@phnx-labs/agents-cli 1.20.71 → 1.20.73

package/dist/lib/crabbox/runtimes.js

@@ -103,10 +103,41 @@ export function inferLeaseRuntime(agentName, detected) {
     // Custom/workflow agent: fall back to the signed-in runtime (preferring claude).
     return signedIn.find((d) => d.id === 'claude')?.id ?? signedIn[0]?.id ?? null;
 }
+const PROFILE_AUTH_ENV_KEYS_BY_RUNTIME = {
+    claude: [
+        'ANTHROPIC_AUTH_TOKEN',
+        'ANTHROPIC_API_KEY',
+        'AWS_ACCESS_KEY_ID',
+        'AWS_PROFILE',
+        'AWS_BEARER_TOKEN_BEDROCK',
+        'GOOGLE_APPLICATION_CREDENTIALS',
+        'GOOGLE_CLOUD_PROJECT',
+        'ANTHROPIC_FOUNDRY_API_KEY',
+    ],
+    codex: ['OPENAI_API_KEY'],
+    gemini: ['GEMINI_API_KEY', 'GOOGLE_API_KEY'],
+    grok: ['XAI_API_KEY', 'GROK_API_KEY'],
+};
+/** True when a profile already carries auth for its host runtime via env. */
+export function profileNeedsBaseRuntimeCredentials(agent, env, authEnvVar) {
+    if (!LEASE_RUNTIMES.some((c) => c.id === agent))
+        return false;
+    if (authEnvVar && typeof env[authEnvVar] === 'string' && env[authEnvVar].trim() !== '')
+        return false;
+    const keys = PROFILE_AUTH_ENV_KEYS_BY_RUNTIME[agent] ?? [];
+    return !keys.some((key) => typeof env[key] === 'string' && env[key].trim() !== '');
+}
 // A long random sentinel makes an accidental (or malicious) collision with a
 // token's contents effectively impossible, so the quoted heredoc can never be
 // closed early by the credential body.
 const CRED_EOF = 'AGENTS_LEASE_CRED_EOF_9f3c1a7b5e2d4068';
+/** Build a quoted heredoc write to a path under the remote user's home. */
+export function buildHomeFileWriteScript(remote, contents) {
+    const dir = path.posix.dirname(remote);
+    const mkdir = dir && dir !== '.' ? `mkdir -p "$HOME/${dir}"\n` : '';
+    return (`${mkdir}cat > "$HOME/${remote}" <<'${CRED_EOF}'\n${contents}${contents.endsWith('\n') ? '' : '\n'}${CRED_EOF}\n` +
+        `chmod 600 "$HOME/${remote}"`);
+}
 /**
  * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
  * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token
@@ -206,12 +237,6 @@ export async function resolveClaudeCredentialsBlob(opts) {
 export function buildCredentialScript(picked, detected, extras) {
     const byId = new Map(detected.map((d) => [d.id, d]));
     const parts = [];
-    const writeFile = (remote, contents) => {
-        const dir = path.posix.dirname(remote);
-        const mkdir = dir && dir !== '.' ? `mkdir -p "$HOME/${dir}"\n` : '';
-        return (`${mkdir}cat > "$HOME/${remote}" <<'${CRED_EOF}'\n${contents}${contents.endsWith('\n') ? '' : '\n'}${CRED_EOF}\n` +
-            `chmod 600 "$HOME/${remote}"`);
-    };
     for (const id of picked) {
         const d = byId.get(id);
         const cred = LEASE_RUNTIMES.find((c) => c.id === id);
@@ -224,11 +249,11 @@ export function buildCredentialScript(picked, detected, extras) {
         catch {
             continue;
         }
-        parts.push(writeFile(cred.remote, contents));
+        parts.push(buildHomeFileWriteScript(cred.remote, contents));
         // For claude the file above is config/state only; the OAuth token is a
         // second artifact — without it the box comes up "Not logged in".
         if (id === 'claude' && extras?.claudeCredentialsJson) {
-            parts.push(writeFile(CLAUDE_TOKEN_REMOTE, extras.claudeCredentialsJson));
+            parts.push(buildHomeFileWriteScript(CLAUDE_TOKEN_REMOTE, extras.claudeCredentialsJson));
         }
     }
     return parts.join('\n');

package/dist/lib/crabbox/setup-copy.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Setup-copy for `agents run --lease` (RUSH-1920), transport = PUSH-FROM-LOCAL.
+ *
+ * A fresh crabbox box has agents-cli installed but none of the caller's own
+ * `~/.agents` config (skills, hooks, commands, MCP, profiles). This module
+ * replicates the *git-tracked* subset of the LOCAL `~/.agents` onto the box:
+ *
+ *   1. `git -C <userAgentsDir> ls-files` — tracked files only. Tracked-only is
+ *      the safety boundary: it excludes `.history/`, `.cache/`, `.system/` and
+ *      any keychain-backed secrets by construction (those are gitignored), so no
+ *      credential material is ever pushed.
+ *   2. `rsync` that exact file set to `~/.agents` on the box over crabbox's OWN
+ *      ssh invocation (`crabboxSshArgv`) — crabbox provisions a per-lease identity
+ *      key, so a raw `ssh crabbox@ip` fails publickey; only crabbox's key works.
+ *   3. `agents repo refresh` on the box so the copied config takes effect.
+ *
+ * NEVER copies `~/.claude` / `~/.claude.json` — they live in `$HOME`, not
+ * `~/.agents`, and are rebuilt on the box by `agents add` + refresh; an explicit
+ * filter belts-and-braces the tracked-only guarantee.
+ *
+ * This is a self-contained local function the command layer calls; it does NOT
+ * ride the box-side bootstrap script (that only echoes the `copy-setup` progress
+ * sentinel — see `buildBootstrapScript`).
+ */
+/** Remote path (relative to the box user's home) the tracked config lands in. */
+export declare const REMOTE_AGENTS_DIR = ".agents/";
+export interface CopySetupOptions {
+    /** crabbox box slug to push to — its per-lease ssh key does the auth. */
+    slug: string;
+    /** Secrets bundle whose env the ssh/rsync children inherit (crabbox parity). */
+    secretsBundle?: string;
+    /** Override the local `~/.agents` dir (defaults to `getUserAgentsDir()`). */
+    userAgentsDir?: string;
+    /** Receives combined stdout/stderr of the rsync + refresh, if set. */
+    onData?: (chunk: string) => void;
+    /**
+     * Run `agents repo refresh` on the box after the push (default `true`). Set
+     * `false` when the caller runs the refresh itself in the box bootstrap — the
+     * lease path does this so the refresh runs AFTER the box installs agents-cli
+     * (this host-side push happens before the box boots agents-cli, so a host-side
+     * refresh here could not find the CLI).
+     */
+    refresh?: boolean;
+}
+export interface CopySetupResult {
+    /** The tracked files enumerated for the push (post-exclusion). */
+    files: string[];
+    /** rsync exit code, or null when the process failed to spawn. */
+    pushExitCode: number | null;
+    /** `agents repo refresh` exit code, or null when it was skipped/failed to spawn. */
+    refreshExitCode: number | null;
+}
+/**
+ * git-tracked files under `dir` (paths relative to `dir`), minus the never-copy
+ * set. Returns `[]` when `dir` is not a git repo — a caller with no tracked
+ * `~/.agents` simply copies nothing.
+ */
+export declare function enumerateTrackedFiles(dir: string): string[];
+/**
+ * Split crabbox's ssh argv (`['ssh', …opts, 'crabbox@host']`) into the `-e`
+ * transport string (`ssh …opts`) and the `crabbox@host` endpoint. This is what
+ * carries the per-lease identity key + known_hosts a raw ssh lacks.
+ */
+export declare function sshTransportFromArgv(sshArgv: string[]): {
+    rsh: string;
+    host: string;
+};
+/**
+ * rsync argv to push the tracked file set to `~/.agents` on the box. Reads the
+ * NUL-separated list at `filesFrom` (`--from0`, matching `ls-files -z`) so paths
+ * with spaces survive, and tunnels over crabbox's own ssh (`rsh`).
+ */
+export declare function buildSetupRsyncArgs(opts: {
+    rsh: string;
+    host: string;
+    filesFrom: string;
+    source: string;
+    remoteDir?: string;
+}): string[];
+/**
+ * Replicate the git-tracked subset of the local `~/.agents` onto the crabbox box
+ * and refresh it. Enumerates tracked files, rsyncs them over ssh, then runs
+ * `agents repo refresh` on the box. Refresh is skipped when the push fails or the
+ * file set is empty (nothing to refresh). Never throws — surfaces failure through
+ * the returned exit codes.
+ */
+export declare function copySetupToBox(opts: CopySetupOptions): Promise<CopySetupResult>;

package/dist/lib/crabbox/setup-copy.js

@@ -0,0 +1,127 @@
+/**
+ * Setup-copy for `agents run --lease` (RUSH-1920), transport = PUSH-FROM-LOCAL.
+ *
+ * A fresh crabbox box has agents-cli installed but none of the caller's own
+ * `~/.agents` config (skills, hooks, commands, MCP, profiles). This module
+ * replicates the *git-tracked* subset of the LOCAL `~/.agents` onto the box:
+ *
+ *   1. `git -C <userAgentsDir> ls-files` — tracked files only. Tracked-only is
+ *      the safety boundary: it excludes `.history/`, `.cache/`, `.system/` and
+ *      any keychain-backed secrets by construction (those are gitignored), so no
+ *      credential material is ever pushed.
+ *   2. `rsync` that exact file set to `~/.agents` on the box over crabbox's OWN
+ *      ssh invocation (`crabboxSshArgv`) — crabbox provisions a per-lease identity
+ *      key, so a raw `ssh crabbox@ip` fails publickey; only crabbox's key works.
+ *   3. `agents repo refresh` on the box so the copied config takes effect.
+ *
+ * NEVER copies `~/.claude` / `~/.claude.json` — they live in `$HOME`, not
+ * `~/.agents`, and are rebuilt on the box by `agents add` + refresh; an explicit
+ * filter belts-and-braces the tracked-only guarantee.
+ *
+ * This is a self-contained local function the command layer calls; it does NOT
+ * ride the box-side bootstrap script (that only echoes the `copy-setup` progress
+ * sentinel — see `buildBootstrapScript`).
+ */
+import { spawn, spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { getUserAgentsDir } from '../state.js';
+import { crabboxEnv, crabboxSshArgv } from './cli.js';
+/** Remote path (relative to the box user's home) the tracked config lands in. */
+export const REMOTE_AGENTS_DIR = '.agents/';
+/** Top-level paths that must never be pushed, even if somehow tracked. */
+const NEVER_COPY = new Set(['.claude', '.claude.json']);
+/**
+ * git-tracked files under `dir` (paths relative to `dir`), minus the never-copy
+ * set. Returns `[]` when `dir` is not a git repo — a caller with no tracked
+ * `~/.agents` simply copies nothing.
+ */
+export function enumerateTrackedFiles(dir) {
+    const r = spawnSync('git', ['-C', dir, 'ls-files', '-z'], { encoding: 'utf-8' });
+    if (r.status !== 0 || !r.stdout)
+        return [];
+    return r.stdout
+        .split('\0')
+        .filter(Boolean)
+        .filter((f) => {
+        const top = f.split('/')[0];
+        return !NEVER_COPY.has(f) && !NEVER_COPY.has(top);
+    });
+}
+/**
+ * Split crabbox's ssh argv (`['ssh', …opts, 'crabbox@host']`) into the `-e`
+ * transport string (`ssh …opts`) and the `crabbox@host` endpoint. This is what
+ * carries the per-lease identity key + known_hosts a raw ssh lacks.
+ */
+export function sshTransportFromArgv(sshArgv) {
+    const host = sshArgv[sshArgv.length - 1];
+    const rsh = sshArgv.slice(0, -1).join(' '); // 'ssh -i <key> -o … -p 2222'
+    return { rsh, host };
+}
+/**
+ * rsync argv to push the tracked file set to `~/.agents` on the box. Reads the
+ * NUL-separated list at `filesFrom` (`--from0`, matching `ls-files -z`) so paths
+ * with spaces survive, and tunnels over crabbox's own ssh (`rsh`).
+ */
+export function buildSetupRsyncArgs(opts) {
+    const remote = `${opts.host}:${opts.remoteDir ?? REMOTE_AGENTS_DIR}`;
+    const source = opts.source.endsWith('/') ? opts.source : `${opts.source}/`;
+    return ['-az', '--files-from', opts.filesFrom, '--from0', '-e', opts.rsh, source, remote];
+}
+function runStreaming(cmd, args, env, onData) {
+    return new Promise((resolve) => {
+        const proc = spawn(cmd, args, { env, stdio: ['ignore', 'pipe', 'pipe'] });
+        const pump = (chunk) => {
+            const s = chunk.toString('utf-8');
+            if (onData)
+                onData(s);
+            else
+                process.stdout.write(s);
+        };
+        proc.stdout.on('data', pump);
+        proc.stderr.on('data', pump);
+        proc.on('error', () => resolve(null));
+        proc.on('close', (code) => resolve(code));
+    });
+}
+/**
+ * Replicate the git-tracked subset of the local `~/.agents` onto the crabbox box
+ * and refresh it. Enumerates tracked files, rsyncs them over ssh, then runs
+ * `agents repo refresh` on the box. Refresh is skipped when the push fails or the
+ * file set is empty (nothing to refresh). Never throws — surfaces failure through
+ * the returned exit codes.
+ */
+export async function copySetupToBox(opts) {
+    const dir = opts.userAgentsDir ?? getUserAgentsDir();
+    const files = enumerateTrackedFiles(dir);
+    if (files.length === 0) {
+        return { files, pushExitCode: null, refreshExitCode: null };
+    }
+    // crabbox provisions a per-lease ssh key; a raw `ssh crabbox@ip` fails publickey.
+    // Ask crabbox for its exact ssh invocation and tunnel rsync through it.
+    const sshArgv = crabboxSshArgv(opts.slug, { secretsBundle: opts.secretsBundle });
+    if (!sshArgv) {
+        return { files, pushExitCode: null, refreshExitCode: null };
+    }
+    const { rsh, host } = sshTransportFromArgv(sshArgv);
+    const env = crabboxEnv({ secretsBundle: opts.secretsBundle });
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-setup-copy-'));
+    const listPath = path.join(tmp, 'files.lst');
+    try {
+        // NUL-separated list, matching `buildSetupRsyncArgs`'s `--from0`.
+        fs.writeFileSync(listPath, files.join('\0'), 'utf-8');
+        const rsyncArgs = buildSetupRsyncArgs({ rsh, host, filesFrom: listPath, source: dir });
+        const pushExitCode = await runStreaming('rsync', rsyncArgs, env, opts.onData);
+        let refreshExitCode = null;
+        if (pushExitCode === 0 && opts.refresh !== false) {
+            // ssh <opts> crabbox@host bash -lc 'agents repo refresh'
+            const refreshArgs = [...sshArgv.slice(1), 'bash', '-lc', 'agents repo refresh'];
+            refreshExitCode = await runStreaming('ssh', refreshArgs, env, opts.onData);
+        }
+        return { files, pushExitCode, refreshExitCode };
+    }
+    finally {
+        fs.rmSync(tmp, { recursive: true, force: true });
+    }
+}

package/dist/lib/daemon.d.ts

@@ -7,6 +7,15 @@
  * log output, reload (SIGHUP), and graceful shutdown are handled here.
  */
 import { getAgentsBinPath } from './cli-entry.js';
+/**
+ * RUSH-1817: decide whether the daemon should (re)take over hosting the secrets
+ * broker. The startup host decision is one-shot; this drives the periodic
+ * self-heal re-check. Take over ONLY when the daemon is not already hosting AND
+ * no healthy broker answers a ping — i.e. a standalone the daemon deferred to at
+ * start has since died or crash-looped. Never take over while our in-process
+ * broker is hosting, and never clobber a reachable (healthy) broker.
+ */
+export declare function shouldTakeOverBroker(isHosting: boolean, brokerReachable: boolean): boolean;
 /** Read the stored daemon PID from disk. Returns null if not present or invalid. */
 export declare function readDaemonPid(): number | null;
 /** Write the daemon PID to the pid file. */
@@ -24,9 +33,9 @@ export declare function isDaemonWedged(): boolean;
 /** Check if the daemon process is alive by sending signal 0 to the stored PID. */
 export declare function isDaemonRunning(): boolean;
 /**
- * Single-instance claim for the daemon `_run` entrypoint.
+ * Single-instance claim for the daemon foreground entrypoint.
  *
- * `agents daemon _run` is reachable directly — a manual invocation, or a
+ * `agents __daemon-run` is reachable directly — a manual invocation, or a
  * service-manager restart that races a still-alive predecessor — bypassing the
  * start lock in startDaemon(). Without this guard runDaemon() would call
  * writeDaemonPid() unconditionally, clobber a live daemon's recorded PID, and
@@ -40,7 +49,7 @@ export declare function isDaemonRunning(): boolean;
  */
 export declare function claimDaemonInstance(): boolean;
 /**
- * Reap stray duplicate daemon processes — a `daemon _run` of THIS install that
+ * Reap stray duplicate daemon processes — a `__daemon-run` of THIS install that
  * isn't this process and isn't the pid-file owner. Mirrors the browser orphan
  * reaper (below): a predecessor that was SIGKILLed/OOM-ed without cleaning up,
  * or a duplicate that lost the pid-file write race, would otherwise keep a
@@ -132,8 +141,8 @@ export declare function ensureDaemonStarted(): {
  */
 export declare function buildDetachedDaemonEnv(baseEnv?: NodeJS.ProcessEnv, oauthToken?: string | null): NodeJS.ProcessEnv;
 /**
- * Resolve how to launch the daemon: `node <entry> daemon _run`, matching the
- * exact form that works under a direct `daemon _run`.
+ * Resolve how to launch the daemon: `node <entry> __daemon-run`, matching the
+ * exact form that works under a direct `__daemon-run`.
  *
  * We spawn the Node runtime (`process.execPath`) with the CLI entry as an
  * argument rather than executing the entry path directly. Executing the `.js`

package/dist/lib/daemon.js

@@ -38,6 +38,17 @@ const WEDGE_THRESHOLD_TICKS = 3;
 // session (which expires between runs and produces intermittent 401s).
 const DAEMON_OAUTH_BUNDLE = 'claude';
 const DAEMON_OAUTH_KEY = 'CLAUDE_CODE_OAUTH_TOKEN';
+/**
+ * RUSH-1817: decide whether the daemon should (re)take over hosting the secrets
+ * broker. The startup host decision is one-shot; this drives the periodic
+ * self-heal re-check. Take over ONLY when the daemon is not already hosting AND
+ * no healthy broker answers a ping — i.e. a standalone the daemon deferred to at
+ * start has since died or crash-looped. Never take over while our in-process
+ * broker is hosting, and never clobber a reachable (healthy) broker.
+ */
+export function shouldTakeOverBroker(isHosting, brokerReachable) {
+    return !isHosting && !brokerReachable;
+}
 function getDaemonDir() {
     const dir = getDaemonDirRoot();
     fs.mkdirSync(dir, { recursive: true });
@@ -176,9 +187,9 @@ export function isDaemonRunning() {
     return false;
 }
 /**
- * Single-instance claim for the daemon `_run` entrypoint.
+ * Single-instance claim for the daemon foreground entrypoint.
  *
- * `agents daemon _run` is reachable directly — a manual invocation, or a
+ * `agents __daemon-run` is reachable directly — a manual invocation, or a
  * service-manager restart that races a still-alive predecessor — bypassing the
  * start lock in startDaemon(). Without this guard runDaemon() would call
  * writeDaemonPid() unconditionally, clobber a live daemon's recorded PID, and
@@ -205,7 +216,7 @@ export function claimDaemonInstance() {
     }
 }
 /**
- * Reap stray duplicate daemon processes — a `daemon _run` of THIS install that
+ * Reap stray duplicate daemon processes — a `__daemon-run` of THIS install that
  * isn't this process and isn't the pid-file owner. Mirrors the browser orphan
  * reaper (below): a predecessor that was SIGKILLed/OOM-ed without cleaning up,
  * or a duplicate that lost the pid-file write race, would otherwise keep a
@@ -241,10 +252,10 @@ export function reapStrayDaemons(keepPid = process.pid) {
         const args = m[2];
         if (isNaN(pid) || pid === keepPid || pid === process.pid || pid === ownerPid)
             continue;
-        // Same install (same launch entry) AND a `daemon _run` command line.
+        // Same install (same launch entry) AND a `__daemon-run` command line.
         if (!args.includes(selfEntry))
             continue;
-        if (!/\bdaemon\b.*\b_run\b/.test(args))
+        if (!/\b__daemon-run\b/.test(args))
             continue;
         try {
             process.kill(pid, 'SIGTERM');
@@ -284,7 +295,7 @@ export function log(level, message) {
 }
 /** Main daemon loop: load jobs, schedule crons, monitor runs, and handle signals. */
 export async function runDaemon() {
-    // Single-instance guard: a direct `agents daemon _run` (manual, or a
+    // Single-instance guard: a direct `agents __daemon-run` (manual, or a
     // service-manager restart racing a live predecessor) must not clobber a
     // running daemon's pid file and start a second scheduler.
     if (!claimDaemonInstance()) {
@@ -661,6 +672,37 @@ export async function runDaemon() {
     };
     const fleetCacheInterval = setInterval(() => { void runFleetCacheWarm(); }, 3 * 60_000);
     const fleetCacheKickoff = setTimeout(() => { void runFleetCacheWarm(); }, 60_000);
+    // RUSH-1817: the startup host decision above is one-shot. If a standalone
+    // broker answered agentPing() at daemon start, the daemon declined to host —
+    // but should that standalone later die or crash-loop, nothing takes over and
+    // every `agents secrets unlock|export|start` fails until a manual restart
+    // (this wedged all keychain-backed secrets on zion and blocked a release).
+    // Re-probe on a cadence: whenever the daemon is NOT itself hosting AND no
+    // healthy broker answers a ping, take over hosting. startHostedBroker binds
+    // the socket only when it is free, so a take-over never races a live broker.
+    let selfHealingBroker = false;
+    const runBrokerSelfHeal = async () => {
+        if (selfHealingBroker)
+            return;
+        selfHealingBroker = true;
+        try {
+            const { agentPing, startHostedBroker } = await import('./secrets/agent.js');
+            const reachable = (await agentPing()).reachable;
+            if (!shouldTakeOverBroker(hostedBroker != null, reachable))
+                return;
+            hostedBroker = await startHostedBroker();
+            if (hostedBroker) {
+                log('WARN', 'Secrets broker was unreachable; daemon took over hosting (self-heal)');
+            }
+        }
+        catch (err) {
+            log('WARN', `Secrets broker self-heal skipped: ${err.message}`);
+        }
+        finally {
+            selfHealingBroker = false;
+        }
+    };
+    const brokerSelfHealInterval = setInterval(() => { void runBrokerSelfHeal(); }, 60_000);
     const handleReload = () => {
         log('INFO', 'Reloading jobs (SIGHUP)');
         scheduler.reloadAll();
@@ -695,6 +737,7 @@ export async function runDaemon() {
         clearTimeout(launchHealthKickoff);
         clearInterval(fleetCacheInterval);
         clearTimeout(fleetCacheKickoff);
+        clearInterval(brokerSelfHealInterval);
         hostedBroker?.close();
         removeDaemonPid();
         removeHeartbeat();
@@ -962,8 +1005,8 @@ export function buildDetachedDaemonEnv(baseEnv = process.env, oauthToken = readD
     return env;
 }
 /**
- * Resolve how to launch the daemon: `node <entry> daemon _run`, matching the
- * exact form that works under a direct `daemon _run`.
+ * Resolve how to launch the daemon: `node <entry> __daemon-run`, matching the
+ * exact form that works under a direct `__daemon-run`.
  *
  * We spawn the Node runtime (`process.execPath`) with the CLI entry as an
  * argument rather than executing the entry path directly. Executing the `.js`
@@ -983,7 +1026,7 @@ export function getDaemonLaunch(agentsBin = getAgentsBinPath()) {
     const { warnings } = validateDaemonBinary(agentsBin);
     for (const w of warnings)
         process.stderr.write(`[agents] ${w}\n`);
-    return getCliLaunch(['daemon', '_run'], agentsBin);
+    return getCliLaunch(['__daemon-run'], agentsBin);
 }
 /**
  * The directory of the Node runtime that generated this service manifest, kept

package/dist/lib/drive-sync.js

@@ -13,6 +13,7 @@ import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { getDriveDir } from './state.js';
 import { AGENTS } from './agents.js';
+import { sshExec } from './ssh-exec.js';
 const execFileAsync = promisify(execFile);
 // `remote` flows from disk into rsync/ssh argv. Use a strict regex so a
 // tampered ~/.agents/drive/config.json can't sneak shell metacharacters or
@@ -92,9 +93,11 @@ export async function push() {
     assertValidRemote(config.remote);
     const localDir = getDriveDir() + '/';
     const remoteSpec = `${config.remote}:~/.agents/drive/`;
-    // Ensure remote directory exists. ssh's command argument is one positional
-    // string; we hand it as a single argv element so no local shell sees it.
-    await execFileAsync('ssh', [config.remote, 'mkdir -p ~/.agents/drive']);
+    // Ensure remote directory exists via the shared hardened SSH primitive.
+    const mkdir = sshExec(config.remote, 'mkdir -p ~/.agents/drive', { timeoutMs: 30_000 });
+    if (mkdir.code !== 0) {
+        throw new Error(`Failed to prepare remote drive directory on ${config.remote}${mkdir.stderr.trim() ? `: ${mkdir.stderr.trim()}` : ''}`);
+    }
     await execFileAsync('rsync', ['-az', '--exclude=config.json', localDir, remoteSpec]);
     config.lastPush = new Date().toISOString();
     writeDriveConfig(config);

package/dist/lib/event-stream.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The unified event reader -- one stream over BOTH operational events
+ * (`~/.agents/events.jsonl` via events.ts: secrets, commands, teams, ...) and
+ * agent-semantic events (the per-session activity logs via activity.ts: plans,
+ * PRs, worktrees, sub-agents, artifacts). They share one {@link EventType}
+ * vocabulary and one {@link EventRecord} shape, so `agents events` and any
+ * higher-level feature (a session/project summarizer, RSS) read them together.
+ *
+ * The two write paths stay separate for efficiency -- operational events append
+ * to the locked global log (low frequency), agent events append to lock-free
+ * per-session shards (high frequency, one writer each). This module is the
+ * single READ surface that merges them; nothing here writes.
+ */
+import { type EventRecord, type EventType, type EventLevel } from './events.js';
+export interface UnifiedQuery {
+    startDate?: Date;
+    endDate?: Date;
+    eventTypes?: EventType[];
+    level?: EventLevel;
+    agent?: string;
+    caller?: string;
+    command?: string;
+    module?: string;
+    limit?: number;
+    /** Include agent-semantic activity events. Default true. */
+    includeActivity?: boolean;
+    /** Override the activity dir (tests). */
+    activityRoot?: string;
+}
+/**
+ * Read a unified, newest-first event stream. Operational events come from
+ * events.ts `query()`; agent-semantic events from the activity logs, normalized
+ * to the same record shape and filtered identically. `limit` caps the merged
+ * result (each source is fetched up to `limit`, so the top-N is exact).
+ */
+export declare function readUnifiedEvents(q?: UnifiedQuery): EventRecord[];

package/dist/lib/event-stream.js

@@ -0,0 +1,68 @@
+/**
+ * The unified event reader -- one stream over BOTH operational events
+ * (`~/.agents/events.jsonl` via events.ts: secrets, commands, teams, ...) and
+ * agent-semantic events (the per-session activity logs via activity.ts: plans,
+ * PRs, worktrees, sub-agents, artifacts). They share one {@link EventType}
+ * vocabulary and one {@link EventRecord} shape, so `agents events` and any
+ * higher-level feature (a session/project summarizer, RSS) read them together.
+ *
+ * The two write paths stay separate for efficiency -- operational events append
+ * to the locked global log (low frequency), agent events append to lock-free
+ * per-session shards (high frequency, one writer each). This module is the
+ * single READ surface that merges them; nothing here writes.
+ */
+import { query, levelFor } from './events.js';
+import { readActivityAsEventRecords } from './activity.js';
+/** Apply the same filters query() applies, to an activity-derived record. */
+function matches(r, q) {
+    const ms = Date.parse(r.ts);
+    // Mirror query()'s default upper bound (endDate = now) so both sources drop
+    // future-dated records identically -- keeps the two in exact filter parity.
+    const endMs = (q.endDate ?? new Date()).getTime();
+    if (q.startDate && !Number.isNaN(ms) && ms < q.startDate.getTime())
+        return false;
+    if (!Number.isNaN(ms) && ms > endMs)
+        return false;
+    if (q.eventTypes && !q.eventTypes.includes(r.event))
+        return false;
+    if (q.level && (r.level ?? levelFor(r.event)) !== q.level)
+        return false;
+    if (q.agent && r.agent !== q.agent)
+        return false;
+    if (q.caller && r.caller !== q.caller)
+        return false;
+    if (q.command && r.command !== q.command &&
+        !(typeof r.command === 'string' && r.command.startsWith(q.command + ' ')))
+        return false;
+    if (q.module && r.module !== q.module)
+        return false;
+    return true;
+}
+/**
+ * Read a unified, newest-first event stream. Operational events come from
+ * events.ts `query()`; agent-semantic events from the activity logs, normalized
+ * to the same record shape and filtered identically. `limit` caps the merged
+ * result (each source is fetched up to `limit`, so the top-N is exact).
+ */
+export function readUnifiedEvents(q = {}) {
+    const ops = query({
+        startDate: q.startDate,
+        endDate: q.endDate,
+        eventTypes: q.eventTypes,
+        level: q.level,
+        agent: q.agent,
+        caller: q.caller,
+        command: q.command,
+        module: q.module,
+        limit: q.limit,
+    });
+    if (q.includeActivity === false)
+        return ops;
+    const acts = readActivityAsEventRecords({
+        sinceMs: q.startDate?.getTime(),
+        limit: q.limit,
+        root: q.activityRoot,
+    }).filter((r) => matches(r, q));
+    const merged = [...ops, ...acts].sort((a, b) => Date.parse(b.ts) - Date.parse(a.ts));
+    return typeof q.limit === 'number' ? merged.slice(0, q.limit) : merged;
+}

package/dist/lib/events.d.ts

@@ -12,7 +12,7 @@
  * - Performance tracking: withTiming() wrapper for any async function
  */
 export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'error' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'file.edited' | 'error' | 'warn' | 'info' | 'debug';
 export declare function levelFor(event: EventType): EventLevel;
 export interface EventMeta {
     ts: string;

package/dist/lib/exec.d.ts

@@ -158,6 +158,17 @@ export interface ExecOptions {
  * `--interactive` takes precedence over `--headless`; the CLI layer rejects passing both.
  */
 export declare function resolveInteractive(options: Pick<ExecOptions, 'interactive' | 'headless' | 'prompt'>): boolean;
+/**
+ * True when a run resolved to *inferred* interactive intent — no prompt and no
+ * explicit `--interactive` — but there is no terminal to host the REPL. Launching
+ * would attach a TUI to a dead stdin and hang forever, so the caller should fail
+ * fast with the headless alternatives instead (RUSH-1829).
+ *
+ * An explicit `--interactive` is the caller's deliberate choice and is never
+ * blocked (they may be driving a PTY we can't detect). Pure — the TTY state is a
+ * parameter so this is unit-testable without touching `process.std*`.
+ */
+export declare function inferredInteractiveWithoutTty(options: Pick<ExecOptions, 'interactive' | 'headless' | 'prompt'>, isTty: boolean): boolean;
 /**
  * Decide whether spawnAgent must capture (PIPE + tee) the child's stdout so the
  * live budget watcher can parse it (issue #346, FIX 3).