@phnx-labs/agents-cli 1.20.53 → 1.20.55

package/dist/lib/registry.js

@@ -6,8 +6,11 @@
  * with transport, runtime, and argument metadata.
  */
 import * as fs from 'fs';
+import * as path from 'path';
+import { createHash } from 'crypto';
 import { DEFAULT_REGISTRIES } from './types.js';
 import { readMeta, writeMeta } from './state.js';
+import { discoverSkillsFromRepo } from './skills.js';
 const UNSAFE_PACKAGE_SPEC_CHARS = /[;&|`$\s\x00-\x1f\x7f]/;
 const NPM_SPEC_PATTERN = /^(@[a-z0-9][a-z0-9-_.]*\/)?[a-z0-9][a-z0-9-_.]*(@[A-Za-z0-9._+-]+)?$/;
 const PYPI_SPEC_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*(\[[A-Za-z0-9,_-]+\])?(==[A-Za-z0-9._-]+)?$/;
@@ -213,7 +216,7 @@ async function fetchSkillIndex(url, apiKey) {
     return doc;
 }
 /** Map a raw skill-index row into the canonical SkillEntry shape. */
-function normalizeSkillEntry(raw) {
+export function normalizeSkillEntry(raw) {
     return {
         name: raw.name,
         description: raw.description,
@@ -225,6 +228,7 @@ function normalizeSkillEntry(raw) {
         installs: raw.installs,
         tags: raw.tags,
         trustLevel: raw.trust_level,
+        sha256: raw.sha256,
     };
 }
 /** Case-insensitive substring match against the fields users expect to search. */
@@ -418,3 +422,80 @@ export async function resolvePackage(identifier) {
     }
     return null;
 }
+// ============================================================================
+// PUBLISH — generate a self-hosted skill index + verify integrity on install
+// ============================================================================
+/** Lowercase hex sha256 of a file's bytes. Small files only (SKILL.md). */
+export function sha256OfFile(file) {
+    return createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+/**
+ * Parse an 'owner/repo' slug from a git remote URL (https or scp-style ssh).
+ * Returns null if the URL is not a recognizable GitHub-style remote.
+ */
+export function parseOwnerRepoFromRemote(remoteUrl) {
+    const s = remoteUrl.trim().replace(/\.git$/, '');
+    // https://github.com/owner/repo  or  git@github.com:owner/repo
+    const m = s.match(/github\.com[/:]([^/]+\/[^/]+)$/);
+    return m ? m[1] : null;
+}
+/**
+ * Walk a repo's skills/ and build a flat {@link SkillIndexDocument}. Each entry
+ * carries the sha256 of its SKILL.md so install can verify integrity after
+ * cloning — this is the artifact `agents publish` commits + pushes.
+ *
+ * `repoSlug` is the 'owner/repo' the skills are published under, written into
+ * each entry's `repo` field so {@link skillEntryToGitSource} resolves it to
+ * `gh:owner/repo`. `identifier` is set to the skill's directory name so
+ * `agents install skill:<name>` resolves against this index.
+ */
+export function buildSkillIndex(repoPath, repoSlug, opts) {
+    const discovered = discoverSkillsFromRepo(repoPath);
+    const skills = discovered.map((s) => ({
+        name: s.name,
+        description: s.metadata.description || undefined,
+        identifier: s.name,
+        source: repoSlug,
+        repo: repoSlug,
+        path: path.relative(repoPath, s.path),
+        author: s.metadata.author,
+        sha256: sha256OfFile(path.join(s.path, 'SKILL.md')),
+    }));
+    return {
+        version: 1,
+        generated_at: opts?.generatedAt,
+        skill_count: skills.length,
+        skills,
+    };
+}
+/**
+ * Verify a cloned skill's SKILL.md against the sha256 recorded in its registry
+ * entry. Returns ok when the entry carries no sha256 — indexes published before
+ * integrity hashes (or by third parties) simply skip the check. Returns an
+ * error when the file is missing or its hash differs, so install can abort
+ * rather than silently trusting a tampered artifact.
+ */
+export function verifySkillIntegrity(repoPath, entry) {
+    if (!entry.sha256)
+        return { ok: true };
+    const rel = entry.path || path.join('skills', entry.name);
+    const skillMd = rel.endsWith('SKILL.md')
+        ? path.join(repoPath, rel)
+        : path.join(repoPath, rel, 'SKILL.md');
+    if (!fs.existsSync(skillMd)) {
+        return {
+            ok: false,
+            error: `Integrity check failed for skill '${entry.name}': SKILL.md not found at ${rel}.`,
+        };
+    }
+    const actual = sha256OfFile(skillMd);
+    const expected = entry.sha256.toLowerCase();
+    if (actual !== expected) {
+        return {
+            ok: false,
+            error: `Integrity check failed for skill '${entry.name}': expected sha256 ${expected}, got ${actual}. ` +
+                `The published SKILL.md does not match the registry index — refusing to install.`,
+        };
+    }
+    return { ok: true };
+}

package/dist/lib/routines.d.ts

@@ -60,6 +60,15 @@ export interface JobConfig {
     prompt: string;
     timezone?: string;
     repo?: string;
+    /**
+     * Pin this routine to one machine. `~/.agents/routines/` is synced to every
+     * device via the user repo, so without a pin an enabled routine fires on
+     * EVERY machine running the scheduler. When set, only the device whose
+     * `machineId()` matches (normalized hostname, e.g. `yosemite-s0`) schedules,
+     * fires, catches up, or counts this job as overdue; everywhere else it is
+     * inert and `run` refuses with an `agents ssh` pointer.
+     */
+    device?: string;
     variables?: Record<string, string>;
     sandbox?: boolean;
     allow?: JobAllowConfig;
@@ -77,11 +86,20 @@ export interface RunMeta {
     agent: AgentId;
     workflow?: string;
     pid: number | null;
+    /** Process birth time (epoch ms) recorded at spawn for pid-reuse detection. */
+    spawnedAt?: number;
     status: 'running' | 'completed' | 'failed' | 'timeout';
     startedAt: string;
     completedAt: string | null;
     exitCode: number | null;
 }
+/**
+ * True when the job may execute on this machine: no `device` pin, or the pin
+ * names this device. Both sides go through `normalizeHost` so `Yosemite-S0`,
+ * `yosemite-s0.tailnet.ts.net`, and `yosemite-s0` all agree. Every fire path
+ * (cron scheduler, webhook, catchup/overdue, manual run) gates on this.
+ */
+export declare function jobRunsOnThisDevice(config: Pick<JobConfig, 'device'>): boolean;
 /**
  * List all job configs, scanning project > user routine dirs.
  * Project routines (`<project>/.agents/routines/`) shadow user routines of the

package/dist/lib/routines.js

@@ -13,6 +13,7 @@ import { Cron } from 'croner';
 import { getRoutinesDir, getRunsDir, ensureAgentsDir, getProjectRoutinesDir } from './state.js';
 import { safeJoin } from './paths.js';
 import { ALL_AGENT_IDS } from './agents.js';
+import { machineId, normalizeHost } from './machine-id.js';
 /** Canonical set of accepted GitHub trigger events — single source for validation. */
 export const GITHUB_TRIGGER_EVENTS = [
     'pull_request',
@@ -40,9 +41,20 @@ export function normalizeTriggerEvent(input) {
     };
     return aliases[key] ?? null;
 }
+/**
+ * True when the job may execute on this machine: no `device` pin, or the pin
+ * names this device. Both sides go through `normalizeHost` so `Yosemite-S0`,
+ * `yosemite-s0.tailnet.ts.net`, and `yosemite-s0` all agree. Every fire path
+ * (cron scheduler, webhook, catchup/overdue, manual run) gates on this.
+ */
+export function jobRunsOnThisDevice(config) {
+    if (!config.device)
+        return true;
+    return normalizeHost(config.device) === machineId();
+}
 /** Default values applied to every job config when fields are omitted. */
 const JOB_DEFAULTS = {
-    mode: 'plan',
+    mode: 'auto',
     effort: 'auto',
     timeout: '10m',
     enabled: true,
@@ -126,7 +138,7 @@ export function writeJob(config) {
     const jobsDir = getRoutinesDir();
     const filePath = safeJoin(jobsDir, config.name + '.yml');
     const output = { ...config };
-    if (output.mode === 'plan')
+    if (output.mode === 'auto')
         delete output.mode;
     if (output.effort === 'auto')
         delete output.effort;
@@ -219,6 +231,11 @@ export function validateJob(config) {
             errors.push('endAt must be a parseable ISO 8601 / RFC3339 timestamp (e.g., 2026-12-31T23:59:00Z)');
         }
     }
+    if (config.device !== undefined) {
+        if (typeof config.device !== 'string' || config.device.trim() === '') {
+            errors.push('device must be a non-empty device name (as shown by `agents devices`, e.g. yosemite-s0)');
+        }
+    }
     return errors;
 }
 /** Validate a job trigger block, returning a list of human-readable errors. */

package/dist/lib/runner.js

@@ -13,7 +13,7 @@
  * limit is detected mid-run (foreground `executeJob` only — detached daemon
  * fires once with the pre-flight pick).
  */
-import { spawn } from 'child_process';
+import { spawn, execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -407,6 +407,7 @@ export async function executeJob(config, deps) {
         agent: effectiveAgent,
         ...(config.workflow ? { workflow: config.workflow } : {}),
         pid: null,
+        spawnedAt: Date.now(),
         status: 'running',
         startedAt: new Date().toISOString(),
         completedAt: null,
@@ -571,6 +572,7 @@ export async function executeJobDetached(config) {
         agent: effectiveAgent,
         ...(config.workflow ? { workflow: config.workflow } : {}),
         pid: null,
+        spawnedAt: Date.now(),
         status: 'running',
         startedAt: new Date().toISOString(),
         completedAt: null,
@@ -691,6 +693,45 @@ function inferFinalStatusFromLog(stdoutPath, agent) {
         return null;
     }
 }
+const MAX_WALL_CLOCK_MS = 24 * 60 * 60 * 1000;
+/**
+ * Verify that a PID still belongs to the process we spawned, not a recycled
+ * OS PID. Uses the recorded `spawnedAt` (epoch ms) from meta.json and
+ * compares against the process's actual start time via `ps`. Returns true
+ * when the PID is alive AND plausibly ours.
+ */
+function isPidOurs(pid, spawnedAt) {
+    try {
+        process.kill(pid, 0);
+    }
+    catch {
+        return false;
+    }
+    if (spawnedAt === undefined)
+        return true;
+    if (process.platform === 'win32')
+        return true;
+    try {
+        const etime = execFileSync('ps', ['-p', String(pid), '-o', 'etime='], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (!etime)
+            return true;
+        const parts = etime.replace(/-/g, ':').split(':').reverse();
+        let uptimeSec = 0;
+        if (parts[0])
+            uptimeSec += parseInt(parts[0], 10);
+        if (parts[1])
+            uptimeSec += parseInt(parts[1], 10) * 60;
+        if (parts[2])
+            uptimeSec += parseInt(parts[2], 10) * 3600;
+        if (parts[3])
+            uptimeSec += parseInt(parts[3], 10) * 86400;
+        const processStartMs = Date.now() - uptimeSec * 1000;
+        return Math.abs(processStartMs - spawnedAt) < 30_000;
+    }
+    catch {
+        return true;
+    }
+}
 /** Scan all runs marked "running" and finalize any whose process has exited. */
 export function monitorRunningJobs() {
     const runsDir = getRunsDir();
@@ -712,14 +753,17 @@ export function monitorRunningJobs() {
                     continue;
                 if (!meta.pid)
                     continue;
-                try {
-                    process.kill(meta.pid, 0);
+                const runDirPath = path.join(jobRunsPath, runDirEntry.name);
+                const stdoutPath = path.join(runDirPath, 'stdout.log');
+                const wallClockMs = Date.now() - Date.parse(meta.startedAt);
+                if (Number.isFinite(wallClockMs) && wallClockMs > MAX_WALL_CLOCK_MS) {
+                    meta.status = 'timeout';
+                    meta.completedAt = new Date().toISOString();
+                    writeRunMeta(meta);
+                    extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
+                    continue;
                 }
-                catch { /* process no longer running */
-                    const runDirPath = path.join(jobRunsPath, runDirEntry.name);
-                    const stdoutPath = path.join(runDirPath, 'stdout.log');
-                    // Prefer the agent's own success/error marker; fall back to "failed"
-                    // only when the stream ended without one (process killed mid-run).
+                if (!isPidOurs(meta.pid, meta.spawnedAt)) {
                     const inferred = inferFinalStatusFromLog(stdoutPath, meta.agent);
                     if (inferred) {
                         meta.status = inferred.status;

package/dist/lib/scheduler.js

@@ -6,7 +6,7 @@
  * on startup and reloads them on SIGHUP.
  */
 import { Cron } from 'croner';
-import { listJobs, deleteJob, isPastEndAt, setJobEnabled } from './routines.js';
+import { listJobs, deleteJob, isPastEndAt, setJobEnabled, jobRunsOnThisDevice } from './routines.js';
 /** In-memory cron scheduler that triggers a callback when jobs fire. */
 export class JobScheduler {
     jobs = new Map();
@@ -18,8 +18,9 @@ export class JobScheduler {
         const configs = listJobs();
         for (const config of configs) {
             // Trigger-only jobs (no cron schedule) fire via the webhook receiver,
-            // not the cron loop — skip them here.
-            if (config.enabled && config.schedule) {
+            // not the cron loop — skip them here. Jobs pinned to another device
+            // (routines are fleet-synced) never enter this machine's cron loop.
+            if (config.enabled && config.schedule && jobRunsOnThisDevice(config)) {
                 this.schedule(config);
             }
         }

package/dist/lib/session/remote.d.ts

@@ -16,6 +16,19 @@ export declare function shellQuote(s: string): string;
  *             (`[runtime, script, 'sessions', ...]`).
  */
 export declare function buildForwardedArgs(argv: string[], hosts?: Set<string>): string[];
+/**
+ * Force a forwarded `agents sessions` listing to span the peer's WHOLE index.
+ *
+ * A remote listing runs in the peer's SSH-login cwd — its home dir — and the
+ * default listing is silently cwd-scoped, so `sessions --host box` reads as
+ * empty even when the box's index is full (`No sessions found for /home/<user>`).
+ * Across SSH a peer's cwd is meaningless, so `--host` defaults to `--all`
+ * (whole-index) scope. This only drops the *cwd* narrowing — an explicit path
+ * query, `--project`, `--since`, or `--agent` filter still narrows on top, and
+ * a query that looks like a path takes precedence over `--all` on the remote.
+ * Idempotent: never adds a second `--all`.
+ */
+export declare function ensureWholeIndex(forwardedArgs: string[]): string[];
 /**
  * Build the single remote command string for `ssh <host> <cmd>`. Forwarded args
  * are quoted for the inner login shell, then the whole `agents …` invocation is

package/dist/lib/session/remote.js

@@ -30,6 +30,7 @@ import { getCacheDir } from '../state.js';
 import { SSH_OPTS, controlOpts, assertValidSshTarget } from '../ssh-exec.js';
 import { remoteShellFor, buildWindowsAgentsCommand } from '../hosts/remote-cmd.js';
 import { resolveRemoteOsSync } from '../hosts/remote-os.js';
+import { NO_FANOUT_ENV } from './remote-active.js';
 import { formatRelativeTime } from './relative-time.js';
 import { terminalWidth } from './width.js';
 /**
@@ -81,6 +82,21 @@ export function buildForwardedArgs(argv, hosts = new Set()) {
     }
     return out;
 }
+/**
+ * Force a forwarded `agents sessions` listing to span the peer's WHOLE index.
+ *
+ * A remote listing runs in the peer's SSH-login cwd — its home dir — and the
+ * default listing is silently cwd-scoped, so `sessions --host box` reads as
+ * empty even when the box's index is full (`No sessions found for /home/<user>`).
+ * Across SSH a peer's cwd is meaningless, so `--host` defaults to `--all`
+ * (whole-index) scope. This only drops the *cwd* narrowing — an explicit path
+ * query, `--project`, `--since`, or `--agent` filter still narrows on top, and
+ * a query that looks like a path takes precedence over `--all` on the remote.
+ * Idempotent: never adds a second `--all`.
+ */
+export function ensureWholeIndex(forwardedArgs) {
+    return forwardedArgs.includes('--all') ? forwardedArgs : [...forwardedArgs, '--all'];
+}
 /**
  * Build the single remote command string for `ssh <host> <cmd>`. Forwarded args
  * are quoted for the inner login shell, then the whole `agents …` invocation is
@@ -93,16 +109,23 @@ export function buildForwardedArgs(argv, hosts = new Set()) {
  * remote renders its table to the local screen.
  */
 export function buildRemoteCommand(forwardedArgs, columns, os) {
+    // `--host <box>` means "that box's own sessions" — so the peer must answer for
+    // ITSELF and not re-sweep its fleet. Without this the remote `agents sessions`
+    // fans back out to every device IT knows (including us), printing a spurious
+    // `<this-machine>: unreachable`. AGENTS_SESSIONS_LOCAL=1 pins the peer local,
+    // matching the JSON fan-out path (`remote-list.ts`).
     if (remoteShellFor(os) === 'powershell') {
-        const env = columns && columns > 0 ? { COLUMNS: String(columns) } : undefined;
+        const env = { [NO_FANOUT_ENV]: '1' };
+        if (columns && columns > 0)
+            env.COLUMNS = String(columns);
         return buildWindowsAgentsCommand({ args: forwardedArgs, env });
     }
     const inner = ['agents', ...forwardedArgs].map(shellQuote).join(' ');
     // Forward the caller's terminal width so the remote renders the table to the
     // local screen (over SSH the remote's own COLUMNS is unset/wrong). `VAR=val
     // cmd` scopes the env to that process — the remote's terminalWidth() reads it.
-    const withCols = columns && columns > 0 ? `COLUMNS=${columns} ${inner}` : inner;
-    return `bash -lc ${shellQuote(withCols)}`;
+    const envPrefix = `${NO_FANOUT_ENV}=1` + (columns && columns > 0 ? ` COLUMNS=${columns}` : '');
+    return `bash -lc ${shellQuote(`${envPrefix} ${inner}`)}`;
 }
 /**
  * Classify an ssh `spawnSync` result. ssh(1) reserves exit 255 for its own
@@ -182,7 +205,7 @@ function replayRemoteCache(host, forwardedArgs) {
 export function runRemoteSessions(hosts, argv = process.argv) {
     for (const host of hosts)
         assertValidSshTarget(host); // fail fast on any bad target
-    const forwarded = buildForwardedArgs(argv, new Set(hosts));
+    const forwarded = ensureWholeIndex(buildForwardedArgs(argv, new Set(hosts)));
     const cols = terminalWidth();
     const multi = hosts.length > 1;
     let failures = 0;

package/dist/lib/tmux/binary.d.ts

@@ -8,6 +8,8 @@
  *    subcommand);
  *  - stdout/stderr capture is consistent for the session module to parse.
  */
+/** Oldest tmux release with `run-shell -C`, required by the managed pane-died hook. */
+export declare const MIN_TMUX_VERSION = "3.2";
 /**
  * Locate the tmux binary on PATH. Cached after first call — tmux either is or
  * isn't installed for the duration of the process.
@@ -19,6 +21,8 @@ export declare function findTmuxBinary(): string | null;
 export declare function isTmuxInstalled(): boolean;
 /** Best-effort tmux version string (e.g. "tmux 3.6a"). Returns null when not installed or version probe fails. */
 export declare function getTmuxVersion(): string | null;
+/** True for a `tmux -V` string at or above the supported 3.2 floor. */
+export declare function isTmuxVersionSupported(version: string | null): boolean;
 /**
  * Throw a user-friendly error when tmux isn't installed. Command handlers call
  * this first thing so the error message is the same shape every time.

package/dist/lib/tmux/binary.js

@@ -11,6 +11,9 @@
 import { spawn, spawnSync } from 'child_process';
 import { existsSync } from 'fs';
 let cachedBin;
+let cachedVersion;
+/** Oldest tmux release with `run-shell -C`, required by the managed pane-died hook. */
+export const MIN_TMUX_VERSION = '3.2';
 /**
  * Locate the tmux binary on PATH. Cached after first call — tmux either is or
  * isn't installed for the duration of the process.
@@ -45,13 +48,29 @@ export function isTmuxInstalled() {
 }
 /** Best-effort tmux version string (e.g. "tmux 3.6a"). Returns null when not installed or version probe fails. */
 export function getTmuxVersion() {
+    if (cachedVersion !== undefined)
+        return cachedVersion;
     const bin = findTmuxBinary();
     if (!bin)
         return null;
     const res = spawnSync(bin, ['-V'], { encoding: 'utf8' });
-    if (res.status !== 0)
-        return null;
-    return res.stdout.trim() || null;
+    if (res.status !== 0) {
+        cachedVersion = null;
+        return cachedVersion;
+    }
+    cachedVersion = res.stdout.trim() || null;
+    return cachedVersion;
+}
+/** True for a `tmux -V` string at or above the supported 3.2 floor. */
+export function isTmuxVersionSupported(version) {
+    if (!version)
+        return false;
+    const match = /^tmux\s+(\d+)\.(\d+)/.exec(version.trim());
+    if (!match)
+        return false;
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    return major > 3 || (major === 3 && minor >= 2);
 }
 /**
  * Throw a user-friendly error when tmux isn't installed. Command handlers call
@@ -68,6 +87,10 @@ export function assertTmuxAvailable() {
                 : 'Install tmux from https://github.com/tmux/tmux';
         throw new TmuxUnavailableError(`tmux is not installed. ${hint}`);
     }
+    const version = getTmuxVersion();
+    if (!isTmuxVersionSupported(version)) {
+        throw new TmuxUnavailableError(`${version ?? 'tmux version unknown'} is unsupported. agents requires tmux ${MIN_TMUX_VERSION} or newer.`);
+    }
     return bin;
 }
 export class TmuxUnavailableError extends Error {

package/dist/lib/tmux/index.d.ts

@@ -3,6 +3,6 @@
  * (swarmify extension, `agents teams` multiplexer mode, future MCP wrapper)
  * should import from here.
  */
-export { findTmuxBinary, isTmuxInstalled, getTmuxVersion, assertTmuxAvailable, TmuxUnavailableError, TmuxCommandError, runTmux, attachTmux, } from './binary.js';
+export { findTmuxBinary, isTmuxInstalled, getTmuxVersion, isTmuxVersionSupported, MIN_TMUX_VERSION, assertTmuxAvailable, TmuxUnavailableError, TmuxCommandError, runTmux, attachTmux, } from './binary.js';
 export { getDefaultSocketPath, getSessionMetaPath, ensureTmuxDir, } from './paths.js';
 export { assertValidSessionName, slugifyName, hasSession, createSession, killSession, killAll, listSessions, splitPane, sendKeys, capturePane, readSessionMeta, TmuxSessionError, type SessionMeta, type CreateSessionOptions, type ListedSession, type SplitOptions, type SendOptions, type CaptureOptions, } from './session.js';

package/dist/lib/tmux/index.js

@@ -3,6 +3,6 @@
  * (swarmify extension, `agents teams` multiplexer mode, future MCP wrapper)
  * should import from here.
  */
-export { findTmuxBinary, isTmuxInstalled, getTmuxVersion, assertTmuxAvailable, TmuxUnavailableError, TmuxCommandError, runTmux, attachTmux, } from './binary.js';
+export { findTmuxBinary, isTmuxInstalled, getTmuxVersion, isTmuxVersionSupported, MIN_TMUX_VERSION, assertTmuxAvailable, TmuxUnavailableError, TmuxCommandError, runTmux, attachTmux, } from './binary.js';
 export { getDefaultSocketPath, getSessionMetaPath, ensureTmuxDir, } from './paths.js';
 export { assertValidSessionName, slugifyName, hasSession, createSession, killSession, killAll, listSessions, splitPane, sendKeys, capturePane, readSessionMeta, TmuxSessionError, } from './session.js';

package/dist/lib/tmux/session.d.ts

@@ -123,9 +123,10 @@ export declare function paneExitStatus(pane: string, socket?: string): Promise<P
  * Bind a per-session hook. Used by the spawn-wrap path to install a `pane-died`
  * hook that detaches the attach client the instant the wrapped agent exits (the
  * global `remain-on-exit on` otherwise leaves the client staring at a dead pane).
- * Best-effort — a failed hook just means the user Ctrl-b d's out manually.
+ * Best-effort — returns false when tmux rejects the hook so callers do not
+ * stamp a schema marker and daemon reconciliation can retry later.
  */
-export declare function setSessionHook(name: string, hook: string, command: string, socket?: string): Promise<void>;
+export declare function setSessionHook(name: string, hook: string, command: string, socket?: string): Promise<boolean>;
 /**
  * Schema version of the `pane-died` hook installed on managed `agents run`
  * sessions. Bump whenever the hook's SHAPE changes so the daemon reconcile
@@ -135,15 +136,30 @@ export declare function setSessionHook(name: string, hook: string, command: stri
  *        user exiting a split they opened) tore down the whole client.
  *   v2 — `#{hook_pane}`-guarded: only the AGENT pane dying detaches; a user
  *        split's death runs `kill-pane`, closing just that split.
+ *   v3 — the else-branch pins its target via
+ *        `run-shell "tmux -S <socket> kill-pane -t #{hook_pane}"`. Untargeted
+ *        kill-pane resolves "current pane" inside the hook context, which goes
+ *        nondeterministic on a loaded detached server (CI flake #965: the dead
+ *        split survived as a husk); run-shell format-expands its command at
+ *        fire time, so the event pane is always the target.
+ *   v4 — `run-shell -C "kill-pane -t #{hook_pane}"` executes the targeted command
+ *        in the tmux server instead of launching a second tmux client against
+ *        the same socket from inside the hook. That self-client could race the
+ *        server under load and leave the dead split behind.
  */
-export declare const AGENT_HOOK_SCHEMA = 2;
+export declare const AGENT_HOOK_SCHEMA = 4;
 /**
  * The guarded `pane-died` hook. Detach the client ONLY when the agent pane dies
  * (so the blocking attach in runInTmux returns and the exit status can be read);
- * a user split's death falls through to `kill-pane`, which — because the hook
- * runs in the dead pane's context — closes that split in place. Single source of
- * truth: both the spawn-wrap (exec.ts) and the daemon reconcile build the hook
- * here, so the two can never drift.
+ * a user split's death runs the else-branch, closing just that split. The
+ * else-branch goes through `run-shell -C` with an explicit `-t #{hook_pane}`
+ * target: tmux format-expands the command at fire time and executes it inside
+ * the server command queue, so the event pane is always the one killed without
+ * launching a second tmux client against the same socket. A bare `kill-pane`
+ * relied on the hook context supplying a "current pane", while an external
+ * self-client could race the server under load. Single source of truth: both
+ * the spawn-wrap (exec.ts) and the daemon reconcile build the hook here, so the
+ * two can never drift.
  */
 export declare function agentPaneDiedHook(sessionName: string, agentPane: string): string;
 /** Stamp a session's hook-schema marker to the current version. */

package/dist/lib/tmux/session.js

@@ -262,12 +262,18 @@ export async function paneExitStatus(pane, socket) {
  * Bind a per-session hook. Used by the spawn-wrap path to install a `pane-died`
  * hook that detaches the attach client the instant the wrapped agent exits (the
  * global `remain-on-exit on` otherwise leaves the client staring at a dead pane).
- * Best-effort — a failed hook just means the user Ctrl-b d's out manually.
+ * Best-effort — returns false when tmux rejects the hook so callers do not
+ * stamp a schema marker and daemon reconciliation can retry later.
  */
 export async function setSessionHook(name, hook, command, socket) {
     assertValidSessionName(name);
     const sock = socket ?? getDefaultSocketPath();
-    await runTmux({ socket: sock, args: ['set-hook', '-t', name, hook, command], throwOnError: false }).catch(() => { });
+    const result = await runTmux({
+        socket: sock,
+        args: ['set-hook', '-t', name, hook, command],
+        throwOnError: false,
+    }).catch(() => null);
+    return result?.code === 0;
 }
 /**
  * Schema version of the `pane-died` hook installed on managed `agents run`
@@ -278,20 +284,35 @@ export async function setSessionHook(name, hook, command, socket) {
  *        user exiting a split they opened) tore down the whole client.
  *   v2 — `#{hook_pane}`-guarded: only the AGENT pane dying detaches; a user
  *        split's death runs `kill-pane`, closing just that split.
+ *   v3 — the else-branch pins its target via
+ *        `run-shell "tmux -S <socket> kill-pane -t #{hook_pane}"`. Untargeted
+ *        kill-pane resolves "current pane" inside the hook context, which goes
+ *        nondeterministic on a loaded detached server (CI flake #965: the dead
+ *        split survived as a husk); run-shell format-expands its command at
+ *        fire time, so the event pane is always the target.
+ *   v4 — `run-shell -C "kill-pane -t #{hook_pane}"` executes the targeted command
+ *        in the tmux server instead of launching a second tmux client against
+ *        the same socket from inside the hook. That self-client could race the
+ *        server under load and leave the dead split behind.
  */
-export const AGENT_HOOK_SCHEMA = 2;
+export const AGENT_HOOK_SCHEMA = 4;
 /** Per-session tmux user-option that records which AGENT_HOOK_SCHEMA a session's hook is at. */
 const HOOK_SCHEMA_OPTION = '@ag_hook_schema';
 /**
  * The guarded `pane-died` hook. Detach the client ONLY when the agent pane dies
  * (so the blocking attach in runInTmux returns and the exit status can be read);
- * a user split's death falls through to `kill-pane`, which — because the hook
- * runs in the dead pane's context — closes that split in place. Single source of
- * truth: both the spawn-wrap (exec.ts) and the daemon reconcile build the hook
- * here, so the two can never drift.
+ * a user split's death runs the else-branch, closing just that split. The
+ * else-branch goes through `run-shell -C` with an explicit `-t #{hook_pane}`
+ * target: tmux format-expands the command at fire time and executes it inside
+ * the server command queue, so the event pane is always the one killed without
+ * launching a second tmux client against the same socket. A bare `kill-pane`
+ * relied on the hook context supplying a "current pane", while an external
+ * self-client could race the server under load. Single source of truth: both
+ * the spawn-wrap (exec.ts) and the daemon reconcile build the hook here, so the
+ * two can never drift.
  */
 export function agentPaneDiedHook(sessionName, agentPane) {
-    return `if -F '#{==:#{hook_pane},${agentPane}}' 'detach-client -s =${sessionName}' 'kill-pane'`;
+    return `if -F '#{==:#{hook_pane},${agentPane}}' 'detach-client -s =${sessionName}' 'run-shell -C "kill-pane -t #{hook_pane}"'`;
 }
 /** Stamp a session's hook-schema marker to the current version. */
 export async function markSessionHookSchema(name, socket) {
@@ -355,7 +376,9 @@ export async function reconcileSessionHooks(socket) {
         const agentPane = s.meta?.pane ?? await lowestPaneId(s.name, sock);
         if (!agentPane)
             continue;
-        await setSessionHook(s.name, 'pane-died', agentPaneDiedHook(s.name, agentPane), sock);
+        const installed = await setSessionHook(s.name, 'pane-died', agentPaneDiedHook(s.name, agentPane), sock);
+        if (!installed)
+            continue;
         await markSessionHookSchema(s.name, sock);
         reconciled++;
     }

package/dist/lib/triggers/webhook.js

@@ -12,7 +12,7 @@
  * The optional http listener (`startWebhookServer`) is a thin adapter over it.
  */
 import * as http from 'http';
-import { listJobs } from '../routines.js';
+import { listJobs, jobRunsOnThisDevice } from '../routines.js';
 import { executeJobDetached } from '../runner.js';
 /** Read `repository.full_name` (`owner/name`) from a webhook payload, if present. */
 export function webhookRepo(payload) {
@@ -85,7 +85,7 @@ export function jobMatchesWebhook(job, webhook) {
  * time-based jobs are unaffected by webhook delivery.
  */
 export function matchJobsToWebhook(jobs, webhook) {
-    return jobs.filter((job) => job.enabled !== false && jobMatchesWebhook(job, webhook));
+    return jobs.filter((job) => job.enabled !== false && jobRunsOnThisDevice(job) && jobMatchesWebhook(job, webhook));
 }
 /**
  * Match an incoming webhook against the persisted routines and fire each match

package/dist/lib/types.d.ts

@@ -439,6 +439,12 @@ export interface SkillEntry {
     tags?: string[];
     /** Registry-specific trust signal (e.g. 'builtin', 'trusted', 'community'). */
     trustLevel?: string;
+    /**
+     * Lowercase hex sha256 of the skill's SKILL.md, as recorded by
+     * `agents publish`. When present, install verifies the cloned SKILL.md
+     * against it and aborts on mismatch.
+     */
+    sha256?: string;
 }
 /** Paginated response from a skill registry search endpoint. */
 export interface SkillRegistryResponse {