@phnx-labs/agents-cli 1.20.54 → 1.20.56

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 1.20.56
+
+- **Fix native routine schedulers rejecting the published CLI as a Bun virtual path.** Bun's standalone runtime reports the embedded `/$bunfs/root/agents` entry as existing at `process.argv[1]`, while the real physical executable lives at `process.execPath`. Daemon resolution now substitutes that physical executable before generating launchd/systemd manifests or detached launches; the existing virtual-path guard still rejects any virtual path that reaches supervision. Source: `apps/cli/src/lib/daemon.ts`.
+
+- **Fix: `agents teams`, `agents message`, and `agents profiles check` work again on the signed standalone binary (regression from #315).** When `agents` resolves to the bun-compiled Mach-O (shipped since 1.20.53), three self-spawn sites relaunched the CLI as `[process.execPath, process.argv[1], …]` — but under a bun standalone executable `process.argv[1]` is the virtual entry `/$bunfs/root/agents`, so the child died with `unknown command '/$bunfs/root/agents'` (or `/bin/sh: /$bunfs/root/agents: No such file or directory`). Every teammate spawned by a compiled-binary install failed in 0s. New shared `getAgentsInvocation(subArgs)` (`apps/cli/src/lib/daemon.ts`) resolves the real on-disk binary — mapping the `/$bunfs/root/…` virtual path to `process.execPath`, running a `.js` entry under node, and a native binary directly — and `teams/agents.ts`, `commands/message.ts`, and `commands/profiles.ts` route through it. Verified end-to-end: a teammate spawned by the freshly-compiled binary runs to `completed` with no `$bunfs` error. Source: `apps/cli/src/lib/daemon.ts` (`getAgentsInvocation`), `apps/cli/src/lib/teams/agents.ts`, `apps/cli/src/commands/{message,profiles}.ts`.
+## 1.20.55
+
+- **Routine scheduler health is now observable and self-healing.** `agents routines status` distinguishes `running`, `wedged`, and `stopped`, and reports the daemon binary plus heartbeat age. Routine listing/status opportunistically finalize orphaned runs; PID reuse checks and a 24-hour wall-clock limit prevent stale `running` records; daemon startup rejects bun virtual paths and warns about worktree binaries that can disappear. Source: `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/runner.ts`, `apps/cli/src/commands/routines.ts`.
+- **Built-in Open-Claude and OpenCode profiles.** `agents profiles` now ships `open-claude` and `claude-spark` for Claude Code through OpenRouter, plus `opencode`, `opencode-spark`, and `opencode-qwen` presets for the OpenCode harness. Source: `apps/cli/src/lib/profiles-presets.ts`, `apps/cli/docs/profiles.md`.
+- **Fix: exiting a user split inside an `agents run` tmux session reliably closes just that split (de-flakes CI #965).** The guarded `pane-died` hook's else-branch was a bare `kill-pane`, which relies on the hook context supplying an implicit "current pane" — nondeterministic on a loaded detached server, so the dead split intermittently survived as a husk (the same failure the flaky `session.test.ts` pane-died tests reproduced in CI). An intermediate external `tmux -S <socket>` self-client still raced the server under Linux load. The else-branch now runs `run-shell -C "kill-pane -t #{hook_pane}"`, which format-expands the event pane and executes the targeted command inside tmux's own server queue. Interactive tmux-backed runs now require tmux 3.2+, the release that introduced `run-shell -C`. `AGENT_HOOK_SCHEMA` bumps to 4; the daemon reconcile retrofits live sessions automatically and only stamps the marker after tmux accepts the hook, so a transient failure stays retryable. Source: `apps/cli/src/lib/tmux/session.ts` (`agentPaneDiedHook`, `AGENT_HOOK_SCHEMA`), `apps/cli/src/lib/tmux/binary.ts`, `apps/cli/src/lib/exec.ts`.
+- **`agents devices sync` pins the login user on Windows too.** `os.userInfo().username` returns `COMPUTER\user` / `DOMAIN\user` on Windows, which failed the safe-charset guard, so Windows boxes synced with no pinned user and `--host <device>` fell back to the wrong local account. `sanitizeLoginUser` now strips the domain prefix to the bare ssh account before the guard. Also folds the duplicate `user@host` splitter (`parseTarget` in `ssh.ts`) into the canonical `splitUserHost` so there is one parser. Source: `apps/cli/src/lib/devices/sync.ts`, `apps/cli/src/commands/ssh.ts`.
+- **Menu bar ACTIVE section now shows every local session, not just extension-registered terminals.** The dropdown's session source was `live-terminals.json`, which only carries terminals the Factory extension registers — a machine with 25 live sessions (tmux, ghostty, headless) rendered `ACTIVE · 1 running`. The helper now feeds triage + ACTIVE from `agents sessions --active --local --json` (the session engine's authoritative view, issue #741 contract) on the same warm-cache pattern as routines (30s TTL, refreshed off the click path; the cheap file still covers cold start and the 10s badge poll). Blocked sessions outside the extension's view now surface in NEEDS YOU too. Idle rows cap at 3 per repo group — the group header carries the true counts — so a big idle fleet can't wall the menu. Source: `apps/cli/menubar/Sources/MenubarHelper/{StatusItemController,LocalState,AgentsCLI,Models}.swift`.
+- **Daemon service manifests pin JavaScript installs to the current Node runtime.** launchd and systemd now invoke `process.execPath <entry> daemon _run`, matching the detached launcher, instead of executing the JS entrypoint through `#!/usr/bin/env node`. Linux user services therefore stop falling back to an obsolete system Node (observed as Node 18 failing on `node:util.styleText`) when the CLI was installed under Node 22/24. Native `agents` launchers remain direct executables. Source: `apps/cli/src/lib/daemon.ts`.
+- **Routines support a `devices:` allowlist so multiple machines each fire the same job independently.** Routine YAMLs sync fleet-wide via the user repo, so without a restriction an enabled routine fires on every device running the scheduler. A `devices: [yosemite-s0, mac-mini]` allowlist makes each listed machine run the job independently on schedule; omitting the field (or `--clear`) leaves the job unrestricted. A single-entry list `devices: [yosemite-s0]` replaces the legacy singular `device:` pin — v12 migration converts any existing `device: X` YAML automatically to `devices: [X]`. All automatic paths (cron scheduler, webhook triggers, overdue/`catchup`, daemon nags, detached runner fires, one-shot `--at`) skip devices outside the allowlist; attempting to run a job on an ineligible host errors with the allowed device names and a ready-to-paste `--host` hint. `routines add --devices yosemite-s0,mac-mini` sets the list at creation (validated against the registered fleet); `routines devices <name>` opens a preselected multi-select picker; `--set <csv>` and `--clear` update it non-interactively and are mutually exclusive. `routines list` gains a Devices column; `--json` gains `devices` array and `runsHere`. `--host <device>` (alias: `--device`) routes any `routines` subcommand to a remote machine over SSH. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/scheduler.ts`, `apps/cli/src/lib/overdue.ts`, `apps/cli/src/lib/triggers/webhook.ts`, `apps/cli/src/lib/runner.ts`, `apps/cli/src/lib/hosts/passthrough.ts`, `apps/cli/src/lib/migrate.ts`, `apps/cli/src/commands/routines.ts`.
+- **Routines now default to `--mode auto` instead of `plan` (RUSH-1595).** A routine created without an explicit `mode` now runs under the smart classifier (`auto`) rather than read-only `plan`, so unattended jobs can create PRs, write files, and run tests end-to-end without every user opting in — `auto` maps to `--permission-mode auto` (claude), workspace-write + network (codex), `--auto high` (droid), and kimi's default headless run (which had no read-only mode and previously errored at `plan`). Opt down to `mode: plan` for read-only monitoring/reporting. `JOB_DEFAULTS.mode`, the `agents routines add --mode` flag default, and the file-add default all move to `auto`; `writeJob` now omits `mode` when it equals `auto`. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/commands/routines.ts`.
+- **`agents publish` — a self-hosted, zero-infrastructure skill registry that round-trips with `agents search`/`agents install`.** Publish walks a git repo's `skills/` directory, records a sha256 of every `SKILL.md`, and writes a flat `skills-index.json` (`SkillIndexDocument` shape) at the repo root, then commits + pushes it and prints the `raw.githubusercontent.com` URL plus the exact `agents registry add skill <name> <url>` command to share. No hosted aggregator: the index is just a file in your GitHub repo, consumed directly by the existing `fetchSkillIndex`/`searchSkillRegistries` path. Targets your `~/.agents` repo by default or an extra repo via `--repo <alias>` (`--dry-run` previews without pushing). Each index entry carries `sha256`, threaded through `SkillEntry`/`normalizeSkillEntry`, and `agents install` now verifies the freshly cloned `SKILL.md` against it — a mismatch aborts with a clear error rather than trusting a tampered artifact. This is the self-hosted/git-index slice of #336; global no-URL discovery (a hosted aggregator) remains future work. Source: `apps/cli/src/commands/packages.ts` (`publish` subcommand + install-time verify), `apps/cli/src/lib/registry.ts` (`buildSkillIndex`, `verifySkillIntegrity`, `sha256OfFile`, `parseOwnerRepoFromRemote`, `SkillIndexEntry.sha256`), `apps/cli/src/lib/types.ts` (`SkillEntry.sha256`). (#336)
+
 ## 1.20.54
 
 - **Unified fleet target resolution for `agents ssh` + `sessions --host`.** `agents ssh` now accepts the full target grammar the fan-out already used — a registered `name`, a `user@device` (same device, login user overridden, still dialed via its Tailscale route rather than raw LAN DNS), and an ad-hoc `user@host`/`host` literal — instead of only an exact device name (`agents ssh muqsit@mac-mini` no longer errors "Unknown device"). A bare unregistered alias still reports "Unknown device". `sessions --host user@device` now resolves the host part through the registry too, so it stops silently diverging onto the non-Tailscale route. New `resolveDeviceTarget`; `resolveSshTarget` shares one host-part matcher. Source: `apps/cli/src/lib/devices/resolve-target.ts`, `apps/cli/src/commands/ssh.ts`.

package/README.md

@@ -642,6 +642,13 @@ agents routines add daily-digest \
 agents routines list                   # All jobs + next run times
 agents routines run daily-digest       # Test it now, ignore the schedule
 agents routines logs daily-digest      # Last execution — status + report (add --full for raw stdout)
+
+# Routines sync to every device; restrict to an allowlist with --devices
+agents routines add nightly-drain --schedule "0 3 * * *" --agent claude \
+  --devices yosemite-s0,mac-mini --prompt "Drain the local work queue"
+
+agents routines devices nightly-drain --set yosemite-s0,mac-mini  # update allowlist
+agents routines list --host yosemite-s0                            # query another device
 ```
 
 Jobs run sandboxed -- agents only see directories and tools you explicitly allow.
@@ -895,6 +902,8 @@ macOS and Linux. Windows via WSL works but isn't first-class yet.
 
 **macOS-only features:** Keychain-based secrets (`agents secrets`, `agents profiles login`) require macOS. Default iCloud sync for bundles requires macOS + iCloud Keychain enabled; use `--no-icloud-sync` for device-local bundles. On Linux, use environment variables or `.env` files for API keys. Native Linux credential store support is planned.
 
+Interactive tmux-backed runs require tmux 3.2 or newer.
+
 ### Do I need Node.js?
 
 The installer tries Bun first (faster), falls back to npm. Node 22.5+ required at runtime.

package/dist/commands/message.js

@@ -5,6 +5,7 @@ import { getActiveSessions } from '../lib/session/active.js';
 import { getTaskById, updateTaskStatus } from '../lib/cloud/store.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
 import { mailboxDir, enqueue } from '../lib/mailbox.js';
+import { getAgentsInvocation } from '../lib/daemon.js';
 import { resolveMessageTarget, mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { blockIdForSession, listBlocks, readBlock, recordAnswer, recordMessageReceipt, } from '../lib/feed.js';
 import { verifyOperatorIdentity } from '../lib/operator.js';
@@ -89,11 +90,12 @@ async function deliverViaResume(route, mailboxId) {
         die(`Internal error: resume route incomplete for ${mailboxId}.`);
     }
     const argv = resumeArgv(route);
-    // Spawn the same agents binary the user invoked (process.argv[1]) so version
-    // pins and wrappers stay consistent. Detach so the resume can take over a TTY
-    // when interactive; for feed answers we pass the prompt non-interactively.
-    const bin = process.argv[1] ?? 'agents';
-    const child = spawn(process.execPath, [bin, ...argv], {
+    // Relaunch the same agents CLI (via getAgentsInvocation, which resolves the
+    // real binary — not a bun /$bunfs virtual path under the compiled build) so
+    // version pins and wrappers stay consistent. Detach so the resume can take
+    // over a TTY when interactive; for feed answers we pass it non-interactively.
+    const inv = getAgentsInvocation(argv);
+    const child = spawn(inv.command, inv.args, {
         stdio: 'inherit',
         env: process.env,
     });

package/dist/commands/packages.js

@@ -5,13 +5,16 @@
  * for discovering and installing MCP servers, skills, commands, and
  * hooks from configured registries or GitHub sources.
  */
+import * as fs from 'fs';
+import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
+import { getAgentsDir, getEnabledExtraRepos } from '../lib/state.js';
 import { AGENTS, ALL_AGENT_IDS, getAllCliStates, agentLabel, } from '../lib/agents.js';
 import { capableAgents } from '../lib/capabilities.js';
 import { DEFAULT_REGISTRIES } from '../lib/types.js';
-import { getRegistries, setRegistry, removeRegistry, search as searchRegistries, resolvePackage, validatedNpmSpec, validatedPyPISpec, } from '../lib/registry.js';
-import { cloneRepo } from '../lib/git.js';
+import { getRegistries, setRegistry, removeRegistry, search as searchRegistries, resolvePackage, validatedNpmSpec, validatedPyPISpec, buildSkillIndex, verifySkillIntegrity, parseOwnerRepoFromRemote, } from '../lib/registry.js';
+import { cloneRepo, commitAndPush, getRemoteUrl, isGitRepo } from '../lib/git.js';
 import { discoverCommands, resolveCommandSource, installCommand, installCommandCentrally, } from '../lib/commands.js';
 import { discoverSkillsFromRepo, installSkill, installSkillCentrally, } from '../lib/skills.js';
 import { discoverHooksFromRepo, installHooks, installHooksCentrally, } from '../lib/hooks.js';
@@ -325,6 +328,100 @@ When to use:
         }
     });
     // ==========================================================================
+    // PUBLISH COMMAND (self-hosted, git-index skill registry)
+    // ==========================================================================
+    program
+        .command('publish')
+        .description('Generate a skills-index.json for a git repo and push it, making its skills discoverable via agents search/install')
+        .option('--repo <alias>', 'Publish an extra repo added via `agents repo add` (default: your ~/.agents repo)')
+        .option('--name <name>', 'Registry name to suggest in the output (default: the repo name)')
+        .option('--branch <branch>', 'Branch the raw URL should reference', 'main')
+        .option('--dry-run', 'Write the index and print the URL without committing or pushing')
+        .addHelpText('after', `
+Publish walks a repo's skills/ directory, records a sha256 of every SKILL.md,
+and writes skills-index.json at the repo root — a flat index that 'agents search'
+and 'agents install' can consume directly from raw.githubusercontent.com. No
+hosted infrastructure: the index is just a file committed to your GitHub repo.
+
+Examples:
+  # Publish your ~/.agents repo's skills
+  agents publish
+
+  # Publish an extra repo added via 'agents repo add'
+  agents publish --repo team-skills
+
+  # Preview the index without pushing
+  agents publish --dry-run
+
+After publishing, share the printed 'agents registry add skill ...' command so
+others can search and install your skills. Installs verify each SKILL.md against
+the sha256 in the index and abort on mismatch.
+`)
+        .action(async (options) => {
+        // Resolve the target repo: an extra repo by alias, else the primary ~/.agents repo.
+        let repoDir;
+        if (options.repo) {
+            const extra = getEnabledExtraRepos().find((r) => r.alias === options.repo);
+            if (!extra) {
+                console.log(chalk.red(`No enabled extra repo aliased '${options.repo}'.`));
+                console.log(chalk.gray('Add one with: agents repo add <source> --as <alias>'));
+                process.exit(1);
+            }
+            repoDir = extra.dir;
+        }
+        else {
+            repoDir = getAgentsDir();
+        }
+        if (!isGitRepo(repoDir)) {
+            console.log(chalk.red(`${repoDir} is not a git repository.`));
+            console.log(chalk.gray('publish commits + pushes the index, so the repo needs a GitHub remote.'));
+            process.exit(1);
+        }
+        const remoteUrl = await getRemoteUrl(repoDir);
+        const repoSlug = remoteUrl ? parseOwnerRepoFromRemote(remoteUrl) : null;
+        if (!repoSlug) {
+            console.log(chalk.red(`Could not resolve an 'owner/repo' from the git remote of ${repoDir}.`));
+            console.log(chalk.gray(`  Remote: ${remoteUrl || '(none)'} — publish needs a GitHub origin.`));
+            process.exit(1);
+        }
+        const spinner = ora('Building skills index...').start();
+        const index = buildSkillIndex(repoDir, repoSlug, { generatedAt: new Date().toISOString() });
+        spinner.stop();
+        if (index.skills.length === 0) {
+            console.log(chalk.yellow(`No skills found under ${repoDir}/skills.`));
+            console.log(chalk.gray('Add a skill (a directory with a SKILL.md) and re-run publish.'));
+            process.exit(1);
+        }
+        const indexPath = path.join(repoDir, 'skills-index.json');
+        fs.writeFileSync(indexPath, JSON.stringify(index, null, 2) + '\n', 'utf-8');
+        console.log(chalk.bold(`\nIndexed ${index.skills.length} skill(s) into skills-index.json:`));
+        for (const s of index.skills) {
+            console.log(`  ${chalk.cyan(s.name)} ${chalk.gray(`sha256:${s.sha256?.slice(0, 12)}…`)}`);
+        }
+        if (options.dryRun) {
+            console.log(chalk.gray(`\nDry run — wrote ${indexPath} but did not commit or push.`));
+        }
+        else {
+            const pushSpinner = ora('Committing and pushing skills-index.json...').start();
+            const result = await commitAndPush(repoDir, 'chore: update skills-index.json (agents publish)');
+            if (!result.success) {
+                pushSpinner.fail(`Push failed: ${result.error}`);
+                console.log(chalk.gray('The index was written locally — commit and push it manually to publish.'));
+                process.exit(1);
+            }
+            pushSpinner.succeed('Pushed skills-index.json');
+        }
+        const rawUrl = `https://raw.githubusercontent.com/${repoSlug}/${options.branch}/skills-index.json`;
+        const registryName = options.name || repoSlug.split('/')[1] || 'my-skills';
+        console.log(chalk.bold('\nPublished. Share these with anyone who wants your skills:\n'));
+        console.log(chalk.gray('  Index URL:'));
+        console.log(`    ${rawUrl}`);
+        console.log(chalk.gray('\n  Register + search + install:'));
+        console.log(`    ${chalk.green(`agents registry add skill ${registryName} ${rawUrl}`)}`);
+        console.log(`    ${chalk.green(`agents search ${index.skills[0].name} --type skill`)}`);
+        console.log(`    ${chalk.green(`agents install skill:${index.skills[0].name} --agents claude,codex,gemini`)}`);
+    });
+    // ==========================================================================
     // INSTALL COMMAND (unified package installation)
     // ==========================================================================
     program
@@ -448,6 +545,20 @@ When to use:
                 // --names narrows which specific resources within those kinds.
                 console.log(chalk.bold(`\nInstalling from ${resolved.source}`));
                 const { localPath } = await cloneRepo(resolved.source);
+                // Integrity: a published skill entry carries the sha256 of its
+                // SKILL.md. Verify the freshly cloned file against it BEFORE
+                // installing anything — a mismatch aborts rather than trusting a
+                // tampered artifact.
+                if (resolved.type === 'skill' && resolved.skillEntry) {
+                    const check = verifySkillIntegrity(localPath, resolved.skillEntry);
+                    if (!check.ok) {
+                        console.log(chalk.red(`\n${check.error}`));
+                        process.exit(1);
+                    }
+                    if (resolved.skillEntry.sha256) {
+                        console.log(chalk.gray(`  Integrity verified (sha256) for ${resolved.skillEntry.name}`));
+                    }
+                }
                 const requestedTypes = new Set(parseCommaSeparatedList(options.types));
                 const includeType = (type) => requestedTypes.size === 0 || requestedTypes.has(type);
                 const requestedNames = new Set(parseCommaSeparatedList(options.names));

package/dist/commands/profiles.js

@@ -13,6 +13,7 @@ import { listProfiles, readProfile, writeProfile, deleteProfile, profileExists,
 import { getPreset, listPresets, expandPreset } from '../lib/profiles-presets.js';
 import { hasKeychainToken, keychainItemName, setKeychainToken, deleteKeychainToken, } from '../lib/secrets/profiles.js';
 import { isInteractiveTerminal } from './utils.js';
+import { getAgentsInvocation } from '../lib/daemon.js';
 /**
  * Pure helper: builds a Profile from collected wizard inputs. Extracted so the
  * shape of preset->profile mapping for the `create` wizard is unit-testable
@@ -280,15 +281,15 @@ Examples:
             const run = await confirm({ message: 'Run smoke test now?', default: true });
             if (run) {
                 console.log(chalk.gray(`Spawning: agents run ${name} "say alive in one word" (60s timeout)`));
-                const child = spawn(process.argv[0], [
-                    process.argv[1],
+                const inv = getAgentsInvocation([
                     'run',
                     name,
                     'say alive in one word',
                     '--headless',
                     '--timeout',
                     '60s',
-                ], { stdio: 'inherit' });
+                ]);
+                const child = spawn(inv.command, inv.args, { stdio: 'inherit' });
                 child.on('exit', (code) => process.exit(code ?? 0));
             }
             else {

package/dist/commands/routines.js

@@ -10,18 +10,21 @@ import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
-import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemonPid, readDaemonLog, } from '../lib/daemon.js';
+import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemonLog, getDaemonStatus, } from '../lib/daemon.js';
 import { humanizeCron, humanizeNextRun, formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
-import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, getLatestRun, getRunDir, getJobPath, parseAtTime, } from '../lib/routines.js';
+import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, getLatestRun, getRunDir, getJobPath, parseAtTime, jobRunsOnThisDevice, checkJobDeviceEligibility, } from '../lib/routines.js';
 import { fireWebhookJobs, matchJobsToWebhook } from '../lib/triggers/webhook.js';
 import { getRoutinesDir } from '../lib/state.js';
 import { IS_WINDOWS } from '../lib/platform/index.js';
 import { safeJoin } from '../lib/paths.js';
-import { executeJob, executeJobDetached } from '../lib/runner.js';
+import { executeJob, executeJobDetached, monitorRunningJobs } from '../lib/runner.js';
 import { JobScheduler } from '../lib/scheduler.js';
 import { detectOverdueJobs } from '../lib/overdue.js';
 import { isInteractiveTerminal, requireInteractiveSelection } from './utils.js';
 import { setHelpSections } from '../lib/help.js';
+import { loadDevices } from '../lib/devices/registry.js';
+import { normalizeHost } from '../lib/machine-id.js';
+import { addHostOption } from '../lib/hosts/option.js';
 /**
  * Human-friendly wall-clock a run took (e.g. "  · 3 min", "  · 45 sec"), or ""
  * when it hasn't completed or timestamps are unparseable. Leading separator lets
@@ -122,11 +125,34 @@ async function pickJob(message, filter, alternatives = [], cwd) {
         throw err;
     }
 }
+/**
+ * Parse a comma-separated devices string, normalize, deduplicate, and validate
+ * each entry against the registered fleet. Exits nonzero on empty/whitespace
+ * input or unknown devices.
+ */
+async function parseAndValidateDevices(raw) {
+    const names = [...new Set(raw.split(',').map((s) => s.trim()).filter(Boolean).map((s) => normalizeHost(s)))];
+    if (names.length === 0) {
+        console.log(chalk.red('--devices requires at least one non-empty device name'));
+        process.exit(1);
+    }
+    const registry = await loadDevices();
+    const registered = new Set(Object.keys(registry).map((k) => normalizeHost(k)));
+    const unknown = names.filter((n) => !registered.has(n));
+    if (unknown.length > 0) {
+        console.log(chalk.red(`Unknown device(s): ${unknown.join(', ')}`));
+        console.log(chalk.gray(`Registered: ${[...registered].sort().join(', ') || '(none)'}`));
+        console.log(chalk.gray('Enroll devices with: agents devices sync'));
+        process.exit(1);
+    }
+    return names;
+}
 /** Register the `agents routines` command tree. */
 export function registerRoutinesCommands(program) {
     const routinesCmd = program
         .command('routines')
         .description('Schedule agents to run on a cron schedule or at a specific time. The scheduler auto-starts on first add.');
+    addHostOption(routinesCmd);
     setHelpSections(routinesCmd, {
         examples: `
       # Cron routine: Claude every weekday at 9 AM (scheduler auto-starts)
@@ -141,6 +167,15 @@ export function registerRoutinesCommands(program) {
       # List all routines and their next run times
       agents routines list
 
+      # List routines on a specific device
+      agents routines list --host yosemite-s0
+
+      # Create a routine restricted to specific devices
+      agents routines add nightly --schedule "0 2 * * *" --agent claude --prompt "Summarize today's commits" --devices yosemite-s0,mac-mini
+
+      # Interactively manage which devices may run a routine
+      agents routines devices nightly
+
       # Run a routine right now in the foreground (ignores schedule)
       agents routines run daily-standup
 
@@ -175,6 +210,10 @@ export function registerRoutinesCommands(program) {
         .description('See all scheduled jobs, when they run next, and their last execution status')
         .option('--json', 'Emit machine-readable JSON instead of the table (used by the menu bar helper)')
         .action((options) => {
+        try {
+            monitorRunningJobs();
+        }
+        catch { /* best-effort orphan reap */ }
         const jobs = listAllJobs(process.cwd());
         if (jobs.length === 0) {
             if (options.json) {
@@ -212,6 +251,8 @@ export function registerRoutinesCommands(program) {
                     scheduleHuman: fireConditionLabel(job),
                     trigger: job.trigger ?? null,
                     timezone: job.timezone ?? null,
+                    devices: job.devices ?? [],
+                    runsHere: jobRunsOnThisDevice(job),
                     enabled: job.enabled,
                     overdue: overdueSet.has(job.name),
                     nextRun: nextRun ? nextRun.toISOString() : null,
@@ -234,12 +275,13 @@ export function registerRoutinesCommands(program) {
         const NAME_W = 24;
         const AGENT_W = 10;
         const REPO_W = REPO_DISPLAY_MAX;
+        const DEVICE_W = 22;
         const SCHED_W = 22;
         const ENABLED_W = 10;
         const NEXT_W = 22;
-        const header = `  ${'Name'.padEnd(NAME_W)} ${'Agent'.padEnd(AGENT_W)} ${'Repo'.padEnd(REPO_W)} ${'Schedule'.padEnd(SCHED_W)} ${'Enabled'.padEnd(ENABLED_W)} ${'Next Run'.padEnd(NEXT_W)} Last Status`;
+        const header = `  ${'Name'.padEnd(NAME_W)} ${'Agent'.padEnd(AGENT_W)} ${'Repo'.padEnd(REPO_W)} ${'Devices'.padEnd(DEVICE_W)} ${'Schedule'.padEnd(SCHED_W)} ${'Enabled'.padEnd(ENABLED_W)} ${'Next Run'.padEnd(NEXT_W)} Last Status`;
         console.log(chalk.gray(header));
-        console.log(chalk.gray('  ' + '-'.repeat(NAME_W + AGENT_W + REPO_W + SCHED_W + ENABLED_W + NEXT_W + 20)));
+        console.log(chalk.gray('  ' + '-'.repeat(NAME_W + AGENT_W + REPO_W + DEVICE_W + SCHED_W + ENABLED_W + NEXT_W + 20)));
         for (const job of jobs) {
             const nextRun = scheduler.getNextRun(job.name);
             const nextStr = humanizeNextRun(nextRun ?? null, now, job.timezone);
@@ -261,6 +303,18 @@ export function registerRoutinesCommands(program) {
             // chalk adds escape codes; pad the raw word and let chalk wrap it.
             const enabledWord = job.enabled ? 'yes' : 'no';
             const enabledPad = Math.max(0, ENABLED_W - enabledWord.length);
+            const deviceFull = job.devices?.join(',') ?? '';
+            const deviceWord = deviceFull.length === 0
+                ? 'all'
+                : deviceFull.length > DEVICE_W
+                    ? deviceFull.slice(0, DEVICE_W - 1) + '…'
+                    : deviceFull;
+            const deviceCell = deviceFull.length === 0
+                ? chalk.gray('all')
+                : jobRunsOnThisDevice(job)
+                    ? deviceWord
+                    : chalk.gray(deviceWord);
+            const devicePad = Math.max(0, DEVICE_W - deviceWord.length);
             const statusColor = lastStatus === 'completed' ? chalk.green
                 : lastStatus === 'failed' ? chalk.red
                     : lastStatus === 'timeout' ? chalk.yellow
@@ -269,7 +323,7 @@ export function registerRoutinesCommands(program) {
             const agentLabelPadded = job.workflow
                 ? chalk.magenta(`wf:${job.workflow}`.padEnd(10))
                 : (job.agent || '').padEnd(10);
-            console.log(`  ${chalk.cyan(job.name.padEnd(NAME_W))} ${agentLabelPadded} ${repoCell}${' '.repeat(repoPadding)} ${schedStr.padEnd(SCHED_W)} ${enabledStr}${' '.repeat(enabledPad)} ${chalk.gray(nextStr.padEnd(NEXT_W))} ${statusColor(lastStatus)}${overdueTag}`);
+            console.log(`  ${chalk.cyan(job.name.padEnd(NAME_W))} ${agentLabelPadded} ${repoCell}${' '.repeat(repoPadding)} ${deviceCell}${' '.repeat(devicePad)} ${schedStr.padEnd(SCHED_W)} ${enabledStr}${' '.repeat(enabledPad)} ${chalk.gray(nextStr.padEnd(NEXT_W))} ${statusColor(lastStatus)}${overdueTag}`);
         }
         if (overdueSet.size > 0) {
             console.log();
@@ -285,10 +339,11 @@ export function registerRoutinesCommands(program) {
         .option('-a, --agent <agent>', 'Which agent runs this routine: claude, codex, gemini, cursor, or opencode')
         .option('--workflow <name>', 'Run an installed workflow (~/.agents/workflows/<name>) via `agents run`. Mutually exclusive with --agent.')
         .option('-p, --prompt <prompt>', 'Task instruction for the agent')
-        .option('-m, --mode <mode>', "Execution mode: plan (read-only), edit (can write files), auto (smart classifier), or skip (bypass all permission prompts). 'full' accepted as alias for skip.", 'plan')
+        .option('-m, --mode <mode>', "Execution mode: plan (read-only), edit (can write files), auto (smart classifier, the default), or skip (bypass all permission prompts). 'full' accepted as alias for skip.", 'auto')
         .option('-e, --effort <effort>', 'Reasoning effort: low | medium | high | xhigh | max | auto', 'auto')
         .option('-t, --timeout <timeout>', 'Kill the agent if it runs longer than this (e.g., 10m, 2h, 3d, 1w; max 1w)', '10m')
         .option('--timezone <tz>', 'Interpret schedule in this timezone (e.g., America/Los_Angeles)')
+        .option('--devices <names>', 'Fleet allowlist (comma-separated): only listed devices schedule and fire this routine. Omit for unrestricted.')
         .option('--at <time>', 'One-shot mode: run once at this time (e.g., "14:30" or "2026-02-24 09:00"), then disable')
         .option('--end-at <iso>', 'Stop firing on or after this ISO 8601 timestamp (e.g., "2026-12-31T23:59:00Z"); routine auto-disables.')
         .option('--disabled', 'Create the routine but keep it paused (enable later with resume)')
@@ -332,6 +387,11 @@ export function registerRoutinesCommands(program) {
                 console.log(chalk.red('Prompt is required (use --prompt)'));
                 process.exit(1);
             }
+            // Parse and validate --devices against the fleet registry.
+            let devices;
+            if (options.devices !== undefined) {
+                devices = await parseAndValidateDevices(options.devices);
+            }
             const config = {
                 name: nameOrPath,
                 schedule,
@@ -343,6 +403,7 @@ export function registerRoutinesCommands(program) {
                 enabled: !options.disabled,
                 prompt: options.prompt,
                 timezone: options.timezone,
+                ...(devices ? { devices } : {}),
                 ...(runOnce ? { runOnce: true } : {}),
                 ...(options.endAt ? { endAt: options.endAt } : {}),
             };
@@ -394,7 +455,7 @@ export function registerRoutinesCommands(program) {
                 process.exit(1);
             }
             const config = {
-                mode: 'plan',
+                mode: 'auto',
                 effort: 'auto',
                 timeout: '10m',
                 enabled: true,
@@ -544,6 +605,12 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.red(`Job '${name}' not found`));
             process.exit(1);
         }
+        const eligibility = checkJobDeviceEligibility(job);
+        if (eligibility) {
+            console.log(chalk.red(eligibility.message));
+            console.log(chalk.gray(`  ${eligibility.suggestion}`));
+            process.exit(1);
+        }
         const runLabel = job.workflow ? `workflow: ${job.workflow}` : `agent: ${job.agent}`;
         console.log(chalk.bold(`Running job '${name}' (${runLabel}, mode: ${job.mode})\n`));
         const spinner = ora('Executing...').start();
@@ -829,6 +896,87 @@ export function registerRoutinesCommands(program) {
             process.exit(1);
         }
     });
+    // Fleet allowlist management for a single routine.
+    routinesCmd
+        .command('devices [name]')
+        .description('View or change which devices may run a routine. Without flags, opens an interactive picker (requires a TTY).')
+        .option('--set <devices>', 'Replace the allowlist with this comma-separated list (strict fleet validation)')
+        .option('--clear', 'Remove the allowlist so the routine runs on every device')
+        .action(async (name, options) => {
+        const hasSet = options.set !== undefined;
+        if (hasSet && options.clear) {
+            console.log(chalk.red('--set and --clear are mutually exclusive'));
+            process.exit(1);
+        }
+        if (!name) {
+            name = await pickJob('Select routine', undefined, ['agents routines devices <name>']) ?? undefined;
+            if (!name)
+                return;
+        }
+        const job = readJob(name);
+        if (!job) {
+            console.log(chalk.red(`Job '${name}' not found`));
+            process.exit(1);
+        }
+        if (options.clear) {
+            job.devices = undefined;
+            writeJob(job);
+            console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
+            if (isDaemonRunning())
+                signalDaemonReload();
+            return;
+        }
+        if (hasSet) {
+            const devices = await parseAndValidateDevices(options.set);
+            job.devices = devices;
+            writeJob(job);
+            console.log(chalk.green(`Devices for '${name}' set to: ${devices.join(', ')}`));
+            if (isDaemonRunning())
+                signalDaemonReload();
+            return;
+        }
+        // Interactive picker
+        if (!isInteractiveTerminal()) {
+            requireInteractiveSelection('device allowlist', ['agents routines devices <name> --set a,b', 'agents routines devices <name> --clear']);
+        }
+        const registry = await loadDevices();
+        const registeredNames = Object.keys(registry).map((k) => normalizeHost(k)).sort();
+        if (registeredNames.length === 0) {
+            console.log(chalk.yellow('No devices registered. Enroll with: agents devices sync'));
+            return;
+        }
+        const currentSet = new Set((job.devices ?? []).map((d) => normalizeHost(d)));
+        try {
+            const { checkbox } = await import('@inquirer/prompts');
+            const selected = await checkbox({
+                message: `Devices allowed to run '${name}' (space to toggle, enter to confirm, empty = unrestricted):`,
+                choices: registeredNames.map((d) => ({
+                    value: d,
+                    name: d,
+                    checked: currentSet.has(d),
+                })),
+            });
+            if (selected.length === 0) {
+                job.devices = undefined;
+                writeJob(job);
+                console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
+            }
+            else {
+                job.devices = selected;
+                writeJob(job);
+                console.log(chalk.green(`Devices for '${name}' set to: ${selected.join(', ')}`));
+            }
+            if (isDaemonRunning())
+                signalDaemonReload();
+        }
+        catch (err) {
+            if (isPromptCancelled(err)) {
+                console.log(chalk.gray('Cancelled'));
+                return;
+            }
+            throw err;
+        }
+    });
     // Scheduler lifecycle — usually auto-managed by `routines add`, exposed here for manual control.
     routinesCmd
         .command('start')
@@ -860,16 +1008,33 @@ export function registerRoutinesCommands(program) {
         .command('status')
         .description('Show scheduler status, enabled routines, and when each one fires next.')
         .action(() => {
-        const running = isDaemonRunning();
-        const pid = readDaemonPid();
+        try {
+            monitorRunningJobs();
+        }
+        catch { /* best-effort orphan reap */ }
+        const status = getDaemonStatus();
         console.log(chalk.bold('Scheduler\n'));
-        console.log(`  Status:    ${running ? chalk.green('running') : chalk.gray('stopped')}`);
-        if (pid)
-            console.log(`  PID:       ${pid}`);
+        const stateLabel = status.state === 'running'
+            ? chalk.green('running')
+            : status.state === 'wedged'
+                ? chalk.red('wedged')
+                : chalk.gray('stopped');
+        console.log(`  Status:    ${stateLabel}`);
+        if (status.pid)
+            console.log(`  PID:       ${status.pid}`);
+        if (status.binaryPath)
+            console.log(`  Binary:    ${chalk.gray(status.binaryPath)}`);
+        if (status.heartbeat) {
+            const ago = Math.round((Date.now() - Date.parse(status.heartbeat.lastTick)) / 1000);
+            console.log(`  Heartbeat: ${chalk.gray(`${ago} sec ago`)}`);
+        }
         const jobs = listAllJobs();
         const enabled = jobs.filter((j) => j.enabled);
         console.log(`  Routines:  ${enabled.length} enabled / ${jobs.length} total`);
-        if (running && enabled.length > 0) {
+        if (status.state === 'wedged') {
+            console.log(chalk.red('\n  The daemon is wedged (heartbeat stale). Restart with: agents routines stop && agents routines start'));
+        }
+        if (status.running && enabled.length > 0) {
             const scheduler = new JobScheduler(async () => { });
             scheduler.loadAll();
             const scheduled = scheduler.listScheduled();
@@ -880,7 +1045,7 @@ export function registerRoutinesCommands(program) {
             }
             scheduler.stopAll();
         }
-        else if (!running && jobs.length > 0) {
+        else if (!status.running && jobs.length > 0) {
             console.log(chalk.gray('\n  Start the scheduler to begin firing routines: agents routines start'));
         }
     });
@@ -910,4 +1075,9 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.gray('No scheduler logs'));
         }
     });
+    // Every direct routines subcommand accepts the shared --host family so remote
+    // fall-through works and each subcommand's --help documents the flags.
+    for (const sub of routinesCmd.commands) {
+        addHostOption(sub);
+    }
 }

package/dist/commands/ssh.js

@@ -20,18 +20,11 @@ import { machineId } from '../lib/session/sync/config.js';
 import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from '../lib/devices/tailscale.js';
 import { localLoginUser, planDeviceReconciliation, runDeviceSync, withDefaultUser } from '../lib/devices/sync.js';
-import { resolveDeviceTarget } from '../lib/devices/resolve-target.js';
+import { resolveDeviceTarget, splitUserHost } from '../lib/devices/resolve-target.js';
 import { clearPendingSentinel } from '../lib/devices/pending.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
-/** Parse `user@host` or `host` into pieces. */
-function parseTarget(target) {
-    const at = target.indexOf('@');
-    if (at === -1)
-        return { host: target };
-    return { user: target.slice(0, at), host: target.slice(at + 1) };
-}
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
  * command is running on so it stands out from the rest of the tailnet. */
 function deviceSummary(d, isSelf = false) {
@@ -240,7 +233,7 @@ Typical workflow:
         .option('--platform <platform>', 'windows | linux | macos')
         .action(async (name, target, opts) => {
         try {
-            const { host, user } = parseTarget(target);
+            const { host, user } = splitUserHost(target);
             const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
             const d = await upsertDevice(name, {
                 platform: opts.platform ?? undefined,