@phnx-labs/agents-cli 1.20.64 → 1.20.65

package/dist/commands/sessions.js

@@ -16,7 +16,7 @@ import { truncate, padRight } from '../lib/format.js';
 import ora from 'ora';
 import { SESSION_AGENTS } from '../lib/session/types.js';
 import { discoverArtifacts, readArtifact, resolveArtifact } from '../lib/session/artifacts.js';
-import { looksLikePath, toComparablePath, homeDir, needsWindowsShell, findExecutable } from '../lib/platform/index.js';
+import { looksLikePath, toComparablePath, homeDir, needsWindowsShell, findExecutable, composeWin32CommandLine } from '../lib/platform/index.js';
 import { getActiveSessions } from '../lib/session/active.js';
 import { enumerateGhosttyTabs, assignGhosttyTabs } from '../lib/session/ghostty-tabs.js';
 import { mapPanesToTargets, listClients } from '../lib/tmux/session.js';
@@ -25,6 +25,7 @@ import { machineId, normalizeHost } from '../lib/session/sync/config.js';
 import { gatherRemoteActive, NO_FANOUT_ENV } from '../lib/session/remote-active.js';
 import { gatherRemoteList, runOnPeer } from '../lib/session/remote-list.js';
 import { stringWidth, truncateToWidth, padToWidth, terminalWidth } from '../lib/session/width.js';
+import { inferSessionState } from '../lib/session/state.js';
 import { discoverSessions, countSessionsInScope, resolveSessionById, searchContentIndex, getSessionRoots } from '../lib/session/discover.js';
 import { filterTeamSessions } from '../lib/session/team-filter.js';
 import { parseSession } from '../lib/session/parse.js';
@@ -1323,9 +1324,9 @@ async function renderSession(session, mode, filters, options = {}) {
         return;
     }
     const spinner = ora(`Parsing ${session.agent} session...`).start();
-    let events = parseSession(session.filePath, session.agent);
+    const parsedEvents = parseSession(session.filePath, session.agent);
     spinner.stop();
-    events = filterEvents(events, filters);
+    let events = filterEvents(parsedEvents, filters);
     const agentColor = colorAgent(session.agent);
     console.log('');
     if (mode === 'summary') {
@@ -1367,7 +1368,11 @@ async function renderSession(session, mode, filters, options = {}) {
     // engine (plan text, PR, worktree, ticket). Pre-1.20.51 emitted a bare event
     // array; consumers that JSON.parse this now read `output.events` for the
     // array. See issue #743 (plan surfaced) and CHANGELOG for the shape change.
-    process.stdout.write(renderJson(events, session));
+    // `todos` (RUSH-1503) is computed from the UNFILTERED transcript so the
+    // checklist reflects true session state regardless of any `--include` filter;
+    // it lets the Factory panel read the CLI's checklist instead of re-parsing.
+    const todos = inferSessionState(parsedEvents, { cwd: session.cwd }).todos;
+    process.stdout.write(renderJson(events, todos ? { ...session, todos } : session));
 }
 function renderTopicCell(label, topic, query, visibleWidth, paddedWidth) {
     const lbl = (label ?? '').trim();
@@ -1613,11 +1618,35 @@ export async function resumeSessionInPlace(session) {
     }
     await spawnResumeCommand(resume, cwd);
 }
+/**
+ * Map a resume argv to the spawn(command, args, {shell}) triple.
+ *
+ * On Windows the agent launcher is a `.cmd`/PATHEXT shim and needs shell:true.
+ * With shell:true, Node concatenates args into the cmd.exe line unescaped
+ * (DEP0190 + injection). A session.id derived from a filename can carry
+ * metacharacters (`&|<>`); compose a fully-quoted line and pass an EMPTY args
+ * array so cmd.exe cannot reparse them (RUSH-1753). See composeWin32CommandLine.
+ *
+ * `platform` is injectable so the win32 shell path is unit-testable on any host.
+ */
+export function resumeSpawnInvocation(cmd, platform = process.platform) {
+    const shell = needsWindowsShell(cmd[0], platform);
+    if (shell) {
+        return {
+            command: composeWin32CommandLine(cmd[0], cmd.slice(1)),
+            args: [],
+            shell: true,
+        };
+    }
+    return { command: cmd[0], args: cmd.slice(1), shell: false };
+}
 /**
  * Spawn a resume command as a foreground takeover (inherited stdio), resolving
  * when it exits. On Windows the agent launcher is a `.cmd`/PATHEXT shim that
  * `spawn` can't exec directly — a bare-name `shell:false` spawn throws
  * `EFTYPE`/`ENOENT` there — so we go through the shell via `needsWindowsShell`.
+ * When shell:true, argv is composed via resumeSpawnInvocation (quoted line +
+ * empty args) so an untrusted session.id cannot inject through cmd.exe.
  * The spawn is guarded because such a failure can be thrown synchronously;
  * without the guard it would surface under an unrelated "Failed to discover
  * sessions" catch upstream instead of a truthful launch error.
@@ -1626,10 +1655,11 @@ function spawnResumeCommand(cmd, cwd) {
     return new Promise((resolve) => {
         let child;
         try {
-            child = spawn(cmd[0], cmd.slice(1), {
+            const { command, args, shell } = resumeSpawnInvocation(cmd);
+            child = spawn(command, args, {
                 cwd,
                 stdio: 'inherit',
-                shell: needsWindowsShell(cmd[0]),
+                shell,
             });
         }
         catch (err) {

package/dist/commands/ssh.js

@@ -15,9 +15,11 @@ import * as os from 'os';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
-import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
+import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../lib/secrets/bundles.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
+import { addControlToken } from '../lib/serve/token.js';
+import { DEFAULT_SERVE_PORT } from '../lib/serve/server.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from '../lib/devices/tailscale.js';
 import { localLoginUser, planDeviceReconciliation, runDeviceSync, withDefaultUser } from '../lib/devices/sync.js';
 import { resolveDeviceTarget, splitUserHost } from '../lib/devices/resolve-target.js';
@@ -400,6 +402,47 @@ Typical workflow:
             process.exit(1);
         }
     });
+    devicesCmd
+        .command('pair-ios [name]')
+        .description('Pair an iPhone/iPad cockpit (RUSH-1733): mint a control token for `agents serve --control` and mark the device control-only. The token is shown ONCE — enter it in the app. Run this on the anchor.')
+        .option('--port <n>', 'Anchor control port to advertise to the app', String(DEFAULT_SERVE_PORT))
+        .action(async (name, opts) => {
+        const label = (name || 'iphone').trim();
+        // Mint the bearer token — hash-only on disk, raw shown once (see serve/token.ts).
+        const { id, token } = addControlToken(label);
+        // If a device with this name is already registered (e.g. discovered over
+        // Tailscale as an `unknown`-platform node), mark it control-only so the
+        // fleet stops trying to dial it for sessions/placement.
+        let marked = false;
+        let unknownName = false;
+        if (name) {
+            const existing = await getDevice(name);
+            if (existing) {
+                await upsertDevice(name, { role: 'control' });
+                marked = true;
+            }
+            else {
+                unknownName = true;
+            }
+        }
+        const port = parseInt(opts.port ?? '', 10) || DEFAULT_SERVE_PORT;
+        console.log(chalk.green(`Paired cockpit '${label}'`) + chalk.gray(` (token id ${id})`));
+        if (marked)
+            console.log(chalk.gray(`Marked device '${name}' role=control — the fleet won't dial it.`));
+        if (unknownName) {
+            console.log(chalk.yellow(`Note: no registered device named '${name}' — token minted, but no device was marked role=control.`) +
+                chalk.gray(` Run \`agents devices sync\` first if this phone should appear in the fleet.`));
+        }
+        console.log();
+        console.log(chalk.bold('Control token (shown once — enter it in the app):'));
+        console.log('  ' + chalk.cyan(token));
+        console.log();
+        console.log('On the anchor, expose the control server on your tailnet:');
+        console.log(chalk.gray(`  agents serve --control --bind <anchor-tailnet-ip> --port ${port}`));
+        console.log('Then point the app at:');
+        console.log(chalk.gray(`  http://<anchor-tailnet-ip>:${port}   (Bearer: the token above)`));
+        console.log(chalk.yellow('Keep the control server on the tailnet — never public Funnel.'));
+    });
     devicesCmd
         .command('rm <name>')
         .alias('remove')
@@ -544,7 +587,7 @@ async function runAskpass() {
         process.exit(1);
     }
     try {
-        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents ssh' });
+        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents ssh', agentOnly: isHeadlessSecretsContext() });
         const value = env[key];
         if (value === undefined) {
             console.error(`askpass: key '${key}' not found in bundle '${bundle}'`);

package/dist/commands/versions.js

@@ -4,7 +4,7 @@ import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
 import { select, confirm, checkbox } from '@inquirer/prompts';
-import { AGENTS, ALL_AGENT_IDS, getAccountEmail, getAccountInfo, agentLabel, warnAgentDeprecated, isSelfUpdatingAgent, } from '../lib/agents.js';
+import { AGENTS, ALL_AGENT_IDS, accountOrgBadge, getAccountEmail, getAccountInfo, agentLabel, warnAgentDeprecated, isSelfUpdatingAgent, } from '../lib/agents.js';
 import { formatUsageSummary, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, } from '../lib/usage.js';
 import { viewAction } from './view.js';
 import { readManifest, writeManifest, createDefaultManifest } from '../lib/manifest.js';
@@ -32,8 +32,12 @@ function fixSessionFilePaths(agent, version, oldVersionDir) {
 }
 function formatAccountHint(info, usage) {
     const parts = [];
-    if (info.email)
-        parts.push(info.email);
+    if (info.email) {
+        // Same-email accounts can live in different orgs (personal Max vs a Team
+        // seat) — the badge is what makes the picker disambiguate them.
+        const badge = accountOrgBadge(info);
+        parts.push(badge ? `${info.email} (${badge})` : info.email);
+    }
     const usageSummary = formatUsageSummary(info.plan, usage);
     if (usageSummary)
         parts.push(usageSummary);

package/dist/commands/view.d.ts

@@ -7,8 +7,23 @@
  * rules, hooks, and promptcuts synced to that version.
  */
 import type { Command } from 'commander';
+import type { AccountInfo } from '../lib/agents.js';
 import type { AgentId } from '../lib/types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
+/**
+ * Text for the account (email) column. Prefers the real email; otherwise, for a
+ * signed-in agent whose credential carries no email but does carry an opaque
+ * account id (Kimi's user_id), show `id:<user_id>` so distinct accounts read
+ * distinctly instead of a generic "signed in". Falls back to "signed in" when we
+ * have neither (Antigravity), and empty when signed out.
+ *
+ * When the account carries a Claude organizationType, the org badge is appended
+ * — "email (Turing Labs · Team)" — so two installs signed into the same email
+ * under different orgs (personal Max vs a Team seat) read distinctly. The
+ * suffix is plain text inside the label so the existing column-width pass
+ * measures and pads it for free.
+ */
+export declare function accountColumnLabel(info?: Pick<AccountInfo, 'email' | 'accountId' | 'signedIn' | 'organizationType' | 'organizationName'> | null): string;
 type SyncState = 'synced' | 'new' | 'modified' | 'deleted';
 /** Per-section filter flags. When any are true, only those sections render. */
 export interface ViewSectionFilter {
@@ -32,6 +47,8 @@ export interface ViewJsonVersion {
     signedIn: boolean;
     email: string | null;
     accountId?: string | null;
+    organizationType?: string | null;
+    organizationName?: string | null;
     plan: string | null;
     usageStatus: 'available' | 'rate_limited' | 'out_of_credits' | null;
     overageCredits?: {
@@ -86,6 +103,15 @@ export declare function parseResourceSections(options: {
     resources?: string | boolean;
     detailed?: boolean;
 } & ViewSectionFilter, jsonMode: boolean): Set<ResourceSection>;
+/**
+ * Identity key for duplicate-install detection. Prefers accountKey — which
+ * encodes account AND org — over the bare email: two installs can share an
+ * email yet belong to different orgs (a personal Max plan and a Team seat),
+ * and grouping those by email alone would propose pruning a live account.
+ * Falls back to the lowercased email for agents whose credentials expose no
+ * identity key. Null when there is no usable identity.
+ */
+export declare function pruneGroupKey(info: Pick<AccountInfo, 'accountKey' | 'email'>): string | null;
 /**
  * Prune older installed versions that share an email with a newer installed
  * version. Keeps the highest semver per email, skips the global default (with

package/dist/commands/view.js

@@ -4,7 +4,7 @@ import { visibleWidth, termLink } from '../lib/format.js';
 import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
-import { AGENTS, ALL_AGENT_IDS, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
+import { AGENTS, ALL_AGENT_IDS, accountOrgBadge, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
 import { deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, } from '../lib/usage.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, syncResourcesToVersion, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, } from '../lib/versions.js';
@@ -34,12 +34,20 @@ const SIGNED_IN_LABEL = 'signed in';
  * account id (Kimi's user_id), show `id:<user_id>` so distinct accounts read
  * distinctly instead of a generic "signed in". Falls back to "signed in" when we
  * have neither (Antigravity), and empty when signed out.
+ *
+ * When the account carries a Claude organizationType, the org badge is appended
+ * — "email (Turing Labs · Team)" — so two installs signed into the same email
+ * under different orgs (personal Max vs a Team seat) read distinctly. The
+ * suffix is plain text inside the label so the existing column-width pass
+ * measures and pads it for free.
  */
-function accountColumnLabel(info) {
+export function accountColumnLabel(info) {
     if (!info)
         return '';
-    if (info.email)
-        return info.email;
+    if (info.email) {
+        const badge = accountOrgBadge(info);
+        return badge ? `${info.email} (${badge})` : info.email;
+    }
     if (info.signedIn)
         return info.accountId ? `id:${info.accountId}` : SIGNED_IN_LABEL;
     return '';
@@ -1149,6 +1157,8 @@ async function collectAgentsJson(filterAgentId, resourceSections) {
             signedIn: info.signedIn,
             email: info.email,
             accountId: info.accountId,
+            organizationType: info.organizationType ?? null,
+            organizationName: info.organizationName ?? null,
             plan: info.plan,
             usageStatus: info.usageStatus,
             overageCredits: info.overageCredits,
@@ -1184,6 +1194,17 @@ async function collectAgentsJson(filterAgentId, resourceSections) {
     }
     return out;
 }
+/**
+ * Identity key for duplicate-install detection. Prefers accountKey — which
+ * encodes account AND org — over the bare email: two installs can share an
+ * email yet belong to different orgs (a personal Max plan and a Team seat),
+ * and grouping those by email alone would propose pruning a live account.
+ * Falls back to the lowercased email for agents whose credentials expose no
+ * identity key. Null when there is no usable identity.
+ */
+export function pruneGroupKey(info) {
+    return info.accountKey ?? info.email?.toLowerCase() ?? null;
+}
 async function buildAgentPrunePlan(agentId) {
     const dirInfos = listInstalledVersionDirs(agentId);
     const entries = await Promise.all(dirInfos.map(async ({ version, hasBinary }) => {
@@ -1198,16 +1219,18 @@ async function buildAgentPrunePlan(agentId) {
     // working binary — those are the things that compete for "the live install
     // for this account."
     const installed = entries.filter((e) => e.hasBinary);
-    const byEmail = new Map();
+    const byAccount = new Map();
     for (const e of installed) {
         if (!e.info.email)
             continue;
-        const key = e.info.email.toLowerCase();
-        const list = byEmail.get(key) ?? [];
+        const key = pruneGroupKey(e.info);
+        if (!key)
+            continue;
+        const list = byAccount.get(key) ?? [];
         list.push(e);
-        byEmail.set(key, list);
+        byAccount.set(key, list);
     }
-    for (const [, group] of byEmail) {
+    for (const [, group] of byAccount) {
         if (group.length < 2)
             continue;
         const sorted = [...group].sort((a, b) => compareVersions(b.version, a.version));

package/dist/commands/webhook.js

@@ -1,6 +1,8 @@
+import * as path from 'path';
 import chalk from 'chalk';
-import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
-import { startWebhookServer } from '../lib/triggers/webhook.js';
+import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../lib/secrets/bundles.js';
+import { createFileDeliveryStore, startWebhookServer } from '../lib/triggers/webhook.js';
+import { getRuntimeStateDir } from '../lib/state.js';
 const DEFAULT_HOST = '127.0.0.1';
 const DEFAULT_PORT = 8787;
 function positiveInt(value, fallback) {
@@ -10,6 +12,9 @@ function positiveInt(value, fallback) {
 function readWebhookSecrets(bundleName) {
     const { env } = readAndResolveBundleEnv(bundleName, {
         caller: 'webhook serve',
+        // `webhook serve` is a long-running background server; when started detached
+        // (no TTY) it must resolve broker-only rather than pop an unanswerable prompt.
+        agentOnly: isHeadlessSecretsContext(),
     });
     const secrets = {};
     if (env.GITHUB_WEBHOOK_SECRET)
@@ -69,6 +74,9 @@ export function registerWebhookCommand(program) {
                 port,
                 secrets,
                 rateLimitPerMinute: rateLimit,
+                // Durable delivery dedup: replays survive a receiver restart (an
+                // in-memory store would forget every seen delivery on restart).
+                deliveryStore: createFileDeliveryStore(path.join(getRuntimeStateDir(), 'webhook', 'deliveries.json')),
                 onDelivery: (webhook, fired) => {
                     console.log(`${new Date().toISOString()} ${webhook.source}:${webhook.event} ` +
                         `${fired.length ? `fired ${fired.map((f) => f.jobName).join(', ')}` : 'no match'}`);

package/dist/index.js

@@ -26,7 +26,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageJsonPath = path.join(__dirname, '..', 'package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
 const VERSION = packageJson.version;
-import { NPM_PACKAGE_NAME, deriveGlobalPrefix, detectPackageManager, installPackageIntoPrefix, installPackageWithBun, verifyInstalledVersion, refreshAliasShims, } from './lib/self-update.js';
+import { NPM_PACKAGE_NAME, deriveGlobalPrefix, detectPackageManager, installPackageIntoPrefix, installPackageWithBun, verifyInstalledVersion, refreshAliasShims, downloadVerifiedTarball, } from './lib/self-update.js';
 // Detect dev/working-tree builds and default the noisy startup steps off.
 // Three cases trip this:
 //   1. Dev install (scripts/install.sh) — package.json version stamped 0.0.0-dev.<sha>
@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -315,10 +315,12 @@ async function fetchNpmPackageMetadata(versionOrTag = 'latest', timeoutMs = 5000
         throw new Error('Could not reach npm registry');
     }
     const data = await response.json();
-    if (typeof data.version !== 'string' || typeof data.dist?.integrity !== 'string') {
-        throw new Error('npm registry response did not include version and integrity');
+    if (typeof data.version !== 'string' ||
+        typeof data.dist?.integrity !== 'string' ||
+        typeof data.dist?.tarball !== 'string') {
+        throw new Error('npm registry response did not include version, integrity, and tarball');
     }
-    return { version: data.version, integrity: data.dist.integrity };
+    return { version: data.version, integrity: data.dist.integrity, tarball: data.dist.tarball };
 }
 function printResolvedPackage(metadata) {
     console.log(chalk.gray(`Resolved: ${NPM_PACKAGE_NAME}@${metadata.version}`));
@@ -326,16 +328,32 @@ function printResolvedPackage(metadata) {
 }
 async function installResolvedPackage(metadata) {
     const packageRoot = path.resolve(__dirname, '..');
-    const spec = `${NPM_PACKAGE_NAME}@${metadata.version}`;
-    // Upgrade with the package manager that owns this install. A bun global
-    // install lives at <bunGlobalDir>/node_modules/... (no `lib` segment), so an
-    // `npm install --prefix` would write to <bunGlobalDir>/lib/node_modules and
-    // never touch the running copy — npm exits 0, the verify below fails.
-    if (detectPackageManager(packageRoot) === 'bun') {
-        await installPackageWithBun(spec);
+    // Download the published tarball and prove its bytes match the registry
+    // integrity BEFORE installing anything. A `name@version` spec would let the
+    // package manager fetch and install whatever the registry serves with no
+    // hash check on our side; instead we verify here and install the LOCAL, now
+    // trusted .tgz. A mismatch throws and nothing below runs — fail closed.
+    const tarball = await downloadVerifiedTarball(metadata.tarball, metadata.integrity);
+    try {
+        // Upgrade with the package manager that owns this install. A bun global
+        // install lives at <bunGlobalDir>/node_modules/... (no `lib` segment), so an
+        // `npm install --prefix` would write to <bunGlobalDir>/lib/node_modules and
+        // never touch the running copy — npm exits 0, the verify below fails.
+        if (detectPackageManager(packageRoot) === 'bun') {
+            await installPackageWithBun(tarball);
+        }
+        else {
+            await installPackageIntoPrefix(tarball, deriveGlobalPrefix(packageRoot));
+        }
     }
-    else {
-        await installPackageIntoPrefix(spec, deriveGlobalPrefix(packageRoot));
+    finally {
+        // Best-effort cleanup of the verified tarball and its temp dir.
+        try {
+            fs.rmSync(path.dirname(tarball), { recursive: true, force: true });
+        }
+        catch {
+            /* leave it for the OS temp sweep */
+        }
     }
     verifyInstalledVersion(packageRoot, metadata.version);
     refreshAliasShims(packageRoot);
@@ -669,6 +687,7 @@ async function registerAllEagerCommands() {
     await reg(loadPackages);
     await reg(loadDaemon);
     await reg(loadRoutines);
+    await reg(loadMonitors);
     await reg(loadRun);
     await reg(loadDefaults);
     await reg(loadModels);
@@ -676,6 +695,7 @@ async function registerAllEagerCommands() {
     await reg(loadTrash);
     await reg(loadRestore);
     await reg(loadDoctor);
+    await reg(loadApply);
     await reg(loadCheck);
     await reg(loadStatus);
     registerExecAliasCommand(program);

package/dist/lib/agents.d.ts

@@ -127,7 +127,25 @@ export interface AccountInfo {
     } | null;
     lastActive: Date | null;
     signedIn: boolean;
+    organizationType?: string | null;
+    organizationName?: string | null;
 }
+/**
+ * Human-readable label for a Claude account's organizationType as read from
+ * .claude.json's oauthAccount ("claude_team" -> "Team"). Unrecognized values
+ * (future tiers) are rendered by stripping the "claude_" prefix and
+ * title-casing the rest — an unfamiliar-but-visible label beats silence.
+ * Returns null for missing input.
+ */
+export declare function formatClaudeOrgLabel(orgType: string | null | undefined): string | null;
+/**
+ * Short badge identifying which org an account belongs to: "Turing Labs · Team"
+ * for multi-seat orgs, just the tier label ("Max") for personal plans — a
+ * personal org's name is auto-generated boilerplate ("<email>'s Organization"),
+ * not identity. Returns null when the account carries no organizationType
+ * (signed out, non-Claude agents, configs predating the field).
+ */
+export declare function accountOrgBadge(info?: Pick<AccountInfo, 'organizationType' | 'organizationName'> | null): string | null;
 /** Return the email address associated with the agent's auth config, or null. */
 export declare function getAccountEmail(agentId: AgentId, home?: string): Promise<string | null>;
 /** Decrypted contents of Droid's auth.v2.file (subset we consume). */

package/dist/lib/agents.js

@@ -17,7 +17,7 @@ import * as os from 'os';
 import * as TOML from 'smol-toml';
 import * as yaml from 'yaml';
 import chalk from 'chalk';
-import { needsWindowsShell } from './platform/index.js';
+import { execFileShellSpec } from './platform/index.js';
 import { latestFileMtimeMs } from './fs-walk.js';
 import { damerauLevenshtein } from './fuzzy.js';
 import { getCacheDir, getVersionsDir, getShimsDir, getCliVersionCachePath } from './state.js';
@@ -943,6 +943,48 @@ export function ensureSkillsDir(agentId) {
 export function agentConfigDirName(agentId) {
     return path.relative(HOME, AGENTS[agentId].configDir);
 }
+/**
+ * Human-readable label for a Claude account's organizationType as read from
+ * .claude.json's oauthAccount ("claude_team" -> "Team"). Unrecognized values
+ * (future tiers) are rendered by stripping the "claude_" prefix and
+ * title-casing the rest — an unfamiliar-but-visible label beats silence.
+ * Returns null for missing input.
+ */
+export function formatClaudeOrgLabel(orgType) {
+    if (!orgType)
+        return null;
+    const known = {
+        claude_max: 'Max',
+        claude_pro: 'Pro',
+        claude_team: 'Team',
+        claude_enterprise: 'Enterprise',
+        claude_free: 'Free',
+    };
+    if (known[orgType])
+        return known[orgType];
+    return orgType
+        .replace(/^claude_/, '')
+        .split('_')
+        .filter(Boolean)
+        .map((w) => w[0].toUpperCase() + w.slice(1))
+        .join(' ');
+}
+/**
+ * Short badge identifying which org an account belongs to: "Turing Labs · Team"
+ * for multi-seat orgs, just the tier label ("Max") for personal plans — a
+ * personal org's name is auto-generated boilerplate ("<email>'s Organization"),
+ * not identity. Returns null when the account carries no organizationType
+ * (signed out, non-Claude agents, configs predating the field).
+ */
+export function accountOrgBadge(info) {
+    const label = formatClaudeOrgLabel(info?.organizationType);
+    if (!label)
+        return null;
+    const isMultiSeat = info?.organizationType === 'claude_team' || info?.organizationType === 'claude_enterprise';
+    if (isMultiSeat && info?.organizationName)
+        return `${info.organizationName} · ${label}`;
+    return label;
+}
 /** Return the email address associated with the agent's auth config, or null. */
 export async function getAccountEmail(agentId, home) {
     const info = await getAccountInfo(agentId, home);
@@ -1248,6 +1290,8 @@ export async function getAccountInfo(agentId, home) {
                     overageCredits,
                     lastActive,
                     signedIn: !!email,
+                    organizationType: oa?.organizationType ?? null,
+                    organizationName: oa?.organizationName ?? null,
                 };
             }
             case 'codex': {
@@ -1659,7 +1703,10 @@ export async function registerMcp(agentId, name, command, scope = 'user', transp
         // On Windows a bare command name / `.cmd` wrapper (the npm-installed agent
         // CLI) can't be exec'd directly — it needs shell:true for PATHEXT/cmd. Off
         // Windows this is always false, so the no-shell argv path is unchanged.
-        await execFileAsync(bin, args, { ...(env ? { env } : {}), shell: needsWindowsShell(bin) });
+        // RUSH-1752: when shell is needed, compose a fully-quoted command line and
+        // pass EMPTY argv so user-controlled MCP command/args never reach cmd.exe unescaped.
+        const spec = execFileShellSpec(bin, args);
+        await execFileAsync(spec.command, spec.args, { ...(env ? { env } : {}), shell: spec.shell });
         return { success: true };
     }
     catch (err) {
@@ -1687,7 +1734,10 @@ export async function unregisterMcp(agentId, name, options) {
     try {
         const bin = options?.binary || agent.cliCommand;
         const env = options?.home ? { ...process.env, HOME: options.home } : undefined;
-        await execFileAsync(bin, ['mcp', 'remove', name], { ...(env ? { env } : {}), shell: needsWindowsShell(bin) });
+        // RUSH-1752: same shell-safe path as registerMcp — attacker-controlled MCP
+        // `name` must not reach cmd.exe unescaped when shell:true is required.
+        const spec = execFileShellSpec(bin, ['mcp', 'remove', name]);
+        await execFileAsync(spec.command, spec.args, { ...(env ? { env } : {}), shell: spec.shell });
         return { success: true };
     }
     catch (err) {

package/dist/lib/auto-dispatch-provider.js

@@ -9,7 +9,7 @@
 import { resolveProvider } from './cloud/registry.js';
 export function createProviderDispatcher() {
     return {
-        async dispatch({ agent, prompt, repo, provider }) {
+        async dispatch({ agent, prompt, repo, provider, host }) {
             const p = resolveProvider(provider, agent);
             const caps = p.capabilities();
             if (!caps.available) {
@@ -18,7 +18,12 @@ export function createProviderDispatcher() {
             if (!caps.dispatch) {
                 throw new Error(`cloud provider '${p.id}' does not support dispatch`);
             }
-            const task = await p.dispatch({ agent, prompt, repo });
+            // The host provider clones nothing — a repo target is meaningless there
+            // and its dispatch() rejects it; a ticket project pinned to 'host' relies
+            // on the machine's own checkout (the project's `host` names the machine).
+            const task = p.id === 'host'
+                ? await p.dispatch({ agent, prompt, providerOptions: { host } })
+                : await p.dispatch({ agent, prompt, repo });
             return { id: task.id };
         },
     };

package/dist/lib/auto-dispatch.d.ts

@@ -22,6 +22,7 @@ export interface AutoDispatchProject {
     autoDispatch?: boolean;
     maxAgents?: number;
     provider?: string;
+    host?: string;
 }
 /** A Linear issue that is a candidate for dispatch. */
 export interface DelegatedIssue {
@@ -36,6 +37,7 @@ export interface PlannedDispatch {
     projectId: string;
     repoSlug?: string;
     provider?: string;
+    host?: string;
     issueId: string;
     identifier: string;
     title: string;
@@ -73,6 +75,7 @@ export interface Dispatcher {
         prompt: string;
         repo?: string;
         provider?: string;
+        host?: string;
     }): Promise<{
         id: string;
     }>;

package/dist/lib/auto-dispatch.js

@@ -46,6 +46,7 @@ export function readAutoDispatchProjects() {
             autoDispatch: o.autoDispatch === true,
             maxAgents: typeof o.maxAgents === 'number' ? o.maxAgents : undefined,
             provider: typeof o.provider === 'string' ? o.provider : undefined,
+            host: typeof o.host === 'string' ? o.host : undefined,
         });
     }
     return out;
@@ -76,6 +77,7 @@ export function planAutoDispatch(projects, inFlightByProject, delegatedTodoByPro
                 projectId: p.id,
                 repoSlug: p.repoSlug,
                 provider: p.provider,
+                host: p.host,
                 issueId: issue.id,
                 identifier: issue.identifier,
                 title: issue.title,
@@ -122,6 +124,7 @@ export async function autoDispatchTick(deps) {
                 prompt: dispatchPrompt(d.identifier, d.title),
                 repo: d.repoSlug,
                 provider: d.provider,
+                host: d.host,
             });
             // Bookkeeping only — dispatch already happened; moving to Doing keeps the
             // ticket out of the next Todo poll. A failure here is non-fatal.