@phnx-labs/agents-cli 1.20.50 → 1.20.52

package/dist/lib/session/state.js

@@ -17,6 +17,14 @@
 import { summarizeToolUse } from './parse.js';
 /** A healthy live session writes several times a minute; 2 min ⇒ "recently active". */
 const ACTIVE_WINDOW_MS = 2 * 60_000;
+/**
+ * A prose trailing question ("…?") is a HEURISTIC, so it decays: past this long
+ * with no session writes it stops classifying as waiting_input — otherwise a
+ * finished session that signed off with "anything else?" reads as needing input
+ * forever (RUSH-1522). The structural ExitPlanMode / AskUserQuestion signals are
+ * exempt: they are precise, still-unanswered decisions.
+ */
+const PROSE_QUESTION_FRESH_MS = 30 * 60_000;
 /** Claude tool names that structurally mean "the agent handed control back to you". */
 const PLAN_TOOL = 'ExitPlanMode';
 const ASK_TOOL = 'AskUserQuestion';
@@ -130,6 +138,69 @@ export function extractCreatedTicket(text) {
         return `#${gh[1]}`;
     return undefined;
 }
+/**
+ * Pull the plan markdown out of an `ExitPlanMode` tool_use event's args. The
+ * Claude tool schema is `{ plan: string }`; the transcript parser already
+ * lifts `input` onto `event.args`. Returns undefined for a missing/empty plan
+ * so consumers can rely on `plan?: string` truthiness.
+ */
+export function extractPlanText(args) {
+    const plan = args?.plan;
+    if (typeof plan !== 'string')
+        return undefined;
+    const trimmed = plan.trim();
+    return trimmed ? plan : undefined;
+}
+/**
+ * Structured question from a Claude `AskUserQuestion` tool call. Its input is
+ * `{ questions: [{ question, header, options: [{label, description}] }] }` and the
+ * whole thing is already parsed onto `event.args` by the transcript parser — this
+ * surfaces the first question + its options (instead of collapsing to a generic
+ * "Asked you a question"). The prompt is a select-list, so each option carries its
+ * 1-based selection digit as `key`.
+ */
+export function structuredQuestionFromAsk(args) {
+    const q = Array.isArray(args?.questions) ? args.questions[0] : undefined;
+    if (!q)
+        return undefined;
+    const text = oneLine(String(q.question ?? q.header ?? '')) || 'Asked you a question';
+    const raw = Array.isArray(q.options) ? q.options : [];
+    const options = [];
+    for (const o of raw) {
+        const label = typeof o === 'string' ? oneLine(o) : o?.label != null ? oneLine(String(o.label)) : '';
+        if (!label)
+            continue;
+        const description = typeof o === 'object' && o?.description != null ? oneLine(String(o.description)) : undefined;
+        options.push({ label, description, key: String(options.length + 1) });
+    }
+    return { text, reason: 'question', options: options.length ? options : undefined };
+}
+/**
+ * Canonical approve/deny choices for an interactive prompt that carries no
+ * agent-supplied option list: Claude's plan-review and permission dialogs. Approve
+ * is reliably option 1; deny/keep-planning maps to ESC, which cancels the prompt in
+ * every variant (2- or 3-option) — safer than guessing a digit that could differ.
+ */
+function planReviewQuestion() {
+    return {
+        text: 'Plan ready — review it',
+        reason: 'plan_review',
+        options: [
+            { label: 'Approve plan', key: '1' },
+            { label: 'Keep planning', key: 'esc' },
+        ],
+    };
+}
+function permissionQuestion(preview) {
+    return {
+        text: preview ? `Permission — ${preview}` : 'Waiting on a permission prompt',
+        reason: 'permission',
+        options: [
+            { label: 'Approve', key: '1' },
+            { label: 'Deny', key: 'esc' },
+        ],
+    };
+}
 /** Does an assistant message read as a question directed at the user? */
 function looksLikeQuestion(text) {
     const t = text.trim();
@@ -177,18 +248,27 @@ export function inferActivity(events, ctx = {}) {
     const lastToolUse = lastOf(meaningful, e => e.type === 'tool_use');
     // The most informative recent line: a message or tool call as-is, but for a
     // trailing tool_result/thinking show the tool *call* that produced it (its
-    // command) rather than a bare "↳ Bash".
+    // command), or — failing that — the last assistant message, rather than a bare
+    // "↳ Bash" or a content-free "thinking…". This is what stops a trailing thinking
+    // block from masking the real turn (the defect behind the "Thinking…" panel).
     const previewSource = !last
         ? undefined
         : last.type === 'message' || last.type === 'tool_use'
             ? last
-            : (lastToolUse ?? last);
+            : (lastToolUse ?? lastMsg ?? last);
+    // Last few assistant turns, most-recent last — context for the decision panel.
+    const tail = meaningful
+        .filter(e => e.type === 'message' && e.role === 'assistant' && e.content)
+        .slice(-3)
+        .map(e => oneLine(e.content ?? ''))
+        .filter(Boolean);
     const base = {
         activity: 'idle',
         lastRole: lastMsg?.role,
         lastEventKind: last?.type,
         lastActivityMs: ctx.mtimeMs,
         preview: previewSource ? describeEvent(previewSource) : undefined,
+        tail: tail.length ? tail : undefined,
     };
     if (!last)
         return base;
@@ -196,12 +276,15 @@ export function inferActivity(events, ctx = {}) {
     // tool and nothing has come after it.
     const lastPlanOrAsk = lastOf(meaningful, e => e.type === 'tool_use' && (e.tool === PLAN_TOOL || e.tool === ASK_TOOL));
     if (lastPlanOrAsk && meaningful.indexOf(lastPlanOrAsk) === meaningful.length - 1) {
-        return {
-            ...base,
-            activity: 'waiting_input',
-            awaitingReason: lastPlanOrAsk.tool === PLAN_TOOL ? 'plan_review' : 'question',
-            preview: lastPlanOrAsk.tool === PLAN_TOOL ? 'Plan ready — awaiting your review' : 'Asked you a question',
-        };
+        if (lastPlanOrAsk.tool === PLAN_TOOL) {
+            const question = planReviewQuestion();
+            const plan = extractPlanText(lastPlanOrAsk.args);
+            return { ...base, activity: 'waiting_input', awaitingReason: 'plan_review', preview: question.text, question, plan };
+        }
+        // AskUserQuestion: surface the real question + options (they're on `args`),
+        // not the generic "Asked you a question" that discarded them.
+        const question = structuredQuestionFromAsk(lastPlanOrAsk.args) ?? { text: 'Asked you a question', reason: 'question' };
+        return { ...base, activity: 'waiting_input', awaitingReason: 'question', preview: question.text, question };
     }
     // Pending tool call (tool_use with no following tool_result): mid-turn.
     if (last.type === 'tool_use') {
@@ -209,7 +292,7 @@ export function inferActivity(events, ctx = {}) {
             return { ...base, activity: 'working' };
         // Alive but the file hasn't moved — likely blocked on a permission prompt.
         if (ctx.pidAlive)
-            return { ...base, activity: 'waiting_input', awaitingReason: 'permission' };
+            return { ...base, activity: 'waiting_input', awaitingReason: 'permission', question: permissionQuestion(base.preview) };
         return { ...base, activity: 'idle' };
     }
     // Thinking or a tool result just landed → agent is mid-turn if recently active.
@@ -223,8 +306,14 @@ export function inferActivity(events, ctx = {}) {
             return { ...base, activity: canWork ? 'working' : 'idle' };
         }
         // Assistant spoke last and stopped. A trailing question → waiting; else idle.
-        if (looksLikeQuestion(last.content ?? '')) {
-            return { ...base, activity: 'waiting_input', awaitingReason: 'question' };
+        // A prose question takes a free-text reply (no select-list), so no options/keys.
+        // Unlike the structural plan/ask signals above, the prose heuristic DECAYS: a
+        // question nobody answered within PROSE_QUESTION_FRESH_MS is a session that
+        // ended, not one that needs you (RUSH-1522). Unknown mtime keeps the question.
+        const questionFresh = ctx.mtimeMs == null || Date.now() - ctx.mtimeMs < PROSE_QUESTION_FRESH_MS;
+        if (questionFresh && looksLikeQuestion(last.content ?? '')) {
+            const text = oneLine(last.content ?? '');
+            return { ...base, activity: 'waiting_input', awaitingReason: 'question', question: { text, reason: 'question' } };
         }
         return { ...base, activity: 'idle' };
     }

package/dist/lib/session/types.d.ts

@@ -97,6 +97,15 @@ export interface SessionMeta {
      * `isTeamOrigin` (which marks sessions spawned BY a team).
      */
     spawnedTeam?: string;
+    /**
+     * The plan markdown from the LAST `ExitPlanMode` tool call in the transcript
+     * (Claude sessions only), captured at scan time. Present whenever the session
+     * ever entered plan-review; consumers can pair it with a live
+     * `awaitingReason === 'plan_review'` to decide whether it is still pending.
+     * Fills the gap that forced the Factory extension to re-read raw JSONL to
+     * recover the plan text — the CLI now carries it on the metadata row.
+     */
+    plan?: string;
     /**
      * True when the session was spawned programmatically (SDK entrypoint) rather
      * than by a human at the Claude CLI. Captured at scan time from the JSONL

package/dist/lib/shims.d.ts

@@ -77,7 +77,7 @@ export interface ConflictInfo {
  *         top-level entry add/remove — deep edits to plugin contents won't
  *         trigger auto-resync, run `agents sync` for that.
  */
-export declare const SHIM_SCHEMA_VERSION = 25;
+export declare const SHIM_SCHEMA_VERSION = 26;
 /**
  * Generate the full bash shim script for the given agent. The returned string
  * is written to ~/.agents/shims/{cliCommand} and made executable.
@@ -145,8 +145,14 @@ export declare function removeShim(agent: AgentId): boolean;
  *        editor opens the script and the agent never launches. The `.cmd` is
  *        now the only Windows artifact and carries this alias marker so
  *        staleness checks read it directly.
- */
-export declare const VERSIONED_ALIAS_SCHEMA_VERSION = 12;
+ *  v13 — grok aliases resolve the binary from the versioned home's
+ *        .grok/downloads first, then fall back to the global ~/.grok/downloads.
+ *        The old template checked only the global dir, so a `grok@<version>`
+ *        alias failed with "not installed" whenever the binary was staged into
+ *        the versioned home (installer run with GROK_HOME set, or grok
+ *        self-update under the shim).
+ */
+export declare const VERSIONED_ALIAS_SCHEMA_VERSION = 13;
 /**
  * Generate a versioned alias script that directly execs a specific version.
  * e.g., claude@2.0.65 -> directly runs that version's binary

package/dist/lib/shims.js

@@ -214,7 +214,14 @@ async function promptConflictStrategy(conflictInfos) {
 // v25 — dispatcher self-recovery: if the baked AGENTS_BIN is gone (a removed/moved
 //        dev build that generated the shim), resolve `agents` on PATH instead of
 //        exiting 127, so a stale/vanished dev build can't brick every launch.
-export const SHIM_SCHEMA_VERSION = 25;
+// v26 — grok resolves its binary from the versioned home's .grok/downloads first
+//        ($VERSION_DIR/home/.grok/downloads, where the binary lands when the
+//        installer runs with GROK_HOME set or grok self-updates under the shim),
+//        then falls back to the global ~/.grok/downloads for pre-fix installs.
+//        The old dispatcher checked only the global dir, so a pinned grok that
+//        installed into the versioned home fell through to the "not installed"
+//        error.
+export const SHIM_SCHEMA_VERSION = 26;
 /** Internal marker string used to embed the schema version in shim scripts. */
 const SHIM_VERSION_MARKER = 'agents-shim-version:';
 function shellQuote(value) {
@@ -468,11 +475,14 @@ fi
 
 VERSION_DIR="$AGENTS_USER_DIR/.history/versions/$AGENT/$VERSION"
 
-# Grok special case: binary lives in ~/.grok/downloads/, not node_modules.
-# We still use the agents-cli version dir purely for GROK_HOME isolation.
+# Grok special case: binary lives in the versioned home's .grok/downloads (or,
+# for pre-fix installs, the global ~/.grok/downloads), not node_modules. We
+# still use the agents-cli version dir purely for GROK_HOME isolation.
 if [ "$AGENT" = "grok" ]; then
-  # Try to find a matching binary for the pinned version in the global grok downloads dir.
-  GROK_DOWNLOADS="$HOME/.grok/downloads"
+  # Check the versioned home first — this is where the binary lands when the
+  # installer runs with GROK_HOME set (i.e. via the shim or a correct
+  # \`agents add grok\`), or when grok self-updates from within the shim.
+  GROK_DOWNLOADS="$VERSION_DIR/home/.grok/downloads"
   if [ -d "$GROK_DOWNLOADS" ]; then
     # Prefer a binary whose filename contains the exact version
     BINARY=$(ls "$GROK_DOWNLOADS"/grok-* 2>/dev/null | grep -i "$VERSION" | head -1)
@@ -481,6 +491,17 @@ if [ "$AGENT" = "grok" ]; then
       BINARY=$(ls "$GROK_DOWNLOADS"/grok-* 2>/dev/null | head -1)
     fi
   fi
+  # Fall back to the global grok home (binary installed without GROK_HOME set,
+  # e.g. an earlier \`agents add grok@latest\` before this resolution fix).
+  if [ -z "$BINARY" ] || [ ! -x "$BINARY" ]; then
+    GROK_DOWNLOADS="$HOME/.grok/downloads"
+    if [ -d "$GROK_DOWNLOADS" ]; then
+      BINARY=$(ls "$GROK_DOWNLOADS"/grok-* 2>/dev/null | grep -i "$VERSION" | head -1)
+      if [ -z "$BINARY" ]; then
+        BINARY=$(ls "$GROK_DOWNLOADS"/grok-* 2>/dev/null | head -1)
+      fi
+    fi
+  fi
   if [ -z "$BINARY" ] || [ ! -x "$BINARY" ]; then
     # Last resort: the adopted native launcher (recorded absolute path) if we
     # adopted grok, else whatever is on PATH. Prefer the adopted record — after
@@ -744,8 +765,14 @@ export function removeShim(agent) {
  *        editor opens the script and the agent never launches. The `.cmd` is
  *        now the only Windows artifact and carries this alias marker so
  *        staleness checks read it directly.
+ *  v13 — grok aliases resolve the binary from the versioned home's
+ *        .grok/downloads first, then fall back to the global ~/.grok/downloads.
+ *        The old template checked only the global dir, so a `grok@<version>`
+ *        alias failed with "not installed" whenever the binary was staged into
+ *        the versioned home (installer run with GROK_HOME set, or grok
+ *        self-update under the shim).
  */
-export const VERSIONED_ALIAS_SCHEMA_VERSION = 12;
+export const VERSIONED_ALIAS_SCHEMA_VERSION = 13;
 /** Internal marker string used to embed the schema version in versioned alias scripts. */
 const VERSIONED_ALIAS_VERSION_MARKER = 'agents-versioned-alias-version:';
 // The version string is interpolated into a generated bash script and into
@@ -822,13 +849,22 @@ export KIMI_CODE_HOME="$HOME/.agents/.history/versions/${agent}/${version}/home/
     // "agents __shim" which resolves via getBinaryPath() instead.
     const versionDir = `$HOME/.agents/.history/versions/${agent}/${version}`;
     const binaryResolution = agent === 'grok'
-        ? `# Grok ships its native binary in ~/.grok/downloads, not node_modules.
-GROK_DOWNLOADS="$HOME/.grok/downloads"
+        ? `# Grok ships its native binary in the versioned home's .grok/downloads (or,
+# for pre-fix installs, the global ~/.grok/downloads), not node_modules.
+GROK_DOWNLOADS="${versionDir}/home/.grok/downloads"
 BINARY=""
 if [ -d "$GROK_DOWNLOADS" ]; then
   BINARY=$(ls "$GROK_DOWNLOADS"/grok-* 2>/dev/null | grep -i "${version}" | head -1)
   [ -n "$BINARY" ] || BINARY=$(ls "$GROK_DOWNLOADS"/grok-* 2>/dev/null | head -1)
 fi
+# Fall back to the global grok home (binary installed without GROK_HOME set).
+if [ -z "$BINARY" ] || [ ! -x "$BINARY" ]; then
+  GROK_GLOBAL_DOWNLOADS="$HOME/.grok/downloads"
+  if [ -d "$GROK_GLOBAL_DOWNLOADS" ]; then
+    BINARY=$(ls "$GROK_GLOBAL_DOWNLOADS"/grok-* 2>/dev/null | grep -i "${version}" | head -1)
+    [ -n "$BINARY" ] || BINARY=$(ls "$GROK_GLOBAL_DOWNLOADS"/grok-* 2>/dev/null | head -1)
+  fi
+fi
 # Refuse a PATH match under our own shims dir — it resolves to this alias's
 # sibling dispatcher shim (shims dir is ahead of ~/.local/bin on PATH) and
 # re-execs forever. Fall through to the clean "not installed" error instead.

package/dist/lib/ssh-tunnel.d.ts

@@ -50,10 +50,41 @@ export declare const REMOTE_TASK_NAME = "AgentsComputerHelper";
 /** Basename of the cross-published exe under native/computer-win/dist. */
 export declare const WIN_HELPER_EXE = "computer-helper-win.exe";
 /**
- * Locate the cross-published Windows daemon exe. Only the local build output is
- * a candidate — `scripts/build-win.sh` writes it to packages/.../dist/.
+ * Locate a locally built Windows daemon exe — a repo-checkout build output from
+ * `scripts/build-win.sh`, or one bundled next to the package. Local paths are
+ * only the first candidate; npm-installed CLIs have neither and fall through to
+ * the release-asset download (`ensureWinHelperExe`).
  */
 export declare function resolveWinHelperExe(): string | null;
+/** GitHub repo whose `v<version>` releases carry the exe as an asset. */
+export declare const WIN_HELPER_RELEASE_REPO = "phnx-labs/agents-cli";
+/** Cache dir for downloaded helper exes, one subdir per release tag. */
+export declare function winHelperCacheDir(version: string): string;
+/** Release-asset URLs for the exe + its checksum at one exact `v<version>` tag. */
+export declare function winHelperAssetUrls(version: string): {
+    exe: string;
+    sha256: string;
+};
+/**
+ * Parse the published `.sha256` asset — `sha256sum` format (`<hex>  <name>`) or
+ * a bare hex digest. Throws on anything that does not lead with 64 hex chars.
+ */
+export declare function parseSha256Asset(text: string): string;
+/** Stream a file through sha256 — the exe is ~157MB, never read it whole. */
+export declare function sha256File(file: string): Promise<string>;
+/**
+ * Download the exe release asset for this CLI version, verify its sha256
+ * against the published `.sha256` asset, and cache it under the agents cache
+ * dir. Only the exact `v<version>` tag is consulted — a missing asset is a
+ * hard error naming that tag, never a silent fallback to another release.
+ */
+export declare function downloadWinHelperExe(version: string): Promise<string>;
+/**
+ * Resolve the helper exe for `setup --host`: local build outputs first (repo
+ * checkout / bundled), then the checksum-verified release-asset download for
+ * the running CLI version. Throws with the tag it checked when neither exists.
+ */
+export declare function ensureWinHelperExe(version?: string): Promise<string>;
 /** Persisted per-device tunnel state so verbs can reconnect after `start --host`. */
 export interface RemoteTunnelState {
     device: string;

package/dist/lib/ssh-tunnel.js

@@ -21,7 +21,9 @@ import * as net from 'net';
 import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
-import { randomBytes } from 'crypto';
+import { randomBytes, createHash } from 'crypto';
+import { Readable } from 'stream';
+import { pipeline } from 'stream/promises';
 import { sshExec, SSH_OPTS } from './ssh-exec.js';
 import { backgroundSpawnOptions } from './platform/process.js';
 import { encodePowerShell } from './browser/drivers/ssh.js';
@@ -29,6 +31,7 @@ import { getDevice } from './devices/registry.js';
 import { sshTargetFor } from './devices/connect.js';
 import { hostNameFor } from './devices/ssh-config.js';
 import { getCacheDir } from './state.js';
+import { getCliVersion } from './version.js';
 import { openComputerClient, resolveTcpEndpoint } from './computer-rpc.js';
 /** Build the ssh argv (after the `ssh` program name) for an `-L` tunnel. Pure.
  *
@@ -89,8 +92,10 @@ export const REMOTE_TASK_NAME = 'AgentsComputerHelper';
 /** Basename of the cross-published exe under native/computer-win/dist. */
 export const WIN_HELPER_EXE = 'computer-helper-win.exe';
 /**
- * Locate the cross-published Windows daemon exe. Only the local build output is
- * a candidate — `scripts/build-win.sh` writes it to packages/.../dist/.
+ * Locate a locally built Windows daemon exe — a repo-checkout build output from
+ * `scripts/build-win.sh`, or one bundled next to the package. Local paths are
+ * only the first candidate; npm-installed CLIs have neither and fall through to
+ * the release-asset download (`ensureWinHelperExe`).
  */
 export function resolveWinHelperExe() {
     const here = path.dirname(fileURLToPath(import.meta.url));
@@ -106,6 +111,89 @@ export function resolveWinHelperExe() {
     }
     return null;
 }
+/** GitHub repo whose `v<version>` releases carry the exe as an asset. */
+export const WIN_HELPER_RELEASE_REPO = 'phnx-labs/agents-cli';
+/** Cache dir for downloaded helper exes, one subdir per release tag. */
+export function winHelperCacheDir(version) {
+    return path.join(getCacheDir(), 'computer', 'win-helper', `v${version}`);
+}
+/** Release-asset URLs for the exe + its checksum at one exact `v<version>` tag. */
+export function winHelperAssetUrls(version) {
+    const base = `https://github.com/${WIN_HELPER_RELEASE_REPO}/releases/download/v${version}`;
+    return { exe: `${base}/${WIN_HELPER_EXE}`, sha256: `${base}/${WIN_HELPER_EXE}.sha256` };
+}
+/**
+ * Parse the published `.sha256` asset — `sha256sum` format (`<hex>  <name>`) or
+ * a bare hex digest. Throws on anything that does not lead with 64 hex chars.
+ */
+export function parseSha256Asset(text) {
+    const m = text.trim().match(/^([A-Fa-f0-9]{64})(\s|$)/);
+    if (!m)
+        throw new Error(`malformed .sha256 release asset: ${JSON.stringify(text.slice(0, 80))}`);
+    return m[1].toLowerCase();
+}
+/** Stream a file through sha256 — the exe is ~157MB, never read it whole. */
+export function sha256File(file) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash('sha256');
+        fs.createReadStream(file)
+            .on('error', reject)
+            .on('data', (d) => hash.update(d))
+            .on('end', () => resolve(hash.digest('hex')));
+    });
+}
+/**
+ * Download the exe release asset for this CLI version, verify its sha256
+ * against the published `.sha256` asset, and cache it under the agents cache
+ * dir. Only the exact `v<version>` tag is consulted — a missing asset is a
+ * hard error naming that tag, never a silent fallback to another release.
+ */
+export async function downloadWinHelperExe(version) {
+    const cached = path.join(winHelperCacheDir(version), WIN_HELPER_EXE);
+    if (fs.existsSync(cached))
+        return cached;
+    const tag = `v${version}`;
+    const { exe: exeUrl, sha256: shaUrl } = winHelperAssetUrls(version);
+    const missing = (status, url) => new Error(`no ${WIN_HELPER_EXE} release asset for tag ${tag} (HTTP ${status} on ${url}). ` +
+        `The Windows helper ships as a GitHub release asset per tagged CLI version; ` +
+        `from a repo checkout you can build it locally instead: bash scripts/build-win.sh`);
+    // Checksum first: it is tiny and 404s fast when the tag has no assets.
+    const shaRes = await fetch(shaUrl, { signal: AbortSignal.timeout(30_000) });
+    if (!shaRes.ok)
+        throw missing(shaRes.status, shaUrl);
+    const expected = parseSha256Asset(await shaRes.text());
+    console.error(`Downloading ${WIN_HELPER_EXE} ${tag} from GitHub releases (~160 MB)...`);
+    const exeRes = await fetch(exeUrl, { signal: AbortSignal.timeout(15 * 60_000) });
+    if (!exeRes.ok || !exeRes.body)
+        throw missing(exeRes.status, exeUrl);
+    fs.mkdirSync(path.dirname(cached), { recursive: true });
+    // Stream to a partial file and rename only after the checksum passes, so an
+    // interrupted download can never be picked up as a valid cache hit.
+    const partial = `${cached}.download`;
+    try {
+        await pipeline(Readable.fromWeb(exeRes.body), fs.createWriteStream(partial));
+        const actual = await sha256File(partial);
+        if (actual !== expected) {
+            throw new Error(`sha256 mismatch for ${exeUrl}: expected ${expected}, got ${actual}`);
+        }
+        fs.renameSync(partial, cached);
+    }
+    finally {
+        fs.rmSync(partial, { force: true });
+    }
+    return cached;
+}
+/**
+ * Resolve the helper exe for `setup --host`: local build outputs first (repo
+ * checkout / bundled), then the checksum-verified release-asset download for
+ * the running CLI version. Throws with the tag it checked when neither exists.
+ */
+export async function ensureWinHelperExe(version = getCliVersion()) {
+    const local = resolveWinHelperExe();
+    if (local)
+        return local;
+    return downloadWinHelperExe(version);
+}
 function remoteStateDir() {
     return path.join(getCacheDir(), 'computer', 'remote');
 }
@@ -249,10 +337,9 @@ function copyFileOverScp(target, remotePath, filePath, timeoutMs = 600_000) {
  */
 export async function setupRemoteHelper(name) {
     const { target } = await resolveRemoteDevice(name);
-    const exe = resolveWinHelperExe();
-    if (!exe) {
-        throw new Error(`Windows helper exe not built. Run: bash scripts/build-win.sh`);
-    }
+    // Local build output, else the checksum-verified GitHub release asset for
+    // this CLI version. Throws naming the tag it checked when neither exists.
+    const exe = await ensureWinHelperExe();
     const prep = sshExec(target, encodePowerShell(buildPushScript()), { timeoutMs: 60_000 });
     if (prep.code !== 0) {
         throw new Error(`preparing helper exe path on '${name}' failed (exit ${prep.code ?? 'null'}): ${prep.stderr.trim() || prep.stdout.trim()}`);

package/dist/lib/staleness/types.d.ts

@@ -53,4 +53,3 @@ export interface SyncManifest {
     workflows?: Record<string, DirEntry>;
     plugins?: Record<string, PluginEntry>;
 }
-export type ResourceType = 'commands' | 'skills' | 'hooks' | 'mcp' | 'rules' | 'subagents' | 'workflows' | 'plugins' | 'permissions';

package/dist/lib/startup/command-registry.d.ts

@@ -83,6 +83,7 @@ export declare const loadSessions: ModuleLoader;
 export declare const loadTeams: ModuleLoader;
 export declare const loadCloud: ModuleLoader;
 export declare const loadMessage: ModuleLoader;
+export declare const loadFeed: ModuleLoader;
 export declare const loadServe: ModuleLoader;
 export declare const loadAudit: ModuleLoader;
 /**

package/dist/lib/startup/command-registry.js

@@ -61,6 +61,7 @@ export const loadSessions = async () => (await import('../../commands/sessions.j
 export const loadTeams = async () => (await import('../../commands/teams.js')).registerTeamsCommands;
 export const loadCloud = async () => (await import('../../commands/cloud.js')).registerCloudCommands;
 export const loadMessage = async () => (await import('../../commands/message.js')).registerMessageCommand;
+export const loadFeed = async () => (await import('../../commands/feed.js')).registerFeedCommand;
 export const loadServe = async () => (await import('../../commands/serve.js')).registerServeCommand;
 export const loadAudit = async () => (await import('../../commands/audit.js')).registerAuditCommands;
 /**
@@ -154,6 +155,7 @@ export const COMMAND_LOADERS = {
     teams: [loadTeams],
     cloud: [loadCloud],
     message: [loadMessage],
+    feed: [loadFeed],
     serve: [loadServe],
     audit: [loadAudit],
 };

package/dist/lib/state.d.ts

@@ -122,6 +122,8 @@ export declare function getProjectRoutinesDir(cwd?: string): string | null;
 export declare function getRunsDir(): string;
 /** Root for per-agent mailboxes (~/.agents/.history/mailbox/). */
 export declare function getMailboxRootDir(): string;
+/** Root for open-block feed records (~/.agents/.history/feed/). */
+export declare function getFeedDir(): string;
 /** Path to installed agent CLI binaries (~/.agents/.history/versions/). */
 export declare function getVersionsDir(): string;
 /** Path to version-switching shim scripts (~/.agents/.cache/shims/). */

package/dist/lib/state.js

@@ -89,6 +89,7 @@ const TEAMS_AGENTS_DIR = path.join(HISTORY_DIR, 'teams', 'agents');
 const BACKUPS_DIR = path.join(HISTORY_DIR, 'backups');
 const TRASH_DIR = path.join(HISTORY_DIR, 'trash');
 const MAILBOX_DIR = path.join(HISTORY_DIR, 'mailbox');
+const FEED_DIR = path.join(HISTORY_DIR, 'feed');
 // Cache bucket (regenerable).
 const SHIMS_DIR = path.join(CACHE_DIR, 'shims');
 const HOOK_SHIMS_DIR = path.join(SHIMS_DIR, 'hooks');
@@ -313,6 +314,8 @@ export function getProjectRoutinesDir(cwd = process.cwd()) {
 export function getRunsDir() { return RUNS_DIR; }
 /** Root for per-agent mailboxes (~/.agents/.history/mailbox/). */
 export function getMailboxRootDir() { return MAILBOX_DIR; }
+/** Root for open-block feed records (~/.agents/.history/feed/). */
+export function getFeedDir() { return FEED_DIR; }
 /** Path to installed agent CLI binaries (~/.agents/.history/versions/). */
 export function getVersionsDir() { return VERSIONS_DIR; }
 /** Path to version-switching shim scripts (~/.agents/.cache/shims/). */
@@ -569,25 +572,35 @@ function writeIfChanged(filePath, content) {
 /**
  * Partition the in-memory Meta across three files by sync-domain:
  *   - central  `~/.agents/agents.yaml`             — portable, everything else
- *   - device   `~/.agents/devices/<machine>/agents.yaml` — `agents:` pins (per-device)
+ *   - device   `~/.agents/devices/<machine>/agents.yaml` — `agents:` pins +
+ *              `defaultBrowserProfile:` (both per-device)
  *   - history  `~/.agents/.history/version-resources.json` — `versions:` (machine-local)
  * All callers funnel through writeMeta → here, so nothing else changes. Empty
  * `agents:` / `versions:` are not written (no empty committed files).
  */
 function writeMetaUnlocked(meta) {
-    const { agents, versions, ...central } = meta;
+    const { agents, versions, defaultBrowserProfile, ...central } = meta;
     // Write the machine-local files FIRST, then strip central — so a crash mid-write
     // never removes pins/versions from central before they're persisted elsewhere.
     const devicePath = getDeviceMetaPath();
-    if (agents && Object.keys(agents).length > 0) {
+    const hasAgents = !!agents && Object.keys(agents).length > 0;
+    const hasDefaultBrowser = !!defaultBrowserProfile;
+    if (hasAgents || hasDefaultBrowser) {
+        // Device-local doc carries `agents:` pins and `defaultBrowserProfile:` — both
+        // are per-machine and must never land in central agents.yaml (which syncs).
+        const deviceDoc = {};
+        if (hasAgents)
+            deviceDoc.agents = agents;
+        if (hasDefaultBrowser)
+            deviceDoc.defaultBrowserProfile = defaultBrowserProfile;
         fs.mkdirSync(path.dirname(devicePath), { recursive: true });
-        writeIfChanged(devicePath, META_HEADER + yaml.stringify({ agents }));
+        writeIfChanged(devicePath, META_HEADER + yaml.stringify(deviceDoc));
     }
     else if (fs.existsSync(devicePath)) {
-        // Every pin was cleared. Persist the emptied map instead of skipping the
-        // write — otherwise the stale device file survives and overlayMachineLocal
-        // re-applies the removed pin on the next read, leaving a dangling default
-        // (e.g. a launcher pointing at a version that was just uninstalled).
+        // Every device-local value was cleared. Persist the emptied doc instead of
+        // skipping the write — otherwise the stale device file survives and
+        // overlayMachineLocal re-applies the removed pin/default on the next read,
+        // leaving a dangling value (e.g. a default pointing at a deleted profile).
         writeIfChanged(devicePath, META_HEADER + yaml.stringify({ agents: {} }));
     }
     if (versions && Object.keys(versions).length > 0) {
@@ -602,6 +615,8 @@ function writeMetaUnlocked(meta) {
  * Overlay this machine's local state onto a central-portable Meta:
  *   - `agents:` from the device file (device wins; the union both preserves the
  *     one-level merge and self-heals a pre-migration central that still has pins)
+ *   - `defaultBrowserProfile:` from the device file (device is the sole source;
+ *     the field is stripped from central on write, so nothing to merge against)
  *   - `versions:` from the history JSON (wholesale replace; falls back to
  *     whatever central carried when the history file doesn't exist yet)
  */
@@ -612,6 +627,8 @@ function overlayMachineLocal(meta) {
             const dm = yaml.parse(fs.readFileSync(devicePath, 'utf-8'));
             if (dm?.agents)
                 meta.agents = { ...meta.agents, ...dm.agents };
+            if (dm?.defaultBrowserProfile)
+                meta.defaultBrowserProfile = dm.defaultBrowserProfile;
         }
         catch { /* ignore malformed device file */ }
     }

package/dist/lib/teams/agents.js

@@ -1693,6 +1693,7 @@ export class AgentManager {
         ];
         if (model)
             args.push('--model', model);
+        args.push('--env', 'AGENTS_RUNTIME=teams');
         return args;
     }
     buildCommand(agentType, prompt, mode, model, cwd = null, sessionId = null, effort = 'medium', version = null, profileName = null) {
@@ -1704,9 +1705,11 @@ export class AgentManager {
         ];
         if (cwd)
             cmd.push('--cwd', cwd);
-        // Pin Claude's session UUID to our agent_id so its session file lands at
-        // ~/.claude/projects/.../<agent_id>.jsonl — unified identity for status polling.
-        if (agentType === 'claude' && sessionId) {
+        // Pin the session UUID to our agent_id so buildExecEnv keys
+        // AGENTS_MAILBOX_DIR by the same id mailboxIdForActiveSession returns.
+        // Claude also forwards --session-id to its CLI (unified identity);
+        // other agents ignore the flag but still get the correct mailbox dir.
+        if (sessionId) {
             cmd.push('--session-id', sessionId);
         }
         // Claude: grant access to the teammate's working directory.