs(json) {
         console.log(t.id.padEnd(11) + nameCol + t.host.padEnd(16) + t.agent.padEnd(10) + status.padEnd(11) + promptCol);
     }
 }
-async function doLogs(ref, follow) {
+async function doLogs(ref, follow, full) {
     // Resolve the ref as a task id first, then fall back to a `--name` handle so
     // `agents hosts logs <name>` works, not just the opaque id.
     const id = loadTask(ref) ? ref : (findTaskByName(ref)?.id ?? findTaskBySessionId(ref)?.id ?? ref);
-    const res = await showHostTaskLog(id, follow);
+    const res = await showHostTaskLog(id, follow, full);
     if (!res.found) {
         console.log(chalk.red(`Unknown task "${ref}".`));
         process.exitCode = 1;
@@ -235,7 +235,8 @@ export function registerHostsCommand(program) {
         .action((opts) => doPs(!!opts.json));
     hosts
         .command('logs <id>')
-        .description('Show a host task log; -f to follow a running one.')
+        .description('Show a host task’s concise summary; --full for the raw log, -f to follow a running one.')
         .option('-f, --follow', 'Follow live output')
-        .action((id, opts) => doLogs(id, !!opts.follow));
+        .option('-m, --full', 'Show the full raw combined-stdout log instead of the concise summary')
+        .action((id, opts) => doLogs(id, !!opts.follow, !!opts.full));
 }

package/dist/commands/logs.d.ts

@@ -5,6 +5,10 @@
  *  - host-dispatch tasks (`agents run --host`) → combined-stdout log, offset-tailed
  *  - sessions (the local index) → transcript, tailed via the sessions tailer
  *
+ * Concise by default: a bare `agents logs <id>` prints the same summary digest as
+ * `agents sessions <id>` — cheap for an agent to glance at. The token-heavy full
+ * transcript / raw stdout is opt-in behind `--full` (alias `-m/--markdown`).
+ *
  * `[id]`/`--session` load directly (host task tried first, then session). With no
  * id, `--host`/`--agent`/`--version` filter a merged candidate list; one match is
  * shown, several open the fuzzy picker (or, non-TTY, print the list).

package/dist/commands/logs.js

@@ -5,6 +5,10 @@
  *  - host-dispatch tasks (`agents run --host`) → combined-stdout log, offset-tailed
  *  - sessions (the local index) → transcript, tailed via the sessions tailer
  *
+ * Concise by default: a bare `agents logs <id>` prints the same summary digest as
+ * `agents sessions <id>` — cheap for an agent to glance at. The token-heavy full
+ * transcript / raw stdout is opt-in behind `--full` (alias `-m/--markdown`).
+ *
  * `[id]`/`--session` load directly (host task tried first, then session). With no
  * id, `--host`/`--agent`/`--version` filter a merged candidate list; one match is
  * shown, several open the fuzzy picker (or, non-TTY, print the list).
@@ -33,8 +37,8 @@ function candidateLabel(c) {
     const title = s.label || s.topic || '';
     return `${chalk.gray('sess')} ${s.shortId.padEnd(9)} ${(s.agent + ver).padEnd(14)} ${chalk.gray(s.timestamp.slice(0, 16))}  ${title.slice(0, 40)}`;
 }
-/** Show a resolved session — follow (tail) or render its transcript. */
-async function showSession(session, follow) {
+/** Show a resolved session — follow (tail), concise summary, or (`full`) transcript. */
+async function showSession(session, follow, full) {
     if (follow) {
         if (!isTailable(session.agent)) {
             console.error(chalk.red(`Tailing is supported for claude and codex sessions only (got ${session.agent}).`));
@@ -43,20 +47,20 @@ async function showSession(session, follow) {
         await streamSessionTail(session, {});
         return;
     }
-    await renderSessionLog(session);
+    await renderSessionLog(session, full ? 'markdown' : 'summary');
 }
-async function showCandidate(c, follow) {
+async function showCandidate(c, follow, full) {
     if (c.kind === 'task') {
-        const res = await showHostTaskLog(c.task.id, follow);
+        const res = await showHostTaskLog(c.task.id, follow, full);
         if (res.exitCode !== undefined)
             process.exitCode = res.exitCode;
         return;
     }
-    await showSession(c.session, follow);
+    await showSession(c.session, follow, full);
 }
 /** Resolve an explicit id/--session: host task first, then a session. */
-async function showById(id, follow) {
-    const hostRes = await showHostTaskLog(id, follow);
+async function showById(id, follow, full) {
+    const hostRes = await showHostTaskLog(id, follow, full);
     if (hostRes.found) {
         if (hostRes.exitCode !== undefined)
             process.exitCode = hostRes.exitCode;
@@ -68,13 +72,14 @@ async function showById(id, follow) {
         console.error(chalk.red(`No run or session found matching "${id}".`));
         process.exit(1);
     }
-    await showSession(matches[0], follow);
+    await showSession(matches[0], follow, full);
 }
 async function runLogs(id, opts) {
     const follow = !!opts.follow;
+    const full = !!opts.full;
     const directId = opts.session ?? id;
     if (directId) {
-        await showById(directId, follow);
+        await showById(directId, follow, full);
         return;
     }
     const { agent, version } = parseAgentFilter(opts.agent);
@@ -99,7 +104,7 @@ async function runLogs(id, opts) {
         process.exit(1);
     }
     if (candidates.length === 1) {
-        await showCandidate(candidates[0], follow);
+        await showCandidate(candidates[0], follow, full);
         return;
     }
     // Multiple sessions matched → picker if interactive, else a list to pick from.
@@ -123,17 +128,18 @@ async function runLogs(id, opts) {
     });
     if (!picked)
         return;
-    await showCandidate(picked.item, follow);
+    await showCandidate(picked.item, follow, full);
 }
 /** Register the top-level `agents logs` command. */
 export function registerLogsCommand(program) {
     program
         .command('logs [id]')
-        .description('Show a run’s log — a host-dispatch task or a session. -f to follow a live one.')
+        .description('Show a run’s concise summary — a host-dispatch task or a session. --full for the raw transcript, -f to follow a live one.')
         .option('--host <name>', 'Scope to runs dispatched to a host')
         .option('-a, --agent <agent>', 'Filter by agent (e.g. claude, codex@0.116.0)')
         .option('--version <version>', 'Filter by agent version')
         .option('--session <id>', 'Select a session/run by id (same as the positional id)')
         .option('-f, --follow', 'Follow live output')
+        .option('-m, --full', 'Show the full raw transcript / stdout instead of the concise summary')
         .action((id, opts) => runLogs(id, opts));
 }

package/dist/commands/routines.d.ts

@@ -6,5 +6,11 @@
  * Also exposes scheduler lifecycle controls (start/stop/status/logs).
  */
 import type { Command } from 'commander';
+/**
+ * Human-friendly wall-clock a run took (e.g. "  · 3 min", "  · 45 sec"), or ""
+ * when it hasn't completed or timestamps are unparseable. Leading separator lets
+ * callers drop it straight into a status line.
+ */
+export declare function formatRunDuration(startedAt: string, completedAt: string | null): string;
 /** Register the `agents routines` command tree. */
 export declare function registerRoutinesCommands(program: Command): void;

package/dist/commands/routines.js

@@ -22,6 +22,27 @@ import { JobScheduler } from '../lib/scheduler.js';
 import { detectOverdueJobs } from '../lib/overdue.js';
 import { isInteractiveTerminal, requireInteractiveSelection } from './utils.js';
 import { setHelpSections } from '../lib/help.js';
+/**
+ * Human-friendly wall-clock a run took (e.g. "  · 3 min", "  · 45 sec"), or ""
+ * when it hasn't completed or timestamps are unparseable. Leading separator lets
+ * callers drop it straight into a status line.
+ */
+export function formatRunDuration(startedAt, completedAt) {
+    if (!completedAt)
+        return '';
+    const ms = Date.parse(completedAt) - Date.parse(startedAt);
+    if (!Number.isFinite(ms) || ms < 0)
+        return '';
+    const sec = Math.round(ms / 1000);
+    if (sec < 60)
+        return `  · ${sec} sec`;
+    const min = Math.round(sec / 60);
+    if (min < 60)
+        return `  · ${min} min`;
+    const hr = Math.floor(min / 60);
+    const rem = min % 60;
+    return rem ? `  · ${hr} hr ${rem} min` : `  · ${hr} hr`;
+}
 /**
  * Human label for what fires a job: its cron schedule, or its event trigger
  * for schedule-less (trigger-only) routines.
@@ -660,30 +681,67 @@ export function registerRoutinesCommands(program) {
     });
     routinesCmd
         .command('logs [name]')
-        .description('Read stdout from the most recent execution. Use --run to see a specific past run.')
+        .description('Show a run’s concise summary — status + extracted report. --full for the raw stdout stream; --run for a specific past run.')
         .option('-r, --run <runId>', 'Show logs from this run ID instead of the latest')
+        .option('-m, --full', 'Show the full raw stdout stream instead of the concise summary')
         .action(async (name, options) => {
         if (!name) {
             name = await pickJob('Select job to view logs', undefined, ['agents routines logs <name>', 'agents routines logs <name> --run <run-id>']) ?? undefined;
             if (!name)
                 return;
         }
-        let runId = options.run;
-        if (!runId) {
-            const latest = getLatestRun(name);
-            if (!latest) {
-                console.log(chalk.yellow(`No runs found for job '${name}'`));
+        // Resolve the run: an explicit --run row, else the latest.
+        const run = options.run
+            ? listRuns(name).find((r) => r.runId === options.run)
+            : getLatestRun(name);
+        if (!run) {
+            console.log(chalk.yellow(options.run ? `No run '${options.run}' for job '${name}'` : `No runs found for job '${name}'`));
+            return;
+        }
+        const runId = run.runId;
+        const logPath = path.join(getRunDir(name, runId), 'stdout.log');
+        // --full: the raw combined stdout stream (the old default).
+        if (options.full) {
+            if (!fs.existsSync(logPath)) {
+                console.log(chalk.yellow(`Log not found: ${logPath}`));
                 return;
             }
-            runId = latest.runId;
+            console.log(chalk.gray(`Run: ${runId}\n`));
+            console.log(fs.readFileSync(logPath, 'utf-8'));
+            return;
         }
-        const logPath = path.join(getRunDir(name, runId), 'stdout.log');
-        if (!fs.existsSync(logPath)) {
-            console.log(chalk.yellow(`Log not found: ${logPath}`));
+        // Concise by default: a status header + the extracted report (final
+        // assistant message). Routine runs are sandboxed (transcript in an overlay
+        // HOME, not the session index), so the captured report — not renderSummary —
+        // is the concise view. Falls back to a bounded stdout tail when no report
+        // was extracted (e.g. the run failed before finishing).
+        const statusColor = run.status === 'completed' ? chalk.green
+            : run.status === 'failed' || run.status === 'timeout' ? chalk.red
+                : chalk.yellow;
+        console.log(chalk.bold(name) + chalk.gray(`  run ${runId}`));
+        console.log(statusColor(run.status) +
+            chalk.gray(`  ${run.startedAt}`) +
+            chalk.gray(formatRunDuration(run.startedAt, run.completedAt)) +
+            (run.exitCode !== null && run.exitCode !== undefined ? chalk.gray(`  exit ${run.exitCode}`) : ''));
+        console.log(chalk.gray('─'.repeat(60)));
+        const reportPath = path.join(getRunDir(name, runId), 'report.md');
+        if (fs.existsSync(reportPath)) {
+            console.log(fs.readFileSync(reportPath, 'utf-8').trimEnd());
+            console.log(chalk.gray('\n(pass --full for the raw stdout stream)'));
             return;
         }
-        console.log(chalk.gray(`Run: ${runId}\n`));
-        console.log(fs.readFileSync(logPath, 'utf-8'));
+        // No report — show a bounded tail rather than dumping the whole stream.
+        if (fs.existsSync(logPath)) {
+            const lines = fs.readFileSync(logPath, 'utf-8').split('\n');
+            const tail = lines.slice(-40).join('\n').trimEnd();
+            console.log(chalk.gray('(no report extracted — showing the last lines of stdout)'));
+            if (tail)
+                console.log(tail);
+            console.log(chalk.gray('\n(pass --full for the raw stdout stream)'));
+        }
+        else {
+            console.log(chalk.gray('(no output captured for this run)'));
+        }
     });
     routinesCmd
         .command('report [name]')

package/dist/commands/sessions.d.ts

@@ -1,5 +1,5 @@
 import type { Command } from 'commander';
-import type { SessionAgentId, SessionMeta } from '../lib/session/types.js';
+import type { SessionAgentId, SessionMeta, ViewMode } from '../lib/session/types.js';
 import { type ActiveSession } from '../lib/session/active.js';
 import { type PickedSession } from './sessions-picker.js';
 /**
@@ -149,11 +149,12 @@ export declare function buildOverviewGroups(pool: SessionMeta[], perProjectCap:
     projectCount: number;
 };
 /**
- * Render a session's full transcript to stdout — the non-follow view behind
- * `agents logs <sessionId>`. Reuses the same markdown renderer as
- * `agents sessions <id> --markdown`.
+ * Render a resolved session to stdout — the non-follow view behind
+ * `agents logs <sessionId>`. Defaults to the concise `summary` digest (same as
+ * `agents sessions <id>`); pass `'markdown'` for the full transcript
+ * (`agents logs <id> --full`). Reuses the shared `renderSession` renderer.
  */
-export declare function renderSessionLog(session: SessionMeta): Promise<void>;
+export declare function renderSessionLog(session: SessionMeta, mode?: ViewMode): Promise<void>;
 /** Column-visibility flags for the picker row, computed once over the whole pool. */
 export interface PickerColumns {
     /** Render the machine column (only when the pool spans more than one machine). */

package/dist/commands/sessions.js

@@ -425,7 +425,14 @@ export function groupActiveSessions(sessions) {
  * to the same id form); else the local machine. Never keys off `ActiveSession.host`
  * — that is the terminal *app* (code/tmux), not the computer.
  */
+/** Synthetic top-level group key for provider-sandboxed cloud tasks. */
+const CLOUD_MACHINE_KEY = 'cloud';
 function machineKeyFor(s, localMachine) {
+    // Cloud tasks run in a provider sandbox, not on the machine they're attributed
+    // to for reply routing (s.machine = the querier). Surface them as their own
+    // top-level "cloud" group instead of nested under the local device.
+    if (s.context === 'cloud')
+        return CLOUD_MACHINE_KEY;
     if (s.machine)
         return s.machine;
     if (s.provenance?.host)
@@ -449,6 +456,11 @@ export function groupSessionsByMachine(sessions, localMachine) {
             return -1;
         if (b === localMachine)
             return 1;
+        // The synthetic "cloud" category sorts after all real machines.
+        if (a === CLOUD_MACHINE_KEY)
+            return 1;
+        if (b === CLOUD_MACHINE_KEY)
+            return -1;
         const ac = byMachine.get(a).length, bc = byMachine.get(b).length;
         if (ac !== bc)
             return bc - ac;
@@ -575,38 +587,48 @@ function groupTally(sessions) {
     return parts.join(' · ');
 }
 /** Print one machine's workspace tree, indented under its machine header. */
-function renderWorkspaceLayout(layout, base) {
+function renderWorkspaceLayout(layout, base, machineKey) {
     let first = true;
     for (const ws of layout.workspaces) {
         if (!first)
             console.log();
         first = false;
-        const header = ws.key === '__cloud__'
-            ? chalk.magenta.bold('cloud')
-            : ws.key === '__unknown__'
-                ? chalk.gray.bold('unknown')
-                : chalk.cyan.bold(shortCwd(ws.key));
-        const wsSessions = [...ws.windows.flatMap(w => w.sessions), ...ws.flat];
-        const tally = groupTally(wsSessions);
-        console.log(`${base}${header} ${chalk.gray(`(${ws.total})`)}${tally ? chalk.gray(`  ${tally}`) : ''}`);
+        // Under the top-level "cloud" machine group the __cloud__ workspace header is
+        // redundant ("▸ cloud" then "cloud") — render its rows flat under the machine
+        // header instead. Row indent collapses by one level to match.
+        const redundantCloud = ws.key === '__cloud__' && machineKey === CLOUD_MACHINE_KEY;
+        const rowBase = redundantCloud ? base : base + '  ';
+        if (!redundantCloud) {
+            const header = ws.key === '__cloud__'
+                ? chalk.magenta.bold('cloud')
+                : ws.key === '__unknown__'
+                    ? chalk.gray.bold('unknown')
+                    : chalk.cyan.bold(shortCwd(ws.key));
+            const wsSessions = [...ws.windows.flatMap(w => w.sessions), ...ws.flat];
+            const tally = groupTally(wsSessions);
+            console.log(`${base}${header} ${chalk.gray(`(${ws.total})`)}${tally ? chalk.gray(`  ${tally}`) : ''}`);
+        }
         for (const win of ws.windows) {
             // Host is per-process, but every terminal in the same IDE window shares
             // an ancestor — take the first non-empty host as the window's label.
             const host = win.sessions.find((s) => s.host)?.host ?? 'terminal';
             const winHeader = `${chalk.gray(host)} ${chalk.gray('·')} ${chalk.gray(shortWindowLabel(win.windowId))} ${chalk.gray(`(${win.sessions.length})`)}`;
-            console.log(base + '  ' + winHeader);
+            console.log(rowBase + winHeader);
             for (const s of win.sessions)
-                printActiveRow(s, base + '    ');
+                printActiveRow(s, rowBase + '  ');
         }
         for (const s of ws.flat)
-            printActiveRow(s, base + '  ');
+            printActiveRow(s, rowBase);
     }
 }
 /** Machine header: `▸ <name> ← this machine` for the local box (cyan), matching
  * the `ag devices list` treatment; a plain `▸ <name>` for remotes. */
 function printMachineHeader(mg) {
-    const marker = mg.isLocal ? chalk.cyan('▸ ') : chalk.gray('▸ ');
-    const name = mg.isLocal ? chalk.bold.cyan(mg.machine) : chalk.bold(mg.machine);
+    // The synthetic "cloud" group isn't a device — tint it magenta (matching the
+    // cloud row/label styling) so it reads as a category, not a machine.
+    const isCloud = mg.machine === CLOUD_MACHINE_KEY;
+    const marker = mg.isLocal ? chalk.cyan('▸ ') : isCloud ? chalk.magenta('▸ ') : chalk.gray('▸ ');
+    const name = mg.isLocal ? chalk.bold.cyan(mg.machine) : isCloud ? chalk.bold.magenta(mg.machine) : chalk.bold(mg.machine);
     const here = mg.isLocal ? chalk.cyan('  ← this machine') : '';
     console.log(`${marker}${name} ${chalk.gray(`(${mg.total})`)}${here}`);
 }
@@ -740,11 +762,16 @@ async function renderActiveSessions(asJson, waitingOnly = false, opts = {}) {
             console.log();
         firstMachine = false;
         printMachineHeader(mg);
-        renderWorkspaceLayout(mg.layout, '  ');
+        renderWorkspaceLayout(mg.layout, '  ', mg.machine);
     }
     const parts = groupTally(sessions).split(' · ').filter(Boolean);
-    const machineWord = grouped.machines.length === 1 ? 'machine' : 'machines';
-    console.log(chalk.gray(`\n${sessions.length} active (${parts.join(', ')}) across ${grouped.machines.length} ${machineWord}.`));
+    // The synthetic "cloud" group is a category, not a machine — exclude it from the
+    // machine count and note it separately so the tally stays truthful.
+    const realMachines = grouped.machines.filter((m) => m.machine !== CLOUD_MACHINE_KEY).length;
+    const hasCloud = grouped.machines.some((m) => m.machine === CLOUD_MACHINE_KEY);
+    const machineWord = realMachines === 1 ? 'machine' : 'machines';
+    const cloudNote = hasCloud ? ' + cloud' : '';
+    console.log(chalk.gray(`\n${sessions.length} active (${parts.join(', ')}) across ${realMachines} ${machineWord}${cloudNote}.`));
     // Tip only when nothing else could be included and the user didn't opt out.
     if (!opts.local && !opts.hosts?.length && remoteDeviceCount === 0)
         printCrossMachineTip();
@@ -1258,12 +1285,13 @@ function resolveViewMode(options, filters) {
     return 'summary';
 }
 /**
- * Render a session's full transcript to stdout — the non-follow view behind
- * `agents logs <sessionId>`. Reuses the same markdown renderer as
- * `agents sessions <id> --markdown`.
+ * Render a resolved session to stdout — the non-follow view behind
+ * `agents logs <sessionId>`. Defaults to the concise `summary` digest (same as
+ * `agents sessions <id>`); pass `'markdown'` for the full transcript
+ * (`agents logs <id> --full`). Reuses the shared `renderSession` renderer.
  */
-export async function renderSessionLog(session) {
-    await renderSession(session, 'markdown', {});
+export async function renderSessionLog(session, mode = 'summary') {
+    await renderSession(session, mode, {});
 }
 async function renderSession(session, mode, filters, options = {}) {
     // OpenCode stores sessions in SQLite; filePath is "db_path#session_id"

package/dist/commands/teams.js

@@ -11,9 +11,10 @@ import { handleSpawn, handleStatus, handleStop, handleTasks, toTaskStatusSummary
 import { createTeam, ensureTeam, getTeam, loadTeams, removeTeam, teamExists, } from '../lib/teams/registry.js';
 import { setHelpSections } from '../lib/help.js';
 import { createWorktree, isGitRepo, hasUncommittedChanges, removeWorktree, } from '../lib/teams/worktree.js';
-import { isVersionInstalled, resolveVersionAlias, resolveVersionAliasLoose } from '../lib/versions.js';
+import { isVersionInstalled, resolveVersion, resolveVersionAlias, resolveVersionAliasLoose, verifyInstalledBinaryLaunches } from '../lib/versions.js';
 import { AGENTS, warnAgentDeprecated } from '../lib/agents.js';
 import { discoverSessions, parseTimeFilter, resolveSessionById } from '../lib/session/discover.js';
+import { renderSessionLog } from './sessions.js';
 import { buildPreview as buildSessionPreview } from './sessions-picker.js';
 import { parseExecEnv } from '../lib/exec.js';
 import { teamPicker, printTeamTable } from './teams-picker.js';
@@ -1651,8 +1652,9 @@ export function registerTeamsCommands(program) {
     teams
         .command('logs [teammate]')
         .alias('log')
-        .description("Read a teammate's raw log output. Accepts positional name, --teammate <name>, UUID, or UUID prefix.")
-        .option('-n, --tail <n>', 'Show only the last N lines instead of the full log')
+        .description("Show a teammate's concise session summary. --full (or -n <lines>) for the raw stdout. Accepts positional name, --teammate <name>, UUID, or UUID prefix.")
+        .option('-n, --tail <n>', 'Show the last N lines of raw stdout instead of the concise summary')
+        .option('-m, --full', 'Show the full raw stdout log instead of the concise summary')
         .option('--team <team>', 'Disambiguate when the same name appears in multiple teams')
         .option('--teammate <name>', 'Teammate name (alias for the positional arg; useful for scripts)')
         .action(async (ref, opts) => {
@@ -1682,14 +1684,28 @@ export function registerTeamsCommands(program) {
             }
             agentId = resolved.agentId;
         }
+        // Concise by default: a teammate's agentId IS its agent session id (passed
+        // as --session-id at launch), so render the same summary digest as
+        // `agents sessions <id>`. --full / -n <lines> opt into the raw stdout.log.
+        if (!opts.full && !opts.tail) {
+            const all = await discoverSessions({ all: true, limit: 5000 });
+            const matches = resolveSessionById(all, agentId);
+            if (matches.length > 0) {
+                await renderSessionLog(matches[0], 'summary');
+                return;
+            }
+            // No resolvable session (e.g. a non-Claude teammate) — fall through to a
+            // bounded tail of raw stdout rather than dumping the whole file.
+        }
         const logPath = path.join(base, agentId, 'stdout.log');
         try {
             const content = await fs.readFile(logPath, 'utf-8');
-            if (!opts.tail) {
+            if (opts.full) {
                 process.stdout.write(content);
                 return;
             }
-            const n = Math.max(1, parseInt(opts.tail, 10) || 50);
+            // Default tail size keeps an un-resolvable teammate's glance bounded too.
+            const n = opts.tail ? Math.max(1, parseInt(opts.tail, 10) || 50) : 40;
             const lines = content.split('\n');
             process.stdout.write(lines.slice(-n).join('\n'));
         }
@@ -1705,6 +1721,28 @@ export function registerTeamsCommands(program) {
         .option('--json', 'Output machine-readable JSON')
         .action(async (opts) => {
         const info = checkAllClis();
+        // Deep integrity probe. `checkAllClis` reports presence (shim + stub guard),
+        // but a GUTTED native binary (JS wrapper present, platform binary missing —
+        // the codex/kimi optional-dep partial-extract failure) still passes that. So
+        // actually launch the resolved default version and, if it won't run, flip the
+        // agent to not-installed with a repair hint — otherwise doctor says "ready"
+        // and the teammate ENOENTs at spawn. Parallel; win32 is treated as healthy by
+        // verifyInstalledBinaryLaunches.
+        await Promise.all(Object.entries(info).map(async ([name, entry]) => {
+            if (!entry.installed)
+                return;
+            const agent = name;
+            const version = resolveVersion(agent);
+            if (!version)
+                return;
+            const health = await verifyInstalledBinaryLaunches(agent, version);
+            if (!health.ok) {
+                entry.installed = false;
+                entry.path = null;
+                entry.error = `${AGENTS[agent]?.cliCommand ?? name}@${version} is installed but its binary won't launch`
+                    + `${health.detail ? ` (${health.detail})` : ''}. Repair: agents add ${agent}@${version}`;
+            }
+        }));
         // Advisory enrichment only. Sign-in detection is UNRELIABLE, so it never
         // changes the authoritative installed/ready column — it annotates. And an
         // agent that is actually running in a team is treated as signed in