@phnx-labs/agents-cli 1.20.55 → 1.20.57

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 1.20.57
+
+- **`agents teams resume` / `agents teams message` — resume a stopped teammate with a follow-up message.** A teammate that ended its turn with more to do (PR open awaiting review, headless turn cap, a redirect after the fact) could not be reached: `agents message` resolves only *live* sessions, so a completed/stopped/failed teammate had no path back short of finishing the work by hand or spawning a fresh, context-less teammate. `teams resume <team> <teammate> <message>` re-enters the teammate's **own** session with the message as the next user turn, re-launching through the same backend (local process or remote host) in its original worktree and flipping it back to `running` so `teams status` tracks it live. `teams message` is the same command with automatic routing by reconciled status: a **running** teammate is steered via its mailbox (delivered at its next tool call, no re-launch); a **stopped** one is resumed; a **pending** one is refused with a pointer to `teams start`. Works for every harness — the resume delegates to `agents run --resume`, inheriting native resume for Claude/Codex and the universal `/continue` replay for the rest (OpenCode, Grok, Kimi, …); the resume target is the teammate's captured underlying session id (`remoteSessionId ?? agentId`), and a non-Claude teammate that died before emitting a session id is refused with a clear error rather than resumed into a fresh run. This also makes good on `teams stop`'s long-standing "can be restarted later" promise, which no code implemented. Source: `apps/cli/src/commands/teams.ts` (`message`/`resume` subcommands, `decideTeamMessageRoute`), `apps/cli/src/lib/teams/agents.ts` (`AgentManager.resumeTeammate`, resume-aware `buildRunArgv`/`buildCommand`/`launchProcess`/`launchRemoteProcess`).
+- **The always-on daemon now hosts the secrets broker (socket-first) — one supervised backbone instead of a separate service (#416, step 1).** `runDaemon()` binds the broker via the new `startHostedBroker()` before the scheduler and the heavy browser/session-sync services, so `agents secrets` resolves within ms of daemon start. It serves the same socket + wire protocol as the standalone broker (no `PROTOCOL_VERSION` bump — `agentGetSync`/`agentPing`/`agentAutoLoadSync` are unchanged), but is daemon-safe: no pid-guard, no `process.exit`/signal handlers/self-heal-exit (which would take the daemon down), TTL-eviction only. `ensureAgentRunning()` gains a Path 0 that prefers the daemon and falls back to the standalone `com.phnx-labs.agents-secrets-agent` launchd service, and the daemon only hosts when no broker is already reachable, so a live standalone broker is never orphaned. Retiring the standalone service (a gated `launchctl bootout` migration) and child-spawning the heavy services are the follow-on (#417). Source: `apps/cli/src/lib/secrets/agent.ts` (`startHostedBroker`, `ensureAgentRunning` Path 0, `agentPing` exported), `apps/cli/src/lib/daemon.ts` (`runDaemon` broker host + shutdown).
+- **Clarified `agents secrets list` POLICY column labels.** The column previously mixed policy names, runtime state, and implementation jargon (`daily · 7d left`, `always ask`, `never · NO ACL`). It now uses a consistent `policy · state` form: `daily`, `daily · held 7d`, `always · prompt`, and `never · no prompt`. Source: `apps/cli/src/commands/secrets.ts` (`renderPolicyCol`).
+
+## 1.20.56
+
+- **Fix native routine schedulers rejecting the published CLI as a Bun virtual path.** Bun's standalone runtime reports the embedded `/$bunfs/root/agents` entry as existing at `process.argv[1]`, while the real physical executable lives at `process.execPath`. Daemon resolution now substitutes that physical executable before generating launchd/systemd manifests or detached launches; the existing virtual-path guard still rejects any virtual path that reaches supervision. Source: `apps/cli/src/lib/daemon.ts`.
+- **Fix: `agents teams`, `agents message`, and `agents profiles check` work again on the signed standalone binary (regression from #315).** When `agents` resolves to the bun-compiled Mach-O (shipped since 1.20.53), three self-spawn sites relaunched the CLI as `[process.execPath, process.argv[1], …]` — but under a bun standalone executable `process.argv[1]` is the virtual entry `/$bunfs/root/agents`, so the child died with `unknown command '/$bunfs/root/agents'` (or `/bin/sh: /$bunfs/root/agents: No such file or directory`). Every teammate spawned by a compiled-binary install failed in 0s. New shared `getAgentsInvocation(subArgs)` (`apps/cli/src/lib/daemon.ts`) resolves the real on-disk binary — mapping the `/$bunfs/root/…` virtual path to `process.execPath`, running a `.js` entry under node, and a native binary directly — and `teams/agents.ts`, `commands/message.ts`, and `commands/profiles.ts` route through it. Verified end-to-end: a teammate spawned by the freshly-compiled binary runs to `completed` with no `$bunfs` error. Source: `apps/cli/src/lib/daemon.ts` (`getAgentsInvocation`), `apps/cli/src/lib/teams/agents.ts`, `apps/cli/src/commands/{message,profiles}.ts`.
 ## 1.20.55
 
 - **Routine scheduler health is now observable and self-healing.** `agents routines status` distinguishes `running`, `wedged`, and `stopped`, and reports the daemon binary plus heartbeat age. Routine listing/status opportunistically finalize orphaned runs; PID reuse checks and a 24-hour wall-clock limit prevent stale `running` records; daemon startup rejects bun virtual paths and warns about worktree binaries that can disappear. Source: `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/runner.ts`, `apps/cli/src/commands/routines.ts`.
@@ -10,7 +20,7 @@
 - **`agents devices sync` pins the login user on Windows too.** `os.userInfo().username` returns `COMPUTER\user` / `DOMAIN\user` on Windows, which failed the safe-charset guard, so Windows boxes synced with no pinned user and `--host <device>` fell back to the wrong local account. `sanitizeLoginUser` now strips the domain prefix to the bare ssh account before the guard. Also folds the duplicate `user@host` splitter (`parseTarget` in `ssh.ts`) into the canonical `splitUserHost` so there is one parser. Source: `apps/cli/src/lib/devices/sync.ts`, `apps/cli/src/commands/ssh.ts`.
 - **Menu bar ACTIVE section now shows every local session, not just extension-registered terminals.** The dropdown's session source was `live-terminals.json`, which only carries terminals the Factory extension registers — a machine with 25 live sessions (tmux, ghostty, headless) rendered `ACTIVE · 1 running`. The helper now feeds triage + ACTIVE from `agents sessions --active --local --json` (the session engine's authoritative view, issue #741 contract) on the same warm-cache pattern as routines (30s TTL, refreshed off the click path; the cheap file still covers cold start and the 10s badge poll). Blocked sessions outside the extension's view now surface in NEEDS YOU too. Idle rows cap at 3 per repo group — the group header carries the true counts — so a big idle fleet can't wall the menu. Source: `apps/cli/menubar/Sources/MenubarHelper/{StatusItemController,LocalState,AgentsCLI,Models}.swift`.
 - **Daemon service manifests pin JavaScript installs to the current Node runtime.** launchd and systemd now invoke `process.execPath <entry> daemon _run`, matching the detached launcher, instead of executing the JS entrypoint through `#!/usr/bin/env node`. Linux user services therefore stop falling back to an obsolete system Node (observed as Node 18 failing on `node:util.styleText`) when the CLI was installed under Node 22/24. Native `agents` launchers remain direct executables. Source: `apps/cli/src/lib/daemon.ts`.
-- **Routines can be pinned to one machine with `device:` / `--device`.** Routine YAMLs sync fleet-wide via the user repo, so an enabled routine previously fired on every device running the scheduler. A `device: <name>` pin (matched against the local `machineId()`, normalized like `agents devices` names) makes the job inert everywhere else: the cron scheduler skips it, webhook triggers don't match it, overdue detection/`catchup`/daemon nags ignore it, and `routines run` refuses with an `agents ssh <device>` pointer. `routines list` grows a Device column and `--json` gains `device` + `runsHere`. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/scheduler.ts`, `apps/cli/src/lib/overdue.ts`, `apps/cli/src/lib/triggers/webhook.ts`, `apps/cli/src/commands/routines.ts`.
+- **Routines support a `devices:` allowlist so multiple machines each fire the same job independently.** Routine YAMLs sync fleet-wide via the user repo, so without a restriction an enabled routine fires on every device running the scheduler. A `devices: [yosemite-s0, mac-mini]` allowlist makes each listed machine run the job independently on schedule; omitting the field (or `--clear`) leaves the job unrestricted. A single-entry list `devices: [yosemite-s0]` replaces the legacy singular `device:` pin — v12 migration converts any existing `device: X` YAML automatically to `devices: [X]`. All automatic paths (cron scheduler, webhook triggers, overdue/`catchup`, daemon nags, detached runner fires, one-shot `--at`) skip devices outside the allowlist; attempting to run a job on an ineligible host errors with the allowed device names and a ready-to-paste `--host` hint. `routines add --devices yosemite-s0,mac-mini` sets the list at creation (validated against the registered fleet); `routines devices <name>` opens a preselected multi-select picker; `--set <csv>` and `--clear` update it non-interactively and are mutually exclusive. `routines list` gains a Devices column; `--json` gains `devices` array and `runsHere`. `--host <device>` (alias: `--device`) routes any `routines` subcommand to a remote machine over SSH. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/scheduler.ts`, `apps/cli/src/lib/overdue.ts`, `apps/cli/src/lib/triggers/webhook.ts`, `apps/cli/src/lib/runner.ts`, `apps/cli/src/lib/hosts/passthrough.ts`, `apps/cli/src/lib/migrate.ts`, `apps/cli/src/commands/routines.ts`.
 - **Routines now default to `--mode auto` instead of `plan` (RUSH-1595).** A routine created without an explicit `mode` now runs under the smart classifier (`auto`) rather than read-only `plan`, so unattended jobs can create PRs, write files, and run tests end-to-end without every user opting in — `auto` maps to `--permission-mode auto` (claude), workspace-write + network (codex), `--auto high` (droid), and kimi's default headless run (which had no read-only mode and previously errored at `plan`). Opt down to `mode: plan` for read-only monitoring/reporting. `JOB_DEFAULTS.mode`, the `agents routines add --mode` flag default, and the file-add default all move to `auto`; `writeJob` now omits `mode` when it equals `auto`. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/commands/routines.ts`.
 - **`agents publish` — a self-hosted, zero-infrastructure skill registry that round-trips with `agents search`/`agents install`.** Publish walks a git repo's `skills/` directory, records a sha256 of every `SKILL.md`, and writes a flat `skills-index.json` (`SkillIndexDocument` shape) at the repo root, then commits + pushes it and prints the `raw.githubusercontent.com` URL plus the exact `agents registry add skill <name> <url>` command to share. No hosted aggregator: the index is just a file in your GitHub repo, consumed directly by the existing `fetchSkillIndex`/`searchSkillRegistries` path. Targets your `~/.agents` repo by default or an extra repo via `--repo <alias>` (`--dry-run` previews without pushing). Each index entry carries `sha256`, threaded through `SkillEntry`/`normalizeSkillEntry`, and `agents install` now verifies the freshly cloned `SKILL.md` against it — a mismatch aborts with a clear error rather than trusting a tampered artifact. This is the self-hosted/git-index slice of #336; global no-URL discovery (a hosted aggregator) remains future work. Source: `apps/cli/src/commands/packages.ts` (`publish` subcommand + install-time verify), `apps/cli/src/lib/registry.ts` (`buildSkillIndex`, `verifySkillIntegrity`, `sha256OfFile`, `parseOwnerRepoFromRemote`, `SkillIndexEntry.sha256`), `apps/cli/src/lib/types.ts` (`SkillEntry.sha256`). (#336)
 

package/README.md

@@ -643,9 +643,12 @@ agents routines list                   # All jobs + next run times
 agents routines run daily-digest       # Test it now, ignore the schedule
 agents routines logs daily-digest      # Last execution — status + report (add --full for raw stdout)
 
-# Routines sync to every device; pin one to a single machine with --device
+# Routines sync to every device; restrict to an allowlist with --devices
 agents routines add nightly-drain --schedule "0 3 * * *" --agent claude \
-  --device yosemite-s0 --prompt "Drain the work queue"
+  --devices yosemite-s0,mac-mini --prompt "Drain the local work queue"
+
+agents routines devices nightly-drain --set yosemite-s0,mac-mini  # update allowlist
+agents routines list --host yosemite-s0                            # query another device
 ```
 
 Jobs run sandboxed -- agents only see directories and tools you explicitly allow.

package/dist/commands/message.js

@@ -5,6 +5,7 @@ import { getActiveSessions } from '../lib/session/active.js';
 import { getTaskById, updateTaskStatus } from '../lib/cloud/store.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
 import { mailboxDir, enqueue } from '../lib/mailbox.js';
+import { getAgentsInvocation } from '../lib/daemon.js';
 import { resolveMessageTarget, mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { blockIdForSession, listBlocks, readBlock, recordAnswer, recordMessageReceipt, } from '../lib/feed.js';
 import { verifyOperatorIdentity } from '../lib/operator.js';
@@ -89,11 +90,12 @@ async function deliverViaResume(route, mailboxId) {
         die(`Internal error: resume route incomplete for ${mailboxId}.`);
     }
     const argv = resumeArgv(route);
-    // Spawn the same agents binary the user invoked (process.argv[1]) so version
-    // pins and wrappers stay consistent. Detach so the resume can take over a TTY
-    // when interactive; for feed answers we pass the prompt non-interactively.
-    const bin = process.argv[1] ?? 'agents';
-    const child = spawn(process.execPath, [bin, ...argv], {
+    // Relaunch the same agents CLI (via getAgentsInvocation, which resolves the
+    // real binary — not a bun /$bunfs virtual path under the compiled build) so
+    // version pins and wrappers stay consistent. Detach so the resume can take
+    // over a TTY when interactive; for feed answers we pass it non-interactively.
+    const inv = getAgentsInvocation(argv);
+    const child = spawn(inv.command, inv.args, {
         stdio: 'inherit',
         env: process.env,
     });

package/dist/commands/profiles.js

@@ -13,6 +13,7 @@ import { listProfiles, readProfile, writeProfile, deleteProfile, profileExists,
 import { getPreset, listPresets, expandPreset } from '../lib/profiles-presets.js';
 import { hasKeychainToken, keychainItemName, setKeychainToken, deleteKeychainToken, } from '../lib/secrets/profiles.js';
 import { isInteractiveTerminal } from './utils.js';
+import { getAgentsInvocation } from '../lib/daemon.js';
 /**
  * Pure helper: builds a Profile from collected wizard inputs. Extracted so the
  * shape of preset->profile mapping for the `create` wizard is unit-testable
@@ -280,15 +281,15 @@ Examples:
             const run = await confirm({ message: 'Run smoke test now?', default: true });
             if (run) {
                 console.log(chalk.gray(`Spawning: agents run ${name} "say alive in one word" (60s timeout)`));
-                const child = spawn(process.argv[0], [
-                    process.argv[1],
+                const inv = getAgentsInvocation([
                     'run',
                     name,
                     'say alive in one word',
                     '--headless',
                     '--timeout',
                     '60s',
-                ], { stdio: 'inherit' });
+                ]);
+                const child = spawn(inv.command, inv.args, { stdio: 'inherit' });
                 child.on('exit', (code) => process.exit(code ?? 0));
             }
             else {

package/dist/commands/routines.js

@@ -12,7 +12,7 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemonLog, getDaemonStatus, } from '../lib/daemon.js';
 import { humanizeCron, humanizeNextRun, formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
-import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, getLatestRun, getRunDir, getJobPath, parseAtTime, jobRunsOnThisDevice, } from '../lib/routines.js';
+import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, getLatestRun, getRunDir, getJobPath, parseAtTime, jobRunsOnThisDevice, checkJobDeviceEligibility, } from '../lib/routines.js';
 import { fireWebhookJobs, matchJobsToWebhook } from '../lib/triggers/webhook.js';
 import { getRoutinesDir } from '../lib/state.js';
 import { IS_WINDOWS } from '../lib/platform/index.js';
@@ -22,6 +22,9 @@ import { JobScheduler } from '../lib/scheduler.js';
 import { detectOverdueJobs } from '../lib/overdue.js';
 import { isInteractiveTerminal, requireInteractiveSelection } from './utils.js';
 import { setHelpSections } from '../lib/help.js';
+import { loadDevices } from '../lib/devices/registry.js';
+import { normalizeHost } from '../lib/machine-id.js';
+import { addHostOption } from '../lib/hosts/option.js';
 /**
  * Human-friendly wall-clock a run took (e.g. "  · 3 min", "  · 45 sec"), or ""
  * when it hasn't completed or timestamps are unparseable. Leading separator lets
@@ -122,11 +125,34 @@ async function pickJob(message, filter, alternatives = [], cwd) {
         throw err;
     }
 }
+/**
+ * Parse a comma-separated devices string, normalize, deduplicate, and validate
+ * each entry against the registered fleet. Exits nonzero on empty/whitespace
+ * input or unknown devices.
+ */
+async function parseAndValidateDevices(raw) {
+    const names = [...new Set(raw.split(',').map((s) => s.trim()).filter(Boolean).map((s) => normalizeHost(s)))];
+    if (names.length === 0) {
+        console.log(chalk.red('--devices requires at least one non-empty device name'));
+        process.exit(1);
+    }
+    const registry = await loadDevices();
+    const registered = new Set(Object.keys(registry).map((k) => normalizeHost(k)));
+    const unknown = names.filter((n) => !registered.has(n));
+    if (unknown.length > 0) {
+        console.log(chalk.red(`Unknown device(s): ${unknown.join(', ')}`));
+        console.log(chalk.gray(`Registered: ${[...registered].sort().join(', ') || '(none)'}`));
+        console.log(chalk.gray('Enroll devices with: agents devices sync'));
+        process.exit(1);
+    }
+    return names;
+}
 /** Register the `agents routines` command tree. */
 export function registerRoutinesCommands(program) {
     const routinesCmd = program
         .command('routines')
         .description('Schedule agents to run on a cron schedule or at a specific time. The scheduler auto-starts on first add.');
+    addHostOption(routinesCmd);
     setHelpSections(routinesCmd, {
         examples: `
       # Cron routine: Claude every weekday at 9 AM (scheduler auto-starts)
@@ -141,6 +167,15 @@ export function registerRoutinesCommands(program) {
       # List all routines and their next run times
       agents routines list
 
+      # List routines on a specific device
+      agents routines list --host yosemite-s0
+
+      # Create a routine restricted to specific devices
+      agents routines add nightly --schedule "0 2 * * *" --agent claude --prompt "Summarize today's commits" --devices yosemite-s0,mac-mini
+
+      # Interactively manage which devices may run a routine
+      agents routines devices nightly
+
       # Run a routine right now in the foreground (ignores schedule)
       agents routines run daily-standup
 
@@ -216,7 +251,7 @@ export function registerRoutinesCommands(program) {
                     scheduleHuman: fireConditionLabel(job),
                     trigger: job.trigger ?? null,
                     timezone: job.timezone ?? null,
-                    device: job.device ?? null,
+                    devices: job.devices ?? [],
                     runsHere: jobRunsOnThisDevice(job),
                     enabled: job.enabled,
                     overdue: overdueSet.has(job.name),
@@ -240,11 +275,11 @@ export function registerRoutinesCommands(program) {
         const NAME_W = 24;
         const AGENT_W = 10;
         const REPO_W = REPO_DISPLAY_MAX;
-        const DEVICE_W = 13;
+        const DEVICE_W = 22;
         const SCHED_W = 22;
         const ENABLED_W = 10;
         const NEXT_W = 22;
-        const header = `  ${'Name'.padEnd(NAME_W)} ${'Agent'.padEnd(AGENT_W)} ${'Repo'.padEnd(REPO_W)} ${'Device'.padEnd(DEVICE_W)} ${'Schedule'.padEnd(SCHED_W)} ${'Enabled'.padEnd(ENABLED_W)} ${'Next Run'.padEnd(NEXT_W)} Last Status`;
+        const header = `  ${'Name'.padEnd(NAME_W)} ${'Agent'.padEnd(AGENT_W)} ${'Repo'.padEnd(REPO_W)} ${'Devices'.padEnd(DEVICE_W)} ${'Schedule'.padEnd(SCHED_W)} ${'Enabled'.padEnd(ENABLED_W)} ${'Next Run'.padEnd(NEXT_W)} Last Status`;
         console.log(chalk.gray(header));
         console.log(chalk.gray('  ' + '-'.repeat(NAME_W + AGENT_W + REPO_W + DEVICE_W + SCHED_W + ENABLED_W + NEXT_W + 20)));
         for (const job of jobs) {
@@ -268,11 +303,14 @@ export function registerRoutinesCommands(program) {
             // chalk adds escape codes; pad the raw word and let chalk wrap it.
             const enabledWord = job.enabled ? 'yes' : 'no';
             const enabledPad = Math.max(0, ENABLED_W - enabledWord.length);
-            // Unpinned jobs run everywhere; a pin that names another machine is
-            // grayed — this machine never fires it.
-            const deviceWord = job.device || '-';
-            const deviceCell = !job.device
-                ? chalk.gray('-')
+            const deviceFull = job.devices?.join(',') ?? '';
+            const deviceWord = deviceFull.length === 0
+                ? 'all'
+                : deviceFull.length > DEVICE_W
+                    ? deviceFull.slice(0, DEVICE_W - 1) + '…'
+                    : deviceFull;
+            const deviceCell = deviceFull.length === 0
+                ? chalk.gray('all')
                 : jobRunsOnThisDevice(job)
                     ? deviceWord
                     : chalk.gray(deviceWord);
@@ -305,7 +343,7 @@ export function registerRoutinesCommands(program) {
         .option('-e, --effort <effort>', 'Reasoning effort: low | medium | high | xhigh | max | auto', 'auto')
         .option('-t, --timeout <timeout>', 'Kill the agent if it runs longer than this (e.g., 10m, 2h, 3d, 1w; max 1w)', '10m')
         .option('--timezone <tz>', 'Interpret schedule in this timezone (e.g., America/Los_Angeles)')
-        .option('--device <name>', 'Pin to one machine (routines are fleet-synced): only the device with this name schedules and fires the job')
+        .option('--devices <names>', 'Fleet allowlist (comma-separated): only listed devices schedule and fire this routine. Omit for unrestricted.')
         .option('--at <time>', 'One-shot mode: run once at this time (e.g., "14:30" or "2026-02-24 09:00"), then disable')
         .option('--end-at <iso>', 'Stop firing on or after this ISO 8601 timestamp (e.g., "2026-12-31T23:59:00Z"); routine auto-disables.')
         .option('--disabled', 'Create the routine but keep it paused (enable later with resume)')
@@ -349,6 +387,11 @@ export function registerRoutinesCommands(program) {
                 console.log(chalk.red('Prompt is required (use --prompt)'));
                 process.exit(1);
             }
+            // Parse and validate --devices against the fleet registry.
+            let devices;
+            if (options.devices !== undefined) {
+                devices = await parseAndValidateDevices(options.devices);
+            }
             const config = {
                 name: nameOrPath,
                 schedule,
@@ -360,7 +403,7 @@ export function registerRoutinesCommands(program) {
                 enabled: !options.disabled,
                 prompt: options.prompt,
                 timezone: options.timezone,
-                ...(options.device ? { device: options.device } : {}),
+                ...(devices ? { devices } : {}),
                 ...(runOnce ? { runOnce: true } : {}),
                 ...(options.endAt ? { endAt: options.endAt } : {}),
             };
@@ -562,9 +605,10 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.red(`Job '${name}' not found`));
             process.exit(1);
         }
-        if (!jobRunsOnThisDevice(job)) {
-            console.log(chalk.red(`Job '${name}' is pinned to device '${job.device}' and never runs here.`));
-            console.log(chalk.gray(`  Run it there: agents ssh ${job.device} 'agents routines run ${name}'`));
+        const eligibility = checkJobDeviceEligibility(job);
+        if (eligibility) {
+            console.log(chalk.red(eligibility.message));
+            console.log(chalk.gray(`  ${eligibility.suggestion}`));
             process.exit(1);
         }
         const runLabel = job.workflow ? `workflow: ${job.workflow}` : `agent: ${job.agent}`;
@@ -852,6 +896,87 @@ export function registerRoutinesCommands(program) {
             process.exit(1);
         }
     });
+    // Fleet allowlist management for a single routine.
+    routinesCmd
+        .command('devices [name]')
+        .description('View or change which devices may run a routine. Without flags, opens an interactive picker (requires a TTY).')
+        .option('--set <devices>', 'Replace the allowlist with this comma-separated list (strict fleet validation)')
+        .option('--clear', 'Remove the allowlist so the routine runs on every device')
+        .action(async (name, options) => {
+        const hasSet = options.set !== undefined;
+        if (hasSet && options.clear) {
+            console.log(chalk.red('--set and --clear are mutually exclusive'));
+            process.exit(1);
+        }
+        if (!name) {
+            name = await pickJob('Select routine', undefined, ['agents routines devices <name>']) ?? undefined;
+            if (!name)
+                return;
+        }
+        const job = readJob(name);
+        if (!job) {
+            console.log(chalk.red(`Job '${name}' not found`));
+            process.exit(1);
+        }
+        if (options.clear) {
+            job.devices = undefined;
+            writeJob(job);
+            console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
+            if (isDaemonRunning())
+                signalDaemonReload();
+            return;
+        }
+        if (hasSet) {
+            const devices = await parseAndValidateDevices(options.set);
+            job.devices = devices;
+            writeJob(job);
+            console.log(chalk.green(`Devices for '${name}' set to: ${devices.join(', ')}`));
+            if (isDaemonRunning())
+                signalDaemonReload();
+            return;
+        }
+        // Interactive picker
+        if (!isInteractiveTerminal()) {
+            requireInteractiveSelection('device allowlist', ['agents routines devices <name> --set a,b', 'agents routines devices <name> --clear']);
+        }
+        const registry = await loadDevices();
+        const registeredNames = Object.keys(registry).map((k) => normalizeHost(k)).sort();
+        if (registeredNames.length === 0) {
+            console.log(chalk.yellow('No devices registered. Enroll with: agents devices sync'));
+            return;
+        }
+        const currentSet = new Set((job.devices ?? []).map((d) => normalizeHost(d)));
+        try {
+            const { checkbox } = await import('@inquirer/prompts');
+            const selected = await checkbox({
+                message: `Devices allowed to run '${name}' (space to toggle, enter to confirm, empty = unrestricted):`,
+                choices: registeredNames.map((d) => ({
+                    value: d,
+                    name: d,
+                    checked: currentSet.has(d),
+                })),
+            });
+            if (selected.length === 0) {
+                job.devices = undefined;
+                writeJob(job);
+                console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
+            }
+            else {
+                job.devices = selected;
+                writeJob(job);
+                console.log(chalk.green(`Devices for '${name}' set to: ${selected.join(', ')}`));
+            }
+            if (isDaemonRunning())
+                signalDaemonReload();
+        }
+        catch (err) {
+            if (isPromptCancelled(err)) {
+                console.log(chalk.gray('Cancelled'));
+                return;
+            }
+            throw err;
+        }
+    });
     // Scheduler lifecycle — usually auto-managed by `routines add`, exposed here for manual control.
     routinesCmd
         .command('start')
@@ -950,4 +1075,9 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.gray('No scheduler logs'));
         }
     });
+    // Every direct routines subcommand accepts the shared --host family so remote
+    // fall-through works and each subcommand's --help documents the flags.
+    for (const sub of routinesCmd.commands) {
+        addHostOption(sub);
+    }
 }

package/dist/commands/secrets.d.ts

@@ -66,8 +66,9 @@ export declare function buildSecretsExecEnv(parentEnv: NodeJS.ProcessEnv, secret
  * parse, so multi-line values are rejected rather than silently corrupted.
  */
 export declare function bundleEnvToDotenv(env: Record<string, string>): string;
-/** The POLICY column for `secrets list`: the prompt policy, plus a "Nh left"
- * hint when a `daily` bundle is currently held by the secrets-agent. `held`
+/** The POLICY column for `secrets list`: the prompt policy, plus a concise
+ * state hint. `daily` shows `held Nh` when the secrets-agent is currently
+ * caching the bundle; `always` and `never` show whether they prompt. `held`
  * maps bundle name → expiry epoch-ms (from agentStatus()). */
 export declare function renderPolicyCol(b: SecretsBundle, held?: Map<string, number>): string;
 /** Register the `agents secrets` command tree. */

package/dist/commands/secrets.js

@@ -387,17 +387,18 @@ function compactRemaining(expiresAt) {
         return `${hours}h`;
     return `${Math.round(hours / 24)}d`;
 }
-/** The POLICY column for `secrets list`: the prompt policy, plus a "Nh left"
- * hint when a `daily` bundle is currently held by the secrets-agent. `held`
+/** The POLICY column for `secrets list`: the prompt policy, plus a concise
+ * state hint. `daily` shows `held Nh` when the secrets-agent is currently
+ * caching the bundle; `always` and `never` show whether they prompt. `held`
  * maps bundle name → expiry epoch-ms (from agentStatus()). */
 export function renderPolicyCol(b, held) {
     // `never` is loud on purpose — it's the only tier with no user-presence gate.
     if (bundlePolicy(b) === 'never')
-        return chalk.red.bold('never · NO ACL');
+        return chalk.red.bold('never · no prompt');
     if (bundlePolicy(b) === 'always')
-        return chalk.yellow('always ask');
+        return chalk.yellow('always · prompt');
     const exp = held?.get(b.name);
-    return exp ? chalk.green(`daily · ${compactRemaining(exp)} left`) : chalk.gray('daily');
+    return exp ? chalk.green(`daily · held ${compactRemaining(exp)}`) : chalk.gray('daily');
 }
 /** Below this width the fixed date columns no longer fit; `list` uses cards. */
 const SECRETS_WIDE = 96;
@@ -657,7 +658,7 @@ export function registerSecretsCommands(program) {
             return;
         }
         // Cross-reference the secrets-agent so `daily` bundles that are currently
-        // held can show "· Nh left". Soft-fails to no hint if the broker is down.
+        // held can show "· held Nh". Soft-fails to no hint if the broker is down.
         const held = new Map();
         if (process.platform === 'darwin') {
             try {

package/dist/commands/teams.d.ts

@@ -6,7 +6,26 @@
  * dependencies between teammates, and clean up when work is done.
  */
 import type { Command } from 'commander';
-import { AgentManager } from '../lib/teams/agents.js';
+import { AgentManager, AgentStatus } from '../lib/teams/agents.js';
+/** Where `teams message`/`teams resume` routes a follow-up, by teammate status. */
+export type TeamMessageRoute = {
+    kind: 'steer';
+} | {
+    kind: 'resume';
+} | {
+    kind: 'need-message';
+} | {
+    kind: 'not-started';
+};
+/**
+ * Decide how a follow-up to a teammate is delivered from its reconciled status.
+ * Pure — the source of truth for the routing table, unit-tested without I/O.
+ *   - pending                       -> not-started (tell them to `teams start`)
+ *   - running     + message         -> steer (mailbox)
+ *   - stopped/etc + message         -> resume (re-enter session)
+ *   - any actionable + no message   -> need-message
+ */
+export declare function decideTeamMessageRoute(status: AgentStatus, hasMessage: boolean): TeamMessageRoute;
 /**
  * Register the generic cloud dispatcher — staged cloud teammates get
  * dispatched when their --after deps resolve, using repo/branch stored on

package/dist/commands/teams.js

@@ -3,7 +3,8 @@ import { die, relTime, truncate, isJsonMode, padRight } from '../lib/format.js';
 import * as fs from 'fs/promises';
 import { addHostOption } from '../lib/hosts/option.js';
 import * as path from 'path';
-import { AgentManager, checkCliSignedIn, collectTeamsDoctorData, getAgentsDir, VALID_TASK_TYPES, } from '../lib/teams/agents.js';
+import { AgentManager, AgentStatus, checkCliSignedIn, collectTeamsDoctorData, getAgentsDir, VALID_TASK_TYPES, } from '../lib/teams/agents.js';
+import { mailboxDir, enqueue } from '../lib/mailbox.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
 import { emit } from '../lib/events.js';
 import { runSupervisor } from '../lib/teams/supervisor.js';
@@ -126,6 +127,23 @@ function parseTeammate(spec) {
 function shortId(id) {
     return id.slice(0, 8);
 }
+/**
+ * Decide how a follow-up to a teammate is delivered from its reconciled status.
+ * Pure — the source of truth for the routing table, unit-tested without I/O.
+ *   - pending                       -> not-started (tell them to `teams start`)
+ *   - running     + message         -> steer (mailbox)
+ *   - stopped/etc + message         -> resume (re-enter session)
+ *   - any actionable + no message   -> need-message
+ */
+export function decideTeamMessageRoute(status, hasMessage) {
+    if (status === AgentStatus.PENDING)
+        return { kind: 'not-started' };
+    if (!hasMessage)
+        return { kind: 'need-message' };
+    if (status === AgentStatus.RUNNING)
+        return { kind: 'steer' };
+    return { kind: 'resume' };
+}
 /**
  * Preamble injected into every factory worker's prompt. Tells the worker
  * which team + teammate name + task-type it is, and how to file new tasks.
@@ -816,6 +834,12 @@ export function registerTeamsCommands(program) {
       # Delta-poll status without rereading everything
       agents teams status pricing-page --since 2026-04-24T09:00:00-07:00
 
+      # Nudge a teammate that stopped with more to do — resumes its own session
+      agents teams resume pricing-page backend "Review's in — rebase-merge the PR, then release"
+
+      # Steer a still-running teammate mid-flight (delivered at its next tool call)
+      agents teams message pricing-page qa "Skip the flaky screenshot test for now"
+
       # Wind everyone down when shipped
       agents teams disband pricing-page
     `,
@@ -1646,7 +1670,7 @@ export function registerTeamsCommands(program) {
     });
     // stop
     addHostOption(teams.command('stop [team] [teammate]'))
-        .description('Stop a running teammate. Can be restarted later. Cleans up worktree if no uncommitted changes.')
+        .description('Stop a running teammate. Resume it later with `agents teams resume`. Cleans up worktree if no uncommitted changes.')
         .option('--json', 'Output machine-readable JSON')
         .action(async (team, ref, opts) => {
         const mgr = mkManager();
@@ -1733,6 +1757,85 @@ export function registerTeamsCommands(program) {
             console.log(chalk.yellow(`Worktree '${agent.worktreeName}' has uncommitted changes. Keeping it at: ${agent.worktreePath}`));
         }
     });
+    // message / resume — send a follow-up message to a teammate. Routes by the
+    // teammate's reconciled status: a RUNNING teammate is STEERED via its mailbox
+    // (delivered at its next tool call); a STOPPED one (completed/failed/stopped)
+    // is RESUMED — re-entering its own session with the message as the next user
+    // turn, re-attaching it to the team as live.
+    async function teamMessageAction(team, ref, message, opts) {
+        const mgr = mkManager();
+        const lookup = await mgr.resolveAgentIdInTask(team, ref);
+        if (lookup.kind === 'none')
+            die(`No teammate matching '${ref}' in team ${team}`, 2);
+        if (lookup.kind === 'ambiguous') {
+            const shorts = lookup.matches.map(shortId).join(', ');
+            die(`'${ref}' matches multiple teammates: ${shorts}. Use more characters or a name.`, 2);
+        }
+        const agentId = lookup.agentId;
+        // mgr.get reconciles the teammate's status (PID + start-time guard / remote
+        // .exit sentinel / exit-code reap) before we branch — so running-vs-stopped
+        // is a fact, not a guess.
+        const agent = await mgr.get(agentId);
+        if (!agent)
+            die(`Teammate ${shortId(agentId)} vanished from team ${team}.`);
+        const display = agent.name || shortId(agentId);
+        const status = agent.status;
+        const hasMessage = message != null && message.trim().length > 0;
+        const route = decideTeamMessageRoute(status, hasMessage);
+        switch (route.kind) {
+            case 'not-started':
+                die(`Teammate '${display}' hasn't started yet (waiting on --after deps). Run \`agents teams start ${team}\` to launch it.`);
+                return;
+            case 'need-message':
+                if (status === AgentStatus.RUNNING) {
+                    die(`Teammate '${display}' is running — pass a message to steer it.`);
+                }
+                die(`Teammate '${display}' is ${status} — pass a message to resume it: \`agents teams resume ${team} ${display} "<message>"\`.`);
+                return;
+            case 'steer': {
+                // Running -> steer via mailbox; never re-launch (that forks a 2nd session).
+                enqueue(mailboxDir(agentId), { to: agentId, text: message, from: opts.from });
+                if (isJsonMode(opts)) {
+                    console.log(JSON.stringify({ team, agent_id: agentId, name: agent.name ?? null, action: 'steer', status }, null, 2));
+                    return;
+                }
+                console.log(chalk.green(`Steering ${chalk.cyan(display)} (running) — `) +
+                    chalk.dim('message queued; it will see it at its next tool call.'));
+                return;
+            }
+            case 'resume': {
+                // Stopped / completed / failed -> resume its own session with the message.
+                try {
+                    await mgr.resumeTeammate(agentId, message);
+                }
+                catch (err) {
+                    die(err.message);
+                }
+                if (isJsonMode(opts)) {
+                    console.log(JSON.stringify({ team, agent_id: agentId, name: agent.name ?? null, action: 'resume', prior_status: status }, null, 2));
+                    return;
+                }
+                console.log(chalk.green(`Resuming ${chalk.cyan(display)} `) +
+                    chalk.dim(`(was ${status}) in team ${team} — re-entering its session with your message.`));
+                console.log(chalk.dim(`Track it with \`agents teams status ${team}\`.`));
+                return;
+            }
+        }
+    }
+    addHostOption(teams.command('message <team> <teammate> <message>'))
+        .description('Send a follow-up message to a teammate. A running teammate is steered via its mailbox; a stopped one is resumed — re-entering its own session with the message.')
+        .option('--from <who>', 'Label recorded as the sender of this message')
+        .option('--json', 'Output machine-readable JSON')
+        .action(async (team, ref, message, opts) => {
+        await teamMessageAction(team, ref, message, opts);
+    });
+    addHostOption(teams.command('resume <team> <teammate> [message]'))
+        .description("Resume a stopped teammate (completed/failed/stopped) by re-entering its own session with a message as the next user turn. If the teammate is still running, the message is steered via its mailbox instead.")
+        .option('--from <who>', 'Label recorded as the sender of this message')
+        .option('--json', 'Output machine-readable JSON')
+        .action(async (team, ref, message, opts) => {
+        await teamMessageAction(team, ref, message, opts);
+    });
     // remove
     teams
         .command('remove [team] [teammate]')

package/dist/index.js

@@ -874,7 +874,7 @@ if (process.env.AGENTS_SKIP_MIGRATION !== '1') {
         // Bumping the suffix re-runs migrations for every user; binary releases that
         // don't change the schema must NOT re-run (they would destroy user content
         // when migration steps overlap with user-authored paths). See issue #20.
-        const sentinelValue = 'v11';
+        const sentinelValue = 'v12';
         let needRun = true;
         try {
             if (fs.existsSync(sentinel) && fs.readFileSync(sentinel, 'utf-8').trim() === sentinelValue) {

package/dist/lib/daemon.d.ts

@@ -85,7 +85,7 @@ export declare function writeOwnerOnlyServiceManifest(filePath: string, content:
 export declare function generateLaunchdPlist(oauthToken?: string | null): string;
 /** Generate a Linux systemd user unit for auto-starting the daemon. */
 export declare function generateSystemdUnit(oauthToken?: string | null): string;
-export declare function getAgentsBinPath(): string;
+export declare function getAgentsBinPath(argv1?: string | undefined, execPath?: string): string;
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(): {
     pid: number | null;
@@ -136,6 +136,24 @@ export declare function getDaemonLaunch(agentsBin?: string): {
     command: string;
     args: string[];
 };
+/**
+ * Build the argv to relaunch the `agents` CLI with the given subcommand args.
+ *
+ * Resolves the real on-disk binary via getAgentsBinPath(), then dispatches: a
+ * `.js` entry runs under node (`node <entry> …`), a native/compiled binary runs
+ * directly (`<bin> …`).
+ *
+ * Callers MUST route self-spawns through this rather than hand-rolling
+ * `[process.execPath, process.argv[1], …]`: under the compiled standalone binary
+ * (#315) `process.argv[1]` is the bun virtual entry `/$bunfs/root/agents`, so the
+ * hand-rolled form becomes `agents /$bunfs/root/agents …` → the CLI receives the
+ * bunfs path as a subcommand and dies with "unknown command '/$bunfs/root/agents'".
+ * getAgentsBinPath() resolves that virtual entry to the physical process.execPath.
+ */
+export declare function getAgentsInvocation(subArgs: string[], agentsBin?: string): {
+    command: string;
+    args: string[];
+};
 export declare function validateDaemonBinary(binPath: string): {
     warnings: string[];
 };