@phnx-labs/agents-cli 1.20.64 → 1.20.65

package/dist/lib/session/sync/config.js

@@ -3,7 +3,7 @@
  * machine's stable identity. Credentials come from the `r2.backups` secrets
  * bundle (OS keychain on macOS, libsecret on Linux) — never from env or disk.
  */
-import { readAndResolveBundleEnv } from '../../secrets/bundles.js';
+import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../../secrets/bundles.js';
 /** Secrets bundle holding the R2 credentials. */
 export const SYNC_BUNDLE = 'r2.backups';
 /**
@@ -12,7 +12,13 @@ export const SYNC_BUNDLE = 'r2.backups';
  * without real credentials (no silent fallback).
  */
 function resolveR2Config() {
-    const { env } = readAndResolveBundleEnv(SYNC_BUNDLE, { caller: 'sessions-sync' });
+    // The daemon monitor loop is headless by construction (no TTY, ever), so
+    // isHeadlessSecretsContext() is true here and this resolves broker-only — a
+    // broker miss can never pop an unattended Touch ID sheet on the user's screen
+    // (same rationale as daemon.ts readDaemonClaudeOAuthToken). Using the shared
+    // predicate rather than a literal keeps it consistent with the other callers
+    // and lets any interactive caller of loadR2Config still prompt.
+    const { env } = readAndResolveBundleEnv(SYNC_BUNDLE, { caller: 'sessions-sync', agentOnly: isHeadlessSecretsContext() });
     const accountId = env.R2_ACCOUNT_ID?.trim();
     const bucket = env.R2_BUCKET_NAME?.trim();
     const accessKeyId = env.R2_ACCESS_KEY_ID?.trim();

package/dist/lib/session/types.d.ts

@@ -41,6 +41,29 @@ export interface SessionAttachment {
     mediaType: string;
     sizeBytes?: number;
 }
+/** One checklist item, as Claude's `TodoWrite` (`content`) or Codex's `update_plan` (`step`) emits it. */
+export interface TodoItem {
+    content: string;
+    status: 'pending' | 'in_progress' | 'completed';
+    /** Present-continuous label shown while this item is the active step. */
+    activeForm?: string;
+}
+/**
+ * Live plan progress derived from the most recent checklist write in the transcript
+ * (Claude `TodoWrite` / Codex `update_plan`, RUSH-1380). Lets consumers show "N/M
+ * done" + the current step for any session — including remote / device-dispatched
+ * agents that carry no local tool-call stream — instead of only a coarse
+ * working/idle verb.
+ */
+export interface TodoProgress {
+    items: TodoItem[];
+    /** Count of completed items. */
+    done: number;
+    /** Total items. */
+    total: number;
+    /** The in-progress item's activeForm (falls back to its content). The live step. */
+    activeForm?: string;
+}
 /** Metadata attached when a session was spawned by `agents teams`. */
 export interface TeamOrigin {
     /** Teammate name if set, otherwise first 8 chars of the agent UUID. */
@@ -116,6 +139,13 @@ export interface SessionMeta {
      * recover the plan text — the CLI now carries it on the metadata row.
      */
     plan?: string;
+    /**
+     * Live plan progress from the most recent checklist write (Claude `TodoWrite`
+     * / Codex `update_plan`, RUSH-1503). Populated on `agents sessions <id> --json`
+     * from the state engine so the Factory panel reads the CLI's computed checklist
+     * instead of re-parsing the transcript. Absent when the session wrote no list.
+     */
+    todos?: TodoProgress;
     /**
      * True when the session was spawned programmatically (SDK entrypoint) rather
      * than by a human at the Claude CLI. Captured at scan time from the JSONL

package/dist/lib/ssh-tunnel.d.ts

@@ -49,6 +49,8 @@ export declare const REMOTE_HELPER_PORT = 8765;
 export declare const REMOTE_TASK_NAME = "AgentsComputerHelper";
 /** Basename of the cross-published exe under native/computer-win/dist. */
 export declare const WIN_HELPER_EXE = "computer-helper-win.exe";
+/** Basename of the daemon's shared-secret token file under %LOCALAPPDATA%\agents. */
+export declare const WIN_HELPER_TOKEN_FILE = "helper-token";
 /**
  * Locate a locally built Windows daemon exe — a repo-checkout build output from
  * `scripts/build-win.sh`, or one bundled next to the package. Local paths are
@@ -101,6 +103,16 @@ export declare function remoteStatePath(device: string): string;
 export declare function readRemoteState(device: string): RemoteTunnelState | null;
 export declare function writeRemoteState(state: RemoteTunnelState): void;
 export declare function clearRemoteState(device: string): void;
+/**
+ * Local file holding the shared-secret token for a device's helper daemon.
+ * Written at `setup --host` (0600), read at `start --host` so the RPC client
+ * authenticates. The remote daemon reads the same value from its own
+ * `--token-file`; the CLI is the source of truth and never round-trips it back.
+ */
+export declare function helperTokenPath(device: string): string;
+export declare function readHelperToken(device: string): string | null;
+export declare function writeHelperToken(device: string, token: string): void;
+export declare function clearHelperToken(device: string): void;
 /** Resolve a registered device to its ssh pieces, or throw a clear error. */
 export declare function resolveRemoteDevice(name: string): Promise<{
     device: DeviceProfile;
@@ -123,7 +135,13 @@ export declare function buildVerifyPushScript(remotePath: string, expectedBytes:
  * survives ssh disconnect — the same rationale as the browser WMI launch. The
  * task is started immediately so the caller need not log out/in.
  */
-export declare function buildRegisterTaskScript(port: number, taskName: string): string;
+/**
+ * PowerShell that writes the shared-secret token under %LOCALAPPDATA%\agents
+ * with an owner-only ACL (inheritance removed, read granted only to the current
+ * user) and echoes the resolved path so the caller can pass it to `--token-file`.
+ */
+export declare function buildWriteTokenScript(token: string): string;
+export declare function buildRegisterTaskScript(port: number, taskName: string, tokenPath: string): string;
 /** PowerShell that unregisters the task and stops any running daemon process. */
 export declare function buildUnregisterTaskScript(taskName: string): string;
 /** Convert a Windows path returned by PowerShell into the scp/SFTP path form. */

package/dist/lib/ssh-tunnel.js

@@ -103,6 +103,8 @@ export const REMOTE_HELPER_PORT = 8765;
 export const REMOTE_TASK_NAME = 'AgentsComputerHelper';
 /** Basename of the cross-published exe under native/computer-win/dist. */
 export const WIN_HELPER_EXE = 'computer-helper-win.exe';
+/** Basename of the daemon's shared-secret token file under %LOCALAPPDATA%\agents. */
+export const WIN_HELPER_TOKEN_FILE = 'helper-token';
 /**
  * Locate a locally built Windows daemon exe — a repo-checkout build output from
  * `scripts/build-win.sh`, or one bundled next to the package. Local paths are
@@ -234,6 +236,37 @@ export function clearRemoteState(device) {
         /* already gone */
     }
 }
+/**
+ * Local file holding the shared-secret token for a device's helper daemon.
+ * Written at `setup --host` (0600), read at `start --host` so the RPC client
+ * authenticates. The remote daemon reads the same value from its own
+ * `--token-file`; the CLI is the source of truth and never round-trips it back.
+ */
+export function helperTokenPath(device) {
+    return path.join(remoteStateDir(), `${device}.token`);
+}
+export function readHelperToken(device) {
+    try {
+        const t = fs.readFileSync(helperTokenPath(device), 'utf-8').trim();
+        return t.length > 0 ? t : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeHelperToken(device, token) {
+    const dir = remoteStateDir();
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(helperTokenPath(device), token, { mode: 0o600 });
+}
+export function clearHelperToken(device) {
+    try {
+        fs.unlinkSync(helperTokenPath(device));
+    }
+    catch {
+        /* already gone */
+    }
+}
 /** Resolve a registered device to its ssh pieces, or throw a clear error. */
 export async function resolveRemoteDevice(name) {
     const device = await getDevice(name);
@@ -284,10 +317,26 @@ export function buildVerifyPushScript(remotePath, expectedBytes) {
  * survives ssh disconnect — the same rationale as the browser WMI launch. The
  * task is started immediately so the caller need not log out/in.
  */
-export function buildRegisterTaskScript(port, taskName) {
+/**
+ * PowerShell that writes the shared-secret token under %LOCALAPPDATA%\agents
+ * with an owner-only ACL (inheritance removed, read granted only to the current
+ * user) and echoes the resolved path so the caller can pass it to `--token-file`.
+ */
+export function buildWriteTokenScript(token) {
+    return [
+        `$dir = Join-Path $env:LOCALAPPDATA 'agents'`,
+        `New-Item -ItemType Directory -Force -Path $dir | Out-Null`,
+        `$tok = Join-Path $dir '${WIN_HELPER_TOKEN_FILE}'`,
+        `Set-Content -LiteralPath $tok -Value ${psSingleQuote(token)} -NoNewline -Encoding ascii`,
+        `icacls $tok /inheritance:r /grant:r ("$($env:USERNAME):(R)") | Out-Null`,
+        `Write-Output $tok`,
+    ].join('; ');
+}
+export function buildRegisterTaskScript(port, taskName, tokenPath) {
+    const argument = `--port ${port} --token-file "${tokenPath}"`;
     return [
         `$exe = Join-Path (Join-Path $env:LOCALAPPDATA 'agents') '${WIN_HELPER_EXE}'`,
-        `$action = New-ScheduledTaskAction -Execute $exe -Argument '--port ${port}'`,
+        `$action = New-ScheduledTaskAction -Execute $exe -Argument ${psSingleQuote(argument)}`,
         `$trigger = New-ScheduledTaskTrigger -AtLogOn`,
         `$principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive -RunLevel Highest`,
         `$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero)`,
@@ -369,13 +418,28 @@ export async function setupRemoteHelper(name) {
     if (verify.code !== 0) {
         throw new Error(`verifying helper exe on '${name}' failed (exit ${verify.code ?? 'null'}): ${verify.stderr.trim() || verify.stdout.trim()}`);
     }
-    // Register + start the LOGON task.
-    const reg = sshExec(target, encodePowerShell(buildRegisterTaskScript(REMOTE_HELPER_PORT, REMOTE_TASK_NAME)), {
+    // Provision the auth token: generate it locally, write it on the remote with
+    // an owner-only ACL, and register the task with --token-file. The daemon now
+    // refuses to start without a token, so a token-less (open-to-any-local-process)
+    // daemon can no longer be stood up through the CLI.
+    const token = generateToken();
+    const tokWrite = sshExec(target, encodePowerShell(buildWriteTokenScript(token)), { timeoutMs: 60_000 });
+    if (tokWrite.code !== 0) {
+        throw new Error(`writing helper token on '${name}' failed (exit ${tokWrite.code ?? 'null'}): ${tokWrite.stderr.trim() || tokWrite.stdout.trim()}`);
+    }
+    const remoteTokenPath = tokWrite.stdout.trim().split(/\r?\n/).filter(Boolean).at(-1);
+    if (!remoteTokenPath) {
+        throw new Error(`writing helper token on '${name}' did not return a destination path`);
+    }
+    // Register + start the LOGON task, pointing it at the token file.
+    const reg = sshExec(target, encodePowerShell(buildRegisterTaskScript(REMOTE_HELPER_PORT, REMOTE_TASK_NAME, remoteTokenPath)), {
         timeoutMs: 60_000,
     });
     if (reg.code !== 0) {
         throw new Error(`registering scheduled task on '${name}' failed (exit ${reg.code ?? 'null'}): ${reg.stderr.trim() || reg.stdout.trim()}`);
     }
+    // Persist the token locally so `start --host` authenticates to the daemon.
+    writeHelperToken(name, token);
     return { target, taskName: REMOTE_TASK_NAME };
 }
 /** Reserve a free local TCP port by binding :0 and reading the assigned port. */
@@ -403,9 +467,17 @@ export async function startRemoteTunnel(name) {
     const tunnelPid = tunnel.pid ?? 0;
     // Verify the daemon answers through the tunnel before we record it. This is
     // the real end-to-end check: tunnel up + daemon listening + RPC round-trips.
-    const token = null; // tunnel-gated; the daemon runs token-less
+    // The daemon now requires a token, so the probe must authenticate with the one
+    // provisioned at `setup`. A missing token means setup predates auth — guide
+    // the user to re-run it rather than silently failing the RPC.
+    const token = readHelperToken(name);
     const prevTcp = process.env.COMPUTER_HELPER_TCP;
+    const prevTok = process.env.COMPUTER_HELPER_TOKEN;
     process.env.COMPUTER_HELPER_TCP = `127.0.0.1:${localPort}`;
+    if (token)
+        process.env.COMPUTER_HELPER_TOKEN = token;
+    else
+        delete process.env.COMPUTER_HELPER_TOKEN;
     const client = openComputerClient();
     let ok = false;
     let probeErr = '';
@@ -424,6 +496,10 @@ export async function startRemoteTunnel(name) {
             delete process.env.COMPUTER_HELPER_TCP;
         else
             process.env.COMPUTER_HELPER_TCP = prevTcp;
+        if (prevTok === undefined)
+            delete process.env.COMPUTER_HELPER_TOKEN;
+        else
+            process.env.COMPUTER_HELPER_TOKEN = prevTok;
     }
     if (!ok) {
         try {
@@ -431,8 +507,10 @@ export async function startRemoteTunnel(name) {
                 process.kill(tunnelPid);
         }
         catch { /* gone */ }
-        throw new Error(`tunnel to '${name}' opened but the daemon did not answer (${probeErr}). ` +
-            `Is it installed? Run: agents computer setup --host ${name}`);
+        const hint = token
+            ? `Is it installed? Run: agents computer setup --host ${name}`
+            : `No auth token on record for '${name}' — re-run: agents computer setup --host ${name}`;
+        throw new Error(`tunnel to '${name}' opened but the daemon did not answer (${probeErr}). ${hint}`);
     }
     const state = {
         device: name,
@@ -473,6 +551,7 @@ export async function stopRemoteHelper(name) {
         /* device gone / offline — local teardown still succeeds */
     }
     clearRemoteState(name);
+    clearHelperToken(name);
     return { tunnelKilled, taskRemoved };
 }
 /**

package/dist/lib/startup/command-registry.d.ts

@@ -43,6 +43,7 @@ export declare const loadImport: ModuleLoader;
 export declare const loadPackages: ModuleLoader;
 export declare const loadDaemon: ModuleLoader;
 export declare const loadRoutines: ModuleLoader;
+export declare const loadMonitors: ModuleLoader;
 export declare const loadRun: ModuleLoader;
 export declare const loadDefaults: ModuleLoader;
 export declare const loadModels: ModuleLoader;
@@ -50,6 +51,7 @@ export declare const loadPrune: ModuleLoader;
 export declare const loadTrash: ModuleLoader;
 export declare const loadRestore: ModuleLoader;
 export declare const loadDoctor: ModuleLoader;
+export declare const loadApply: ModuleLoader;
 export declare const loadCheck: ModuleLoader;
 export declare const loadStatus: ModuleLoader;
 export declare const loadProfiles: ModuleLoader;

package/dist/lib/startup/command-registry.js

@@ -21,6 +21,7 @@ export const loadImport = async () => (await import('../../commands/import.js'))
 export const loadPackages = async () => (await import('../../commands/packages.js')).registerPackagesCommands;
 export const loadDaemon = async () => (await import('../../commands/daemon.js')).registerDaemonCommands;
 export const loadRoutines = async () => (await import('../../commands/routines.js')).registerRoutinesCommands;
+export const loadMonitors = async () => (await import('../../commands/monitors.js')).registerMonitorsCommands;
 export const loadRun = async () => (await import('../../commands/exec.js')).registerRunCommand;
 export const loadDefaults = async () => (await import('../../commands/defaults.js')).registerDefaultsCommands;
 export const loadModels = async () => (await import('../../commands/models.js')).registerModelsCommand;
@@ -28,6 +29,7 @@ export const loadPrune = async () => (await import('../../commands/prune.js')).r
 export const loadTrash = async () => (await import('../../commands/trash.js')).registerTrashCommands;
 export const loadRestore = async () => (await import('../../commands/trash.js')).registerRestoreCommand;
 export const loadDoctor = async () => (await import('../../commands/doctor.js')).registerDoctorCommand;
+export const loadApply = async () => (await import('../../commands/apply.js')).registerApplyCommand;
 export const loadCheck = async () => (await import('../../commands/check.js')).registerCheckCommand;
 export const loadStatus = async () => (await import('../../commands/status.js')).registerStatusCommand;
 export const loadProfiles = async () => (await import('../../commands/profiles.js')).registerProfilesCommands;
@@ -121,12 +123,14 @@ export const COMMAND_LOADERS = {
     install: [loadPackages],
     daemon: [loadDaemon],
     routines: [loadRoutines],
+    monitors: [loadMonitors],
     run: [loadRun],
     defaults: [loadDefaults],
     models: [loadModels],
     trash: [loadTrash],
     restore: [loadRestore],
     doctor: [loadDoctor],
+    apply: [loadApply],
     check: [loadCheck],
     status: [loadStatus],
     profiles: [loadProfiles],

package/dist/lib/state.d.ts

@@ -128,6 +128,11 @@ export declare function getSystemRoutinesDir(): string;
 export declare function getProjectRoutinesDir(cwd?: string): string | null;
 /** Path to routine execution logs (~/.agents/.history/runs/). */
 export declare function getRunsDir(): string;
+/** Path to monitor YAML definitions (~/.agents/monitors/). */
+export declare function getMonitorsDir(): string;
+/** Path to the durable per-monitor state-diff store + fire history
+ * (~/.agents/.history/monitors/). */
+export declare function getMonitorsHistoryDir(): string;
 /** Root for per-agent mailboxes (~/.agents/.history/mailbox/). */
 export declare function getMailboxRootDir(): string;
 /** Root for open-block feed records (~/.agents/.history/feed/). */

package/dist/lib/state.js

@@ -83,12 +83,19 @@ const HISTORY_DIR = path.join(USER_AGENTS_DIR, '.history');
 const CACHE_DIR = path.join(USER_AGENTS_DIR, '.cache');
 // Top-level user dirs (config/definitions only — runtime moves into .history/.cache).
 const ROUTINES_DIR = path.join(USER_AGENTS_DIR, 'routines');
+// Monitor definitions (event-triggered watchers). Sibling of ROUTINES_DIR: a
+// monitor is a routine whose trigger is a watched source instead of a clock.
+const MONITORS_DIR = path.join(USER_AGENTS_DIR, 'monitors');
 const TEAMS_DIR = path.join(USER_AGENTS_DIR, 'teams');
 // History bucket (durable).
 const SESSIONS_DIR = path.join(HISTORY_DIR, 'sessions');
 const SESSIONS_DB_PATH = path.join(SESSIONS_DIR, 'sessions.db');
 const VERSIONS_DIR = path.join(HISTORY_DIR, 'versions');
 const RUNS_DIR = path.join(HISTORY_DIR, 'runs');
+// Durable per-monitor state-diff store + fire history (last-seen value/hash,
+// fires/<id>/). Sibling of RUNS_DIR — the native diff store that replaces the
+// hand-rolled markdown memory files monitors used to need.
+const MONITORS_HISTORY_DIR = path.join(HISTORY_DIR, 'monitors');
 const TEAMS_AGENTS_DIR = path.join(HISTORY_DIR, 'teams', 'agents');
 const BACKUPS_DIR = path.join(HISTORY_DIR, 'backups');
 const TRASH_DIR = path.join(HISTORY_DIR, 'trash');
@@ -324,6 +331,11 @@ export function getProjectRoutinesDir(cwd = process.cwd()) {
 }
 /** Path to routine execution logs (~/.agents/.history/runs/). */
 export function getRunsDir() { return RUNS_DIR; }
+/** Path to monitor YAML definitions (~/.agents/monitors/). */
+export function getMonitorsDir() { return MONITORS_DIR; }
+/** Path to the durable per-monitor state-diff store + fire history
+ * (~/.agents/.history/monitors/). */
+export function getMonitorsHistoryDir() { return MONITORS_HISTORY_DIR; }
 /** Root for per-agent mailboxes (~/.agents/.history/mailbox/). */
 export function getMailboxRootDir() { return MAILBOX_DIR; }
 /** Root for open-block feed records (~/.agents/.history/feed/). */

package/dist/lib/tmux/session.d.ts

@@ -33,6 +33,13 @@ export interface SessionMeta {
 export interface CreateSessionOptions {
     name: string;
     cmd?: string;
+    /**
+     * Redacted copy of `cmd` to persist in SessionMeta.cmd instead of the real
+     * command. When set, `cmd` is still executed but only `metaCmd` is written to
+     * disk — used to keep resolved secret values out of the informational cmd
+     * field (see exec.ts buildTmuxAgentCommand, RUSH-1758). Defaults to `cmd`.
+     */
+    metaCmd?: string;
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     socket?: string;

package/dist/lib/tmux/session.js

@@ -106,7 +106,9 @@ export async function createSession(opts) {
         name: opts.name,
         socket,
         createdAt: Date.now(),
-        cmd: opts.cmd,
+        // Persist the redacted copy when provided so resolved secret values in the
+        // launch command never land on disk (RUSH-1758).
+        cmd: opts.metaCmd ?? opts.cmd,
         cwd: opts.cwd,
         source: opts.source ?? 'cli',
         labels: opts.labels,

package/dist/lib/triggers/webhook.d.ts

@@ -99,6 +99,18 @@ export interface DeliveryStore {
     markJob(id: string, jobName: string): void;
 }
 export declare function createMemoryDeliveryStore(maxEntries?: number): DeliveryStore;
+/**
+ * A durable, disk-backed delivery store. Unlike `createMemoryDeliveryStore`,
+ * seen delivery ids survive a process restart and are bounded by AGE, not by a
+ * fixed entry count — so a captured valid delivery cannot re-fire after a
+ * restart or after count-based LRU eviction would have dropped it.
+ *
+ * `retentionMs` doubles as the replay-acceptance window: a delivery whose id is
+ * still on record (younger than the window) is rejected as a duplicate; entries
+ * older than the window are pruned (keeping the file bounded) since a webhook
+ * source will not legitimately retry a delivery that old.
+ */
+export declare function createFileDeliveryStore(filePath: string, retentionMs?: number): DeliveryStore;
 export interface RateLimiter {
     take(key: string): boolean;
 }
@@ -117,6 +129,12 @@ export interface WebhookServerOptions {
     rateLimiter?: RateLimiter;
     rateLimitPerMinute?: number;
     maxBodyBytes?: number;
+    /** Per-IP ingress throttle applied BEFORE the body read (bad-sig flood guard). */
+    ipRateLimiter?: RateLimiter;
+    /** Per-source-IP requests/minute allowed through to the body read. Default 120. */
+    ipRateLimitPerMinute?: number;
+    /** Max concurrent TCP connections the receiver accepts. Default 256. */
+    maxConnections?: number;
 }
 /**
  * Start a localhost-bound receiver. It accepts only:

package/dist/lib/triggers/webhook.js

@@ -12,7 +12,9 @@
  * verification, idempotency, source allow-listing, and rate limiting.
  */
 import * as crypto from 'crypto';
+import * as fs from 'fs';
 import * as http from 'http';
+import * as path from 'path';
 import { jobRunsOnThisDevice, listJobs } from '../routines.js';
 import { executeJobDetached } from '../runner.js';
 /** Read `repository.full_name` (`owner/name`) from a webhook payload, if present. */
@@ -236,6 +238,88 @@ export function createMemoryDeliveryStore(maxEntries = 1000) {
         },
     };
 }
+/**
+ * A durable, disk-backed delivery store. Unlike `createMemoryDeliveryStore`,
+ * seen delivery ids survive a process restart and are bounded by AGE, not by a
+ * fixed entry count — so a captured valid delivery cannot re-fire after a
+ * restart or after count-based LRU eviction would have dropped it.
+ *
+ * `retentionMs` doubles as the replay-acceptance window: a delivery whose id is
+ * still on record (younger than the window) is rejected as a duplicate; entries
+ * older than the window are pruned (keeping the file bounded) since a webhook
+ * source will not legitimately retry a delivery that old.
+ */
+export function createFileDeliveryStore(filePath, retentionMs = 14 * 24 * 60 * 60 * 1000) {
+    const seen = new Map();
+    // Load persisted state (best-effort: a corrupt/missing file starts empty).
+    try {
+        const raw = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        const loadedAt = Date.now();
+        for (const [id, entry] of Object.entries(raw)) {
+            if (typeof entry?.updatedAt !== 'number' || loadedAt - entry.updatedAt > retentionMs)
+                continue;
+            seen.set(id, {
+                complete: entry.complete === true,
+                jobs: new Set(Array.isArray(entry.jobs) ? entry.jobs : []),
+                updatedAt: entry.updatedAt,
+            });
+        }
+    }
+    catch {
+        // no prior file / unreadable — start empty
+    }
+    const persist = () => {
+        const snapshot = {};
+        for (const [id, entry] of seen) {
+            snapshot[id] = { complete: entry.complete, jobs: [...entry.jobs], updatedAt: entry.updatedAt };
+        }
+        try {
+            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            const tmp = `${filePath}.${process.pid}.tmp`;
+            fs.writeFileSync(tmp, JSON.stringify(snapshot), 'utf-8');
+            fs.renameSync(tmp, filePath);
+        }
+        catch {
+            // best-effort durability; an unwritable dir must not crash ingress
+        }
+    };
+    const prune = (now) => {
+        for (const [id, entry] of seen) {
+            if (now - entry.updatedAt > retentionMs)
+                seen.delete(id);
+        }
+    };
+    const touch = (id) => {
+        const now = Date.now();
+        prune(now);
+        let current = seen.get(id);
+        if (!current) {
+            current = { complete: false, jobs: new Set(), updatedAt: now };
+            seen.set(id, current);
+        }
+        current.updatedAt = now;
+        return current;
+    };
+    return {
+        seen: (id) => {
+            const entry = seen.get(id);
+            if (!entry)
+                return false;
+            if (Date.now() - entry.updatedAt > retentionMs)
+                return false;
+            return entry.complete === true;
+        },
+        mark: (id) => {
+            touch(id).complete = true;
+            persist();
+        },
+        completedJobs: (id) => new Set(seen.get(id)?.jobs ?? []),
+        markJob: (id, jobName) => {
+            touch(id).jobs.add(jobName);
+            persist();
+        },
+    };
+}
 export function createMemoryRateLimiter(limit, windowMs) {
     const buckets = new Map();
     return {
@@ -285,6 +369,7 @@ async function readRawBody(req, maxBytes) {
 export function startWebhookServer(options) {
     const deliveryStore = options.deliveryStore ?? createMemoryDeliveryStore();
     const rateLimiter = options.rateLimiter ?? createMemoryRateLimiter(options.rateLimitPerMinute ?? 60, 60_000);
+    const ipRateLimiter = options.ipRateLimiter ?? createMemoryRateLimiter(options.ipRateLimitPerMinute ?? 120, 60_000);
     const maxBodyBytes = options.maxBodyBytes ?? 1024 * 1024;
     const server = http.createServer((req, res) => {
         void (async () => {
@@ -305,6 +390,23 @@ export function startWebhookServer(options) {
                 res.end(JSON.stringify({ ok: false, error: `missing ${source} webhook secret` }));
                 return;
             }
+            // Per-IP throttle + declared-size cap BEFORE the (expensive) body read +
+            // HMAC. A bad-signature flood of 1 MiB POSTs must be rejected without
+            // forcing a full body read and an HMAC per request — the signed-delivery
+            // rate limit further down runs only after a signature passes, so it can't
+            // shed this load on its own.
+            const ip = req.socket.remoteAddress ?? 'unknown';
+            if (!ipRateLimiter.take(ip)) {
+                res.writeHead(429, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: 'rate limit exceeded' }));
+                return;
+            }
+            const declaredLength = Number.parseInt(header(req.headers, 'content-length') ?? '', 10);
+            if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+                res.writeHead(413, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: `payload exceeds ${maxBodyBytes} bytes` }));
+                return;
+            }
             try {
                 const rawBody = await readRawBody(req, maxBodyBytes);
                 const valid = source === 'github'
@@ -357,6 +459,9 @@ export function startWebhookServer(options) {
             }
         })();
     });
+    // Connection cap: bound how many concurrent TCP connections the receiver
+    // will hold open, so a flood cannot exhaust file descriptors / memory.
+    server.maxConnections = options.maxConnections ?? 256;
     server.listen(options.port ?? 0, options.host ?? '127.0.0.1');
     return server;
 }

package/dist/lib/types.d.ts

@@ -515,6 +515,20 @@ export interface PluginManifest {
     userConfig?: PluginUserConfigField[];
     /** Other plugin names this plugin depends on. Missing deps produce a warning. */
     dependencies?: string[];
+    /**
+     * Inline hook configuration (or a path to a hooks JSON file) declared directly
+     * in the manifest, per the official plugin format — an execution surface even
+     * when the plugin ships no `hooks/` directory. Untyped because the shape is a
+     * path string or an inline event map; capability detection only needs to know
+     * whether it is present and non-empty.
+     */
+    hooks?: unknown;
+    /**
+     * Inline MCP-server configuration (or a path to an MCP JSON file) declared
+     * directly in the manifest — an execution surface even when the plugin ships
+     * no `.mcp.json`. Untyped for the same reason as `hooks`.
+     */
+    mcpServers?: unknown;
 }
 /** A plugin found on disk with its parsed manifest and resource inventory. */
 export interface DiscoveredPlugin {
@@ -637,11 +651,15 @@ export interface Meta {
      * bundles without an explicit per-bundle policy: `daily` (the default) asks
      * once per ~7 days, `always` asks every time. `auto` (default on) lets the
      * first real keychain read of a `daily` bundle populate the broker so
-     * concurrent runs read silently — set it `false` to force a prompt on every read. */
+     * concurrent runs read silently — set it `false` to force a prompt on every read.
+     * `holdMs` caps how long an unlocked/auto-cached bundle is held before the next
+     * read re-prompts (default 7 days; e.g. 86400000 for a 24h cap). Clamped to
+     * [1 minute, 30 days]. */
     secrets?: {
         policy?: 'always' | 'daily';
         agent?: {
             auto?: boolean;
+            holdMs?: number;
         };
     };
     /** Spend guardrails (issue #346). User-global caps; project agents.yaml overrides. */
@@ -698,6 +716,13 @@ export interface Meta {
      * are never copied. `inline` hosts carry their own address/user.
      */
     hosts?: Record<string, HostEntry>;
+    /**
+     * Declarative fleet profile (`agents apply` / `ag apply`). Additive to the
+     * schema — project `agents:` version-pins are untouched. Declares which agents
+     * every device should have, which config to sync, and how login propagates.
+     * Full shape in `lib/fleet/types.ts` (FleetManifest).
+     */
+    fleet?: import('./fleet/types.js').FleetManifest;
 }
 /** Persisted agent-host entry in agents.yaml (overlay or inline). */
 export interface HostEntry {

package/dist/lib/usage.js

@@ -207,12 +207,14 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3) {
         parts.push(chalk.gray(plan.padEnd(planWidth)));
     }
     if (snapshot) {
-        // Compact rows show the two windows every agent shares (session + week);
-        // extra windows (Claude's Sonnet week, Droid's month) render only in the
-        // full per-version usage section. An exhausted month window still surfaces
-        // here as the rate-limited badge via deriveUsageStatusFromSnapshot.
+        // Compact rows show every BLOCKING window — the same set
+        // deriveUsageStatusFromSnapshot uses for the rate-limited badge — so an
+        // account throttled by its month window (Droid meters on 5h/week/month)
+        // shows the bar that explains why. Claude's Sonnet week is a per-model
+        // sub-limit, not a blocking window; it renders only in the full
+        // per-version usage section.
         const windows = snapshot.windows
-            .filter((window) => window.key === 'session' || window.key === 'week')
+            .filter((window) => window.key !== 'sonnet_week')
             .map((window) => `${chalk.gray(`${window.shortLabel}:`)} ${renderCompactUsageBar(window.usedPercent)}`);
         if (windows.length > 0) {
             parts.push(windows.join(' '));