@phnx-labs/agents-cli 1.20.60 → 1.20.62

package/CHANGELOG.md

@@ -2,16 +2,32 @@
 
 ## Unreleased
 
-## 1.20.60
+## 1.20.62
+
+- **Wire Goose commands support (RUSH-1572).** `agents` now syncs slash commands to Goose as recipe YAML files under `~/.config/goose/commands/<name>.yaml`, each registered in `~/.config/goose/config.yaml` under a `slash_commands: [{ command, recipe_path }]` array (Goose has no native slash-command file format — a slash command IS a recipe). The command recipes live in a dir distinct from the workflow recipes dir (`~/.config/goose/recipes/`) so the workflow detector never treats a command recipe as a workflow. Registration is a read-modify-write that preserves every other `config.yaml` key (`mcp_servers`, `extensions`, …) and other `slash_commands` entries, and removal soft-deletes the recipe + unregisters the entry. Flip Goose's `commands` capability and add `goose` branches to install/list/match/remove, the staleness commands writer, and doctor-diff, backed by a new `goose-commands.ts` module + a `markdownToGooseRecipe` converter. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/goose-commands.ts`, `apps/cli/src/lib/commands.ts`, `apps/cli/src/lib/convert.ts`, `apps/cli/src/lib/staleness/writers/commands.ts`, `apps/cli/src/lib/doctor-diff.ts`.
+- **Fix: Hermes plugin sync no longer disables a plugin the user explicitly enabled.** The plugin install path (RUSH-1688) unconditionally forced `plugins.enabled` to the exec-surface trust verdict on every sync. An ordinary un-flagged background re-sync computes `enable=false` for a plugin with hooks/tools, so it stripped that plugin from the `~/.hermes/config.yaml` allowlist — clobbering a plugin the user deliberately enabled with `--allow-exec-surfaces`. The install path now enables only when trusted and never down-toggles (matching the marketplace flow's add-if-trusted semantics); removal still unregisters explicitly. Source: `apps/cli/src/lib/plugins.ts`.
+- **Wire Goose subagents support (RUSH-1573).** `agents` now syncs subagents to Goose as recipe YAML files under `~/.config/goose/agents/<name>.yaml` — Goose has no dedicated subagent format, so a named subagent IS a recipe (goose auto-discovers `~/.config/goose/agents/` and delegates to them by name in autonomous mode). `transformSubagentForGoose` emits the same recipe schema agents-cli already uses for Goose workflow recipes (`version`/`title`/`description`/`instructions`/`prompt`, plus optional `settings.goose_model`). Flip Goose's `subagents` capability and wire the install/remove/list/orphan/version-remove branches plus the staleness subagents writer and detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/staleness/{writers,detectors}/subagents.ts`.
+
+- **Wire ForgeCode commands and subagents support (RUSH-1689, RUSH-1690).** `agents` now syncs slash commands to ForgeCode as Markdown files under `~/.forge/commands/<name>.md` (previously ForgeCode had `commands: false` and received commands only as skills), and named subagents as Markdown-with-frontmatter definitions under `~/.forge/agents/<name>.md` (same `color`-less shape as Droid/Copilot/Cursor, so `transformSubagentForForge` aliases `transformSubagentForDroid`). Flip ForgeCode's `commands`/`subagents` capabilities, set `commandsDir`, add the subagent transform plus install/remove/list/orphan/version-remove branches, and register the subagents writer + detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/staleness/{writers,detectors}/subagents.ts`.
+- **Wire allowlist (permissions) support for OpenClaw (RUSH-1570).** OpenClaw gates at TOOL granularity only, so permission sync maps just **blanket** (whole-tool) rules into `~/.openclaw/openclaw.json` `tools.alsoAllow` (allow) / `tools.deny` (deny): `bash → exec`, `read → read`, `write`/`edit → write`, `webfetch → web_fetch`, `websearch → web_search`. Sub-command/path/domain rules (`Bash(git:*)`, `Write(secrets/**)`, `WebFetch(domain:x)`) have no tool-level equivalent and are skipped — coarse-mapping a specific deny to a whole tool would wrongly gate every use of that tool. The absolute `tools.allow` list is never touched, and all other keys (`mcp`, `exec`, `agents`, …) are preserved on read-modify-write. Flip OpenClaw's `allowlist: true`, add `convertToOpenClawFormat` + the `openclaw` branch in `applyPermissionsToVersion`, register the config path and staleness detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/permissions.ts`, `apps/cli/src/lib/resources/permissions.ts`, `apps/cli/src/lib/staleness/detectors/permissions.ts`.
+- **Wire subagents support for Cursor CLI (RUSH-1388).** cursor-agent loads custom subagents as Markdown with YAML frontmatter under `~/.cursor/agents/*.md` (project-scoped `.cursor/agents/` also supported natively), same shape as Claude/Droid/Copilot minus the `color` field, gated at `>= 2026.1.22` (cursor-agent's CalVer build tag for Cursor 2.4). Flip Cursor's `subagents`, add `transformSubagentForCursor` (alias of `transformSubagentForDroid`), and wire the install/remove, list, orphan-detection, writer, and detector paths. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/staleness/{writers,detectors}/subagents.ts`.
+- **Wire hooks support for Hermes (RUSH-1687).** `agents` now registers central hooks into Hermes Agent's `~/.hermes/config.yaml` under a `hooks:` block (YAML, ≥ 0.11.0). The registrar read-modify-writes that shared config so sibling keys like `mcp_servers` survive, maps canonical events to Hermes' snake_case lifecycle names (`SessionStart→on_session_start`, `SessionEnd→on_session_end`, `PreToolUse→pre_tool_call`, `PostToolUse→post_tool_call`, `SubagentStop→subagent_stop`, `UserPromptSubmit→pre_llm_call`, `Stop→on_session_finalize`), and clamps each hook's timeout to 300s (default 60s). Managed entries are re-synced idempotently while user-authored hooks are preserved. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/hooks.ts`, `apps/cli/src/lib/staleness/writers/hooks.ts`.
 
+## 1.20.61
+
+- **Detect OpenCode sign-in state so `agents view` stops mislabeling a logged-in install as "not signed in."** `getAccountInfo` had no `opencode` case, so it fell through to `signedIn: false` and every row printed "(not signed in — run opencode to log in)" even with a live login. It now reads OpenCode's `auth.json` (`$XDG_DATA_HOME/opencode/auth.json`, defaulting to `~/.local/share/opencode/auth.json` on every platform — `xdg-basedir` does not special-case macOS), validates each provider entry against its `oauth`/`api`/`wellknown` credential shape, and reports the account as signed in with the non-secret provider ids surfaced as the account label (e.g. `id:muse-spark`). Credential secrets (`access`/`refresh`/`key`/`token`) are only inspected for presence — never read into any display or JSON output. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/agents.test.ts`.
+- **Wire Antigravity workflows support (RUSH-1580).** `agents` now syncs workflows to Antigravity as markdown files with the required `description` frontmatter plus an `agents_workflow` ownership marker, invocable as `/<name>` slash commands. Antigravity workflows are the one non-version-isolated target: `agy` scans a single shared, HOME-global `~/.gemini/config/global_workflows/` at startup (a real home directory, never symlinked per version — verified via strace of `agy`), so the writer and detector both resolve that shared dir for every installed version instead of a per-version home. Gated at `>= 1.0.6`. The ownership marker prevents overwriting or removing user-authored workflows of the same name. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/workflows.ts`, `apps/cli/src/lib/staleness/detectors/workflows.ts`.
+
+## 1.20.60
 - **Fix Goose skill sync status for its native central-storage path.** `agents skills list goose@<version>` now reports skills under `~/.agents/skills/` as installed instead of falsely requiring a per-version `.config/goose/skills/` copy that Goose never reads. Source: `apps/cli/src/lib/skills.ts`.
 - **Correct the documented `auto` and ACP `skip` semantics.** The README and bundled `run` skill now distinguish Kimi's interactive `--auto` from its already-auto-approved headless `-p` path, document Droid's native `--auto high`, and explain that ACP `skip` prefers `allow_always` but falls back to the first permission option offered by the server. Documentation only; runtime behavior is unchanged. Source: `README.md`, `skills/run/SKILL.md`.
-- **Wire Antigravity subagents and Kimi workflow sync (RUSH-1548, RUSH-1581).** Antigravity now receives subagents as custom-agent Markdown under `~/.gemini/config/agents/<name>/agent.md` with the `>= 1.0.16` version gate enforced during sync. Kimi receives workflows as managed `type: flow` skills under `.kimi-code/skills/<name>/SKILL.md`, using the canonical slug as the flow name and an `agents_workflow` marker so native user-owned flows are not overwritten or removed. Antigravity workflows remain disabled for version-home sync until a global filesystem target is documented. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/workflows.ts`.
+- **Wire Antigravity subagents and Kimi workflow sync (RUSH-1548, RUSH-1581).** Antigravity now receives subagents as custom-agent Markdown under `~/.gemini/config/agents/<name>/agent.md` with the `>= 1.0.16` version gate enforced during sync. Kimi receives workflows as managed `type: flow` skills under `.kimi-code/skills/<name>/SKILL.md`, using the canonical slug as the flow name and an `agents_workflow` marker so native user-owned flows are not overwritten or removed. Antigravity workflows are wired separately in RUSH-1580 (they target a shared HOME-global dir, not a version home). Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/workflows.ts`.
 - **Release retries rebuild the exact merged, CI-tested release tree even after `main` advances.** A registry/auth failure after the release PR merged previously stranded that version because the catch-up guard required the release merge to remain current `main`. The local release script now validates the original PR head and full green matrix, verifies the SHA-pinned keychain helper, rebuilds the unpinned menu-bar helper from historical source in a detached temporary worktree, rejects mismatched remote tags, and tags/publishes that exact merge without including later commits. Source: `apps/cli/scripts/release.sh`.
 - **Wire Gemini plugins/subagents and Goose workflows/allowlists.** Gemini now syncs plugin bundles as Gemini extensions (`.gemini/extensions/<name>/gemini-extension.json`) from CLI 0.8.0+ and subagents as `.gemini/agents/*.md` from CLI 0.36.0+. Goose now syncs workflows as recipe/subrecipe YAML under `.config/goose/recipes/` and permission groups into `.config/goose/permission.yaml`. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/plugins.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/workflows.ts`, `apps/cli/src/lib/permissions.ts`. (RUSH-1568, RUSH-1569, RUSH-1574, RUSH-1582)
 - **Wire Gemini permissions/allowlist support (RUSH-1567).** Gemini permission groups now sync Bash allow/deny rules into `.gemini/settings.json` as `tools.core` / `tools.exclude` entries with per-command `ShellTool(...)` patterns; non-Bash canonical permissions remain unsupported by Gemini's native tool grammar and are skipped. Flip `allowlist: true`, register the permission writer/detector through the capability table, and replace the dormant legacy `tools.allowed` serializer. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/permissions.ts`, `apps/cli/src/lib/resources/permissions.ts`, `apps/cli/src/lib/staleness/detectors/permissions.ts`.
 - **Fix: `agents run <agent>@<version> --host <host>` now forwards the version pin and most run flags to the remote host.** Previously the `--host` branch stripped `@version` and ignored `--strategy`, `--effort`, `--add-dir`, `--json`, `--verbose`, `--timeout`, `--yes`, and `--acp`, so the remote host applied its own defaults. The local CLI now parses `agent@version` verbatim, normalizes `--strategy`/`--balanced`, makes `--add-dir` paths remote-portable, and forwards all of these flags to the remote `agents run` invocation. `--add-dir` portability uses the same `~`/`$HOME` re-rooting that `--cwd` already uses, so a Linux remote resolves home paths against its own `/home/<user>`. Source: `apps/cli/src/lib/hosts/dispatch.ts`, `apps/cli/src/commands/exec.ts`, `apps/cli/src/lib/hosts/dispatch.test.ts`.
 - **Fix: routine edits no longer rewrite the whole YAML file, so `~/.agents` stays clean and `agents repo pull` can sync routines across the fleet.** `writeJob` previously re-emitted the entire document via `yaml.stringify` on every mutation (pause/resume, `routines devices --set`, add), restyling untouched scalars — unquoting `schedule`, re-wrapping the folded `prompt` block — which left the git-backed user repo perpetually dirty. That made cross-device `agents repo pull` refuse ("uncommitted changes"), so a `devices:` pin set on one machine never reached the others and `Devices: all` routines kept firing on every box. A new `serializeJob` edits only the changed keys via the YAML Document API, preserving byte-for-byte formatting of untouched nodes; new/unparseable/non-mapping files fall back to canonical stringify. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/__tests__/routines.serialize.test.ts`.
+- **`agents sessions --active --json` now carries live plan progress (RUSH-1380).** The state engine parses the latest `TodoWrite` off the transcript tail into `ActiveSession.todos` (`{ items: [{ content, status, activeForm? }], done, total, activeForm }`), and the live preview verb reads `Plan N/M: <current step>` instead of a bare "TodoWrite". This lets consumers (the Factory Floor) show an N/M pill + checklist for every session — including remote / device-dispatched agents that have no local tool-call stream. Source: `apps/cli/src/lib/session/state.ts` (`extractTodoProgress`, `inferActivity`), `apps/cli/src/lib/session/active.ts` (`ActiveSession.todos`, `applyState`), `apps/cli/src/lib/session/parse.ts` (`summarizeToolUse`).
 
 ## 1.20.59
 

package/README.md

@@ -855,7 +855,7 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | Grok Build | yes | yes | yes | yes | yes | skills ($name) | yes | no | `AGENTS.md` | no |
 | OpenClaw | yes | yes | yes | no | yes | gateway | yes | yes | `workspace/AGENTS.md` | no |
 | Cursor | yes | no | yes | no | yes | yes | no | no | `.cursorrules` | no |
-| OpenCode | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
+| OpenCode | yes | no | yes | >= 1.1.1 | yes | yes | no | no | `AGENTS.md` | no |
 | Copilot | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Amp | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Kiro | yes | no | yes | >= 2.8.0 | yes | yes | no | >= 1.23.0 | `AGENTS.md` | no |

package/dist/commands/exec.js

@@ -1081,8 +1081,17 @@ export function registerRunCommand(program) {
             if (nativeResume(agent)) {
                 resumeNative = true;
                 resumeSessionId = session.id;
+                // Native `--resume` (claude/codex) resolves the transcript relative to the
+                // working directory (projects/<cwd-hash>/). The session may have been started
+                // in a different directory than we're standing in now — most importantly when a
+                // routine daemon fires `agents run --resume` from its own cwd. Spawn from the
+                // session's ORIGIN cwd so the resume actually finds it; otherwise the agent
+                // exits "No conversation found with session ID". Honor an explicit --cwd only if
+                // the caller passed one (they're overriding on purpose).
+                if (!options.cwd && session.cwd)
+                    options.cwd = session.cwd;
                 if (!options.quiet)
-                    process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''}\n`));
+                    process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''}${!options.cwd || options.cwd === session.cwd ? ` in ${session.cwd ?? cwd}` : ''}\n`));
             }
             else {
                 // Tier-2: launch fresh with a /continue <id> first message; the agent

package/dist/commands/routines.js

@@ -347,6 +347,7 @@ export function registerRoutinesCommands(program) {
         .option('--at <time>', 'One-shot mode: run once at this time (e.g., "14:30" or "2026-02-24 09:00"), then disable')
         .option('--end-at <iso>', 'Stop firing on or after this ISO 8601 timestamp (e.g., "2026-12-31T23:59:00Z"); routine auto-disables.')
         .option('--disabled', 'Create the routine but keep it paused (enable later with resume)')
+        .option('--resume <sessionId>', 'At fire time, resume this existing session id (via `agents run <agent> --resume`) instead of starting fresh — the actual session reopens with full context and the prompt becomes its next turn. Powers self-scheduled wake-ups (e.g. /hibernate). Requires --agent claude or codex; runs un-sandboxed (the session store lives in the real home, not the job overlay).')
         .action(async (nameOrPath, options) => {
         // Check if inline mode (has flags) or file mode
         const hasInlineFlags = options.schedule || options.agent || options.workflow || options.prompt || options.at;
@@ -406,6 +407,7 @@ export function registerRoutinesCommands(program) {
                 ...(devices ? { devices } : {}),
                 ...(runOnce ? { runOnce: true } : {}),
                 ...(options.endAt ? { endAt: options.endAt } : {}),
+                ...(options.resume ? { resume: options.resume } : {}),
             };
             const errors = validateJob(config);
             if (errors.length > 0) {

package/dist/lib/agents.js

@@ -291,7 +291,15 @@ export const AGENTS = {
         format: 'markdown',
         variableSyntax: '$ARGUMENTS',
         supportsHooks: true,
-        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: false, rules: { file: '.cursorrules' }, workflows: false, memory: false, modes: ['edit', 'skip'] }, // allowlist: ~/.cursor/cli-config.json
+        // Subagents: `.cursor/agents/<name>.md` (project) or `~/.cursor/agents/<name>.md`
+        // (user), Markdown with YAML frontmatter (name, description, model, readonly,
+        // is_background — no `color`). Shipped in cursor-agent CLI 2026.01 (Cursor 2.4,
+        // 2026-01-22); cursor-agent uses CalVer build tags (e.g. 2025.11.25-<hash>), so
+        // gate at `>= 2026.1.22`. The `agents sync` path enforces this (versions.ts skips
+        // + warns for pre-2.4 installs); the direct `subagents add --agents cursor` path
+        // writes unconditionally, same as the other since-gated agents.
+        // See transformSubagentForCursor / https://cursor.com/docs/subagents.
+        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: { since: '2026.1.22' }, rules: { file: '.cursorrules' }, workflows: false, memory: false, modes: ['edit', 'skip'] }, // allowlist: ~/.cursor/cli-config.json
     },
     opencode: {
         id: 'opencode',
@@ -329,7 +337,11 @@ export const AGENTS = {
         format: 'markdown',
         variableSyntax: '{{ARGUMENTS}}',
         supportsHooks: true,
-        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: false, skills: true, commands: false, plugins: true, subagents: true, rules: { file: 'workspace/AGENTS.md' }, workflows: false, memory: true, modes: ['plan', 'edit', 'skip'] },
+        // allowlist: maps blanket (whole-tool) rules to ~/.openclaw/openclaw.json
+        // tools.alsoAllow (allow) / tools.deny (deny). OpenClaw gates at tool
+        // granularity only, so sub-command/path/domain patterns are skipped.
+        // OpenClaw is self-updating (no pinned since), so `true` is correct.
+        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: false, plugins: true, subagents: true, rules: { file: 'workspace/AGENTS.md' }, workflows: false, memory: true, modes: ['plan', 'edit', 'skip'] },
     },
     copilot: {
         id: 'copilot',
@@ -421,7 +433,12 @@ export const AGENTS = {
         // Plugins: Open Plugins under ~/.agents/plugins/<name>/ (same layout as
         // agents-cli source). Version isolation copies into versionHome/.agents/plugins/.
         // Workflows sync as Goose recipe YAML; permissions sync to permission.yaml.
-        capabilities: { hooks: { since: '1.34.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: { since: '1.25.0' }, commands: false, plugins: true, subagents: false, rules: { file: 'AGENTS.md' }, workflows: true, memory: false, modes: ['edit'] },
+        // Commands: a Goose slash command is a recipe YAML under
+        // ~/.config/goose/commands/<name>.yaml, registered in ~/.config/goose/config.yaml
+        // under `slash_commands: [{ command, recipe_path }]` (see goose-commands.ts).
+        // Subagents: recipe YAML named agents under ~/.config/goose/agents/<name>.yaml
+        // (goose auto-discovers and delegates to them by name in autonomous mode).
+        capabilities: { hooks: { since: '1.34.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: { since: '1.25.0' }, commands: true, plugins: true, subagents: true, rules: { file: 'AGENTS.md' }, workflows: true, memory: false, modes: ['edit'] },
     },
     // Google Antigravity CLI (`agy`) — official replacement for Gemini CLI as of IO 2026.
     // configDir nests inside `~/.gemini/` since agy shares the parent dir with the Gemini
@@ -450,7 +467,7 @@ export const AGENTS = {
         variableSyntax: '{{args}}',
         supportsHooks: true,
         cloudProvider: 'antigravity',
-        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: { since: '1.0.16' }, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit', 'skip'], rulesImports: false },
+        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: { since: '1.0.16' }, rules: { file: 'AGENTS.md' }, workflows: { since: '1.0.6' }, memory: false, modes: ['edit', 'skip'], rulesImports: false }, // workflows: markdown files in the shared, HOME-global ~/.gemini/config/global_workflows/ (agy scans it at startup; not version-isolated — see workflows.ts), invoked as /<name> slash commands
     },
     // xAI Grok Build CLI (`grok`) — early beta, SuperGrok Heavy. Auth via OAuth on
     // first launch, or XAI_API_KEY env var for headless. MCP servers configured inline
@@ -610,16 +627,25 @@ export const AGENTS = {
         instructionsFile: 'MEMORY.md',
         format: 'markdown',
         variableSyntax: '$ARGUMENTS',
-        supportsHooks: false,
+        supportsHooks: true,
+        // Plugins: Hermes loads plugins from a flat `~/.hermes/plugins/<name>/` dir
+        // with a `plugin.yaml` manifest; a plugin only loads once its name is in the
+        // `plugins.enabled` allowlist in `~/.hermes/config.yaml` (deny-list
+        // `plugins.disabled` wins). Not the Claude marketplace layout, so it installs
+        // via a flat-copy branch (mirrors goose) plus a YAML allowlist toggle.
+        // See https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins
         capabilities: {
-            hooks: false,
+            // Lifecycle hooks land in ~/.hermes/config.yaml under a `hooks:` block
+            // (YAML, shared with `mcp_servers`); gated to Hermes ≥ 0.11.0 which
+            // introduced the configurable hook runner.
+            hooks: { since: '0.11.0' },
             mcp: true,
             mcpHttp: true,
             mcpHeaders: false,
             allowlist: false,
             skills: true,
             commands: false,
-            plugins: false,
+            plugins: true,
             subagents: false,
             rules: { file: 'MEMORY.md' },
             workflows: false,
@@ -638,14 +664,20 @@ export const AGENTS = {
         npmPackage: '',
         installScript: 'curl -fsSL https://forgecode.dev/cli | sh',
         configDir: path.join(HOME, '.forge'),
-        commandsDir: '',
-        commandsSubdir: '',
+        commandsDir: path.join(HOME, '.forge', 'commands'),
+        commandsSubdir: 'commands',
         skillsDir: path.join(HOME, '.forge', 'skills'),
         hooksDir: 'hooks',
         instructionsFile: 'AGENTS.md',
         format: 'markdown',
         variableSyntax: '$ARGUMENTS',
         supportsHooks: false,
+        // Commands: ForgeCode reads Markdown slash commands from `~/.forge/commands/<name>.md`
+        // (also the shared `~/.agents/commands/`); the filename is the command name.
+        // Subagents: named `.md` agent definitions with YAML frontmatter under
+        // `~/.forge/agents/<name>.md` — same Markdown+frontmatter shape as Droid/Copilot
+        // (no `color` field), so transformSubagentForForge aliases transformSubagentForDroid.
+        // See https://forgecode.dev/docs/commands/ and /docs/agent-definition-guide/.
         capabilities: {
             hooks: false,
             mcp: true,
@@ -653,9 +685,9 @@ export const AGENTS = {
             mcpHeaders: false,
             allowlist: false,
             skills: true,
-            commands: false,
+            commands: true,
             plugins: false,
-            subagents: false,
+            subagents: true,
             rules: { file: 'AGENTS.md' },
             workflows: false,
             memory: false,
@@ -1024,6 +1056,64 @@ async function antigravityKeychainSignedIn() {
     }
     return cachedAgyKeychainSignedIn;
 }
+/**
+ * OpenCode (sst/opencode) stores provider credentials in a single JSON file at
+ * `$XDG_DATA_HOME/opencode/auth.json`, defaulting to
+ * `~/.local/share/opencode/auth.json` on EVERY platform — its `xdg-basedir`
+ * dependency does not special-case macOS, so there is no
+ * `~/Library/Application Support` variant. The path is account-global (not
+ * per-version), matching how `session/discover.ts` already resolves
+ * `~/.local/share/opencode/opencode.db`.
+ *
+ * Resolution order, first existing wins:
+ *   1. `<base>/.local/share/opencode/auth.json` — the passed per-version home.
+ *      This is primarily a test hook (suites write a hermetic auth file under a
+ *      temp home) but also covers any relocated install.
+ *   2. `$XDG_DATA_HOME/opencode/auth.json` — an explicit XDG override, exactly
+ *      what OpenCode itself honours.
+ *   3. `<realHome>/.local/share/opencode/auth.json` — the active default, under
+ *      `AGENTS_REAL_HOME` or `os.homedir()`, so every installed version reflects
+ *      the one account-global login (same fallback shape as
+ *      resolveAccountCredentialPath).
+ * Returns the first existing path, or null. Never throws.
+ */
+function resolveOpenCodeAuthPath(base) {
+    const candidates = [path.join(base, '.local', 'share', 'opencode', 'auth.json')];
+    const xdgData = process.env.XDG_DATA_HOME;
+    if (xdgData)
+        candidates.push(path.join(xdgData, 'opencode', 'auth.json'));
+    const realHome = process.env.AGENTS_REAL_HOME || os.homedir();
+    candidates.push(path.join(realHome, '.local', 'share', 'opencode', 'auth.json'));
+    for (const candidate of candidates) {
+        try {
+            if (fs.existsSync(candidate))
+                return candidate;
+        }
+        catch { /* unreadable */ }
+    }
+    return null;
+}
+/**
+ * Validate one OpenCode auth.json entry against its discriminated union
+ * (`type: 'oauth' | 'api' | 'wellknown'`) and confirm the credential actually
+ * carries its required secret field(s) non-empty. This guards against a
+ * corrupt/half-written entry reading as signed-in — the same "must have a real
+ * credential" floor grok/antigravity apply. We only INSPECT the shape here; the
+ * secret values (`access`/`refresh`/`key`/`token`) are never read out or
+ * surfaced anywhere.
+ */
+function isValidOpenCodeCredential(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const cred = value;
+    const nonEmpty = (v) => typeof v === 'string' && v.length > 0;
+    switch (cred.type) {
+        case 'oauth': return nonEmpty(cred.access) || nonEmpty(cred.refresh);
+        case 'api': return nonEmpty(cred.key);
+        case 'wellknown': return nonEmpty(cred.key) && nonEmpty(cred.token);
+        default: return false;
+    }
+}
 export async function getAccountInfo(agentId, home) {
     const base = home || os.homedir();
     const empty = {
@@ -1253,6 +1343,34 @@ export async function getAccountInfo(agentId, home) {
                     return { ...empty, lastActive };
                 return { ...empty, signedIn: true, lastActive };
             }
+            case 'opencode': {
+                // OpenCode's auth.json is a record keyed by provider id ->
+                // { type: 'oauth'|'api'|'wellknown', ...secret fields }. There is no
+                // email/identity claim to surface, so — like antigravity/kimi — we
+                // report signed-in state plus the NON-SECRET provider metadata (which
+                // provider ids hold a valid credential) and never read the tokens/keys
+                // themselves. The user's complaint was the row read "not signed in"
+                // despite a live login; a valid provider entry now shows e.g.
+                // "id:muse-spark" so they can see exactly which provider is configured.
+                const authPath = resolveOpenCodeAuthPath(base);
+                if (!authPath)
+                    return { ...empty, lastActive };
+                const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
+                if (!data || typeof data !== 'object')
+                    return { ...empty, lastActive };
+                const providers = Object.entries(data)
+                    .filter(([, cred]) => isValidOpenCodeCredential(cred))
+                    .map(([id]) => id)
+                    .sort();
+                if (providers.length === 0)
+                    return { ...empty, lastActive };
+                // Provider ids are config keys (e.g. "anthropic", "muse-spark"), not
+                // secrets. Join them into a stable, human-readable account label +
+                // identity key for usage dedup.
+                const accountId = providers.join('+');
+                const accountKey = buildIdentityKey(agentId, [['providers', accountId]]);
+                return { ...empty, signedIn: true, accountId, accountKey, lastActive };
+            }
             default:
                 return { ...empty, lastActive };
         }

package/dist/lib/commands.js

@@ -15,6 +15,7 @@ import { markdownToToml } from './convert.js';
 import { getCommandsDir, getUserCommandsDir, getEnabledExtraRepos, getProjectAgentsDir, getSkillsDir, getTrashCommandsDir } from './state.js';
 import { getEffectiveHome, getVersionHomePath, listInstalledVersions, resolveVersion } from './versions.js';
 import { commandSkillMatches, installCommandSkillToVersion, listCommandSkillsInVersion, removeCommandSkillFromVersion, shouldInstallCommandAsSkill, } from './command-skills.js';
+import { installGooseCommandToVersion, listGooseCommandsInVersion, gooseCommandMatches, removeGooseCommandFromVersion, } from './goose-commands.js';
 function compareVersions(a, b) {
     const aParts = a.split('.').map((n) => parseInt(n, 10) || 0);
     const bParts = b.split('.').map((n) => parseInt(n, 10) || 0);
@@ -209,6 +210,19 @@ export function installCommand(sourcePath, agentId, commandName, method = 'symli
     const agent = AGENTS[agentId];
     ensureCommandsDir(agentId);
     const home = getEffectiveHome(agentId);
+    // Goose: a slash command is a recipe YAML registered in config.yaml, not a
+    // native command file under commandsSubdir.
+    if (agentId === 'goose') {
+        const result = installGooseCommandToVersion(home, commandName, sourcePath);
+        if (!result.success) {
+            return { path: '', method: 'copy', error: result.error, warnings: validation.warnings };
+        }
+        return {
+            path: path.join(home, '.config', 'goose', 'commands', `${commandName}.yaml`),
+            method: 'copy',
+            warnings: validation.warnings,
+        };
+    }
     const commandsDir = path.join(home, agentConfigDirName(agentId), agent.commandsSubdir);
     fs.mkdirSync(commandsDir, { recursive: true });
     const ext = agent.format === 'toml' ? '.toml' : '.md';
@@ -248,6 +262,9 @@ export function listCommandsInVersionHome(agent, version) {
     if (shouldInstallCommandAsSkill(agent, version)) {
         return listCommandSkillsInVersion(agentDir);
     }
+    if (agent === 'goose') {
+        return listGooseCommandsInVersion(versionHome);
+    }
     const dir = getVersionCommandsDir(agent, version);
     if (!fs.existsSync(dir))
         return [];
@@ -270,6 +287,9 @@ function versionCommandMatches(agent, version, commandName) {
     if (shouldInstallCommandAsSkill(agent, version)) {
         return commandSkillMatches(agentDir, commandName, sourcePath);
     }
+    if (agent === 'goose') {
+        return gooseCommandMatches(versionHome, commandName, sourcePath);
+    }
     const agentConfig = AGENTS[agent];
     const ext = agentConfig.format === 'toml' ? '.toml' : '.md';
     const installedPath = path.join(getVersionCommandsDir(agent, version), `${commandName}${ext}`);
@@ -357,6 +377,11 @@ export function installCommandToVersion(agent, version, commandName, method = 'c
             ...getEnabledExtraRepos().map((repo) => path.join(repo.dir, 'skills')),
         ]);
     }
+    // Goose: a slash command is a recipe YAML registered in config.yaml, not a
+    // native command file. Write the recipe + slash_commands entry.
+    if (agent === 'goose') {
+        return installGooseCommandToVersion(versionHome, commandName, sourcePath);
+    }
     const agentConfig = AGENTS[agent];
     const commandsDir = getVersionCommandsDir(agent, version);
     fs.mkdirSync(commandsDir, { recursive: true });
@@ -392,6 +417,10 @@ export function removeCommandFromVersion(agent, version, commandName) {
     if (shouldInstallCommandAsSkill(agent, version)) {
         return removeCommandSkillFromVersion(agentDir, commandName);
     }
+    if (agent === 'goose') {
+        const trashDir = path.join(getTrashCommandsDir(), agent, version, commandName);
+        return removeGooseCommandFromVersion(versionHome, commandName, trashDir);
+    }
     const ext = AGENTS[agent].format === 'toml' ? '.toml' : '.md';
     const targetPath = path.join(getVersionCommandsDir(agent, version), `${commandName}${ext}`);
     if (!fs.existsSync(targetPath) && !fs.lstatSync(targetPath, { throwIfNoEntry: false })) {

package/dist/lib/convert.d.ts

@@ -16,5 +16,16 @@ export declare function parseMarkdownFrontmatter(content: string): {
 };
 /** Convert a Markdown command file to Gemini's TOML format, translating $ARGUMENTS to {{args}}. */
 export declare function markdownToToml(skillName: string, markdown: string): string;
+/**
+ * Convert a Markdown command file to a Goose recipe YAML object.
+ *
+ * Goose has no native slash-command file format — a slash command is a recipe
+ * (registered in `config.yaml` under `slash_commands`). The recipe schema matches
+ * the one agents-cli already emits for Goose workflow/subagent recipes:
+ * `version`, `title`, `description`, `instructions`, `prompt`. The Markdown body
+ * (with `$ARGUMENTS` preserved) becomes both `instructions` and `prompt`.
+ * Returns a plain object so the caller can `yaml.stringify` it.
+ */
+export declare function markdownToGooseRecipe(commandName: string, markdown: string): Record<string, unknown>;
 /** Convert a Gemini TOML command file back to Markdown format, translating {{args}} to $ARGUMENTS. */
 export declare function tomlToMarkdown(toml: string): string;

package/dist/lib/convert.js

@@ -40,6 +40,28 @@ export function markdownToToml(skillName, markdown) {
     ];
     return lines.join('\n');
 }
+/**
+ * Convert a Markdown command file to a Goose recipe YAML object.
+ *
+ * Goose has no native slash-command file format — a slash command is a recipe
+ * (registered in `config.yaml` under `slash_commands`). The recipe schema matches
+ * the one agents-cli already emits for Goose workflow/subagent recipes:
+ * `version`, `title`, `description`, `instructions`, `prompt`. The Markdown body
+ * (with `$ARGUMENTS` preserved) becomes both `instructions` and `prompt`.
+ * Returns a plain object so the caller can `yaml.stringify` it.
+ */
+export function markdownToGooseRecipe(commandName, markdown) {
+    const { frontmatter, body } = parseMarkdownFrontmatter(markdown);
+    const description = frontmatter.description || `Run ${commandName} command`;
+    const prompt = body.trim() || description;
+    return {
+        version: '1.0.0',
+        title: commandName,
+        description,
+        instructions: prompt,
+        prompt,
+    };
+}
 /** Convert a Gemini TOML command file back to Markdown format, translating {{args}} to $ARGUMENTS. */
 export function tomlToMarkdown(toml) {
     const nameMatch = toml.match(/name\s*=\s*"([^"]+)"/);

package/dist/lib/doctor-diff.js

@@ -30,6 +30,7 @@ import { markdownToToml } from './convert.js';
 import { resolveImports, supportsRulesImports } from './rules/compile.js';
 import { listCommandsInVersionHome, getVersionCommandsDir } from './commands.js';
 import { shouldInstallCommandAsSkill, commandSkillMatches, commandSkillName } from './command-skills.js';
+import { gooseCommandMatches, gooseCommandsDir } from './goose-commands.js';
 import { supports } from './capabilities.js';
 import { listSkillsInVersionHome, getVersionSkillsDir } from './skills.js';
 import { listHooksInVersionHome, listHookEntriesFromDir } from './hooks.js';
@@ -141,6 +142,19 @@ function diffCommands(agent, version, cwd, excludeProject = false) {
             });
             continue;
         }
+        if (agent === 'goose') {
+            // Compare against the installed Goose recipe YAML + slash_commands registration.
+            const matches = gooseCommandMatches(getVersionHomePath(agent, version), name, src.path);
+            rows.push({
+                kind: 'commands',
+                name,
+                status: matches ? 'ok' : 'diff',
+                source: src.layer,
+                sourcePath: src.path,
+                homePath: path.join(gooseCommandsDir(getVersionHomePath(agent, version)), `${name}.yaml`),
+            });
+            continue;
+        }
         const homePath = path.join(homeDir, `${name}${ext}`);
         const installedContent = readSafe(homePath);
         const sourceContent = readSafe(src.path);
@@ -164,7 +178,9 @@ function diffCommands(agent, version, cwd, excludeProject = false) {
             continue;
         const extraHome = asSkill
             ? path.join(agentDir, 'skills', commandSkillName(name), 'SKILL.md')
-            : path.join(homeDir, `${name}${ext}`);
+            : agent === 'goose'
+                ? path.join(gooseCommandsDir(getVersionHomePath(agent, version)), `${name}.yaml`)
+                : path.join(homeDir, `${name}${ext}`);
         rows.push({ kind: 'commands', name, status: 'extra', homePath: extraHome });
     }
     return rows.sort((a, b) => a.name.localeCompare(b.name));

package/dist/lib/goose-commands.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Goose slash-command install/remove/list/compare.
+ *
+ * Goose has no native slash-command file format — a slash command is a recipe
+ * YAML file registered in `~/.config/goose/config.yaml` under a `slash_commands`
+ * array: `[{ command: "<name>", recipe_path: "<abs path to recipe.yaml>" }]`.
+ * (See goose-docs.ai context-engineering/slash-commands.)
+ *
+ * agents-cli writes each command's recipe to `<versionHome>/.config/goose/commands/
+ * <name>.yaml` — a dir distinct from the workflow recipes dir
+ * (`.config/goose/recipes/`) so the workflow detector never treats a command
+ * recipe as a workflow — and registers/unregisters the `slash_commands` entry in
+ * `config.yaml` via a read-modify-write that preserves every other key
+ * (`mcp_servers`, `extensions`, …). Under agents-cli version isolation HOME is the
+ * version home, so both files live under it and the absolute `recipe_path`
+ * resolves correctly at goose runtime.
+ */
+/** Directory holding Goose slash-command recipe YAML files in a version home. */
+export declare function gooseCommandsDir(versionHome: string): string;
+/** Path to the Goose config.yaml (holds the `slash_commands` registry) in a version home. */
+export declare function gooseCommandConfigPath(versionHome: string): string;
+/**
+ * Install a command into a Goose version home: write its recipe YAML and register
+ * the `slash_commands` entry in config.yaml.
+ */
+export declare function installGooseCommandToVersion(versionHome: string, commandName: string, sourcePath: string): {
+    success: boolean;
+    error?: string;
+};
+/** List Goose command names (recipe files) installed in a version home. */
+export declare function listGooseCommandsInVersion(versionHome: string): string[];
+/** Whether an installed Goose command recipe matches the central Markdown source. */
+export declare function gooseCommandMatches(versionHome: string, commandName: string, sourcePath: string): boolean;
+/**
+ * Remove a Goose command from a version home: soft-delete the recipe to `trashDir`
+ * (when provided) and unregister its `slash_commands` entry.
+ */
+export declare function removeGooseCommandFromVersion(versionHome: string, commandName: string, trashDir?: string): {
+    success: boolean;
+    error?: string;
+};