@phnx-labs/agents-cli 1.20.64 → 1.20.66

package/dist/commands/exec.js

@@ -12,6 +12,8 @@ import { parseLoopInterval } from '../lib/loop.js';
 import { AGENTS } from '../lib/agents.js';
 import { recordDispatchedRun } from '../lib/audit/log.js';
 import { warnUnpushedWork, shouldWarnUnpushed } from '../lib/warn-unpushed.js';
+import { isHostPinned, pinHostKey, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
+import { sshResolve } from '../lib/hosts/ssh-config.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -27,6 +29,46 @@ function formatRotationBanner(result, verb = 'balanced') {
     const ratio = `${healthy.length} of ${healthy.length + excluded.length} healthy`;
     return `[agents] ${verb} picked ${label} (${ratio})`;
 }
+/**
+ * Decide whether `--copy-creds` may ship credentials (and the Claude OAuth
+ * token) to `host` (RUSH-1767). Credentials ship only to a host whose SSH host
+ * key is pinned in the managed known_hosts store, so the offload never rides an
+ * accept-new (TOFU) connection a machine-in-the-middle could intercept.
+ *
+ * Resolution:
+ *  - The checked target is the host's concrete `address`, else its ssh-config
+ *    HostName (`ssh -G`), else its name — so an alias is pinned/verified against
+ *    the SAME real host the strict dispatch later connects to.
+ *  - An unpinned NON-device (a bare `~/.ssh/config` `Host` alias or literal,
+ *    which `agents ssh <name>` can't reach — "Unknown device") is self-pinned in
+ *    place via ssh-keyscan. A registered device is left unpinned here — it earns
+ *    its pin through the normal `agents ssh <name>` accept-new connect, so the
+ *    caller steers there instead.
+ *
+ * The network seams (`resolve`, `selfPin`) default to the real ssh -G /
+ * ssh-keyscan implementations and are injectable so the ship/refuse decision is
+ * unit-testable against real known_hosts fixtures with no network.
+ */
+export function decideCopyCredsGate(host, deps = {}) {
+    const file = deps.file ?? managedKnownHostsPath();
+    const resolve = deps.resolve ?? sshResolve;
+    const selfPin = deps.selfPin ?? ((target, port, f) => pinHostKey(target, { file: f, ...(port ? { port } : {}) }).pinned);
+    // For an ssh-config host `host.address` is unset; ssh -G gives the real
+    // HostName (and Port) the strict dispatch will verify against.
+    const cfg = host.address ? undefined : resolve(host.name);
+    const pinTarget = host.address ?? cfg?.hostname ?? host.name;
+    // Not pinned yet? A registered device earns its pin through the normal
+    // accept-new connect (`agents ssh <name>` / the fleet sweep), so leave it and
+    // let the caller steer there. A bare ssh-config alias / literal is NOT a
+    // registered device — that flow can never pin it — so pin it right here.
+    let selfPinned = false;
+    if (!isHostPinned(pinTarget, file) && host.provider !== 'devices') {
+        const cfgPort = cfg?.port;
+        const port = cfgPort && cfgPort !== '22' ? Number(cfgPort) : undefined;
+        selfPinned = selfPin(pinTarget, port, file);
+    }
+    return { allowed: isHostPinned(pinTarget, file), pinTarget, selfPinned };
+}
 /**
  * Build the LoopConfig the driver consumes from CLI flags and/or a workflow's
  * `loop:` frontmatter block (issue #332). Returns undefined when neither source
@@ -507,33 +549,45 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             const hostName = hostGiven[0];
-            const { resolveHost, resolveHostByCap } = await import('../lib/hosts/registry.js');
-            const { dispatchToHost, runInteractiveOnHost } = await import('../lib/hosts/dispatch.js');
-            const { registerHostSession, registerInteractiveHostSession } = await import('../lib/hosts/session-index.js');
+            const { resolveHostRunTarget, dispatchPromptToHost, HostResolutionError } = await import('../lib/hosts/run-target.js');
+            const { runInteractiveOnHost } = await import('../lib/hosts/dispatch.js');
+            const { registerInteractiveHostSession } = await import('../lib/hosts/session-index.js');
+            const { RUN_OPTION_REJECT_MESSAGES } = await import('../lib/hosts/remote-cmd.js');
             const { normalizeRunStrategy, RUN_STRATEGIES } = await import('../lib/rotate.js');
-            // A password-auth device throws DeviceOffloadUnsupportedError here; it's
-            // printed cleanly by the top-level catch in index.ts (covers every
-            // resolveHost caller), so it never falls through to capability routing.
-            let host = await resolveHost(hostName);
-            if (!host) {
-                // Not a host name — try capability routing (e.g. --host gpu). A
-                // "Multiple hosts tagged…" error is actionable and must surface;
-                // only "no host tagged" falls through to the generic unknown-host msg.
-                try {
-                    host = await resolveHostByCap(hostName, options.any);
-                }
-                catch (e) {
-                    const msg = e.message ?? '';
-                    if (msg.startsWith('Multiple hosts')) {
-                        console.error(chalk.red(msg));
-                        process.exit(1);
-                    }
-                }
-            }
-            if (!host) {
-                console.error(chalk.red(`Unknown host "${hostName}". List hosts: agents hosts list`));
+            // The forwarding contract (RUN_OPTION_FORWARDING): options that cannot
+            // cross the SSH boundary fail loud BEFORE dispatch — never a silent
+            // drop. Value-aware: only reject what was actually passed.
+            const hostRejects = [];
+            if (options.secrets.length > 0)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.secrets);
+            if (options.secretsKeys)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.secretsKeys);
+            if (options.allowExpired)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.allowExpired);
+            if (options.resumeCheckpoint)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.resumeCheckpoint);
+            if (options.resume === true)
+                hostRejects.push(RUN_OPTION_REJECT_MESSAGES.resumeBare);
+            if (hostRejects.length > 0) {
+                for (const msg of hostRejects)
+                    console.error(chalk.red(msg));
                 process.exit(1);
             }
+            // Shared resolution (name → capability tag → error). A password-auth
+            // device throws DeviceOffloadUnsupportedError inside the helper and
+            // propagates untouched — it's printed cleanly by the top-level catch in
+            // index.ts (covers every resolveHost caller).
+            let host;
+            try {
+                host = await resolveHostRunTarget(hostName, { any: options.any });
+            }
+            catch (e) {
+                if (e instanceof HostResolutionError) {
+                    console.error(chalk.red(e.message));
+                    process.exit(1);
+                }
+                throw e;
+            }
             try {
                 const [runAgent, rawRunVersion] = agentSpec.split('@');
                 // Forward the explicit @version pin verbatim. Resolving aliases like
@@ -569,6 +623,29 @@ export function registerRunCommand(program) {
                 // --lease, a host is persistent, so this is strictly opt-in per run.
                 let hostCopyCreds;
                 if (options.copyCreds) {
+                    // Refuse to copy credentials (and the Claude OAuth token) to a host
+                    // whose SSH host key isn't pinned in the managed known_hosts store:
+                    // the offload transport would otherwise ride an accept-new (TOFU)
+                    // connection, so a machine-in-the-middle on an unverified first
+                    // connect could capture the tokens. The dispatch itself then verifies
+                    // strictly against that pin (see lib/hosts/dispatch.ts) (RUSH-1767).
+                    // The ship/refuse decision — pinTarget resolution, the non-device
+                    // self-pin, and the final pinned check — lives in decideCopyCredsGate
+                    // (unit-tested against real known_hosts fixtures).
+                    const gate = decideCopyCredsGate(host);
+                    if (gate.selfPinned) {
+                        console.error(chalk.gray(`Pinned "${host.name}" (${gate.pinTarget}) into the managed known_hosts store.`));
+                    }
+                    if (!gate.allowed) {
+                        console.error(chalk.red(`Refusing --copy-creds to "${host.name}": its SSH host key isn't pinned, so the ` +
+                            `credentials could be exposed to a machine-in-the-middle on an unverified first connect.`));
+                        console.error(chalk.gray(host.provider === 'devices'
+                            ? `Pin the key first by connecting once so agents records and verifies it:  agents ssh ${host.name}\n` +
+                                `Then re-run with --copy-creds.`
+                            : `Couldn't reach "${gate.pinTarget}" to pin its key (ssh-keyscan returned nothing). ` +
+                                `Make sure the host is reachable over SSH, then re-run with --copy-creds.`));
+                        process.exit(1);
+                    }
                     const { detectSignedInRuntimes, pickRuntimes, resolveClaudeCredentialsBlob } = await import('../lib/crabbox/runtimes.js');
                     const { confirm } = await import('@inquirer/prompts');
                     const detected = await detectSignedInRuntimes();
@@ -636,10 +713,12 @@ export function registerRunCommand(program) {
                         agent: runAgent,
                         version: resumeId ? undefined : runVersion,
                         strategy: resumeId ? undefined : runStrategy,
+                        fallback: options.fallback,
                         prompt,
                         mode: options.mode,
                         model: options.model,
                         effort: options.effort,
+                        env: options.env,
                         addDir: hostAddDirs,
                         json: options.json,
                         verbose: options.verbose,
@@ -663,32 +742,37 @@ export function registerRunCommand(program) {
                     console.error(chalk.red('A prompt is required for headless host runs: agents run <agent> "<task>" --host <name>'));
                     process.exit(1);
                 }
-                const hostSessionId = runAgent === 'claude' && !resumeId ? randomUUID() : undefined;
-                const { task, exitCode } = await dispatchToHost(host, {
+                // Session-id mint, detached dispatch, and local session-index
+                // registration all live in the shared helper (lib/hosts/run-target.ts).
+                const { task, exitCode } = await dispatchPromptToHost(host, {
                     agent: runAgent,
                     version: resumeId ? undefined : runVersion,
                     strategy: resumeId ? undefined : runStrategy,
+                    fallback: options.fallback,
                     prompt,
                     mode: options.mode,
                     model: options.model,
                     effort: options.effort,
+                    env: options.env,
                     addDir: hostAddDirs,
+                    timeout: options.timeout,
+                    loop: options.loop,
+                    maxIterations: options.maxIterations,
+                    budget: options.budget,
+                    until: options.until,
+                    interval: options.interval,
                     json: options.json,
                     verbose: options.verbose,
-                    timeout: options.timeout,
                     yes: options.yes,
                     acp: options.acp,
+                    autoSecrets: options.autoSecrets,
                     remoteCwd: hostCwd,
-                    sessionId: hostSessionId,
                     name: options.name,
                     resume: resumeId,
                     follow: options.follow !== false,
+                    passthroughArgs,
                     copyCreds: hostCopyCreds,
                 });
-                // Register the dispatched run in the LOCAL session index so it shows
-                // up in `agents sessions` and resolves by id/name, even though its
-                // transcript lives on the host. No-op when no session id was captured.
-                registerHostSession(task, { cwd: process.cwd(), prompt });
                 if (options.follow === false) {
                     // The handle the caller uses to check on the run: the name if given,
                     // else the real host-task id (never the old literal `<id>`). Steer
@@ -803,7 +887,7 @@ export function registerRunCommand(program) {
                 await warnUnpushedWork(resumeExec.cwd ?? process.cwd());
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported, isHeadlessSecretsContext }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
@@ -841,6 +925,11 @@ export function registerRunCommand(program) {
         // produced item, and drives the teams supervisor to drain — no `teams`
         // subcommands needed.
         let workflowForEach;
+        // True once this run copies ≥1 dispatchable subagent into the shared agents
+        // dir. Used below to keep the `Task` tool in a `tools:`-restricted workflow —
+        // an orchestrator handed subagents but denied `Task` cannot reach them and
+        // degenerates to a no-op ("I'll wait for the completion notification").
+        let workflowHasSubagents = false;
         const cwd = options.cwd ?? process.cwd();
         if (isValidAgent(rawAgent)) {
             agent = rawAgent;
@@ -922,6 +1011,8 @@ export function registerRunCommand(program) {
                     workflowSubagentTargets.push(dest);
                     copied++;
                 }
+                if (copied > 0)
+                    workflowHasSubagents = true;
                 if (allowedAgents !== undefined) {
                     // Surface any allowedAgents entry with no matching subagent file, and
                     // report how many were filtered out, so the scope is auditable.
@@ -965,7 +1056,9 @@ export function registerRunCommand(program) {
             }
             // Auto-inject secrets bundles declared in the workflow's frontmatter `secrets:` field.
             // Union with any --secrets flags the user passed; dedupe. Skip when --no-auto-secrets is set.
-            if (!options.noAutoSecrets) {
+            // (Commander stores the negated flag as `autoSecrets: false` — the old
+            // `noAutoSecrets` read was never populated, making the flag a no-op.)
+            if (options.autoSecrets !== false) {
                 const declared = workflowFrontmatter?.secrets ?? [];
                 if (declared.length > 0) {
                     const existing = new Set(options.secrets);
@@ -1002,8 +1095,14 @@ export function registerRunCommand(program) {
             }
             else if (hasScoping) {
                 if (tools && tools.length > 0) {
-                    workflowToolsRestrict = tools;
-                    process.stderr.write(chalk.gray(`[workflow] restricting available tools to: ${tools.join(', ')} (Write/Bash/Edit unavailable unless listed)\n`));
+                    // An orchestrator with dispatchable subagents MUST retain the `Task`
+                    // tool, or it can't reach the subagents this run just installed for it
+                    // — the run silently no-ops ("I'll wait for the completion notification").
+                    workflowToolsRestrict = ensureSubagentDispatchTool(tools, workflowHasSubagents);
+                    process.stderr.write(chalk.gray(`[workflow] restricting available tools to: ${workflowToolsRestrict.join(', ')} (Write/Bash/Edit unavailable unless listed)\n`));
+                    if (workflowToolsRestrict.length !== tools.length) {
+                        process.stderr.write(chalk.gray(`[workflow] kept Task tool: workflow ships subagents to dispatch\n`));
+                    }
                 }
                 if (mcpServerNames && mcpServerNames.length > 0) {
                     const servers = getMcpServersByName(mcpServerNames, { cwd });
@@ -1186,8 +1285,12 @@ export function registerRunCommand(program) {
             process.exit(1);
         }
         const strategy = options.balanced ? 'balanced' : explicitStrategy ?? configuredStrategy;
-        // Strategy only applies to bare agent invocations. Explicit @version,
-        // profiles, and fallback chains already define their execution target.
+        // Strategy only applies to bare agent invocations. Explicit @version and
+        // profiles already define their execution target. A --fallback chain does
+        // NOT pin the primary: it only names where to cascade on a rate limit, so
+        // the bare primary still resolves through the strategy — otherwise every
+        // `agents run claude --fallback codex` run lands on the pinned default
+        // account and account rotation silently stops (the gh-monitor heal bug).
         if (strategy !== 'pinned' || options.balanced || explicitStrategy) {
             if (version) {
                 process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: version ${version} is pinned\n`));
@@ -1195,9 +1298,6 @@ export function registerRunCommand(program) {
             else if (fromProfile) {
                 process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: profile pins its own version/auth\n`));
             }
-            else if (options.fallback) {
-                process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: --fallback pins versions directly\n`));
-            }
             else {
                 try {
                     const resolved = await resolveRunVersion(agent, strategy, cwd);
@@ -1350,6 +1450,10 @@ export function registerRunCommand(program) {
                         caller: `agent ${agent}`,
                         keys: secretsKeysSubset,
                         allowExpired: options.allowExpired,
+                        // A headless/background run (routine, teammate, detached) must not
+                        // pop a Touch ID sheet nobody can answer — resolve broker-only and
+                        // fail fast with an actionable error. Interactive runs still prompt.
+                        agentOnly: isHeadlessSecretsContext(),
                     });
                     const entries = describeBundle(bundle);
                     const counts = {};
@@ -1470,17 +1574,23 @@ export function registerRunCommand(program) {
         // path (continuing the session via /continue). Because this injects into
         // the same `fallback` array `--fallback` uses, it must only arm for run
         // shapes that accept a fallback chain — shouldArmRotationFailover excludes
-        // acp/loop/resume-checkpoint (which reject a non-empty fallback below),
-        // interactive/no-prompt runs, and runs that already have an explicit or
-        // profile fallback. Pinned/single-account runs stay unchanged because
-        // rotationResult is null or rotationFailoverChain returns []. version is
-        // set here because rotationResult is only populated when resolveRunVersion
-        // picked one.
+        // acp/loop/resume-checkpoint (which reject a non-empty fallback below)
+        // and interactive/no-prompt runs. Pinned/single-account runs stay
+        // unchanged because rotationResult is null or rotationFailoverChain
+        // returns []. version is set here because rotationResult is only
+        // populated when resolveRunVersion picked one.
+        //
+        // Composes with an explicit --fallback chain: the same-agent accounts are
+        // UNSHIFTED ahead of the user's cross-agent entries, so a rate limit
+        // first tries the other accounts of the same agent (cheapest recovery —
+        // same CLI, session continues) and only then cascades to codex/gemini/etc.
+        // Profiles never compose: strategy is skipped for them, rotationResult
+        // stays null. (fromProfile's model-swap unshift above is therefore never
+        // displaced by this one.)
         if (shouldArmRotationFailover({
             hasRotation: !!rotationResult,
             hasVersion: !!version,
             hasPrompt: prompt !== undefined,
-            explicitFallback: fallback.length > 0,
             interactive: !!options.interactive,
             acp: !!options.acp,
             loop: !!options.loop,
@@ -1488,7 +1598,7 @@ export function registerRunCommand(program) {
         })) {
             const failover = rotationFailoverChain(rotationResult, version);
             if (failover.length > 0) {
-                fallback.push(...failover);
+                fallback.unshift(...failover);
                 if (!options.quiet) {
                     const accounts = failover.map(f => `${f.agent}@${f.version}`).join(', ');
                     process.stderr.write(chalk.gray(`[agents] rate-limit failover armed: ${accounts}\n`));

package/dist/commands/feed.js

@@ -8,6 +8,7 @@ import { gatherRemoteAgentsJson } from '../lib/remote-agents-json.js';
 import { loadPolicy, applyPolicyToBlock, isPhoneUrgent } from '../lib/feed-policy.js';
 import { notifyUrgentBlock } from '../lib/notify.js';
 import { gcMailbox } from '../lib/mailbox-gc.js';
+import { isValidMailboxId } from '../lib/mailbox.js';
 import { getActiveSessions } from '../lib/session/active.js';
 import { mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { GLYPH, masthead } from '../lib/comms-render.js';
@@ -38,6 +39,11 @@ export function parseRemoteFeed(stdout, machine) {
         const block = item;
         if (!block.blockId || !block.sessionId || !block.mailboxId || !block.questions?.length)
             continue;
+        // A crafted mailboxId (path separators, `.`/`..`) would throw inside
+        // mailboxDir() when policy runs against the block, aborting the whole
+        // dispatch loop — drop it here so a malicious peer can't smuggle one in.
+        if (!isValidMailboxId(block.mailboxId))
+            continue;
         blocks.push({ ...block, host: machine });
     }
     return blocks;
@@ -240,20 +246,28 @@ export function registerFeedCommand(program) {
             const policy = loadPolicy();
             const now = new Date();
             for (const b of blocks) {
-                const result = applyPolicyToBlock(b, policy, now);
-                if (result.action !== 'none') {
-                    console.log(`${chalk.yellow('policy')} ${b.blockId}: ${result.action}`);
-                }
-                if (isPhoneUrgent(b, policy)) {
-                    const notifyResult = await notifyUrgentBlock(b, { dryRun: opts.json });
-                    if (notifyResult.ok && !notifyResult.skipped) {
-                        recordNotified(b.blockId);
-                        console.log(`${chalk.green('notified')} ${b.blockId}`);
+                // Wrap per-block policy so one malformed block (e.g. a crafted
+                // mailboxId that throws in mailboxDir) can't abort the whole loop and
+                // strand every remaining block's dispatch.
+                try {
+                    const result = applyPolicyToBlock(b, policy, now);
+                    if (result.action !== 'none') {
+                        console.log(`${chalk.yellow('policy')} ${b.blockId}: ${result.action}`);
                     }
-                    else if (notifyResult.error) {
-                        console.error(chalk.yellow(`Notification failed for ${b.blockId}: ${notifyResult.error}`));
+                    if (isPhoneUrgent(b, policy)) {
+                        const notifyResult = await notifyUrgentBlock(b, { dryRun: opts.json });
+                        if (notifyResult.ok && !notifyResult.skipped) {
+                            recordNotified(b.blockId);
+                            console.log(`${chalk.green('notified')} ${b.blockId}`);
+                        }
+                        else if (notifyResult.error) {
+                            console.error(chalk.yellow(`Notification failed for ${b.blockId}: ${notifyResult.error}`));
+                        }
                     }
                 }
+                catch (err) {
+                    console.error(chalk.yellow(`Skipped block ${b.blockId}: ${err.message}`));
+                }
             }
         }
         for (const warning of setupWarnings) {

package/dist/commands/hosts.js

@@ -11,6 +11,7 @@ import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/widt
 import { checkbox, confirm } from '@inquirer/prompts';
 import { assertValidSshTarget } from '../lib/ssh-exec.js';
 import { getProvider, listAllHosts, resolveHost } from '../lib/hosts/registry.js';
+import { getDevice } from '../lib/devices/registry.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
 import { listSshConfigHosts, listKnownHosts, isSshConfigHost } from '../lib/hosts/ssh-config.js';
 import { probeHost, remoteAgentsVersion, bootstrapAgentsCli, localCliVersion, } from '../lib/hosts/ready.js';
@@ -93,7 +94,7 @@ async function doAdd(name, target, opts) {
         return;
     }
     let spec;
-    let sshTarget;
+    let sshTarget = '';
     if (target) {
         assertValidSshTarget(target);
         const { address, user } = parseTarget(target);
@@ -105,9 +106,36 @@ async function doAdd(name, target, opts) {
         sshTarget = name;
     }
     else {
-        console.log(chalk.red(`"${name}" is not in ~/.ssh/config. Pass a target: agents hosts add ${name} <user@host>`));
-        process.exitCode = 1;
-        return;
+        // A registered device enrolls with no target — connection details come from
+        // the device profile. The main reason to enroll one at all is the overlay
+        // metadata (capability tags); plain dispatch already works via the devices
+        // provider.
+        const device = await getDevice(name);
+        if (device && device.auth.method !== 'password') {
+            const address = device.address.dnsName ?? device.address.ip;
+            if (address) {
+                spec = {
+                    name,
+                    provider: 'local',
+                    source: 'inline',
+                    address,
+                    user: device.user,
+                    caps: opts.cap,
+                    os: opts.os ?? (device.platform !== 'unknown' ? device.platform : undefined),
+                };
+                sshTarget = device.user ? `${device.user}@${address}` : address;
+            }
+        }
+        if (!spec) {
+            if (device?.auth.method === 'password') {
+                console.log(chalk.red(`Device "${name}" uses password auth — dispatch needs key auth. Switch it first: agents devices set ${name} --auth key`));
+            }
+            else {
+                console.log(chalk.red(`"${name}" is not in ~/.ssh/config or the devices registry. Pass a target: agents hosts add ${name} <user@host>`));
+            }
+            process.exitCode = 1;
+            return;
+        }
     }
     const probe = probeHost(sshTarget);
     if (!spec.os && probe.os)
@@ -133,8 +161,12 @@ async function doList(json) {
         // Cap TARGET at its column so a long user@host can't shove CAPS out of alignment.
         const tgtW = stringWidth(tgt);
         const tgtCol = tgtW > 28 ? truncateToWidth(tgt, 28) : tgt + ' '.repeat(28 - tgtW);
-        const mark = h.enrolled ? '' : chalk.gray(' ·available');
-        console.log(h.name.padEnd(20) + h.source.padEnd(13) + tgtCol + (h.caps?.join(',') ?? '') + mark);
+        // Devices surface their registry as SOURCE (they're synced, not enrolled here).
+        const source = h.provider === 'devices' ? 'devices' : h.source;
+        const mark = h.dispatchable === false
+            ? chalk.yellow(' ·password-auth (no dispatch)')
+            : h.enrolled ? '' : chalk.gray(' ·available');
+        console.log(h.name.padEnd(20) + source.padEnd(13) + tgtCol + (h.caps?.join(',') ?? '') + mark);
     }
 }
 async function doCheck(name) {
@@ -163,6 +195,12 @@ async function doRemove(name) {
         console.log(chalk.yellow(`"${name}" is not enrolled (nothing to remove).`));
         return;
     }
+    if (host.provider === 'devices') {
+        // The devices registry owns this entry — hosts remove would silently no-op.
+        console.log(chalk.yellow(`"${name}" comes from the devices registry. Remove it there: agents devices rm ${name}`));
+        process.exitCode = 1;
+        return;
+    }
     await getProvider('local').remove(name);
     console.log(chalk.green(`Removed ${name}`));
 }

package/dist/commands/mcp.js

@@ -6,9 +6,9 @@ import { capableAgents, isCapable } from '../lib/capabilities.js';
 import { emit } from '../lib/events.js';
 import { AGENTS, getAllCliStates, resolveAgentName, formatAgentError, registerMcpToTargets, unregisterMcpFromTargets, listInstalledMcpsWithScope, parseMcpConfig, getMcpConfigPathForHome, agentLabel, } from '../lib/agents.js';
 import { readManifest, writeManifest, createDefaultManifest } from '../lib/manifest.js';
-import { listMcpServerConfigs, discoverMcpConfigsFromRepo, installMcpConfigCentrally, } from '../lib/mcp.js';
+import { listMcpServerConfigs, discoverMcpConfigsFromRepo, installMcpConfigCentrally, isProjectMcpTrusted, trustProjectMcp, untrustProjectMcp, getMcpTrustStorePath, } from '../lib/mcp.js';
 import { cloneRepo } from '../lib/git.js';
-import { getMcpDir } from '../lib/state.js';
+import { getMcpDir, getProjectAgentsDir } from '../lib/state.js';
 import { getEffectiveHome, getGlobalDefault, listInstalledVersions, getVersionHomePath, resolveInstalledAgentTargets, resolveConfiguredAgentTargets, syncResourcesToVersion, } from '../lib/versions.js';
 import { getUserAgentsDir } from '../lib/state.js';
 import { isPromptCancelled, isInteractiveTerminal, requireInteractiveSelection, promptRemovalTargets, parseCommaSeparatedList, ensureAgentVersionsInstalled, resolveAgentTargetsAutoInstalling, resolveInstalledAgentTargetsAutoInstalling, VersionNotInstalledError, resolveListFilterOrExit, } from './utils.js';
@@ -178,6 +178,43 @@ When to use:
             filterVersion,
         });
     });
+    mcpCmd
+        .command('trust')
+        .description('Trust this project so its .agents/mcp/ servers may be registered and spawned')
+        .action(() => {
+        const projectAgentsDir = getProjectAgentsDir();
+        if (!projectAgentsDir) {
+            console.log(chalk.red('Not inside a project (no .agents/ directory found) — nothing to trust.'));
+            process.exit(1);
+        }
+        const servers = listMcpServerConfigs().filter((s) => s.scope === 'project');
+        if (servers.length > 0) {
+            console.log(chalk.bold('Project-scoped MCP servers that will be trusted to run:'));
+            for (const s of servers) {
+                console.log('  ' + chalk.cyan(s.name) + '  ' + chalk.white(formatCentralCommand(s)));
+            }
+        }
+        const trusted = trustProjectMcp();
+        console.log(chalk.green(`Trusted project MCP servers for: ${trusted}`));
+        console.log(chalk.gray(`Recorded in ${getMcpTrustStorePath()} — revoke with: agents mcp untrust`));
+    });
+    mcpCmd
+        .command('untrust')
+        .description('Revoke MCP trust for this project (its .agents/mcp/ servers stop auto-applying)')
+        .action(() => {
+        const projectAgentsDir = getProjectAgentsDir();
+        if (!projectAgentsDir) {
+            console.log(chalk.red('Not inside a project (no .agents/ directory found).'));
+            process.exit(1);
+        }
+        const removed = untrustProjectMcp();
+        if (removed) {
+            console.log(chalk.green('Revoked MCP trust for this project.'));
+        }
+        else {
+            console.log(chalk.gray('This project was not trusted — nothing to revoke.'));
+        }
+    });
     mcpCmd
         .command('add <name> [command_or_url...]')
         .description('Add an MCP server to the manifest (run "agents mcp register" afterward to apply)')
@@ -797,9 +834,15 @@ function formatCentralCommand(server) {
 function formatMcpDetail(name, source, centralConfig, manifestConfig, command, targets) {
     const lines = [];
     lines.push(chalk.bold.cyan(name));
-    const tag = source === 'central' ? chalk.green('declared in ~/.agents/mcp/') :
-        source === 'manifest' ? chalk.gray('declared in agents.yaml') :
-            chalk.yellow('unmanaged (not in central or manifest)');
+    const isUntrustedProject = centralConfig?.scope === 'project'
+        && !isProjectMcpTrusted(getProjectAgentsDir() ?? '');
+    const tag = centralConfig?.scope === 'project'
+        ? (isUntrustedProject
+            ? chalk.yellow('declared in <repo>/.agents/mcp/ (untrusted project — will NOT auto-apply)')
+            : chalk.green('declared in <repo>/.agents/mcp/ (trusted project)')) :
+        source === 'central' ? chalk.green('declared in ~/.agents/mcp/') :
+            source === 'manifest' ? chalk.gray('declared in agents.yaml') :
+                chalk.yellow('unmanaged (not in central or manifest)');
     lines.push('  ' + tag);
     lines.push('');
     if (centralConfig) {
@@ -814,6 +857,13 @@ function formatMcpDetail(name, source, centralConfig, manifestConfig, command, t
     if (command) {
         lines.push(`  ${chalk.gray('command:')} ${chalk.white(command)}`);
     }
+    // A project-scoped server is an arbitrary command from a (possibly cloned)
+    // repo. Show exactly what would run and how to opt in (RUSH-1776).
+    if (isUntrustedProject) {
+        lines.push('');
+        lines.push('  ' + chalk.yellow('This project is untrusted — its MCP servers are skipped on sync and workflow runs.'));
+        lines.push('  ' + chalk.gray('Review the command above, then opt in with: ') + chalk.white('agents mcp trust'));
+    }
     lines.push('');
     lines.push(chalk.bold('  Synced to'));
     lines.push(buildTargetsSection(targets));

package/dist/commands/monitors.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Monitors — durable event-triggered watchers.
+ *
+ * Registers the `agents monitors` command tree: create, list, view, dry-run test,
+ * edit, logs, fire history, pause/resume, (re)pin the owner device, and remove.
+ * Mirrors `agents routines` (commands/routines.ts) and shares the same daemon +
+ * dispatch engine underneath — a monitor is a routine whose trigger is a watched
+ * source instead of a clock.
+ */
+import type { Command } from 'commander';
+/** Register the `agents monitors` command tree. */
+export declare function registerMonitorsCommands(program: Command): void;