@phnx-labs/agents-cli 1.20.62 → 1.20.63

package/dist/lib/hosts/passthrough.js

@@ -1,10 +1,8 @@
 /**
  * Generic `--host` passthrough — the single choke point that runs an allowlisted
- * `agents <command>` on a remote host instead of locally, so read-only and
- * config commands (`view`, `usage`, `cost`, `doctor`, `inspect`, `list`, `sync`)
- * and the team lifecycle (`teams …`) all gain remote support with no per-command
- * code. Called once from `index.ts` before commander parses; returns `true` when
- * it handled the invocation (the local command must then NOT run).
+ * `agents <command>` on a remote host instead of locally. Called once from
+ * `index.ts` before commander parses; returns `true` when it handled the
+ * invocation (the local command must then NOT run).
  *
  * Transport is SSH (via `ssh-exec.ts`), never a daemon: SSH is the one hardened
  * choke point already used everywhere, and it gives auth + encryption + host-key
@@ -12,9 +10,11 @@
  * long-running case — `teams start --watch` — dispatches detached so the remote
  * supervisor outlives a dropped connection.
  *
- * `run`, `sessions`, and `feed` are deliberately absent from the table below:
- * they own richer `--host` handling in their own command actions (detached run
- * dispatch or multi-host fan-out) and must fall through to it.
+ * Commands with their own richer `--host` handling (`run`/`sessions`/`feed`/
+ * `computer`/`secrets`/`logs`/…) are listed in {@link OWN_HOST_COMMANDS} and
+ * fall through to their local actions. Everything else either routes via this
+ * table or, when `--host`/`--device` is present, exits with a clear
+ * "not supported" message — never commander's raw `unknown option`.
  */
 import chalk from 'chalk';
 import { assertValidSshTarget, sshStream } from '../ssh-exec.js';
@@ -24,19 +24,90 @@ import { dispatchAgentsCommand } from './dispatch.js';
 import { stripRoutingFlags, buildRemoteAgentsInvocation, HOST_ROUTING_SPECS, } from './remote-cmd.js';
 import { resolveRemoteOsSync } from './remote-os.js';
 import { machineId } from '../session/sync/config.js';
+/**
+ * First-class groups that run transparently on a remote via SSH when
+ * `--host`/`--device` is present. Keep both canonical names and aliases
+ * (`repo`/`repos`, `exec`/`run`) so either argv form routes the same way.
+ *
+ * Prefer adding here over per-command SSH code — this is the single choke point.
+ */
 const REMOTE_PASSTHROUGH = {
+    // status / inspect
     view: {},
+    inspect: {},
+    doctor: {},
+    status: {},
+    check: {},
+    list: {},
     usage: {},
     cost: {},
     output: {},
-    doctor: {},
-    inspect: {},
-    list: {},
+    budget: {},
+    // config / resources
     sync: { nonInteractive: ['--yes'] },
+    pull: {},
+    push: {},
+    repo: {},
+    repos: {},
+    plugins: {},
+    skills: {},
+    hooks: {},
+    commands: {},
+    rules: {},
+    memory: {},
+    permissions: {},
+    perms: {},
+    mcp: {},
+    cli: {},
+    subagents: {},
+    workflows: {},
+    packages: {},
+    models: {},
+    profiles: {},
+    defaults: {},
+    alias: {},
+    // lifecycle
     teams: {},
     message: {},
     routines: {},
+    jobs: {},
+    cron: {},
+    // misc remote-sensible
+    prune: {},
+    trash: {},
+    restore: {},
+    worktree: {},
+    events: {},
+    audit: {},
+    lock: {},
+    feedback: {},
+    wallet: {},
+    daemon: {},
+    pty: {},
+    tmux: {},
+    watchdog: {},
+    factory: {},
+    browser: {},
+    versions: {},
 };
+/**
+ * Commands that register and interpret `--host`/`--device` themselves — must
+ * fall through to local commander even when the flag is present. Do not add
+ * these to {@link REMOTE_PASSTHROUGH}.
+ */
+const OWN_HOST_COMMANDS = new Set([
+    'run',
+    'exec', // deprecated alias of run
+    'sessions',
+    'feed',
+    'computer',
+    'secrets',
+    'logs',
+    'hosts',
+    'ssh',
+    'devices',
+    'fleet', // alias of devices
+]);
 /** `--no-tty` is stripped like the routing flags but carries no value. */
 const STRIP_SPECS = [...HOST_ROUTING_SPECS, { long: 'no-tty', takesValue: false }];
 /** Pull the value of `--host`/`-H`/`--remote-cwd` (any form) out of an argv. */
@@ -83,15 +154,26 @@ async function resolveTargetHost(name, any) {
 /**
  * Route `agents <command> … --host <name>` to a remote if the command is
  * host-routable and a `--host` (or its `--device` alias) was given. Returns
- * `false` (run locally) when neither flag is present, the command isn't in the
- * table, or the target is this very machine.
+ * `false` (run locally) when neither flag is present, the command owns its own
+ * host handling, the target is this very machine, or placement flags need the
+ * local action. Returns `true` after printing a clear error when the flag is
+ * present on a command that is neither routable nor self-handling — so the user
+ * never sees commander's raw `unknown option '--host'`.
  *
  * @param command the resolved subcommand name (`process.argv`'s first non-flag).
  * @param allArgs `process.argv.slice(2)` — the command name followed by its args.
  */
 export async function maybeRunOnHost(command, allArgs) {
-    const spec = REMOTE_PASSTHROUGH[command];
-    if (!spec)
+    const hostFlag = flagValue(allArgs, 'host', 'H');
+    const deviceFlag = flagValue(allArgs, 'device');
+    const hostName = hostFlag ?? deviceFlag;
+    if (!hostName)
+        return false;
+    // Commands with their own richer --host semantics must reach local commander
+    // BEFORE any single-target conflict gate. sessions/feed merge --host and
+    // --device into a multi-host list; rejecting "conflicting" pairs would break
+    // `agents sessions --host a --device b` / `agents feed --host a --device b`.
+    if (OWN_HOST_COMMANDS.has(command))
         return false;
     // Placement, not routing: `teams add`/`teams create` read `--device`/`--devices`
     // (and `--host`/`--hosts`) as WHERE to place a teammate / the team pool — the
@@ -107,16 +189,6 @@ export async function maybeRunOnHost(command, allArgs) {
             return false;
         }
     }
-    // `--device` is a first-class alias of `--host` (mirrors `agents run`); the
-    // device registry is the source of truth for machine identity. Reject a
-    // conflicting pair rather than silently preferring one — same rule as run.
-    const hostFlag = flagValue(allArgs, 'host', 'H');
-    const deviceFlag = flagValue(allArgs, 'device');
-    if (hostFlag && deviceFlag && hostFlag !== deviceFlag) {
-        console.error(chalk.red('Conflicting --host/--device values — pass just one.'));
-        process.exitCode = 1;
-        return true;
-    }
     // `--hosts` is always a generic fleet flag — bail for every command so the
     // local aggregator handles it. `--devices` is fan-out on most commands but
     // a placement flag on `routines` (which devices may run the routine), so
@@ -125,14 +197,32 @@ export async function maybeRunOnHost(command, allArgs) {
         return false;
     if (allArgs.includes('--devices') && command !== 'routines')
         return false;
-    const hostName = hostFlag ?? deviceFlag;
-    if (!hostName)
-        return false;
+    const spec = REMOTE_PASSTHROUGH[command];
+    if (!spec) {
+        // Flag was accepted (no raw commander "unknown option") but this group has
+        // no remote semantics — say so clearly instead of falling through.
+        console.error(chalk.red(`\`agents ${command}\` does not support --host/--device (no remote interpretation).`) +
+            chalk.gray(' Run without the flag, or use a host-routable group (repos, view, sync, teams, doctor, …).'));
+        process.exitCode = 1;
+        return true;
+    }
+    // Single-target remote path only: reject a conflicting --host/--device pair
+    // rather than silently preferring one (same rule as `agents run`).
+    if (hostFlag && deviceFlag && hostFlag !== deviceFlag) {
+        console.error(chalk.red('Conflicting --host/--device values — pass just one.'));
+        process.exitCode = 1;
+        return true;
+    }
     // Running against your own machine is just a local run — skip the SSH round-trip.
     // `machineId()` is the same self-identifier the device registry and session
     // sync use (lowercased short hostname); compare case-insensitively.
-    if (hostName.toLowerCase() === machineId())
+    // Strip the routing flags from process.argv so the local command never sees
+    // an unregistered `--host`/`--device` and dies with "unknown option".
+    if (hostName.toLowerCase() === machineId()) {
+        const stripped = stripRoutingFlags(allArgs, STRIP_SPECS);
+        process.argv = [process.argv[0], process.argv[1], ...stripped];
         return false;
+    }
     const remoteCwd = flagValue(allArgs, 'remote-cwd');
     const any = allArgs.includes('--any');
     let host;

package/dist/lib/mailbox-gc.js

@@ -9,7 +9,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { getMailboxRootDir } from './state.js';
-import { mailboxDir, isValidMailboxId, readMessage, } from './mailbox.js';
+import { mailboxDir, isValidMailboxId, readMessage, sweepExpired, } from './mailbox.js';
 import { listBlocks, removeBlock } from './feed.js';
 const DEFAULT_MAX_CONSUMED_AGE_MINUTES = 24 * 60;
 function consumedAgeMinutes(file, now) {
@@ -134,21 +134,9 @@ export function gcMailbox(activeBoxIds, options = {}) {
             }
         }
         else {
-            // Live box: lazy expiry is handled by drain/peek, but sweep here for GC metrics.
-            // We still need to read expired messages; reuse readMessage directly to avoid
-            // importing sweepExpired and duplicating logic.
-            for (const sub of ['inbox', 'processing']) {
-                const dir = path.join(boxDir, sub);
-                for (const file of jsonFiles(dir)) {
-                    const msg = readMessage(path.join(dir, file));
-                    if (msg && msg.expiresAt) {
-                        const ts = Date.parse(msg.expiresAt);
-                        if (!Number.isNaN(ts) && ts <= now.getTime()) {
-                            result.messagesDroppedExpired++;
-                        }
-                    }
-                }
-            }
+            // Live box: archive expired messages (same path as drain/peek) so GC does
+            // not leave expired files in inbox/processing while only bumping metrics.
+            result.messagesDroppedExpired += sweepExpired(boxDir, name, now);
             result.consumedPruned += pruneConsumed(boxDir, maxConsumedAgeMinutes, now);
         }
     }

package/dist/lib/migrate.d.ts

@@ -44,6 +44,18 @@ export declare function foldLegacySystemRepo(): void;
  * drive a fixture tree without touching the user's ~/.agents.
  */
 export declare function migrateAgentsYaml(systemDir?: string, userDir?: string): void;
+/**
+ * Fold the legacy GLOBAL browser captures root
+ * (`~/.agents/.cache/browser/sessions/<task>/`) into the new PER-PROFILE layout
+ * (`~/.agents/.cache/browser/<profile>/sessions/<task>/`), so each profile is one
+ * self-contained tree and the new `browser sessions` listing finds old captures.
+ *
+ * Attribution: a legacy `sessions/<task>` dir is owned by whichever profile's
+ * `tasks.json` still lists that task name. Tasks no profile claims (the profile
+ * was deleted, or tasks.json was cleared) move under a `_legacy` pseudo-profile so
+ * nothing is lost. Idempotent — once the global `sessions/` root is gone it no-ops.
+ */
+export declare function foldBrowserSessionsIntoProfiles(browserDir?: string): void;
 /**
  * Repair self-referential agent binary symlinks.
  *

package/dist/lib/migrate.js

@@ -359,6 +359,56 @@ function foldUserHooksYamlIntoAgentsYaml() {
     }
     catch { /* best-effort */ }
 }
+/**
+ * Fold the legacy GLOBAL browser captures root
+ * (`~/.agents/.cache/browser/sessions/<task>/`) into the new PER-PROFILE layout
+ * (`~/.agents/.cache/browser/<profile>/sessions/<task>/`), so each profile is one
+ * self-contained tree and the new `browser sessions` listing finds old captures.
+ *
+ * Attribution: a legacy `sessions/<task>` dir is owned by whichever profile's
+ * `tasks.json` still lists that task name. Tasks no profile claims (the profile
+ * was deleted, or tasks.json was cleared) move under a `_legacy` pseudo-profile so
+ * nothing is lost. Idempotent — once the global `sessions/` root is gone it no-ops.
+ */
+export function foldBrowserSessionsIntoProfiles(browserDir = path.join(CACHE_DIR, 'browser')) {
+    const legacySessionsDir = path.join(browserDir, 'sessions');
+    let taskDirs;
+    try {
+        taskDirs = fs.readdirSync(legacySessionsDir, { withFileTypes: true });
+    }
+    catch {
+        return; // no legacy global sessions/ root — already folded or never existed
+    }
+    // Map task name -> owning profile from every profile's tasks.json (first wins).
+    const taskOwner = new Map();
+    let profileDirs = [];
+    try {
+        profileDirs = fs.readdirSync(browserDir, { withFileTypes: true });
+    }
+    catch { /* browserDir vanished mid-run */ }
+    for (const p of profileDirs) {
+        if (!p.isDirectory() || p.name === 'sessions' || p.name === '_legacy')
+            continue;
+        try {
+            const state = JSON.parse(fs.readFileSync(path.join(browserDir, p.name, 'tasks.json'), 'utf-8'));
+            for (const taskName of Object.keys(state)) {
+                if (!taskOwner.has(taskName))
+                    taskOwner.set(taskName, p.name);
+            }
+        }
+        catch { /* missing or invalid tasks.json */ }
+    }
+    for (const taskEntry of taskDirs) {
+        if (!taskEntry.isDirectory())
+            continue;
+        const owner = taskOwner.get(taskEntry.name) ?? '_legacy';
+        // A capture dir can hold a nested recordings/ subdir and may collide with a
+        // dest that already has newer captures — moveDirOnce merges (skip-existing),
+        // moveFileOnce would EISDIR on unlink and silently strand the captures.
+        moveDirOnce(path.join(legacySessionsDir, taskEntry.name), path.join(browserDir, owner, 'sessions', taskEntry.name));
+    }
+    rmEmptyDirTree(legacySessionsDir);
+}
 /**
  * Fold ~/.agents/browser/profiles/*.yaml into ~/.agents/agents.yaml under a
  * `browser:` key, then delete the profiles directory. Single user file to sync.
@@ -1582,7 +1632,7 @@ function containsOnlyDsStore(dir) {
 function warnSystemOrphans() {
     const SHIPPED_ALLOWLIST = new Set([
         // resource directories shipped by the npm package
-        'commands', 'hooks', 'skills', 'rules', 'mcp', 'cli', 'permissions', 'subagents', 'profiles', 'agents',
+        'commands', 'hooks', 'skills', 'rules', 'mcp', 'cli', 'permissions', 'subagents', 'profiles', 'agents', 'routines',
         // top-level metadata files
         'agents.yaml', 'hooks.yaml', 'README.md', 'CHANGELOG.md',
         // git + repo metadata
@@ -1966,6 +2016,10 @@ export async function runMigration() {
     // migrateRuntimeToCache so any legacy plugins/ still at the user-root from
     // very-old layouts have already been handled.
     migratePluginsBackToUserRoot();
+    // Browser captures: fold the legacy global browser/sessions/<task> root into the
+    // per-profile browser/<profile>/sessions/<task> layout. After the cache moves so
+    // the browser dir is at its canonical .cache location.
+    foldBrowserSessionsIntoProfiles();
     // System-repo sweep: move every remaining operational dir into its canonical
     // user-bucket location, then drop known-dead artifacts and warn about
     // anything we don't recognize. Order: durable (sessions/teams/trash/repos/

package/dist/lib/routines.d.ts

@@ -18,6 +18,10 @@ export interface JobAllowConfig {
 export type GithubTriggerEvent = 'pull_request' | 'push' | 'issue_comment' | 'workflow_run';
 /** Canonical set of accepted GitHub trigger events — single source for validation. */
 export declare const GITHUB_TRIGGER_EVENTS: readonly GithubTriggerEvent[];
+/** Linear webhook resource types a routine can be triggered by. */
+export type LinearTriggerEvent = 'Issue' | 'IssueLabel' | 'Comment' | 'Project' | 'Cycle';
+/** Canonical set of accepted Linear trigger events — single source for validation. */
+export declare const LINEAR_TRIGGER_EVENTS: readonly LinearTriggerEvent[];
 /**
  * Map a user-facing `--on` alias to a canonical GitHub trigger event.
  * Accepts the canonical names plus friendly shortcuts (e.g. `pr`, `pr_opened`
@@ -26,11 +30,11 @@ export declare const GITHUB_TRIGGER_EVENTS: readonly GithubTriggerEvent[];
 export declare function normalizeTriggerEvent(input: string): GithubTriggerEvent | null;
 /**
  * Event-based fire condition for a routine — an alternative (or complement) to
- * `schedule`. Currently only `github_event`: an incoming GitHub webhook whose
- * event (and optional repo/branch) match fires the job through the same
- * dispatch path a cron fire uses. See `src/lib/triggers/webhook.ts`.
+ * `schedule`. Incoming webhooks whose source-specific filters match fire the job
+ * through the same dispatch path a cron fire uses. See
+ * `src/lib/triggers/webhook.ts`.
  */
-export interface JobTrigger {
+export interface GithubJobTrigger {
     type: 'github_event';
     event: GithubTriggerEvent;
     /** `owner/name` — when set, only payloads for this repo match. */
@@ -38,6 +42,17 @@ export interface JobTrigger {
     /** git branch (ref short name) — when set, only payloads for this branch match. */
     branch?: string;
 }
+export interface LinearJobTrigger {
+    type: 'linear_event';
+    event: LinearTriggerEvent;
+    /** Linear action, e.g. `create`, `update`, `remove`. */
+    action?: string;
+    /** Issue identifier prefix such as `RUSH`; useful when one webhook spans teams. */
+    teamKey?: string;
+    /** Required issue label name. */
+    label?: string;
+}
+export type JobTrigger = GithubJobTrigger | LinearJobTrigger;
 /**
  * Full configuration for a routine (persisted as YAML).
  *
@@ -126,16 +141,20 @@ export interface JobEligibilityResult {
  */
 export declare function checkJobDeviceEligibility(config: Pick<JobConfig, 'name' | 'devices'>): JobEligibilityResult | null;
 /**
- * List all job configs, scanning project > user routine dirs.
- * Project routines (`<project>/.agents/routines/`) shadow user routines of the
- * same name. Project discovery is opt-in via `cwd`; the daemon (which calls
- * `listJobs()` with no argument) only sees user routines.
+ * List all job configs, scanning project > user > system routine dirs.
+ * Higher layers shadow lower ones of the same name (first-seen wins): a project
+ * routine shadows a user routine, and a user routine shadows a built-in system
+ * routine (`~/.agents/.system/routines/`, shipped via gh:phnx-labs/.agents-system).
+ * Project discovery is opt-in via `cwd`; the daemon (which calls `listJobs()`
+ * with no argument) sees user + system routines, so a built-in routine fires for
+ * every install unless the user overrides or disables it by name.
  */
 export declare function listJobs(cwd?: string): JobConfig[];
 /**
- * Read a single job config by name, checking project > user.
+ * Read a single job config by name, checking project > user > system.
  * Project discovery is opt-in via `cwd`; daemon callers pass no argument and
- * only resolve user routines.
+ * resolve user + system routines (a user routine of the same name shadows a
+ * built-in system routine).
  */
 export declare function readJob(name: string, cwd?: string): JobConfig | null;
 /** Write a job config to disk, omitting fields that match defaults.

package/dist/lib/routines.js

@@ -10,7 +10,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { Cron } from 'croner';
-import { getRoutinesDir, getRunsDir, ensureAgentsDir, getProjectRoutinesDir } from './state.js';
+import { getRoutinesDir, getSystemRoutinesDir, getRunsDir, ensureAgentsDir, getProjectRoutinesDir } from './state.js';
 import { safeJoin } from './paths.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { ALL_AGENT_IDS } from './agents.js';
@@ -22,6 +22,14 @@ export const GITHUB_TRIGGER_EVENTS = [
     'issue_comment',
     'workflow_run',
 ];
+/** Canonical set of accepted Linear trigger events — single source for validation. */
+export const LINEAR_TRIGGER_EVENTS = [
+    'Issue',
+    'IssueLabel',
+    'Comment',
+    'Project',
+    'Cycle',
+];
 /**
  * Map a user-facing `--on` alias to a canonical GitHub trigger event.
  * Accepts the canonical names plus friendly shortcuts (e.g. `pr`, `pr_opened`
@@ -79,10 +87,13 @@ const JOB_DEFAULTS = {
     enabled: true,
 };
 /**
- * List all job configs, scanning project > user routine dirs.
- * Project routines (`<project>/.agents/routines/`) shadow user routines of the
- * same name. Project discovery is opt-in via `cwd`; the daemon (which calls
- * `listJobs()` with no argument) only sees user routines.
+ * List all job configs, scanning project > user > system routine dirs.
+ * Higher layers shadow lower ones of the same name (first-seen wins): a project
+ * routine shadows a user routine, and a user routine shadows a built-in system
+ * routine (`~/.agents/.system/routines/`, shipped via gh:phnx-labs/.agents-system).
+ * Project discovery is opt-in via `cwd`; the daemon (which calls `listJobs()`
+ * with no argument) sees user + system routines, so a built-in routine fires for
+ * every install unless the user overrides or disables it by name.
  */
 export function listJobs(cwd) {
     ensureAgentsDir();
@@ -95,6 +106,7 @@ export function listJobs(cwd) {
             dirs.push(projectDir);
     }
     dirs.push(getRoutinesDir());
+    dirs.push(getSystemRoutinesDir());
     for (const dir of dirs) {
         if (!fs.existsSync(dir))
             continue;
@@ -112,9 +124,10 @@ export function listJobs(cwd) {
     return jobs;
 }
 /**
- * Read a single job config by name, checking project > user.
+ * Read a single job config by name, checking project > user > system.
  * Project discovery is opt-in via `cwd`; daemon callers pass no argument and
- * only resolve user routines.
+ * resolve user + system routines (a user routine of the same name shadows a
+ * built-in system routine).
  */
 export function readJob(name, cwd) {
     ensureAgentsDir();
@@ -125,6 +138,7 @@ export function readJob(name, cwd) {
             dirs.push(projectDir);
     }
     dirs.push(getRoutinesDir());
+    dirs.push(getSystemRoutinesDir());
     for (const dir of dirs) {
         for (const ext of ['.yml', '.yaml']) {
             const filePath = safeJoin(dir, name + ext);
@@ -358,17 +372,35 @@ export function validateTrigger(trigger) {
         return ['trigger must be an object'];
     }
     const t = trigger;
-    if (t.type !== 'github_event') {
-        errors.push("trigger.type must be 'github_event'");
+    if (t.type !== 'github_event' && t.type !== 'linear_event') {
+        errors.push("trigger.type must be 'github_event' or 'linear_event'");
+        return errors;
+    }
+    if (t.type === 'github_event') {
+        const github = t;
+        if (!github.event || !GITHUB_TRIGGER_EVENTS.includes(github.event)) {
+            errors.push(`trigger.event must be one of: ${GITHUB_TRIGGER_EVENTS.join(', ')}`);
+        }
+        if (github.repo !== undefined && (typeof github.repo !== 'string' || !/^[^/\s]+\/[^/\s]+$/.test(github.repo))) {
+            errors.push('trigger.repo must be in owner/name form');
+        }
+        if (github.branch !== undefined && typeof github.branch !== 'string') {
+            errors.push('trigger.branch must be a string');
+        }
+        return errors;
+    }
+    const linear = t;
+    if (!linear.event || !LINEAR_TRIGGER_EVENTS.includes(linear.event)) {
+        errors.push(`trigger.event must be one of: ${LINEAR_TRIGGER_EVENTS.join(', ')}`);
     }
-    if (!t.event || !GITHUB_TRIGGER_EVENTS.includes(t.event)) {
-        errors.push(`trigger.event must be one of: ${GITHUB_TRIGGER_EVENTS.join(', ')}`);
+    if (linear.action !== undefined && typeof linear.action !== 'string') {
+        errors.push('trigger.action must be a string');
     }
-    if (t.repo !== undefined && (typeof t.repo !== 'string' || !/^[^/\s]+\/[^/\s]+$/.test(t.repo))) {
-        errors.push('trigger.repo must be in owner/name form');
+    if (linear.teamKey !== undefined && (typeof linear.teamKey !== 'string' || !/^[A-Z][A-Z0-9]*$/.test(linear.teamKey))) {
+        errors.push('trigger.teamKey must be an uppercase Linear team key');
     }
-    if (t.branch !== undefined && typeof t.branch !== 'string') {
-        errors.push('trigger.branch must be a string');
+    if (linear.label !== undefined && typeof linear.label !== 'string') {
+        errors.push('trigger.label must be a string');
     }
     return errors;
 }

package/dist/lib/session/sync/agents.d.ts

@@ -24,6 +24,8 @@ export interface SyncAgentSpec {
     id: string;
     /** Config subdir under the agent home that holds transcripts. */
     subdir: string;
+    /** File extension to walk for this agent (defaults to .jsonl). */
+    ext?: string;
     /** Derive the session id from a storage-relative key. */
     sessionIdFromRelKey(relKey: string): string;
 }

package/dist/lib/session/sync/agents.js

@@ -32,6 +32,44 @@ export const SYNC_AGENTS = [
         // is the session id (matches session_meta.payload.id).
         sessionIdFromRelKey: rel => path.basename(rel).match(UUID_RE)?.[0] ?? rel,
     },
+    {
+        id: 'droid',
+        subdir: 'sessions',
+        // Droid writes <uuid>.jsonl under per-cwd subdirs (plus an optional
+        // <uuid>.settings.json sidecar for metadata). The JSONL is the canonical
+        // transcript; the sidecar is rebuilt from the transcript on the mirror.
+        sessionIdFromRelKey: rel => path.basename(rel).replace(/\.jsonl$/, ''),
+    },
+    {
+        id: 'grok',
+        subdir: 'sessions',
+        // Grok sessions are multi-file directories under ~/.grok/sessions/<cwd>/<uuid>/.
+        // events.jsonl is the canonical transcript stream; syncing it lets the mirror
+        // reconstruct the session (summary.json metadata is recomputed on read).
+        sessionIdFromRelKey: rel => path.basename(path.dirname(rel)),
+    },
+    {
+        id: 'kimi',
+        subdir: 'sessions',
+        ext: '.json',
+        // Kimi sessions are multi-file directories under
+        // ~/.kimi-code/sessions/<wd_hash>/session_<uuid>/. state.json carries the
+        // metadata the scanner reads; wire.jsonl (conversation) is a follow-up
+        // tracked by the multi-file-sessions ticket.
+        sessionIdFromRelKey: rel => {
+            const m = rel.match(/session_[^/]+/);
+            return m?.[0] ?? rel;
+        },
+    },
+    {
+        id: 'opencode',
+        subdir: 'sessions',
+        // OpenCode stores sessions in a single SQLite DB (~/.local/share/opencode/opencode.db)
+        // rather than transcript files. This entry reserves the agent slot so the
+        // sync matrix is complete; file-based round-tripping requires an SQLite-to-JSONL
+        // export step (not yet implemented).
+        sessionIdFromRelKey: rel => path.basename(rel),
+    },
 ];
 let cachedMirrorRoot = null;
 function mirrorRootReal() {
@@ -61,7 +99,7 @@ export function listLocalTranscripts(spec) {
     for (const dir of getAgentSessionDirs(spec.id, spec.subdir)) {
         if (safeReal(dir).startsWith(mirror))
             continue; // skip synced-in mirror dirs
-        for (const abs of walkForFiles(dir, '.jsonl', 100_000)) {
+        for (const abs of walkForFiles(dir, spec.ext ?? '.jsonl', 100_000)) {
             const relKey = path.relative(dir, abs);
             if (!relKey || relKey.startsWith('..'))
                 continue;

package/dist/lib/session/sync/config.d.ts

@@ -12,6 +12,14 @@ export interface R2Config {
     secretAccessKey: string;
     /** S3-compatible endpoint for the account (no bucket, no trailing slash). */
     endpoint: string;
+    /**
+     * Shared 32-byte key (hex or base64) for client-side transcript encryption,
+     * held in the bundle as `R2_SYNC_ENC_KEY`. Optional and deliberately separate
+     * from the R2 credentials so rotating the access token never orphans already
+     * encrypted objects. When absent, transcripts upload unencrypted (with a loud
+     * per-cycle warning) — see transcript-crypto.ts + pushOwn.
+     */
+    syncEncKey?: string;
 }
 /** Window after a prompt-bearing resolution failure during which we skip
  *  re-attempting (and thus re-prompting). SIGHUP / restart bypasses it. */

package/dist/lib/session/sync/config.js

@@ -17,6 +17,7 @@ function resolveR2Config() {
     const bucket = env.R2_BUCKET_NAME?.trim();
     const accessKeyId = env.R2_ACCESS_KEY_ID?.trim();
     const secretAccessKey = env.R2_SECRET_ACCESS_KEY?.trim();
+    const syncEncKey = env.R2_SYNC_ENC_KEY?.trim() || undefined;
     const missing = [
         !accountId && 'R2_ACCOUNT_ID',
         !bucket && 'R2_BUCKET_NAME',
@@ -32,7 +33,11 @@ function resolveR2Config() {
         bucket: bucket,
         accessKeyId: accessKeyId,
         secretAccessKey: secretAccessKey,
-        endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
+        // Default to the account's R2 endpoint; an explicit R2_ENDPOINT override
+        // points sync at any S3-compatible store (MinIO, another provider) — which
+        // is also how the feature is verified end-to-end without live R2.
+        endpoint: env.R2_ENDPOINT?.trim() || `https://${accountId}.r2.cloudflarestorage.com`,
+        syncEncKey,
     };
 }
 // ── Resolution cache ────────────────────────────────────────────────────────