@phnx-labs/agents-cli 1.20.72 → 1.20.74

package/dist/commands/export.js

@@ -0,0 +1,215 @@
+import chalk from 'chalk';
+import { execFileSync } from 'child_process';
+import { confirm, select } from '@inquirer/prompts';
+import { AGENTS, agentLabel, formatAgentError, resolveAgentName } from '../lib/agents.js';
+import { listInstalledVersions, isVersionIsolated } from '../lib/versions.js';
+import { planExport, executeExport, CONFLICT_SUFFIX } from '../lib/export.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+function isolatedVersions(agent) {
+    return listInstalledVersions(agent).filter((v) => isVersionIsolated(agent, v));
+}
+/** Explain a blocker in terms of what the user should do instead. */
+function reportBlocker(plan) {
+    const label = agentLabel(plan.agent);
+    const b = plan.blocker;
+    switch (b.kind) {
+        case 'not-installed':
+            console.log(chalk.red(`${label}@${plan.version} is not installed.`));
+            console.log(chalk.gray(`  Installed: ${listInstalledVersions(plan.agent).join(', ') || 'none'}`));
+            break;
+        case 'not-isolated':
+            console.log(chalk.yellow(`${label}@${plan.version} is not an isolated install.`));
+            console.log(chalk.gray(`  A normal install's config already IS ${plan.dest} (adoption symlinks it),`));
+            console.log(chalk.gray('  so there is nothing to export. To un-adopt it, use: agents uninstall'));
+            break;
+        case 'no-config':
+            console.log(chalk.yellow(`${label}@${plan.version} has no config to export yet (${b.source} is empty).`));
+            console.log(chalk.gray(`  Run it once first: agents run ${plan.agent}@${plan.version}`));
+            break;
+        case 'dest-adopted':
+            console.log(chalk.red(`${b.realPath} is managed by agents-cli (adopted by ${label}@${b.adoptedVersion}).`));
+            console.log(chalk.gray('  Exporting would write into that version\'s home, not your real config.'));
+            console.log(chalk.gray(`  Release it first: agents uninstall  (or agents remove ${plan.agent}@${b.adoptedVersion})`));
+            break;
+    }
+}
+/** Unified diff between the user's file and the incoming one, via git. */
+function printDiff(existing, incoming) {
+    try {
+        execFileSync('git', ['diff', '--no-index', '--color', '--', existing, incoming], {
+            stdio: ['ignore', 'inherit', 'ignore'],
+        });
+    }
+    catch {
+        // git diff --no-index exits 1 when files differ; output already streamed.
+    }
+}
+function printPlan(plan, opts) {
+    const label = agentLabel(plan.agent);
+    console.log(chalk.bold(`Export ${label}@${plan.version} -> ${plan.dest}  ${chalk.gray(`[${plan.mode}]`)}\n`));
+    console.log(`  ${chalk.gray('from')}  ${plan.source}`);
+    console.log(`  ${chalk.gray('to')}    ${plan.stagedPath ?? plan.dest}`);
+    console.log();
+    if (plan.mode === 'replace') {
+        console.log(chalk.yellow(`  Replacing ${plan.dest} wholesale — ${plan.writes.length} file(s).`));
+        if (plan.backupPath)
+            console.log(chalk.gray(`  Your current config moves to: ${plan.backupPath}`));
+        else if (plan.destKind === 'foreign-symlink') {
+            console.log(chalk.yellow(`  ${plan.dest} is a symlink agents-cli does not own; it will be removed.`));
+            console.log(chalk.gray('  Its target is left untouched.'));
+        }
+    }
+    else if (plan.mode === 'staged') {
+        console.log(chalk.gray(`  Writing ${plan.writes.length} file(s) into ${plan.stagedPath}.`));
+        console.log(chalk.gray('  Nothing is activated — your config is untouched.'));
+    }
+    else {
+        if (plan.writes.length > 0) {
+            console.log(chalk.green(`  ${plan.writes.length} new file(s) will be added:`));
+            for (const w of plan.writes.slice(0, 15))
+                console.log(chalk.gray(`      + ${w.rel}`));
+            if (plan.writes.length > 15)
+                console.log(chalk.gray(`      + ${plan.writes.length - 15} more`));
+        }
+        else {
+            console.log(chalk.gray('  No new files to add.'));
+        }
+        if (plan.conflicts.length > 0) {
+            console.log();
+            console.log(chalk.yellow(`  ${plan.conflicts.length} file(s) you already have — YOURS ARE NOT MODIFIED.`));
+            console.log(chalk.gray(`  The incoming version is written beside each as *${CONFLICT_SUFFIX}:`));
+            for (const c of plan.conflicts.slice(0, 15))
+                console.log(chalk.gray(`      ~ ${c.rel}`));
+            if (plan.conflicts.length > 15)
+                console.log(chalk.gray(`      ~ ${plan.conflicts.length - 15} more`));
+        }
+    }
+    if (opts.diff && plan.conflicts.length > 0) {
+        for (const c of plan.conflicts) {
+            console.log(chalk.bold(`\n─── ${c.rel} ───`));
+            printDiff(c.existing, c.source);
+        }
+    }
+    console.log(chalk.gray(`\n  Receipt: ${plan.receiptPath}`));
+}
+export function registerExportCommand(program) {
+    program
+        .command('export <spec>')
+        .description('Copy an isolated install\'s config out to your real ~/.<agent>')
+        .option('--replace', 'Replace your config wholesale (yours is backed up) instead of merging')
+        .option('--staged', 'Write into ~/.<agent>/.agents-export-<ts>/ and activate nothing')
+        .option('--diff', 'Show a unified diff for each file you already have')
+        .option('--dry-run', 'Show what would change without writing anything')
+        .option('-y, --yes', 'Skip the confirmation prompt')
+        .addHelpText('after', `
+Modes:
+  (default)   merge   — additive. Your files are NEVER modified. Anything that
+                        collides is written beside yours as <name>${CONFLICT_SUFFIX}
+                        so you can diff and take the parts you want.
+  --replace           — the isolated config becomes ~/.<agent>; yours is moved to
+                        backups/<agent>/<ts>. For promoting a sandbox wholesale.
+  --staged            — dump the tree into ~/.<agent>/.agents-export-<ts>/ and
+                        activate nothing. For inspecting first.
+
+Every mode writes a receipt to ~/.<agent>/.agents-cli-export.json listing exactly
+what came from the export — so you can tell your settings from the CLI's, and undo it.
+
+Examples:
+  agents export codex --dry-run          # see the plan
+  agents export codex --diff             # ...and the deltas on colliding files
+  agents export codex                    # additive; nothing of yours changes
+  agents export codex@0.144.6 --replace  # promote the sandbox wholesale
+
+Note: file CONTENTS are never auto-merged. The TOML parser here does not preserve
+comments, so merging keys would silently delete them. You get both files and a diff.
+`)
+        .action(async (spec, options) => {
+        if (options.replace && options.staged) {
+            console.error(chalk.red('--replace and --staged are mutually exclusive; pass only one.'));
+            process.exit(1);
+        }
+        const mode = options.replace ? 'replace' : options.staged ? 'staged' : 'merge';
+        const [rawAgent, rawVersion] = spec.split('@');
+        const agent = resolveAgentName(rawAgent);
+        if (!agent) {
+            console.error(chalk.red(formatAgentError(rawAgent)));
+            process.exit(1);
+        }
+        let version = rawVersion;
+        if (!version) {
+            const candidates = isolatedVersions(agent);
+            if (candidates.length === 0) {
+                console.log(chalk.yellow(`No isolated ${agentLabel(agent)} installs to export.`));
+                console.log(chalk.gray(`  Create one with: agents add ${agent}@<version> --isolated`));
+                return;
+            }
+            if (candidates.length === 1) {
+                version = candidates[0];
+            }
+            else if (isInteractiveTerminal()) {
+                version = await select({
+                    message: `Which isolated ${agentLabel(agent)} version?`,
+                    choices: candidates.map((v) => ({ name: v, value: v })),
+                }).catch((err) => {
+                    if (isPromptCancelled(err))
+                        process.exit(130);
+                    throw err;
+                });
+            }
+            else {
+                console.error(chalk.red(`${agentLabel(agent)} has several isolated installs; name one.`));
+                console.error(chalk.gray(`  ${candidates.map((v) => `agents export ${agent}@${v}`).join('\n  ')}`));
+                process.exit(1);
+            }
+        }
+        const timestamp = Date.now();
+        const plan = planExport(agent, version, timestamp, mode);
+        if (plan.blocker) {
+            reportBlocker(plan);
+            process.exit(1);
+        }
+        printPlan(plan, { diff: options.diff });
+        if (options.dryRun) {
+            console.log(chalk.gray('\nDry run — nothing was written.'));
+            return;
+        }
+        // Only `--replace` can destroy anything, so it is the only mode that demands
+        // confirmation. merge and staged are additive by construction.
+        if (mode === 'replace' && !options.yes) {
+            if (!isInteractiveTerminal()) {
+                console.error(chalk.red('\nRefusing to replace your config without confirmation in a non-interactive shell.'));
+                console.error(chalk.gray('  Re-run with --yes once you have checked --dry-run.'));
+                process.exit(1);
+            }
+            const ok = await confirm({ message: `Replace ${plan.dest}?`, default: false }).catch((err) => {
+                if (isPromptCancelled(err))
+                    process.exit(130);
+                throw err;
+            });
+            if (!ok) {
+                console.log(chalk.gray('Aborted.'));
+                return;
+            }
+        }
+        const result = executeExport(plan, timestamp);
+        if (!result.exported) {
+            console.error(chalk.red(`Export failed: ${result.errors.join('; ')}`));
+            process.exit(1);
+        }
+        console.log();
+        if (result.written.length > 0)
+            console.log(chalk.green(`Added ${result.written.length} file(s) to ${result.dest}`));
+        if (result.conflicts.length > 0) {
+            console.log(chalk.yellow(`${result.conflicts.length} of your file(s) were left untouched; incoming copies written as *${CONFLICT_SUFFIX}`));
+            console.log(chalk.gray(`  Compare them with: agents export ${agent}@${version} --diff --dry-run`));
+        }
+        if (result.backupPath)
+            console.log(chalk.gray(`Previous config kept at: ${result.backupPath}`));
+        if (result.stagedPath)
+            console.log(chalk.gray(`Staged (nothing activated): ${result.stagedPath}`));
+        console.log(chalk.gray(`Receipt: ${result.receiptPath}`));
+        if (mode !== 'staged') {
+            console.log(chalk.gray(`  ${AGENTS[plan.agent].cliCommand} reads this config directly.`));
+        }
+    });
+}

package/dist/commands/feed.d.ts

@@ -12,6 +12,8 @@
 import type { Command } from 'commander';
 import { type OpenBlock } from '../lib/feed.js';
 import { type OutcomeGroup, type SessionOutcomeHint } from '../lib/feed-outcome.js';
+import { filterBlocksForFeed } from '../lib/ask-classifier.js';
+import { type FeedSessionSignal } from '../lib/feed-ranking.js';
 export declare const FEED_NO_FANOUT_ENV = "AGENTS_FEED_LOCAL";
 /** Right-hand masthead summary: `N blocks · M agents`. */
 export declare function formatFeedMastheadRight(blocks: OpenBlock[]): string;
@@ -20,8 +22,19 @@ export declare function formatFeedReplyHint(mailboxId: string): string;
 export declare function parseRemoteFeed(stdout: string, machine: string): OpenBlock[];
 /** Merge local and remote rows, keeping the first copy of a host/session block. */
 export declare function mergeFeedBlocks(...groups: OpenBlock[][]): OpenBlock[];
+export type FeedControlAction = 'pause' | 'kill';
+export declare function controlFeedSession(action: FeedControlAction, target: string, signals: FeedSessionSignal[]): Promise<string>;
 export declare function shouldIncludeLocalFeed(hosts: string[] | undefined, self: string): boolean;
 export declare function remoteFeedHostsToDial(hosts: string[] | undefined, self: string): string[] | undefined;
+export declare function prepareLocalFeedBlocks(localBlocks: OpenBlock[], opts: {
+    includeLocal: boolean;
+    all?: boolean;
+    dispatch?: boolean;
+}): {
+    visible: OpenBlock[];
+    dispatch: OpenBlock[];
+    filter: ReturnType<typeof filterBlocksForFeed>;
+};
 /** Human summary line for one outcome rollup. */
 export declare function formatOutcomeHeader(group: OutcomeGroup): string;
 /** Map active sessions into the lightweight hints outcome enrichment needs. */

package/dist/commands/feed.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
-import { ensureFeedPublishHook, listBlocks, recordNotified } from '../lib/feed.js';
+import { ensureFeedPublishHook, listAskStats, listBlocks, recordNotified } from '../lib/feed.js';
+import { ensureActivityLogHook, readRecentActivity, formatActivityLine } from '../lib/activity.js';
 import { enrichBlocksFromSessions, groupBlocksByOutcome, isUnambiguousOutcomeAnswer, openBlocksForOutcome, stampBlockOutcomes, } from '../lib/feed-outcome.js';
 import { classifyBlock, filterBlocksForFeed, suppressionDigest, } from '../lib/ask-classifier.js';
 import { machineId, normalizeHost } from '../lib/machine-id.js';
@@ -12,6 +13,9 @@ import { isValidMailboxId } from '../lib/mailbox.js';
 import { getActiveSessions } from '../lib/session/active.js';
 import { mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { GLYPH, masthead } from '../lib/comms-render.js';
+import { discoverSessions } from '../lib/session/discover.js';
+import { resolveProvider } from '../lib/cloud/registry.js';
+import { buildSessionSignals, rankFeedBlocks, synthesizeControlCards, } from '../lib/feed-ranking.js';
 export const FEED_NO_FANOUT_ENV = 'AGENTS_FEED_LOCAL';
 /** Right-hand masthead summary: `N blocks · M agents`. */
 export function formatFeedMastheadRight(blocks) {
@@ -58,6 +62,36 @@ export function mergeFeedBlocks(...groups) {
     }
     return [...byIdentity.values()].sort((a, b) => Date.parse(b.ts) - Date.parse(a.ts));
 }
+function matchesControlTarget(signal, target) {
+    return [
+        signal.mailboxId,
+        signal.sessionId,
+        signal.cloudTaskId,
+        signal.pid !== undefined ? String(signal.pid) : undefined,
+    ].some((value) => value === target);
+}
+export async function controlFeedSession(action, target, signals) {
+    const signal = signals.find((s) => matchesControlTarget(s, target));
+    if (!signal)
+        throw new Error(`No live feed session matches '${target}'.`);
+    if (signal.cloudProvider && signal.cloudTaskId) {
+        const provider = resolveProvider(signal.cloudProvider);
+        await provider.cancel(signal.cloudTaskId);
+        return `${action === 'pause' ? 'paused' : 'killed'} cloud task ${signal.cloudTaskId}`;
+    }
+    if (!signal.pid) {
+        throw new Error(`Session '${target}' has no local pid or cancellable cloud task.`);
+    }
+    if (action === 'pause') {
+        if (process.platform === 'win32') {
+            throw new Error('Pause is not supported for local Windows processes; use --kill.');
+        }
+        process.kill(signal.pid, 'SIGSTOP');
+        return `paused pid ${signal.pid}`;
+    }
+    process.kill(signal.pid, 'SIGTERM');
+    return `killed pid ${signal.pid}`;
+}
 function hostToken(host) {
     return normalizeHost(host.split('@').pop() || host);
 }
@@ -69,6 +103,16 @@ export function remoteFeedHostsToDial(hosts, self) {
         return undefined;
     return hosts.filter((host) => hostToken(host) !== self);
 }
+export function prepareLocalFeedBlocks(localBlocks, opts) {
+    const filter = filterBlocksForFeed(localBlocks, {
+        apply: opts.includeLocal && (!opts.all || opts.dispatch === true),
+    });
+    return {
+        visible: opts.all ? localBlocks : filter.surfaced,
+        dispatch: filter.surfaced,
+        filter,
+    };
+}
 function renderBlock(b, localHost, indent = '') {
     const host = b.host !== localHost ? chalk.yellow(` [${b.host}]`) : '';
     const runtime = chalk.gray(b.runtime);
@@ -76,13 +120,16 @@ function renderBlock(b, localHost, indent = '') {
     const cls = b.blockClass ? chalk.gray(`(${b.blockClass})`) : '';
     const consequence = b.consequence && b.consequence !== 'normal' ? chalk.red(`[${b.consequence}]`) : '';
     const cost = b.costOfDelay ? chalk.gray(`cost:${b.costOfDelay}`) : '';
+    const rank = b.delayRank ? chalk.gray(`rank:${Math.round(b.delayRank.score)}`) : '';
     // Shared fleet-comms glyphs: ▲ open ask, ✓ answered (see comms-render GLYPH).
     const marker = b.answer
         ? chalk.green(GLYPH.delivered)
-        : !b.parkedAt
-            ? chalk.yellow(GLYPH.ask)
-            : ' ';
-    console.log(`${indent}${marker} ${chalk.cyan(b.mailboxId)}${host}  ${runtime}  ${age}  ${cls} ${consequence} ${cost}`.trimEnd());
+        : b.kind === 'control'
+            ? chalk.red('!')
+            : !b.parkedAt
+                ? chalk.yellow(GLYPH.ask)
+                : ' ';
+    console.log(`${indent}${marker} ${chalk.cyan(b.mailboxId)}${host}  ${runtime}  ${age}  ${cls} ${consequence} ${cost} ${rank}`.trimEnd());
     for (const question of b.questions) {
         const header = question.header ? chalk.gray(`[${question.header}] `) : '';
         console.log(`${indent}  ${header}${question.text}`);
@@ -119,7 +166,15 @@ function renderBlock(b, localHost, indent = '') {
     if (b.notifiedAt) {
         console.log(`${indent}  ${chalk.dim('notified')} ${relTime(b.notifiedAt)}`);
     }
-    if (!b.answer && !b.parkedAt) {
+    if (b.runaway) {
+        console.log(`${indent}  ${chalk.red('runaway:')} ${b.runaway.reason}`);
+        console.log(`${indent}  ${chalk.dim(`control: ag feed --pause ${b.mailboxId}  ·  ag feed --kill ${b.mailboxId}`)}`);
+    }
+    if (b.needy) {
+        console.log(`${indent}  ${chalk.yellow('needy:')} ${b.needy.askCountLastHour}/${b.needy.threshold} asks in the last hour`);
+        console.log(`${indent}  ${chalk.dim(`inspect: ag sessions ${b.sessionId}`)}`);
+    }
+    if (!b.answer && !b.parkedAt && b.kind !== 'control') {
         console.log(`${indent}  ${chalk.dim(formatFeedReplyHint(b.mailboxId))}`);
     }
     console.log();
@@ -169,6 +224,8 @@ export function registerFeedCommand(program) {
         .option('-H, --host <target...>', 'Scope to remote machine(s) over SSH; repeatable')
         .option('--device <target...>', 'Alias for --host; repeatable')
         .option('--dispatch', 'Run stall suppression + default-on-no-answer policy and urgent notifications')
+        .option('--pause <id>', 'Pause a runaway/needy local process (SIGSTOP) or cancel a cloud task')
+        .option('--kill <id>', 'Kill a runaway/needy local process (SIGTERM) or cancel a cloud task')
         .action(async (opts) => {
         if (opts.device?.length)
             opts.host = [...(opts.host ?? []), ...opts.device];
@@ -176,11 +233,16 @@ export function registerFeedCommand(program) {
         const includeLocal = shouldIncludeLocalFeed(opts.host, self);
         const setupWarnings = [];
         if (includeLocal) {
+            // Feed and activity hooks are independent -- install both, and register
+            // the manifest as long as at least one wrote its entries (don't couple
+            // activity registration to the feed hook succeeding).
             const hookInstall = ensureFeedPublishHook();
-            if (hookInstall.error) {
+            const activityInstall = ensureActivityLogHook();
+            if (hookInstall.error)
                 setupWarnings.push(hookInstall.error);
-            }
-            else {
+            if (activityInstall.error)
+                setupWarnings.push(activityInstall.error);
+            if (!hookInstall.error || !activityInstall.error) {
                 const [{ iterHooksCapableVersions, parseHookManifest, registerHooksToSettings }, { getVersionHomePath }] = await Promise.all([
                     import('../lib/hooks.js'),
                     import('../lib/versions.js'),
@@ -199,6 +261,17 @@ export function registerFeedCommand(program) {
         if (includeLocal) {
             sessions = await getActiveSessions();
         }
+        const sessionMetas = includeLocal && sessions.length > 0 ? await discoverSessions({ all: true, limit: 5000 }) : [];
+        const localSignals = buildSessionSignals(sessions, sessionMetas);
+        if (opts.pause || opts.kill) {
+            if (!includeLocal) {
+                throw new Error('Feed controls run on the local machine. Re-run against the target host with --local.');
+            }
+            const action = opts.pause ? 'pause' : 'kill';
+            const target = opts.pause ?? opts.kill ?? '';
+            console.log(await controlFeedSession(action, target, localSignals));
+            return;
+        }
         if (opts.dispatch && includeLocal) {
             // Liveness sweep: drop messages to dead agents and retire stale blocks
             // before we render the feed.
@@ -208,8 +281,26 @@ export function registerFeedCommand(program) {
                 console.log(chalk.yellow(`gc: ${gcResult.messagesDroppedDead} dead messages, ${gcResult.blocksRemoved} stale blocks removed`));
             }
         }
-        const localBlocks = includeLocal ? listBlocks() : [];
-        let blocks = localBlocks;
+        let localBlocks = includeLocal
+            ? [...listBlocks(), ...synthesizeControlCards(localSignals, listAskStats())]
+            : [];
+        // Fill missing ticket/PR/worktree from live session meta before local
+        // policy mutates the store, so outcome keys land even when the publish
+        // hook had no deliverable stamp.
+        if (sessions.length > 0) {
+            localBlocks = enrichBlocksFromSessions(localBlocks, sessionHintsFromActive(sessions));
+        }
+        // Stall suppression (RUSH-1477) must only mutate blocks owned by this
+        // machine. Remote peers run their own `feed --json`; never enqueue a
+        // policy answer into a local mailbox for a remote agent.
+        const preparedLocal = prepareLocalFeedBlocks(localBlocks, {
+            includeLocal,
+            all: opts.all,
+            dispatch: opts.dispatch,
+        });
+        const visibleLocalBlocks = preparedLocal.visible;
+        const dispatchBlocks = preparedLocal.dispatch;
+        let blocks = visibleLocalBlocks;
         const forceLocal = opts.local === true || process.env[FEED_NO_FANOUT_ENV] === '1';
         if (!forceLocal) {
             const remoteHosts = remoteFeedHostsToDial(opts.host, self);
@@ -221,31 +312,18 @@ export function registerFeedCommand(program) {
                     hosts: remoteHosts,
                     parse: parseRemoteFeed,
                 });
-                blocks = mergeFeedBlocks(localBlocks, remote.items);
+                blocks = mergeFeedBlocks(visibleLocalBlocks, remote.items);
             }
         }
-        // Fill missing ticket/PR/worktree from live session meta so outcome keys
-        // land even when the publish hook had no deliverable stamp.
-        if (sessions.length > 0) {
-            blocks = enrichBlocksFromSessions(blocks, sessionHintsFromActive(sessions));
-        }
-        // Stall suppression (RUSH-1477): auto-answer "should I…?" / "what's next?"
-        // so they never render. Applied on every feed read unless --all; --dispatch
-        // also applies so unattended ticks drain the stall backlog.
-        const filter = filterBlocksForFeed(blocks, {
-            apply: !opts.all || opts.dispatch === true,
-        });
-        if (!opts.all) {
-            blocks = filter.surfaced;
-        }
-        const digest = suppressionDigest(filter);
+        blocks = rankFeedBlocks(blocks, localSignals);
+        const digest = suppressionDigest(preparedLocal.filter);
         if (digest && !opts.json) {
             console.log(chalk.dim(digest));
         }
         if (opts.dispatch) {
             const policy = loadPolicy();
             const now = new Date();
-            for (const b of blocks) {
+            for (const b of dispatchBlocks) {
                 // Wrap per-block policy so one malformed block (e.g. a crafted
                 // mailboxId that throws in mailboxDir) can't abort the whole loop and
                 // strand every remaining block's dispatch.
@@ -285,6 +363,8 @@ export function registerFeedCommand(program) {
         }
         if (blocks.length === 0) {
             console.log(chalk.gray(digest ? 'No open blocks after stall suppression.' : 'No open blocks.'));
+            if (includeLocal)
+                renderActivityLane();
             return;
         }
         // Shared fleet-comms masthead (same family as `agents mailboxes`).
@@ -300,8 +380,29 @@ export function registerFeedCommand(program) {
                 renderBlock(b, self);
             return;
         }
-        const groups = groupBlocksByOutcome(blocks);
+        const groups = groupBlocksByOutcome(blocks).sort((a, b) => {
+            const ar = Math.max(...a.blocks.map((block) => block.delayRank?.score ?? 0));
+            const br = Math.max(...b.blocks.map((block) => block.delayRank?.score ?? 0));
+            return br - ar;
+        });
         for (const g of groups)
             renderOutcomeGroup(g, self);
+        if (includeLocal)
+            renderActivityLane();
     });
 }
+/**
+ * Print a compact "recent activity" lane under the feed: the last few milestone
+ * events (plans, PRs, worktrees, sub-agents) from the append-only activity logs.
+ * Read-only tail of the logs -- no transcript re-parsing. Silent when empty.
+ */
+function renderActivityLane() {
+    const events = readRecentActivity({ sinceMs: Date.now() - 24 * 60 * 60 * 1000, limit: 6 })
+        .filter((e) => e.tier === 'milestone');
+    if (events.length === 0)
+        return;
+    console.log(chalk.bold('\n  recent activity'));
+    for (const ev of events)
+        console.log(formatActivityLine(ev, { showHost: true }));
+    console.log(chalk.gray('  → agents activity  for the full stream'));
+}

package/dist/commands/hq.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerHqCommand(program: Command): void;

package/dist/commands/hq.js

@@ -0,0 +1,58 @@
+import chalk from 'chalk';
+import { getActiveSessions } from '../lib/session/active.js';
+import { AgentManager } from '../lib/teams/agents.js';
+import { handleStatus, handleTasks } from '../lib/teams/api.js';
+import { listAskStats, listBlocks } from '../lib/feed.js';
+import { buildSessionSignals, synthesizeControlCards } from '../lib/feed-ranking.js';
+import { discoverSessions } from '../lib/session/discover.js';
+import { buildHqFloor } from '../lib/hq/floor.js';
+import { die } from '../lib/format.js';
+async function collectFloorSnapshot() {
+    const manager = new AgentManager();
+    const [sessions, tasksResult] = await Promise.all([
+        getActiveSessions(),
+        handleTasks(manager, 1000),
+    ]);
+    const teammatesByTeam = new Map();
+    await Promise.all(tasksResult.tasks.map(async (team) => {
+        const status = await handleStatus(manager, team.task_name, 'all');
+        teammatesByTeam.set(team.task_name, status.agents);
+    }));
+    const sessionMetas = sessions.length > 0 ? await discoverSessions({ all: true, limit: 5000 }) : [];
+    const blocks = [
+        ...listBlocks(),
+        ...synthesizeControlCards(buildSessionSignals(sessions, sessionMetas), listAskStats()),
+    ];
+    return buildHqFloor({
+        sessions,
+        teams: tasksResult.tasks,
+        teammatesByTeam,
+        blocks,
+    });
+}
+export function registerHqCommand(program) {
+    const hq = program
+        .command('hq')
+        .description('Machine-readable bridge for Agents HQ floor management.');
+    hq
+        .command('floor')
+        .description('Emit the live floor snapshot: rooms, agents, ambient events, and runnable actions.')
+        .option('--json', 'Output machine-readable JSON')
+        .action(async (opts) => {
+        try {
+            const snapshot = await collectFloorSnapshot();
+            if (opts.json || !process.stdout.isTTY) {
+                console.log(JSON.stringify(snapshot, null, 2));
+                return;
+            }
+            console.log(chalk.bold('Agents HQ floor'));
+            console.log(chalk.gray(`${snapshot.counters.agents} agents, ${snapshot.counters.rooms} rooms, ${snapshot.counters.needsInput} need input`));
+            for (const room of snapshot.rooms) {
+                console.log(`${chalk.cyan(room.name)}  ${chalk.gray(`${room.counts.agents} agents, ${room.counts.running} running, ${room.counts.needsInput} need input`)}`);
+            }
+        }
+        catch (err) {
+            die(err.message);
+        }
+    });
+}

package/dist/commands/import.js

@@ -20,6 +20,9 @@
  * In all forms, the agent's config dir (e.g. ~/.openclaw) is also moved under
  * management — same behavior as the first-run `agents setup` import flow.
  */
+import { withIsolationBoundary } from '../lib/isolation-boundary-report.js';
+import { assertIsolationBoundary, createVersionedAlias } from '../lib/shims.js';
+import { markVersionIsolated } from '../lib/versions.js';
 import chalk from 'chalk';
 import ora from 'ora';
 import * as fs from 'fs';
@@ -29,7 +32,7 @@ import { confirm } from '@inquirer/prompts';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
 import { AGENTS, getCliPath, getCliVersion, agentLabel, resolveAgentName } from '../lib/agents.js';
 import { getVersionDir } from '../lib/versions.js';
-import { finalizeImport, importAgentBinary, importAgentConfig, importInstallScriptBinary, isValidImportVersion, resolvePackageDirFromBinary, } from '../lib/import.js';
+import { finalizeImport, importAgentBinary, importAgentConfig, importInstallScriptBinary, seedIsolatedConfigFromLocal, isValidImportVersion, resolvePackageDirFromBinary, } from '../lib/import.js';
 import { isPromptCancelled, isInteractiveTerminal } from './utils.js';
 async function runImport(agentArg, opts) {
     const agentId = resolveAgentName(agentArg);
@@ -39,6 +42,16 @@ async function runImport(agentArg, opts) {
         process.exit(1);
     }
     const agent = AGENTS[agentId];
+    // Import registers the adopted install as a NORMAL version and only then sets the
+    // default / creates the shim / repoints the config. By that point the agent has a
+    // non-isolated version, so it is no longer protected and the primitive gates —
+    // which read the state as it is at call time — would let the adoption through.
+    // The boundary has to be checked against the state BEFORE the import mutates it.
+    // --isolated adopts nothing, so the boundary does not apply to it — it is in fact
+    // the supported way to bring a local install in while protection is on.
+    if (!opts.isolated) {
+        assertIsolationBoundary(agentId, 'adopt your existing install');
+    }
     // installScript-based agents (Grok, Antigravity, Cursor, Kiro, Goose, Roo)
     // don't have an npm package; their binary lives wherever the curl/brew
     // installer dropped it. We adopt by symlinking that PATH binary directly
@@ -191,7 +204,27 @@ async function runImport(agentArg, opts) {
     // user-visible side effect (renaming ~/.<agent>/), so if it fails we don't
     // want a stranded symlink farm. Binary registration is cheap and reversible
     // — if it fails after config, the next `agents import` call retries cleanly.
-    const willImportConfig = configDirExists && !configAlreadyManaged;
+    const willImportConfig = configDirExists && !configAlreadyManaged && !opts.isolated;
+    if (opts.isolated && configDirExists) {
+        // COPY the user's settings in; never move, never symlink. The original stays
+        // exactly where it is — that is what separates this from adoption.
+        const seedSpinner = ora(`Copying ${agent.configDir} into the isolated copy...`).start();
+        const seed = seedIsolatedConfigFromLocal(agentId, version, { withAuth: opts.withAuth });
+        if (seed.error) {
+            seedSpinner.fail(`Config: ${seed.error}`);
+            process.exit(1);
+        }
+        else if (seed.seeded) {
+            seedSpinner.succeed(`Settings copied (${seed.from} -> ${seed.to}); your original is untouched`);
+            if (seed.skippedAuth.length > 0) {
+                console.log(chalk.gray(`  Credentials NOT copied: ${seed.skippedAuth.join(', ')}`));
+                console.log(chalk.gray('  The copy signs in separately. Use --with-auth to copy them too.'));
+            }
+        }
+        else {
+            seedSpinner.info('No existing config to copy.');
+        }
+    }
     if (willImportConfig) {
         const cfgSpinner = ora(`Importing config dir for ${agentLabel(agentId)} v${version}...`).start();
         const cfgResult = await importAgentConfig(agentId, version);
@@ -224,6 +257,19 @@ async function runImport(agentArg, opts) {
     // Wire the imported version into the resolver: global default, main shim,
     // versioned alias, home-file symlinks. Idempotent — safe to call even if
     // importAgentConfig already set the global default.
+    if (opts.isolated) {
+        // The isolated finalizer: launchable alias + marker, and nothing else. No global
+        // default, no bare shim, no config symlink — the same shape as
+        // `agents add --isolated`.
+        createVersionedAlias(agentId, version);
+        markVersionIsolated(agentId, version);
+        console.log();
+        console.log(chalk.green(`${agentLabel(agentId)} v${version} imported as an isolated copy.`));
+        console.log(chalk.gray(`  Your ${agent.configDir} and ${agent.cliCommand} launcher are untouched.`));
+        console.log(chalk.gray(`  Run it:  agents run ${agentId}@${version}`));
+        console.log(chalk.gray(`  Or make it the default isolated copy:  agents use ${agentId}@${version}`));
+        return;
+    }
     const finalizeSpinner = ora(`Wiring ${agentLabel(agentId)} v${version} as the active version...`).start();
     try {
         finalizeImport(agentId, version);
@@ -244,6 +290,8 @@ export function registerImportCommand(program) {
         .description('Import an existing unmanaged agent install into agents-cli')
         .option('--version <version>', 'Pin a version label (otherwise read from package.json)')
         .option('--from-path <path>', 'Path to the npm package dir (otherwise auto-detected from PATH)')
+        .option('--isolated', 'Copy the install into a self-contained isolated version instead of adopting it')
+        .option('--with-auth', 'With --isolated, also copy credentials into the sandbox (skipped by default)')
         .option('-y, --yes', 'Skip the confirmation prompt')
         .addHelpText('after', `
 Examples:
@@ -265,5 +313,5 @@ When to use:
   npm-style packages (claude, codex, gemini, opencode, openclaw) and
   installScript-based agents (grok, antigravity, cursor, kiro, goose).
 `)
-        .action(runImport);
+        .action((...args) => withIsolationBoundary(() => runImport(...args)));
 }