@phnx-labs/agents-cli 1.20.51 → 1.20.53

package/dist/commands/secrets.js

@@ -24,6 +24,7 @@ import { parseDuration } from '../lib/hooks/cache.js';
 import { emit } from '../lib/events.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+import { discoverSyncedBundles, importSyncedBundle, } from '../lib/secrets/icloud-import.js';
 import { registerSecretsSyncCommands } from './secrets-sync.js';
 import { registerSecretsMigrateAclCommand } from './secrets-migrate.js';
 import { registerSecretsImportKeyringCommand } from './secrets-import.js';
@@ -135,6 +136,104 @@ async function resolveVault(vaultOpt) {
 export function readImportDotenv(from) {
     return from === '-' ? readStdinSync() : fs.readFileSync(from, 'utf-8');
 }
+/**
+ * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),
+ * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`
+ * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`
+ * pair maps onto the 1password source. A file literally named `icloud` or
+ * `1password` can still be imported via an explicit path (`./icloud`).
+ */
+export function parseImportSource(opts) {
+    if (opts.from && opts.from1password) {
+        throw new Error('--from and --from-1password are mutually exclusive.');
+    }
+    if (opts.from1password)
+        return { kind: '1password', vault: opts.vault };
+    if (!opts.from) {
+        throw new Error("Pass --from <source>: a .env path (- reads stdin), '1password:<vault>', or 'icloud'.");
+    }
+    if (opts.from === 'icloud')
+        return { kind: 'icloud' };
+    if (opts.from === '1password')
+        return { kind: '1password', vault: opts.vault };
+    if (opts.from.startsWith('1password:')) {
+        const vault = opts.from.slice('1password:'.length);
+        return { kind: '1password', vault: vault || opts.vault };
+    }
+    return { kind: 'dotenv', path: opts.from };
+}
+/**
+ * `secrets import --from icloud` — recover bundles stranded in the iCloud
+ * Keychain by the device-local cutover. With a bundle name, imports exactly
+ * that bundle; without one, interactively multi-selects from everything
+ * discovered (all pre-checked — the common case is "bring them all back").
+ */
+async function importFromICloud(bundleName, opts) {
+    if (process.platform !== 'darwin') {
+        throw new Error('--from icloud reads the macOS iCloud Keychain and is only available on macOS.');
+    }
+    const candidates = discoverSyncedBundles();
+    if (candidates.length === 0) {
+        console.log('No legacy iCloud Keychain bundles found.');
+        return;
+    }
+    const describe = (c) => `${c.name} (${c.keys.length} key${c.keys.length === 1 ? '' : 's'}${c.hasMeta ? '' : ', no metadata'})`;
+    let chosen;
+    if (bundleName) {
+        const hit = candidates.find((c) => c.name === bundleName);
+        if (!hit) {
+            throw new Error(`No iCloud Keychain bundle named '${bundleName}'. Found: ${candidates.map((c) => c.name).join(', ')}`);
+        }
+        chosen = [hit];
+    }
+    else if (!isInteractiveTerminal()) {
+        throw new Error(`Found ${candidates.length} iCloud Keychain bundle(s): ${candidates.map((c) => c.name).join(', ')}. ` +
+            'Pass a bundle name to import non-interactively.');
+    }
+    else {
+        const { checkbox } = await import('@inquirer/prompts');
+        chosen = await checkbox({
+            message: 'Which iCloud Keychain bundles to import?',
+            choices: candidates.map((c) => ({ name: describe(c), value: c, checked: true })),
+        });
+        if (chosen.length === 0) {
+            console.log('Nothing selected.');
+            return;
+        }
+    }
+    for (const candidate of chosen) {
+        const result = importSyncedBundle(candidate, opts);
+        const parts = [`imported ${result.added} key(s)`];
+        if (result.skipped)
+            parts.push(`skipped ${result.skipped} (already set, pass --force)`);
+        if (result.missing.length)
+            parts.push(`unreadable (left in iCloud): ${result.missing.join(', ')}`);
+        if (result.unimportable.length)
+            parts.push(`reserved, not importable (left in iCloud): ${result.unimportable.join(', ')}`);
+        if (opts.purge)
+            parts.push(`purged ${result.purged} iCloud item(s)`);
+        const line = `${candidate.name}: ${parts.join(', ')}`;
+        const warn = result.missing.length > 0 || result.unimportable.length > 0;
+        console.log(warn ? chalk.yellow(line) : chalk.green(line));
+    }
+}
+/**
+ * Printed under a "bundle not found" failure: if the name matches a bundle
+ * stranded in the iCloud Keychain (pre-device-local-cutover era), point at the
+ * recovery command instead of leaving a dead end.
+ */
+function maybePrintSyncedHint(name) {
+    if (process.platform !== 'darwin')
+        return;
+    try {
+        if (discoverSyncedBundles().some((c) => c.name === name)) {
+            console.error(chalk.yellow(`A legacy iCloud Keychain copy of '${name}' exists. Recover it with: agents secrets import ${name} --from icloud`));
+        }
+    }
+    catch {
+        // Hint only — never mask the original error.
+    }
+}
 /**
  * Build the remote `agents secrets unlock` argv for `unlock --host`. `--all`
  * forwards verbatim; otherwise the explicit bundle names. A `--ttl` is passed
@@ -525,7 +624,8 @@ export function registerSecretsCommands(program) {
         agents secrets status                          show held bundles + when they lock
         agents secrets rotate <bundle> <key>           rotate value, preserve metadata
         agents secrets import <bundle> --from .env     bulk import from .env
-        agents secrets import <bundle> --from-1password --vault <name>
+        agents secrets import <bundle> --from 1password:<vault>
+        agents secrets import --from icloud            recover legacy iCloud Keychain bundles
         agents secrets generate [length]               generate a random password / PIN / hex
         agents secrets migrate-acl                     upgrade legacy items to the biometry ACL
     `,
@@ -610,7 +710,15 @@ export function registerSecretsCommands(program) {
                 return;
             }
             const resolvedName = name ?? (await pickBundleName('view'));
-            const bundle = readBundle(resolvedName);
+            let bundle;
+            try {
+                bundle = readBundle(resolvedName);
+            }
+            catch (err) {
+                console.error(chalk.red(err.message));
+                maybePrintSyncedHint(resolvedName);
+                process.exit(1);
+            }
             const entries = describeBundle(bundle);
             console.log(chalk.bold(bundle.name));
             if (bundle.description)
@@ -672,7 +780,7 @@ export function registerSecretsCommands(program) {
                     emit('secrets.get', {
                         module: 'secrets',
                         bundle: bundle.name,
-                        caller: 'view --reveal',
+                        operation: 'view --reveal',
                         source: 'reveal',
                         status: 'success',
                         keyCount: exposedCount,
@@ -713,24 +821,48 @@ export function registerSecretsCommands(program) {
         }
     });
     cmd
-        .command('get <item>')
-        .description('Print a raw keychain item by name (for shell hooks/automation). Cross-platform; no bundle required.')
-        .action((item) => {
+        .command('get <item> [key]')
+        .description('Print one secret value for shell hooks/automation. One arg = a raw keychain item by name; two args = one KEY out of a bundle (`get <bundle> <KEY>`). Cross-platform.')
+        .action((item, key) => {
+        if (key === undefined) {
+            // Raw keychain item path — unchanged.
+            try {
+                // Routes through the platform keychain layer: macOS reads bare items
+                // via /usr/bin/security (no Touch ID), Linux via secret-tool with the
+                // encrypted-file fallback. The value goes to stdout (newline-terminated
+                // so `$(agents secrets get NAME)` captures it cleanly); diagnostics go
+                // to stderr so they never pollute the captured value.
+                const value = getKeychainToken(item);
+                // Raw item reads bypass readAndResolveBundleEnv, so audit here too.
+                // `item` is the keychain service name, never the value.
+                emit('secrets.get', { module: 'secrets', item, source: 'raw-item', status: 'success' });
+                process.stdout.write(value.endsWith('\n') ? value : `${value}\n`);
+            }
+            catch {
+                // Missing item is a normal, quiet outcome for a hook probe: exit 1,
+                // print nothing to stdout. Callers test the exit code / empty capture.
+                process.exit(1);
+            }
+            return;
+        }
+        // Bundle-key path: `get <bundle> <KEY>` prints exactly one resolved value.
+        // Ungated like the raw path (it IS the automation primitive); the
+        // `secrets.get` audit event is emitted inside readAndResolveBundleEnv.
         try {
-            // Routes through the platform keychain layer: macOS reads bare items
-            // via /usr/bin/security (no Touch ID), Linux via secret-tool with the
-            // encrypted-file fallback. The value goes to stdout (newline-terminated
-            // so `$(agents secrets get NAME)` captures it cleanly); diagnostics go
-            // to stderr so they never pollute the captured value.
-            const value = getKeychainToken(item);
-            // Raw item reads bypass readAndResolveBundleEnv, so audit here too.
-            // `item` is the keychain service name, never the value.
-            emit('secrets.get', { module: 'secrets', item, source: 'raw-item', status: 'success' });
+            if (!bundleExists(item)) {
+                console.error(chalk.red(`Secrets bundle '${item}' not found.`));
+                process.exit(1);
+            }
+            const { env } = readAndResolveBundleEnv(item, { caller: 'secrets get', keys: [key] });
+            if (!(key in env)) {
+                console.error(chalk.red(`Key '${key}' not in bundle '${item}'.`));
+                process.exit(1);
+            }
+            const value = env[key];
             process.stdout.write(value.endsWith('\n') ? value : `${value}\n`);
         }
-        catch {
-            // Missing item is a normal, quiet outcome for a hook probe: exit 1,
-            // print nothing to stdout. Callers test the exit code / empty capture.
+        catch (err) {
+            console.error(chalk.red(err.message));
             process.exit(1);
         }
     });
@@ -1160,23 +1292,34 @@ Examples:
     });
     cmd
         .command('import [bundle]')
-        .description('Import keys from a .env file or a 1Password vault into a bundle. The bundle is created if it does not exist. Values are stored in the bundle\'s backend (keychain by default).')
-        .option('--from <path>', 'Path to a .env file (use - to read the .env from stdin)')
-        .option('--from-1password', 'Import secrets from a 1Password vault (requires the op CLI)')
-        .option('--vault <name>', '1Password vault name (used with --from-1password)')
+        .description('Import keys into a bundle from a .env file, a 1Password vault, or legacy iCloud Keychain bundles. The bundle is created if it does not exist. Values are stored in the bundle\'s backend (keychain by default).')
+        .option('--from <source>', "Source: a .env path (- reads stdin), '1password:<vault>', or 'icloud' (legacy iCloud Keychain bundles)")
+        .addOption(new Option('--from-1password', 'deprecated alias for --from 1password:<vault>').hideHelp())
+        .addOption(new Option('--vault <name>', 'deprecated: name the vault in --from 1password:<vault>').hideHelp())
         .option('--all-plaintext', 'Store every imported value as a literal in the bundle metadata (skip keychain item creation)')
         .option('--backend <backend>', 'When creating the bundle: keychain (default) or file (passphrase-encrypted, headless-readable)', 'keychain')
         .option('--force', 'Overwrite an existing key in the bundle')
+        .option('--purge', 'With --from icloud: delete the iCloud copies after a successful import (iCloud propagates the deletion to your other devices)')
         .action(async (bundleName, opts) => {
         try {
-            if (!opts.from && !opts.from1password) {
-                throw new Error('Pass --from <path> to import a .env file, or --from-1password to import from a 1Password vault.');
+            const source = parseImportSource(opts);
+            if (opts.purge && source.kind !== 'icloud') {
+                throw new Error('--purge only applies to --from icloud.');
             }
-            if (opts.from && opts.from1password) {
-                throw new Error('--from and --from-1password are mutually exclusive.');
+            if (opts.from1password) {
+                console.log(chalk.yellow('--from-1password is deprecated; use --from 1password:<vault>.'));
             }
-            const resolvedBundleName = bundleName ?? (await pickBundleName('import into'));
             const requestedBackend = parseBackendOpt(opts.backend);
+            if (source.kind === 'icloud') {
+                await importFromICloud(bundleName, {
+                    force: opts.force,
+                    allPlaintext: opts.allPlaintext,
+                    backend: requestedBackend === 'file' ? 'file' : undefined,
+                    purge: opts.purge,
+                });
+                return;
+            }
+            const resolvedBundleName = bundleName ?? (await pickBundleName('import into'));
             // Read the bundle if it exists (inheriting its backend); otherwise
             // create it with the requested backend so a single `import --backend
             // file` works (this is what `export --host ... --remote-backend file`
@@ -1199,9 +1342,9 @@ Examples:
             const store = bundleItemStore(bundle.backend, { noAcl: bundlePolicy(bundle) === 'never' });
             let added = 0;
             let skipped = 0;
-            if (opts.from1password) {
+            if (source.kind === '1password') {
                 assertOpAvailable();
-                const vault = await resolveVault(opts.vault);
+                const vault = await resolveVault(source.vault);
                 const items = listItems(vault);
                 const { secrets, skipped: opSkipped } = extractSecrets(items, vault);
                 for (const { envKey, value } of secrets) {
@@ -1226,7 +1369,7 @@ Examples:
                 console.log(chalk.green(`Imported ${added} key(s) from 1Password vault '${vault}'${skipped ? `, skipped ${skipped} (already set, pass --force)` : ''}.`));
             }
             else {
-                const raw = readImportDotenv(opts.from);
+                const raw = readImportDotenv(source.path);
                 const pairs = parseDotenv(raw);
                 for (const [key, value] of Object.entries(pairs)) {
                     if (!opts.force && key in bundle.vars) {
@@ -1720,20 +1863,11 @@ Examples:
                 console.error(chalk.yellow('Aborted.'));
                 return;
             }
-            const wasDaily = bundlePolicy(bundle) === 'daily';
             bundle.policy = next;
+            // writeBundle evicts any broker-held copy, so tightening daily ->
+            // always/never takes effect NOW: the next read re-prompts (`always`)
+            // or reads its no-ACL item directly (`never`).
             writeBundle(bundle);
-            // Tightening daily -> always/never must take effect NOW, not up to the
-            // ~7d hold later. If the broker is already serving this bundle silently
-            // (auto-cached under the old `daily` policy), evict it so the next read
-            // re-prompts (`always`) or reads its no-ACL item directly (`never`).
-            // macOS-only + best-effort; agentLock no-ops off darwin / with no broker.
-            if (wasDaily && next !== 'daily') {
-                try {
-                    await agentLock(bundle.name);
-                }
-                catch { /* broker down — nothing held */ }
-            }
             console.log(chalk.green(`${bundle.name} policy set to ${next}.`));
             if (next === 'daily') {
                 console.log(chalk.gray('Held by the secrets-agent for ~7 days after one unlock (auto-cache is on by default; disable with `secrets.agent.auto: false` in agents.yaml).'));

package/dist/commands/sessions.js

@@ -25,7 +25,7 @@ import { machineId, normalizeHost } from '../lib/session/sync/config.js';
 import { gatherRemoteActive, NO_FANOUT_ENV } from '../lib/session/remote-active.js';
 import { gatherRemoteList, runOnPeer } from '../lib/session/remote-list.js';
 import { stringWidth, truncateToWidth, padToWidth, terminalWidth } from '../lib/session/width.js';
-import { discoverSessions, countSessionsInScope, resolveSessionById, searchContentIndex } from '../lib/session/discover.js';
+import { discoverSessions, countSessionsInScope, resolveSessionById, searchContentIndex, getSessionRoots } from '../lib/session/discover.js';
 import { filterTeamSessions } from '../lib/session/team-filter.js';
 import { parseSession } from '../lib/session/parse.js';
 import { runRemoteSessions, buildForwardedArgs } from '../lib/session/remote.js';
@@ -796,6 +796,14 @@ async function sessionsAction(query, options) {
     if (options.device && options.device.length > 0) {
         options.host = [...(options.host ?? []), ...options.device];
     }
+    // --roots: emit the local session-scan directories, per agent, as JSON. A pure
+    // machine-readable query (no listing/render) — external watchers (the Factory
+    // extension's fs.watch) read it to track the same dirs the CLI scans, instead
+    // of hardcoding `~/.claude|.codex|.gemini`. Always local; ignores other flags.
+    if (options.roots) {
+        process.stdout.write(JSON.stringify(getSessionRoots(), null, 2) + '\n');
+        return;
+    }
     // --host WITHOUT --active. `--json` fans the recent listing out and emits ONE
     // clean merged SessionMeta[] array (same shape as the local --json path), for
     // scripts/extensions that JSON.parse a remote's history. Without --json it
@@ -2047,6 +2055,7 @@ export function registerSessionsCommands(program) {
         .option('--artifacts', 'List all files written or edited during a session')
         .option('--artifact <name>', 'Read a specific artifact by filename or path (outputs to stdout)')
         .option('--active', 'Show only sessions running right now across terminals, teams, cloud, and headless agents')
+        .option('--roots', 'With --json: emit the on-disk directories scanned for session transcripts, per agent (for external watchers)')
         .option('--local', 'Only this machine — skip the cross-machine SSH fan-out (default listing and --active)')
         .option('--waiting', 'With --active: show only sessions waiting on your input (exits non-zero if any)')
         .option('--tree', 'Group the listing by directory; drops the id/version columns for readability')

package/dist/commands/teams.js

@@ -5,6 +5,7 @@ import { addHostOption } from '../lib/hosts/option.js';
 import * as path from 'path';
 import { AgentManager, checkCliSignedIn, collectTeamsDoctorData, getAgentsDir, VALID_TASK_TYPES, } from '../lib/teams/agents.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
+import { emit } from '../lib/events.js';
 import { runSupervisor } from '../lib/teams/supervisor.js';
 import { debug } from '../lib/teams/debug.js';
 import { runPrWatch, DEFAULT_MAX_WAVES, } from '../lib/teams/pr-watch.js';
@@ -1317,6 +1318,7 @@ export function registerTeamsCommands(program) {
         }
         try {
             const result = await handleSpawn(mgr, team, agent, effectiveTask, cwd, opts.mode, opts.effort, null, cwd, version, opts.name ?? null, after, opts.model ?? null, envOverrides ?? null, taskType, cloudProviderId, cloudSessionId, opts.repo ?? null, opts.branch ?? null, worktreeName, worktreePath, profileName, hostName, hostTarget, hostRepoPath);
+            emit('teams.add', { module: 'teams', team, agent, name: result.name, agent_id: result.agent_id, status: result.status });
             if (isJsonMode(opts)) {
                 console.log(JSON.stringify(result, null, 2));
                 return;
@@ -1487,6 +1489,7 @@ export function registerTeamsCommands(program) {
             await warnUnsignedTeammates(mgr, team);
             await warnThrottledTeammates(mgr, team);
         }
+        emit('teams.start', { module: 'teams', team, watch: Boolean(opts.watch) });
         if (!opts.watch) {
             await runOneWave(mgr, team, Boolean(opts.json));
             return;
@@ -1526,6 +1529,7 @@ export function registerTeamsCommands(program) {
             },
         });
         const elapsed = Math.floor(result.elapsed_ms / 1000);
+        emit('teams.complete', { module: 'teams', team, stoppedBy: result.stoppedBy, waves: result.waves, durationMs: result.elapsed_ms });
         if (result.stoppedBy === 'drained') {
             console.log(chalk.green(`Factory drained in ${elapsed}s (${result.waves} waves).`));
         }

package/dist/commands/worktree.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import { die } from '../lib/format.js';
+import { getGitRoot } from '../lib/git.js';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import * as fs from 'fs/promises';
@@ -14,10 +15,11 @@ function isValidTerminalId(id) {
     // hostile or buggy caller can't inject path traversal or shell metachars.
     return /^[A-Za-z0-9._-]+$/.test(id) && id.length > 0 && id.length <= 128;
 }
+// Thin command-layer wrapper over the shared lib/git.ts `getGitRoot`: turns its
+// throw into a clean `die()` message. The git plumbing lives in one place now.
 async function gitRoot(cwd) {
     try {
-        const { stdout } = await execFileAsync('git', ['rev-parse', '--show-toplevel'], { cwd });
-        return stdout.trim();
+        return await getGitRoot(cwd);
     }
     catch {
         die(`Not inside a git repo: ${cwd}`);

package/dist/index.js

@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadSsh, loadPull, loadPush, loadRepo, loadSetup, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -73,6 +73,7 @@ program
     .name('agents')
     .description('Environment manager for AI agents')
     .version(VERSION)
+    .option('--verbose', 'Show startup self-heal details on stderr')
     .helpOption('-h, --help', 'Show help')
     .addHelpCommand(false);
 // ─── Audit backbone ────────────────────────────────────────────────────────────
@@ -101,7 +102,10 @@ program.hook('preAction', (_thisCommand, actionCommand) => {
         emit('command.start', {
             module: parts[0],
             command: parts.join(' '),
-            args: redactArgs(actionCommand.args),
+            // Commander exposes positional operands in actionCommand.args but omits
+            // parsed option values. Audit the real argv so sensitive flags are seen
+            // and redacted instead of silently bypassing the policy.
+            args: redactArgs(process.argv.slice(2, 22)),
             cwd: process.cwd(),
         });
     }
@@ -204,6 +208,7 @@ Automation tips:
 Options:
   -V, --version                   Show version number
   -h, --help                      Show help
+  --verbose                       Show startup self-heal details on stderr
 
 System config lives in ~/.agents/.system/. Run 'agents <command> --help' for details.
 `;
@@ -461,8 +466,8 @@ async function checkForUpdates() {
         }
     }
 }
-async function maybeBootstrapShimIntegration(requestedCommand, helpOrVersionRequested) {
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+async function maybeBootstrapShimIntegration(requestedCommand, helpOrVersionRequested, verboseStartup) {
+    if (!verboseStartup && (!process.stdin.isTTY || !process.stdout.isTTY)) {
         return;
     }
     // Pure documentation paths must never trigger interactive repair — mirrors
@@ -484,8 +489,12 @@ async function maybeBootstrapShimIntegration(requestedCommand, helpOrVersionRequ
     // (a real native binary shadowing the shim) or is worth saying once (a PATH entry
     // just added). Suppression is persistent and keyed to the condition — a new
     // terminal no longer re-nags (the old per-PPID sentinel did, every shell).
-    const { healShimsInteractive } = await import('./lib/shim-heal.js');
-    const noticeLines = await healShimsInteractive();
+    const { runInteractiveShimHeal } = await import('./lib/shim-heal.js');
+    const { summarizeSelfHeal } = await import('./lib/self-heal/registry.js');
+    const { noticeLines, report } = await runInteractiveShimHeal();
+    if (verboseStartup) {
+        process.stderr.write(`[agents] startup self-heal: ${summarizeSelfHeal(report)}\n`);
+    }
     if (noticeLines) {
         for (const line of noticeLines)
             console.log(chalk.gray(line));
@@ -496,17 +505,8 @@ async function maybeBootstrapShimIntegration(requestedCommand, helpOrVersionRequ
 // close over entry-point-local state (program re-parsing, VERSION, the npm
 // upgrade helpers). The lazy registrar and the all-commands fallback below both
 // call them, so the behavior is identical to the old eager registration.
-/** Deprecated `memory` command — hard error pointing users at `rules`. */
-function registerMemoryCommand(p) {
-    p.command('memory', { hidden: true })
-        .allowUnknownOption()
-        .allowExcessArguments()
-        .action(() => {
-        console.error(chalk.red('"agents memory" has been renamed to "agents rules".'));
-        console.error(chalk.gray('Run "agents rules --help" for usage.\n'));
-        process.exit(1);
-    });
-}
+// memory is a first-class resource command (see commands/memory.ts via
+// COMMAND_LOADERS). The old memory→rules tombstone was removed in RUSH-1330.
 /** Deprecated `perms` alias — re-parses as `permissions`. */
 function registerPermsAliasCommand(p) {
     p.command('perms', { hidden: true })
@@ -613,9 +613,6 @@ async function reg(loader) {
  */
 async function registerEagerForRequest(name) {
     switch (name) {
-        case 'memory':
-            registerMemoryCommand(program);
-            return true;
         case 'perms':
             // The action re-parses as `permissions`, so that target must exist too.
             registerPermsAliasCommand(program);
@@ -656,7 +653,7 @@ async function registerAllEagerCommands() {
     await reg(loadHooks);
     await reg(loadSkills);
     await reg(loadRules);
-    registerMemoryCommand(program);
+    await reg(loadMemory);
     await reg(loadPermissions);
     registerPermsAliasCommand(program);
     await reg(loadMcp);
@@ -704,6 +701,7 @@ async function registerAllEagerCommands() {
     await reg(loadLogs);
     await reg(loadEvents);
     await reg(loadAudit);
+    await reg(loadFeed);
     await reg(loadSsh);
     registerJobsCronAliasCommand(program, 'jobs');
     registerJobsCronAliasCommand(program, 'cron');
@@ -764,6 +762,7 @@ program.on('command:*', (operands) => {
 // and whether the update check + background sync run at all.
 const passedArgs = process.argv.slice(2);
 const requestedCommand = passedArgs.find((arg) => !arg.startsWith('-'));
+const verboseStartup = passedArgs.includes('--verbose');
 // Help and version output are pure documentation — they must never gate on
 // setup, otherwise `agents <cmd> --help` becomes useless on a fresh box.
 const helpOrVersionRequested = passedArgs.some((arg) => arg === '--help' || arg === '-h' || arg === '--version' || arg === '-V');
@@ -918,7 +917,7 @@ if (passedArgs.length === 0) {
     process.exit(0);
 }
 try {
-    await maybeBootstrapShimIntegration(requestedCommand, helpOrVersionRequested);
+    await maybeBootstrapShimIntegration(requestedCommand, helpOrVersionRequested, verboseStartup);
     await program.parseAsync();
 }
 catch (err) {