@phnx-labs/agents-cli 1.20.57 → 1.20.59

package/dist/lib/session/db.d.ts

@@ -24,6 +24,7 @@ export interface SessionRow {
     label: string | null;
     message_count: number | null;
     token_count: number | null;
+    output_tokens: number | null;
     cost_usd: number | null;
     duration_ms: number | null;
     file_path: string;
@@ -184,6 +185,8 @@ export interface UsageRollupRow {
     durationMs: number;
     sessionCount: number;
     tokenCount: number;
+    /** Real generated (output) tokens — excludes cache-read/-write context. */
+    outputTokens: number;
 }
 /** What to group a usage rollup by. */
 export type UsageRollupGroup = 'agent' | 'project' | 'day';

package/dist/lib/session/db.js

@@ -13,7 +13,7 @@ import { getSessionsDir, getSessionsDbPath } from '../state.js';
 const SESSIONS_DIR = getSessionsDir();
 const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. */
-const SCHEMA_VERSION = 11;
+const SCHEMA_VERSION = 12;
 /**
  * Canonicalize a file path for use as a scan_ledger key. The same physical
  * session file is reachable via multiple aliases — `~/.claude/projects/x.jsonl`
@@ -54,6 +54,7 @@ CREATE TABLE IF NOT EXISTS sessions (
   label TEXT,
   message_count INTEGER,
   token_count INTEGER,
+  output_tokens INTEGER,
   cost_usd REAL,
   duration_ms INTEGER,
   file_path TEXT NOT NULL,
@@ -224,6 +225,16 @@ function migrateSchema(db, fromVersion) {
             db.exec(`ALTER TABLE sessions ADD COLUMN plan TEXT`);
         db.exec(`DELETE FROM scan_ledger;`);
     }
+    if (fromVersion < 12) {
+        // v11 → v12: `output_tokens` — the real generated-token count, kept separate
+        // from `token_count` (which sums cache-read/-write and so is dominated by
+        // cheap re-counted context). This is the honest "output" metric powering
+        // `agents output`. Additive column; rescan to backfill from transcripts.
+        const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
+        if (!cols.some(c => c.name === 'output_tokens'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN output_tokens INTEGER`);
+        db.exec(`DELETE FROM scan_ledger;`);
+    }
 }
 /** Open (or return the cached) sessions database, applying migrations as needed. */
 export function getDB() {
@@ -438,13 +449,13 @@ const upsertSessionStmt = (db) => db.prepare(`
   INSERT INTO sessions (
     id, short_id, agent, version, account, timestamp, last_activity,
     project, cwd, git_branch, topic, label, message_count, token_count,
-    cost_usd, duration_ms,
+    output_tokens, cost_usd, duration_ms,
     file_path, file_mtime_ms, file_size, scanned_at, is_team_origin,
     pr_url, pr_number, worktree_slug, ticket_id, plan
   ) VALUES (
     @id, @short_id, @agent, @version, @account, @timestamp, @last_activity,
     @project, @cwd, @git_branch, @topic, @label, @message_count, @token_count,
-    @cost_usd, @duration_ms,
+    @output_tokens, @cost_usd, @duration_ms,
     @file_path, @file_mtime_ms, @file_size, @scanned_at, @is_team_origin,
     @pr_url, @pr_number, @worktree_slug, @ticket_id, @plan
   )
@@ -462,6 +473,7 @@ const upsertSessionStmt = (db) => db.prepare(`
     label = excluded.label,
     message_count = excluded.message_count,
     token_count = excluded.token_count,
+    output_tokens = excluded.output_tokens,
     cost_usd = excluded.cost_usd,
     duration_ms = excluded.duration_ms,
     file_path = excluded.file_path,
@@ -510,6 +522,7 @@ export function upsertSession(meta, content, scan) {
         label: meta.label ?? null,
         message_count: meta.messageCount ?? null,
         token_count: meta.tokenCount ?? null,
+        output_tokens: meta.outputTokens ?? null,
         cost_usd: meta.costUsd ?? null,
         duration_ms: meta.durationMs ?? null,
         file_path: meta.filePath,
@@ -599,6 +612,7 @@ export function upsertSessionsBatch(entries) {
                     label: meta.label ?? null,
                     message_count: meta.messageCount ?? null,
                     token_count: meta.tokenCount ?? null,
+                    output_tokens: meta.outputTokens ?? null,
                     cost_usd: meta.costUsd ?? null,
                     duration_ms: meta.durationMs ?? null,
                     file_path: meta.filePath,
@@ -772,6 +786,7 @@ function rowToMeta(row) {
         gitBranch: row.git_branch ?? undefined,
         messageCount: row.message_count ?? undefined,
         tokenCount: row.token_count ?? undefined,
+        outputTokens: row.output_tokens ?? undefined,
         costUsd: row.cost_usd ?? undefined,
         durationMs: row.duration_ms ?? undefined,
         version: row.version ?? undefined,
@@ -956,7 +971,8 @@ export function queryUsageRollup(options) {
       IFNULL(SUM(cost_usd), 0) AS costUsd,
       IFNULL(SUM(duration_ms), 0) AS durationMs,
       COUNT(*) AS sessionCount,
-      IFNULL(SUM(token_count), 0) AS tokenCount
+      IFNULL(SUM(token_count), 0) AS tokenCount,
+      IFNULL(SUM(output_tokens), 0) AS outputTokens
     FROM sessions
     ${clause}
     GROUP BY key

package/dist/lib/session/discover.d.ts

@@ -46,6 +46,8 @@ interface ClaudeSessionScan {
     topic?: string;
     messageCount: number;
     tokenCount?: number;
+    /** Real generated (output) tokens, excluding cache-read/-write context. */
+    outputTokens?: number;
     /** Total USD cost accumulated from per-(model, direction) token usage. */
     costUsd?: number;
     /** Wall-clock duration in ms between the first and last timestamped event. */

package/dist/lib/session/discover.js

@@ -508,6 +508,7 @@ async function readClaudeMeta(filePath, sessionId, account, label) {
             label,
             messageCount: scan.messageCount,
             tokenCount: scan.tokenCount,
+            outputTokens: scan.outputTokens,
             costUsd: scan.costUsd,
             durationMs: scan.durationMs,
             isTeamOrigin,
@@ -533,6 +534,7 @@ async function readClaudeMeta(filePath, sessionId, account, label) {
             label,
             messageCount: scan.messageCount,
             tokenCount: scan.tokenCount,
+            outputTokens: scan.outputTokens,
             costUsd: scan.costUsd,
             durationMs: scan.durationMs,
             topic: scan.topic,
@@ -748,6 +750,7 @@ export async function readCodexMeta(filePath, resolveAccount, currentVersion) {
         topic: scan.topic,
         messageCount: scan.messageCount,
         tokenCount: scan.tokenCount,
+        outputTokens: scan.outputTokens,
         costUsd: scan.costUsd,
         durationMs: scan.durationMs,
         account: resolveAccount?.(),
@@ -873,6 +876,7 @@ function readGeminiMeta(filePath, hashDir, projectMap, currentVersion) {
     let topic;
     let messageCount = 0;
     let tokenCount = 0;
+    let outputTokens = 0;
     let sawTokenCount = false;
     let costUsd = 0;
     let sawCost = false;
@@ -910,6 +914,16 @@ function readGeminiMeta(filePath, hashDir, projectMap, currentVersion) {
             tokenCount += total;
             sawTokenCount = true;
         }
+        // Output tokens: sum directional generation fields per message (output +
+        // thoughts + tool), mirroring the cost path — never `tokens.total`, which
+        // may be cumulative and would double-count when summed.
+        const gtk = message.tokens;
+        if (gtk && typeof gtk === 'object') {
+            outputTokens +=
+                (typeof gtk.output === 'number' ? gtk.output : 0) +
+                    (typeof gtk.thoughts === 'number' ? gtk.thoughts : 0) +
+                    (typeof gtk.tool === 'number' ? gtk.tool : 0);
+        }
         // Per-message cost: directional tokens × this message's model price.
         const msgModel = (typeof message.model === 'string' ? message.model : undefined) || sessionModel;
         const tk = message.tokens;
@@ -944,6 +958,7 @@ function readGeminiMeta(filePath, hashDir, projectMap, currentVersion) {
         topic,
         messageCount,
         tokenCount: sawTokenCount ? tokenCount : undefined,
+        outputTokens: sawTokenCount ? outputTokens : undefined,
         costUsd: sawCost ? costUsd : undefined,
         durationMs,
     };
@@ -1158,6 +1173,7 @@ async function scanOpenCodeIncremental() {
         s.time_updated AS time_updated,
         COALESCE(stats.message_count, 0) AS message_count,
         stats.token_count AS token_count,
+        stats.output_tokens AS output_tokens,
         COALESCE(stats.has_token_data, 0) AS has_token_data
       FROM session s
       LEFT JOIN (
@@ -1171,6 +1187,7 @@ async function scanOpenCodeIncremental() {
             COALESCE(json_extract(data, '$.tokens.cache.read'), 0) +
             COALESCE(json_extract(data, '$.tokens.cache.write'), 0)
           ) AS token_count,
+          SUM(COALESCE(json_extract(data, '$.tokens.output'), 0)) AS output_tokens,
           MAX(CASE WHEN json_type(data, '$.tokens') IS NOT NULL THEN 1 ELSE 0 END) AS has_token_data
         FROM message
         GROUP BY session_id
@@ -1194,6 +1211,7 @@ async function scanOpenCodeIncremental() {
             const timeUpdated = asInt(row.time_updated);
             const messageCount = asInt(row.message_count);
             const tokenCount = asInt(row.token_count);
+            const outputTokens = asInt(row.output_tokens);
             const hasTokenData = asInt(row.has_token_data) === 1;
             const timestamp = isNaN(timeCreated) ? new Date().toISOString() : new Date(timeCreated).toISOString();
             // OpenCode is one shared DB, not one file per session — its row carries a
@@ -1215,6 +1233,7 @@ async function scanOpenCodeIncremental() {
                 topic,
                 messageCount: Number.isNaN(messageCount) ? undefined : messageCount,
                 tokenCount: hasTokenData && !Number.isNaN(tokenCount) ? tokenCount : undefined,
+                outputTokens: hasTokenData && !Number.isNaN(outputTokens) ? outputTokens : undefined,
             };
             entries.push({ meta, content: topic || '', scan: currentScan });
         }
@@ -1653,6 +1672,7 @@ async function readDroidMeta(filePath, currentVersion) {
         topic: scan.topic,
         messageCount: scan.messageCount,
         tokenCount,
+        outputTokens: settings.usage?.outputTokens,
         costUsd: costUsd > 0 ? costUsd : undefined,
         durationMs: scan.durationMs,
     };
@@ -1801,6 +1821,7 @@ export async function scanClaudeSession(filePath) {
     let entrypoint;
     let messageCount = 0;
     let tokenCount = 0;
+    let outputTokens = 0;
     let sawTokenCount = false;
     let costUsd = 0;
     let sawCost = false;
@@ -1961,6 +1982,8 @@ export async function scanClaudeSession(filePath) {
                 tokenCount += usage;
                 sawTokenCount = true;
             }
+            if (typeof usageObj?.output_tokens === 'number')
+                outputTokens += usageObj.output_tokens;
             // Per-assistant-message cost: each event carries its own model, so we
             // multiply that event's raw token directions by that model's price.
             const model = parsed.message?.model;
@@ -2000,6 +2023,7 @@ export async function scanClaudeSession(filePath) {
         entrypoint,
         messageCount,
         tokenCount: sawTokenCount ? tokenCount : undefined,
+        outputTokens: sawTokenCount ? outputTokens : undefined,
         costUsd: sawCost ? costUsd : undefined,
         durationMs,
         lastActivity: lastTsMs !== undefined ? new Date(lastTsMs).toISOString() : undefined,
@@ -2167,6 +2191,9 @@ async function scanCodexSession(filePath) {
         topic,
         messageCount,
         tokenCount,
+        outputTokens: lastTotalTokenUsage
+            ? (lastTotalTokenUsage.output_tokens ?? 0) + (lastTotalTokenUsage.reasoning_output_tokens ?? 0)
+            : undefined,
         costUsd,
         durationMs,
         lastActivity: lastTsMs !== undefined ? new Date(lastTsMs).toISOString() : undefined,
@@ -2500,7 +2527,7 @@ export function readKimiMeta(filePath) {
         }
     }
     // Parse wire.jsonl to extract message count and token usage
-    const { messageCount, tokenCount } = parseKimiWireMetrics(sessionDir);
+    const { messageCount, tokenCount, outputTokens } = parseKimiWireMetrics(sessionDir);
     const meta = {
         id: sessionId,
         shortId,
@@ -2511,6 +2538,7 @@ export function readKimiMeta(filePath) {
         topic,
         messageCount,
         tokenCount: tokenCount > 0 ? tokenCount : undefined,
+        outputTokens: outputTokens > 0 ? outputTokens : undefined,
     };
     return { meta, content: lastPrompt || '' };
 }
@@ -2522,8 +2550,9 @@ function parseKimiWireMetrics(sessionDir) {
     const wirePath = path.join(sessionDir, 'agents', 'main', 'wire.jsonl');
     let messageCount = 0;
     let tokenCount = 0;
+    let outputTokens = 0;
     if (!fs.existsSync(wirePath)) {
-        return { messageCount: 0, tokenCount: 0 };
+        return { messageCount: 0, tokenCount: 0, outputTokens: 0 };
     }
     try {
         const lines = fs.readFileSync(wirePath, 'utf-8').split('\n');
@@ -2539,6 +2568,7 @@ function parseKimiWireMetrics(sessionDir) {
                     // Kimi usage structure: inputOther + output + inputCacheRead + inputCacheCreation
                     const u = event.usage;
                     tokenCount += (u.inputOther || 0) + (u.output || 0) + (u.inputCacheRead || 0) + (u.inputCacheCreation || 0);
+                    outputTokens += (u.output || 0);
                 }
             }
             catch {
@@ -2549,11 +2579,13 @@ function parseKimiWireMetrics(sessionDir) {
     catch {
         // If wire.jsonl can't be read, return 0s (graceful degradation)
     }
-    return { messageCount, tokenCount };
+    return { messageCount, tokenCount, outputTokens };
 }
 /** Parse a time filter string (relative like '7d' or ISO timestamp) into epoch milliseconds. */
 export function parseTimeFilter(input) {
-    const relativeMatch = input.match(/^(\d+)([mhdw])$/i);
+    // Units: m=minute, h=hour, d=day, w=week, mo=month(30d), y=year(365d). `mo`
+    // must precede the single-letter alternatives so "1mo" isn't read as "1m"+"o".
+    const relativeMatch = input.match(/^(\d+)(mo|[mhdwy])$/i);
     if (relativeMatch) {
         const value = parseInt(relativeMatch[1], 10);
         const unit = relativeMatch[2].toLowerCase();
@@ -2565,6 +2597,10 @@ export function parseTimeFilter(input) {
             return Date.now() - value * 86_400_000;
         if (unit === 'w')
             return Date.now() - value * 7 * 86_400_000;
+        if (unit === 'mo')
+            return Date.now() - value * 30 * 86_400_000;
+        if (unit === 'y')
+            return Date.now() - value * 365 * 86_400_000;
     }
     const ts = new Date(input).getTime();
     return Number.isNaN(ts) ? 0 : ts;

package/dist/lib/session/parse.js

@@ -55,6 +55,8 @@ function sanitizeEvent(e) {
         e.command = sanitizeForTerminal(e.command);
     if (e.path)
         e.path = sanitizeForTerminal(e.path);
+    if (e.name)
+        e.name = sanitizeForTerminal(e.name);
     if (e.output)
         e.output = sanitizeForTerminal(e.output);
     if (e.tool)
@@ -66,6 +68,36 @@ function sanitizeEvent(e) {
     if (e.args)
         e.args = sanitizeArgsDeep(e.args);
 }
+function firstString(...values) {
+    for (const value of values) {
+        if (typeof value === 'string' && value.trim())
+            return value.trim();
+    }
+    return undefined;
+}
+function attachmentPath(block, source) {
+    return firstString(source?.path, source?.file_path, source?.filePath, source?.url, source?.ref, block?.path, block?.file_path, block?.filePath, block?.ref);
+}
+function attachmentName(block, source, filePath) {
+    return firstString(block?.name, block?.title, source?.name, source?.filename, source?.file_name, source?.fileName, filePath ? path.basename(filePath) : undefined);
+}
+function normalizedAttachmentEvent(agent, timestamp, block, source, defaultMediaType, sizeBytes) {
+    const filePath = attachmentPath(block, source);
+    const name = attachmentName(block, source, filePath);
+    const explicitSize = typeof source?.sizeBytes === 'number' ? source.sizeBytes :
+        typeof source?.size === 'number' ? source.size :
+            typeof block?.sizeBytes === 'number' ? block.sizeBytes :
+                undefined;
+    return {
+        type: 'attachment',
+        agent,
+        timestamp,
+        path: filePath,
+        name,
+        mediaType: firstString(source?.media_type, source?.mediaType, block?.media_type, block?.mediaType) || defaultMediaType,
+        sizeBytes: sizeBytes || explicitSize || 0,
+    };
+}
 /**
  * Read a session file, refusing files above maxBytes. Bounded read protects
  * against multi-GB session blobs that would OOM the CLI or exceed V8's
@@ -351,24 +383,15 @@ export function parseClaudeContent(content) {
                         const source = block.source || {};
                         if (source.type === 'base64') {
                             const sizeBytes = Math.ceil((source.data?.length || 0) * 0.75);
-                            events.push({
-                                type: 'attachment',
-                                agent: 'claude',
-                                timestamp,
-                                mediaType: source.media_type || 'image/png',
-                                sizeBytes,
-                            });
+                            events.push(normalizedAttachmentEvent('claude', timestamp, block, source, 'image/png', sizeBytes));
+                        }
+                        else {
+                            events.push(normalizedAttachmentEvent('claude', timestamp, block, source, 'image/png', 0));
                         }
                     }
                     else if (block.type === 'document') {
                         const source = block.source || {};
-                        events.push({
-                            type: 'attachment',
-                            agent: 'claude',
-                            timestamp,
-                            mediaType: source.media_type || 'application/pdf',
-                            sizeBytes: 0,
-                        });
+                        events.push(normalizedAttachmentEvent('claude', timestamp, block, source, 'application/pdf', 0));
                     }
                     else if (block.type === 'tool_result') {
                         const toolId = block.tool_use_id;
@@ -1554,7 +1577,7 @@ export function parseDroid(filePath) {
             else if (block.type === 'image') {
                 const source = block.source || {};
                 const sizeBytes = source.type === 'base64' ? Math.ceil((source.data?.length || 0) * 0.75) : 0;
-                events.push({ type: 'attachment', agent: 'droid', timestamp, mediaType: source.media_type || 'image/png', sizeBytes });
+                events.push(normalizedAttachmentEvent('droid', timestamp, block, source, 'image/png', sizeBytes));
             }
         }
     }

package/dist/lib/session/state.d.ts

@@ -14,7 +14,7 @@
  * markers. Codex has no such tools, so it falls back to last-role + question
  * shape + mtime — same function, driven off the normalized events.
  */
-import type { SessionEvent } from './types.js';
+import type { SessionAttachment, SessionEvent } from './types.js';
 export type SessionActivity = 'working' | 'waiting_input' | 'idle';
 export type AwaitingReason = 'question' | 'plan_review' | 'permission';
 /** One discrete choice the agent offered the user. */
@@ -98,6 +98,8 @@ export interface SessionState {
     createdTickets?: string[];
     /** Team name this session SPAWNED via `agents teams create/add`. */
     spawnedTeam?: string;
+    /** Displayable files/screenshots attached to the session prompt. */
+    attachments?: SessionAttachment[];
 }
 export interface StateContext {
     /** Session file mtime; drives running-vs-stale. */
@@ -169,6 +171,7 @@ export declare function detectDurableSignals(events: SessionEvent[]): {
     ticket?: DetectedTicket;
     createdTickets?: string[];
     spawnedTeam?: string;
+    attachments?: SessionAttachment[];
 };
 /** Full inference: activity + preview + durable signals + worktree/ticket from ctx. */
 export declare function inferSessionState(events: SessionEvent[], ctx?: StateContext): SessionState;

package/dist/lib/session/state.js

@@ -352,6 +352,8 @@ export function detectDurableSignals(events) {
     let sawTicketCreate = false;
     let spawnedTeam;
     const createdTickets = new Set();
+    const attachments = [];
+    const seenAttachments = new Set();
     for (const e of events) {
         // Structural PR signal: a real `gh pr create` tool call, then the pull URL
         // from a following tool_result — never a bare URL mentioned in prose.
@@ -384,18 +386,32 @@ export function detectDurableSignals(events) {
         if (!ticket && e.type === 'message' && e.role === 'user') {
             ticket = detectTicket(e.content);
         }
+        if (e.type === 'attachment') {
+            const mediaType = e.mediaType || 'application/octet-stream';
+            const key = e.path || e.name || `${mediaType}:${e.sizeBytes ?? 0}:${e.timestamp}`;
+            if (key && !seenAttachments.has(key)) {
+                seenAttachments.add(key);
+                attachments.push({
+                    path: e.path,
+                    name: e.name,
+                    mediaType,
+                    sizeBytes: e.sizeBytes,
+                });
+            }
+        }
     }
     return {
         pr,
         ticket,
         createdTickets: createdTickets.size > 0 ? [...createdTickets] : undefined,
         spawnedTeam,
+        attachments: attachments.length > 0 ? attachments : undefined,
     };
 }
 /** Full inference: activity + preview + durable signals + worktree/ticket from ctx. */
 export function inferSessionState(events, ctx = {}) {
     const state = inferActivity(events, ctx);
-    const { pr, ticket, createdTickets, spawnedTeam } = detectDurableSignals(events);
+    const { pr, ticket, createdTickets, spawnedTeam, attachments } = detectDurableSignals(events);
     const worktree = detectWorktree(ctx.cwd, ctx.gitBranch);
     // Rate-limit: scan the most recent assistant messages + tool errors (tail-first).
     let rateLimited = false;
@@ -421,6 +437,7 @@ export function inferSessionState(events, ctx = {}) {
         ticket: ticket ?? detectTicket(undefined, ctx.gitBranch) ?? state.ticket,
         createdTickets,
         spawnedTeam,
+        attachments,
         rateLimited: rateLimited || undefined,
     };
 }

package/dist/lib/session/types.d.ts

@@ -30,9 +30,17 @@ export interface SessionEvent {
     outputTokens?: number;
     cacheReadTokens?: number;
     cacheCreationTokens?: number;
+    name?: string;
     mediaType?: string;
     sizeBytes?: number;
 }
+/** A displayable file attachment discovered in a session transcript. */
+export interface SessionAttachment {
+    path?: string;
+    name?: string;
+    mediaType: string;
+    sizeBytes?: number;
+}
 /** Metadata attached when a session was spawned by `agents teams`. */
 export interface TeamOrigin {
     /** Teammate name if set, otherwise first 8 chars of the agent UUID. */
@@ -58,6 +66,8 @@ export interface SessionMeta {
     gitBranch?: string;
     messageCount?: number;
     tokenCount?: number;
+    /** Real generated (output) tokens — excludes cache-read/-write context (issue: `agents output`). */
+    outputTokens?: number;
     /** Total USD cost, computed at scan time from per-model token usage (issue #323). */
     costUsd?: number;
     /** Wall-clock duration in ms (lastTs − firstTs), persisted at scan time. */

package/dist/lib/staleness/detectors/permissions.js

@@ -13,6 +13,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as TOML from 'smol-toml';
+import * as yaml from 'yaml';
 import { capableAgents } from '../../capabilities.js';
 import { discoverPermissionGroups, buildPermissionsFromGroups, CODEX_RULES_FILENAME, } from '../../permissions.js';
 import { lazyAgentMap } from '../writers/lazy-map.js';
@@ -83,7 +84,7 @@ function buildOpenCodeDetector() {
         kind: 'permissions',
         agent: 'opencode',
         list({ versionHome }) {
-            const opencodeConfigPath = path.join(versionHome, '.opencode', 'opencode.jsonc');
+            const opencodeConfigPath = path.join(versionHome, '.config', 'opencode', 'opencode.jsonc');
             if (!fs.existsSync(opencodeConfigPath))
                 return [];
             try {
@@ -181,6 +182,65 @@ function buildKimiDetector() {
         },
     };
 }
+function buildCursorDetector() {
+    return {
+        kind: 'permissions',
+        agent: 'cursor',
+        list({ versionHome }) {
+            const configPath = path.join(versionHome, '.cursor', 'cli-config.json');
+            if (!fs.existsSync(configPath))
+                return [];
+            try {
+                const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+                const allow = config.permissions?.allow?.length ?? 0;
+                const deny = config.permissions?.deny?.length ?? 0;
+                if (allow + deny > 0)
+                    return discoverPermissionGroups().map(g => g.name);
+            }
+            catch { /* parse fail */ }
+            return [];
+        },
+    };
+}
+function buildDroidDetector() {
+    return {
+        kind: 'permissions',
+        agent: 'droid',
+        list({ versionHome }) {
+            const settingsPath = path.join(versionHome, '.factory', 'settings.json');
+            if (!fs.existsSync(settingsPath))
+                return [];
+            try {
+                const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+                const hasAllow = Array.isArray(settings.commandAllowlist) && settings.commandAllowlist.length > 0;
+                const hasDeny = Array.isArray(settings.commandDenylist) && settings.commandDenylist.length > 0;
+                if (hasAllow || hasDeny)
+                    return discoverPermissionGroups().map(g => g.name);
+            }
+            catch { /* parse fail */ }
+            return [];
+        },
+    };
+}
+function buildKiroDetector() {
+    return {
+        kind: 'permissions',
+        agent: 'kiro',
+        list({ versionHome }) {
+            const permissionsPath = path.join(versionHome, '.kiro', 'settings', 'permissions.yaml');
+            if (!fs.existsSync(permissionsPath))
+                return [];
+            try {
+                const config = yaml.parse(fs.readFileSync(permissionsPath, 'utf-8'));
+                if (config && Array.isArray(config.rules) && config.rules.length > 0) {
+                    return discoverPermissionGroups().map(g => g.name);
+                }
+            }
+            catch { /* parse fail */ }
+            return [];
+        },
+    };
+}
 const handlers = {
     claude: buildClaudeDetector,
     codex: buildCodexDetector,
@@ -189,6 +249,9 @@ const handlers = {
     antigravity: buildAntigravityDetector,
     grok: buildGrokDetector,
     kimi: buildKimiDetector,
+    cursor: buildCursorDetector,
+    droid: buildDroidDetector,
+    kiro: buildKiroDetector,
 };
 export const permissionsDetectors = lazyAgentMap(() => {
     const m = {};

package/dist/lib/staleness/detectors/subagents.js

@@ -57,6 +57,20 @@ function buildDroidDetector() {
         },
     };
 }
+function buildCopilotDetector() {
+    return {
+        kind: 'subagents',
+        agent: 'copilot',
+        list({ versionHome }) {
+            const agentsDir = path.join(versionHome, '.copilot', 'agents');
+            if (!fs.existsSync(agentsDir))
+                return [];
+            return fs.readdirSync(agentsDir)
+                .filter(f => f.endsWith('.agent.md'))
+                .map(f => f.replace('.agent.md', ''));
+        },
+    };
+}
 function buildOpenclawDetector() {
     return {
         kind: 'subagents',
@@ -86,6 +100,20 @@ function buildKimiDetector() {
         },
     };
 }
+function buildKiroDetector() {
+    return {
+        kind: 'subagents',
+        agent: 'kiro',
+        list({ versionHome }) {
+            const agentsDir = path.join(versionHome, '.kiro', 'agents');
+            if (!fs.existsSync(agentsDir))
+                return [];
+            return fs.readdirSync(agentsDir)
+                .filter(f => f.endsWith('.json'))
+                .map(f => f.replace(/\.json$/, ''));
+        },
+    };
+}
 function buildOpenCodeDetector() {
     return {
         kind: 'subagents',
@@ -102,12 +130,14 @@ function buildOpenCodeDetector() {
 }
 const handlers = {
     claude: buildClaudeDetector,
+    copilot: buildCopilotDetector,
     grok: buildGrokDetector,
     codex: buildCodexDetector,
     kimi: buildKimiDetector,
     opencode: buildOpenCodeDetector,
     droid: buildDroidDetector,
     openclaw: buildOpenclawDetector,
+    kiro: buildKiroDetector,
 };
 export const subagentsDetectors = lazyAgentMap(() => {
     const m = {};

package/dist/lib/staleness/writers/commands.js

@@ -36,10 +36,10 @@ function buildCommandsWriter(agent) {
             const agentDir = path.join(versionHome, agentConfigDirName(agent));
             const commandsAsSkills = shouldInstallCommandAsSkill(agent, version);
             const supportsCommands = supports(agent, 'commands', version).ok;
-            // Writers fire only after supports() OR commands-as-skills says yes —
-            // both paths produce a usable result here.
+            // Version-gated agents (e.g. goose skills >= 1.25.0) are registered but
+            // may be called at a version too old for both paths — skip gracefully.
             if (!commandsAsSkills && !supportsCommands) {
-                throw new Error(`commands writer reached for ${agent}@${version} with no path (cmd=false, asSkill=false)`);
+                return { synced: [] };
             }
             const skillRoots = trustedSkillRoots();
             const commandsTarget = path.join(agentDir, agentConfig.commandsSubdir);