@phnx-labs/agents-cli 1.20.61 → 1.20.63

package/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 ## Unreleased
 
+## 1.20.63
+
+- **Built-in routines: the daemon now fires routines shipped in the system repo.** Routine discovery (`listJobs`/`readJob`) unions a new system layer — `~/.agents/.system/routines/*.yml` (shipped via `gh:phnx-labs/.agents-system`, which every install pulls at `agents setup`) — under the existing project and user layers. Ordering is project > user > system with first-seen-wins, so a routine shipped as a built-in fires for every install, while a user routine of the same name overrides it and a user copy with `enabled: false` disables it. The daemon (which loads with no `cwd`) sees user + system routines; `writeJob` still only ever writes to the user layer, so built-ins are never mutated in place. This is what lets a routine like `check-updates` ship to all users centrally. Source: `apps/cli/src/lib/state.ts` (`getSystemRoutinesDir`), `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/routines.test.ts`.
+
+- **`--host` / `--device` work across virtually all first-class subcommand groups (RUSH-1691).** Previously only a handful of groups accepted the flags; `agents repos list --host yosemite-s0` (and the same with `--device`) died with commander's raw `unknown option`. Remote routing now covers `repos`/`repo`, status/inspect groups, config/resource groups (`plugins`, `skills`, `hooks`, `sync`, …), `teams`, `routines`, and more via the central `maybeRunOnHost` allowlist. Commands with their own richer host handling (`run`, `sessions`, `feed`, `computer`, `secrets`, `logs`) still fall through to their actions. Groups with no remote semantics reject the flag with a clear message instead of `unknown option`. Self-host targets strip the routing flags before the local command parses so fall-through never trips an unregistered option. Source: `apps/cli/src/lib/hosts/passthrough.ts`, `apps/cli/src/commands/repo.ts`, `apps/cli/docs/{00-concepts,hosts}.md`.
+- **Signed webhook ingress for routines via Tailscale Funnel (RUSH-1456, RUSH-1459, RUSH-1460, RUSH-1461).**
+  Routine triggers now understand both GitHub and Linear event sources, including
+  Linear action/team/label filters. `agents webhook serve --secrets-bundle <name>`
+  exposes signed localhost endpoints at `/hooks/github` and `/hooks/linear` with
+  raw-body HMAC verification, Linear timestamp checks, duplicate delivery
+  suppression, and rate limiting. `agents funnel status/up` wraps the allowed
+  Tailscale Funnel ports through the existing SSH/device path so a webhook
+  receiver can be exposed without hand-written SSH commands. Source:
+  `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/triggers/webhook.ts`,
+  `apps/cli/src/commands/routines.ts`, `apps/cli/src/commands/webhook.ts`,
+  `apps/cli/src/commands/funnel.ts`, `apps/cli/src/lib/funnel.ts`.
+- **Guided session-sync provisioning in `agents setup` and `agents sessions sync --setup` (RUSH-1468).** Joining a machine to the cross-machine session-sync fabric no longer requires hand-running four `agents secrets add r2.backups …` commands. A new interactive step mints the `r2.backups` bundle (R2 account/bucket/access-key/secret + a generated `R2_SYNC_ENC_KEY`), probes read+write connectivity with a throwaway object, and opts the machine into the `session-sync` beta on success. The first machine mints and prints the shared encryption key; every other machine pastes it so the whole fabric shares one key (an existing key is reused, never overwritten — overwriting would orphan peers' encrypted transcripts). `agents setup` offers it opt-in (default No, never blocks setup); `agents sessions sync --setup` runs it explicitly and can re-show the shared key. Source: `apps/cli/src/lib/session/sync/provision.ts`, `apps/cli/src/lib/session/sync/provision.test.ts`, `apps/cli/src/commands/sync-provision.ts`, `apps/cli/src/commands/setup.ts`, `apps/cli/src/commands/sessions-sync.ts`.
+- **`agents fleet` alias + fleet-wide rollout (RUSH-1632).** `fleet` is an alias
+  for `devices`. New subcommands `update [version]` and `run <cmd…>` roll out
+  across every online device with a per-device result table. Source:
+  `apps/cli/src/commands/ssh.ts`, `apps/cli/src/lib/devices/fleet.ts`.
+- **`agents hosts stop <id>` (alias `kill`) terminates a detached host run from the origin machine (RUSH-1360).**
+  Sends SIGTERM to the remote process group, writes exit `143` only when a live
+  group was signaled (or no `.exit` existed), and keeps the remote log for
+  `agents hosts logs <id>`. Source: `apps/cli/src/lib/hosts/dispatch.ts`,
+  `apps/cli/src/commands/hosts.ts`.
+- **Fix: mailbox GC actually archives expired messages on live boxes (RUSH-1611).**
+  The live-box branch of `gcMailbox` only incremented `messagesDroppedExpired`
+  without moving the file to `consumed/`, so `agents feed --dispatch` could report
+  drops while leaving expired messages in `inbox/`/`processing/`. GC now reuses
+  `sweepExpired` (the same path as drain/peek). Source: `apps/cli/src/lib/mailbox-gc.ts`.
+- **Fix: Antigravity sign-in detection on Linux when the OAuth grant lives in Secret Service (RUSH-1329).** `agy` uses the Go keyring library, which prefers libsecret (gnome-keyring) over the file fallback whenever a Secret Service daemon is running — so `~/.gemini/antigravity-cli/antigravity-oauth-token` may be absent even when the user is signed in. After the file check, `getAccountInfo` now probes `secret-tool lookup service gemini username antigravity` (exit 0 = present; stdout discarded), mirroring the macOS `security find-generic-password` probe from #506. Missing `secret-tool`, locked collections, and timeouts all read as signed out. Opt out with `AGENTS_NO_KEYCHAIN_PROBE=1`. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/agents.test.ts`.
+- **Client-side (zero-knowledge) encryption of session transcripts before R2 upload (RUSH-1463).** Transcripts carry secrets, tokens, and absolute file paths; R2's server-side encryption uses Cloudflare's key, so anyone with bucket-read access (or Cloudflare) could read them as plaintext NDJSON. `agents sessions sync` now seals each transcript BODY client-side with AES-256-GCM before upload and decrypts on pull, so R2 only ever stores ciphertext. The 32-byte key is a new `R2_SYNC_ENC_KEY` in the `r2.backups` bundle — shared across the sync fabric (every machine derives the identical key) and deliberately separate from the R2 access key so rotating the token never orphans encrypted objects. CRDT identity stays over plaintext (the manifest hash is cleartext; pull decrypts before the G-Set union), so cross-machine merge is unaffected. Pull transparently reads legacy plaintext objects (migration-safe); a push with no key configured still uploads but emits a loud per-cycle warning. A new `R2_ENDPOINT` override points sync at any S3-compatible store (MinIO/other providers), which is also how the flow is verified end-to-end without live R2. Source: `apps/cli/src/lib/session/sync/transcript-crypto.ts`, `apps/cli/src/lib/session/sync/transcript-crypto.test.ts`, `apps/cli/src/lib/session/sync/sync.ts`, `apps/cli/src/lib/session/sync/config.ts`, `apps/cli/src/commands/sessions-sync.ts`, `apps/cli/src/lib/daemon.ts`.
+- **Extend session sync to Droid, Grok, Kimi, and OpenCode (RUSH-1467).** `agents sessions sync` now includes these four agents in its upload/download matrix. `SyncAgentSpec` gains an optional `ext` field so agents with non-`.jsonl` transcript files (e.g., Kimi `state.json`) are walked correctly. Droid `.jsonl` rollouts, Grok `events.jsonl` streams, and Kimi `state.json` metadata files round-trip through the R2 mirror; OpenCode is slotted in `SYNC_AGENTS` but remains a placeholder because its sessions live in a SQLite DB and still require an SQLite-to-JSONL export step. Source: `apps/cli/src/lib/session/sync/agents.ts`, `apps/cli/src/lib/session/sync/agents.test.ts`, `apps/cli/src/commands/sessions-sync.ts`.
+- **`agents repos` is canonical (`repo` alias); push/pull echo the resolved target; push no longer no-ops when clean-but-ahead; pull rebases on diverge (RUSH-1454).** Help now prints `Usage: agents repos …`. Push/pull report `user (~/.agents → origin/main): …` instead of the bare alias. `commitAndPush` still `git push`es when the tree is clean but local is ahead of origin (previously returned success without pushing). `pullRepo` uses `git pull --rebase` so divergent branches reconcile instead of failing with a raw git error. Source: `apps/cli/src/commands/repo.ts`, `apps/cli/src/lib/git.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+- **`agents run --host <name> --copy-creds` provisions runtime credentials on a persistent host (RUSH-1608).**
+  Reuses the `--lease` credential path (`resolveClaudeCredentialsBlob` + the
+  `~/.claude/.credentials.json` bootstrap) but makes copying tokens to a
+  persistent host strictly opt-in per run. The user picks runtimes, sees a
+  consent prompt naming accounts and the Claude OAuth token, and the files are
+  shredded after the run. Source: `apps/cli/src/commands/exec.ts`,
+  `apps/cli/src/lib/hosts/dispatch.ts`, `apps/cli/src/lib/hosts/credentials.ts`,
+  `apps/cli/src/lib/hosts/credentials.test.ts`.
+
+## 1.20.62
+
+- **Browser downloads land in a known per-profile dir; profile data is consolidated.** A browser profile is now one self-contained tree under `~/.agents/.cache/browser/<profile>/`: `chrome-data/`, `downloads/`, and `sessions/<task>/` (screenshots, PDFs, recordings). Previously downloads had no configured destination — the CLI only set the download dir when the agent explicitly ran `browser download --path`, so absent that call a download fell to Chromium's own default (for an attached user browser like comet, wherever *that* browser was last configured), which is how downloads escaped into random locations. The service now sets the profile's `downloads/` dir browser-global at connect time (both fresh launch and every attach path), so downloads always land somewhere agents-cli controls; `browser download --path` becomes an optional override (omit it to use the profile default) and reports the resolved path. Screenshots/PDFs/recordings moved from the old GLOBAL `browser/sessions/<task>/` root to the per-profile `browser/<profile>/sessions/<task>/`, with a one-shot migration that folds existing captures into the owning profile (attributed via each profile's `tasks.json`; unattributable captures go to a `_legacy` bucket). New `agents browser sessions [--profile <name>] [--open latest|<file>] [--json]` lists a profile's captures + downloads, aliased as `agents sessions --browser`. Source: `apps/cli/src/lib/browser/{profiles,service,ipc,sessions-list}.ts`, `apps/cli/src/lib/migrate.ts`, `apps/cli/src/commands/{browser,sessions}.ts`.
+- **Wire Goose commands support (RUSH-1572).** `agents` now syncs slash commands to Goose as recipe YAML files under `~/.config/goose/commands/<name>.yaml`, each registered in `~/.config/goose/config.yaml` under a `slash_commands: [{ command, recipe_path }]` array (Goose has no native slash-command file format — a slash command IS a recipe). The command recipes live in a dir distinct from the workflow recipes dir (`~/.config/goose/recipes/`) so the workflow detector never treats a command recipe as a workflow. Registration is a read-modify-write that preserves every other `config.yaml` key (`mcp_servers`, `extensions`, …) and other `slash_commands` entries, and removal soft-deletes the recipe + unregisters the entry. Flip Goose's `commands` capability and add `goose` branches to install/list/match/remove, the staleness commands writer, and doctor-diff, backed by a new `goose-commands.ts` module + a `markdownToGooseRecipe` converter. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/goose-commands.ts`, `apps/cli/src/lib/commands.ts`, `apps/cli/src/lib/convert.ts`, `apps/cli/src/lib/staleness/writers/commands.ts`, `apps/cli/src/lib/doctor-diff.ts`.
+- **Fix: Hermes plugin sync no longer disables a plugin the user explicitly enabled.** The plugin install path (RUSH-1688) unconditionally forced `plugins.enabled` to the exec-surface trust verdict on every sync. An ordinary un-flagged background re-sync computes `enable=false` for a plugin with hooks/tools, so it stripped that plugin from the `~/.hermes/config.yaml` allowlist — clobbering a plugin the user deliberately enabled with `--allow-exec-surfaces`. The install path now enables only when trusted and never down-toggles (matching the marketplace flow's add-if-trusted semantics); removal still unregisters explicitly. Source: `apps/cli/src/lib/plugins.ts`.
+- **Wire Goose subagents support (RUSH-1573).** `agents` now syncs subagents to Goose as recipe YAML files under `~/.config/goose/agents/<name>.yaml` — Goose has no dedicated subagent format, so a named subagent IS a recipe (goose auto-discovers `~/.config/goose/agents/` and delegates to them by name in autonomous mode). `transformSubagentForGoose` emits the same recipe schema agents-cli already uses for Goose workflow recipes (`version`/`title`/`description`/`instructions`/`prompt`, plus optional `settings.goose_model`). Flip Goose's `subagents` capability and wire the install/remove/list/orphan/version-remove branches plus the staleness subagents writer and detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/staleness/{writers,detectors}/subagents.ts`.
+
+- **Wire ForgeCode commands and subagents support (RUSH-1689, RUSH-1690).** `agents` now syncs slash commands to ForgeCode as Markdown files under `~/.forge/commands/<name>.md` (previously ForgeCode had `commands: false` and received commands only as skills), and named subagents as Markdown-with-frontmatter definitions under `~/.forge/agents/<name>.md` (same `color`-less shape as Droid/Copilot/Cursor, so `transformSubagentForForge` aliases `transformSubagentForDroid`). Flip ForgeCode's `commands`/`subagents` capabilities, set `commandsDir`, add the subagent transform plus install/remove/list/orphan/version-remove branches, and register the subagents writer + detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/staleness/{writers,detectors}/subagents.ts`.
+- **Wire allowlist (permissions) support for OpenClaw (RUSH-1570).** OpenClaw gates at TOOL granularity only, so permission sync maps just **blanket** (whole-tool) rules into `~/.openclaw/openclaw.json` `tools.alsoAllow` (allow) / `tools.deny` (deny): `bash → exec`, `read → read`, `write`/`edit → write`, `webfetch → web_fetch`, `websearch → web_search`. Sub-command/path/domain rules (`Bash(git:*)`, `Write(secrets/**)`, `WebFetch(domain:x)`) have no tool-level equivalent and are skipped — coarse-mapping a specific deny to a whole tool would wrongly gate every use of that tool. The absolute `tools.allow` list is never touched, and all other keys (`mcp`, `exec`, `agents`, …) are preserved on read-modify-write. Flip OpenClaw's `allowlist: true`, add `convertToOpenClawFormat` + the `openclaw` branch in `applyPermissionsToVersion`, register the config path and staleness detector. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/permissions.ts`, `apps/cli/src/lib/resources/permissions.ts`, `apps/cli/src/lib/staleness/detectors/permissions.ts`.
+- **Wire subagents support for Cursor CLI (RUSH-1388).** cursor-agent loads custom subagents as Markdown with YAML frontmatter under `~/.cursor/agents/*.md` (project-scoped `.cursor/agents/` also supported natively), same shape as Claude/Droid/Copilot minus the `color` field, gated at `>= 2026.1.22` (cursor-agent's CalVer build tag for Cursor 2.4). Flip Cursor's `subagents`, add `transformSubagentForCursor` (alias of `transformSubagentForDroid`), and wire the install/remove, list, orphan-detection, writer, and detector paths. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/subagents.ts`, `apps/cli/src/lib/staleness/{writers,detectors}/subagents.ts`.
+- **Wire hooks support for Hermes (RUSH-1687).** `agents` now registers central hooks into Hermes Agent's `~/.hermes/config.yaml` under a `hooks:` block (YAML, ≥ 0.11.0). The registrar read-modify-writes that shared config so sibling keys like `mcp_servers` survive, maps canonical events to Hermes' snake_case lifecycle names (`SessionStart→on_session_start`, `SessionEnd→on_session_end`, `PreToolUse→pre_tool_call`, `PostToolUse→post_tool_call`, `SubagentStop→subagent_stop`, `UserPromptSubmit→pre_llm_call`, `Stop→on_session_finalize`), and clamps each hook's timeout to 300s (default 60s). Managed entries are re-synced idempotently while user-authored hooks are preserved. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/hooks.ts`, `apps/cli/src/lib/staleness/writers/hooks.ts`.
+
 ## 1.20.61
 
 - **Detect OpenCode sign-in state so `agents view` stops mislabeling a logged-in install as "not signed in."** `getAccountInfo` had no `opencode` case, so it fell through to `signedIn: false` and every row printed "(not signed in — run opencode to log in)" even with a live login. It now reads OpenCode's `auth.json` (`$XDG_DATA_HOME/opencode/auth.json`, defaulting to `~/.local/share/opencode/auth.json` on every platform — `xdg-basedir` does not special-case macOS), validates each provider entry against its `oauth`/`api`/`wellknown` credential shape, and reports the account as signed in with the non-secret provider ids surfaced as the account label (e.g. `id:muse-spark`). Credential secrets (`access`/`refresh`/`key`/`token`) are only inspected for presence — never read into any display or JSON output. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/agents.test.ts`.
@@ -16,6 +72,7 @@
 - **Wire Gemini permissions/allowlist support (RUSH-1567).** Gemini permission groups now sync Bash allow/deny rules into `.gemini/settings.json` as `tools.core` / `tools.exclude` entries with per-command `ShellTool(...)` patterns; non-Bash canonical permissions remain unsupported by Gemini's native tool grammar and are skipped. Flip `allowlist: true`, register the permission writer/detector through the capability table, and replace the dormant legacy `tools.allowed` serializer. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/permissions.ts`, `apps/cli/src/lib/resources/permissions.ts`, `apps/cli/src/lib/staleness/detectors/permissions.ts`.
 - **Fix: `agents run <agent>@<version> --host <host>` now forwards the version pin and most run flags to the remote host.** Previously the `--host` branch stripped `@version` and ignored `--strategy`, `--effort`, `--add-dir`, `--json`, `--verbose`, `--timeout`, `--yes`, and `--acp`, so the remote host applied its own defaults. The local CLI now parses `agent@version` verbatim, normalizes `--strategy`/`--balanced`, makes `--add-dir` paths remote-portable, and forwards all of these flags to the remote `agents run` invocation. `--add-dir` portability uses the same `~`/`$HOME` re-rooting that `--cwd` already uses, so a Linux remote resolves home paths against its own `/home/<user>`. Source: `apps/cli/src/lib/hosts/dispatch.ts`, `apps/cli/src/commands/exec.ts`, `apps/cli/src/lib/hosts/dispatch.test.ts`.
 - **Fix: routine edits no longer rewrite the whole YAML file, so `~/.agents` stays clean and `agents repo pull` can sync routines across the fleet.** `writeJob` previously re-emitted the entire document via `yaml.stringify` on every mutation (pause/resume, `routines devices --set`, add), restyling untouched scalars — unquoting `schedule`, re-wrapping the folded `prompt` block — which left the git-backed user repo perpetually dirty. That made cross-device `agents repo pull` refuse ("uncommitted changes"), so a `devices:` pin set on one machine never reached the others and `Devices: all` routines kept firing on every box. A new `serializeJob` edits only the changed keys via the YAML Document API, preserving byte-for-byte formatting of untouched nodes; new/unparseable/non-mapping files fall back to canonical stringify. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/__tests__/routines.serialize.test.ts`.
+- **`agents sessions --active --json` now carries live plan progress (RUSH-1380).** The state engine parses the latest `TodoWrite` off the transcript tail into `ActiveSession.todos` (`{ items: [{ content, status, activeForm? }], done, total, activeForm }`), and the live preview verb reads `Plan N/M: <current step>` instead of a bare "TodoWrite". This lets consumers (the Factory Floor) show an N/M pill + checklist for every session — including remote / device-dispatched agents that have no local tool-call stream. Source: `apps/cli/src/lib/session/state.ts` (`extractTodoProgress`, `inferActivity`), `apps/cli/src/lib/session/active.ts` (`ActiveSession.todos`, `applyState`), `apps/cli/src/lib/session/parse.ts` (`summarizeToolUse`).
 
 ## 1.20.59
 

package/README.md

@@ -347,6 +347,9 @@ agents hosts check gpu-box              # reachable? which agents-cli version?
 # Run there instead of locally
 agents run claude --host gpu-box "profile this build"   # headless: follows live by default
 agents run claude --host gpu-box                         # no prompt → interactive TTY over SSH (tmux-backed)
+agents run claude --host gpu-box --copy-creds "fix auth" # copy local runtime creds + Claude token, shred after
+agents hosts ps                         # list dispatched runs + terminal status
+agents hosts stop <id>                  # terminate a hung/detached run (alias: kill)
 agents logs --host gpu-box              # pick a dispatched run — concise summary by default
 agents logs <id> --full                 # the full raw transcript / stdout (token-heavy)
 agents logs <id> -f                     # re-attach to a running one and follow
@@ -682,6 +685,13 @@ agents routines add nightly-drain --schedule "0 3 * * *" --agent claude \
 
 agents routines devices nightly-drain --set yosemite-s0,mac-mini  # update allowlist
 agents routines list --host yosemite-s0                            # query another device
+
+# Signed webhook trigger: Linear issue labeled "agent" fires a routine
+agents routines add agent-labeled-issue --on linear:Issue --action update \
+  --team-key RUSH --label agent --agent claude \
+  --prompt "Work the Linear issue that was just labeled agent"
+agents webhook serve --secrets-bundle webhooks --port 8787          # /hooks/linear, /hooks/github
+agents funnel up yosemite-s0 --local-port 8787 --port 443           # public HTTPS ingress
 ```
 
 Jobs run sandboxed -- agents only see directories and tools you explicitly allow.

package/dist/commands/browser.js

@@ -8,6 +8,7 @@ import { readAndResolveBundleEnv, bundleExists, readBundle, describeBundle } fro
 import { findBrowserPath, getPortOccupant, isLauncherScript } from '../lib/browser/chrome.js';
 import { listProfileCacheDirs, removeProfileCache, listAllProfileSnapshots, } from '../lib/browser/runtime-state.js';
 import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
+import { runBrowserSessions } from '../lib/browser/sessions-list.js';
 import { discoverBrowserWsUrl, verifyBrowserIdentity } from '../lib/browser/cdp.js';
 import { parseTargetFilter } from '../lib/browser/service.js';
 import { BrowserDaemonNotRunningError, formatBrowserDaemonNotRunningError, sendIPCRequest, } from '../lib/browser/ipc.js';
@@ -1850,10 +1851,10 @@ function registerTaskCommands(browser) {
     // ─── Downloads ───────────────────────────────────────────────────────────────
     browser
         .command('download')
-        .description('Set download directory for a task')
+        .description("Set the download directory for a task (defaults to the profile's downloads dir)")
         .option(TASK_OPTION_FLAG, TASK_OPTION_DESC)
         .option('-t, --tab <tabId>', 'Tab ID (defaults to current)')
-        .requiredOption('-p, --path <dir>', 'Download directory path')
+        .option('-p, --path <dir>', "Download directory path (default: the profile's downloads dir)")
         .action(async (opts) => {
         const task = resolveTaskName(opts);
         const response = await sendIPCRequest({
@@ -1866,7 +1867,16 @@ function registerTaskCommands(browser) {
             console.error(response.error);
             process.exit(1);
         }
-        console.log(`Download path set to ${opts.path}`);
+        console.log(response.downloadPath ? `Download path set to ${response.downloadPath}` : 'Download path set');
+    });
+    browser
+        .command('sessions')
+        .description('List a profile\'s captured screenshots, PDFs, recordings, and downloads')
+        .option('--profile <name>', 'Only this profile (default: all profiles with captures)')
+        .option('--open [selector]', "Open a capture in the OS default app: 'latest' or a filename")
+        .option('--json', 'Emit machine-readable JSON')
+        .action((opts) => {
+        runBrowserSessions({ profile: opts.profile, open: opts.open, json: opts.json });
     });
     // ─── Recording ─────────────────────────────────────────────────────────────
     const record = browser.command('record').description('Record a video of the page');

package/dist/commands/exec.js

@@ -242,6 +242,7 @@ export function registerRunCommand(program) {
         .option('--remote-cwd <dir>', 'Explicit host working directory for --host runs (overrides --cwd; usually --cwd suffices).')
         .option('--no-follow', 'With --host, dispatch detached and return immediately (track via `agents hosts ps/logs`).')
         .option('--any', 'With --host <cap> (a capability tag), pick any matching host instead of erroring when several match.')
+        .option('--copy-creds', 'With --host, copy the picked runtime credentials (and Claude OAuth token) to the host, then shred them after the run. Opt-in per run.')
         .option('--lease [backend]', 'Invent a disposable cloud box for this run and tear it down after (via crabbox). Optional backend selects the cloud (hetzner/aws/do). Unlike --host, no machine is registered.')
         .option('--keep-box', 'With --lease, keep the box after the run instead of stopping it.');
     // `--on` and `--computer` are hidden aliases of `--host` — same behavior.
@@ -536,6 +537,44 @@ export function registerRunCommand(program) {
                 // which can't run over a detached remote dispatch — only forward a
                 // concrete id.
                 const resumeId = typeof options.resume === 'string' ? options.resume : undefined;
+                // --copy-creds: provision runtime credentials (and the Claude OAuth token)
+                // on the remote host before the run, then shred them after. Unlike
+                // --lease, a host is persistent, so this is strictly opt-in per run.
+                let hostCopyCreds;
+                if (options.copyCreds) {
+                    const { detectSignedInRuntimes, pickRuntimes, resolveClaudeCredentialsBlob } = await import('../lib/crabbox/runtimes.js');
+                    const { confirm } = await import('@inquirer/prompts');
+                    const detected = await detectSignedInRuntimes();
+                    const runtimes = await pickRuntimes(detected);
+                    if (runtimes.length === 0) {
+                        console.error(chalk.yellow('No runtimes selected. Sign into one locally then retry, or omit --copy-creds.'));
+                        process.exit(1);
+                    }
+                    const names = runtimes
+                        .map((id) => {
+                        const d = detected.find((x) => x.id === id);
+                        return `${d?.label ?? id}${d?.email ? ` (${d.email})` : ''}`;
+                    })
+                        .join(', ');
+                    const whatShips = runtimes.includes('claude') ? 'credentials + Claude OAuth token' : 'credentials';
+                    const ok = await confirm({
+                        message: `Copy ${whatShips} for ${names} to host "${host.name}", run there, then shred them after?`,
+                        default: false,
+                    });
+                    if (!ok) {
+                        console.error(chalk.yellow('Aborted — no credentials pushed, no run dispatched.'));
+                        process.exit(1);
+                    }
+                    let claudeCredentialsJson = null;
+                    if (runtimes.includes('claude')) {
+                        const claudeEmail = detected.find((d) => d.id === 'claude')?.email ?? null;
+                        claudeCredentialsJson = await resolveClaudeCredentialsBlob({ preferEmail: claudeEmail });
+                        if (!claudeCredentialsJson) {
+                            console.error(chalk.yellow('Warning: could not read the local Claude OAuth token — the host may boot Claude "Not logged in".'));
+                        }
+                    }
+                    hostCopyCreds = { runtimes, detected, claudeCredentialsJson };
+                }
                 // Decide whether this host run is interactive. No prompt always means
                 // interactive (matching local resolveInteractive); --interactive forces
                 // interactive even when a prompt is provided; --headless forces headless
@@ -587,6 +626,7 @@ export function registerRunCommand(program) {
                         passthroughArgs,
                         raw: options.raw || options.tmux === false || options.disableTmux === true,
                         forceInteractive: options.interactive,
+                        copyCreds: hostCopyCreds,
                     });
                     process.exit(exitCode);
                 }
@@ -616,6 +656,7 @@ export function registerRunCommand(program) {
                     name: options.name,
                     resume: resumeId,
                     follow: options.follow !== false,
+                    copyCreds: hostCopyCreds,
                 });
                 // Register the dispatched run in the LOCAL session index so it shows
                 // up in `agents sessions` and resolves by id/name, even though its
@@ -1081,8 +1122,17 @@ export function registerRunCommand(program) {
             if (nativeResume(agent)) {
                 resumeNative = true;
                 resumeSessionId = session.id;
+                // Native `--resume` (claude/codex) resolves the transcript relative to the
+                // working directory (projects/<cwd-hash>/). The session may have been started
+                // in a different directory than we're standing in now — most importantly when a
+                // routine daemon fires `agents run --resume` from its own cwd. Spawn from the
+                // session's ORIGIN cwd so the resume actually finds it; otherwise the agent
+                // exits "No conversation found with session ID". Honor an explicit --cwd only if
+                // the caller passed one (they're overriding on purpose).
+                if (!options.cwd && session.cwd)
+                    options.cwd = session.cwd;
                 if (!options.quiet)
-                    process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''}\n`));
+                    process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''}${!options.cwd || options.cwd === session.cwd ? ` in ${session.cwd ?? cwd}` : ''}\n`));
             }
             else {
                 // Tier-2: launch fresh with a /continue <id> first message; the agent

package/dist/commands/funnel.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `agents funnel` — thin Tailscale Funnel wrapper for webhook ingress nodes.
+ */
+import type { Command } from 'commander';
+export declare function registerFunnelCommand(program: Command): void;

package/dist/commands/funnel.js

@@ -0,0 +1,62 @@
+import chalk from 'chalk';
+import { buildFunnelStatusCommand, buildFunnelUpCommand, parseFunnelPort } from '../lib/funnel.js';
+import { resolveHost } from '../lib/hosts/registry.js';
+import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
+import { sshTargetFor } from '../lib/hosts/types.js';
+import { sshExec } from '../lib/ssh-exec.js';
+async function resolveIngressHost(name) {
+    const host = await resolveHost(name);
+    if (!host)
+        throw new Error(`Unknown host "${name}". Enroll it with agents hosts add, or sync devices first.`);
+    const os = host.os ?? resolveRemoteOsSync(host.name);
+    if (os === 'windows') {
+        throw new Error('Tailscale Funnel requires a host with the Tailscale CLI; Windows cannot host this ingress path.');
+    }
+    return host;
+}
+async function runOnHost(hostName, command) {
+    const host = await resolveIngressHost(hostName);
+    const target = sshTargetFor(host);
+    const result = sshExec(target, command, { timeoutMs: 30_000, multiplex: true });
+    if (result.code !== 0) {
+        throw new Error((result.stderr || result.stdout).trim() || `ssh exited ${result.code ?? 'without a code'}`);
+    }
+    const out = result.stdout.trim();
+    if (out)
+        console.log(out);
+}
+export function registerFunnelCommand(program) {
+    const funnel = program
+        .command('funnel')
+        .description('Manage Tailscale Funnel exposure for a fleet webhook receiver.');
+    funnel
+        .command('status <host>')
+        .description('Show Tailscale Funnel status on a fleet host.')
+        .action(async (host) => {
+        try {
+            await runOnHost(host, buildFunnelStatusCommand());
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    funnel
+        .command('up <host>')
+        .description('Expose a localhost webhook receiver through Tailscale Funnel.')
+        .requiredOption('--local-port <n>', 'Local receiver port on the remote host')
+        .option('--port <n>', 'Public Funnel port: 443, 8443, or 10000', '443')
+        .action(async (host, opts) => {
+        try {
+            const publicPort = parseFunnelPort(opts.port ?? '443');
+            const localPort = Number.parseInt(opts.localPort, 10);
+            const command = buildFunnelUpCommand(publicPort, localPort);
+            await runOnHost(host, command);
+            console.log(chalk.green(`Funnel enabled on ${host}: public :${publicPort} → localhost:${localPort}`));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+}

package/dist/commands/hosts.js

@@ -18,6 +18,7 @@ import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
 import { listTasks, loadTask, findTaskByName, findTaskBySessionId } from '../lib/hosts/tasks.js';
 import { reconcileRunningTasks } from '../lib/hosts/reconcile.js';
 import { showHostTaskLog } from '../lib/hosts/logs.js';
+import { stopDispatchedTask } from '../lib/hosts/dispatch.js';
 /** Parse `user@host` or `host` into its pieces. */
 function parseTarget(target) {
     const at = target.indexOf('@');
@@ -201,6 +202,42 @@ async function doLogs(ref, follow, full) {
     if (res.exitCode !== undefined)
         process.exitCode = res.exitCode;
 }
+/** Resolve a host-task ref (id, --name handle, or session id) or null. */
+function resolveTaskRef(ref) {
+    return loadTask(ref) ?? findTaskByName(ref) ?? findTaskBySessionId(ref);
+}
+async function doStop(ref) {
+    // Heal first so we don't try to kill a process that already exited.
+    const current = resolveTaskRef(ref);
+    if (!current) {
+        console.log(chalk.red(`Unknown task "${ref}".`));
+        process.exitCode = 1;
+        return;
+    }
+    const task = reconcileRunningTasks([current])[0] ?? current;
+    if (task.status !== 'running') {
+        console.log(chalk.gray(`Task ${task.id} is already ${task.status}` + (task.exitCode !== undefined ? ` (exit ${task.exitCode})` : '') + '.'));
+        return;
+    }
+    try {
+        const stopped = stopDispatchedTask(task);
+        const statusColor = stopped.status === 'completed' ? chalk.green : chalk.yellow;
+        const exitNote = stopped.exitCode === 143
+            ? 'exit 143 / SIGTERM'
+            : stopped.exitCode !== undefined
+                ? `exit ${stopped.exitCode}`
+                : stopped.status;
+        console.log(chalk.green(`Stopped ${stopped.id}`) +
+            chalk.gray(` on ${stopped.host}`) +
+            '  ' + statusColor(stopped.status) +
+            chalk.gray(` (${exitNote})`));
+        console.log(chalk.gray(`Logs: agents hosts logs ${stopped.id}`));
+    }
+    catch (err) {
+        console.error(chalk.red(err?.message ?? err));
+        process.exitCode = 1;
+    }
+}
 /** Register the `agents hosts` command tree. */
 export function registerHostsCommand(program) {
     const hosts = program
@@ -239,4 +276,9 @@ export function registerHostsCommand(program) {
         .option('-f, --follow', 'Follow live output')
         .option('-m, --full', 'Show the full raw combined-stdout log instead of the concise summary')
         .action((id, opts) => doLogs(id, !!opts.follow, !!opts.full));
+    hosts
+        .command('stop <id>')
+        .alias('kill')
+        .description('Terminate a running host task from this machine (SIGTERM process group; marks failed/143).')
+        .action((id) => doStop(id));
 }

package/dist/commands/repo.d.ts

@@ -1,9 +1,9 @@
 /**
  * Extra DotAgent repo management.
  *
- * Registers `agents repo add|init|list|remove|enable|disable` which manage
- * additional DotAgent repos alongside the primary ~/.agents/.system/ repo so
- * private, work, or team skills can ship separately from public ones.
+ * Registers `agents repos add|init|list|remove|enable|disable` (`repo` alias)
+ * which manage additional DotAgent repos alongside the primary ~/.agents/.system/
+ * repo so private, work, or team skills can ship separately from public ones.
  *
  * Extras are user-level config: managed clones live at ~/.agents-<alias>/ as
  * peer dirs to ~/.agents/, and user-owned repos may live anywhere. All extras
@@ -73,6 +73,6 @@ export declare function formatResourceDelta(entries: {
 export declare function repoSlug(url: string): string;
 /** Pack colored phrases into `, `-joined lines no wider than `width`. */
 export declare function wrapPhrases(parts: string[], width: number): string[];
-/** Register the `agents repo` command tree. */
+/** Register the `agents repos` command tree (`repo` is a convenience alias). */
 export declare function registerRepoCommands(program: Command): void;
 export {};

package/dist/commands/repo.js

@@ -9,6 +9,7 @@ import { confirm, input } from '@inquirer/prompts';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { setHelpSections } from '../lib/help.js';
 import { itemPicker } from '../lib/picker.js';
+import { addHostOption } from '../lib/hosts/option.js';
 import { inspectRepo, resolveRepoTarget, } from './inspect.js';
 const HOME = os.homedir();
 /**
@@ -27,7 +28,7 @@ function resolveRepoPath(target) {
     return path.join(HOME, `.agents-${trimmed}`);
 }
 import { applyExtraAliasToVersions, ensureAgentsDir, getExtraRepoDir, getSystemAgentsDir, getUserAgentsDir, readMeta, resolveExtraRepoDir, updateMeta, } from '../lib/state.js';
-import { parseSource, pullRepo, commitAndPush, isGitRepo, isSystemRepoOrigin, adoptRepo } from '../lib/git.js';
+import { parseSource, pullRepo, commitAndPush, isGitRepo, isSystemRepoOrigin, adoptRepo, displayHomePath, } from '../lib/git.js';
 import { DEFAULT_SYSTEM_REPO } from '../lib/types.js';
 import { ALL_AGENT_IDS, isAgentName, resolveAgentName } from '../lib/agents.js';
 import { refresh } from '../lib/refresh.js';
@@ -465,34 +466,44 @@ async function listRepos(alias, opts = {}) {
     }
     console.log('');
 }
-/** Register the `agents repo` command tree. */
+/**
+ * Label for push/pull spinners and results: alias + resolved dir + tracking ref.
+ * e.g. `user (~/.agents → origin/main)`.
+ */
+function formatRepoTarget(alias, dir, branch) {
+    const ref = branch ? `origin/${branch}` : 'origin';
+    return `${alias} (${displayHomePath(dir)} → ${ref})`;
+}
+/** Register the `agents repos` command tree (`repo` is a convenience alias). */
 export function registerRepoCommands(program) {
-    const repoCmd = program
-        .command('repo')
-        .alias('repos')
-        .description('Manage extra DotAgent repos alongside ~/.agents/ (for private or team skills).');
+    // addHostOption on the group so --help documents --host/--device; remote
+    // routing is handled pre-parse by maybeRunOnHost (passthrough.ts).
+    const repoCmd = addHostOption(program
+        .command('repos')
+        .alias('repo')
+        .description('Manage extra DotAgent repos alongside ~/.agents/ (for private or team skills).'));
     setHelpSections(repoCmd, {
         examples: `
       # Scaffold an editable repo (default: ~/.agents/)
-      agents repo init
+      agents repos init
 
       # Scaffold a named repo at ~/.agents-work/
-      agents repo init work
+      agents repos init work
 
       # Register an existing repo (clones to ~/.agents-<alias>/)
-      agents repo add gh:yourname/.agents-work
+      agents repos add gh:yourname/.agents-work
 
       # Register with a custom alias
-      agents repo add git@github.com:acme/team-skills.git --as acme
+      agents repos add git@github.com:acme/team-skills.git --as acme
 
       # See what's registered
-      agents repo list
+      agents repos list
 
       # View one repo's contents (git state + resource counts); omit the name for a picker
       agents repos view system
 
       # Temporarily disable without deleting
-      agents repo disable acme
+      agents repos disable acme
     `,
         notes: `
       Managed extras live at ~/.agents-<alias>/ as peer dirs to ~/.agents/. User-owned
@@ -850,20 +861,20 @@ export function registerRepoCommands(program) {
                 }
                 continue;
             }
-            const spinner = ora(`Pulling ${t.alias}...`).start();
+            const spinner = ora(`Pulling ${formatRepoTarget(t.alias, t.dir)}...`).start();
             const result = await pullRepo(t.dir);
             if (result.success) {
-                spinner.succeed(`${t.alias} -> ${result.commit}`);
+                spinner.succeed(`${formatRepoTarget(t.alias, t.dir, result.branch)}: ${result.commit}`);
             }
             else {
-                spinner.fail(`${t.alias}: ${result.error}`);
+                spinner.fail(`${formatRepoTarget(t.alias, t.dir)}: ${result.error}`);
             }
         }
     });
     repoCmd
         .command('push [alias]')
         .description('Commit and push the user repo or a user-owned extra. Refuses to push the system repo.')
-        .option('-m, --message <msg>', 'Commit message', 'Update via agents repo push')
+        .option('-m, --message <msg>', 'Commit message', 'Update via agents repos push')
         .action(async (alias, options) => {
         const targets = collectRepoTargets(alias);
         if (!targets) {
@@ -893,13 +904,13 @@ export function registerRepoCommands(program) {
             return;
         }
         for (const t of pushable) {
-            const spinner = ora(`Pushing ${t.alias}...`).start();
+            const spinner = ora(`Pushing ${formatRepoTarget(t.alias, t.dir)}...`).start();
             const result = await commitAndPush(t.dir, options.message);
             if (result.success) {
-                spinner.succeed(`${t.alias} pushed`);
+                spinner.succeed(`${formatRepoTarget(t.alias, t.dir, result.branch)}: ${result.detail ?? 'pushed'}`);
             }
             else {
-                spinner.fail(`${t.alias}: ${result.error}`);
+                spinner.fail(`${formatRepoTarget(t.alias, t.dir)}: ${result.error}`);
             }
         }
     });