@phnx-labs/agents-cli 1.20.61 → 1.20.63

package/dist/lib/plugins.js

@@ -10,6 +10,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import * as yaml from 'yaml';
 import { execFileSync } from 'child_process';
 import { getPluginsDir, getTrashPluginsDir, getExtraPluginsDir, getProjectPluginsDir, getSystemPluginsDir } from './state.js';
 import { IS_WINDOWS, isWindowsAbsolutePath, homeDir } from './platform/index.js';
@@ -22,6 +23,7 @@ import { copyPluginToMarketplace, syncMarketplaceManifest, registerMarketplace,
 const PLUGIN_MANIFEST_DIR = '.claude-plugin';
 const PLUGIN_MANIFEST_FILE = 'plugin.json';
 const GEMINI_EXTENSION_MANIFEST_FILE = 'gemini-extension.json';
+const HERMES_PLUGIN_MANIFEST_FILE = 'plugin.yaml';
 const USER_CONFIG_FILE = '.user-config.json';
 const SOURCE_FILE = '.source';
 export const PLUGIN_EXEC_SURFACE_LABELS = {
@@ -533,6 +535,16 @@ export function syncPluginToVersion(plugin, agent, versionHome, options = {}) {
             result.skills.push(plugin.name);
         return result;
     }
+    // Hermes loads plugins from a flat $HOME/.hermes/plugins/<name>/ dir with a
+    // plugin.yaml manifest, gated by a plugins.enabled allowlist in config.yaml.
+    if (agent === 'hermes') {
+        const enablePlugin = options.allowExecSurfaces === true || !hasPluginExecSurfaces(inspectPluginCapabilities(plugin.root));
+        const ok = installHermesPlugin(plugin, versionHome, enablePlugin);
+        result.success = ok;
+        if (ok)
+            result.skills.push(plugin.name);
+        return result;
+    }
     const userConfig = loadUserConfig(plugin.name);
     // Route every marketplace op through the plugin's own marketplace, so a plugin
     // discovered in an extra/project repo installs under its own
@@ -1035,6 +1047,102 @@ export function removeGoosePlugin(pluginName, versionHome) {
     fs.rmSync(destRoot, { recursive: true, force: true });
     return true;
 }
+// ─── Hermes plugins (flat ~/.hermes/plugins/ + config.yaml enable toggle) ─────
+/**
+ * Hermes (Nous Research) loads plugins from a flat `$HOME/.hermes/plugins/<name>/`
+ * directory holding a `plugin.yaml` manifest — NOT the Claude marketplace layout.
+ * Under agents-cli version isolation HOME is the version home, so we install to:
+ *   {versionHome}/.hermes/plugins/<name>/
+ * A plugin does not load until its name is added to `plugins.enabled` (a YAML
+ * array) in `{versionHome}/.hermes/config.yaml`; a deny-list `plugins.disabled`
+ * wins on conflict, so agents-cli only manages the `enabled` allowlist and never
+ * touches `disabled` (user-owned).
+ */
+export function hermesPluginsDir(versionHome) {
+    return path.join(versionHome, '.hermes', 'plugins');
+}
+function hermesConfigPath(versionHome) {
+    return path.join(versionHome, '.hermes', 'config.yaml');
+}
+function writeHermesPluginManifest(plugin, destRoot) {
+    const manifest = {
+        name: plugin.manifest.name,
+        version: plugin.manifest.version,
+        description: plugin.manifest.description,
+    };
+    fs.writeFileSync(path.join(destRoot, HERMES_PLUGIN_MANIFEST_FILE), yaml.stringify(manifest), 'utf-8');
+}
+/**
+ * Add or remove a plugin name in `plugins.enabled` within ~/.hermes/config.yaml,
+ * preserving every other key (read → mutate → write). Never touches
+ * `plugins.disabled`. No-op (no rewrite) when the desired state already holds.
+ */
+export function setHermesPluginEnabled(pluginName, versionHome, enabled) {
+    const configPath = hermesConfigPath(versionHome);
+    let config = {};
+    if (fs.existsSync(configPath)) {
+        const parsed = yaml.parse(fs.readFileSync(configPath, 'utf-8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            config = parsed;
+        }
+    }
+    if (!config.plugins || typeof config.plugins !== 'object' || Array.isArray(config.plugins)) {
+        config.plugins = {};
+    }
+    const plugins = config.plugins;
+    const current = Array.isArray(plugins.enabled) ? plugins.enabled.filter((n) => typeof n === 'string') : [];
+    const has = current.includes(pluginName);
+    if (enabled && !has) {
+        plugins.enabled = [...current, pluginName];
+    }
+    else if (!enabled && has) {
+        plugins.enabled = current.filter((n) => n !== pluginName);
+    }
+    else {
+        return; // desired state already holds — no rewrite
+    }
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, yaml.stringify(config), 'utf-8');
+}
+export function installHermesPlugin(plugin, versionHome, enable) {
+    const destRoot = path.join(hermesPluginsDir(versionHome), plugin.name);
+    try {
+        if (fs.existsSync(destRoot)) {
+            fs.rmSync(destRoot, { recursive: true, force: true });
+        }
+        fs.cpSync(plugin.root, destRoot, { recursive: true });
+        const userConfig = loadUserConfig(plugin.name);
+        if (Object.keys(userConfig).length > 0) {
+            expandUserConfigInDir(destRoot, userConfig);
+        }
+        writeHermesPluginManifest(plugin, destRoot);
+        fs.writeFileSync(path.join(destRoot, '.agents-cli-managed'), `plugin=${plugin.name}\n`, 'utf-8');
+        // Enable only when trusted — never DOWN-toggle here. An un-flagged background
+        // re-sync of an exec-surface plugin passes enable=false; forcing the allowlist
+        // to false then would clobber a plugin the user deliberately enabled with
+        // --allow-exec-surfaces. Mirror addPluginToSettings: add-if-trusted, else leave
+        // the existing enabled state untouched. (Removal still unregisters explicitly.)
+        if (enable) {
+            setHermesPluginEnabled(plugin.name, versionHome, true);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function isHermesPluginInstalled(pluginName, versionHome) {
+    return fs.existsSync(path.join(hermesPluginsDir(versionHome), pluginName, HERMES_PLUGIN_MANIFEST_FILE));
+}
+export function removeHermesPlugin(pluginName, versionHome) {
+    const destRoot = path.join(hermesPluginsDir(versionHome), pluginName);
+    const existed = fs.existsSync(destRoot);
+    if (existed)
+        fs.rmSync(destRoot, { recursive: true, force: true });
+    // Always drop it from the enabled allowlist, even if the dir was already gone.
+    setHermesPluginEnabled(pluginName, versionHome, false);
+    return existed;
+}
 // ─── Sync status ──────────────────────────────────────────────────────────────
 /**
  * Check if a plugin is synced to a version. True when the plugin lives at the
@@ -1053,6 +1161,9 @@ export function isPluginSynced(plugin, agent, versionHome) {
     if (agent === 'goose') {
         return isGoosePluginInstalled(plugin.name, versionHome);
     }
+    if (agent === 'hermes') {
+        return isHermesPluginInstalled(plugin.name, versionHome);
+    }
     const spec = marketplaceSpecForName(plugin.marketplace);
     if (!isInstalledInMarketplace(plugin.name, spec, agent, versionHome))
         return false;
@@ -1101,6 +1212,13 @@ export function removePluginFromVersion(pluginName, pluginRoot, agent, versionHo
         }
         return result;
     }
+    // Hermes: remove the flat plugin dir and drop it from config.yaml plugins.enabled.
+    if (agent === 'hermes') {
+        if (removeHermesPlugin(pluginName, versionHome)) {
+            result.skills.push(pluginName);
+        }
+        return result;
+    }
     // 1. Remove the plugin from every marketplace it's installed under. A name can
     //    appear in more than one (collision across repos), so we sweep them all.
     let removedAny = false;

package/dist/lib/resources/permissions.js

@@ -75,6 +75,8 @@ function getAgentConfigPath(agent, versionHome) {
             return path.join(versionHome, '.factory', 'settings.json');
         case 'kiro':
             return path.join(versionHome, '.kiro', 'settings', 'permissions.yaml');
+        case 'openclaw':
+            return path.join(versionHome, '.openclaw', 'openclaw.json');
         case 'goose':
             return path.join(versionHome, '.config', 'goose', 'permission.yaml');
         default:

package/dist/lib/routines.d.ts

@@ -18,6 +18,10 @@ export interface JobAllowConfig {
 export type GithubTriggerEvent = 'pull_request' | 'push' | 'issue_comment' | 'workflow_run';
 /** Canonical set of accepted GitHub trigger events — single source for validation. */
 export declare const GITHUB_TRIGGER_EVENTS: readonly GithubTriggerEvent[];
+/** Linear webhook resource types a routine can be triggered by. */
+export type LinearTriggerEvent = 'Issue' | 'IssueLabel' | 'Comment' | 'Project' | 'Cycle';
+/** Canonical set of accepted Linear trigger events — single source for validation. */
+export declare const LINEAR_TRIGGER_EVENTS: readonly LinearTriggerEvent[];
 /**
  * Map a user-facing `--on` alias to a canonical GitHub trigger event.
  * Accepts the canonical names plus friendly shortcuts (e.g. `pr`, `pr_opened`
@@ -26,11 +30,11 @@ export declare const GITHUB_TRIGGER_EVENTS: readonly GithubTriggerEvent[];
 export declare function normalizeTriggerEvent(input: string): GithubTriggerEvent | null;
 /**
  * Event-based fire condition for a routine — an alternative (or complement) to
- * `schedule`. Currently only `github_event`: an incoming GitHub webhook whose
- * event (and optional repo/branch) match fires the job through the same
- * dispatch path a cron fire uses. See `src/lib/triggers/webhook.ts`.
+ * `schedule`. Incoming webhooks whose source-specific filters match fire the job
+ * through the same dispatch path a cron fire uses. See
+ * `src/lib/triggers/webhook.ts`.
  */
-export interface JobTrigger {
+export interface GithubJobTrigger {
     type: 'github_event';
     event: GithubTriggerEvent;
     /** `owner/name` — when set, only payloads for this repo match. */
@@ -38,6 +42,17 @@ export interface JobTrigger {
     /** git branch (ref short name) — when set, only payloads for this branch match. */
     branch?: string;
 }
+export interface LinearJobTrigger {
+    type: 'linear_event';
+    event: LinearTriggerEvent;
+    /** Linear action, e.g. `create`, `update`, `remove`. */
+    action?: string;
+    /** Issue identifier prefix such as `RUSH`; useful when one webhook spans teams. */
+    teamKey?: string;
+    /** Required issue label name. */
+    label?: string;
+}
+export type JobTrigger = GithubJobTrigger | LinearJobTrigger;
 /**
  * Full configuration for a routine (persisted as YAML).
  *
@@ -126,16 +141,20 @@ export interface JobEligibilityResult {
  */
 export declare function checkJobDeviceEligibility(config: Pick<JobConfig, 'name' | 'devices'>): JobEligibilityResult | null;
 /**
- * List all job configs, scanning project > user routine dirs.
- * Project routines (`<project>/.agents/routines/`) shadow user routines of the
- * same name. Project discovery is opt-in via `cwd`; the daemon (which calls
- * `listJobs()` with no argument) only sees user routines.
+ * List all job configs, scanning project > user > system routine dirs.
+ * Higher layers shadow lower ones of the same name (first-seen wins): a project
+ * routine shadows a user routine, and a user routine shadows a built-in system
+ * routine (`~/.agents/.system/routines/`, shipped via gh:phnx-labs/.agents-system).
+ * Project discovery is opt-in via `cwd`; the daemon (which calls `listJobs()`
+ * with no argument) sees user + system routines, so a built-in routine fires for
+ * every install unless the user overrides or disables it by name.
  */
 export declare function listJobs(cwd?: string): JobConfig[];
 /**
- * Read a single job config by name, checking project > user.
+ * Read a single job config by name, checking project > user > system.
  * Project discovery is opt-in via `cwd`; daemon callers pass no argument and
- * only resolve user routines.
+ * resolve user + system routines (a user routine of the same name shadows a
+ * built-in system routine).
  */
 export declare function readJob(name: string, cwd?: string): JobConfig | null;
 /** Write a job config to disk, omitting fields that match defaults.

package/dist/lib/routines.js

@@ -10,7 +10,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { Cron } from 'croner';
-import { getRoutinesDir, getRunsDir, ensureAgentsDir, getProjectRoutinesDir } from './state.js';
+import { getRoutinesDir, getSystemRoutinesDir, getRunsDir, ensureAgentsDir, getProjectRoutinesDir } from './state.js';
 import { safeJoin } from './paths.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { ALL_AGENT_IDS } from './agents.js';
@@ -22,6 +22,14 @@ export const GITHUB_TRIGGER_EVENTS = [
     'issue_comment',
     'workflow_run',
 ];
+/** Canonical set of accepted Linear trigger events — single source for validation. */
+export const LINEAR_TRIGGER_EVENTS = [
+    'Issue',
+    'IssueLabel',
+    'Comment',
+    'Project',
+    'Cycle',
+];
 /**
  * Map a user-facing `--on` alias to a canonical GitHub trigger event.
  * Accepts the canonical names plus friendly shortcuts (e.g. `pr`, `pr_opened`
@@ -79,10 +87,13 @@ const JOB_DEFAULTS = {
     enabled: true,
 };
 /**
- * List all job configs, scanning project > user routine dirs.
- * Project routines (`<project>/.agents/routines/`) shadow user routines of the
- * same name. Project discovery is opt-in via `cwd`; the daemon (which calls
- * `listJobs()` with no argument) only sees user routines.
+ * List all job configs, scanning project > user > system routine dirs.
+ * Higher layers shadow lower ones of the same name (first-seen wins): a project
+ * routine shadows a user routine, and a user routine shadows a built-in system
+ * routine (`~/.agents/.system/routines/`, shipped via gh:phnx-labs/.agents-system).
+ * Project discovery is opt-in via `cwd`; the daemon (which calls `listJobs()`
+ * with no argument) sees user + system routines, so a built-in routine fires for
+ * every install unless the user overrides or disables it by name.
  */
 export function listJobs(cwd) {
     ensureAgentsDir();
@@ -95,6 +106,7 @@ export function listJobs(cwd) {
             dirs.push(projectDir);
     }
     dirs.push(getRoutinesDir());
+    dirs.push(getSystemRoutinesDir());
     for (const dir of dirs) {
         if (!fs.existsSync(dir))
             continue;
@@ -112,9 +124,10 @@ export function listJobs(cwd) {
     return jobs;
 }
 /**
- * Read a single job config by name, checking project > user.
+ * Read a single job config by name, checking project > user > system.
  * Project discovery is opt-in via `cwd`; daemon callers pass no argument and
- * only resolve user routines.
+ * resolve user + system routines (a user routine of the same name shadows a
+ * built-in system routine).
  */
 export function readJob(name, cwd) {
     ensureAgentsDir();
@@ -125,6 +138,7 @@ export function readJob(name, cwd) {
             dirs.push(projectDir);
     }
     dirs.push(getRoutinesDir());
+    dirs.push(getSystemRoutinesDir());
     for (const dir of dirs) {
         for (const ext of ['.yml', '.yaml']) {
             const filePath = safeJoin(dir, name + ext);
@@ -358,17 +372,35 @@ export function validateTrigger(trigger) {
         return ['trigger must be an object'];
     }
     const t = trigger;
-    if (t.type !== 'github_event') {
-        errors.push("trigger.type must be 'github_event'");
+    if (t.type !== 'github_event' && t.type !== 'linear_event') {
+        errors.push("trigger.type must be 'github_event' or 'linear_event'");
+        return errors;
+    }
+    if (t.type === 'github_event') {
+        const github = t;
+        if (!github.event || !GITHUB_TRIGGER_EVENTS.includes(github.event)) {
+            errors.push(`trigger.event must be one of: ${GITHUB_TRIGGER_EVENTS.join(', ')}`);
+        }
+        if (github.repo !== undefined && (typeof github.repo !== 'string' || !/^[^/\s]+\/[^/\s]+$/.test(github.repo))) {
+            errors.push('trigger.repo must be in owner/name form');
+        }
+        if (github.branch !== undefined && typeof github.branch !== 'string') {
+            errors.push('trigger.branch must be a string');
+        }
+        return errors;
+    }
+    const linear = t;
+    if (!linear.event || !LINEAR_TRIGGER_EVENTS.includes(linear.event)) {
+        errors.push(`trigger.event must be one of: ${LINEAR_TRIGGER_EVENTS.join(', ')}`);
     }
-    if (!t.event || !GITHUB_TRIGGER_EVENTS.includes(t.event)) {
-        errors.push(`trigger.event must be one of: ${GITHUB_TRIGGER_EVENTS.join(', ')}`);
+    if (linear.action !== undefined && typeof linear.action !== 'string') {
+        errors.push('trigger.action must be a string');
     }
-    if (t.repo !== undefined && (typeof t.repo !== 'string' || !/^[^/\s]+\/[^/\s]+$/.test(t.repo))) {
-        errors.push('trigger.repo must be in owner/name form');
+    if (linear.teamKey !== undefined && (typeof linear.teamKey !== 'string' || !/^[A-Z][A-Z0-9]*$/.test(linear.teamKey))) {
+        errors.push('trigger.teamKey must be an uppercase Linear team key');
     }
-    if (t.branch !== undefined && typeof t.branch !== 'string') {
-        errors.push('trigger.branch must be a string');
+    if (linear.label !== undefined && typeof linear.label !== 'string') {
+        errors.push('trigger.label must be a string');
     }
     return errors;
 }

package/dist/lib/session/active.d.ts

@@ -1,6 +1,6 @@
 import type { CloudTaskStatus } from '../cloud/types.js';
 import { type PidSessionEntry } from './pid-registry.js';
-import { type SessionActivity, type AwaitingReason, type StructuredQuestion, type DetectedPr, type DetectedWorktree, type DetectedTicket } from './state.js';
+import { type SessionActivity, type AwaitingReason, type StructuredQuestion, type TodoProgress, type DetectedPr, type DetectedWorktree, type DetectedTicket } from './state.js';
 import type { SessionAttachment } from './types.js';
 import { type SessionProvenance } from './provenance.js';
 /**
@@ -46,6 +46,13 @@ export interface ActiveSession {
      * says whether it is still pending.
      */
     plan?: string;
+    /**
+     * Live plan progress from the most recent `TodoWrite` (RUSH-1380): the checklist
+     * items + a done/total tally + the current step. The Factory Floor renders this
+     * as an N/M pill + checklist for every session — including remote and
+     * device-dispatched agents that have no local tool-call stream to parse.
+     */
+    todos?: TodoProgress;
     /** Last few assistant turns (most-recent last), for at-a-glance context in the UI. */
     tail?: string[];
     /** PR opened during the session. */

package/dist/lib/session/active.js

@@ -267,6 +267,7 @@ function applyState(base, state, fallbackFile) {
         awaitingReason: state.awaitingReason,
         question: state.question,
         plan: state.plan,
+        todos: state.todos,
         tail: state.tail,
         // Prefer the live preview (latest turn); keep the first-prompt topic as a fallback.
         preview: state.preview ?? base.preview,

package/dist/lib/session/parse.js

@@ -225,6 +225,18 @@ export function summarizeToolUse(tool, args) {
             const steps = Array.isArray(args.plan) ? args.plan.length : 0;
             return `Plan: ${steps} step${steps === 1 ? '' : 's'}`;
         }
+        // Claude's live checklist: show progress + the current step, not a bare "TodoWrite".
+        case 'TodoWrite': {
+            const todos = Array.isArray(args.todos) ? args.todos : [];
+            if (todos.length === 0)
+                return 'Plan: 0 steps';
+            const done = todos.filter((t) => t?.status === 'completed').length;
+            const active = todos.find((t) => t?.status === 'in_progress');
+            const step = active?.activeForm || active?.content;
+            return step
+                ? `Plan ${done}/${todos.length}: ${truncate(String(step), 80)}`
+                : `Plan: ${done}/${todos.length} done`;
+        }
         // Codex tools
         case 'exec_command':
             return `Bash: ${truncate(String(args.command || args.cmd || '').replace(/\n/g, ' ').trim(), 120)}`;

package/dist/lib/session/state.d.ts

@@ -41,6 +41,28 @@ export interface StructuredQuestion {
     reason: AwaitingReason;
     options?: QuestionOption[];
 }
+/** One `TodoWrite` checklist item, as Claude's plan tool emits it. */
+export interface TodoItem {
+    content: string;
+    status: 'pending' | 'in_progress' | 'completed';
+    /** Present-continuous label shown while this item is the active step. */
+    activeForm?: string;
+}
+/**
+ * Live plan progress derived from the most recent `TodoWrite` in the transcript
+ * (RUSH-1380). Lets the Factory Floor show "N/M done" + the current step for any
+ * session — including remote / device-dispatched agents that carry no local
+ * tool-call stream — instead of only a coarse working/idle verb.
+ */
+export interface TodoProgress {
+    items: TodoItem[];
+    /** Count of completed items. */
+    done: number;
+    /** Total items. */
+    total: number;
+    /** The in-progress item's activeForm (falls back to its content). The live step. */
+    activeForm?: string;
+}
 export interface DetectedPr {
     url: string;
     number?: number;
@@ -88,6 +110,12 @@ export interface SessionState {
      * render the actual plan without re-parsing the transcript.
      */
     plan?: string;
+    /**
+     * Live plan progress from the most recent `TodoWrite` (RUSH-1380). Present when
+     * the session has written a todo list; drives the Factory Floor N/M pill +
+     * checklist, notably for remote/device-dispatched agents with no local stream.
+     */
+    todos?: TodoProgress;
     /** Last few assistant turns (most-recent last), one line each — panel context. */
     tail?: string[];
     lastActivityMs?: number;
@@ -111,6 +139,11 @@ export interface StateContext {
     /** Override the running window (defaults to 2 min, matching active.ts). */
     activeWindowMs?: number;
 }
+/**
+ * Derive live plan progress from a `TodoWrite` tool call's args. Returns undefined
+ * when there is no usable list, so a session with no plan carries no `todos` field.
+ */
+export declare function extractTodoProgress(args?: Record<string, any>): TodoProgress | undefined;
 /** Detect a worktree from the session cwd, per the `.agents/worktrees/<slug>/` convention. */
 export declare function detectWorktree(cwd?: string, branch?: string): DetectedWorktree | undefined;
 /** Detect a tracker ticket from free text (prompt/topic) then a branch name. */

package/dist/lib/session/state.js

@@ -47,6 +47,40 @@ const PROSE_QUESTION_FRESH_MS = 30 * 60_000;
 /** Claude tool names that structurally mean "the agent handed control back to you". */
 const PLAN_TOOL = 'ExitPlanMode';
 const ASK_TOOL = 'AskUserQuestion';
+/** Claude's live plan/checklist tool. */
+const TODO_TOOL = 'TodoWrite';
+/**
+ * Derive live plan progress from a `TodoWrite` tool call's args. Returns undefined
+ * when there is no usable list, so a session with no plan carries no `todos` field.
+ */
+export function extractTodoProgress(args) {
+    const raw = args?.todos;
+    if (!Array.isArray(raw) || raw.length === 0)
+        return undefined;
+    const items = [];
+    for (const t of raw) {
+        const activeForm = typeof t?.activeForm === 'string' && t.activeForm ? t.activeForm : undefined;
+        const content = typeof t?.content === 'string' && t.content
+            ? t.content
+            : typeof t?.text === 'string' && t.text
+                ? t.text
+                : activeForm ?? '';
+        if (!content)
+            continue;
+        const status = t?.status === 'completed' || t?.status === 'in_progress' ? t.status : 'pending';
+        items.push(activeForm ? { content, status, activeForm } : { content, status });
+    }
+    if (items.length === 0)
+        return undefined;
+    const done = items.filter(i => i.status === 'completed').length;
+    const inProgress = items.find(i => i.status === 'in_progress');
+    return {
+        items,
+        done,
+        total: items.length,
+        activeForm: inProgress ? inProgress.activeForm ?? inProgress.content : undefined,
+    };
+}
 /** Trailing '?' or a leading interrogative — a question aimed at the user. */
 const QUESTION_TRAILING = /\?["'”)\]]?\s*$/;
 const QUESTION_PHRASE = /\b(shall i|should i|do you want|would you like|which (?:one|option|approach|of)|can you (?:confirm|clarify)|please (?:confirm|clarify|advise)|let me know|are you (?:ok|okay|sure)|proceed\?)\b/i;
@@ -281,12 +315,18 @@ export function inferActivity(events, ctx = {}) {
         .slice(-3)
         .map(e => oneLine(e.content ?? ''))
         .filter(Boolean);
+    // Live plan progress: the most recent TodoWrite's checklist (RUSH-1380). Attached
+    // to `base` so every return path below carries it — a working, waiting, or idle
+    // session all keep showing how far the plan got.
+    const lastTodo = lastOf(meaningful, e => e.type === 'tool_use' && e.tool === TODO_TOOL);
+    const todos = lastTodo ? extractTodoProgress(lastTodo.args) : undefined;
     const base = {
         activity: 'idle',
         lastRole: lastMsg?.role,
         lastEventKind: last?.type,
         lastActivityMs: ctx.mtimeMs,
         preview: previewSource ? describeEvent(previewSource) : undefined,
+        todos,
         tail: tail.length ? tail : undefined,
     };
     if (!last)

package/dist/lib/session/sync/agents.d.ts

@@ -24,6 +24,8 @@ export interface SyncAgentSpec {
     id: string;
     /** Config subdir under the agent home that holds transcripts. */
     subdir: string;
+    /** File extension to walk for this agent (defaults to .jsonl). */
+    ext?: string;
     /** Derive the session id from a storage-relative key. */
     sessionIdFromRelKey(relKey: string): string;
 }

package/dist/lib/session/sync/agents.js

@@ -32,6 +32,44 @@ export const SYNC_AGENTS = [
         // is the session id (matches session_meta.payload.id).
         sessionIdFromRelKey: rel => path.basename(rel).match(UUID_RE)?.[0] ?? rel,
     },
+    {
+        id: 'droid',
+        subdir: 'sessions',
+        // Droid writes <uuid>.jsonl under per-cwd subdirs (plus an optional
+        // <uuid>.settings.json sidecar for metadata). The JSONL is the canonical
+        // transcript; the sidecar is rebuilt from the transcript on the mirror.
+        sessionIdFromRelKey: rel => path.basename(rel).replace(/\.jsonl$/, ''),
+    },
+    {
+        id: 'grok',
+        subdir: 'sessions',
+        // Grok sessions are multi-file directories under ~/.grok/sessions/<cwd>/<uuid>/.
+        // events.jsonl is the canonical transcript stream; syncing it lets the mirror
+        // reconstruct the session (summary.json metadata is recomputed on read).
+        sessionIdFromRelKey: rel => path.basename(path.dirname(rel)),
+    },
+    {
+        id: 'kimi',
+        subdir: 'sessions',
+        ext: '.json',
+        // Kimi sessions are multi-file directories under
+        // ~/.kimi-code/sessions/<wd_hash>/session_<uuid>/. state.json carries the
+        // metadata the scanner reads; wire.jsonl (conversation) is a follow-up
+        // tracked by the multi-file-sessions ticket.
+        sessionIdFromRelKey: rel => {
+            const m = rel.match(/session_[^/]+/);
+            return m?.[0] ?? rel;
+        },
+    },
+    {
+        id: 'opencode',
+        subdir: 'sessions',
+        // OpenCode stores sessions in a single SQLite DB (~/.local/share/opencode/opencode.db)
+        // rather than transcript files. This entry reserves the agent slot so the
+        // sync matrix is complete; file-based round-tripping requires an SQLite-to-JSONL
+        // export step (not yet implemented).
+        sessionIdFromRelKey: rel => path.basename(rel),
+    },
 ];
 let cachedMirrorRoot = null;
 function mirrorRootReal() {
@@ -61,7 +99,7 @@ export function listLocalTranscripts(spec) {
     for (const dir of getAgentSessionDirs(spec.id, spec.subdir)) {
         if (safeReal(dir).startsWith(mirror))
             continue; // skip synced-in mirror dirs
-        for (const abs of walkForFiles(dir, '.jsonl', 100_000)) {
+        for (const abs of walkForFiles(dir, spec.ext ?? '.jsonl', 100_000)) {
             const relKey = path.relative(dir, abs);
             if (!relKey || relKey.startsWith('..'))
                 continue;

package/dist/lib/session/sync/config.d.ts

@@ -12,6 +12,14 @@ export interface R2Config {
     secretAccessKey: string;
     /** S3-compatible endpoint for the account (no bucket, no trailing slash). */
     endpoint: string;
+    /**
+     * Shared 32-byte key (hex or base64) for client-side transcript encryption,
+     * held in the bundle as `R2_SYNC_ENC_KEY`. Optional and deliberately separate
+     * from the R2 credentials so rotating the access token never orphans already
+     * encrypted objects. When absent, transcripts upload unencrypted (with a loud
+     * per-cycle warning) — see transcript-crypto.ts + pushOwn.
+     */
+    syncEncKey?: string;
 }
 /** Window after a prompt-bearing resolution failure during which we skip
  *  re-attempting (and thus re-prompting). SIGHUP / restart bypasses it. */

package/dist/lib/session/sync/config.js

@@ -17,6 +17,7 @@ function resolveR2Config() {
     const bucket = env.R2_BUCKET_NAME?.trim();
     const accessKeyId = env.R2_ACCESS_KEY_ID?.trim();
     const secretAccessKey = env.R2_SECRET_ACCESS_KEY?.trim();
+    const syncEncKey = env.R2_SYNC_ENC_KEY?.trim() || undefined;
     const missing = [
         !accountId && 'R2_ACCOUNT_ID',
         !bucket && 'R2_BUCKET_NAME',
@@ -32,7 +33,11 @@ function resolveR2Config() {
         bucket: bucket,
         accessKeyId: accessKeyId,
         secretAccessKey: secretAccessKey,
-        endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
+        // Default to the account's R2 endpoint; an explicit R2_ENDPOINT override
+        // points sync at any S3-compatible store (MinIO, another provider) — which
+        // is also how the feature is verified end-to-end without live R2.
+        endpoint: env.R2_ENDPOINT?.trim() || `https://${accountId}.r2.cloudflarestorage.com`,
+        syncEncKey,
     };
 }
 // ── Resolution cache ────────────────────────────────────────────────────────