@phnx-labs/agents-cli 1.20.64 → 1.20.66

package/dist/lib/shims.js

@@ -16,7 +16,7 @@ import { confirm, select } from '@inquirer/prompts';
 import { IS_WINDOWS, prependToWindowsUserPath } from './platform/index.js';
 import { getShimsDir, getVersionsDir, getBackupsDir, getHistoryDir, ensureAgentsDir } from './state.js';
 export { getShimsDir };
-import { AGENTS, agentConfigDirName } from './agents.js';
+import { AGENTS, agentConfigDirName, readAuthAccountIdentity } from './agents.js';
 /**
  * Files and directories to always skip during conflict detection and migration.
  * These are never user config that should be migrated.
@@ -1143,6 +1143,21 @@ function detectMigrationConflicts(agent, version) {
  * preserved so the "freshest" comparison stays stable and switches don't
  * ping-pong. Best-effort: a failed copy just means the user re-logs in.
  */
+/**
+ * Best-effort account identity for the credential *directory* of a file-auth
+ * agent (droid / kimi / antigravity), or null when the directory holds no
+ * decodable account claim. Delegates to readAuthAccountIdentity, which decrypts
+ * / decodes each agent's REAL on-disk format (droid AES-256-GCM + WorkOS JWT,
+ * kimi access-token JWT, antigravity refresh-token) — the earlier plaintext
+ * top-level-key scan matched NO real credential file, so the guard below never
+ * engaged. Two dirs for the SAME account compare equal; DIFFERENT accounts
+ * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
+ * account's login with a credential that belongs to a DIFFERENT account
+ * (RUSH-1764).
+ */
+export function readAuthFileIdentity(agent, configDir) {
+    return readAuthAccountIdentity(agent, configDir);
+}
 export function carryForwardAuthFiles(agent, toConfigDir) {
     const authFiles = AGENTS[agent].authFiles;
     if (!authFiles || authFiles.length === 0)
@@ -1158,12 +1173,33 @@ export function carryForwardAuthFiles(agent, toConfigDir) {
     catch {
         return; // no installed versions to source from
     }
+    // Account identity currently installed at the destination home (null when the
+    // dest is empty or its credential can't be decoded). When it IS known, only a
+    // source home whose credential decodes to the SAME account is eligible to
+    // overwrite it — so a newer login for a DIFFERENT account sitting in another
+    // version-home can't silently replace the account the user is signed into
+    // (RUSH-1764). An empty destination still seeds from the freshest source (the
+    // version-switch case). Identity is a per-DIR/account property, not per-file:
+    // for droid it comes from decrypting auth.v2.file with auth.v2.key, so it must
+    // gate BOTH files as a unit (never carry account B's key over account A's).
+    const toResolved = path.resolve(toConfigDir);
+    const destIdentity = readAuthFileIdentity(agent, toConfigDir);
+    const identityCache = new Map();
+    const dirIdentity = (dir) => {
+        const key = path.resolve(dir);
+        if (!identityCache.has(key))
+            identityCache.set(key, readAuthFileIdentity(agent, dir));
+        return identityCache.get(key) ?? null;
+    };
     for (const rel of authFiles) {
         const dest = path.join(toConfigDir, rel);
         const destResolved = path.resolve(dest);
-        // Newest existing source copy across all version homes (excluding dest).
+        // Newest existing source copy across all version homes (excluding dest),
+        // constrained to the destination's account identity when it is known.
         let newest = null;
         for (const dir of sourceDirs) {
+            if (path.resolve(dir) === toResolved)
+                continue; // never source from self
             const src = path.join(dir, rel);
             if (path.resolve(src) === destResolved)
                 continue;
@@ -1176,6 +1212,10 @@ export function carryForwardAuthFiles(agent, toConfigDir) {
             }
             if (!st.isFile())
                 continue;
+            // Account-identity guard: never carry a different account's credential over
+            // an existing login. Only enforced when the destination's identity is known.
+            if (destIdentity !== null && dirIdentity(dir) !== destIdentity)
+                continue;
             if (!newest || st.mtimeMs > newest.mtimeMs)
                 newest = { path: src, mtimeMs: st.mtimeMs };
         }

package/dist/lib/ssh-exec.d.ts

@@ -29,6 +29,16 @@ export declare function shellQuote(s: string): string;
  */
 export declare const SSH_OPTS: readonly string[];
 export declare function controlOpts(): string[];
+/**
+ * Compose an ssh connection-option prefix.
+ *
+ * `hostKeyOpts` (a caller's host-key posture, e.g. a pinned
+ * `StrictHostKeyChecking=yes` + managed `UserKnownHostsFile`) go FIRST, ahead of
+ * the `SSH_OPTS` baseline: ssh honors the *first* value it sees for each option,
+ * so an override placed after the baseline's `accept-new` would be silently
+ * ignored. Pure so the ordering contract is unit-testable. See RUSH-1767.
+ */
+export declare function sshConnectOpts(mux: string[], hostKeyOpts?: string[]): string[];
 export interface SshExecOptions {
     /** Piped to the remote command's stdin (never interpolated into the shell). */
     input?: string;
@@ -38,6 +48,13 @@ export interface SshExecOptions {
     extraSshArgs?: string[];
     /** Reuse a persistent control socket across calls (default true; see `controlOpts`). */
     multiplex?: boolean;
+    /**
+     * Host-key `-o` options that OVERRIDE the accept-new baseline — prepended so
+     * ssh's first-value-wins rule takes them (see {@link sshConnectOpts}). Used to
+     * force strict verification against the managed known_hosts store on the
+     * credential-copy path (RUSH-1767).
+     */
+    hostKeyOpts?: string[];
 }
 export interface SshExecResult {
     /** Remote exit status, or null if ssh itself failed / timed out. */
@@ -79,6 +96,13 @@ export interface SshStreamOptions {
     tty?: boolean;
     /** Reuse a persistent control socket across calls (default true; see `controlOpts`). */
     multiplex?: boolean;
+    /**
+     * Host-key `-o` options that OVERRIDE the accept-new baseline — prepended so
+     * ssh's first-value-wins rule takes them (see {@link sshConnectOpts}). Used to
+     * force strict verification against the managed known_hosts store on the
+     * interactive credential-copy path (RUSH-1767).
+     */
+    hostKeyOpts?: string[];
 }
 /**
  * Foreground counterpart to `sshExec`: run `remoteCmd` on `target` with the

package/dist/lib/ssh-exec.js

@@ -88,6 +88,18 @@ export function controlOpts() {
         '-o', 'ControlPersist=60s',
     ];
 }
+/**
+ * Compose an ssh connection-option prefix.
+ *
+ * `hostKeyOpts` (a caller's host-key posture, e.g. a pinned
+ * `StrictHostKeyChecking=yes` + managed `UserKnownHostsFile`) go FIRST, ahead of
+ * the `SSH_OPTS` baseline: ssh honors the *first* value it sees for each option,
+ * so an override placed after the baseline's `accept-new` would be silently
+ * ignored. Pure so the ordering contract is unit-testable. See RUSH-1767.
+ */
+export function sshConnectOpts(mux, hostKeyOpts) {
+    return [...(hostKeyOpts ?? []), ...SSH_OPTS, ...mux];
+}
 /**
  * Run `remoteCmd` on `target` over ssh and capture stdout/stderr/exit.
  *
@@ -97,7 +109,7 @@ export function controlOpts() {
 export function sshExec(target, remoteCmd, opts = {}) {
     assertValidSshTarget(target);
     const mux = opts.multiplex === false ? [] : controlOpts();
-    const args = [...SSH_OPTS, ...mux, ...(opts.extraSshArgs ?? []), target, remoteCmd];
+    const args = [...sshConnectOpts(mux, opts.hostKeyOpts), ...(opts.extraSshArgs ?? []), target, remoteCmd];
     const res = spawnSync('ssh', args, {
         input: opts.input,
         encoding: 'utf-8',
@@ -123,7 +135,7 @@ export function sshExec(target, remoteCmd, opts = {}) {
 export function sshExecRaw(target, remoteCmd, opts = {}) {
     assertValidSshTarget(target);
     const mux = opts.multiplex === false ? [] : controlOpts();
-    const args = [...SSH_OPTS, ...mux, ...(opts.extraSshArgs ?? []), target, remoteCmd];
+    const args = [...sshConnectOpts(mux, opts.hostKeyOpts), ...(opts.extraSshArgs ?? []), target, remoteCmd];
     const res = spawnSync('ssh', args, {
         input: opts.input,
         // No `encoding` → spawnSync returns Buffers.
@@ -154,7 +166,7 @@ export function sshStream(target, remoteCmd, opts = {}) {
     assertValidSshTarget(target);
     const mux = opts.multiplex === false ? [] : controlOpts();
     const tty = opts.tty ? ['-tt'] : [];
-    const args = [...SSH_OPTS, ...mux, ...tty, target, remoteCmd];
+    const args = [...sshConnectOpts(mux, opts.hostKeyOpts), ...tty, target, remoteCmd];
     const res = spawnSync('ssh', args, { stdio: 'inherit' });
     if (typeof res.status === 'number')
         return res.status;

package/dist/lib/ssh-tunnel.d.ts

@@ -49,6 +49,8 @@ export declare const REMOTE_HELPER_PORT = 8765;
 export declare const REMOTE_TASK_NAME = "AgentsComputerHelper";
 /** Basename of the cross-published exe under native/computer-win/dist. */
 export declare const WIN_HELPER_EXE = "computer-helper-win.exe";
+/** Basename of the daemon's shared-secret token file under %LOCALAPPDATA%\agents. */
+export declare const WIN_HELPER_TOKEN_FILE = "helper-token";
 /**
  * Locate a locally built Windows daemon exe — a repo-checkout build output from
  * `scripts/build-win.sh`, or one bundled next to the package. Local paths are
@@ -101,6 +103,16 @@ export declare function remoteStatePath(device: string): string;
 export declare function readRemoteState(device: string): RemoteTunnelState | null;
 export declare function writeRemoteState(state: RemoteTunnelState): void;
 export declare function clearRemoteState(device: string): void;
+/**
+ * Local file holding the shared-secret token for a device's helper daemon.
+ * Written at `setup --host` (0600), read at `start --host` so the RPC client
+ * authenticates. The remote daemon reads the same value from its own
+ * `--token-file`; the CLI is the source of truth and never round-trips it back.
+ */
+export declare function helperTokenPath(device: string): string;
+export declare function readHelperToken(device: string): string | null;
+export declare function writeHelperToken(device: string, token: string): void;
+export declare function clearHelperToken(device: string): void;
 /** Resolve a registered device to its ssh pieces, or throw a clear error. */
 export declare function resolveRemoteDevice(name: string): Promise<{
     device: DeviceProfile;
@@ -123,7 +135,13 @@ export declare function buildVerifyPushScript(remotePath: string, expectedBytes:
  * survives ssh disconnect — the same rationale as the browser WMI launch. The
  * task is started immediately so the caller need not log out/in.
  */
-export declare function buildRegisterTaskScript(port: number, taskName: string): string;
+/**
+ * PowerShell that writes the shared-secret token under %LOCALAPPDATA%\agents
+ * with an owner-only ACL (inheritance removed, read granted only to the current
+ * user) and echoes the resolved path so the caller can pass it to `--token-file`.
+ */
+export declare function buildWriteTokenScript(token: string): string;
+export declare function buildRegisterTaskScript(port: number, taskName: string, tokenPath: string): string;
 /** PowerShell that unregisters the task and stops any running daemon process. */
 export declare function buildUnregisterTaskScript(taskName: string): string;
 /** Convert a Windows path returned by PowerShell into the scp/SFTP path form. */

package/dist/lib/ssh-tunnel.js

@@ -103,6 +103,8 @@ export const REMOTE_HELPER_PORT = 8765;
 export const REMOTE_TASK_NAME = 'AgentsComputerHelper';
 /** Basename of the cross-published exe under native/computer-win/dist. */
 export const WIN_HELPER_EXE = 'computer-helper-win.exe';
+/** Basename of the daemon's shared-secret token file under %LOCALAPPDATA%\agents. */
+export const WIN_HELPER_TOKEN_FILE = 'helper-token';
 /**
  * Locate a locally built Windows daemon exe — a repo-checkout build output from
  * `scripts/build-win.sh`, or one bundled next to the package. Local paths are
@@ -234,6 +236,37 @@ export function clearRemoteState(device) {
         /* already gone */
     }
 }
+/**
+ * Local file holding the shared-secret token for a device's helper daemon.
+ * Written at `setup --host` (0600), read at `start --host` so the RPC client
+ * authenticates. The remote daemon reads the same value from its own
+ * `--token-file`; the CLI is the source of truth and never round-trips it back.
+ */
+export function helperTokenPath(device) {
+    return path.join(remoteStateDir(), `${device}.token`);
+}
+export function readHelperToken(device) {
+    try {
+        const t = fs.readFileSync(helperTokenPath(device), 'utf-8').trim();
+        return t.length > 0 ? t : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeHelperToken(device, token) {
+    const dir = remoteStateDir();
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(helperTokenPath(device), token, { mode: 0o600 });
+}
+export function clearHelperToken(device) {
+    try {
+        fs.unlinkSync(helperTokenPath(device));
+    }
+    catch {
+        /* already gone */
+    }
+}
 /** Resolve a registered device to its ssh pieces, or throw a clear error. */
 export async function resolveRemoteDevice(name) {
     const device = await getDevice(name);
@@ -284,10 +317,26 @@ export function buildVerifyPushScript(remotePath, expectedBytes) {
  * survives ssh disconnect — the same rationale as the browser WMI launch. The
  * task is started immediately so the caller need not log out/in.
  */
-export function buildRegisterTaskScript(port, taskName) {
+/**
+ * PowerShell that writes the shared-secret token under %LOCALAPPDATA%\agents
+ * with an owner-only ACL (inheritance removed, read granted only to the current
+ * user) and echoes the resolved path so the caller can pass it to `--token-file`.
+ */
+export function buildWriteTokenScript(token) {
+    return [
+        `$dir = Join-Path $env:LOCALAPPDATA 'agents'`,
+        `New-Item -ItemType Directory -Force -Path $dir | Out-Null`,
+        `$tok = Join-Path $dir '${WIN_HELPER_TOKEN_FILE}'`,
+        `Set-Content -LiteralPath $tok -Value ${psSingleQuote(token)} -NoNewline -Encoding ascii`,
+        `icacls $tok /inheritance:r /grant:r ("$($env:USERNAME):(R)") | Out-Null`,
+        `Write-Output $tok`,
+    ].join('; ');
+}
+export function buildRegisterTaskScript(port, taskName, tokenPath) {
+    const argument = `--port ${port} --token-file "${tokenPath}"`;
     return [
         `$exe = Join-Path (Join-Path $env:LOCALAPPDATA 'agents') '${WIN_HELPER_EXE}'`,
-        `$action = New-ScheduledTaskAction -Execute $exe -Argument '--port ${port}'`,
+        `$action = New-ScheduledTaskAction -Execute $exe -Argument ${psSingleQuote(argument)}`,
         `$trigger = New-ScheduledTaskTrigger -AtLogOn`,
         `$principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive -RunLevel Highest`,
         `$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero)`,
@@ -369,13 +418,28 @@ export async function setupRemoteHelper(name) {
     if (verify.code !== 0) {
         throw new Error(`verifying helper exe on '${name}' failed (exit ${verify.code ?? 'null'}): ${verify.stderr.trim() || verify.stdout.trim()}`);
     }
-    // Register + start the LOGON task.
-    const reg = sshExec(target, encodePowerShell(buildRegisterTaskScript(REMOTE_HELPER_PORT, REMOTE_TASK_NAME)), {
+    // Provision the auth token: generate it locally, write it on the remote with
+    // an owner-only ACL, and register the task with --token-file. The daemon now
+    // refuses to start without a token, so a token-less (open-to-any-local-process)
+    // daemon can no longer be stood up through the CLI.
+    const token = generateToken();
+    const tokWrite = sshExec(target, encodePowerShell(buildWriteTokenScript(token)), { timeoutMs: 60_000 });
+    if (tokWrite.code !== 0) {
+        throw new Error(`writing helper token on '${name}' failed (exit ${tokWrite.code ?? 'null'}): ${tokWrite.stderr.trim() || tokWrite.stdout.trim()}`);
+    }
+    const remoteTokenPath = tokWrite.stdout.trim().split(/\r?\n/).filter(Boolean).at(-1);
+    if (!remoteTokenPath) {
+        throw new Error(`writing helper token on '${name}' did not return a destination path`);
+    }
+    // Register + start the LOGON task, pointing it at the token file.
+    const reg = sshExec(target, encodePowerShell(buildRegisterTaskScript(REMOTE_HELPER_PORT, REMOTE_TASK_NAME, remoteTokenPath)), {
         timeoutMs: 60_000,
     });
     if (reg.code !== 0) {
         throw new Error(`registering scheduled task on '${name}' failed (exit ${reg.code ?? 'null'}): ${reg.stderr.trim() || reg.stdout.trim()}`);
     }
+    // Persist the token locally so `start --host` authenticates to the daemon.
+    writeHelperToken(name, token);
     return { target, taskName: REMOTE_TASK_NAME };
 }
 /** Reserve a free local TCP port by binding :0 and reading the assigned port. */
@@ -403,9 +467,17 @@ export async function startRemoteTunnel(name) {
     const tunnelPid = tunnel.pid ?? 0;
     // Verify the daemon answers through the tunnel before we record it. This is
     // the real end-to-end check: tunnel up + daemon listening + RPC round-trips.
-    const token = null; // tunnel-gated; the daemon runs token-less
+    // The daemon now requires a token, so the probe must authenticate with the one
+    // provisioned at `setup`. A missing token means setup predates auth — guide
+    // the user to re-run it rather than silently failing the RPC.
+    const token = readHelperToken(name);
     const prevTcp = process.env.COMPUTER_HELPER_TCP;
+    const prevTok = process.env.COMPUTER_HELPER_TOKEN;
     process.env.COMPUTER_HELPER_TCP = `127.0.0.1:${localPort}`;
+    if (token)
+        process.env.COMPUTER_HELPER_TOKEN = token;
+    else
+        delete process.env.COMPUTER_HELPER_TOKEN;
     const client = openComputerClient();
     let ok = false;
     let probeErr = '';
@@ -424,6 +496,10 @@ export async function startRemoteTunnel(name) {
             delete process.env.COMPUTER_HELPER_TCP;
         else
             process.env.COMPUTER_HELPER_TCP = prevTcp;
+        if (prevTok === undefined)
+            delete process.env.COMPUTER_HELPER_TOKEN;
+        else
+            process.env.COMPUTER_HELPER_TOKEN = prevTok;
     }
     if (!ok) {
         try {
@@ -431,8 +507,10 @@ export async function startRemoteTunnel(name) {
                 process.kill(tunnelPid);
         }
         catch { /* gone */ }
-        throw new Error(`tunnel to '${name}' opened but the daemon did not answer (${probeErr}). ` +
-            `Is it installed? Run: agents computer setup --host ${name}`);
+        const hint = token
+            ? `Is it installed? Run: agents computer setup --host ${name}`
+            : `No auth token on record for '${name}' — re-run: agents computer setup --host ${name}`;
+        throw new Error(`tunnel to '${name}' opened but the daemon did not answer (${probeErr}). ${hint}`);
     }
     const state = {
         device: name,
@@ -473,6 +551,7 @@ export async function stopRemoteHelper(name) {
         /* device gone / offline — local teardown still succeeds */
     }
     clearRemoteState(name);
+    clearHelperToken(name);
     return { tunnelKilled, taskRemoved };
 }
 /**

package/dist/lib/startup/command-registry.d.ts

@@ -43,6 +43,7 @@ export declare const loadImport: ModuleLoader;
 export declare const loadPackages: ModuleLoader;
 export declare const loadDaemon: ModuleLoader;
 export declare const loadRoutines: ModuleLoader;
+export declare const loadMonitors: ModuleLoader;
 export declare const loadRun: ModuleLoader;
 export declare const loadDefaults: ModuleLoader;
 export declare const loadModels: ModuleLoader;
@@ -50,6 +51,7 @@ export declare const loadPrune: ModuleLoader;
 export declare const loadTrash: ModuleLoader;
 export declare const loadRestore: ModuleLoader;
 export declare const loadDoctor: ModuleLoader;
+export declare const loadApply: ModuleLoader;
 export declare const loadCheck: ModuleLoader;
 export declare const loadStatus: ModuleLoader;
 export declare const loadProfiles: ModuleLoader;
@@ -89,6 +91,7 @@ export declare const loadMessage: ModuleLoader;
 export declare const loadFeed: ModuleLoader;
 export declare const loadMailboxes: ModuleLoader;
 export declare const loadServe: ModuleLoader;
+export declare const loadShare: ModuleLoader;
 export declare const loadAudit: ModuleLoader;
 export declare const loadWebhook: ModuleLoader;
 export declare const loadFunnel: ModuleLoader;

package/dist/lib/startup/command-registry.js

@@ -21,6 +21,7 @@ export const loadImport = async () => (await import('../../commands/import.js'))
 export const loadPackages = async () => (await import('../../commands/packages.js')).registerPackagesCommands;
 export const loadDaemon = async () => (await import('../../commands/daemon.js')).registerDaemonCommands;
 export const loadRoutines = async () => (await import('../../commands/routines.js')).registerRoutinesCommands;
+export const loadMonitors = async () => (await import('../../commands/monitors.js')).registerMonitorsCommands;
 export const loadRun = async () => (await import('../../commands/exec.js')).registerRunCommand;
 export const loadDefaults = async () => (await import('../../commands/defaults.js')).registerDefaultsCommands;
 export const loadModels = async () => (await import('../../commands/models.js')).registerModelsCommand;
@@ -28,6 +29,7 @@ export const loadPrune = async () => (await import('../../commands/prune.js')).r
 export const loadTrash = async () => (await import('../../commands/trash.js')).registerTrashCommands;
 export const loadRestore = async () => (await import('../../commands/trash.js')).registerRestoreCommand;
 export const loadDoctor = async () => (await import('../../commands/doctor.js')).registerDoctorCommand;
+export const loadApply = async () => (await import('../../commands/apply.js')).registerApplyCommand;
 export const loadCheck = async () => (await import('../../commands/check.js')).registerCheckCommand;
 export const loadStatus = async () => (await import('../../commands/status.js')).registerStatusCommand;
 export const loadProfiles = async () => (await import('../../commands/profiles.js')).registerProfilesCommands;
@@ -67,6 +69,7 @@ export const loadMessage = async () => (await import('../../commands/message.js'
 export const loadFeed = async () => (await import('../../commands/feed.js')).registerFeedCommand;
 export const loadMailboxes = async () => (await import('../../commands/mailboxes.js')).registerMailboxesCommand;
 export const loadServe = async () => (await import('../../commands/serve.js')).registerServeCommand;
+export const loadShare = async () => (await import('../../commands/share.js')).registerShareCommands;
 export const loadAudit = async () => (await import('../../commands/audit.js')).registerAuditCommands;
 export const loadWebhook = async () => (await import('../../commands/webhook.js')).registerWebhookCommand;
 export const loadFunnel = async () => (await import('../../commands/funnel.js')).registerFunnelCommand;
@@ -121,12 +124,14 @@ export const COMMAND_LOADERS = {
     install: [loadPackages],
     daemon: [loadDaemon],
     routines: [loadRoutines],
+    monitors: [loadMonitors],
     run: [loadRun],
     defaults: [loadDefaults],
     models: [loadModels],
     trash: [loadTrash],
     restore: [loadRestore],
     doctor: [loadDoctor],
+    apply: [loadApply],
     check: [loadCheck],
     status: [loadStatus],
     profiles: [loadProfiles],
@@ -175,6 +180,7 @@ export const COMMAND_LOADERS = {
     mailboxes: [loadMailboxes],
     mailbox: [loadMailboxes],
     serve: [loadServe],
+    share: [loadShare],
     audit: [loadAudit],
     webhook: [loadWebhook],
     funnel: [loadFunnel],

package/dist/lib/state.d.ts

@@ -128,6 +128,11 @@ export declare function getSystemRoutinesDir(): string;
 export declare function getProjectRoutinesDir(cwd?: string): string | null;
 /** Path to routine execution logs (~/.agents/.history/runs/). */
 export declare function getRunsDir(): string;
+/** Path to monitor YAML definitions (~/.agents/monitors/). */
+export declare function getMonitorsDir(): string;
+/** Path to the durable per-monitor state-diff store + fire history
+ * (~/.agents/.history/monitors/). */
+export declare function getMonitorsHistoryDir(): string;
 /** Root for per-agent mailboxes (~/.agents/.history/mailbox/). */
 export declare function getMailboxRootDir(): string;
 /** Root for open-block feed records (~/.agents/.history/feed/). */

package/dist/lib/state.js

@@ -83,12 +83,19 @@ const HISTORY_DIR = path.join(USER_AGENTS_DIR, '.history');
 const CACHE_DIR = path.join(USER_AGENTS_DIR, '.cache');
 // Top-level user dirs (config/definitions only — runtime moves into .history/.cache).
 const ROUTINES_DIR = path.join(USER_AGENTS_DIR, 'routines');
+// Monitor definitions (event-triggered watchers). Sibling of ROUTINES_DIR: a
+// monitor is a routine whose trigger is a watched source instead of a clock.
+const MONITORS_DIR = path.join(USER_AGENTS_DIR, 'monitors');
 const TEAMS_DIR = path.join(USER_AGENTS_DIR, 'teams');
 // History bucket (durable).
 const SESSIONS_DIR = path.join(HISTORY_DIR, 'sessions');
 const SESSIONS_DB_PATH = path.join(SESSIONS_DIR, 'sessions.db');
 const VERSIONS_DIR = path.join(HISTORY_DIR, 'versions');
 const RUNS_DIR = path.join(HISTORY_DIR, 'runs');
+// Durable per-monitor state-diff store + fire history (last-seen value/hash,
+// fires/<id>/). Sibling of RUNS_DIR — the native diff store that replaces the
+// hand-rolled markdown memory files monitors used to need.
+const MONITORS_HISTORY_DIR = path.join(HISTORY_DIR, 'monitors');
 const TEAMS_AGENTS_DIR = path.join(HISTORY_DIR, 'teams', 'agents');
 const BACKUPS_DIR = path.join(HISTORY_DIR, 'backups');
 const TRASH_DIR = path.join(HISTORY_DIR, 'trash');
@@ -324,6 +331,11 @@ export function getProjectRoutinesDir(cwd = process.cwd()) {
 }
 /** Path to routine execution logs (~/.agents/.history/runs/). */
 export function getRunsDir() { return RUNS_DIR; }
+/** Path to monitor YAML definitions (~/.agents/monitors/). */
+export function getMonitorsDir() { return MONITORS_DIR; }
+/** Path to the durable per-monitor state-diff store + fire history
+ * (~/.agents/.history/monitors/). */
+export function getMonitorsHistoryDir() { return MONITORS_HISTORY_DIR; }
 /** Root for per-agent mailboxes (~/.agents/.history/mailbox/). */
 export function getMailboxRootDir() { return MAILBOX_DIR; }
 /** Root for open-block feed records (~/.agents/.history/feed/). */

package/dist/lib/tmux/session.d.ts

@@ -33,6 +33,13 @@ export interface SessionMeta {
 export interface CreateSessionOptions {
     name: string;
     cmd?: string;
+    /**
+     * Redacted copy of `cmd` to persist in SessionMeta.cmd instead of the real
+     * command. When set, `cmd` is still executed but only `metaCmd` is written to
+     * disk — used to keep resolved secret values out of the informational cmd
+     * field (see exec.ts buildTmuxAgentCommand, RUSH-1758). Defaults to `cmd`.
+     */
+    metaCmd?: string;
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     socket?: string;

package/dist/lib/tmux/session.js

@@ -106,7 +106,9 @@ export async function createSession(opts) {
         name: opts.name,
         socket,
         createdAt: Date.now(),
-        cmd: opts.cmd,
+        // Persist the redacted copy when provided so resolved secret values in the
+        // launch command never land on disk (RUSH-1758).
+        cmd: opts.metaCmd ?? opts.cmd,
         cwd: opts.cwd,
         source: opts.source ?? 'cli',
         labels: opts.labels,

package/dist/lib/triggers/webhook.d.ts

@@ -99,6 +99,18 @@ export interface DeliveryStore {
     markJob(id: string, jobName: string): void;
 }
 export declare function createMemoryDeliveryStore(maxEntries?: number): DeliveryStore;
+/**
+ * A durable, disk-backed delivery store. Unlike `createMemoryDeliveryStore`,
+ * seen delivery ids survive a process restart and are bounded by AGE, not by a
+ * fixed entry count — so a captured valid delivery cannot re-fire after a
+ * restart or after count-based LRU eviction would have dropped it.
+ *
+ * `retentionMs` doubles as the replay-acceptance window: a delivery whose id is
+ * still on record (younger than the window) is rejected as a duplicate; entries
+ * older than the window are pruned (keeping the file bounded) since a webhook
+ * source will not legitimately retry a delivery that old.
+ */
+export declare function createFileDeliveryStore(filePath: string, retentionMs?: number): DeliveryStore;
 export interface RateLimiter {
     take(key: string): boolean;
 }
@@ -117,6 +129,12 @@ export interface WebhookServerOptions {
     rateLimiter?: RateLimiter;
     rateLimitPerMinute?: number;
     maxBodyBytes?: number;
+    /** Per-IP ingress throttle applied BEFORE the body read (bad-sig flood guard). */
+    ipRateLimiter?: RateLimiter;
+    /** Per-source-IP requests/minute allowed through to the body read. Default 120. */
+    ipRateLimitPerMinute?: number;
+    /** Max concurrent TCP connections the receiver accepts. Default 256. */
+    maxConnections?: number;
 }
 /**
  * Start a localhost-bound receiver. It accepts only: