@phnx-labs/agents-cli 1.20.65 → 1.20.67

package/dist/commands/ssh.js

@@ -27,6 +27,7 @@ import { clearPendingSentinel } from '../lib/devices/pending.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
+import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
 import { planFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
 import { fleetCapacity, fmtBytes, headroom, probeFleetStats, } from '../lib/devices/health.js';
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
@@ -558,7 +559,14 @@ secrets bundle via an askpass shim — the password never touches argv.
         }
         try {
             const shim = writeAskpassShim();
-            const { args, env } = buildSshInvocation(device, cmd, shim);
+            // Pin the host key on first connect and verify strictly thereafter: the
+            // managed known_hosts store must exist before ssh writes the learned key
+            // into it, and a host already recorded there is checked with
+            // StrictHostKeyChecking=yes (RUSH-1767).
+            ensureManagedKnownHostsDir();
+            const addr = hostNameFor(device);
+            const pinned = addr ? isHostPinned(addr) : false;
+            const { args, env } = buildSshInvocation(device, cmd, shim, { pinned });
             const res = spawnSync('ssh', args, {
                 stdio: 'inherit',
                 env: { ...process.env, ...env },

package/dist/commands/teams.js

@@ -1059,7 +1059,7 @@ export function registerTeamsCommands(program) {
         .alias('a')
         .description("Add a teammate to work on a task. Runs in background; returns immediately. Use 'status' to check in.")
         .option('-n, --name <name>', 'Friendly name for this teammate (e.g. alice). Required if using --after. Unique within team.')
-        .option('-m, --mode <mode>', `Permissions: plan (read-only) | edit (can write files) | auto (smart classifier auto-approves safe ops) | skip (bypass all permission prompts). 'full' accepted as alias for skip.`, 'edit')
+        .option('-m, --mode <mode>', `Permissions: plan (read-only) | edit (can write files) | auto (smart classifier auto-approves safe ops) | skip (bypass all permission prompts). 'full' accepted as alias for skip. Teammates run headless: plan works headless on claude/codex/droid/opencode; kimi/grok/cursor/antigravity have no headless plan mode and auto-downgrade a plan request to auto.`, 'edit')
         .option('-e, --effort <effort>', `Reasoning intensity: ${VALID_EFFORTS.join('|')}`, 'medium')
         .option('--model <model>', 'Override the effort tier and use this specific model (e.g. claude-opus-4-6)')
         .option('--env <key=value>', 'Set an environment variable for this teammate (repeatable for multiple vars)', (val, prev) => [...prev, val], [])

package/dist/index.js

@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadShare, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -667,6 +667,7 @@ async function registerEagerForRequest(name) {
  */
 async function registerAllEagerCommands() {
     await reg(loadView);
+    await reg(loadShare);
     await reg(loadInspect);
     await reg(loadFeedback);
     await reg(loadCommands);

package/dist/lib/agents.d.ts

@@ -164,6 +164,34 @@ export interface DroidAuthPayload {
  * in usage.ts.
  */
 export declare function decryptDroidAuthPayload(base: string): DroidAuthPayload | null;
+/**
+ * Decrypt a Droid `auth.v2.file` (AES-256-GCM `ivB64:tagB64:ctB64`) using the
+ * raw 32-byte key stored base64 in `auth.v2.key`, given the EXACT paths to both.
+ * Same crypto as decryptDroidAuthPayload but without the account-global HOME
+ * fallback, so the identity of a SPECIFIC version home resolves against only
+ * that home's files (carryForwardAuthFiles needs per-dir identity). Returns null
+ * on any failure (missing file/key, wrong key length, bad GCM tag, malformed
+ * JSON). Never throws.
+ */
+export declare function decryptDroidAuthFile(filePath: string, keyPath: string): DroidAuthPayload | null;
+/**
+ * Stable account identity for a *file-auth* agent's credential directory
+ * (droid / kimi / antigravity), or null when the directory holds no decodable
+ * account claim. Unlike a naive top-level JSON key-scan (which matched NO real
+ * credential file), this decrypts / decodes each agent's REAL on-disk format so
+ * the identity resolves against production credentials:
+ *   - droid: AES-256-GCM auth.v2.file (+ auth.v2.key) -> WorkOS access-token JWT
+ *     -> email / org_id / sub.
+ *   - kimi: credentials/kimi-code.json -> access-token JWT -> user_id / sub.
+ *   - antigravity: antigravity-oauth-token -> token.refresh_token -> JWT sub
+ *     when the token is a JWT, else the raw refresh-token value (opaque Google
+ *     consumer tokens are stable per login).
+ * Two directories for the SAME account compare equal; two DIFFERENT accounts
+ * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
+ * account's login with a credential that belongs to a DIFFERENT account
+ * (RUSH-1764). Never throws.
+ */
+export declare function readAuthAccountIdentity(agent: AgentId, configDir: string): string | null;
 /**
  * Antigravity (`agy`) stores its OAuth token via the Go keyring library
  * (zalando/go-keyring), which is platform-split:

package/dist/lib/agents.js

@@ -505,6 +505,10 @@ export const AGENTS = {
             workflows: false,
             memory: true,
             modes: ['plan', 'edit', 'skip'],
+            // grok's `--permission-mode plan` silently stalls a headless `-p` run at
+            // its ExitPlanMode gate (no TTY to approve). Headless plan auto-downgrades
+            // to auto (→ edit via resolveMode). Interactive plan is unaffected.
+            headlessPlan: false,
             rulesImports: true,
         },
     },
@@ -544,6 +548,10 @@ export const AGENTS = {
             workflows: true,
             memory: false,
             modes: ['plan', 'edit', 'auto', 'skip'],
+            // kimi's headless `-p` refuses to combine with `--plan` (`Cannot combine
+            // --prompt with --plan`). Headless plan auto-downgrades to auto (kimi -p
+            // auto-runs). Interactive plan is unaffected.
+            headlessPlan: false,
             rulesImports: false,
         },
     },
@@ -1036,6 +1044,18 @@ export function decryptDroidAuthPayload(base) {
     const keyPath = resolveAccountCredentialPath(base, '.factory', 'auth.v2.key');
     if (!filePath || !keyPath)
         return null;
+    return decryptDroidAuthFile(filePath, keyPath);
+}
+/**
+ * Decrypt a Droid `auth.v2.file` (AES-256-GCM `ivB64:tagB64:ctB64`) using the
+ * raw 32-byte key stored base64 in `auth.v2.key`, given the EXACT paths to both.
+ * Same crypto as decryptDroidAuthPayload but without the account-global HOME
+ * fallback, so the identity of a SPECIFIC version home resolves against only
+ * that home's files (carryForwardAuthFiles needs per-dir identity). Returns null
+ * on any failure (missing file/key, wrong key length, bad GCM tag, malformed
+ * JSON). Never throws.
+ */
+export function decryptDroidAuthFile(filePath, keyPath) {
     try {
         const blob = fs.readFileSync(filePath, 'utf-8').trim();
         const key = Buffer.from(fs.readFileSync(keyPath, 'utf-8').trim(), 'base64');
@@ -1057,6 +1077,62 @@ export function decryptDroidAuthPayload(base) {
         return null;
     }
 }
+/**
+ * Stable account identity for a *file-auth* agent's credential directory
+ * (droid / kimi / antigravity), or null when the directory holds no decodable
+ * account claim. Unlike a naive top-level JSON key-scan (which matched NO real
+ * credential file), this decrypts / decodes each agent's REAL on-disk format so
+ * the identity resolves against production credentials:
+ *   - droid: AES-256-GCM auth.v2.file (+ auth.v2.key) -> WorkOS access-token JWT
+ *     -> email / org_id / sub.
+ *   - kimi: credentials/kimi-code.json -> access-token JWT -> user_id / sub.
+ *   - antigravity: antigravity-oauth-token -> token.refresh_token -> JWT sub
+ *     when the token is a JWT, else the raw refresh-token value (opaque Google
+ *     consumer tokens are stable per login).
+ * Two directories for the SAME account compare equal; two DIFFERENT accounts
+ * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
+ * account's login with a credential that belongs to a DIFFERENT account
+ * (RUSH-1764). Never throws.
+ */
+export function readAuthAccountIdentity(agent, configDir) {
+    try {
+        switch (agent) {
+            case 'droid': {
+                const payload = decryptDroidAuthFile(path.join(configDir, 'auth.v2.file'), path.join(configDir, 'auth.v2.key'));
+                const claims = typeof payload?.access_token === 'string' ? decodeJwtPayload(payload.access_token) : null;
+                if (!claims)
+                    return null;
+                return buildIdentityKey(agent, [
+                    ['email', normalizeIdentityPart(claims.email)],
+                    ['org', normalizeIdentityPart(claims.org_id ?? payload?.active_organization_id)],
+                    ['sub', normalizeIdentityPart(claims.sub)],
+                ]);
+            }
+            case 'kimi': {
+                const data = JSON.parse(fs.readFileSync(path.join(configDir, 'credentials', 'kimi-code.json'), 'utf-8'));
+                const accessToken = data?.access_token;
+                const claims = typeof accessToken === 'string' ? decodeJwtPayload(accessToken) : null;
+                return buildIdentityKey(agent, [
+                    ['user', normalizeIdentityPart(claims?.user_id ?? claims?.sub)],
+                ]);
+            }
+            case 'antigravity': {
+                const data = JSON.parse(fs.readFileSync(path.join(configDir, 'antigravity-oauth-token'), 'utf-8'));
+                const refreshToken = data?.token?.refresh_token;
+                if (typeof refreshToken !== 'string' || !refreshToken)
+                    return null;
+                const claims = decodeJwtPayload(refreshToken);
+                const sub = normalizeIdentityPart(claims?.sub ?? claims?.user_id);
+                return buildIdentityKey(agent, [['sub', sub ?? refreshToken]]);
+            }
+            default:
+                return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Derive Droid account identity from the decrypted credential. The
  * `access_token` is a WorkOS JWT carrying an `email` claim (plus org_id /

package/dist/lib/devices/connect.d.ts

@@ -16,13 +16,30 @@ export declare function sshTargetFor(device: DeviceProfile): string;
  * login).
  */
 export declare function wrapRemoteCommand(device: DeviceProfile, cmd: string[]): string | undefined;
+/** Host-key posture for {@link buildSshInvocation}. */
+export interface SshHostKeyOptions {
+    /**
+     * True when the device's host key is already pinned in the managed
+     * known_hosts store — connections then verify with `StrictHostKeyChecking=yes`
+     * (a key swap is refused). False (the default) keeps `accept-new` for a
+     * genuine first enrollment, whose learned key lands in the managed store and
+     * pins the host for every subsequent connect. See {@link hostKeyCheckingOpts}.
+     */
+    pinned?: boolean;
+    /** Managed known_hosts path override (tests). Defaults to the CLI-managed store. */
+    knownHostsFile?: string;
+}
 /**
  * Build the argv (after the `ssh` program name) and the environment overlay
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at
  * the shim and disables pubkey + the host's interactive password prompt so the
  * shim is the only auth path. Pure (no spawn) so it is unit-testable.
+ *
+ * Host-key checking runs against the CLI-managed known_hosts store (never the
+ * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
+ * `accept-new` to learn+pin the key on first connect (RUSH-1767).
  */
-export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string): {
+export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions): {
     args: string[];
     env: Record<string, string>;
 };

package/dist/lib/devices/connect.js

@@ -18,6 +18,7 @@ import * as path from 'path';
 import { assertValidSshTarget, shellQuote } from '../ssh-exec.js';
 import { encodePwshBase64 } from '../pwsh.js';
 import { getCacheDir } from '../state.js';
+import { hostKeyCheckingOpts } from './known-hosts.js';
 import { hostNameFor } from './ssh-config.js';
 /** Env var the askpass shim reads to know which bundle holds the password. */
 export const ASKPASS_BUNDLE_ENV = 'AGENTS_SSH_BUNDLE';
@@ -57,12 +58,19 @@ export function wrapRemoteCommand(device, cmd) {
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at
  * the shim and disables pubkey + the host's interactive password prompt so the
  * shim is the only auth path. Pure (no spawn) so it is unit-testable.
+ *
+ * Host-key checking runs against the CLI-managed known_hosts store (never the
+ * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
+ * `accept-new` to learn+pin the key on first connect (RUSH-1767).
  */
-export function buildSshInvocation(device, cmd, askpassShimPath) {
+export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}) {
     const target = sshTargetFor(device);
     const remote = wrapRemoteCommand(device, cmd);
     const env = {};
-    const args = ['-o', 'StrictHostKeyChecking=accept-new', '-o', 'ConnectTimeout=10'];
+    const args = [
+        ...hostKeyCheckingOpts(hostKey.pinned ?? false, hostKey.knownHostsFile),
+        '-o', 'ConnectTimeout=10',
+    ];
     if (device.auth.method === 'password') {
         if (!device.auth.bundle) {
             throw new Error(`Device '${device.name}' uses password auth but has no secrets bundle. Set one with \`agents devices set ${device.name} --bundle <name>\`.`);

package/dist/lib/devices/known-hosts.d.ts

@@ -0,0 +1,62 @@
+/** Path to the CLI-managed known_hosts store (created lazily, mode 0600). */
+export declare function managedKnownHostsPath(): string;
+/** Ensure the parent directory of the managed store exists (mode 0700). */
+export declare function ensureManagedKnownHostsDir(file?: string): void;
+/** Read the managed store, or '' when it does not exist yet. */
+export declare function readManagedKnownHosts(file?: string): string;
+/**
+ * True if `host` has at least one pinned key line in `content`. Pure (content
+ * in) so the match logic is unit-testable without touching disk. Matching is
+ * case-insensitive on the hostname, as OpenSSH does.
+ */
+export declare function isHostPinnedIn(content: string, host: string): boolean;
+/** True if `host` is pinned in the managed store on disk. */
+export declare function isHostPinned(host: string, file?: string): boolean;
+/**
+ * The host-key-checking ssh options for a connection.
+ *
+ * Always points `UserKnownHostsFile` at the managed store so learned and pinned
+ * keys live in exactly one CLI-owned file. `StrictHostKeyChecking` is `yes` once
+ * the host is pinned (a key swap is refused) and `accept-new` before that
+ * (genuine first enrollment learns the key into the managed store, which pins it
+ * for every subsequent connect). Pure given `pinned`, so the policy is testable.
+ */
+export declare function hostKeyCheckingOpts(pinned: boolean, file?: string): string[];
+/**
+ * The key lines in `scanned` (ssh-keyscan output) not already present in
+ * `existing`. Comments and blank lines are dropped; whitespace is normalized so
+ * a re-scan of an already-pinned key is a no-op. Pure, so the idempotent-append
+ * contract is unit-testable without spawning ssh-keyscan.
+ */
+export declare function newKnownHostsLines(existing: string, scanned: string): string[];
+export interface PinResult {
+    /** True if the host is pinned in the managed store after this call. */
+    pinned: boolean;
+    /** How many new key lines were appended. */
+    added: number;
+}
+/**
+ * Merge `ssh-keyscan` output for `host` into the managed store at `file`,
+ * idempotently, and report whether `host` is pinned afterward. Split out from
+ * {@link pinHostKey} so the store-write half — the part that decides a scanned
+ * key now counts as pinned — is unit-testable with real keyscan text and no
+ * network (the spawn stays in `pinHostKey`).
+ */
+export declare function recordScannedKeys(host: string, scanned: string, file?: string): PinResult;
+/**
+ * `ssh-keyscan` a host at a trusted moment and append any new key lines to the
+ * managed store, idempotently. This is the explicit pin path; the implicit one
+ * is a normal `accept-new` connection whose learned key lands in the same store.
+ * Returns whether the host is pinned afterward.
+ *
+ * Host-name-agnostic: it scans whatever address it is handed, so it also pins a
+ * host `agents ssh` can't reach — notably a bare `~/.ssh/config` `Host` alias,
+ * which is not a registered device. The `--copy-creds` gate (commands/exec.ts)
+ * calls this for exactly that case so the credential copy is usable for
+ * ssh-config-alias hosts (RUSH-1767).
+ */
+export declare function pinHostKey(host: string, opts?: {
+    file?: string;
+    timeoutMs?: number;
+    port?: number;
+}): PinResult;

package/dist/lib/devices/known-hosts.js

@@ -0,0 +1,137 @@
+/**
+ * Managed known_hosts pinning for the device fleet (RUSH-1767).
+ *
+ * The shared SSH baseline uses `StrictHostKeyChecking=accept-new`
+ * (trust-on-first-use): it silently accepts whatever key answers on the FIRST
+ * connect, so a machine-in-the-middle present in that window is trusted forever
+ * and never re-checked. This module gives the CLI its own known_hosts store,
+ * kept apart from the user's `~/.ssh/known_hosts`, so a device's host key can be
+ * *pinned*: once a key is recorded here, connections verify against it with
+ * `StrictHostKeyChecking=yes`, so a later key swap is refused instead of
+ * silently re-accepted.
+ *
+ * The learn-then-pin flow: the first `agents ssh`/fleet connection to a host is
+ * still `accept-new`, but it writes the learned key into THIS store, which pins
+ * it for every subsequent connect. Credential copies (`run --host --copy-creds`)
+ * refuse to run against a host that isn't pinned here — see
+ * `commands/exec.ts` — so tokens never ride an unverified first connect.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { spawnSync } from 'child_process';
+import { getCacheDir } from '../state.js';
+import { assertValidSshTarget } from '../ssh-exec.js';
+import { parseKnownHosts } from '../hosts/ssh-config.js';
+/** Path to the CLI-managed known_hosts store (created lazily, mode 0600). */
+export function managedKnownHostsPath() {
+    return path.join(getCacheDir(), 'devices', 'known_hosts');
+}
+/** Ensure the parent directory of the managed store exists (mode 0700). */
+export function ensureManagedKnownHostsDir(file = managedKnownHostsPath()) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+}
+/** Read the managed store, or '' when it does not exist yet. */
+export function readManagedKnownHosts(file = managedKnownHostsPath()) {
+    try {
+        return fs.readFileSync(file, 'utf-8');
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * True if `host` has at least one pinned key line in `content`. Pure (content
+ * in) so the match logic is unit-testable without touching disk. Matching is
+ * case-insensitive on the hostname, as OpenSSH does.
+ */
+export function isHostPinnedIn(content, host) {
+    const needle = host.trim().toLowerCase();
+    if (!needle)
+        return false;
+    return parseKnownHosts(content).some((h) => h.toLowerCase() === needle);
+}
+/** True if `host` is pinned in the managed store on disk. */
+export function isHostPinned(host, file = managedKnownHostsPath()) {
+    return isHostPinnedIn(readManagedKnownHosts(file), host);
+}
+/**
+ * The host-key-checking ssh options for a connection.
+ *
+ * Always points `UserKnownHostsFile` at the managed store so learned and pinned
+ * keys live in exactly one CLI-owned file. `StrictHostKeyChecking` is `yes` once
+ * the host is pinned (a key swap is refused) and `accept-new` before that
+ * (genuine first enrollment learns the key into the managed store, which pins it
+ * for every subsequent connect). Pure given `pinned`, so the policy is testable.
+ */
+export function hostKeyCheckingOpts(pinned, file = managedKnownHostsPath()) {
+    return [
+        '-o', `UserKnownHostsFile=${file}`,
+        '-o', `StrictHostKeyChecking=${pinned ? 'yes' : 'accept-new'}`,
+    ];
+}
+/**
+ * The key lines in `scanned` (ssh-keyscan output) not already present in
+ * `existing`. Comments and blank lines are dropped; whitespace is normalized so
+ * a re-scan of an already-pinned key is a no-op. Pure, so the idempotent-append
+ * contract is unit-testable without spawning ssh-keyscan.
+ */
+export function newKnownHostsLines(existing, scanned) {
+    const have = new Set(existing.split('\n').map((l) => l.trim()).filter(Boolean));
+    const seen = new Set();
+    const fresh = [];
+    for (const raw of scanned.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || have.has(line) || seen.has(line))
+            continue;
+        seen.add(line);
+        fresh.push(line);
+    }
+    return fresh;
+}
+/**
+ * Merge `ssh-keyscan` output for `host` into the managed store at `file`,
+ * idempotently, and report whether `host` is pinned afterward. Split out from
+ * {@link pinHostKey} so the store-write half — the part that decides a scanned
+ * key now counts as pinned — is unit-testable with real keyscan text and no
+ * network (the spawn stays in `pinHostKey`).
+ */
+export function recordScannedKeys(host, scanned, file = managedKnownHostsPath()) {
+    ensureManagedKnownHostsDir(file);
+    const existing = readManagedKnownHosts(file);
+    const fresh = newKnownHostsLines(existing, scanned);
+    if (fresh.length > 0) {
+        const prefix = existing && !existing.endsWith('\n') ? '\n' : '';
+        fs.appendFileSync(file, prefix + fresh.join('\n') + '\n', { mode: 0o600 });
+    }
+    return { pinned: isHostPinned(host, file), added: fresh.length };
+}
+/**
+ * `ssh-keyscan` a host at a trusted moment and append any new key lines to the
+ * managed store, idempotently. This is the explicit pin path; the implicit one
+ * is a normal `accept-new` connection whose learned key lands in the same store.
+ * Returns whether the host is pinned afterward.
+ *
+ * Host-name-agnostic: it scans whatever address it is handed, so it also pins a
+ * host `agents ssh` can't reach — notably a bare `~/.ssh/config` `Host` alias,
+ * which is not a registered device. The `--copy-creds` gate (commands/exec.ts)
+ * calls this for exactly that case so the credential copy is usable for
+ * ssh-config-alias hosts (RUSH-1767).
+ */
+export function pinHostKey(host, opts = {}) {
+    // Same injection guard as sshExec: a host starting with `-` (or carrying shell
+    // metacharacters) must never reach ssh-keyscan as a bare argv where it could
+    // be parsed as a flag.
+    assertValidSshTarget(host);
+    const file = opts.file ?? managedKnownHostsPath();
+    const timeoutMs = opts.timeoutMs ?? 8000;
+    ensureManagedKnownHostsDir(file);
+    const args = ['-T', String(Math.max(1, Math.ceil(timeoutMs / 1000)))];
+    if (opts.port)
+        args.push('-p', String(opts.port));
+    args.push(host);
+    const res = spawnSync('ssh-keyscan', args, { encoding: 'utf-8', timeout: timeoutMs });
+    if (res.status !== 0 || !res.stdout) {
+        return { pinned: isHostPinned(host, file), added: 0 };
+    }
+    return recordScannedKeys(host, res.stdout, file);
+}

package/dist/lib/exec.d.ts

@@ -52,6 +52,21 @@ export declare function headlessPlanStallCommand(args: {
  *   explicitly asked to bypass permissions; pretending we did is unsafe.
  */
 export declare function resolveMode(agent: AgentId, requested: Mode): Mode;
+/**
+ * Resolve a requested mode for a run, honoring whether the run is HEADLESS.
+ *
+ * Wraps resolveMode with one extra rule: an agent may list `plan` in its modes
+ * (so interactive plan works) yet declare `capabilities.headlessPlan === false`
+ * because plan is broken in a headless `--prompt`/`-p` run — kimi refuses
+ * `--prompt` + `--plan`, and grok's `--permission-mode plan` silently stalls at
+ * its ExitPlanMode gate. For those agents, a headless plan request degrades to
+ * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
+ * one-line stderr warning, mirroring the graceful plan→edit degrade cursor and
+ * antigravity get for having no plan flag at all. Interactive runs are never
+ * downgraded. This is the single source of truth shared by buildExecCommand
+ * (agents run / teams) and the routine runner.
+ */
+export declare function resolveHeadlessMode(agent: AgentId, requested: Mode, interactive: boolean): Mode;
 /**
  * The mode an agent should run in when the caller has no preference.
  *

package/dist/lib/exec.js

@@ -104,6 +104,28 @@ export function resolveMode(agent, requested) {
     }
     throw new Error(`${agent} does not support '${requested}' mode. Supported modes: ${supported.join(', ')}.`);
 }
+/**
+ * Resolve a requested mode for a run, honoring whether the run is HEADLESS.
+ *
+ * Wraps resolveMode with one extra rule: an agent may list `plan` in its modes
+ * (so interactive plan works) yet declare `capabilities.headlessPlan === false`
+ * because plan is broken in a headless `--prompt`/`-p` run — kimi refuses
+ * `--prompt` + `--plan`, and grok's `--permission-mode plan` silently stalls at
+ * its ExitPlanMode gate. For those agents, a headless plan request degrades to
+ * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
+ * one-line stderr warning, mirroring the graceful plan→edit degrade cursor and
+ * antigravity get for having no plan flag at all. Interactive runs are never
+ * downgraded. This is the single source of truth shared by buildExecCommand
+ * (agents run / teams) and the routine runner.
+ */
+export function resolveHeadlessMode(agent, requested, interactive) {
+    const mode = resolveMode(agent, requested);
+    if (!interactive && mode === 'plan' && AGENTS[agent].capabilities.headlessPlan === false) {
+        process.stderr.write(`warning: ${agent} has no headless plan mode; running --mode auto instead\n`);
+        return resolveMode(agent, 'auto');
+    }
+    return mode;
+}
 /**
  * The mode an agent should run in when the caller has no preference.
  *
@@ -573,9 +595,11 @@ export function buildExecCommand(options) {
     // Resolve the requested mode against the agent's capability table.
     // - `auto` on an agent without auto support → silently degrades to `edit`
     // - `plan` on an agent without a read-only mode → degrades to modes[0]
+    // - headless `plan` on an agent with headlessPlan:false (kimi, grok) →
+    //   degrades to `auto` with a stderr warning (see resolveHeadlessMode)
     // - `skip` on an unsupported agent → throws a clear error
-    // After resolveMode, the chosen mode is guaranteed to be in template.modeFlags.
-    const resolvedMode = resolveMode(options.agent, normalizeMode(options.mode));
+    // After resolution, the chosen mode is guaranteed to be in template.modeFlags.
+    const resolvedMode = resolveHeadlessMode(options.agent, normalizeMode(options.mode), interactive);
     const modeFlags = template.modeFlags[resolvedMode];
     if (!modeFlags) {
         // Defense in depth: would only fire if AGENTS.capabilities.modes and
@@ -609,11 +633,12 @@ export function buildExecCommand(options) {
         // all abort with "Cannot combine --prompt with --X" (verified against the live
         // kimi CLI). The write-capable modes (edit/auto/skip) all collapse to kimi's
         // default `-p` behavior, which already auto-approves tool calls, so we emit no
-        // mode flag. Plan (read-only) has no headless equivalent, so fail closed rather
-        // than silently letting a plan-mode run mutate the workspace.
+        // mode flag. Plan can't reach here headless — resolveHeadlessMode already
+        // downgraded it to auto (kimi's headlessPlan:false); this asserts that
+        // invariant so a plan-mode run can never silently mutate the workspace.
         if (resolvedMode === 'plan') {
-            throw new Error('kimi has no headless read-only mode: `--prompt` cannot be combined with `--plan`. ' +
-                'Run kimi in plan mode interactively (omit the prompt), or use --mode edit, auto, or skip.');
+            throw new Error(`Internal error: kimi reached headless command build with resolved mode 'plan'; ` +
+                `resolveHeadlessMode should have downgraded it to auto (capabilities.headlessPlan is false).`);
         }
         // edit/auto/skip: emit no mode flag — `kimi -p` auto-runs.
     }

package/dist/lib/hosts/dispatch.js

@@ -17,6 +17,7 @@ import { resolveRemoteOsSync } from './remote-os.js';
 import { saveTask, updateTask, terminalPatch } from './tasks.js';
 import { followHostTask } from './progress.js';
 import { wrapHostCommandWithCredentials } from './credentials.js';
+import { hostKeyCheckingOpts } from '../devices/known-hosts.js';
 // Use $HOME (not ~) so the path is correct whether or not it's quoted and
 // regardless of the run's cwd. Task ids are 8 hex chars, so these paths are
 // injection-safe to interpolate unquoted into remote commands.
@@ -180,10 +181,19 @@ async function launchDetached(host, target, opts) {
     if (opts.copyCreds) {
         inner = wrapHostCommandWithCredentials(inner, opts.copyCreds);
     }
+    // When credentials ride this launch, verify the host key strictly against the
+    // managed pin (the gate in exec.ts already required the host to be pinned) and
+    // force a fresh connection — reusing a control socket opened by an earlier
+    // accept-new connection would bypass the strict check (RUSH-1767).
+    const credHostKeyOpts = opts.copyCreds ? hostKeyCheckingOpts(true) : undefined;
     // Outer: ensure dir, launch the login-shell wrapper as a new process-group
     // leader, and print that leader PID.
     const launch = `mkdir -p ${REMOTE_DIR}; ${buildDetachedLaunchCommand(inner)}`;
-    const res = sshExec(target, launch, { timeoutMs: 30000, multiplex: true });
+    const res = sshExec(target, launch, {
+        timeoutMs: 30000,
+        multiplex: !opts.copyCreds,
+        hostKeyOpts: credHostKeyOpts,
+    });
     if (res.code !== 0) {
         throw new Error(`Failed to launch on "${host.name}": ${(res.stderr || res.stdout).trim() || 'ssh error'}`);
     }
@@ -362,7 +372,15 @@ export async function runInteractiveOnHost(host, opts) {
     if (opts.copyCreds) {
         remoteCmd = wrapHostCommandWithCredentials(remoteCmd, opts.copyCreds);
     }
-    return sshStream(target, remoteCmd, { tty: process.stdin.isTTY, multiplex: true });
+    // Credentials ride this stream when --copy-creds is set: verify the host key
+    // strictly against the managed pin and force a fresh connection so a stale
+    // accept-new control socket can't bypass the check (RUSH-1767).
+    const credHostKeyOpts = opts.copyCreds ? hostKeyCheckingOpts(true) : undefined;
+    return sshStream(target, remoteCmd, {
+        tty: process.stdin.isTTY,
+        multiplex: !opts.copyCreds,
+        hostKeyOpts: credHostKeyOpts,
+    });
 }
 /** Dispatch an `agents run <agent> "<prompt>"` onto a host (the `run --host` path). */
 export async function dispatchToHost(host, opts) {

package/dist/lib/hosts/remote-cmd.js

@@ -227,12 +227,16 @@ export function buildWindowsAgentsCommand(cmd) {
  */
 export function buildWindowsStdinImportCommand(bundle, opts = {}) {
     const force = opts.force ? ' --force' : '';
+    // Create AND write the temp file INSIDE the try so its finally always cleans
+    // up: if GetTempFileName succeeds but WriteAllText (or the import) then throws,
+    // the secret-bearing temp file would otherwise be left behind (RUSH-1764). $tmp
+    // starts null so a GetTempFileName that itself throws leaves nothing to remove.
     const script = [
         '$in = [Console]::In.ReadToEnd()',
-        '$tmp = [System.IO.Path]::GetTempFileName()',
-        '[System.IO.File]::WriteAllText($tmp, $in)',
-        `try { & agents secrets import ${powershellQuote(bundle)} --from $tmp${force}; $code = $LASTEXITCODE } ` +
-            `finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }`,
+        '$tmp = $null',
+        `try { $tmp = [System.IO.Path]::GetTempFileName(); [System.IO.File]::WriteAllText($tmp, $in); ` +
+            `& agents secrets import ${powershellQuote(bundle)} --from $tmp${force}; $code = $LASTEXITCODE } ` +
+            `finally { if ($tmp) { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue } }`,
         'if ($null -eq $code) { $code = 1 }',
         'exit $code',
     ].join('; ');

package/dist/lib/monitors/engine.js

@@ -170,6 +170,10 @@ export class MonitorEngine {
             const windowMs = parseInterval(monitor.rateLimit.per) ?? 60_000;
             fireTimes = recordFireTime(monitor.name, now, windowMs);
             if (fireTimes.length > monitor.rateLimit.max) {
+                // Record the tripped event in fire history too, so `agents monitors runs`
+                // reflects what `view`'s `lastFiredAt` shows — the firehose event the guard
+                // exists to surface must not be invisible in the fire log.
+                writeFireRecord(event, { action: monitor.action.type, ok: false, error: 'rate limited — auto-paused' });
                 writeState(monitor.name, decision.value, decision.dedupeKey, { lastFiredAt: event.firedAt, fireTimes });
                 try {
                     setMonitorEnabled(monitor.name, false);

package/dist/lib/monitors/sources/device.js

@@ -18,9 +18,19 @@ export async function evaluate(source) {
     const registry = await loadDevices();
     const wanted = normalizeHost(name);
     const entry = Object.entries(registry).find(([k]) => normalizeHost(k) === wanted);
-    const stats = entry && normalizeHost(entry[0]) !== machineId()
-        ? await probeDeviceStats(entry[1])
-        : await probeLocalStats(name);
+    // An unregistered / removed device must NOT silently fall back to the local
+    // machine's stats — that would watch the wrong box under the requested name
+    // (the "no fallback logic" convention). `add` validates --watch-device up
+    // front, so this catches the device-removed-after-creation case at eval time.
+    if (!entry) {
+        return {
+            raw: `error\tdevice not registered: ${name}`,
+            meta: { error: true, reachable: false, device: name },
+        };
+    }
+    const stats = normalizeHost(entry[0]) === machineId()
+        ? await probeLocalStats(name)
+        : await probeDeviceStats(entry[1]);
     const bucket = headroom(stats);
     return {
         raw: `${stats.reachable ? 'reachable' : 'unreachable'}\t${bucket}`,