@phnx-labs/agents-cli 1.20.59 → 1.20.60

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 1.20.60
+
+- **Fix Goose skill sync status for its native central-storage path.** `agents skills list goose@<version>` now reports skills under `~/.agents/skills/` as installed instead of falsely requiring a per-version `.config/goose/skills/` copy that Goose never reads. Source: `apps/cli/src/lib/skills.ts`.
+- **Correct the documented `auto` and ACP `skip` semantics.** The README and bundled `run` skill now distinguish Kimi's interactive `--auto` from its already-auto-approved headless `-p` path, document Droid's native `--auto high`, and explain that ACP `skip` prefers `allow_always` but falls back to the first permission option offered by the server. Documentation only; runtime behavior is unchanged. Source: `README.md`, `skills/run/SKILL.md`.
+- **Wire Antigravity subagents and Kimi workflow sync (RUSH-1548, RUSH-1581).** Antigravity now receives subagents as custom-agent Markdown under `~/.gemini/config/agents/<name>/agent.md` with the `>= 1.0.16` version gate enforced during sync. Kimi receives workflows as managed `type: flow` skills under `.kimi-code/skills/<name>/SKILL.md`, using the canonical slug as the flow name and an `agents_workflow` marker so native user-owned flows are not overwritten or removed. Antigravity workflows remain disabled for version-home sync until a global filesystem target is documented. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/workflows.ts`.
+- **Release retries rebuild the exact merged, CI-tested release tree even after `main` advances.** A registry/auth failure after the release PR merged previously stranded that version because the catch-up guard required the release merge to remain current `main`. The local release script now validates the original PR head and full green matrix, verifies the SHA-pinned keychain helper, rebuilds the unpinned menu-bar helper from historical source in a detached temporary worktree, rejects mismatched remote tags, and tags/publishes that exact merge without including later commits. Source: `apps/cli/scripts/release.sh`.
+- **Wire Gemini plugins/subagents and Goose workflows/allowlists.** Gemini now syncs plugin bundles as Gemini extensions (`.gemini/extensions/<name>/gemini-extension.json`) from CLI 0.8.0+ and subagents as `.gemini/agents/*.md` from CLI 0.36.0+. Goose now syncs workflows as recipe/subrecipe YAML under `.config/goose/recipes/` and permission groups into `.config/goose/permission.yaml`. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/plugins.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/workflows.ts`, `apps/cli/src/lib/permissions.ts`. (RUSH-1568, RUSH-1569, RUSH-1574, RUSH-1582)
+- **Wire Gemini permissions/allowlist support (RUSH-1567).** Gemini permission groups now sync Bash allow/deny rules into `.gemini/settings.json` as `tools.core` / `tools.exclude` entries with per-command `ShellTool(...)` patterns; non-Bash canonical permissions remain unsupported by Gemini's native tool grammar and are skipped. Flip `allowlist: true`, register the permission writer/detector through the capability table, and replace the dormant legacy `tools.allowed` serializer. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/permissions.ts`, `apps/cli/src/lib/resources/permissions.ts`, `apps/cli/src/lib/staleness/detectors/permissions.ts`.
+- **Fix: `agents run <agent>@<version> --host <host>` now forwards the version pin and most run flags to the remote host.** Previously the `--host` branch stripped `@version` and ignored `--strategy`, `--effort`, `--add-dir`, `--json`, `--verbose`, `--timeout`, `--yes`, and `--acp`, so the remote host applied its own defaults. The local CLI now parses `agent@version` verbatim, normalizes `--strategy`/`--balanced`, makes `--add-dir` paths remote-portable, and forwards all of these flags to the remote `agents run` invocation. `--add-dir` portability uses the same `~`/`$HOME` re-rooting that `--cwd` already uses, so a Linux remote resolves home paths against its own `/home/<user>`. Source: `apps/cli/src/lib/hosts/dispatch.ts`, `apps/cli/src/commands/exec.ts`, `apps/cli/src/lib/hosts/dispatch.test.ts`.
+- **Fix: routine edits no longer rewrite the whole YAML file, so `~/.agents` stays clean and `agents repo pull` can sync routines across the fleet.** `writeJob` previously re-emitted the entire document via `yaml.stringify` on every mutation (pause/resume, `routines devices --set`, add), restyling untouched scalars — unquoting `schedule`, re-wrapping the folded `prompt` block — which left the git-backed user repo perpetually dirty. That made cross-device `agents repo pull` refuse ("uncommitted changes"), so a `devices:` pin set on one machine never reached the others and `Devices: all` routines kept firing on every box. A new `serializeJob` edits only the changed keys via the YAML Document API, preserving byte-for-byte formatting of untouched nodes; new/unparseable/non-mapping files fall back to canonical stringify. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/__tests__/routines.serialize.test.ts`.
+
 ## 1.20.59
 
 - **Fix: remote secrets now choose the Windows PowerShell wrapper from the original `--host` name, not the resolved `user@ip` SSH target.** Inline enrolled Windows hosts resolve to address-based SSH targets, but the OS registry is keyed by the host name; `agents secrets view/list/exec --host <windows>`, `agents run --secrets bundle@<windows>`, and remote secrets unlock/export paths now pass that original name into command construction so Windows hosts no longer fall back to `bash -lc`. Source: `apps/cli/src/lib/secrets/remote.ts`, `apps/cli/src/commands/secrets.ts`, `apps/cli/src/commands/exec.ts`. (RUSH-1431)
@@ -12,6 +23,8 @@
 - **OpenCode permissions write to the loaded config path (RUSH-1623).** Global config is `~/.config/opencode/opencode.jsonc` (not `~/.opencode/`); project config is `opencode.jsonc` at the project root. Source: `apps/cli/src/lib/permissions.ts`, `apps/cli/src/lib/agents.ts`.
 - **Catch-up publishes now require the exact CI-tested release tree and its full green matrix.** A package version already present on `main` no longer counts as release validation by itself: `release.sh` resolves the merged `release/v<version>` PR, requires its merge commit to be current `main`, fetches the PR head that ran CI, requires that head tree to equal current `main`, and rechecks every expected CI context before publishing. This closes the path that let 1.20.58 reach npm before its tag-triggered Windows matrix exposed failures. Source: `apps/cli/scripts/release.sh`.
 - **Windows release validation now matches portable path behavior.** Home-relative project paths normalize native separators to `/` before they are stored as `~/…`, and the systemd-manifest and remote-shell assertions now compare the escaped/quoted forms that the runtime deliberately emits. This restores the Windows Node 22/24 release matrix without weakening command escaping. Source: `apps/cli/src/lib/project-root.ts`, `apps/cli/src/lib/{project-root,daemon}.test.ts`, `apps/cli/src/lib/hosts/dispatch.test.ts`.
+- **Wire subagents support for Kiro CLI.** Kiro custom agents are JSON files under `~/.kiro/agents/*.json` (introduced in kiro-cli v1.23.0). Flip Kiro's `subagents: { since: '1.23.0' }`, add `transformSubagentForKiro`, and wire the subagents writer, detector, install/remove, and orphan-detection paths. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/staleness/{writers,detectors}/subagents.ts`. (RUSH-1393)
+
 ## 1.20.58
 
 - **Self-updating agent CLIs are represented as one live installation.** `agents view` no longer invents version-home rows for single-binary installers such as Droid, Grok, Cursor, Kiro, Goose, and Hermes; it reports the version returned by the installed binary and folds away stale per-version directories. `agents add <agent>@<version>` now installs or keeps that agent's current release instead of rejecting an unsupported pinned install. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/versions.ts`, `apps/cli/src/commands/{versions,view}.ts`. (RUSH-1321)
@@ -19,7 +32,6 @@
 - **Wire allowlist support for Cursor CLI.** Cursor agent CLI stores allow/deny in `~/.cursor/cli-config.json` (`permissions.allow`/`deny` with Shell/Read/Write/WebFetch/Mcp). Flip `allowlist: true`, add `convertToCursorFormat` (Bash→Shell), and write via `applyPermissionsToVersion` + detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/permissions.ts`. (RUSH-1387)
 - **GitHub Copilot CLI subagents now sync (RUSH-1390).** Installed subagents flatten into GitHub Copilot custom-agent profiles at `~/.copilot/agents/<name>.agent.md` (the Droid custom-droid format), gated to Copilot CLI ≥ 0.0.353. `agents subagents list/view` now surfaces synced Copilot agents and `agents subagents remove` soft-deletes their `.agent.md` files to trash — both previously skipped `copilot` entirely. Source: `apps/cli/src/lib/subagents.ts` (`listSubagentsForAgent`, `removeSubagentFromVersion`, `transformSubagentForCopilot`), `apps/cli/src/lib/staleness/writers/subagents.ts`, `apps/cli/src/lib/staleness/detectors/subagents.ts`, `apps/cli/src/lib/agents.ts`.
 - **Menu-bar Quick Dispatch preserves typed drafts when focus is stolen (RUSH-1592).** If another app activates while the `Cmd-Shift-O` capture panel is open, the panel can hide without destroying the note; the next summon restores the draft text plus selected screenshots, action, and agents. Return submits and clears the draft; Escape clears without dispatching. Source: `apps/cli/menubar/Sources/MenubarHelper/PromptPanel.swift`, `apps/cli/docs/menubar.md`.
-- **Wire subagents support for Kiro CLI.** Kiro custom agents are JSON files under `~/.kiro/agents/*.json` (introduced in kiro-cli v1.23.0). Flip Kiro's `subagents: { since: '1.23.0' }`, add `transformSubagentForKiro`, and wire the subagents writer, detector, install/remove, and orphan-detection paths. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/staleness/{writers,detectors}/subagents.ts`. (RUSH-1393)
 - **Menu-bar ticket agents now carry every selected screenshot into the Linear issue (RUSH-1668).** `Cmd-Shift-O` already passed selected file paths to the ticket agent, but the prompt only asked it to inspect them, so agents could create text-only issues and stop. The brief now identifies every selected path as user-provided ticket material, requires each file to be uploaded, supplies the existing `linear update <id> --proof <path>` path as a reliable default, and leaves description/comment/other placement to the agent's judgment. Source: `apps/cli/menubar/Sources/MenubarHelper/{AgentsCLI,IssueSelfTest}.swift`, `apps/cli/docs/menubar.md`.
 - **`agents sessions --active --json` now carries session attachment metadata for Factory previews (RUSH-1524).** Claude and Droid prompt image/document blocks that reference local files are preserved as `{ path, name, mediaType, sizeBytes }`, and the active-session state dedupes them into `attachments` so consumers can render screenshot thumbnails and open the original files instead of only seeing an attachment count. Source: `apps/cli/src/lib/session/parse.ts`, `apps/cli/src/lib/session/state.ts`, `apps/cli/src/lib/session/active.ts`.
 - **Retired the standalone `com.phnx-labs.agents-secrets-agent` launchd service — the always-on daemon is now the sole broker host (#416, step 2).** `ensureAgentRunning()` no longer installs a separate launchd service: it retires any leftover plist via the new `retireLegacySecretsAgentService()` and relies on the daemon (Path 0), with a one-off detached broker as the only fallback. The upgrade migration (`scripts/postinstall.js` → `healLongRunningProcesses`) now `launchctl bootout`s the legacy service **first**, then (re)starts the daemon so it takes over the broker socket, instead of kickstarting the old service onto new code. `agents secrets start` is now a thin alias that brings the daemon up (and waits for the broker to answer); `agents secrets stop` locks all bundles and retires any leftover legacy service while leaving the always-on daemon running; `agents secrets status` reports broker reachability (daemon-hosted vs standalone) rather than "service installed". The stale broker teardown (version-skew self-heal) retires the legacy service instead of kickstarting it. Source: `apps/cli/src/lib/secrets/agent.ts` (`retireLegacySecretsAgentService`, `ensureAgentRunning`, `teardownStaleBroker`, `uninstallSecretsAgentService`; removed `installSecretsAgentService`/`kickstartSecretsAgentService`/`generateServicePlist`), `apps/cli/scripts/postinstall.js` (`healLongRunningProcesses`), `apps/cli/src/commands/secrets.ts` (`start`/`stop`/`status`).

package/README.md

@@ -161,9 +161,11 @@ Supports plan (read-only), edit, auto, and skip modes, effort levels, JSON outpu
 
 Treat `skip` as a last-resort escape hatch. In direct-exec runs (without `--acp`),
 agents-cli forwards the harness's native no-prompt flag; it does not add another
-safety layer. Prefer `auto` where the harness has a smart classifier (Claude Code and
-GitHub Copilot), or `edit` everywhere else. Harnesses without a native bypass flag
-reject direct-exec `skip`.
+safety layer. Prefer `auto` where it adds a safer automatic policy (smart classifier
+on Claude/Copilot, native high-auto mode on Droid, or interactive Kimi), or `edit`
+everywhere else. For headless Kimi, `edit`, `auto`, and `skip` all use the same
+already-auto-approved `-p` behavior, so prefer `edit` rather than signaling a blanket
+bypass. Harnesses without a native bypass flag reject direct-exec `skip`.
 
 | Harness | Direct-exec `--mode skip` becomes |
 |---|---|
@@ -179,8 +181,9 @@ reject direct-exec `skip`.
 | Droid | `--skip-permissions-unsafe` |
 
 With `--acp`, these native flags are not used. agents-cli instead grants `skip`
-permission requests at the ACP protocol layer with `allow_always`; the same
-last-resort warning applies.
+permission requests at the ACP protocol layer: it selects `allow_always` when offered,
+otherwise the first permission option offered by the server. The same last-resort
+warning applies.
 
 Codex has no native smart-classifier mode, so `agents run codex --mode auto` resolves
 to sandboxed `edit` and can still prompt. `agents run codex --mode skip` is different:

package/dist/commands/exec.js

@@ -482,6 +482,7 @@ export function registerRunCommand(program) {
             const { resolveHost, resolveHostByCap } = await import('../lib/hosts/registry.js');
             const { dispatchToHost, runInteractiveOnHost } = await import('../lib/hosts/dispatch.js');
             const { registerHostSession, registerInteractiveHostSession } = await import('../lib/hosts/session-index.js');
+            const { normalizeRunStrategy, RUN_STRATEGIES } = await import('../lib/rotate.js');
             // A password-auth device throws DeviceOffloadUnsupportedError here; it's
             // printed cleanly by the top-level catch in index.ts (covers every
             // resolveHost caller), so it never falls through to capability routing.
@@ -506,12 +507,30 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             try {
-                const runAgent = agentSpec.split('@')[0];
+                const [runAgent, rawRunVersion] = agentSpec.split('@');
+                // Forward the explicit @version pin verbatim. Resolving aliases like
+                // @latest locally would check local installs, but the remote host may
+                // have versions the laptop does not. The remote agents CLI resolves
+                // aliases against its own installed versions.
+                const runVersion = rawRunVersion || undefined;
+                // Normalize the effective strategy exactly like the local path so we
+                // fail fast on invalid input and can forward --balanced/--strategy.
+                const explicitStrategy = options.strategy ? normalizeRunStrategy(options.strategy) : null;
+                if (options.strategy && !explicitStrategy) {
+                    console.error(chalk.red(`Invalid strategy: ${options.strategy}. Use ${RUN_STRATEGIES.join(', ')}.`));
+                    process.exit(1);
+                }
+                if (options.balanced && explicitStrategy && explicitStrategy !== 'balanced') {
+                    console.error(chalk.red('--balanced conflicts with --strategy. Use one strategy override.'));
+                    process.exit(1);
+                }
+                const runStrategy = options.balanced ? 'balanced' : explicitStrategy ?? undefined;
                 // Working directory on the host: an explicit --remote-cwd is used
                 // verbatim; --cwd/--project are made portable (a local-home absolute
                 // becomes `~/…` so the remote shell re-roots it at ITS home).
                 const { toRemotePortable } = await import('../lib/project-root.js');
                 const hostCwd = options.remoteCwd ?? (options.cwd ? toRemotePortable(options.cwd) : undefined);
+                const hostAddDirs = options.addDir.length > 0 ? options.addDir.map(toRemotePortable) : undefined;
                 // `--resume [id]`: commander yields the string id, or `true` when the
                 // flag is passed bare. A bare resume needs the interactive picker,
                 // which can't run over a detached remote dispatch — only forward a
@@ -549,9 +568,18 @@ export function registerRunCommand(program) {
                     }
                     const exitCode = await runInteractiveOnHost(host, {
                         agent: runAgent,
+                        version: resumeId ? undefined : runVersion,
+                        strategy: resumeId ? undefined : runStrategy,
                         prompt,
                         mode: options.mode,
                         model: options.model,
+                        effort: options.effort,
+                        addDir: hostAddDirs,
+                        json: options.json,
+                        verbose: options.verbose,
+                        timeout: options.timeout,
+                        yes: options.yes,
+                        acp: options.acp,
                         remoteCwd: hostCwd,
                         sessionId: hostSessionId,
                         name: options.name,
@@ -571,9 +599,18 @@ export function registerRunCommand(program) {
                 const hostSessionId = runAgent === 'claude' && !resumeId ? randomUUID() : undefined;
                 const { task, exitCode } = await dispatchToHost(host, {
                     agent: runAgent,
+                    version: resumeId ? undefined : runVersion,
+                    strategy: resumeId ? undefined : runStrategy,
                     prompt,
                     mode: options.mode,
                     model: options.model,
+                    effort: options.effort,
+                    addDir: hostAddDirs,
+                    json: options.json,
+                    verbose: options.verbose,
+                    timeout: options.timeout,
+                    yes: options.yes,
+                    acp: options.acp,
                     remoteCwd: hostCwd,
                     sessionId: hostSessionId,
                     name: options.name,

package/dist/lib/agents.js

@@ -265,7 +265,8 @@ export const AGENTS = {
             url: 'https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/',
         },
         // gemini hooks: shipped in v0.26.0 (Jan 2026); older binaries silently ignore the `hooks` key.
-        capabilities: { hooks: { since: '0.26.0' }, mcp: true, mcpHttp: true, mcpHeaders: false, allowlist: false, skills: true, commands: true, plugins: false, subagents: false, rules: { file: 'GEMINI.md' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], rulesImports: true },
+        // extensions: gemini-extension.json bundles shipped in v0.8.0; custom subagents in v0.36.0.
+        capabilities: { hooks: { since: '0.26.0' }, mcp: true, mcpHttp: true, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: { since: '0.8.0' }, subagents: { since: '0.36.0' }, rules: { file: 'GEMINI.md' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], rulesImports: true },
     },
     cursor: {
         id: 'cursor',
@@ -419,7 +420,8 @@ export const AGENTS = {
         supportsHooks: true,
         // Plugins: Open Plugins under ~/.agents/plugins/<name>/ (same layout as
         // agents-cli source). Version isolation copies into versionHome/.agents/plugins/.
-        capabilities: { hooks: { since: '1.34.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: false, skills: { since: '1.25.0' }, commands: false, plugins: true, subagents: false, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit'] },
+        // Workflows sync as Goose recipe YAML; permissions sync to permission.yaml.
+        capabilities: { hooks: { since: '1.34.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: { since: '1.25.0' }, commands: false, plugins: true, subagents: false, rules: { file: 'AGENTS.md' }, workflows: true, memory: false, modes: ['edit'] },
     },
     // Google Antigravity CLI (`agy`) — official replacement for Gemini CLI as of IO 2026.
     // configDir nests inside `~/.gemini/` since agy shares the parent dir with the Gemini
@@ -448,7 +450,7 @@ export const AGENTS = {
         variableSyntax: '{{args}}',
         supportsHooks: true,
         cloudProvider: 'antigravity',
-        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: false, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit', 'skip'], rulesImports: false },
+        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: { since: '1.0.16' }, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit', 'skip'], rulesImports: false },
     },
     // xAI Grok Build CLI (`grok`) — early beta, SuperGrok Heavy. Auth via OAuth on
     // first launch, or XAI_API_KEY env var for headless. MCP servers configured inline
@@ -522,7 +524,7 @@ export const AGENTS = {
             plugins: true,
             subagents: true, // YAML agent files under ~/.kimi-code/agents/ (see transformSubagentForKimi)
             rules: { file: 'AGENTS.md' },
-            workflows: false,
+            workflows: true,
             memory: false,
             modes: ['plan', 'edit', 'auto', 'skip'],
             rulesImports: false,

package/dist/lib/hosts/dispatch.d.ts

@@ -39,8 +39,26 @@ export declare function terminateDispatchedTask(task: HostTask): void;
 export interface DispatchOptions {
     agent: string;
     prompt: string;
+    /** Explicit agent version pin (e.g. "2.1.207") to forward as `agent@version`. */
+    version?: string;
+    /** Explicit run strategy (e.g. "balanced") to forward as `--strategy <strategy>`. */
+    strategy?: string;
     mode?: string;
     model?: string;
+    /** Reasoning effort to forward as `--effort <effort>`. */
+    effort?: string;
+    /** Additional directories to grant, already made remote-portable. */
+    addDir?: string[];
+    /** Stream events as JSON lines. */
+    json?: boolean;
+    /** Show detailed execution logs. */
+    verbose?: boolean;
+    /** Kill the agent after this duration, forwarded as `--timeout <duration>`. */
+    timeout?: string;
+    /** Skip the interactive budget-confirm prompt. */
+    yes?: boolean;
+    /** Route through the Agent Client Protocol. */
+    acp?: boolean;
     remoteCwd?: string;
     /**
      * Force the remote run's NEW session to use this exact id (Claude only, via
@@ -68,10 +86,28 @@ export interface DispatchOptions {
 export declare function buildRunForwardedArgs(opts: DispatchOptions): string[];
 export interface InteractiveDispatchOptions {
     agent: string;
+    /** Explicit agent version pin (e.g. "2.1.207") to forward as `agent@version`. */
+    version?: string;
+    /** Explicit run strategy (e.g. "balanced") to forward as `--strategy <strategy>`. */
+    strategy?: string;
     /** Optional prompt — forwarded only when the caller explicitly forced interactive mode. */
     prompt?: string;
     mode?: string;
     model?: string;
+    /** Reasoning effort to forward as `--effort <effort>`. */
+    effort?: string;
+    /** Additional directories to grant, already made remote-portable. */
+    addDir?: string[];
+    /** Stream events as JSON lines. */
+    json?: boolean;
+    /** Show detailed execution logs. */
+    verbose?: boolean;
+    /** Kill the agent after this duration, forwarded as `--timeout <duration>`. */
+    timeout?: string;
+    /** Skip the interactive budget-confirm prompt. */
+    yes?: boolean;
+    /** Route through the Agent Client Protocol. */
+    acp?: boolean;
     remoteCwd?: string;
     sessionId?: string;
     name?: string;

package/dist/lib/hosts/dispatch.js

@@ -175,11 +175,30 @@ async function launchDetached(host, target, opts) {
  * resume wins when — defensively — both are set.
  */
 export function buildRunForwardedArgs(opts) {
-    const args = ['run', opts.agent, opts.prompt, '--quiet'];
+    const agentArg = opts.version ? `${opts.agent}@${opts.version}` : opts.agent;
+    const args = ['run', agentArg, opts.prompt, '--quiet'];
+    if (opts.strategy)
+        args.push('--strategy', opts.strategy);
     if (opts.mode)
         args.push('--mode', opts.mode);
     if (opts.model)
         args.push('--model', opts.model);
+    if (opts.effort)
+        args.push('--effort', opts.effort);
+    if (opts.addDir) {
+        for (const dir of opts.addDir)
+            args.push('--add-dir', dir);
+    }
+    if (opts.json)
+        args.push('--json');
+    if (opts.verbose)
+        args.push('--verbose');
+    if (opts.timeout)
+        args.push('--timeout', opts.timeout);
+    if (opts.yes)
+        args.push('--yes');
+    if (opts.acp)
+        args.push('--acp');
     if (opts.name)
         args.push('--name', opts.name);
     if (opts.resume)
@@ -196,15 +215,34 @@ export function buildRunForwardedArgs(opts) {
  * infer headless from the prompt).
  */
 export function buildInteractiveRunForwardedArgs(opts) {
-    const args = ['run', opts.agent];
+    const agentArg = opts.version ? `${opts.agent}@${opts.version}` : opts.agent;
+    const args = ['run', agentArg];
     if (opts.prompt && opts.forceInteractive)
         args.push(opts.prompt);
     if (opts.forceInteractive)
         args.push('--interactive');
+    if (opts.strategy)
+        args.push('--strategy', opts.strategy);
     if (opts.mode)
         args.push('--mode', opts.mode);
     if (opts.model)
         args.push('--model', opts.model);
+    if (opts.effort)
+        args.push('--effort', opts.effort);
+    if (opts.addDir) {
+        for (const dir of opts.addDir)
+            args.push('--add-dir', dir);
+    }
+    if (opts.json)
+        args.push('--json');
+    if (opts.verbose)
+        args.push('--verbose');
+    if (opts.timeout)
+        args.push('--timeout', opts.timeout);
+    if (opts.yes)
+        args.push('--yes');
+    if (opts.acp)
+        args.push('--acp');
     if (opts.name)
         args.push('--name', opts.name);
     if (opts.resume)

package/dist/lib/permissions.d.ts

@@ -106,15 +106,15 @@ export declare function convertToClaudeFormat(set: PermissionSet): ClaudePermiss
 export declare function convertToCursorFormat(set: PermissionSet): CursorPermissions;
 /**
  * Convert canonical permission set to Gemini format.
- * Gemini reads tool allow-lists from settings.json under `tools.allowed`.
- * Bash permissions map to run_shell_command(prefix) — the prefix is extracted
- * from the canonical "Bash(cmd:*)" pattern by stripping the trailing ":*".
- * Blanket Bash grants map to bare "run_shell_command" (no prefix filter).
+ * Gemini reads tool allow/deny lists from settings.json under
+ * `tools.core` / `tools.exclude`. Bash permissions map to ShellTool(pattern).
+ * Blanket Bash grants map to bare "ShellTool" (no command filter).
  * Non-Bash tool patterns are skipped; Gemini uses different tool names.
  */
 export declare function convertToGeminiFormat(set: PermissionSet): {
     tools: {
-        allowed: string[];
+        core: string[];
+        exclude?: string[];
     };
 };
 /** Convert canonical Bash rules into Droid's command arrays. */
@@ -140,6 +140,15 @@ export declare function convertToAntigravityFormat(set: PermissionSet): {
         deny?: string[];
     };
 };
+export interface GoosePermissionConfig {
+    user: {
+        always_allow: string[];
+        ask_before: string[];
+        never_allow: string[];
+    };
+}
+/** Convert canonical permissions to Goose's per-tool permission.yaml shape. */
+export declare function convertToGooseFormat(set: PermissionSet): GoosePermissionConfig;
 /**
  * Convert canonical permission set to Grok format.
  * Grok reads ~/.grok/config.toml with

package/dist/lib/permissions.js

@@ -306,14 +306,21 @@ export function buildPermissionsFromGroups(groupNames) {
             // Matches lines like: - "Bash(git *)" or   - "WebFetch(domain:example.com)"
             // Handles nested quotes that break YAML parsers
             const lines = content.split('\n');
+            let section = null;
             for (const line of lines) {
+                const sectionMatch = line.match(/^\s*(allow|deny)\s*:\s*(?:#.*)?$/);
+                if (sectionMatch) {
+                    section = sectionMatch[1];
+                    continue;
+                }
                 // Match: optional whitespace, dash, whitespace, quote, content, quote
                 // Use greedy match to capture everything between first and last quote
                 const match = line.match(/^\s*-\s*"(.+)"$/);
                 if (match) {
                     const rule = match[1];
-                    // 99-deny group rules go to deny, others to allow
-                    if (groupName === '99-deny' || groupName.includes('-deny')) {
+                    // 99-deny group rules go to deny, others follow their YAML section.
+                    // Legacy group files used bare lists with no section; keep those as allow.
+                    if (section === 'deny' || groupName === '99-deny' || groupName.includes('-deny')) {
                         allDeny.push(rule);
                     }
                     else {
@@ -486,32 +493,40 @@ function parseCanonicalPattern(permission) {
 const BLANKET_BASH_FORMS = new Set(['Bash', 'Bash(*)', 'Bash(**)']);
 /**
  * Convert canonical permission set to Gemini format.
- * Gemini reads tool allow-lists from settings.json under `tools.allowed`.
- * Bash permissions map to run_shell_command(prefix) — the prefix is extracted
- * from the canonical "Bash(cmd:*)" pattern by stripping the trailing ":*".
- * Blanket Bash grants map to bare "run_shell_command" (no prefix filter).
+ * Gemini reads tool allow/deny lists from settings.json under
+ * `tools.core` / `tools.exclude`. Bash permissions map to ShellTool(pattern).
+ * Blanket Bash grants map to bare "ShellTool" (no command filter).
  * Non-Bash tool patterns are skipped; Gemini uses different tool names.
  */
 export function convertToGeminiFormat(set) {
-    const allowed = new Set();
-    for (const perm of set.allow) {
-        if (BLANKET_BASH_FORMS.has(perm)) {
-            allowed.add('run_shell_command');
-            continue;
-        }
-        const parsed = parseCanonicalPattern(perm);
-        if (!parsed || parsed.tool !== 'bash')
-            continue;
-        const colonIdx = parsed.pattern.lastIndexOf(':');
-        const prefix = colonIdx > 0 ? parsed.pattern.slice(0, colonIdx) : parsed.pattern;
-        if (prefix === '*' || prefix === '**') {
-            allowed.add('run_shell_command');
-        }
-        else {
-            allowed.add(`run_shell_command(${prefix})`);
+    const serialize = (permissions) => {
+        const tools = new Set();
+        for (const perm of permissions) {
+            if (BLANKET_BASH_FORMS.has(perm)) {
+                tools.add('ShellTool');
+                continue;
+            }
+            const parsed = parseCanonicalPattern(perm);
+            if (!parsed || parsed.tool !== 'bash')
+                continue;
+            const command = normalizeBashPattern(parsed.pattern);
+            if (command === '*') {
+                tools.add('ShellTool');
+            }
+            else {
+                tools.add(`ShellTool(${command})`);
+            }
         }
-    }
-    return { tools: { allowed: Array.from(allowed) } };
+        return Array.from(tools);
+    };
+    const core = serialize(set.allow);
+    const exclude = serialize(set.deny ?? []);
+    return {
+        tools: {
+            core,
+            ...(exclude.length ? { exclude } : {}),
+        },
+    };
 }
 /**
  * Strip Claude's `:*` subcommand-wildcard suffix and return a space-glob form.
@@ -596,6 +611,49 @@ const ANTIGRAVITY_ACTION_BY_TOOL = {
     write: 'write_file',
     webfetch: 'read_url',
 };
+const GOOSE_TOOL_BY_CANONICAL = {
+    bash: 'developer__shell',
+    read: 'developer__text_editor',
+    write: 'developer__text_editor',
+    edit: 'developer__text_editor',
+    grep: 'developer__analyze',
+    glob: 'developer__analyze',
+    webfetch: 'developer__fetch',
+    mcp: undefined,
+};
+function canonicalToGooseTool(permission) {
+    if (BLANKET_BASH_FORMS.has(permission))
+        return 'developer__shell';
+    const parsed = parseCanonicalPattern(permission);
+    if (!parsed)
+        return null;
+    return GOOSE_TOOL_BY_CANONICAL[parsed.tool] ?? null;
+}
+/** Convert canonical permissions to Goose's per-tool permission.yaml shape. */
+export function convertToGooseFormat(set) {
+    const alwaysAllow = new Set();
+    const neverAllow = new Set();
+    for (const permission of set.allow) {
+        const tool = canonicalToGooseTool(permission);
+        if (tool)
+            alwaysAllow.add(tool);
+    }
+    for (const permission of set.deny ?? []) {
+        const tool = canonicalToGooseTool(permission);
+        if (tool)
+            neverAllow.add(tool);
+    }
+    for (const tool of neverAllow) {
+        alwaysAllow.delete(tool);
+    }
+    return {
+        user: {
+            always_allow: Array.from(alwaysAllow).sort(),
+            ask_before: [],
+            never_allow: Array.from(neverAllow).sort(),
+        },
+    };
+}
 /**
  * Convert canonical permission set to Grok format.
  * Grok reads ~/.grok/config.toml with
@@ -1274,17 +1332,29 @@ export function applyPermissionsToVersion(agentId, set, versionHome, merge = tru
             const geminiPerms = convertToGeminiFormat(set);
             const settingsPath = path.join(versionHome, '.gemini', 'settings.json');
             updateGeminiSettings(settingsPath, (settings) => {
-                // Remove stale permissions key written by earlier versions of this serializer.
+                // Remove stale keys written by earlier serializer versions:
+                // top-level `permissions`, and Gemini's pre-core/exclude `tools.allowed`.
                 delete settings.permissions;
                 const tools = (typeof settings.tools === 'object' && settings.tools !== null && !Array.isArray(settings.tools))
                     ? settings.tools
                     : {};
+                delete tools.allowed;
                 if (merge) {
-                    const existing = Array.isArray(tools.allowed) ? tools.allowed : [];
-                    tools.allowed = Array.from(new Set([...existing, ...geminiPerms.tools.allowed]));
+                    const existingCore = Array.isArray(tools.core) ? tools.core : [];
+                    const existingExclude = Array.isArray(tools.exclude) ? tools.exclude : [];
+                    tools.core = Array.from(new Set([...existingCore, ...geminiPerms.tools.core]));
+                    const mergedExclude = Array.from(new Set([...existingExclude, ...(geminiPerms.tools.exclude ?? [])]));
+                    if (mergedExclude.length)
+                        tools.exclude = mergedExclude;
+                    else
+                        delete tools.exclude;
                 }
                 else {
-                    tools.allowed = geminiPerms.tools.allowed;
+                    tools.core = geminiPerms.tools.core;
+                    if (geminiPerms.tools.exclude?.length)
+                        tools.exclude = geminiPerms.tools.exclude;
+                    else
+                        delete tools.exclude;
                 }
                 settings.tools = tools;
             });
@@ -1349,6 +1419,47 @@ export function applyPermissionsToVersion(agentId, set, versionHome, merge = tru
             fs.writeFileSync(configPath, TOML.stringify(config), 'utf-8');
             return { success: true };
         }
+        if (agentId === 'goose') {
+            const permissionsPath = path.join(versionHome, '.config', 'goose', 'permission.yaml');
+            let config = {};
+            if (fs.existsSync(permissionsPath)) {
+                const parsed = yaml.parse(fs.readFileSync(permissionsPath, 'utf-8'));
+                if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                    config = parsed;
+                }
+            }
+            const converted = convertToGooseFormat(set).user;
+            const user = (typeof config.user === 'object' && config.user !== null && !Array.isArray(config.user))
+                ? config.user
+                : {};
+            const currentAlways = Array.isArray(user.always_allow) ? user.always_allow.filter((v) => typeof v === 'string') : [];
+            const currentAsk = Array.isArray(user.ask_before) ? user.ask_before.filter((v) => typeof v === 'string') : [];
+            const currentNever = Array.isArray(user.never_allow) ? user.never_allow.filter((v) => typeof v === 'string') : [];
+            if (merge) {
+                const incomingAlways = new Set(converted.always_allow);
+                const incomingNever = new Set(converted.never_allow);
+                const touched = new Set([...incomingAlways, ...incomingNever]);
+                const always = new Set(currentAlways.filter(tool => !touched.has(tool)));
+                const ask = new Set(currentAsk.filter(tool => !touched.has(tool)));
+                const never = new Set(currentNever.filter(tool => !touched.has(tool)));
+                for (const tool of incomingAlways)
+                    always.add(tool);
+                for (const tool of incomingNever)
+                    never.add(tool);
+                user.always_allow = Array.from(always).sort();
+                user.ask_before = Array.from(ask).sort();
+                user.never_allow = Array.from(never).sort();
+            }
+            else {
+                user.always_allow = converted.always_allow;
+                user.ask_before = converted.ask_before;
+                user.never_allow = converted.never_allow;
+            }
+            config.user = user;
+            fs.mkdirSync(path.dirname(permissionsPath), { recursive: true });
+            fs.writeFileSync(permissionsPath, yaml.stringify(config), 'utf-8');
+            return { success: true };
+        }
         if (agentId === 'kimi') {
             const configPath = path.join(versionHome, '.kimi-code', 'config.toml');
             let config = {};

package/dist/lib/plugins.d.ts

@@ -191,6 +191,14 @@ export declare function resolveOpenCodePluginSources(pluginRoot: string): string
 export declare function installOpenCodePlugin(plugin: DiscoveredPlugin, versionHome: string): boolean;
 export declare function isOpenCodePluginInstalled(pluginName: string, versionHome: string): boolean;
 export declare function removeOpenCodePlugin(pluginName: string, versionHome: string): boolean;
+/**
+ * Gemini CLI extensions live under `$HOME/.gemini/extensions/<name>/` and
+ * require a `gemini-extension.json` manifest at the extension root.
+ */
+export declare function geminiExtensionsDir(versionHome: string): string;
+export declare function installGeminiPlugin(plugin: DiscoveredPlugin, versionHome: string): boolean;
+export declare function isGeminiPluginInstalled(pluginName: string, versionHome: string): boolean;
+export declare function removeGeminiPlugin(pluginName: string, versionHome: string): boolean;
 /**
  * Goose auto-discovers Open Plugins at `$HOME/.agents/plugins/<name>/`.
  * Under agents-cli version isolation HOME is the version home, so we install to: