@phnx-labs/agents-cli 1.20.64 → 1.20.66

package/dist/commands/view.js

@@ -4,7 +4,7 @@ import { visibleWidth, termLink } from '../lib/format.js';
 import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
-import { AGENTS, ALL_AGENT_IDS, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
+import { AGENTS, ALL_AGENT_IDS, accountOrgBadge, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
 import { deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, } from '../lib/usage.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, syncResourcesToVersion, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, } from '../lib/versions.js';
@@ -34,12 +34,20 @@ const SIGNED_IN_LABEL = 'signed in';
  * account id (Kimi's user_id), show `id:<user_id>` so distinct accounts read
  * distinctly instead of a generic "signed in". Falls back to "signed in" when we
  * have neither (Antigravity), and empty when signed out.
+ *
+ * When the account carries a Claude organizationType, the org badge is appended
+ * — "email (Turing Labs · Team)" — so two installs signed into the same email
+ * under different orgs (personal Max vs a Team seat) read distinctly. The
+ * suffix is plain text inside the label so the existing column-width pass
+ * measures and pads it for free.
  */
-function accountColumnLabel(info) {
+export function accountColumnLabel(info) {
     if (!info)
         return '';
-    if (info.email)
-        return info.email;
+    if (info.email) {
+        const badge = accountOrgBadge(info);
+        return badge ? `${info.email} (${badge})` : info.email;
+    }
     if (info.signedIn)
         return info.accountId ? `id:${info.accountId}` : SIGNED_IN_LABEL;
     return '';
@@ -1149,6 +1157,8 @@ async function collectAgentsJson(filterAgentId, resourceSections) {
             signedIn: info.signedIn,
             email: info.email,
             accountId: info.accountId,
+            organizationType: info.organizationType ?? null,
+            organizationName: info.organizationName ?? null,
             plan: info.plan,
             usageStatus: info.usageStatus,
             overageCredits: info.overageCredits,
@@ -1184,6 +1194,17 @@ async function collectAgentsJson(filterAgentId, resourceSections) {
     }
     return out;
 }
+/**
+ * Identity key for duplicate-install detection. Prefers accountKey — which
+ * encodes account AND org — over the bare email: two installs can share an
+ * email yet belong to different orgs (a personal Max plan and a Team seat),
+ * and grouping those by email alone would propose pruning a live account.
+ * Falls back to the lowercased email for agents whose credentials expose no
+ * identity key. Null when there is no usable identity.
+ */
+export function pruneGroupKey(info) {
+    return info.accountKey ?? info.email?.toLowerCase() ?? null;
+}
 async function buildAgentPrunePlan(agentId) {
     const dirInfos = listInstalledVersionDirs(agentId);
     const entries = await Promise.all(dirInfos.map(async ({ version, hasBinary }) => {
@@ -1198,16 +1219,18 @@ async function buildAgentPrunePlan(agentId) {
     // working binary — those are the things that compete for "the live install
     // for this account."
     const installed = entries.filter((e) => e.hasBinary);
-    const byEmail = new Map();
+    const byAccount = new Map();
     for (const e of installed) {
         if (!e.info.email)
             continue;
-        const key = e.info.email.toLowerCase();
-        const list = byEmail.get(key) ?? [];
+        const key = pruneGroupKey(e.info);
+        if (!key)
+            continue;
+        const list = byAccount.get(key) ?? [];
         list.push(e);
-        byEmail.set(key, list);
+        byAccount.set(key, list);
     }
-    for (const [, group] of byEmail) {
+    for (const [, group] of byAccount) {
         if (group.length < 2)
             continue;
         const sorted = [...group].sort((a, b) => compareVersions(b.version, a.version));

package/dist/commands/webhook.js

@@ -1,6 +1,8 @@
+import * as path from 'path';
 import chalk from 'chalk';
-import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
-import { startWebhookServer } from '../lib/triggers/webhook.js';
+import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../lib/secrets/bundles.js';
+import { createFileDeliveryStore, startWebhookServer } from '../lib/triggers/webhook.js';
+import { getRuntimeStateDir } from '../lib/state.js';
 const DEFAULT_HOST = '127.0.0.1';
 const DEFAULT_PORT = 8787;
 function positiveInt(value, fallback) {
@@ -10,6 +12,9 @@ function positiveInt(value, fallback) {
 function readWebhookSecrets(bundleName) {
     const { env } = readAndResolveBundleEnv(bundleName, {
         caller: 'webhook serve',
+        // `webhook serve` is a long-running background server; when started detached
+        // (no TTY) it must resolve broker-only rather than pop an unanswerable prompt.
+        agentOnly: isHeadlessSecretsContext(),
     });
     const secrets = {};
     if (env.GITHUB_WEBHOOK_SECRET)
@@ -69,6 +74,9 @@ export function registerWebhookCommand(program) {
                 port,
                 secrets,
                 rateLimitPerMinute: rateLimit,
+                // Durable delivery dedup: replays survive a receiver restart (an
+                // in-memory store would forget every seen delivery on restart).
+                deliveryStore: createFileDeliveryStore(path.join(getRuntimeStateDir(), 'webhook', 'deliveries.json')),
                 onDelivery: (webhook, fired) => {
                     console.log(`${new Date().toISOString()} ${webhook.source}:${webhook.event} ` +
                         `${fired.length ? `fired ${fired.map((f) => f.jobName).join(', ')}` : 'no match'}`);

package/dist/index.js

@@ -26,7 +26,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageJsonPath = path.join(__dirname, '..', 'package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
 const VERSION = packageJson.version;
-import { NPM_PACKAGE_NAME, deriveGlobalPrefix, detectPackageManager, installPackageIntoPrefix, installPackageWithBun, verifyInstalledVersion, refreshAliasShims, } from './lib/self-update.js';
+import { NPM_PACKAGE_NAME, deriveGlobalPrefix, detectPackageManager, installPackageIntoPrefix, installPackageWithBun, verifyInstalledVersion, refreshAliasShims, downloadVerifiedTarball, } from './lib/self-update.js';
 // Detect dev/working-tree builds and default the noisy startup steps off.
 // Three cases trip this:
 //   1. Dev install (scripts/install.sh) — package.json version stamped 0.0.0-dev.<sha>
@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadShare, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -315,10 +315,12 @@ async function fetchNpmPackageMetadata(versionOrTag = 'latest', timeoutMs = 5000
         throw new Error('Could not reach npm registry');
     }
     const data = await response.json();
-    if (typeof data.version !== 'string' || typeof data.dist?.integrity !== 'string') {
-        throw new Error('npm registry response did not include version and integrity');
+    if (typeof data.version !== 'string' ||
+        typeof data.dist?.integrity !== 'string' ||
+        typeof data.dist?.tarball !== 'string') {
+        throw new Error('npm registry response did not include version, integrity, and tarball');
     }
-    return { version: data.version, integrity: data.dist.integrity };
+    return { version: data.version, integrity: data.dist.integrity, tarball: data.dist.tarball };
 }
 function printResolvedPackage(metadata) {
     console.log(chalk.gray(`Resolved: ${NPM_PACKAGE_NAME}@${metadata.version}`));
@@ -326,16 +328,32 @@ function printResolvedPackage(metadata) {
 }
 async function installResolvedPackage(metadata) {
     const packageRoot = path.resolve(__dirname, '..');
-    const spec = `${NPM_PACKAGE_NAME}@${metadata.version}`;
-    // Upgrade with the package manager that owns this install. A bun global
-    // install lives at <bunGlobalDir>/node_modules/... (no `lib` segment), so an
-    // `npm install --prefix` would write to <bunGlobalDir>/lib/node_modules and
-    // never touch the running copy — npm exits 0, the verify below fails.
-    if (detectPackageManager(packageRoot) === 'bun') {
-        await installPackageWithBun(spec);
+    // Download the published tarball and prove its bytes match the registry
+    // integrity BEFORE installing anything. A `name@version` spec would let the
+    // package manager fetch and install whatever the registry serves with no
+    // hash check on our side; instead we verify here and install the LOCAL, now
+    // trusted .tgz. A mismatch throws and nothing below runs — fail closed.
+    const tarball = await downloadVerifiedTarball(metadata.tarball, metadata.integrity);
+    try {
+        // Upgrade with the package manager that owns this install. A bun global
+        // install lives at <bunGlobalDir>/node_modules/... (no `lib` segment), so an
+        // `npm install --prefix` would write to <bunGlobalDir>/lib/node_modules and
+        // never touch the running copy — npm exits 0, the verify below fails.
+        if (detectPackageManager(packageRoot) === 'bun') {
+            await installPackageWithBun(tarball);
+        }
+        else {
+            await installPackageIntoPrefix(tarball, deriveGlobalPrefix(packageRoot));
+        }
     }
-    else {
-        await installPackageIntoPrefix(spec, deriveGlobalPrefix(packageRoot));
+    finally {
+        // Best-effort cleanup of the verified tarball and its temp dir.
+        try {
+            fs.rmSync(path.dirname(tarball), { recursive: true, force: true });
+        }
+        catch {
+            /* leave it for the OS temp sweep */
+        }
     }
     verifyInstalledVersion(packageRoot, metadata.version);
     refreshAliasShims(packageRoot);
@@ -649,6 +667,7 @@ async function registerEagerForRequest(name) {
  */
 async function registerAllEagerCommands() {
     await reg(loadView);
+    await reg(loadShare);
     await reg(loadInspect);
     await reg(loadFeedback);
     await reg(loadCommands);
@@ -669,6 +688,7 @@ async function registerAllEagerCommands() {
     await reg(loadPackages);
     await reg(loadDaemon);
     await reg(loadRoutines);
+    await reg(loadMonitors);
     await reg(loadRun);
     await reg(loadDefaults);
     await reg(loadModels);
@@ -676,6 +696,7 @@ async function registerAllEagerCommands() {
     await reg(loadTrash);
     await reg(loadRestore);
     await reg(loadDoctor);
+    await reg(loadApply);
     await reg(loadCheck);
     await reg(loadStatus);
     registerExecAliasCommand(program);

package/dist/lib/agents.d.ts

@@ -127,7 +127,25 @@ export interface AccountInfo {
     } | null;
     lastActive: Date | null;
     signedIn: boolean;
+    organizationType?: string | null;
+    organizationName?: string | null;
 }
+/**
+ * Human-readable label for a Claude account's organizationType as read from
+ * .claude.json's oauthAccount ("claude_team" -> "Team"). Unrecognized values
+ * (future tiers) are rendered by stripping the "claude_" prefix and
+ * title-casing the rest — an unfamiliar-but-visible label beats silence.
+ * Returns null for missing input.
+ */
+export declare function formatClaudeOrgLabel(orgType: string | null | undefined): string | null;
+/**
+ * Short badge identifying which org an account belongs to: "Turing Labs · Team"
+ * for multi-seat orgs, just the tier label ("Max") for personal plans — a
+ * personal org's name is auto-generated boilerplate ("<email>'s Organization"),
+ * not identity. Returns null when the account carries no organizationType
+ * (signed out, non-Claude agents, configs predating the field).
+ */
+export declare function accountOrgBadge(info?: Pick<AccountInfo, 'organizationType' | 'organizationName'> | null): string | null;
 /** Return the email address associated with the agent's auth config, or null. */
 export declare function getAccountEmail(agentId: AgentId, home?: string): Promise<string | null>;
 /** Decrypted contents of Droid's auth.v2.file (subset we consume). */
@@ -146,6 +164,34 @@ export interface DroidAuthPayload {
  * in usage.ts.
  */
 export declare function decryptDroidAuthPayload(base: string): DroidAuthPayload | null;
+/**
+ * Decrypt a Droid `auth.v2.file` (AES-256-GCM `ivB64:tagB64:ctB64`) using the
+ * raw 32-byte key stored base64 in `auth.v2.key`, given the EXACT paths to both.
+ * Same crypto as decryptDroidAuthPayload but without the account-global HOME
+ * fallback, so the identity of a SPECIFIC version home resolves against only
+ * that home's files (carryForwardAuthFiles needs per-dir identity). Returns null
+ * on any failure (missing file/key, wrong key length, bad GCM tag, malformed
+ * JSON). Never throws.
+ */
+export declare function decryptDroidAuthFile(filePath: string, keyPath: string): DroidAuthPayload | null;
+/**
+ * Stable account identity for a *file-auth* agent's credential directory
+ * (droid / kimi / antigravity), or null when the directory holds no decodable
+ * account claim. Unlike a naive top-level JSON key-scan (which matched NO real
+ * credential file), this decrypts / decodes each agent's REAL on-disk format so
+ * the identity resolves against production credentials:
+ *   - droid: AES-256-GCM auth.v2.file (+ auth.v2.key) -> WorkOS access-token JWT
+ *     -> email / org_id / sub.
+ *   - kimi: credentials/kimi-code.json -> access-token JWT -> user_id / sub.
+ *   - antigravity: antigravity-oauth-token -> token.refresh_token -> JWT sub
+ *     when the token is a JWT, else the raw refresh-token value (opaque Google
+ *     consumer tokens are stable per login).
+ * Two directories for the SAME account compare equal; two DIFFERENT accounts
+ * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
+ * account's login with a credential that belongs to a DIFFERENT account
+ * (RUSH-1764). Never throws.
+ */
+export declare function readAuthAccountIdentity(agent: AgentId, configDir: string): string | null;
 /**
  * Antigravity (`agy`) stores its OAuth token via the Go keyring library
  * (zalando/go-keyring), which is platform-split:

package/dist/lib/agents.js

@@ -17,7 +17,7 @@ import * as os from 'os';
 import * as TOML from 'smol-toml';
 import * as yaml from 'yaml';
 import chalk from 'chalk';
-import { needsWindowsShell } from './platform/index.js';
+import { execFileShellSpec } from './platform/index.js';
 import { latestFileMtimeMs } from './fs-walk.js';
 import { damerauLevenshtein } from './fuzzy.js';
 import { getCacheDir, getVersionsDir, getShimsDir, getCliVersionCachePath } from './state.js';
@@ -943,6 +943,48 @@ export function ensureSkillsDir(agentId) {
 export function agentConfigDirName(agentId) {
     return path.relative(HOME, AGENTS[agentId].configDir);
 }
+/**
+ * Human-readable label for a Claude account's organizationType as read from
+ * .claude.json's oauthAccount ("claude_team" -> "Team"). Unrecognized values
+ * (future tiers) are rendered by stripping the "claude_" prefix and
+ * title-casing the rest — an unfamiliar-but-visible label beats silence.
+ * Returns null for missing input.
+ */
+export function formatClaudeOrgLabel(orgType) {
+    if (!orgType)
+        return null;
+    const known = {
+        claude_max: 'Max',
+        claude_pro: 'Pro',
+        claude_team: 'Team',
+        claude_enterprise: 'Enterprise',
+        claude_free: 'Free',
+    };
+    if (known[orgType])
+        return known[orgType];
+    return orgType
+        .replace(/^claude_/, '')
+        .split('_')
+        .filter(Boolean)
+        .map((w) => w[0].toUpperCase() + w.slice(1))
+        .join(' ');
+}
+/**
+ * Short badge identifying which org an account belongs to: "Turing Labs · Team"
+ * for multi-seat orgs, just the tier label ("Max") for personal plans — a
+ * personal org's name is auto-generated boilerplate ("<email>'s Organization"),
+ * not identity. Returns null when the account carries no organizationType
+ * (signed out, non-Claude agents, configs predating the field).
+ */
+export function accountOrgBadge(info) {
+    const label = formatClaudeOrgLabel(info?.organizationType);
+    if (!label)
+        return null;
+    const isMultiSeat = info?.organizationType === 'claude_team' || info?.organizationType === 'claude_enterprise';
+    if (isMultiSeat && info?.organizationName)
+        return `${info.organizationName} · ${label}`;
+    return label;
+}
 /** Return the email address associated with the agent's auth config, or null. */
 export async function getAccountEmail(agentId, home) {
     const info = await getAccountInfo(agentId, home);
@@ -994,6 +1036,18 @@ export function decryptDroidAuthPayload(base) {
     const keyPath = resolveAccountCredentialPath(base, '.factory', 'auth.v2.key');
     if (!filePath || !keyPath)
         return null;
+    return decryptDroidAuthFile(filePath, keyPath);
+}
+/**
+ * Decrypt a Droid `auth.v2.file` (AES-256-GCM `ivB64:tagB64:ctB64`) using the
+ * raw 32-byte key stored base64 in `auth.v2.key`, given the EXACT paths to both.
+ * Same crypto as decryptDroidAuthPayload but without the account-global HOME
+ * fallback, so the identity of a SPECIFIC version home resolves against only
+ * that home's files (carryForwardAuthFiles needs per-dir identity). Returns null
+ * on any failure (missing file/key, wrong key length, bad GCM tag, malformed
+ * JSON). Never throws.
+ */
+export function decryptDroidAuthFile(filePath, keyPath) {
     try {
         const blob = fs.readFileSync(filePath, 'utf-8').trim();
         const key = Buffer.from(fs.readFileSync(keyPath, 'utf-8').trim(), 'base64');
@@ -1015,6 +1069,62 @@ export function decryptDroidAuthPayload(base) {
         return null;
     }
 }
+/**
+ * Stable account identity for a *file-auth* agent's credential directory
+ * (droid / kimi / antigravity), or null when the directory holds no decodable
+ * account claim. Unlike a naive top-level JSON key-scan (which matched NO real
+ * credential file), this decrypts / decodes each agent's REAL on-disk format so
+ * the identity resolves against production credentials:
+ *   - droid: AES-256-GCM auth.v2.file (+ auth.v2.key) -> WorkOS access-token JWT
+ *     -> email / org_id / sub.
+ *   - kimi: credentials/kimi-code.json -> access-token JWT -> user_id / sub.
+ *   - antigravity: antigravity-oauth-token -> token.refresh_token -> JWT sub
+ *     when the token is a JWT, else the raw refresh-token value (opaque Google
+ *     consumer tokens are stable per login).
+ * Two directories for the SAME account compare equal; two DIFFERENT accounts
+ * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
+ * account's login with a credential that belongs to a DIFFERENT account
+ * (RUSH-1764). Never throws.
+ */
+export function readAuthAccountIdentity(agent, configDir) {
+    try {
+        switch (agent) {
+            case 'droid': {
+                const payload = decryptDroidAuthFile(path.join(configDir, 'auth.v2.file'), path.join(configDir, 'auth.v2.key'));
+                const claims = typeof payload?.access_token === 'string' ? decodeJwtPayload(payload.access_token) : null;
+                if (!claims)
+                    return null;
+                return buildIdentityKey(agent, [
+                    ['email', normalizeIdentityPart(claims.email)],
+                    ['org', normalizeIdentityPart(claims.org_id ?? payload?.active_organization_id)],
+                    ['sub', normalizeIdentityPart(claims.sub)],
+                ]);
+            }
+            case 'kimi': {
+                const data = JSON.parse(fs.readFileSync(path.join(configDir, 'credentials', 'kimi-code.json'), 'utf-8'));
+                const accessToken = data?.access_token;
+                const claims = typeof accessToken === 'string' ? decodeJwtPayload(accessToken) : null;
+                return buildIdentityKey(agent, [
+                    ['user', normalizeIdentityPart(claims?.user_id ?? claims?.sub)],
+                ]);
+            }
+            case 'antigravity': {
+                const data = JSON.parse(fs.readFileSync(path.join(configDir, 'antigravity-oauth-token'), 'utf-8'));
+                const refreshToken = data?.token?.refresh_token;
+                if (typeof refreshToken !== 'string' || !refreshToken)
+                    return null;
+                const claims = decodeJwtPayload(refreshToken);
+                const sub = normalizeIdentityPart(claims?.sub ?? claims?.user_id);
+                return buildIdentityKey(agent, [['sub', sub ?? refreshToken]]);
+            }
+            default:
+                return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Derive Droid account identity from the decrypted credential. The
  * `access_token` is a WorkOS JWT carrying an `email` claim (plus org_id /
@@ -1248,6 +1358,8 @@ export async function getAccountInfo(agentId, home) {
                     overageCredits,
                     lastActive,
                     signedIn: !!email,
+                    organizationType: oa?.organizationType ?? null,
+                    organizationName: oa?.organizationName ?? null,
                 };
             }
             case 'codex': {
@@ -1659,7 +1771,10 @@ export async function registerMcp(agentId, name, command, scope = 'user', transp
         // On Windows a bare command name / `.cmd` wrapper (the npm-installed agent
         // CLI) can't be exec'd directly — it needs shell:true for PATHEXT/cmd. Off
         // Windows this is always false, so the no-shell argv path is unchanged.
-        await execFileAsync(bin, args, { ...(env ? { env } : {}), shell: needsWindowsShell(bin) });
+        // RUSH-1752: when shell is needed, compose a fully-quoted command line and
+        // pass EMPTY argv so user-controlled MCP command/args never reach cmd.exe unescaped.
+        const spec = execFileShellSpec(bin, args);
+        await execFileAsync(spec.command, spec.args, { ...(env ? { env } : {}), shell: spec.shell });
         return { success: true };
     }
     catch (err) {
@@ -1687,7 +1802,10 @@ export async function unregisterMcp(agentId, name, options) {
     try {
         const bin = options?.binary || agent.cliCommand;
         const env = options?.home ? { ...process.env, HOME: options.home } : undefined;
-        await execFileAsync(bin, ['mcp', 'remove', name], { ...(env ? { env } : {}), shell: needsWindowsShell(bin) });
+        // RUSH-1752: same shell-safe path as registerMcp — attacker-controlled MCP
+        // `name` must not reach cmd.exe unescaped when shell:true is required.
+        const spec = execFileShellSpec(bin, ['mcp', 'remove', name]);
+        await execFileAsync(spec.command, spec.args, { ...(env ? { env } : {}), shell: spec.shell });
         return { success: true };
     }
     catch (err) {

package/dist/lib/auto-dispatch-provider.js

@@ -9,7 +9,7 @@
 import { resolveProvider } from './cloud/registry.js';
 export function createProviderDispatcher() {
     return {
-        async dispatch({ agent, prompt, repo, provider }) {
+        async dispatch({ agent, prompt, repo, provider, host }) {
             const p = resolveProvider(provider, agent);
             const caps = p.capabilities();
             if (!caps.available) {
@@ -18,7 +18,12 @@ export function createProviderDispatcher() {
             if (!caps.dispatch) {
                 throw new Error(`cloud provider '${p.id}' does not support dispatch`);
             }
-            const task = await p.dispatch({ agent, prompt, repo });
+            // The host provider clones nothing — a repo target is meaningless there
+            // and its dispatch() rejects it; a ticket project pinned to 'host' relies
+            // on the machine's own checkout (the project's `host` names the machine).
+            const task = p.id === 'host'
+                ? await p.dispatch({ agent, prompt, providerOptions: { host } })
+                : await p.dispatch({ agent, prompt, repo });
             return { id: task.id };
         },
     };

package/dist/lib/auto-dispatch.d.ts

@@ -22,6 +22,7 @@ export interface AutoDispatchProject {
     autoDispatch?: boolean;
     maxAgents?: number;
     provider?: string;
+    host?: string;
 }
 /** A Linear issue that is a candidate for dispatch. */
 export interface DelegatedIssue {
@@ -36,6 +37,7 @@ export interface PlannedDispatch {
     projectId: string;
     repoSlug?: string;
     provider?: string;
+    host?: string;
     issueId: string;
     identifier: string;
     title: string;
@@ -73,6 +75,7 @@ export interface Dispatcher {
         prompt: string;
         repo?: string;
         provider?: string;
+        host?: string;
     }): Promise<{
         id: string;
     }>;

package/dist/lib/auto-dispatch.js

@@ -46,6 +46,7 @@ export function readAutoDispatchProjects() {
             autoDispatch: o.autoDispatch === true,
             maxAgents: typeof o.maxAgents === 'number' ? o.maxAgents : undefined,
             provider: typeof o.provider === 'string' ? o.provider : undefined,
+            host: typeof o.host === 'string' ? o.host : undefined,
         });
     }
     return out;
@@ -76,6 +77,7 @@ export function planAutoDispatch(projects, inFlightByProject, delegatedTodoByPro
                 projectId: p.id,
                 repoSlug: p.repoSlug,
                 provider: p.provider,
+                host: p.host,
                 issueId: issue.id,
                 identifier: issue.identifier,
                 title: issue.title,
@@ -122,6 +124,7 @@ export async function autoDispatchTick(deps) {
                 prompt: dispatchPrompt(d.identifier, d.title),
                 repo: d.repoSlug,
                 provider: d.provider,
+                host: d.host,
             });
             // Bookkeeping only — dispatch already happened; moving to Doing keeps the
             // ticket out of the next Todo poll. A failure here is non-fatal.

package/dist/lib/browser/chrome.js

@@ -4,7 +4,7 @@ import * as path from 'path';
 import * as os from 'os';
 import { getProfileRuntimeDir } from './profiles.js';
 import { discoverBrowserWsUrl, registerPipeTransport } from './cdp.js';
-import { readAndResolveBundleEnv, bundleExists } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv, bundleExists, isHeadlessSecretsContext } from '../secrets/bundles.js';
 import { writeProfileRuntime, readProfileRuntime } from './runtime-state.js';
 // Windows install roots. Resolve from the environment (fall back to the usual
 // defaults) so per-user installs under %LOCALAPPDATA% and 64-bit Program Files
@@ -260,7 +260,7 @@ isElectron = false) {
     let env = { ...process.env };
     if (secrets && bundleExists(secrets)) {
         try {
-            const { env: bundleEnv } = readAndResolveBundleEnv(secrets, { caller: 'browser profile' });
+            const { env: bundleEnv } = readAndResolveBundleEnv(secrets, { caller: 'browser profile', agentOnly: isHeadlessSecretsContext() });
             env = { ...env, ...bundleEnv };
         }
         catch {

package/dist/lib/cloud/antigravity.js

@@ -20,7 +20,7 @@
  * back to GEMINI_API_KEY / GOOGLE_API_KEY in the environment.
  */
 import { resolveDispatchRepos, normalizeProviderStatus } from './types.js';
-import { readAndResolveBundleEnv } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../secrets/bundles.js';
 const INTERACTIONS_URL = 'https://generativelanguage.googleapis.com/v1beta/interactions';
 const DEFAULT_MODEL = 'antigravity-preview-05-2026';
 const KEY_NAMES = ['GEMINI_API_KEY', 'GOOGLE_API_KEY'];
@@ -65,7 +65,7 @@ export class AntigravityCloudProvider {
     resolveApiKey() {
         if (this.secretsBundle) {
             try {
-                const { env } = readAndResolveBundleEnv(this.secretsBundle, { caller: 'cloud:antigravity' });
+                const { env } = readAndResolveBundleEnv(this.secretsBundle, { caller: 'cloud:antigravity', agentOnly: isHeadlessSecretsContext() });
                 for (const k of KEY_NAMES) {
                     if (env[k])
                         return env[k];

package/dist/lib/cloud/host.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Host cloud provider — your own machines as a task-execution backend.
+ *
+ * A thin adapter over the hosts subsystem (lib/hosts/*): `agents cloud run
+ * --provider host --host <name>` dispatches through the SAME detached-SSH
+ * launch as `agents run --host`, and the resulting task shows up in BOTH
+ * `agents cloud ps` and `agents hosts ps` — one store (the host-task sidecars
+ * under ~/.agents/.cache/hosts/), two views. No new transport, no relay: SSH
+ * is the only wire, exactly like the rest of the hosts design (docs/hosts.md).
+ *
+ * Status semantics follow reconcile.ts's prime rule: completion is only ever
+ * CONFIRMED from the remote `.exit` file — an unreachable host leaves a task
+ * `running`, never guessed as failed. The cloud SQLite store row is a cached
+ * index (the `cloud list` refresh loop upserts what `status()` returns); the
+ * sidecar stays the source of truth. Reachability is memoized per target for
+ * the life of the process so a down host costs ONE short timeout, not one per
+ * task ("care around the cloud status-refresh path", lib/hosts/tasks.ts).
+ */
+import type { CloudEvent, CloudProvider, CloudTarget, CloudTask, CloudTaskStatus, DispatchOptions, ProviderCapabilities } from './types.js';
+import type { HostTask } from '../hosts/tasks.js';
+/** Project a host-task sidecar into the cloud task shape. */
+export declare function hostTaskToCloudTask(task: HostTask): CloudTask;
+export declare class HostCloudProvider implements CloudProvider {
+    readonly id: "host";
+    readonly name = "Host (your machines)";
+    readonly targetKind: "host";
+    /**
+     * Reachability memo, per target, for the life of this process. The cloud
+     * refresh loop calls `status()` once per active task; without the memo a
+     * down host would cost one ~6s ssh timeout PER task instead of one total.
+     * CLI processes are short-lived, so staleness is bounded by the invocation.
+     */
+    private reachable;
+    capabilities(): ProviderCapabilities;
+    dispatch(options: DispatchOptions): Promise<CloudTask>;
+    status(taskId: string): Promise<CloudTask>;
+    list(filter?: {
+        status?: CloudTaskStatus;
+    }): Promise<CloudTask[]>;
+    /**
+     * `reconcileTask` with the per-process reachability memo folded in: probe a
+     * target at most once per process; a down host leaves its tasks `running`.
+     */
+    private reconcileMemoized;
+    /**
+     * Offset-tail the remote log (the same one-round-trip fetch the `run --host`
+     * follow uses) and yield it as `text` events until the `.exit` file lands.
+     */
+    stream(taskId: string): AsyncIterable<CloudEvent>;
+    cancel(taskId: string): Promise<void>;
+    /**
+     * Follow-up message = resume the run's session on the same host. Only runs
+     * that captured a session id (Claude — the one agent that takes
+     * `--session-id`) can be resumed; others get an actionable refusal.
+     */
+    message(taskId: string, content: string): Promise<void>;
+    /** The unified host pool (enrolled hosts ∪ devices), dispatchable ones only. */
+    listTargets(): Promise<CloudTarget[]>;
+}