@phnx-labs/agents-cli 1.20.58 → 1.20.59

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 1.20.59
+
+- **Fix: remote secrets now choose the Windows PowerShell wrapper from the original `--host` name, not the resolved `user@ip` SSH target.** Inline enrolled Windows hosts resolve to address-based SSH targets, but the OS registry is keyed by the host name; `agents secrets view/list/exec --host <windows>`, `agents run --secrets bundle@<windows>`, and remote secrets unlock/export paths now pass that original name into command construction so Windows hosts no longer fall back to `bash -lc`. Source: `apps/cli/src/lib/secrets/remote.ts`, `apps/cli/src/commands/secrets.ts`, `apps/cli/src/commands/exec.ts`. (RUSH-1431)
+- **Wire Droid skills support (RUSH-1397).** Droid loads skills from `.factory/skills/` (since 0.26.0). Flip `skills: { since: '0.26.0' }`, register generic skills writer/detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/__tests__/capabilities.test.ts`.
+- **Wire skills support for Goose CLI (RUSH-1394).** Goose reads skills directly from `~/.agents/skills/` via the Summon extension (block-goose-cli >= 1.25.0). Flip `skills: { since: '1.25.0' }`, register generic skills writer/detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/staleness/writers/commands.ts`.
+- **Wire Droid allowlist support (RUSH-1396).** Droid stores allow/deny in `.factory/settings.json` (`commandAllowlist`/`commandDenylist`). Flip `allowlist: true` since 0.57.5, add `convertToDroidFormat`, wire writer/detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/permissions.ts`.
+- **Wire Codex permissions/allowlist support (RUSH-1566).** Codex stores allow/deny in `.codex/config.toml` (`approval_policy`, `sandbox_mode`). Flip `allowlist: true` since 0.128.0, add `convertToCodexFormat`, wire writer/detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/permissions.ts`.
+- **OpenCode permissions write to the loaded config path (RUSH-1623).** Global config is `~/.config/opencode/opencode.jsonc` (not `~/.opencode/`); project config is `opencode.jsonc` at the project root. Source: `apps/cli/src/lib/permissions.ts`, `apps/cli/src/lib/agents.ts`.
+- **Catch-up publishes now require the exact CI-tested release tree and its full green matrix.** A package version already present on `main` no longer counts as release validation by itself: `release.sh` resolves the merged `release/v<version>` PR, requires its merge commit to be current `main`, fetches the PR head that ran CI, requires that head tree to equal current `main`, and rechecks every expected CI context before publishing. This closes the path that let 1.20.58 reach npm before its tag-triggered Windows matrix exposed failures. Source: `apps/cli/scripts/release.sh`.
+- **Windows release validation now matches portable path behavior.** Home-relative project paths normalize native separators to `/` before they are stored as `~/…`, and the systemd-manifest and remote-shell assertions now compare the escaped/quoted forms that the runtime deliberately emits. This restores the Windows Node 22/24 release matrix without weakening command escaping. Source: `apps/cli/src/lib/project-root.ts`, `apps/cli/src/lib/{project-root,daemon}.test.ts`, `apps/cli/src/lib/hosts/dispatch.test.ts`.
 ## 1.20.58
 
 - **Self-updating agent CLIs are represented as one live installation.** `agents view` no longer invents version-home rows for single-binary installers such as Droid, Grok, Cursor, Kiro, Goose, and Hermes; it reports the version returned by the installed binary and folds away stale per-version directories. `agents add <agent>@<version>` now installs or keeps that agent's current release instead of rejecting an unsupported pinned install. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/versions.ts`, `apps/cli/src/commands/{versions,view}.ts`. (RUSH-1321)

package/README.md

@@ -855,9 +855,10 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | OpenCode | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Copilot | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Amp | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
-| Kiro | yes | no | yes | >= 2.8.0 | yes | yes | no | no | `AGENTS.md` | no |
+| Kiro | yes | no | yes | >= 2.8.0 | yes | yes | no | >= 1.23.0 | `AGENTS.md` | no |
 | Goose | yes | no | yes | no | no | no | no | no | `AGENTS.md` | no |
 | Roo Code | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
+| Droid | yes | yes | yes | >= 0.57.5 | >= 0.26.0 | yes | yes | yes | `AGENTS.md` | no |
 
 **Legend:** `yes` / `no` = synced or skipped at install time. `skills ($name)` = no file-based slash-command dir; behavior ships as a generated skill invoked with `$command`. `gateway` = OpenClaw resolves slash commands at runtime, not from synced files. Version suffixes are enforced at sync time — out-of-range versions are skipped with a clear message.
 
@@ -875,13 +876,17 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | Grok Build | -- | yes | yes |
 | Antigravity | -- | yes | -- |
 | Copilot | -- | -- | yes |
-| OpenClaw, Amp, Kiro, Goose, Roo | -- | -- | -- |
+| OpenClaw, Amp, Goose, Roo | -- | -- | -- |
+| Kiro | -- | -- | -- |
 
 ### Version-gated sync
 
 | Capability | Agent | Gate |
 |------------|-------|------|
 | Hooks | Codex | >= 0.116.0 |
+| Subagents | Kiro | >= 1.23.0 |
+| Skills | Droid | >= 0.26.0 |
+| Permissions | Droid | >= 0.57.5 |
 | Hooks | Gemini | >= 0.26.0 |
 | Permissions | Kiro | >= 2.8.0 |
 | File-based commands | Codex | < 0.117.0 (0.117+ uses command-as-skill) |

package/dist/commands/exec.js

@@ -1227,7 +1227,7 @@ export function registerRunCommand(program) {
                     // Remote bundle (`bundle@host`): resolve over SSH and inject
                     // ephemerally — values never touch this machine's keychain or disk.
                     const target = await resolveSshTarget(host);
-                    const bundleEnv = await remoteResolveEnv(target, bundleName);
+                    const bundleEnv = await remoteResolveEnv(target, bundleName, { osLookupName: host });
                     console.log(chalk.gray(`[secrets] Resolved ${bundleName}@${host}: ${Object.keys(bundleEnv).length} keys (remote, ephemeral)`));
                     secretsEnv = { ...secretsEnv, ...bundleEnv };
                 }

package/dist/commands/output.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Output command — productivity: token *burn* vs shipped *output*.
+ *
+ * `agents cost` answers "what did we burn?" (dollars + duration). This joins that
+ * burn to what actually shipped — real generated (output) tokens plus PRs and
+ * commits across every git identity — so you can see burn-vs-output and ratios
+ * like $/PR and output-tokens/$. Pure SQLite + local git/gh, no server, no
+ * telemetry — the same offline spirit as `cost`.
+ *
+ * Why not just show `token_count`? Because that number sums cache-read/-write
+ * context re-counted every turn and is dominated by cheap re-reads (often ~100x
+ * the real generation). `output_tokens` (scanned per-agent into the session DB)
+ * is the honest "work produced" signal, and it is what this command leads with.
+ *
+ * `--all-hosts` fans the same rollup across every online device (`ag devices`)
+ * over SSH and merges — one fleet-wide burn-vs-output view.
+ */
+import type { Command } from 'commander';
+export declare function registerOutputCommand(program: Command): void;

package/dist/commands/output.js

@@ -0,0 +1,333 @@
+import chalk from 'chalk';
+import * as os from 'os';
+import * as path from 'path';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { addHostOption } from '../lib/hosts/option.js';
+import { discoverSessions, parseTimeFilter } from '../lib/session/discover.js';
+import { queryUsageRollup } from '../lib/session/db.js';
+import { formatUsd, PRICING_VERSION } from '../lib/pricing/index.js';
+import { formatDuration } from '../lib/session/render.js';
+import { terminalWidth, truncateToWidth, padToWidth } from '../lib/session/width.js';
+import { collectGitOutput } from '../lib/output/git-output.js';
+import { loadDevices } from '../lib/devices/registry.js';
+import { machineId } from '../lib/session/sync/config.js';
+const execFileAsync = promisify(execFile);
+export function registerOutputCommand(program) {
+    addHostOption(program.command('output'))
+        .description('Productivity rollup — token burn vs shipped output (PRs, commits) across agents')
+        .option('--json', 'Output the rollup as JSON')
+        .option('--since <time>', 'Only sessions/commits newer than this: 1h, 24h, 7d, 4w, 1mo, 1y, or ISO date (default 7d)')
+        .option('--by <dimension>', 'Group the burn/output breakdown by: agent (default), project, or day')
+        .option('--repos-dir <dir>', 'Root scanned for git repos (default ~/src)')
+        .option('--author <email...>', 'Count commits by these author emails (default: your git identities)')
+        .option('--login <login...>', 'Count PRs for these GitHub logins (default: current gh user)')
+        .option('--no-prs', 'Skip the GitHub PR lookup (commits only)')
+        .option('--all-hosts', 'Aggregate across every online device (ag devices) over SSH')
+        .addHelpText('after', `
+Examples:
+  agents output                       Last 7 days: burn, output tokens, PRs, commits, ratios
+  agents output --since 24h           Last 24 hours
+  agents output --since 1mo           Last month  (units: 1h 24h 7d 4w 1mo 1y, or ISO date)
+  agents output --all-hosts           Fleet-wide, folding in every online machine
+  agents output --by day --json       Machine-readable daily burn/output rollup
+
+Burn (cost) is computed offline from a versioned per-model price table (${PRICING_VERSION}).
+Output tokens are the real generated tokens — NOT the cache-inflated total token count.
+`)
+        .action(async (options) => {
+        await outputAction(options);
+    });
+}
+function resolveGroup(by) {
+    if (by === undefined)
+        return 'agent';
+    if (by === 'agent' || by === 'project' || by === 'day')
+        return by;
+    console.error(chalk.red('error: --by must be one of: agent, project, day'));
+    process.exit(1);
+}
+/** Compact token formatter: 38.6M, 4.1K, 10.6B. */
+function formatCompact(n) {
+    const abs = Math.abs(n);
+    if (abs >= 1e9)
+        return `${(n / 1e9).toFixed(1)}B`;
+    if (abs >= 1e6)
+        return `${(n / 1e6).toFixed(1)}M`;
+    if (abs >= 1e3)
+        return `${(n / 1e3).toFixed(1)}K`;
+    return String(n);
+}
+function emptyBurn() {
+    return { costUsd: 0, outputTokens: 0, tokenCount: 0, sessionCount: 0, durationMs: 0 };
+}
+function sumBurn(rows) {
+    return rows.reduce((acc, r) => {
+        acc.costUsd += r.costUsd;
+        acc.outputTokens += r.outputTokens;
+        acc.tokenCount += r.tokenCount;
+        acc.sessionCount += r.sessionCount;
+        acc.durationMs += r.durationMs;
+        return acc;
+    }, emptyBurn());
+}
+/** Compute this machine's payload from the local session DB + git. */
+async function computeLocalPayload(options, includePrs) {
+    const since = options.since ?? '7d';
+    const sinceMs = parseTimeFilter(since);
+    // Ensure the index is fresh (and migrated to v12 so output_tokens is populated).
+    await discoverSessions({ all: true, since, limit: 1 });
+    const filter = { sinceMs };
+    const groupBy = resolveGroup(options.by);
+    const breakdown = queryUsageRollup({ ...filter, groupBy });
+    const burn = sumBurn(breakdown);
+    const reposDir = options.reposDir ?? path.join(os.homedir(), 'src');
+    const git = await collectGitOutput({
+        reposDir,
+        sinceMs,
+        authors: options.author,
+        logins: options.login,
+        includePrs,
+    });
+    return {
+        machine: machineId(),
+        pricingVersion: PRICING_VERSION,
+        since,
+        burn,
+        output: {
+            commits: git.commits,
+            commitShas: git.commitShas,
+            prsOpened: git.prsOpened,
+            prsMerged: git.prsMerged,
+            reposScanned: git.reposScanned,
+            ghAvailable: git.ghAvailable,
+            authors: git.authors,
+            logins: git.logins,
+        },
+        breakdown: { by: groupBy, rows: breakdown },
+        uncostedAgents: groupBy === 'agent' ? breakdown.filter(r => r.costUsd === 0).map(r => r.key) : [],
+    };
+}
+/** Fetch one remote device's payload by re-invoking `agents output --json --host <name>`. */
+async function fetchRemotePayload(device, options) {
+    const args = ['output', '--json', '--no-prs', '--host', device, '--since', options.since ?? '7d'];
+    if (options.by)
+        args.push('--by', options.by);
+    if (options.reposDir)
+        args.push('--repos-dir', options.reposDir);
+    for (const a of options.author ?? [])
+        args.push('--author', a);
+    try {
+        const { stdout } = await execFileAsync('agents', args, {
+            timeout: 120_000,
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        const parsed = JSON.parse(stdout);
+        parsed.machine = parsed.machine || device;
+        return parsed;
+    }
+    catch (err) {
+        return {
+            machine: device,
+            pricingVersion: PRICING_VERSION,
+            since: options.since ?? '7d',
+            burn: emptyBurn(),
+            output: { commits: 0, commitShas: [], prsOpened: 0, prsMerged: 0, reposScanned: 0, ghAvailable: false, authors: [], logins: [] },
+            breakdown: { by: resolveGroup(options.by), rows: [] },
+            uncostedAgents: [],
+            error: (err?.stderr || err?.message || 'unreachable').toString().split('\n')[0].slice(0, 120),
+        };
+    }
+}
+async function outputAction(options) {
+    const includePrs = options.prs !== false;
+    if (!options.allHosts) {
+        const payload = await computeLocalPayload(options, includePrs);
+        if (options.json) {
+            process.stdout.write(JSON.stringify(withRatios(payload, [payload]), null, 2) + '\n');
+            return;
+        }
+        renderSingle(payload);
+        return;
+    }
+    // Fleet: local payload + every online device, folded in over SSH.
+    const self = machineId();
+    const registry = await loadDevices();
+    const remotes = Object.values(registry)
+        .filter(d => d.tailscale?.online && d.name !== self)
+        .map(d => d.name);
+    if (!options.json)
+        console.error(chalk.gray(`Folding in ${remotes.length} online device${remotes.length !== 1 ? 's' : ''}…`));
+    // PRs are global (gh search by author, not machine-bound) — compute once, locally.
+    const local = await computeLocalPayload(options, includePrs);
+    const remotePayloads = await Promise.all(remotes.map(d => fetchRemotePayload(d, options)));
+    const machines = [local, ...remotePayloads];
+    if (options.json) {
+        process.stdout.write(JSON.stringify(withRatios(mergeMachines(machines, options), machines), null, 2) + '\n');
+        return;
+    }
+    renderFleet(machines, options);
+}
+/** Merge per-machine payloads into a combined one (burn + commits summed; PRs local-only). */
+function mergeMachines(machines, options) {
+    const burn = emptyBurn();
+    const byKey = new Map();
+    // Union commit SHAs across machines: shared repos (cloned on several boxes)
+    // expose the same commits to `git log` on each, so summing counts would
+    // multi-count. A commit's SHA is its global identity — union, don't add.
+    const allShas = new Set();
+    const uncosted = new Set();
+    for (const m of machines) {
+        burn.costUsd += m.burn.costUsd;
+        burn.outputTokens += m.burn.outputTokens;
+        burn.tokenCount += m.burn.tokenCount;
+        burn.sessionCount += m.burn.sessionCount;
+        burn.durationMs += m.burn.durationMs;
+        for (const s of m.output.commitShas)
+            allShas.add(s);
+        for (const a of m.uncostedAgents)
+            uncosted.add(a);
+        for (const r of m.breakdown.rows) {
+            const cur = byKey.get(r.key) ?? { key: r.key, costUsd: 0, durationMs: 0, sessionCount: 0, tokenCount: 0, outputTokens: 0 };
+            cur.costUsd += r.costUsd;
+            cur.durationMs += r.durationMs;
+            cur.sessionCount += r.sessionCount;
+            cur.tokenCount += r.tokenCount;
+            cur.outputTokens += r.outputTokens;
+            byKey.set(r.key, cur);
+        }
+    }
+    const rows = [...byKey.values()].sort((a, b) => b.costUsd - a.costUsd);
+    // PRs from the local machine only (machines[0]) — gh search is not machine-scoped.
+    const localGit = machines[0].output;
+    return {
+        machine: 'fleet',
+        pricingVersion: PRICING_VERSION,
+        since: options.since ?? '7d',
+        burn,
+        output: { ...localGit, commits: allShas.size, commitShas: [...allShas] },
+        breakdown: { by: resolveGroup(options.by), rows },
+        uncostedAgents: [...uncosted],
+    };
+}
+/** Attach burn-vs-output ratios to a payload for JSON output. */
+function withRatios(payload, machines) {
+    const prsTotal = payload.output.prsOpened + payload.output.prsMerged;
+    return {
+        ...payload,
+        ratios: {
+            costPerPr: prsTotal > 0 ? payload.burn.costUsd / prsTotal : null,
+            costPerCommit: payload.output.commits > 0 ? payload.burn.costUsd / payload.output.commits : null,
+            outputTokensPerUsd: payload.burn.costUsd > 0 ? payload.burn.outputTokens / payload.burn.costUsd : null,
+        },
+        machines: machines.length > 1 ? machines.map(m => ({ machine: m.machine, burn: m.burn, commits: m.output.commits, error: m.error })) : undefined,
+    };
+}
+/** Shared header line: burned · output tokens · PRs · commits, plus ratios. */
+function headerLines(payload) {
+    const prsTotal = payload.output.prsOpened + payload.output.prsMerged;
+    const out = [];
+    out.push('  ' +
+        `${chalk.green(formatUsd(payload.burn.costUsd))} burned` +
+        chalk.gray('  ·  ') +
+        `${chalk.cyan(formatCompact(payload.burn.outputTokens))} output tokens` +
+        chalk.gray('  ·  ') +
+        `${chalk.yellow(String(prsTotal))} PRs ${chalk.gray(`(${payload.output.prsMerged} merged)`)}` +
+        chalk.gray('  ·  ') +
+        `${chalk.yellow(String(payload.output.commits))} commits`);
+    const ratios = [];
+    if (prsTotal > 0)
+        ratios.push(`${formatUsd(payload.burn.costUsd / prsTotal)}/PR`);
+    if (payload.output.commits > 0)
+        ratios.push(`${formatUsd(payload.burn.costUsd / payload.output.commits)}/commit`);
+    if (payload.burn.costUsd > 0)
+        ratios.push(`${formatCompact(Math.round(payload.burn.outputTokens / payload.burn.costUsd))} out-tok/$`);
+    if (ratios.length > 0)
+        out.push(chalk.gray('  ' + ratios.join('  ·  ')));
+    return out;
+}
+/** Render the per-group burn/output table. */
+function renderBreakdown(rows, groupBy) {
+    const out = [chalk.bold(`By ${groupBy}`)];
+    if (rows.length === 0)
+        return out;
+    const cols = terminalWidth();
+    const burnW = Math.max(...rows.map(r => formatUsd(r.costUsd).length), 4);
+    const outW = Math.max(...rows.map(r => formatCompact(r.outputTokens).length), 6);
+    const sessW = Math.max(...rows.map(r => String(r.sessionCount).length), 3);
+    const fixedW = 2 + 2 + burnW + 2 + outW + 2 + sessW + 8;
+    const keyW = Math.max(8, Math.min(Math.max(...rows.map(r => r.key.length), groupBy.length), cols - fixedW));
+    out.push('  ' + chalk.gray(padToWidth('', keyW)) + '  ' + chalk.gray(padToWidth('burn', burnW)) + '  ' + chalk.gray(padToWidth('output', outW)) + '  ' + chalk.gray('sessions'));
+    for (const r of rows) {
+        out.push('  ' +
+            padToWidth(truncateToWidth(r.key, keyW), keyW) +
+            '  ' +
+            chalk.green(padToWidth(formatUsd(r.costUsd), burnW)) +
+            '  ' +
+            chalk.cyan(padToWidth(formatCompact(r.outputTokens), outW)) +
+            '  ' +
+            chalk.gray(padToWidth(String(r.sessionCount), sessW)));
+    }
+    return out;
+}
+function renderSingle(payload) {
+    const out = [];
+    out.push(chalk.bold('Output') + chalk.gray(`  ·  pricing ${payload.pricingVersion}  ·  since ${payload.since}`));
+    out.push(...headerLines(payload));
+    out.push('');
+    if (payload.burn.sessionCount === 0) {
+        out.push(chalk.gray('No sessions with cost data found. Run `agents sessions --all` to index, then retry.'));
+        console.log(out.join('\n'));
+        return;
+    }
+    out.push(...renderBreakdown(payload.breakdown.rows, payload.breakdown.by));
+    out.push('');
+    out.push(chalk.bold('Shipped'));
+    out.push(`  ${chalk.yellow(String(payload.output.commits))} commits across ${payload.output.reposScanned} repos` + chalk.gray(`  (authors: ${payload.output.authors.length > 0 ? payload.output.authors.join(', ') : 'none detected'})`));
+    if (payload.output.ghAvailable) {
+        out.push(`  ${chalk.yellow(String(payload.output.prsOpened))} PRs opened, ${chalk.yellow(String(payload.output.prsMerged))} merged` + chalk.gray(`  (logins: ${payload.output.logins.join(', ')})`));
+    }
+    else {
+        out.push(chalk.gray('  PRs: gh unavailable or unauthed — not counted'));
+    }
+    out.push('');
+    out.push(chalk.gray(notCountedLine(payload.uncostedAgents)));
+    if (payload.burn.durationMs > 0)
+        out.push(chalk.gray(`agent wall-clock: ${formatDuration(payload.burn.durationMs)}`));
+    console.log(out.join('\n'));
+}
+function renderFleet(machines, options) {
+    const merged = mergeMachines(machines, options);
+    const out = [];
+    out.push(chalk.bold('Output') + chalk.gray(`  ·  fleet (${machines.length} machines)  ·  pricing ${merged.pricingVersion}  ·  since ${merged.since}`));
+    out.push(...headerLines(merged));
+    out.push('');
+    // By machine.
+    out.push(chalk.bold('By machine'));
+    const nameW = Math.max(...machines.map(m => m.machine.length), 7);
+    const burnW = Math.max(...machines.map(m => formatUsd(m.burn.costUsd).length), 4);
+    for (const m of machines) {
+        const note = m.error ? chalk.red(`  (${m.error})`) : '';
+        out.push('  ' +
+            padToWidth(m.machine, nameW) +
+            '  ' +
+            chalk.green(padToWidth(formatUsd(m.burn.costUsd), burnW)) +
+            '  ' +
+            chalk.cyan(padToWidth(formatCompact(m.burn.outputTokens), 7)) +
+            '  ' +
+            chalk.gray(`${m.burn.sessionCount} sessions, ${m.output.commits} commits`) +
+            note);
+    }
+    out.push('');
+    out.push(...renderBreakdown(merged.breakdown.rows, merged.breakdown.by));
+    out.push('');
+    out.push(chalk.gray(notCountedLine(merged.uncostedAgents)));
+    console.log(out.join('\n'));
+}
+function notCountedLine(uncosted) {
+    const notes = [];
+    if (uncosted.length > 0)
+        notes.push(`no price table for: ${[...new Set(uncosted)].join(', ')} (burn undercounts)`);
+    notes.push('cloud runs (Rush/Codex/Factory) not counted');
+    return 'not counted: ' + notes.join('  ·  ');
+}

package/dist/commands/secrets.js

@@ -328,12 +328,12 @@ async function browseRemote(targets, args, tty) {
     if (tty) {
         for (const t of targets) {
             const target = await resolveSshTarget(t);
-            render(t, remoteSecretsRaw(target, args, { tty: true }));
+            render(t, remoteSecretsRaw(target, args, { tty: true, osLookupName: t }));
         }
     }
     else {
-        const resolved = await Promise.all(targets.map((t) => resolveSshTarget(t)));
-        const results = resolved.map((target) => remoteSecretsRaw(target, args));
+        const resolved = await Promise.all(targets.map(async (t) => ({ name: t, target: await resolveSshTarget(t) })));
+        const results = resolved.map(({ name, target }) => remoteSecretsRaw(target, args, { osLookupName: name }));
         targets.forEach((t, i) => render(t, results[i]));
     }
     if (failures > 0)
@@ -1476,7 +1476,7 @@ Examples:
                         // engine (BatchMode, ConnectTimeout, keepalive, control-socket
                         // reuse) via the same path the READ inverse (`remoteResolveEnv`)
                         // uses. `--from -` reads the .env off ssh stdin.
-                        res = remoteSecretsRaw(host, ['import', resolvedBundleName, '--from', '-', ...(opts.force ? ['--force'] : [])], { input: dotenv });
+                        res = remoteSecretsRaw(host, ['import', resolvedBundleName, '--from', '-', ...(opts.force ? ['--force'] : [])], { input: dotenv, osLookupName: host });
                     }
                     if (res.code === null) {
                         failures++;
@@ -1584,7 +1584,7 @@ Examples:
                 // locally instead.
                 const { assertRemoteBundleFlagsUnsupported } = await import('../lib/secrets/bundles.js');
                 assertRemoteBundleFlagsUnsupported(bundleName, execOpts.host, { keys: keysSubset, allowExpired: execOpts.allowExpired }, { keysFlag: '--keys', allowExpiredFlag: '--allow-expired' });
-                secretEnv = await remoteResolveEnv(await resolveSshTarget(execOpts.host), bundleName);
+                secretEnv = await remoteResolveEnv(await resolveSshTarget(execOpts.host), bundleName, { osLookupName: execOpts.host });
             }
             else {
                 const { readAndResolveBundleEnv } = await import('../lib/secrets/bundles.js');
@@ -1738,7 +1738,7 @@ Examples:
                 // sees a real TTY, which requires our local terminal to pass straight
                 // through. The remote's prompt + output stream to this terminal; we get
                 // back only the exit code.
-                const code = remoteSecretsStream(target, unlockArgs);
+                const code = remoteSecretsStream(target, unlockArgs, { osLookupName: h });
                 if (code === 0) {
                     console.log(chalk.green(`${h}: unlocked`));
                 }

package/dist/index.js

@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -690,6 +690,7 @@ async function registerAllEagerCommands() {
     await reg(loadFactory);
     await reg(loadUsage);
     await reg(loadCost);
+    await reg(loadOutput);
     await reg(loadBudget);
     await reg(loadAlias);
     await reg(loadPty);

package/dist/lib/agents.js

@@ -236,7 +236,7 @@ export const AGENTS = {
         cloudProvider: 'codex',
         // Subagents: multi-agent plumbing since 0.117.0; custom agents as
         // ~/.codex/agents/*.toml (name, description, developer_instructions).
-        capabilities: { hooks: { since: '0.116.0' }, mcp: true, mcpHttp: true, mcpHeaders: false, allowlist: false, skills: true, commands: { until: '0.117.0' }, plugins: { since: '0.128.0' }, subagents: { since: '0.117.0' }, rules: { file: 'AGENTS.md' }, workflows: false, memory: true, modes: ['plan', 'edit', 'skip'] },
+        capabilities: { hooks: { since: '0.116.0' }, mcp: true, mcpHttp: true, mcpHeaders: false, allowlist: { since: '0.138.0' }, skills: true, commands: { until: '0.117.0' }, plugins: { since: '0.128.0' }, subagents: { since: '0.117.0' }, rules: { file: 'AGENTS.md' }, workflows: false, memory: true, modes: ['plan', 'edit', 'skip'] },
     },
     gemini: {
         id: 'gemini',
@@ -405,7 +405,10 @@ export const AGENTS = {
         configDir: path.join(HOME, '.config', 'goose'),
         commandsDir: path.join(HOME, '.config', 'goose', 'commands'),
         commandsSubdir: 'commands',
-        skillsDir: path.join(HOME, '.config', 'goose', 'skills'),
+        // Goose reads skills directly from central ~/.agents/skills/ via the Summon
+        // extension (block-goose-cli ≥ 1.25.0). No per-version copy is written.
+        skillsDir: path.join(HOME, '.agents', 'skills'),
+        nativeAgentsSkillsDir: true,
         // Hooks: Open Plugins format — auto-discovered from
         // ~/.agents/plugins/<name>/hooks/hooks.json (shipped block-goose-cli
         // ≥ 1.34.0). See registerHooksForGoose.
@@ -416,7 +419,7 @@ export const AGENTS = {
         supportsHooks: true,
         // Plugins: Open Plugins under ~/.agents/plugins/<name>/ (same layout as
         // agents-cli source). Version isolation copies into versionHome/.agents/plugins/.
-        capabilities: { hooks: { since: '1.34.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: false, skills: false, commands: false, plugins: true, subagents: false, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit'] },
+        capabilities: { hooks: { since: '1.34.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: false, skills: { since: '1.25.0' }, commands: false, plugins: true, subagents: false, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit'] },
     },
     // Google Antigravity CLI (`agy`) — official replacement for Gemini CLI as of IO 2026.
     // configDir nests inside `~/.gemini/` since agy shares the parent dir with the Gemini
@@ -560,7 +563,7 @@ export const AGENTS = {
         authFiles: ['auth.v2.file', 'auth.v2.key'],
         commandsDir: path.join(HOME, '.factory', 'commands'),
         commandsSubdir: 'commands',
-        skillsDir: '', // no skills concept
+        skillsDir: path.join(HOME, '.factory', 'skills'),
         hooksDir: 'hooks',
         pluginManifestDir: '.factory-plugin',
         instructionsFile: 'AGENTS.md',
@@ -575,8 +578,8 @@ export const AGENTS = {
             mcp: true,
             mcpHttp: false,
             mcpHeaders: false,
-            allowlist: false,
-            skills: false,
+            allowlist: { since: '0.57.5' },
+            skills: { since: '0.26.0' },
             commands: true,
             plugins: true,
             subagents: true,
@@ -1826,8 +1829,8 @@ export function getUserMcpConfigPath(agentId) {
             // Codex uses TOML config
             return path.join(agent.configDir, 'config.toml');
         case 'opencode':
-            // OpenCode uses JSONC config
-            return path.join(agent.configDir, 'opencode.jsonc');
+            // OpenCode loads ~/.config/opencode/opencode.jsonc (not ~/.opencode/)
+            return path.join(HOME, '.config', 'opencode', 'opencode.jsonc');
         case 'cursor':
             // Cursor uses mcp.json
             return path.join(agent.configDir, 'mcp.json');
@@ -1865,7 +1868,7 @@ export function getMcpConfigPathForHome(agentId, home) {
         case 'codex':
             return path.join(home, '.codex', 'config.toml');
         case 'opencode':
-            return path.join(home, '.opencode', 'opencode.jsonc');
+            return path.join(home, '.config', 'opencode', 'opencode.jsonc');
         case 'cursor':
             return path.join(home, '.cursor', 'mcp.json');
         case 'openclaw':
@@ -1903,7 +1906,8 @@ function getProjectMcpConfigPath(agentId, cwd = process.cwd()) {
         case 'codex':
             return path.join(cwd, `.${agentId}`, 'config.toml');
         case 'opencode':
-            return path.join(cwd, `.${agentId}`, 'opencode.jsonc');
+            // Project config is opencode.jsonc at project root (not .opencode/)
+            return path.join(cwd, 'opencode.jsonc');
         case 'cursor':
             return path.join(cwd, `.${agentId}`, 'mcp.json');
         case 'openclaw':

package/dist/lib/hosts/passthrough.js

@@ -28,6 +28,7 @@ const REMOTE_PASSTHROUGH = {
     view: {},
     usage: {},
     cost: {},
+    output: {},
     doctor: {},
     inspect: {},
     list: {},

package/dist/lib/mcp.js

@@ -485,7 +485,7 @@ function installMcpToForgeConfig(server, versionHome) {
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
 }
 function installMcpToOpenCodeConfig(server, versionHome) {
-    const configPath = path.join(versionHome, '.opencode', 'opencode.jsonc');
+    const configPath = path.join(versionHome, '.config', 'opencode', 'opencode.jsonc');
     let config = {};
     if (fs.existsSync(configPath)) {
         const content = fs.readFileSync(configPath, 'utf-8');

package/dist/lib/output/git-output.d.ts

@@ -0,0 +1,74 @@
+/** Commit tally for one author email. */
+export interface AuthorCommits {
+    author: string;
+    commits: number;
+}
+/** The shipped-work rollup for a window. */
+export interface GitOutputSummary {
+    reposScanned: number;
+    commits: number;
+    byAuthor: AuthorCommits[];
+    prsOpened: number;
+    prsMerged: number;
+    /**
+     * Deduped commit SHAs authored by us in the window. Carried so `--all-hosts`
+     * can UNION across machines — a repo cloned on several boxes exposes the same
+     * commits to `git log` on each, so summing counts would multi-count.
+     */
+    commitShas: string[];
+    /** false when `gh` is missing/unauthed — PR counts are then 0 and not trustworthy. */
+    ghAvailable: boolean;
+    /** Author emails counted as "ours". */
+    authors: string[];
+    /** gh logins queried for PRs. */
+    logins: string[];
+    sinceIso: string;
+}
+export interface GitOutputOptions {
+    /** Root scanned for git repos (e.g. ~/src). */
+    reposDir: string;
+    /** Window start, epoch ms. */
+    sinceMs: number;
+    /** Restrict commit authorship to these emails; default: identities discovered from git config. */
+    authors?: string[];
+    /** gh logins to search PRs for; default: the current `gh api user` login. */
+    logins?: string[];
+    /** Repo discovery depth below reposDir (default 4 — covers ~/src/host/org/repo). */
+    maxDepth?: number;
+    /** Query PRs via gh (default true). */
+    includePrs?: boolean;
+}
+/**
+ * Find git repositories under `root` up to `maxDepth` levels deep. A directory
+ * with a `.git` entry is a repo and is NOT descended into (so nested worktrees
+ * / submodules don't double-count).
+ */
+export declare function findGitRepos(root: string, maxDepth?: number): string[];
+/**
+ * Count commits by our authors across all repos, deduped by SHA (so the same
+ * commit reachable via multiple repo clones/worktrees on this machine — or, at
+ * the fleet layer, across machines — is counted once), tallied per email.
+ */
+export declare function collectCommits(repos: string[], sinceIso: string, authors: string[]): Promise<{
+    total: number;
+    byAuthor: AuthorCommits[];
+    shas: string[];
+}>;
+/**
+ * Count PRs opened and merged in the window across the given logins. `gh search
+ * prs` searches all of GitHub, so one authed gh can cover multiple accounts'
+ * logins. Returns ghAvailable=false if gh can't be reached at all.
+ */
+export declare function collectPrs(logins: string[], sinceDate: string): Promise<{
+    opened: number;
+    merged: number;
+    logins: string[];
+    ghAvailable: boolean;
+}>;
+/** Format an epoch-ms as a YYYY-MM-DD date (UTC), for gh's date-range search. */
+export declare function toSearchDate(ms: number): string;
+/**
+ * Collect the full shipped-work summary for a window: commits (across accounts)
+ * plus PRs opened/merged.
+ */
+export declare function collectGitOutput(options: GitOutputOptions): Promise<GitOutputSummary>;