@phnx-labs/agents-cli 1.20.49 → 1.20.51

package/dist/lib/browser/drivers/ssh.d.ts

@@ -25,26 +25,44 @@ export declare function connectSSH(endpoint: string, profile: BrowserProfile): P
  */
 export declare function encodePowerShell(script: string): string;
 /**
- * The PowerShell that launches the browser on a Windows remote. Two hard
+ * The PowerShell that launches the browser on a Windows remote. Three hard
  * requirements shaped this:
  *   1. The browser must OUTLIVE the ssh session. Windows OpenSSH terminates
  *      the session's job tree on disconnect, which reaps both `start /B` and
- *      `Start-Process` children (verified against a real box). WMI
- *      `Win32_Process.Create` spawns under the WMI provider service instead,
- *      so the process survives after we drop the ssh connection and reconnect
- *      over the CDP tunnel.
- *   2. A distinct `--user-data-dir` so a fresh instance bound to the debugging
+ *      `Start-Process` children (verified against a real box). A scheduled
+ *      task runs under the Task Scheduler service, so the process survives
+ *      after we drop the ssh connection and reconnect over the CDP tunnel.
+ *   2. The browser must run in the user's INTERACTIVE session. The previous
+ *      WMI `Win32_Process.Create` launch also survived disconnect, but it
+ *      spawned Edge in session 0 (the services session): the CDP socket bound
+ *      and accepted, yet the DevTools server never initialized — every
+ *      /json/version probe hung forever and DevToolsActivePort was never
+ *      written (verified against a real box, Edg/150). A scheduled task
+ *      registered and started by the logged-on user runs in that user's
+ *      interactive session, where DevTools comes up normally.
+ *   3. A distinct `--user-data-dir` so a fresh instance bound to the debugging
  *      port comes up even when the user already has Edge open.
  * CreateProcess ignores App Paths, so we resolve the real `.exe` from the
- * registry at runtime rather than relying on a bare `msedge` name.
+ * registry at runtime rather than relying on a bare `msedge` name. The task is
+ * unregistered immediately after start — the browser keeps running; nothing
+ * lingers in the scheduler.
  */
 export declare function buildWindowsLaunchScript(browserType: string, port: number, customBinary?: string): string;
-/** The PowerShell that kills whatever holds the CDP port on a Windows remote. */
+/**
+ * The PowerShell that kills whatever holds the CDP port on a Windows remote.
+ * Tree-kill (`taskkill /T`), not `Stop-Process`: Chromium is multi-process, and
+ * killing only the port-owning main process orphans its children. The orphans
+ * keep the profile's SingletonLock, so every later launch against the same
+ * `--user-data-dir` delegates to the zombie tree, exits, and never binds the
+ * CDP port — `browser start --host` then fails until someone hand-cleans the
+ * box (found live on win-mini by the #561 e2e suite).
+ */
 export declare function buildWindowsKillScript(port: number): string;
 /**
  * Build the remote command that launches the browser detached with a CDP port.
  * POSIX backgrounds the `.app` binary with `… &`; Windows resolves the exe and
- * spawns it via WMI (encoded PowerShell) so it survives the ssh session.
+ * starts it via an interactive one-shot scheduled task (encoded PowerShell)
+ * so it survives the ssh session AND serves CDP (session 0 never does).
  */
 export declare function buildLaunchCmd(remoteOs: RemoteOs, browserType: string, port: number, customBinary?: string): string;
 /**
@@ -57,7 +75,7 @@ export declare function ensureRemoteBrowser(user: string, host: string, browserT
 export declare function restartRemoteBrowser(user: string, host: string, browserType: string, port: number, remoteOs: RemoteOs, customBinary?: string): Promise<void>;
 /**
  * Kill the remote browser holding the CDP port. Invoked on stop/cleanup so the
- * WMI-spawned (Windows) / detached (posix) browser process is not orphaned when
+ * task-launched (Windows) / detached (posix) browser process is not orphaned when
  * the ssh tunnel is torn down — killing only the tunnel left it running on
  * win-mini after every `browser stop`. Best-effort: never rejects.
  */

package/dist/lib/browser/drivers/ssh.js

@@ -5,8 +5,11 @@ import { getPortOccupant } from '../chrome.js';
 import { parseEndpointUrl } from '../profiles.js';
 import { writeProfileRuntime, clearProfileRuntime } from '../runtime-state.js';
 // shellQuote lives in the shared ssh-exec helper (single choke point); re-export
-// so existing importers of `shellQuote` from this module keep working.
-import { shellQuote } from '../../ssh-exec.js';
+// so existing importers of `shellQuote` from this module keep working. SSH_OPTS
+// is the shared hardened baseline (BatchMode + ConnectTimeout + keepalive) —
+// reuse it so the raw-ssh spawns below fail fast on an unreachable host instead
+// of hanging on the default ~127s TCP timeout, rather than re-listing options.
+import { shellQuote, SSH_OPTS } from '../../ssh-exec.js';
 export { shellQuote };
 // The `ssh -L` tunnel spawn is shared with `agents computer --host`; it lives in
 // the single ssh-tunnel helper. Calling it with no options preserves this
@@ -168,18 +171,27 @@ export function encodePowerShell(script) {
     return `powershell -NoProfile -EncodedCommand ${encodePwshBase64(script)}`;
 }
 /**
- * The PowerShell that launches the browser on a Windows remote. Two hard
+ * The PowerShell that launches the browser on a Windows remote. Three hard
  * requirements shaped this:
  *   1. The browser must OUTLIVE the ssh session. Windows OpenSSH terminates
  *      the session's job tree on disconnect, which reaps both `start /B` and
- *      `Start-Process` children (verified against a real box). WMI
- *      `Win32_Process.Create` spawns under the WMI provider service instead,
- *      so the process survives after we drop the ssh connection and reconnect
- *      over the CDP tunnel.
- *   2. A distinct `--user-data-dir` so a fresh instance bound to the debugging
+ *      `Start-Process` children (verified against a real box). A scheduled
+ *      task runs under the Task Scheduler service, so the process survives
+ *      after we drop the ssh connection and reconnect over the CDP tunnel.
+ *   2. The browser must run in the user's INTERACTIVE session. The previous
+ *      WMI `Win32_Process.Create` launch also survived disconnect, but it
+ *      spawned Edge in session 0 (the services session): the CDP socket bound
+ *      and accepted, yet the DevTools server never initialized — every
+ *      /json/version probe hung forever and DevToolsActivePort was never
+ *      written (verified against a real box, Edg/150). A scheduled task
+ *      registered and started by the logged-on user runs in that user's
+ *      interactive session, where DevTools comes up normally.
+ *   3. A distinct `--user-data-dir` so a fresh instance bound to the debugging
  *      port comes up even when the user already has Edge open.
  * CreateProcess ignores App Paths, so we resolve the real `.exe` from the
- * registry at runtime rather than relying on a bare `msedge` name.
+ * registry at runtime rather than relying on a bare `msedge` name. The task is
+ * unregistered immediately after start — the browser keeps running; nothing
+ * lingers in the scheduler.
  */
 export function buildWindowsLaunchScript(browserType, port, customBinary) {
     let exeStmts;
@@ -211,21 +223,42 @@ export function buildWindowsLaunchScript(browserType, port, customBinary) {
     // source — a test asserts CDP is never opened to `*`.
     return [
         ...exeStmts,
-        `$cl = '"' + $exe + '" --remote-debugging-port=${port}` +
+        // First-run / default-browser modals block automation (same rationale as
+        // the local launcher in chrome.ts), and the crash-restore bubble is worse
+        // here: `browser stop` hard-kills the remote process, so the NEXT launch
+        // against the same --user-data-dir marks the profile crashed and session
+        // restore swaps the initial page target — closing its CDP websocket while
+        // a command is pending (reproduced live: Page.captureScreenshot rejected
+        // with "CDP connection closed" on every reused-profile launch).
+        `$args = '--remote-debugging-port=${port}` +
             ` --remote-allow-origins=http://127.0.0.1:${port}` +
+            ` --no-first-run --no-default-browser-check` +
+            ` --hide-crash-restore-bubble --disable-session-crashed-bubble` +
             ` --disable-background-timer-throttling --user-data-dir="' + $env:TEMP + '\\agents-browser-${port}"'`,
-        `Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = $cl } | Out-Null`,
+        `$action = New-ScheduledTaskAction -Execute $exe -Argument $args`,
+        `Register-ScheduledTask -TaskName 'agents-browser-${port}' -Action $action -Force | Out-Null`,
+        `Start-ScheduledTask -TaskName 'agents-browser-${port}'`,
+        `Unregister-ScheduledTask -TaskName 'agents-browser-${port}' -Confirm:$false`,
     ].join('; ');
 }
-/** The PowerShell that kills whatever holds the CDP port on a Windows remote. */
+/**
+ * The PowerShell that kills whatever holds the CDP port on a Windows remote.
+ * Tree-kill (`taskkill /T`), not `Stop-Process`: Chromium is multi-process, and
+ * killing only the port-owning main process orphans its children. The orphans
+ * keep the profile's SingletonLock, so every later launch against the same
+ * `--user-data-dir` delegates to the zombie tree, exits, and never binds the
+ * CDP port — `browser start --host` then fails until someone hand-cleans the
+ * box (found live on win-mini by the #561 e2e suite).
+ */
 export function buildWindowsKillScript(port) {
     return (`Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue ` +
-        `| ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }`);
+        `| ForEach-Object { taskkill /PID $_.OwningProcess /T /F 2>$null } | Out-Null`);
 }
 /**
  * Build the remote command that launches the browser detached with a CDP port.
  * POSIX backgrounds the `.app` binary with `… &`; Windows resolves the exe and
- * spawns it via WMI (encoded PowerShell) so it survives the ssh session.
+ * starts it via an interactive one-shot scheduled task (encoded PowerShell)
+ * so it survives the ssh session AND serves CDP (session 0 never does).
  */
 export function buildLaunchCmd(remoteOs, browserType, port, customBinary) {
     if (remoteOs === 'windows') {
@@ -266,10 +299,12 @@ export async function ensureRemoteBrowser(user, host, browserType, port, remoteO
         // ignored and this resolved on close regardless of exit code, so failures
         // were swallowed and only re-emerged 8s later as a generic
         // "SSH tunnel failed to establish".
+        // Options BEFORE the target (matching `sshExec`): OpenSSH's BSD getopt on
+        // macOS stops at the first non-option, so any `-o` after `user@host` would
+        // be swallowed into the remote command instead of applied.
         const child = spawn('ssh', [
+            ...SSH_OPTS,
             `${user}@${host}`,
-            '-o',
-            'BatchMode=yes',
             remoteCmd,
         ], { stdio: ['ignore', 'ignore', 'pipe'], windowsHide: true });
         let stderr = '';
@@ -319,7 +354,7 @@ export async function restartRemoteBrowser(user, host, browserType, port, remote
 }
 /**
  * Kill the remote browser holding the CDP port. Invoked on stop/cleanup so the
- * WMI-spawned (Windows) / detached (posix) browser process is not orphaned when
+ * task-launched (Windows) / detached (posix) browser process is not orphaned when
  * the ssh tunnel is torn down — killing only the tunnel left it running on
  * win-mini after every `browser stop`. Best-effort: never rejects.
  */
@@ -328,7 +363,11 @@ export function killRemoteBrowser(user, host, remoteOs, port) {
 }
 function runSSHCommand(user, host, cmd) {
     return new Promise((resolve) => {
-        const child = spawn('ssh', [`${user}@${host}`, '-o', 'BatchMode=yes', cmd], {
+        // Reuse the shared hardened baseline so a hung TCP SYN to an unreachable
+        // host is bounded by ConnectTimeout (the local 3s kill below only bounds a
+        // connected-but-slow command, not the connect itself). Options precede the
+        // target — see ensureRemoteBrowser.
+        const child = spawn('ssh', [...SSH_OPTS, `${user}@${host}`, cmd], {
             stdio: 'ignore',
             windowsHide: true,
         });

package/dist/lib/browser/refs.js

@@ -1,3 +1,4 @@
+import { truncate } from '../format.js';
 /** Snapshot the stable descriptor for every ref in a freshly-built node map. */
 export function describeRefs(nodeMap) {
     return Array.from(nodeMap.values()).map((n) => ({
@@ -175,11 +176,6 @@ export async function getRefs(cdp, sessionId, opts = {}) {
     }
     return { refs: lines.join('\n'), nodeMap, opts: { interactive, limit } };
 }
-function truncate(s, max) {
-    if (s.length <= max)
-        return s;
-    return s.slice(0, max - 1) + '…';
-}
 export async function resolveRefToCoords(cdp, sessionId, nodeMap, ref) {
     const node = nodeMap.get(ref);
     if (!node)

package/dist/lib/cli-resources.d.ts

@@ -133,5 +133,3 @@ export declare function listCliStatus(cwd?: string): {
     statuses: CliStatus[];
     errors: CliManifestError[];
 };
-/** Names of CLIs that are declared but not currently installed on the host. */
-export declare function getMissingClis(cwd?: string): CliManifest[];

package/dist/lib/cli-resources.js

@@ -21,6 +21,7 @@ import * as path from 'path';
 import { spawnSync } from 'child_process';
 import * as yaml from 'yaml';
 import { listResources, resolveResource } from './resources.js';
+import { composeWin32CommandLine } from './platform/index.js';
 // ─── Validation primitives ───────────────────────────────────────────────────
 /** Token allowed inside `check:` strings — letters, digits, underscore, dot, slash, dash. */
 const SAFE_CHECK_TOKEN = /^[a-zA-Z0-9_./-]+$/;
@@ -253,19 +254,27 @@ export function resolveCliManifest(name, cwd) {
 // ─── Host detection ──────────────────────────────────────────────────────────
 /**
  * Return true if a command resolves on the current PATH. Uses POSIX `command -v`
- * via spawn argv (no shell); results are cached for the lifetime of the process.
+ * (or `where` on Windows) via spawn argv (no shell); results are cached for the
+ * lifetime of the process.
  */
 const cmdExistsCache = new Map();
 export function hasCommand(cmd) {
     if (cmdExistsCache.has(cmd))
         return cmdExistsCache.get(cmd);
-    // `command` is a shell builtin on most POSIX shells; invoking `sh -c 'command -v X'`
-    // with X as an *argument* (not interpolated) is the safe path. `cmd` may be passed
-    // by callers that haven't validated it, so we route via argv to neutralize metas.
-    const result = spawnSync('sh', ['-c', 'command -v "$1" >/dev/null 2>&1', '_', cmd], {
-        stdio: 'ignore',
-    });
-    const ok = result.status === 0;
+    let ok;
+    if (process.platform === 'win32') {
+        // `sh` only exists when Git Bash is installed; `where` is the native PATH
+        // probe (resolves .exe/.cmd/.bat via PATHEXT). Argv keeps `cmd` uninterpolated.
+        ok = spawnSync('where', [cmd], { stdio: 'ignore' }).status === 0;
+    }
+    else {
+        // `command` is a shell builtin on most POSIX shells; invoking `sh -c 'command -v X'`
+        // with X as an *argument* (not interpolated) is the safe path. `cmd` may be passed
+        // by callers that haven't validated it, so we route via argv to neutralize metas.
+        ok = spawnSync('sh', ['-c', 'command -v "$1" >/dev/null 2>&1', '_', cmd], {
+            stdio: 'ignore',
+        }).status === 0;
+    }
     cmdExistsCache.set(cmd, ok);
     return ok;
 }
@@ -280,7 +289,19 @@ export function isCliInstalled(manifest) {
         return hasCommand(c.cmd);
     }
     const result = spawnSync(c.cmd, c.args, { stdio: 'ignore', timeout: 10_000 });
-    return result.status === 0;
+    if (result.status === 0)
+        return true;
+    // On Windows the PATH entry point is often a `.cmd`/`.bat` shim (npm installs,
+    // script installers), which Node refuses to spawn without a shell (ENOENT /
+    // EINVAL). A failed *spawn* — not a failed run — gets one retry through the
+    // shell, as a single pre-composed line (DEP0190-safe). Check tokens are
+    // SAFE_CHECK_TOKEN-validated at parse time, so the line cannot inject.
+    if (process.platform === 'win32' && result.error) {
+        const line = composeWin32CommandLine(c.cmd, c.args);
+        const retry = spawnSync(line, { stdio: 'ignore', timeout: 10_000, shell: true });
+        return retry.status === 0;
+    }
+    return false;
 }
 // ─── Method selection ────────────────────────────────────────────────────────
 /**
@@ -480,7 +501,3 @@ export function listCliStatus(cwd) {
     }));
     return { statuses, errors };
 }
-/** Names of CLIs that are declared but not currently installed on the host. */
-export function getMissingClis(cwd) {
-    return listCliStatus(cwd).statuses.filter((s) => !s.installed).map((s) => s.manifest);
-}

package/dist/lib/cloud/rush.d.ts

@@ -75,30 +75,6 @@ export declare function buildDispatchBody(input: {
      */
     images?: ImageAttachment[] | null;
 }): Record<string, unknown>;
-/** A single account registered in Rush Cloud's multi-account rotation pool. */
-export interface RemoteAccount {
-    id: string;
-    provider: string;
-    email: string | null;
-    subscription_type: string | null;
-    five_hour_pct: number | null;
-    seven_day_pct: number | null;
-    usage_fetched_at: string | null;
-    created_at: string;
-}
-/** Fetch all Claude accounts in this user's Rush Cloud rotation pool (no tokens). */
-export declare function listRemoteAccounts(): Promise<RemoteAccount[]>;
-/**
- * Register a CLAUDE_CODE_OAUTH_TOKEN with Rush Cloud's rotation pool.
- * The server validates the token against the Anthropic usage API and stores it
- * encrypted in Vault. Returns the account metadata (no token).
- */
-export declare function addRemoteAccount(provider: string, pastedToken: string): Promise<RemoteAccount & {
-    five_hour_pct: number | null;
-    seven_day_pct: number | null;
-}>;
-/** Remove a Claude account from Rush Cloud's rotation pool by its ID. */
-export declare function removeRemoteAccount(id: string): Promise<void>;
 export declare class RushCloudProvider implements CloudProvider {
     id: "rush";
     name: string;

package/dist/lib/cloud/rush.js

@@ -294,37 +294,6 @@ export function buildDispatchBody(input) {
     }
     return body;
 }
-/** Fetch all Claude accounts in this user's Rush Cloud rotation pool (no tokens). */
-export async function listRemoteAccounts() {
-    const token = readToken();
-    const res = await api('GET', '/api/v1/cloud-accounts', token);
-    if (!res.ok) {
-        throw new Error(`Failed to list accounts (${res.status}): ${sanitizeErrorBody(await res.text())}`);
-    }
-    const data = await res.json();
-    return data.accounts ?? [];
-}
-/**
- * Register a CLAUDE_CODE_OAUTH_TOKEN with Rush Cloud's rotation pool.
- * The server validates the token against the Anthropic usage API and stores it
- * encrypted in Vault. Returns the account metadata (no token).
- */
-export async function addRemoteAccount(provider, pastedToken) {
-    const token = readToken();
-    const res = await api('POST', '/api/v1/cloud-accounts', token, { provider, token: pastedToken });
-    if (!res.ok) {
-        throw new Error(`Failed to add account (${res.status}): ${sanitizeErrorBody(await res.text())}`);
-    }
-    return await res.json();
-}
-/** Remove a Claude account from Rush Cloud's rotation pool by its ID. */
-export async function removeRemoteAccount(id) {
-    const token = readToken();
-    const res = await api('DELETE', `/api/v1/cloud-accounts/${encodeURIComponent(id)}`, token);
-    if (!res.ok) {
-        throw new Error(`Failed to remove account (${res.status}): ${sanitizeErrorBody(await res.text())}`);
-    }
-}
 export class RushCloudProvider {
     id = 'rush';
     name = 'Rush Cloud';

package/dist/lib/crabbox/cli.js

@@ -209,7 +209,10 @@ export function crabboxRunScript(slug, script, opts = {}) {
 /** Release the lease / delete the box. Best-effort; never throws. */
 export function crabboxStop(slug, opts = {}) {
     try {
-        const r = spawnSync('crabbox', ['stop', '--id', slug], { encoding: 'utf-8', env: crabboxEnv(opts) });
+        // Positional target: crabbox's stop subcommand has no --id flag (unlike
+        // status/run/ssh) — `stop --id <slug>` dies with "flag provided but not
+        // defined: -id" and the box leaks past the run it was leased for.
+        const r = spawnSync('crabbox', ['stop', slug], { encoding: 'utf-8', env: crabboxEnv(opts) });
         return r.status === 0;
     }
     catch {

package/dist/lib/crabbox/lease.js

@@ -12,6 +12,34 @@ import { buildCredentialScript } from './runtimes.js';
 function q(s) {
     return "'" + s.replace(/'/g, "'\\''") + "'";
 }
+/**
+ * Bash snippet that guarantees `agents` is runnable on the box. Fresh crabbox
+ * images ship without node, and the box user may not own the global npm prefix,
+ * so everything installs user-level under ~/.local (node from the official
+ * latest-v22.x tarball to satisfy engines.node >=22.5.0). Exits 96 with a
+ * diagnostic when the CLI still isn't runnable — a silent `|| true` here used
+ * to surface only as `agents: command not found` deep in the script.
+ */
+const ENSURE_AGENTS_CLI = [
+    'export PATH="$HOME/.local/bin:$PATH"',
+    'if ! command -v node >/dev/null 2>&1; then',
+    '  case "$(uname -m)" in aarch64|arm64) narch=arm64;; *) narch=x64;; esac',
+    '  nver=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ | grep -oE "v22\\.[0-9]+\\.[0-9]+" | head -1)',
+    '  mkdir -p "$HOME/.local"',
+    '  curl -fsSL "https://nodejs.org/dist/latest-v22.x/node-$nver-linux-$narch.tar.xz" | tar -xJ -C "$HOME/.local" --strip-components=1',
+    'fi',
+    'if ! command -v agents >/dev/null 2>&1; then',
+    '  npm config set prefix "$HOME/.local" >/dev/null 2>&1 || true',
+    '  npm install -g @phnx-labs/agents-cli >/dev/null 2>&1',
+    'fi',
+    'if ! command -v agents >/dev/null 2>&1; then',
+    '  echo "lease bootstrap: agents-cli install failed (node: $(command -v node || echo missing))" >&2',
+    '  exit 96',
+    'fi',
+    // Same first-run guard the hosts bootstrap uses (hosts/ready.ts) — a fresh
+    // install refuses `agents run` with "agents-cli is not set up" until setup ran.
+    'if [ ! -d "$HOME/.agents/.system" ]; then agents setup >/dev/null 2>&1 || true; fi',
+].join('\n');
 /**
  * Build the single bootstrap script run on the box: ensure agents-cli, install
  * the picked runtime CLIs, write their credentials, run the agent, then shred
@@ -35,7 +63,7 @@ export function buildBootstrapScript(opts) {
     const installRuntimes = opts.runtimes.map((id) => `agents add ${q(id)} >/dev/null 2>&1 || true`).join('\n');
     return [
         'set -uo pipefail',
-        'if ! command -v agents >/dev/null 2>&1; then npm install -g @phnx-labs/agents-cli >/dev/null 2>&1 || true; fi',
+        ENSURE_AGENTS_CLI,
         installRuntimes,
         credScript,
         `${runParts.join(' ')}`,

package/dist/lib/daemon.js

@@ -393,6 +393,45 @@ export async function runDaemon() {
     };
     const healInterval = setInterval(() => { void runHealCheck(); }, 6 * 60 * 60_000);
     const healKickoff = setTimeout(() => { void runHealCheck(); }, 30_000);
+    // Auto-dispatch: for any managed project that has opted in (autoDispatch:true +
+    // maxAgents>0 in ~/.agents/factory/projects.json), pick up Linear tickets that
+    // are delegated to an agent and still in Todo, and DISPATCH each through
+    // agents-cli's own cloud-provider layer (resolveProvider().dispatch(), same as
+    // `agents cloud run`) — then mark it Doing so it isn't re-picked. Capped at
+    // maxAgents concurrent per project. No hidden Prix dependency: Rush is one
+    // provider among rush/codex/factory, pinned per-project via `provider`. OFF
+    // unless a project opts in; no opted-in project or no LINEAR_API_KEY is a clean
+    // no-op. Overlap-guarded like the probes above. ~every 3 min.
+    let autoDispatching = false;
+    const runAutoDispatch = async () => {
+        if (autoDispatching)
+            return;
+        autoDispatching = true;
+        try {
+            const { readAutoDispatchProjects, isEligible, autoDispatchTick } = await import('./auto-dispatch.js');
+            const projects = readAutoDispatchProjects();
+            if (!projects.some(isEligible))
+                return; // opt-in: nothing enabled → skip
+            const { createLinearGateway } = await import('./auto-dispatch-linear.js');
+            const linear = createLinearGateway();
+            if (!linear)
+                return; // no LINEAR_API_KEY configured → skip
+            const { createProviderDispatcher } = await import('./auto-dispatch-provider.js');
+            const dispatcher = createProviderDispatcher();
+            const dispatched = await autoDispatchTick({ projects, linear, dispatcher, log: (lvl, m) => log(lvl, m) });
+            if (dispatched.length) {
+                log('INFO', `auto-dispatch: started ${dispatched.length} delegated ticket(s): ${dispatched.map((d) => d.identifier).join(', ')}`);
+            }
+        }
+        catch (err) {
+            log('ERROR', `auto-dispatch failed: ${err.message}`);
+        }
+        finally {
+            autoDispatching = false;
+        }
+    };
+    const autoDispatchInterval = setInterval(() => { void runAutoDispatch(); }, 3 * 60_000);
+    const autoDispatchKickoff = setTimeout(() => { void runAutoDispatch(); }, 45_000);
     // Device probe: refresh registered devices' reachability and detect newly
     // appeared tailnet nodes, dropping a sentinel per pending device so the
     // menu-bar helper can surface "NEW DEVICES → Register / Ignore". Refresh mode
@@ -500,6 +539,8 @@ export async function runDaemon() {
         clearInterval(syncInterval);
         clearInterval(healInterval);
         clearTimeout(healKickoff);
+        clearInterval(autoDispatchInterval);
+        clearTimeout(autoDispatchKickoff);
         clearInterval(deviceProbeInterval);
         clearTimeout(deviceProbeKickoff);
         clearInterval(tmuxReconcileInterval);

package/dist/lib/exec.js

@@ -16,6 +16,7 @@ import { resolveModel, buildReasoningFlags } from './models.js';
 import { maybeRotate, createTimer, redactPrompt, redactArgs } from './events.js';
 import { sanitizeProcessEnv } from './secrets/bundles.js';
 import { getShimsDir } from './state.js';
+import { readCodexConfiguredModel } from './shims.js';
 import { writePidSessionEntry, extractSessionIdArg } from './session/pid-registry.js';
 import { recordRunName } from './session/run-names.js';
 import { mailboxDir, isValidMailboxId } from './mailbox.js';
@@ -306,12 +307,12 @@ export const AGENT_COMMANDS = {
         promptFlag: 'positional',
         resume: { subcommand: 'resume' },
         modeFlags: {
-            // NOTE: codex has no read-only mode in --sandbox; 'plan' here means
-            // "workspace-write but no auto-approval" — closer to plan-as-restraint.
-            // True read-only requires --sandbox read-only which we haven't wired.
-            plan: ['--sandbox', 'workspace-write'],
-            edit: ['--sandbox', 'workspace-write', '--dangerously-bypass-approvals-and-sandbox'],
-            // skip drops the sandbox entirely; --dangerously-bypass-approvals-and-sandbox then approves anything.
+            plan: ['--sandbox', 'read-only'],
+            // Sandboxed writes inside the workspace. Network stays on (workspace-write
+            // disables it by default) so edit-mode runs can still use git/gh/package
+            // installs. No approval bypass here — only `skip` drops the guardrails.
+            edit: ['--sandbox', 'workspace-write', '-c', 'sandbox_workspace_write.network_access=true'],
+            // skip = codex --yolo: drops the sandbox entirely and approves anything.
             skip: ['--dangerously-bypass-approvals-and-sandbox'],
         },
         jsonFlags: ['--json'],
@@ -562,14 +563,25 @@ export function buildExecCommand(options) {
         throw new Error(`Internal error: ${options.agent} declares '${resolvedMode}' in capabilities.modes but has no entry in AGENT_COMMANDS.modeFlags.${resolvedMode}.`);
     }
     if (resumeSpec && 'subcommand' in resumeSpec) {
-        // codex `exec resume` / `resume` does NOT accept `--sandbox <mode>` (only the
-        // bypass flag, verified against `codex exec resume --help`). So the standard
-        // codex modeFlags can't be reused on resume. A non-plan HEADLESS resume needs
-        // the bypass or it stalls on approval prompts; plan and interactive resume
-        // inherit codex's default sandbox and pass no flag.
-        if (!interactive && resolvedMode !== 'plan') {
+        if (resolvedMode === 'skip') {
+            // skip = yolo on resume too; both `codex resume` (TUI) and
+            // `codex exec resume` accept the bypass flag.
             cmd.push('--dangerously-bypass-approvals-and-sandbox');
         }
+        else if (interactive) {
+            // `codex resume` (TUI) accepts the same -s/--sandbox flags as a fresh run.
+            cmd.push(...modeFlags);
+        }
+        else {
+            // `codex exec resume` rejects `--sandbox <mode>` (verified against
+            // `codex exec resume --help` on 0.142.5), but takes -c config overrides —
+            // map the mode through sandbox_mode so a non-skip resume never gets the
+            // approval/sandbox bypass.
+            cmd.push('-c', `sandbox_mode=${resolvedMode === 'plan' ? 'read-only' : 'workspace-write'}`);
+            if (resolvedMode !== 'plan') {
+                cmd.push('-c', 'sandbox_workspace_write.network_access=true');
+            }
+        }
     }
     else if (options.agent === 'kimi' && !interactive) {
         // kimi's headless prompt mode (`-p`/`--prompt`) is self-contained and REFUSES
@@ -610,18 +622,25 @@ export function buildExecCommand(options) {
     else if (options.sessionId && options.agent === 'claude') {
         cmd.push('--session-id', options.sessionId);
     }
-    // Add model (only if explicitly provided by user)
-    if (options.model && template.modelFlag) {
+    // Add model. Prefer the user's explicit --model. Otherwise, for Codex, fall
+    // back to the model configured in the user's active ~/.codex/config.toml:
+    // Codex runs under a per-version CODEX_HOME (see buildExecEnv) that may not
+    // carry that setting, so without this it silently defaults to gpt-5.3-codex,
+    // which a ChatGPT-tier account can't use (HTTP 400). Forwarding keeps the
+    // user's default model setup for both `agents run` and `agents teams`.
+    const effectiveModel = options.model
+        ?? (options.agent === 'codex' ? readCodexConfiguredModel() : undefined);
+    if (effectiveModel && template.modelFlag) {
         const effectiveVersion = options.version || resolveVersion(options.agent, options.cwd || process.cwd());
         if (effectiveVersion) {
-            const resolved = resolveModel(options.agent, effectiveVersion, options.model);
+            const resolved = resolveModel(options.agent, effectiveVersion, effectiveModel);
             if (resolved.warning) {
                 process.stderr.write(`[agents] ${resolved.warning}\n`);
             }
             cmd.push(template.modelFlag, resolved.forwarded);
         }
         else {
-            cmd.push(template.modelFlag, options.model);
+            cmd.push(template.modelFlag, effectiveModel);
         }
     }
     // Add JSON output flags if requested
@@ -651,8 +670,14 @@ export function buildExecCommand(options) {
             cmd.push(template.promptFlag, options.prompt);
         }
     }
-    // Claude-specific: add dirs
-    if (options.agent === 'claude' && options.addDirs) {
+    // Extra writable dirs. Claude and Codex both take `--add-dir`; for Codex it
+    // widens the workspace-write sandbox (teams relies on this to let teammates
+    // write ~/.agents), so it must actually be forwarded — it used to be
+    // claude-only, silently dropped for codex and masked by edit mode carrying
+    // the approval/sandbox bypass. Codex's resume forms reject --add-dir, so
+    // skip it there (claude's flag-based resume accepts it).
+    if (options.addDirs &&
+        (options.agent === 'claude' || (options.agent === 'codex' && !options.resume))) {
         for (const dir of options.addDirs) {
             cmd.push('--add-dir', dir);
         }

package/dist/lib/format.d.ts

@@ -0,0 +1,38 @@
+/** Print `msg` in red to stderr and exit the process with `code`. */
+export declare function die(msg: string, code?: number): never;
+/**
+ * Truncate `s` to at most `max` characters, appending a single-char ellipsis
+ * (`…`) when shortened. Character-count based (not ANSI/width aware — use
+ * `truncateToWidth` from `session/width.ts` for colored strings).
+ */
+export declare function truncate(s: string, max: number): string;
+/**
+ * Format an ISO timestamp as a compact relative age: "just now", "5m ago",
+ * "3h ago", "2d ago". The canonical short form — the long "5 minutes ago"
+ * variant that once lived in `cloud.ts` is deliberately dropped. (For the
+ * session-list long form with calendar fallback, see
+ * `formatRelativeTime` in `session/relative-time.ts`.)
+ */
+export declare function relTime(iso: string): string;
+/** Format a millisecond duration as "45s", "3m", "2h 5m", "1d 3h". */
+export declare function humanDuration(ms: number): string;
+/**
+ * Visible column width of `s`, ignoring ANSI SGR color codes (e.g. chalk
+ * wrappers). Matches the full CSI sequence including the `\x1b` escape.
+ */
+export declare function visibleWidth(s: string): number;
+/** Pad `s` with trailing spaces to a target character width. */
+export declare function padRight(s: string, width: number): string;
+/** Pad `s` with trailing spaces to a target *visible* width (ANSI-aware). */
+export declare function padVisible(s: string, width: number): string;
+/** True when `--json` was passed or stdout is not a TTY. */
+export declare function isJsonMode(opts: {
+    json?: boolean;
+}): boolean;
+/** Read all of stdin synchronously and return it UTF-8 decoded and trimmed. */
+export declare function readStdinSync(): string;
+/**
+ * Wrap `text` in an OSC 8 hyperlink to `filePath` (as a `file://` URL) when
+ * stdout is a TTY; otherwise return `text` unchanged.
+ */
+export declare function termLink(text: string, filePath: string): string;