@phnx-labs/agents-cli 1.20.64 → 1.20.65

package/dist/commands/cloud.js

@@ -8,6 +8,7 @@ import { insertTask, updateTaskStatus, getTaskById, listTasks as listStoredTasks
 import { renderStream } from '../lib/cloud/stream.js';
 import { MissingTargetError, MAX_IMAGES_PER_DISPATCH } from '../lib/cloud/types.js';
 import { normalizeTriggerEvent, validateTrigger, writeJob, jobExists, GITHUB_TRIGGER_EVENTS } from '../lib/routines.js';
+import { machineId } from '../lib/machine-id.js';
 import { emit } from '../lib/events.js';
 /** Map a supported image file extension to its wire mimeType. Rejects anything else. */
 function imageMimeFromPath(file) {
@@ -145,7 +146,7 @@ Examples:
     cloud
         .command('run [prompt]')
         .description('Dispatch a task to a cloud agent.')
-        .option('--provider <id>', 'Cloud backend: rush, codex, factory, antigravity (overrides agent auto-routing)')
+        .option('--provider <id>', 'Cloud backend: rush, codex, factory, antigravity, host (overrides agent auto-routing)')
         .option('--agent <name>', 'Agent to run: claude, codex, droid, antigravity (auto-routes to its native cloud)')
         .option('--repo <owner/repo>', 'GitHub repository. Repeatable for multi-repo dispatch (Rush Cloud only).', (value, previous) => {
         const acc = Array.isArray(previous) ? previous : [];
@@ -160,6 +161,9 @@ Examples:
         .option('--model <model>', 'Model override')
         .option('--env <id>', 'Codex Cloud environment ID')
         .option('--computer <name>', 'Factory/Droid computer target')
+        .option('--host <name>', 'One of your machines as the target (a registered host, device, capability tag, or user@host). Implies --provider host.')
+        .option('--remote-cwd <dir>', 'Working directory on the host (--provider host only)')
+        .option('--any', 'With --host <cap> (a capability tag), pick any matching host instead of erroring when several match')
         .option('--autonomy <level>', 'Factory/Droid autonomy: low, medium, high (default high)')
         .option('--mode <mode>', 'Execution mode (e.g., plan, edit, full)')
         .option('--image <path>', `Attach an image (.png/.jpg/.webp) for vision dispatch. Repeatable, up to ${MAX_IMAGES_PER_DISPATCH} (Rush Cloud only).`, (value, previous) => {
@@ -189,6 +193,10 @@ Examples:
   # Codex Cloud
   agents cloud run "add auth tests" --provider codex --env env_abc123
 
+  # One of your own machines (agents hosts / agents devices), over SSH
+  agents cloud run "run the nightly benchmark" --host gpu-box --agent claude
+  agents cloud run "rebuild the index" --host gpu --any --remote-cwd ~/proj
+
   # Default provider (set in ~/.agents/agents.yaml)
   agents cloud run "refactor auth module" --repo user/repo
 `)
@@ -208,9 +216,16 @@ Examples:
                 process.stderr.write(chalk.dim(`Reading prompt from ${filePath} (${sizeKB} KB)\n`));
             }
         }
+        // --host names one of YOUR machines as the target — that only means
+        // something to the host provider, so it implies --provider host rather
+        // than silently riding along to a cloud backend that would ignore it.
+        if (options.host && options.provider && options.provider !== 'host') {
+            die(`--host targets your own machines (--provider host), not ${options.provider}. Drop --host, or use --provider host.`);
+        }
+        const explicitProvider = options.provider ?? (options.host ? 'host' : undefined);
         // Agent-aware: with no --provider, the agent routes to its native cloud
         // (claude→rush, codex→codex, droid→factory, antigravity→antigravity).
-        const provider = resolveProvider(options.provider, options.agent);
+        const provider = resolveProvider(explicitProvider, options.agent);
         // --repo is repeatable: commander gives us an array via our collector.
         // A single --repo value arrives as a one-element array; keep the legacy
         // singular `repo` field in sync so providers that only know that field
@@ -234,6 +249,12 @@ Examples:
             dispatchOptions.providerOptions.env = options.env;
         if (options.computer)
             dispatchOptions.providerOptions.computer = options.computer;
+        if (options.host)
+            dispatchOptions.providerOptions.host = options.host;
+        if (options.remoteCwd)
+            dispatchOptions.providerOptions.remoteCwd = options.remoteCwd;
+        if (options.any)
+            dispatchOptions.providerOptions.any = true;
         if (options.autonomy)
             dispatchOptions.providerOptions.autonomy = options.autonomy;
         if (options.mode)
@@ -279,6 +300,15 @@ Examples:
             };
             if (repoValues[0])
                 routine.repo = repoValues[0];
+            // --host with --on: the webhook-fired run places on that machine (the
+            // routine carries the placement, and firing pins to THIS device so a
+            // fleet of receivers can't each dispatch a duplicate).
+            if (options.host) {
+                routine.host = options.host;
+                if (options.remoteCwd)
+                    routine.remoteCwd = options.remoteCwd;
+                routine.devices = [machineId()];
+            }
             writeJob(routine);
             if (json) {
                 console.log(JSON.stringify({ ok: true, registered: routineName, trigger }, null, 2));

package/dist/commands/doctor.js

@@ -1,6 +1,6 @@
 import { addHostOption } from '../lib/hosts/option.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
-import { loadDevices } from '../lib/devices/registry.js';
+import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
 import { resolveHost } from '../lib/hosts/registry.js';
 import { sshExec } from '../lib/ssh-exec.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
@@ -249,6 +249,9 @@ async function resolveFleetTargets(opts) {
     const localName = machineId();
     return Object.values(registry)
         .filter((d) => d.name.toLowerCase() !== localName)
+        // Control devices (a cockpit) never run agents — skip them in the fleet
+        // fan-out (an explicit --device <name> still resolves above).
+        .filter((d) => !isControlDevice(d))
         .map((d) => ({
         name: d.name,
         sshTarget: d.name,

package/dist/commands/exec.js

@@ -507,33 +507,45 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             const hostName = hostGiven[0];
-            const { resolveHost, resolveHostByCap } = await import('../lib/hosts/registry.js');
-            const { dispatchToHost, runInteractiveOnHost } = await import('../lib/hosts/dispatch.js');
-            const { registerHostSession, registerInteractiveHostSession } = await import('../lib/hosts/session-index.js');
+            const { resolveHostRunTarget, dispatchPromptToHost, HostResolutionError } = await import('../lib/hosts/run-target.js');
+            const { runInteractiveOnHost } = await import('../lib/hosts/dispatch.js');
+            const { registerInteractiveHostSession } = await import('../lib/hosts/session-index.js');
+            const { RUN_OPTION_REJECT_MESSAGES } = await import('../lib/hosts/remote-cmd.js');
             const { normalizeRunStrategy, RUN_STRATEGIES } = await import('../lib/rotate.js');
-            // A password-auth device throws DeviceOffloadUnsupportedError here; it's
-            // printed cleanly by the top-level catch in index.ts (covers every
-            // resolveHost caller), so it never falls through to capability routing.
-            let host = await resolveHost(hostName);
-            if (!host) {
-                // Not a host name — try capability routing (e.g. --host gpu). A
-                // "Multiple hosts tagged…" error is actionable and must surface;
-                // only "no host tagged" falls through to the generic unknown-host msg.
-                try {
-                    host = await resolveHostByCap(hostName, options.any);
-                }
-                catch (e) {
-                    const msg = e.message ?? '';
-                    if (msg.startsWith('Multiple hosts')) {
-                        console.error(chalk.red(msg));
-                        process.exit(1);
-                    }
-                }
-            }
-            if (!host) {
-                console.error(chalk.red(`Unknown host "${hostName}". List hosts: agents hosts list`));
+            // The forwarding contract (RUN_OPTION_FORWARDING): options that cannot
+            // cross the SSH boundary fail loud BEFORE dispatch — never a silent
+            // drop. Value-aware: only reject what was actually passed.
+            const hostRejects = [];
+            if (options.secrets.length > 0)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.secrets);
+            if (options.secretsKeys)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.secretsKeys);
+            if (options.allowExpired)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.allowExpired);
+            if (options.resumeCheckpoint)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.resumeCheckpoint);
+            if (options.resume === true)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.resumeBare);
+            if (hostRejects.length > 0) {
+                for (const msg of hostRejects)
+                    console.error(chalk.red(msg));
                 process.exit(1);
             }
+            // Shared resolution (name → capability tag → error). A password-auth
+            // device throws DeviceOffloadUnsupportedError inside the helper and
+            // propagates untouched — it's printed cleanly by the top-level catch in
+            // index.ts (covers every resolveHost caller).
+            let host;
+            try {
+                host = await resolveHostRunTarget(hostName, { any: options.any });
+            }
+            catch (e) {
+                if (e instanceof HostResolutionError) {
+                    console.error(chalk.red(e.message));
+                    process.exit(1);
+                }
+                throw e;
+            }
             try {
                 const [runAgent, rawRunVersion] = agentSpec.split('@');
                 // Forward the explicit @version pin verbatim. Resolving aliases like
@@ -636,10 +648,12 @@ export function registerRunCommand(program) {
                         agent: runAgent,
                         version: resumeId ? undefined : runVersion,
                         strategy: resumeId ? undefined : runStrategy,
+                        fallback: options.fallback,
                         prompt,
                         mode: options.mode,
                         model: options.model,
                         effort: options.effort,
+                        env: options.env,
                         addDir: hostAddDirs,
                         json: options.json,
                         verbose: options.verbose,
@@ -663,32 +677,37 @@ export function registerRunCommand(program) {
                     console.error(chalk.red('A prompt is required for headless host runs: agents run <agent> "<task>" --host <name>'));
                     process.exit(1);
                 }
-                const hostSessionId = runAgent === 'claude' && !resumeId ? randomUUID() : undefined;
-                const { task, exitCode } = await dispatchToHost(host, {
+                // Session-id mint, detached dispatch, and local session-index
+                // registration all live in the shared helper (lib/hosts/run-target.ts).
+                const { task, exitCode } = await dispatchPromptToHost(host, {
                     agent: runAgent,
                     version: resumeId ? undefined : runVersion,
                     strategy: resumeId ? undefined : runStrategy,
+                    fallback: options.fallback,
                     prompt,
                     mode: options.mode,
                     model: options.model,
                     effort: options.effort,
+                    env: options.env,
                     addDir: hostAddDirs,
+                    timeout: options.timeout,
+                    loop: options.loop,
+                    maxIterations: options.maxIterations,
+                    budget: options.budget,
+                    until: options.until,
+                    interval: options.interval,
                     json: options.json,
                     verbose: options.verbose,
-                    timeout: options.timeout,
                     yes: options.yes,
                     acp: options.acp,
+                    autoSecrets: options.autoSecrets,
                     remoteCwd: hostCwd,
-                    sessionId: hostSessionId,
                     name: options.name,
                     resume: resumeId,
                     follow: options.follow !== false,
+                    passthroughArgs,
                     copyCreds: hostCopyCreds,
                 });
-                // Register the dispatched run in the LOCAL session index so it shows
-                // up in `agents sessions` and resolves by id/name, even though its
-                // transcript lives on the host. No-op when no session id was captured.
-                registerHostSession(task, { cwd: process.cwd(), prompt });
                 if (options.follow === false) {
                     // The handle the caller uses to check on the run: the name if given,
                     // else the real host-task id (never the old literal `<id>`). Steer
@@ -803,7 +822,7 @@ export function registerRunCommand(program) {
                 await warnUnpushedWork(resumeExec.cwd ?? process.cwd());
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported, isHeadlessSecretsContext }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
@@ -841,6 +860,11 @@ export function registerRunCommand(program) {
         // produced item, and drives the teams supervisor to drain — no `teams`
         // subcommands needed.
         let workflowForEach;
+        // True once this run copies ≥1 dispatchable subagent into the shared agents
+        // dir. Used below to keep the `Task` tool in a `tools:`-restricted workflow —
+        // an orchestrator handed subagents but denied `Task` cannot reach them and
+        // degenerates to a no-op ("I'll wait for the completion notification").
+        let workflowHasSubagents = false;
         const cwd = options.cwd ?? process.cwd();
         if (isValidAgent(rawAgent)) {
             agent = rawAgent;
@@ -922,6 +946,8 @@ export function registerRunCommand(program) {
                     workflowSubagentTargets.push(dest);
                     copied++;
                 }
+                if (copied > 0)
+                    workflowHasSubagents = true;
                 if (allowedAgents !== undefined) {
                     // Surface any allowedAgents entry with no matching subagent file, and
                     // report how many were filtered out, so the scope is auditable.
@@ -965,7 +991,9 @@ export function registerRunCommand(program) {
             }
             // Auto-inject secrets bundles declared in the workflow's frontmatter `secrets:` field.
             // Union with any --secrets flags the user passed; dedupe. Skip when --no-auto-secrets is set.
-            if (!options.noAutoSecrets) {
+            // (Commander stores the negated flag as `autoSecrets: false` — the old
+            // `noAutoSecrets` read was never populated, making the flag a no-op.)
+            if (options.autoSecrets !== false) {
                 const declared = workflowFrontmatter?.secrets ?? [];
                 if (declared.length > 0) {
                     const existing = new Set(options.secrets);
@@ -1002,8 +1030,14 @@ export function registerRunCommand(program) {
             }
             else if (hasScoping) {
                 if (tools && tools.length > 0) {
-                    workflowToolsRestrict = tools;
-                    process.stderr.write(chalk.gray(`[workflow] restricting available tools to: ${tools.join(', ')} (Write/Bash/Edit unavailable unless listed)\n`));
+                    // An orchestrator with dispatchable subagents MUST retain the `Task`
+                    // tool, or it can't reach the subagents this run just installed for it
+                    // — the run silently no-ops ("I'll wait for the completion notification").
+                    workflowToolsRestrict = ensureSubagentDispatchTool(tools, workflowHasSubagents);
+                    process.stderr.write(chalk.gray(`[workflow] restricting available tools to: ${workflowToolsRestrict.join(', ')} (Write/Bash/Edit unavailable unless listed)\n`));
+                    if (workflowToolsRestrict.length !== tools.length) {
+                        process.stderr.write(chalk.gray(`[workflow] kept Task tool: workflow ships subagents to dispatch\n`));
+                    }
                 }
                 if (mcpServerNames && mcpServerNames.length > 0) {
                     const servers = getMcpServersByName(mcpServerNames, { cwd });
@@ -1186,8 +1220,12 @@ export function registerRunCommand(program) {
             process.exit(1);
         }
         const strategy = options.balanced ? 'balanced' : explicitStrategy ?? configuredStrategy;
-        // Strategy only applies to bare agent invocations. Explicit @version,
-        // profiles, and fallback chains already define their execution target.
+        // Strategy only applies to bare agent invocations. Explicit @version and
+        // profiles already define their execution target. A --fallback chain does
+        // NOT pin the primary: it only names where to cascade on a rate limit, so
+        // the bare primary still resolves through the strategy — otherwise every
+        // `agents run claude --fallback codex` run lands on the pinned default
+        // account and account rotation silently stops (the gh-monitor heal bug).
         if (strategy !== 'pinned' || options.balanced || explicitStrategy) {
             if (version) {
                 process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: version ${version} is pinned\n`));
@@ -1195,9 +1233,6 @@ export function registerRunCommand(program) {
             else if (fromProfile) {
                 process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: profile pins its own version/auth\n`));
             }
-            else if (options.fallback) {
-                process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: --fallback pins versions directly\n`));
-            }
             else {
                 try {
                     const resolved = await resolveRunVersion(agent, strategy, cwd);
@@ -1350,6 +1385,10 @@ export function registerRunCommand(program) {
                         caller: `agent ${agent}`,
                         keys: secretsKeysSubset,
                         allowExpired: options.allowExpired,
+                        // A headless/background run (routine, teammate, detached) must not
+                        // pop a Touch ID sheet nobody can answer — resolve broker-only and
+                        // fail fast with an actionable error. Interactive runs still prompt.
+                        agentOnly: isHeadlessSecretsContext(),
                     });
                     const entries = describeBundle(bundle);
                     const counts = {};
@@ -1470,17 +1509,23 @@ export function registerRunCommand(program) {
         // path (continuing the session via /continue). Because this injects into
         // the same `fallback` array `--fallback` uses, it must only arm for run
         // shapes that accept a fallback chain — shouldArmRotationFailover excludes
-        // acp/loop/resume-checkpoint (which reject a non-empty fallback below),
-        // interactive/no-prompt runs, and runs that already have an explicit or
-        // profile fallback. Pinned/single-account runs stay unchanged because
-        // rotationResult is null or rotationFailoverChain returns []. version is
-        // set here because rotationResult is only populated when resolveRunVersion
-        // picked one.
+        // acp/loop/resume-checkpoint (which reject a non-empty fallback below)
+        // and interactive/no-prompt runs. Pinned/single-account runs stay
+        // unchanged because rotationResult is null or rotationFailoverChain
+        // returns []. version is set here because rotationResult is only
+        // populated when resolveRunVersion picked one.
+        //
+        // Composes with an explicit --fallback chain: the same-agent accounts are
+        // UNSHIFTED ahead of the user's cross-agent entries, so a rate limit
+        // first tries the other accounts of the same agent (cheapest recovery —
+        // same CLI, session continues) and only then cascades to codex/gemini/etc.
+        // Profiles never compose: strategy is skipped for them, rotationResult
+        // stays null. (fromProfile's model-swap unshift above is therefore never
+        // displaced by this one.)
         if (shouldArmRotationFailover({
             hasRotation: !!rotationResult,
             hasVersion: !!version,
             hasPrompt: prompt !== undefined,
-            explicitFallback: fallback.length > 0,
             interactive: !!options.interactive,
             acp: !!options.acp,
             loop: !!options.loop,
@@ -1488,7 +1533,7 @@ export function registerRunCommand(program) {
         })) {
             const failover = rotationFailoverChain(rotationResult, version);
             if (failover.length > 0) {
-                fallback.push(...failover);
+                fallback.unshift(...failover);
                 if (!options.quiet) {
                     const accounts = failover.map(f => `${f.agent}@${f.version}`).join(', ');
                     process.stderr.write(chalk.gray(`[agents] rate-limit failover armed: ${accounts}\n`));

package/dist/commands/feed.js

@@ -8,6 +8,7 @@ import { gatherRemoteAgentsJson } from '../lib/remote-agents-json.js';
 import { loadPolicy, applyPolicyToBlock, isPhoneUrgent } from '../lib/feed-policy.js';
 import { notifyUrgentBlock } from '../lib/notify.js';
 import { gcMailbox } from '../lib/mailbox-gc.js';
+import { isValidMailboxId } from '../lib/mailbox.js';
 import { getActiveSessions } from '../lib/session/active.js';
 import { mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { GLYPH, masthead } from '../lib/comms-render.js';
@@ -38,6 +39,11 @@ export function parseRemoteFeed(stdout, machine) {
         const block = item;
         if (!block.blockId || !block.sessionId || !block.mailboxId || !block.questions?.length)
             continue;
+        // A crafted mailboxId (path separators, `.`/`..`) would throw inside
+        // mailboxDir() when policy runs against the block, aborting the whole
+        // dispatch loop — drop it here so a malicious peer can't smuggle one in.
+        if (!isValidMailboxId(block.mailboxId))
+            continue;
         blocks.push({ ...block, host: machine });
     }
     return blocks;
@@ -240,20 +246,28 @@ export function registerFeedCommand(program) {
             const policy = loadPolicy();
             const now = new Date();
             for (const b of blocks) {
-                const result = applyPolicyToBlock(b, policy, now);
-                if (result.action !== 'none') {
-                    console.log(`${chalk.yellow('policy')} ${b.blockId}: ${result.action}`);
-                }
-                if (isPhoneUrgent(b, policy)) {
-                    const notifyResult = await notifyUrgentBlock(b, { dryRun: opts.json });
-                    if (notifyResult.ok && !notifyResult.skipped) {
-                        recordNotified(b.blockId);
-                        console.log(`${chalk.green('notified')} ${b.blockId}`);
+                // Wrap per-block policy so one malformed block (e.g. a crafted
+                // mailboxId that throws in mailboxDir) can't abort the whole loop and
+                // strand every remaining block's dispatch.
+                try {
+                    const result = applyPolicyToBlock(b, policy, now);
+                    if (result.action !== 'none') {
+                        console.log(`${chalk.yellow('policy')} ${b.blockId}: ${result.action}`);
                     }
-                    else if (notifyResult.error) {
-                        console.error(chalk.yellow(`Notification failed for ${b.blockId}: ${notifyResult.error}`));
+                    if (isPhoneUrgent(b, policy)) {
+                        const notifyResult = await notifyUrgentBlock(b, { dryRun: opts.json });
+                        if (notifyResult.ok && !notifyResult.skipped) {
+                            recordNotified(b.blockId);
+                            console.log(`${chalk.green('notified')} ${b.blockId}`);
+                        }
+                        else if (notifyResult.error) {
+                            console.error(chalk.yellow(`Notification failed for ${b.blockId}: ${notifyResult.error}`));
+                        }
                     }
                 }
+                catch (err) {
+                    console.error(chalk.yellow(`Skipped block ${b.blockId}: ${err.message}`));
+                }
             }
         }
         for (const warning of setupWarnings) {

package/dist/commands/hosts.js

@@ -11,6 +11,7 @@ import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/widt
 import { checkbox, confirm } from '@inquirer/prompts';
 import { assertValidSshTarget } from '../lib/ssh-exec.js';
 import { getProvider, listAllHosts, resolveHost } from '../lib/hosts/registry.js';
+import { getDevice } from '../lib/devices/registry.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
 import { listSshConfigHosts, listKnownHosts, isSshConfigHost } from '../lib/hosts/ssh-config.js';
 import { probeHost, remoteAgentsVersion, bootstrapAgentsCli, localCliVersion, } from '../lib/hosts/ready.js';
@@ -93,7 +94,7 @@ async function doAdd(name, target, opts) {
         return;
     }
     let spec;
-    let sshTarget;
+    let sshTarget = '';
     if (target) {
         assertValidSshTarget(target);
         const { address, user } = parseTarget(target);
@@ -105,9 +106,36 @@ async function doAdd(name, target, opts) {
         sshTarget = name;
     }
     else {
-        console.log(chalk.red(`"${name}" is not in ~/.ssh/config. Pass a target: agents hosts add ${name} <user@host>`));
-        process.exitCode = 1;
-        return;
+        // A registered device enrolls with no target — connection details come from
+        // the device profile. The main reason to enroll one at all is the overlay
+        // metadata (capability tags); plain dispatch already works via the devices
+        // provider.
+        const device = await getDevice(name);
+        if (device && device.auth.method !== 'password') {
+            const address = device.address.dnsName ?? device.address.ip;
+            if (address) {
+                spec = {
+                    name,
+                    provider: 'local',
+                    source: 'inline',
+                    address,
+                    user: device.user,
+                    caps: opts.cap,
+                    os: opts.os ?? (device.platform !== 'unknown' ? device.platform : undefined),
+                };
+                sshTarget = device.user ? `${device.user}@${address}` : address;
+            }
+        }
+        if (!spec) {
+            if (device?.auth.method === 'password') {
+                console.log(chalk.red(`Device "${name}" uses password auth — dispatch needs key auth. Switch it first: agents devices set ${name} --auth key`));
+            }
+            else {
+                console.log(chalk.red(`"${name}" is not in ~/.ssh/config or the devices registry. Pass a target: agents hosts add ${name} <user@host>`));
+            }
+            process.exitCode = 1;
+            return;
+        }
     }
     const probe = probeHost(sshTarget);
     if (!spec.os && probe.os)
@@ -133,8 +161,12 @@ async function doList(json) {
         // Cap TARGET at its column so a long user@host can't shove CAPS out of alignment.
         const tgtW = stringWidth(tgt);
         const tgtCol = tgtW > 28 ? truncateToWidth(tgt, 28) : tgt + ' '.repeat(28 - tgtW);
-        const mark = h.enrolled ? '' : chalk.gray(' ·available');
-        console.log(h.name.padEnd(20) + h.source.padEnd(13) + tgtCol + (h.caps?.join(',') ?? '') + mark);
+        // Devices surface their registry as SOURCE (they're synced, not enrolled here).
+        const source = h.provider === 'devices' ? 'devices' : h.source;
+        const mark = h.dispatchable === false
+            ? chalk.yellow(' ·password-auth (no dispatch)')
+            : h.enrolled ? '' : chalk.gray(' ·available');
+        console.log(h.name.padEnd(20) + source.padEnd(13) + tgtCol + (h.caps?.join(',') ?? '') + mark);
     }
 }
 async function doCheck(name) {
@@ -163,6 +195,12 @@ async function doRemove(name) {
         console.log(chalk.yellow(`"${name}" is not enrolled (nothing to remove).`));
         return;
     }
+    if (host.provider === 'devices') {
+        // The devices registry owns this entry — hosts remove would silently no-op.
+        console.log(chalk.yellow(`"${name}" comes from the devices registry. Remove it there: agents devices rm ${name}`));
+        process.exitCode = 1;
+        return;
+    }
     await getProvider('local').remove(name);
     console.log(chalk.green(`Removed ${name}`));
 }

package/dist/commands/mcp.js

@@ -6,9 +6,9 @@ import { capableAgents, isCapable } from '../lib/capabilities.js';
 import { emit } from '../lib/events.js';
 import { AGENTS, getAllCliStates, resolveAgentName, formatAgentError, registerMcpToTargets, unregisterMcpFromTargets, listInstalledMcpsWithScope, parseMcpConfig, getMcpConfigPathForHome, agentLabel, } from '../lib/agents.js';
 import { readManifest, writeManifest, createDefaultManifest } from '../lib/manifest.js';
-import { listMcpServerConfigs, discoverMcpConfigsFromRepo, installMcpConfigCentrally, } from '../lib/mcp.js';
+import { listMcpServerConfigs, discoverMcpConfigsFromRepo, installMcpConfigCentrally, isProjectMcpTrusted, trustProjectMcp, untrustProjectMcp, getMcpTrustStorePath, } from '../lib/mcp.js';
 import { cloneRepo } from '../lib/git.js';
-import { getMcpDir } from '../lib/state.js';
+import { getMcpDir, getProjectAgentsDir } from '../lib/state.js';
 import { getEffectiveHome, getGlobalDefault, listInstalledVersions, getVersionHomePath, resolveInstalledAgentTargets, resolveConfiguredAgentTargets, syncResourcesToVersion, } from '../lib/versions.js';
 import { getUserAgentsDir } from '../lib/state.js';
 import { isPromptCancelled, isInteractiveTerminal, requireInteractiveSelection, promptRemovalTargets, parseCommaSeparatedList, ensureAgentVersionsInstalled, resolveAgentTargetsAutoInstalling, resolveInstalledAgentTargetsAutoInstalling, VersionNotInstalledError, resolveListFilterOrExit, } from './utils.js';
@@ -178,6 +178,43 @@ When to use:
             filterVersion,
         });
     });
+    mcpCmd
+        .command('trust')
+        .description('Trust this project so its .agents/mcp/ servers may be registered and spawned')
+        .action(() => {
+        const projectAgentsDir = getProjectAgentsDir();
+        if (!projectAgentsDir) {
+            console.log(chalk.red('Not inside a project (no .agents/ directory found) — nothing to trust.'));
+            process.exit(1);
+        }
+        const servers = listMcpServerConfigs().filter((s) => s.scope === 'project');
+        if (servers.length > 0) {
+            console.log(chalk.bold('Project-scoped MCP servers that will be trusted to run:'));
+            for (const s of servers) {
+                console.log('  ' + chalk.cyan(s.name) + '  ' + chalk.white(formatCentralCommand(s)));
+            }
+        }
+        const trusted = trustProjectMcp();
+        console.log(chalk.green(`Trusted project MCP servers for: ${trusted}`));
+        console.log(chalk.gray(`Recorded in ${getMcpTrustStorePath()} — revoke with: agents mcp untrust`));
+    });
+    mcpCmd
+        .command('untrust')
+        .description('Revoke MCP trust for this project (its .agents/mcp/ servers stop auto-applying)')
+        .action(() => {
+        const projectAgentsDir = getProjectAgentsDir();
+        if (!projectAgentsDir) {
+            console.log(chalk.red('Not inside a project (no .agents/ directory found).'));
+            process.exit(1);
+        }
+        const removed = untrustProjectMcp();
+        if (removed) {
+            console.log(chalk.green('Revoked MCP trust for this project.'));
+        }
+        else {
+            console.log(chalk.gray('This project was not trusted — nothing to revoke.'));
+        }
+    });
     mcpCmd
         .command('add <name> [command_or_url...]')
         .description('Add an MCP server to the manifest (run "agents mcp register" afterward to apply)')
@@ -797,9 +834,15 @@ function formatCentralCommand(server) {
 function formatMcpDetail(name, source, centralConfig, manifestConfig, command, targets) {
     const lines = [];
     lines.push(chalk.bold.cyan(name));
-    const tag = source === 'central' ? chalk.green('declared in ~/.agents/mcp/') :
-        source === 'manifest' ? chalk.gray('declared in agents.yaml') :
-            chalk.yellow('unmanaged (not in central or manifest)');
+    const isUntrustedProject = centralConfig?.scope === 'project'
+        && !isProjectMcpTrusted(getProjectAgentsDir() ?? '');
+    const tag = centralConfig?.scope === 'project'
+        ? (isUntrustedProject
+            ? chalk.yellow('declared in <repo>/.agents/mcp/ (untrusted project — will NOT auto-apply)')
+            : chalk.green('declared in <repo>/.agents/mcp/ (trusted project)')) :
+        source === 'central' ? chalk.green('declared in ~/.agents/mcp/') :
+            source === 'manifest' ? chalk.gray('declared in agents.yaml') :
+                chalk.yellow('unmanaged (not in central or manifest)');
     lines.push('  ' + tag);
     lines.push('');
     if (centralConfig) {
@@ -814,6 +857,13 @@ function formatMcpDetail(name, source, centralConfig, manifestConfig, command, t
     if (command) {
         lines.push(`  ${chalk.gray('command:')} ${chalk.white(command)}`);
     }
+    // A project-scoped server is an arbitrary command from a (possibly cloned)
+    // repo. Show exactly what would run and how to opt in (RUSH-1776).
+    if (isUntrustedProject) {
+        lines.push('');
+        lines.push('  ' + chalk.yellow('This project is untrusted — its MCP servers are skipped on sync and workflow runs.'));
+        lines.push('  ' + chalk.gray('Review the command above, then opt in with: ') + chalk.white('agents mcp trust'));
+    }
     lines.push('');
     lines.push(chalk.bold('  Synced to'));
     lines.push(buildTargetsSection(targets));

package/dist/commands/monitors.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Monitors — durable event-triggered watchers.
+ *
+ * Registers the `agents monitors` command tree: create, list, view, dry-run test,
+ * edit, logs, fire history, pause/resume, (re)pin the owner device, and remove.
+ * Mirrors `agents routines` (commands/routines.ts) and shares the same daemon +
+ * dispatch engine underneath — a monitor is a routine whose trigger is a watched
+ * source instead of a clock.
+ */
+import type { Command } from 'commander';
+/** Register the `agents monitors` command tree. */
+export declare function registerMonitorsCommands(program: Command): void;