@phnx-labs/agents-cli 1.20.63 → 1.20.65

package/dist/lib/sync-umbrella.d.ts

@@ -63,6 +63,7 @@ export interface UmbrellaResult {
         pushed: number;
         pulled: number;
         merged: number;
+        error?: string;
     };
     devices?: {
         synced: number;

package/dist/lib/sync-umbrella.js

@@ -118,9 +118,20 @@ export async function runUmbrellaSync(args) {
         const { isSyncConfigured } = await import('./session/sync/config.js');
         if (isBetaEnabled('session-sync') && isSyncConfigured()) {
             const { syncSessions } = await import('./session/sync/sync.js');
-            const r = await syncSessions();
-            result.sessions = { ran: true, pushed: r.pushed, pulled: r.pulled, merged: r.merged };
-            log(`sessions: pushed ${r.pushed}, pulled ${r.pulled}, merged ${r.merged}`);
+            // Record a failure here instead of letting it throw: like the fetchSecrets
+            // block above, a failure in one fetch stage must not abort the others or
+            // the reconcile below (see this function's doc comment). Without this,
+            // syncSessions() throwing — e.g. via the C1 containment reject on a
+            // malicious peer manifest — would skip `plan.reconcile` entirely.
+            try {
+                const r = await syncSessions();
+                result.sessions = { ran: true, pushed: r.pushed, pulled: r.pulled, merged: r.merged };
+                log(`sessions: pushed ${r.pushed}, pulled ${r.pulled}, merged ${r.merged}`);
+            }
+            catch (err) {
+                result.sessions = { ran: false, pushed: 0, pulled: 0, merged: 0, error: err.message };
+                log(`sessions: failed — ${err.message}`);
+            }
         }
         else {
             result.sessions = { ran: false, pushed: 0, pulled: 0, merged: 0 };

package/dist/lib/tmux/session.d.ts

@@ -33,6 +33,13 @@ export interface SessionMeta {
 export interface CreateSessionOptions {
     name: string;
     cmd?: string;
+    /**
+     * Redacted copy of `cmd` to persist in SessionMeta.cmd instead of the real
+     * command. When set, `cmd` is still executed but only `metaCmd` is written to
+     * disk — used to keep resolved secret values out of the informational cmd
+     * field (see exec.ts buildTmuxAgentCommand, RUSH-1758). Defaults to `cmd`.
+     */
+    metaCmd?: string;
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     socket?: string;

package/dist/lib/tmux/session.js

@@ -106,7 +106,9 @@ export async function createSession(opts) {
         name: opts.name,
         socket,
         createdAt: Date.now(),
-        cmd: opts.cmd,
+        // Persist the redacted copy when provided so resolved secret values in the
+        // launch command never land on disk (RUSH-1758).
+        cmd: opts.metaCmd ?? opts.cmd,
         cwd: opts.cwd,
         source: opts.source ?? 'cli',
         labels: opts.labels,

package/dist/lib/triggers/webhook.d.ts

@@ -99,6 +99,18 @@ export interface DeliveryStore {
     markJob(id: string, jobName: string): void;
 }
 export declare function createMemoryDeliveryStore(maxEntries?: number): DeliveryStore;
+/**
+ * A durable, disk-backed delivery store. Unlike `createMemoryDeliveryStore`,
+ * seen delivery ids survive a process restart and are bounded by AGE, not by a
+ * fixed entry count — so a captured valid delivery cannot re-fire after a
+ * restart or after count-based LRU eviction would have dropped it.
+ *
+ * `retentionMs` doubles as the replay-acceptance window: a delivery whose id is
+ * still on record (younger than the window) is rejected as a duplicate; entries
+ * older than the window are pruned (keeping the file bounded) since a webhook
+ * source will not legitimately retry a delivery that old.
+ */
+export declare function createFileDeliveryStore(filePath: string, retentionMs?: number): DeliveryStore;
 export interface RateLimiter {
     take(key: string): boolean;
 }
@@ -117,6 +129,12 @@ export interface WebhookServerOptions {
     rateLimiter?: RateLimiter;
     rateLimitPerMinute?: number;
     maxBodyBytes?: number;
+    /** Per-IP ingress throttle applied BEFORE the body read (bad-sig flood guard). */
+    ipRateLimiter?: RateLimiter;
+    /** Per-source-IP requests/minute allowed through to the body read. Default 120. */
+    ipRateLimitPerMinute?: number;
+    /** Max concurrent TCP connections the receiver accepts. Default 256. */
+    maxConnections?: number;
 }
 /**
  * Start a localhost-bound receiver. It accepts only:

package/dist/lib/triggers/webhook.js

@@ -12,7 +12,9 @@
  * verification, idempotency, source allow-listing, and rate limiting.
  */
 import * as crypto from 'crypto';
+import * as fs from 'fs';
 import * as http from 'http';
+import * as path from 'path';
 import { jobRunsOnThisDevice, listJobs } from '../routines.js';
 import { executeJobDetached } from '../runner.js';
 /** Read `repository.full_name` (`owner/name`) from a webhook payload, if present. */
@@ -236,6 +238,88 @@ export function createMemoryDeliveryStore(maxEntries = 1000) {
         },
     };
 }
+/**
+ * A durable, disk-backed delivery store. Unlike `createMemoryDeliveryStore`,
+ * seen delivery ids survive a process restart and are bounded by AGE, not by a
+ * fixed entry count — so a captured valid delivery cannot re-fire after a
+ * restart or after count-based LRU eviction would have dropped it.
+ *
+ * `retentionMs` doubles as the replay-acceptance window: a delivery whose id is
+ * still on record (younger than the window) is rejected as a duplicate; entries
+ * older than the window are pruned (keeping the file bounded) since a webhook
+ * source will not legitimately retry a delivery that old.
+ */
+export function createFileDeliveryStore(filePath, retentionMs = 14 * 24 * 60 * 60 * 1000) {
+    const seen = new Map();
+    // Load persisted state (best-effort: a corrupt/missing file starts empty).
+    try {
+        const raw = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        const loadedAt = Date.now();
+        for (const [id, entry] of Object.entries(raw)) {
+            if (typeof entry?.updatedAt !== 'number' || loadedAt - entry.updatedAt > retentionMs)
+                continue;
+            seen.set(id, {
+                complete: entry.complete === true,
+                jobs: new Set(Array.isArray(entry.jobs) ? entry.jobs : []),
+                updatedAt: entry.updatedAt,
+            });
+        }
+    }
+    catch {
+        // no prior file / unreadable — start empty
+    }
+    const persist = () => {
+        const snapshot = {};
+        for (const [id, entry] of seen) {
+            snapshot[id] = { complete: entry.complete, jobs: [...entry.jobs], updatedAt: entry.updatedAt };
+        }
+        try {
+            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            const tmp = `${filePath}.${process.pid}.tmp`;
+            fs.writeFileSync(tmp, JSON.stringify(snapshot), 'utf-8');
+            fs.renameSync(tmp, filePath);
+        }
+        catch {
+            // best-effort durability; an unwritable dir must not crash ingress
+        }
+    };
+    const prune = (now) => {
+        for (const [id, entry] of seen) {
+            if (now - entry.updatedAt > retentionMs)
+                seen.delete(id);
+        }
+    };
+    const touch = (id) => {
+        const now = Date.now();
+        prune(now);
+        let current = seen.get(id);
+        if (!current) {
+            current = { complete: false, jobs: new Set(), updatedAt: now };
+            seen.set(id, current);
+        }
+        current.updatedAt = now;
+        return current;
+    };
+    return {
+        seen: (id) => {
+            const entry = seen.get(id);
+            if (!entry)
+                return false;
+            if (Date.now() - entry.updatedAt > retentionMs)
+                return false;
+            return entry.complete === true;
+        },
+        mark: (id) => {
+            touch(id).complete = true;
+            persist();
+        },
+        completedJobs: (id) => new Set(seen.get(id)?.jobs ?? []),
+        markJob: (id, jobName) => {
+            touch(id).jobs.add(jobName);
+            persist();
+        },
+    };
+}
 export function createMemoryRateLimiter(limit, windowMs) {
     const buckets = new Map();
     return {
@@ -285,6 +369,7 @@ async function readRawBody(req, maxBytes) {
 export function startWebhookServer(options) {
     const deliveryStore = options.deliveryStore ?? createMemoryDeliveryStore();
     const rateLimiter = options.rateLimiter ?? createMemoryRateLimiter(options.rateLimitPerMinute ?? 60, 60_000);
+    const ipRateLimiter = options.ipRateLimiter ?? createMemoryRateLimiter(options.ipRateLimitPerMinute ?? 120, 60_000);
     const maxBodyBytes = options.maxBodyBytes ?? 1024 * 1024;
     const server = http.createServer((req, res) => {
         void (async () => {
@@ -305,6 +390,23 @@ export function startWebhookServer(options) {
                 res.end(JSON.stringify({ ok: false, error: `missing ${source} webhook secret` }));
                 return;
             }
+            // Per-IP throttle + declared-size cap BEFORE the (expensive) body read +
+            // HMAC. A bad-signature flood of 1 MiB POSTs must be rejected without
+            // forcing a full body read and an HMAC per request — the signed-delivery
+            // rate limit further down runs only after a signature passes, so it can't
+            // shed this load on its own.
+            const ip = req.socket.remoteAddress ?? 'unknown';
+            if (!ipRateLimiter.take(ip)) {
+                res.writeHead(429, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: 'rate limit exceeded' }));
+                return;
+            }
+            const declaredLength = Number.parseInt(header(req.headers, 'content-length') ?? '', 10);
+            if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+                res.writeHead(413, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: `payload exceeds ${maxBodyBytes} bytes` }));
+                return;
+            }
             try {
                 const rawBody = await readRawBody(req, maxBodyBytes);
                 const valid = source === 'github'
@@ -357,6 +459,9 @@ export function startWebhookServer(options) {
             }
         })();
     });
+    // Connection cap: bound how many concurrent TCP connections the receiver
+    // will hold open, so a flood cannot exhaust file descriptors / memory.
+    server.maxConnections = options.maxConnections ?? 256;
     server.listen(options.port ?? 0, options.host ?? '127.0.0.1');
     return server;
 }

package/dist/lib/types.d.ts

@@ -515,6 +515,20 @@ export interface PluginManifest {
     userConfig?: PluginUserConfigField[];
     /** Other plugin names this plugin depends on. Missing deps produce a warning. */
     dependencies?: string[];
+    /**
+     * Inline hook configuration (or a path to a hooks JSON file) declared directly
+     * in the manifest, per the official plugin format — an execution surface even
+     * when the plugin ships no `hooks/` directory. Untyped because the shape is a
+     * path string or an inline event map; capability detection only needs to know
+     * whether it is present and non-empty.
+     */
+    hooks?: unknown;
+    /**
+     * Inline MCP-server configuration (or a path to an MCP JSON file) declared
+     * directly in the manifest — an execution surface even when the plugin ships
+     * no `.mcp.json`. Untyped for the same reason as `hooks`.
+     */
+    mcpServers?: unknown;
 }
 /** A plugin found on disk with its parsed manifest and resource inventory. */
 export interface DiscoveredPlugin {
@@ -624,15 +638,28 @@ export interface ExtraRepoConfig {
 export interface Meta {
     agents?: Partial<Record<AgentId, string>>;
     run?: RunConfig;
+    /**
+     * `agents run --lease` config. `secretsBundle` names the keychain secrets bundle
+     * whose provider token (e.g. `HCLOUD_TOKEN`) crabbox uses to reach the cloud API.
+     * When unset, the bundle is resolved by env (`AGENTS_LEASE_SECRETS_BUNDLE`) then
+     * auto-detected (the first bundle that declares a provider token key).
+     */
+    lease?: {
+        secretsBundle?: string;
+    };
     /** macOS secrets-agent config. `policy` is the default prompt policy for
      * bundles without an explicit per-bundle policy: `daily` (the default) asks
      * once per ~7 days, `always` asks every time. `auto` (default on) lets the
      * first real keychain read of a `daily` bundle populate the broker so
-     * concurrent runs read silently — set it `false` to force a prompt on every read. */
+     * concurrent runs read silently — set it `false` to force a prompt on every read.
+     * `holdMs` caps how long an unlocked/auto-cached bundle is held before the next
+     * read re-prompts (default 7 days; e.g. 86400000 for a 24h cap). Clamped to
+     * [1 minute, 30 days]. */
     secrets?: {
         policy?: 'always' | 'daily';
         agent?: {
             auto?: boolean;
+            holdMs?: number;
         };
     };
     /** Spend guardrails (issue #346). User-global caps; project agents.yaml overrides. */
@@ -689,6 +716,13 @@ export interface Meta {
      * are never copied. `inline` hosts carry their own address/user.
      */
     hosts?: Record<string, HostEntry>;
+    /**
+     * Declarative fleet profile (`agents apply` / `ag apply`). Additive to the
+     * schema — project `agents:` version-pins are untouched. Declares which agents
+     * every device should have, which config to sync, and how login propagates.
+     * Full shape in `lib/fleet/types.ts` (FleetManifest).
+     */
+    fleet?: import('./fleet/types.js').FleetManifest;
 }
 /** Persisted agent-host entry in agents.yaml (overlay or inline). */
 export interface HostEntry {

package/dist/lib/usage.d.ts

@@ -1,7 +1,7 @@
-import type { AccountInfo } from './agents.js';
+import { type AccountInfo } from './agents.js';
 import type { AgentId } from './types.js';
 /** Discriminator for usage window types. */
-export type UsageWindowKey = 'session' | 'week' | 'sonnet_week';
+export type UsageWindowKey = 'session' | 'week' | 'sonnet_week' | 'month';
 /** A single rate-limit window with utilization percentage and reset time. */
 export interface UsageWindow {
     key: UsageWindowKey;
@@ -154,7 +154,46 @@ export interface KimiUsagesResponse {
 export declare function normalizeKimiWindows(data: KimiUsagesResponse): UsageWindow[];
 /** Derive a display plan label from Kimi's membership tier or subscription type. */
 export declare function formatKimiPlan(data: KimiUsagesResponse): string | null;
-/** Load Claude OAuth credentials from the system keychain/keyring. */
+/** A single Droid token-rate-limit window from /api/billing/limits. */
+interface DroidLimitWindow {
+    usedPercent?: number | null;
+    windowEnd?: string | null;
+}
+/** Response shape from Factory's billing limits endpoint (subset we render). */
+export interface DroidBillingLimitsResponse {
+    usesTokenRateLimitsBilling?: boolean | null;
+    limits?: {
+        standard?: {
+            fiveHour?: DroidLimitWindow | null;
+            weekly?: DroidLimitWindow | null;
+            monthly?: DroidLimitWindow | null;
+        } | null;
+    } | null;
+}
+/**
+ * Normalize the Factory billing-limits payload into the common UsageWindow
+ * shape. Orgs on the legacy (non token-rate-limit) billing model have no
+ * meaningful windows, so they render nothing — mirrors droid's own gate on
+ * `usesTokenRateLimitsBilling` before it reads `limits.standard`.
+ */
+export declare function normalizeDroidWindows(data: DroidBillingLimitsResponse): UsageWindow[];
+/**
+ * Load a version home's Claude OAuth credential from the two stores Claude Code
+ * uses, tried in order:
+ *
+ *  1. The OS keychain (`getKeychainToken`). Canonical on macOS — Claude Code
+ *     writes the token to the login keychain and we read it via `/usr/bin/security`.
+ *  2. `<home>/.claude/.credentials.json`. On a headless Linux box (the
+ *     `agents view --host <linux>` case) there is no reachable Secret Service, so
+ *     the Claude CLI stores its OAuth token in this plaintext file instead. The
+ *     keychain read above finds nothing on that platform, so we fall back to the
+ *     file. Same wrapped `{ claudeAiOauth }` shape, so one parser handles both.
+ *     Mirrors `readClaudeCredentialsBlob` (cloud/rush.ts), the proven pattern.
+ *
+ * Without step 2 the live usage fetch got no token on Linux, so `agents view`
+ * (run remotely over SSH by `--host`) rendered no usage bars even though the
+ * account + plan — read from the plaintext `.claude.json` — showed fine.
+ */
 export declare function loadClaudeOauth(home?: string): Promise<ClaudeOauthCredentials | null>;
 /**
  * Derive the Keychain service name for a Claude home directory.

package/dist/lib/usage.js

@@ -1,7 +1,8 @@
 /**
- * Usage and rate-limit tracking for Claude and Codex agents.
+ * Usage and rate-limit tracking for Claude, Codex, Kimi, and Droid agents.
  *
- * Fetches live usage data from the Anthropic OAuth API (Claude) or parses
+ * Fetches live usage data from each agent's usage API (Anthropic OAuth for
+ * Claude, Kimi Code /usages, Factory billing limits for Droid) or parses
  * rate-limit events from Codex session logs. Results are normalized into a
  * common UsageSnapshot shape, cached to disk, and rendered as terminal
  * progress bars for the `agents view` command.
@@ -14,6 +15,7 @@ import * as path from 'path';
 import * as readline from 'readline';
 import { promisify } from 'util';
 import chalk from 'chalk';
+import { decodeJwtPayload, decryptDroidAuthPayload } from './agents.js';
 import { walkForFiles } from './fs-walk.js';
 import { getKeychainToken, setKeychainToken, deleteKeychainToken, } from './secrets/index.js';
 import { getCacheDir } from './state.js';
@@ -34,6 +36,7 @@ const CLAUDE_KEYCHAIN_SERVICE = 'Claude Code-credentials';
 const getClaudeUsageCachePath = () => path.join(getCacheDir(), 'claude-usage.json');
 const CACHED_CLAUDE_USAGE_SOURCE_LABEL = 'last seen live account data';
 const KIMI_USAGES_URL = 'https://api.kimi.com/coding/v1/usages';
+const DROID_USAGE_URL = 'https://api.factory.ai/api/billing/limits';
 const COMPACT_BAR_LEN = 5;
 const USAGE_BAR_LEN = 10;
 const FULL = '\u2588';
@@ -47,6 +50,8 @@ export async function getUsageInfo(agentId, options) {
             return getCodexUsageInfo(options);
         case 'kimi':
             return getKimiUsageInfo(options);
+        case 'droid':
+            return getDroidUsageInfo(options);
         default:
             return { snapshot: null, error: null };
     }
@@ -117,13 +122,14 @@ const inFlightRefreshes = new Map();
  */
 export async function getUsageInfoForIdentity(input) {
     const usageKey = getUsageLookupKey(input.info);
-    // Agents whose usage comes from a live network call (Claude, Kimi) go through
-    // the stale-while-revalidate cache below so `agents run`/`agents view` stay off
-    // the network on the hot path. Everything else (Codex reads local session
-    // logs) takes the legacy blocking path. The on-disk cache is shared and keyed
-    // by usageKey, which is namespaced per agent (`claude:org=…`, `kimi:user=…`),
-    // so one cache file holds every account without collision.
-    const usesNetworkUsage = input.agentId === 'claude' || input.agentId === 'kimi';
+    // Agents whose usage comes from a live network call (Claude, Kimi, Droid) go
+    // through the stale-while-revalidate cache below so `agents run`/`agents view`
+    // stay off the network on the hot path. Everything else (Codex reads local
+    // session logs) takes the legacy blocking path. The on-disk cache is shared and
+    // keyed by usageKey, which is namespaced per agent (`claude:org=…`,
+    // `kimi:user=…`, `droid:org=…`), so one cache file holds every account without
+    // collision.
+    const usesNetworkUsage = input.agentId === 'claude' || input.agentId === 'kimi' || input.agentId === 'droid';
     if (!usesNetworkUsage || !usageKey) {
         return getUsageInfo(input.agentId, {
             home: input.home,
@@ -201,6 +207,12 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3) {
         parts.push(chalk.gray(plan.padEnd(planWidth)));
     }
     if (snapshot) {
+        // Compact rows show every BLOCKING window — the same set
+        // deriveUsageStatusFromSnapshot uses for the rate-limited badge — so an
+        // account throttled by its month window (Droid meters on 5h/week/month)
+        // shows the bar that explains why. Claude's Sonnet week is a per-model
+        // sub-limit, not a blocking window; it renders only in the full
+        // per-version usage section.
         const windows = snapshot.windows
             .filter((window) => window.key !== 'sonnet_week')
             .map((window) => `${chalk.gray(`${window.shortLabel}:`)} ${renderCompactUsageBar(window.usedPercent)}`);
@@ -513,6 +525,95 @@ export function formatKimiPlan(data) {
         return null;
     return tail.charAt(0).toUpperCase() + tail.slice(1).toLowerCase();
 }
+/**
+ * Fetch Droid usage via Factory's billing limits API — the same endpoint the
+ * droid CLI polls for its token-limit banner. The WorkOS access token comes
+ * from the locally decrypted ~/.factory/auth.v2.file (the same credential
+ * account identity in agents.ts reads).
+ *
+ * Deliberately NO token refresh, for a sharper reason than Kimi's: WorkOS
+ * refresh tokens are single-use and rotate on every exchange, so refreshing
+ * here would race a concurrently running droid session and can permanently
+ * invalidate the user's login chain. Droid refreshes its own credential when
+ * it runs; if the stored token is expired we skip the live fetch and let the
+ * SWR cache serve the last-seen snapshot.
+ */
+async function getDroidUsageInfo(options) {
+    try {
+        const cred = decryptDroidAuthPayload(options?.home || os.homedir());
+        const accessToken = cred?.access_token;
+        if (typeof accessToken !== 'string' || !accessToken) {
+            return { snapshot: null, error: null };
+        }
+        const exp = decodeJwtPayload(accessToken)?.exp;
+        if (typeof exp === 'number' && Date.now() / 1000 >= exp) {
+            return { snapshot: null, error: null };
+        }
+        const response = await fetch(DROID_USAGE_URL, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/json',
+            },
+            signal: AbortSignal.timeout(5000),
+        });
+        // 401 => revoked/expired token; render nothing rather than a misleading
+        // empty bar.
+        if (!response.ok) {
+            return { snapshot: null, error: null };
+        }
+        const data = await response.json();
+        const windows = normalizeDroidWindows(data);
+        if (windows.length === 0) {
+            return { snapshot: null, error: null };
+        }
+        return {
+            snapshot: {
+                source: 'live',
+                sourceLabel: 'live account data',
+                capturedAt: new Date(),
+                windows,
+            },
+            error: null,
+        };
+    }
+    catch {
+        return { snapshot: null, error: null };
+    }
+}
+/**
+ * Normalize the Factory billing-limits payload into the common UsageWindow
+ * shape. Orgs on the legacy (non token-rate-limit) billing model have no
+ * meaningful windows, so they render nothing — mirrors droid's own gate on
+ * `usesTokenRateLimitsBilling` before it reads `limits.standard`.
+ */
+export function normalizeDroidWindows(data) {
+    if (data.usesTokenRateLimitsBilling !== true)
+        return [];
+    const standard = data.limits?.standard;
+    if (!standard)
+        return [];
+    const windows = [
+        normalizeDroidWindow(standard.fiveHour, 'session', 'Current session', 'S'),
+        normalizeDroidWindow(standard.weekly, 'week', 'Current week', 'W'),
+        normalizeDroidWindow(standard.monthly, 'month', 'Current month', 'M'),
+    ];
+    return windows.filter((window) => window !== null);
+}
+/** Normalize a single Droid billing-limits window. */
+function normalizeDroidWindow(window, key, label, shortLabel) {
+    const usedPercent = normalizePercent(window?.usedPercent);
+    if (usedPercent === null)
+        return null;
+    return {
+        key,
+        label,
+        shortLabel,
+        usedPercent,
+        resetsAt: parseDateValue(window?.windowEnd),
+        windowMinutes: inferWindowMinutes(key),
+    };
+}
 /** Collect Codex JSONL session files sorted newest-first. */
 function collectCodexSessionFiles(home) {
     const base = home || os.homedir();
@@ -609,19 +710,16 @@ function normalizeClaudeWindow(window, key, label, shortLabel) {
         windowMinutes: inferWindowMinutes(key),
     };
 }
-/** Load Claude OAuth credentials from the system keychain/keyring. */
-export async function loadClaudeOauth(home) {
-    // Windows not yet supported
-    if (process.platform !== 'darwin' && process.platform !== 'linux') {
-        return null;
-    }
+/**
+ * Parse a wrapped Claude OAuth payload — the `{ claudeAiOauth, organizationUuid }`
+ * shape written by BOTH the macOS Keychain item and the Linux `.credentials.json`
+ * file — into our credential struct. Returns null when there is no usable access
+ * token. Never throws (malformed JSON => null).
+ */
+function parseClaudeOauthPayload(raw) {
     try {
-        const service = getClaudeKeychainService(home);
-        const stdout = getKeychainToken(service);
-        const payload = JSON.parse(stdout.trim());
-        if (typeof payload?.claudeAiOauth?.accessToken !== 'string')
-            return null;
-        if (!payload.claudeAiOauth) {
+        const payload = JSON.parse(raw.trim());
+        if (!payload?.claudeAiOauth || typeof payload.claudeAiOauth.accessToken !== 'string') {
             return null;
         }
         return {
@@ -633,6 +731,48 @@ export async function loadClaudeOauth(home) {
         return null;
     }
 }
+/**
+ * Load a version home's Claude OAuth credential from the two stores Claude Code
+ * uses, tried in order:
+ *
+ *  1. The OS keychain (`getKeychainToken`). Canonical on macOS — Claude Code
+ *     writes the token to the login keychain and we read it via `/usr/bin/security`.
+ *  2. `<home>/.claude/.credentials.json`. On a headless Linux box (the
+ *     `agents view --host <linux>` case) there is no reachable Secret Service, so
+ *     the Claude CLI stores its OAuth token in this plaintext file instead. The
+ *     keychain read above finds nothing on that platform, so we fall back to the
+ *     file. Same wrapped `{ claudeAiOauth }` shape, so one parser handles both.
+ *     Mirrors `readClaudeCredentialsBlob` (cloud/rush.ts), the proven pattern.
+ *
+ * Without step 2 the live usage fetch got no token on Linux, so `agents view`
+ * (run remotely over SSH by `--host`) rendered no usage bars even though the
+ * account + plan — read from the plaintext `.claude.json` — showed fine.
+ */
+export async function loadClaudeOauth(home) {
+    // The OS keychain/keyring step is macOS/Linux-only. Windows skips straight
+    // to the .credentials.json fallback — the Claude CLI has no keychain
+    // integration there and stores its OAuth token in that file too.
+    if (process.platform === 'darwin' || process.platform === 'linux') {
+        try {
+            const fromKeychain = parseClaudeOauthPayload(getKeychainToken(getClaudeKeychainService(home)));
+            if (fromKeychain)
+                return fromKeychain;
+        }
+        catch {
+            // No keychain item, or no reachable keyring (headless Linux) — fall through.
+        }
+    }
+    const credsPath = path.join(home ?? os.homedir(), '.claude', '.credentials.json');
+    try {
+        if (fs.existsSync(credsPath)) {
+            return parseClaudeOauthPayload(fs.readFileSync(credsPath, 'utf-8'));
+        }
+    }
+    catch {
+        // Unreadable file — treat as not signed in.
+    }
+    return null;
+}
 /**
  * Save Claude OAuth credentials to the system keychain/keyring.
  * Reads the existing payload, merges the new OAuth fields, and writes back.
@@ -895,6 +1035,8 @@ function inferWindowMinutes(key) {
         case 'week':
         case 'sonnet_week':
             return 10080;
+        case 'month':
+            return 43200;
     }
 }
 /** Parse a date value from a number (epoch seconds or ms) or ISO string. */

package/dist/lib/versions.js

@@ -30,7 +30,7 @@ import { listResources } from './resources.js';
 import { VERSION_RE, compareVersions } from './agent-spec/primitives.js';
 import { AGENTS, agentConfigDirName, getAccountEmail, resolveAgentName, formatAgentError, findInPath, isSelfUpdatingAgent } from './agents.js';
 import { discoverPermissionGroups, getActivePermissionPresetName, readPermissionPresetRecipe, PERMISSION_PRESET_ENV_VAR } from './permissions.js';
-import { parseMcpServerConfig } from './mcp.js';
+import { parseMcpServerConfig, isProjectMcpTrusted } from './mcp.js';
 import { createVersionedAlias, removeVersionedAlias, getConfigSymlinkVersion, ensureClaudeInsideSymlink } from './shims.js';
 import { importInstallScriptBinary } from './import.js';
 import { IS_WINDOWS, composeWin32CommandLine } from './platform/index.js';
@@ -2511,20 +2511,23 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
     // For Claude/Codex: uses CLI commands (claude mcp add, codex mcp add)
     // For others: edits config files directly
     //
-    // Mirror the hooks defense: exclude project-scoped MCPs from the sync. An
-    // MCP server is an executable invoked under the agent's authority, so a
-    // cloned public repo's .agents/mcp/foo.yaml could install an arbitrary
-    // command. We pre-compute the set of project-scoped names and drop them
-    // before handing the list to installMcpServers. (The deeper helper-side
-    // dedup in lib/mcp.ts still lets a project entry shadow a same-named
-    // user entry, so name-collision shadowing is not fully closed here —
-    // tracked separately for a follow-up in lib/mcp.ts.)
-    const projectScopedMcpNames = new Set(getScopedMcpResources(cwd).filter(r => r.scope === 'project').map(r => r.name));
+    // Mirror the hooks defense: an MCP server is an executable invoked under the
+    // agent's authority, so a cloned public repo's .agents/mcp/foo.yaml could
+    // install an arbitrary command (RUSH-1776). Project-scoped MCPs are UNTRUSTED
+    // by default — drop them before handing the list to installMcpServers unless
+    // the user has explicitly trusted this project (`agents mcp trust`). The
+    // register/spawn choke in lib/mcp.ts (getMcpServersByName) enforces the same
+    // trust gate and drops untrusted project entries before dedup, so a project
+    // entry can no longer shadow a same-named user entry either.
+    const projectMcpTrusted = projectAgentsDir ? isProjectMcpTrusted(projectAgentsDir) : false;
+    const untrustedProjectMcpNames = new Set(projectMcpTrusted
+        ? []
+        : getScopedMcpResources(cwd).filter(r => r.scope === 'project').map(r => r.name));
     const mcpWriter = getWriter('mcp', agent);
     const mcpToSyncAll = selection
         ? resolveSelection(selection.mcp, available.mcp)
         : (mcpWriter ? available.mcp : []);
-    const mcpToSync = mcpToSyncAll.filter(n => !projectScopedMcpNames.has(n));
+    const mcpToSync = mcpToSyncAll.filter(n => !untrustedProjectMcpNames.has(n));
     if (mcpToSync.length > 0 && mcpWriter) {
         const r = mcpWriter.write({ version, versionHome, selection: mcpToSync, cwd });
         result.mcp = r.synced;