@phnx-labs/agents-cli 1.20.73 → 1.20.76

package/dist/lib/agents.js

@@ -320,8 +320,8 @@ export const AGENTS = {
         instructionsFile: 'AGENTS.md',
         format: 'markdown',
         variableSyntax: '$ARGUMENTS',
-        supportsHooks: false,
-        capabilities: { hooks: false, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: { since: '1.1.1' }, skills: true, commands: true, plugins: true, subagents: true, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit'] },
+        supportsHooks: true,
+        capabilities: { hooks: { since: '0.3.130' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: { since: '1.1.1' }, skills: true, commands: true, plugins: true, subagents: true, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit'] },
     },
     openclaw: {
         id: 'openclaw',
@@ -479,6 +479,8 @@ export const AGENTS = {
     // ~/.grok/hooks/ (+ project .grok/hooks/) — events PreToolUse, PostToolUse, etc.
     // Plugins live in ~/.grok/plugins/ with marketplaces. Permissions: --allow/--deny
     // CLI flags or [permission] TOML block in ~/.grok/config.toml.
+    // Workflows (native Rhai orchestration) enabled by default as of v0.2.111 —
+    // projected into ~/.grok/workflows/<name>.rhai (under GROK_HOME isolation).
     grok: {
         id: 'grok',
         name: 'Grok',
@@ -487,8 +489,12 @@ export const AGENTS = {
         npmPackage: '',
         installScript: 'curl -fsSL https://x.ai/cli/install.sh | bash',
         configDir: path.join(HOME, '.grok'),
-        commandsDir: '', // Grok primarily uses skills + slash commands from skills
-        commandsSubdir: '',
+        // Grok discovers file-based slash commands from ~/.agents/commands/ (the
+        // cross-agent compat dir it mirrors from Claude Code) as well as the legacy
+        // ~/.claude/commands/ symlink. We write there directly so the per-agent
+        // install path and the central user repo stay in sync.
+        commandsDir: path.join(HOME, '.agents', 'commands'),
+        commandsSubdir: path.join('..', '.agents', 'commands'),
         skillsDir: path.join(HOME, '.grok', 'skills'),
         hooksDir: path.join(HOME, '.grok', 'hooks'),
         instructionsFile: 'AGENTS.md',
@@ -502,11 +508,13 @@ export const AGENTS = {
             mcpHeaders: false,
             allowlist: true, // maps to Grok's granular Bash/Edit/Write/Read/Grep/WebFetch/MCPTool rules
             skills: true,
-            commands: false, // covered by skills
+            commands: true, // Grok >= 0.2.111: file-based slash commands from ~/.agents/commands/ (docs) + ~/.claude/commands/ (Claude Code compat)
             plugins: true,
             subagents: true, // ~/.grok/agents/*.md (Claude-compatible agent defs)
             rules: { file: 'AGENTS.md' },
-            workflows: false,
+            // Native workflows (`.rhai` under ~/.grok/workflows/) shipped on-by-default
+            // in v0.2.111 (2026-07-22). See transformWorkflowForGrok in workflows.ts.
+            workflows: { since: '0.2.111' },
             memory: true,
             modes: ['plan', 'edit', 'skip'],
             // grok's `--permission-mode plan` silently stalls a headless `-p` run at
@@ -583,6 +591,24 @@ export const AGENTS = {
     // `.factory-plugin/` (it also reads `.claude-plugin/` for compatibility) — set
     // pluginManifestDir so syncPluginToVersion mirrors the manifest into it, the
     // same pattern codex uses with `.codex-plugin`.
+    //
+    // Workflows / Factory Missions (RUSH-1864, probed droid v0.177.0; ticket cited
+    // v0.161.0 — self-updating, no pinnable semver): Factory ships genuine multi-
+    // step orchestration ("Missions") via `/missions` (interactive) and
+    // `droid exec --mission` (headless; optional `-f <prompt.md>` is a *prompt*
+    // file, not a named mission template). Docs:
+    // https://docs.factory.ai/cli/features/missions and
+    // https://docs.factory.ai/docs/droid-exec/overview (Mission Mode).
+    //
+    // Mission state may land under `~/.factory/missions/<sessionId>/` at runtime
+    // (`getMissionsDir` = join(home, ".factory", "missions") + per-session
+    // mission.md / features.json / progress_log.jsonl) — that is **session
+    // runtime state**, not a discovery directory of installable named workflows.
+    // There is no discoverMission / template registry, and a cold install has no
+    // `~/.factory/missions/` until a mission is run. agents-cli's workflows
+    // capability means "sync WORKFLOW.md into an auto-discovered dir" — Droid
+    // has no such dir, so workflows stays false (invoke-only; do not fabricate a
+    // writer target).
     droid: {
         id: 'droid',
         name: 'Droid',
@@ -615,6 +641,7 @@ export const AGENTS = {
             plugins: true,
             subagents: true,
             rules: { file: 'AGENTS.md' },
+            // Factory Missions are invoke-only — no installable discovery dir (RUSH-1864).
             workflows: false,
             memory: false,
             modes: ['plan', 'edit', 'auto', 'skip'],
@@ -860,7 +887,20 @@ export async function getCliState(agentId) {
             }
         }
     }
-    // Non-version-managed: single PATH lookup + cached version read
+    return getUnmanagedCliState(agentId);
+}
+/**
+ * Resolve the agent's OWN install — the one agents-cli does not manage — by plain
+ * PATH lookup, ignoring the version dirs entirely.
+ *
+ * Callers that specifically mean "the user's own globally-installed CLI" must use
+ * this rather than `getCliState`, whose managed fast path reports an installed
+ * version (any version dir, in readdir order) and would therefore hand back an
+ * isolated copy — a copy that is deliberately unreachable from PATH — labelled as
+ * the global install.
+ */
+export async function getUnmanagedCliState(agentId) {
+    const agent = AGENTS[agentId];
     // Special case for grok: it manages its own binaries in ~/.grok/downloads/
     if (agentId === 'grok') {
         const grokBin = resolveGrokBinary();
@@ -1322,6 +1362,85 @@ function isValidOpenCodeCredential(value) {
         default: return false;
     }
 }
+/**
+ * Whether a Claude version home's credential file is present but carries no
+ * token — the "must have a real credential" floor (see
+ * `isValidOpenCodeCredential`) applied to claude.
+ *
+ * A FAILED OAuth refresh leaves exactly this state behind: Claude Code rewrites
+ * `.claude/.credentials.json` with `accessToken: ""`, `refreshToken: ""` and
+ * `expiresAt: 0`, keeping only the descriptive fields (`subscriptionType`,
+ * `rateLimitTier`, `refreshTokenExpiresAt`). Everything we derive from
+ * `.claude.json` — email, plan — still looks healthy, so the install reported
+ * `signedIn: true`, `agents view` drew usage bars for it, and balanced rotation
+ * (whose `authValid` is just "email present") kept picking it — every pick dying
+ * at spawn on "OAuth session expired and could not be refreshed".
+ *
+ * Only decidable off macOS: there the login Keychain is the canonical store and
+ * this file is not authoritative, and probing the Keychain would raise an
+ * authorization sheet per installed version on every `agents run` — the reason
+ * rotation stopped calling `isClaudeAuthValid` at all. Off macOS the file IS the
+ * only store, so a token-less file is proof of signed-out. `platform` is a
+ * parameter so both branches are testable on any host.
+ *
+ * Sync, no Keychain, no network — safe on the `agents run` hot path.
+ */
+export function isClaudeCredentialFileBlank(base, platform = process.platform) {
+    if (platform === 'darwin')
+        return false;
+    try {
+        const raw = fs.readFileSync(path.join(base, '.claude', '.credentials.json'), 'utf-8');
+        const oauth = JSON.parse(raw).claudeAiOauth;
+        if (!oauth)
+            return false;
+        const nonEmpty = (v) => typeof v === 'string' && v.trim().length > 0;
+        return !nonEmpty(oauth.accessToken) && !nonEmpty(oauth.refreshToken);
+    }
+    catch {
+        // No file (a Keychain-backed home, or never logged in here) or an
+        // unreadable/corrupt one: not positive evidence of a blank credential, so
+        // leave the existing signal alone rather than declaring a working install
+        // signed out.
+        return false;
+    }
+}
+/**
+ * Whether a Claude version home holds its OWN on-disk credential — a non-blank
+ * `.claude/.credentials.json` (the store Claude Code writes on login off macOS)
+ * or a `.claude/.oauth_token` file (the keychain-less shim fallback, shims.ts).
+ *
+ * RUSH-1979: the routines daemon injects one ambient `CLAUDE_CODE_OAUTH_TOKEN`
+ * (RUSH-1759) so a token-less default account still authenticates. But Claude —
+ * and the Linux shim's own `-z CLAUDE_CODE_OAUTH_TOKEN` guard — both prefer that
+ * env var over a pinned account's config dir, so when balanced rotation pins a
+ * specific account's `CLAUDE_CONFIG_DIR` the ambient token shadows it: the pool
+ * is inert and every fire 401s on the one stale token. A routine spawn drops the
+ * ambient token when the pinned account has its own credential (this returns
+ * true) so the account authenticates itself; when it does not (the RUSH-1759
+ * default), the injected token is kept.
+ *
+ * Off-darwin only, mirroring {@link isClaudeCredentialFileBlank}: on macOS the
+ * login Keychain is the canonical store and probing it raises an auth sheet, and
+ * there the daemon injects no token to shadow (broker-only, usually absent), so
+ * returning false changes nothing. Sync, no Keychain, no network.
+ */
+export function claudeHomeHasOwnCredential(base, platform = process.platform) {
+    if (platform === 'darwin')
+        return false;
+    if (fs.existsSync(path.join(base, '.claude', '.oauth_token')))
+        return true;
+    try {
+        const raw = fs.readFileSync(path.join(base, '.claude', '.credentials.json'), 'utf-8');
+        const oauth = JSON.parse(raw).claudeAiOauth;
+        if (!oauth)
+            return false;
+        const nonEmpty = (v) => typeof v === 'string' && v.trim().length > 0;
+        return nonEmpty(oauth.accessToken) || nonEmpty(oauth.refreshToken);
+    }
+    catch {
+        return false;
+    }
+}
 export async function getAccountInfo(agentId, home) {
     const base = home || os.homedir();
     const empty = {
@@ -1358,6 +1477,13 @@ export async function getAccountInfo(agentId, home) {
                 const accountId = normalizeIdentityPart(oa?.accountUuid);
                 const organizationId = normalizeIdentityPart(oa?.organizationUuid);
                 const email = oa?.emailAddress || null;
+                // Credential floor: a blanked credential file means this home cannot
+                // authenticate, whatever `.claude.json` still says. Report it signed out
+                // so `agents view` prompts a re-login and rotation routes around it,
+                // instead of handing runs to an install that dies at spawn.
+                if (email && isClaudeCredentialFileBlank(base)) {
+                    return { ...empty, lastActive };
+                }
                 const accountKey = buildIdentityKey(agentId, [
                     ['account', accountId],
                     ['org', organizationId],

package/dist/lib/cloud/codex.d.ts

@@ -24,3 +24,5 @@ export declare class CodexCloudProvider implements CloudProvider {
     cancel(_taskId: string): Promise<void>;
     message(_taskId: string, _content: string): Promise<void>;
 }
+/** Extract a task ID from codex CLI output (JSON field, key:value line, or UUID pattern). */
+export declare function extractTaskId(output: string): string | undefined;

package/dist/lib/cloud/codex.js

@@ -127,8 +127,19 @@ export class CodexCloudProvider {
         if (code !== 0) {
             throw new Error(`codex cloud exec failed: ${stderr || stdout}`);
         }
-        // Parse task ID from output. Codex typically prints the task ID.
-        const taskId = extractTaskId(stdout) ?? `codex-${Date.now()}`;
+        // The task id is the ONLY handle to the just-created execution — status,
+        // list, and the session-index reconcile all key on it. Codex prints it to
+        // stdout (JSON or a task_/id: line); some builds route it to stderr, so scan
+        // both. A synthetic `codex-<ts>` id was the old fallback here — it can never
+        // match the real execution, so it silently broke every follow-up. If the id
+        // genuinely can't be parsed, fail loudly and point at `agents cloud list`
+        // (which recovers the newest execution) rather than persist a bogus id.
+        const taskId = extractTaskId(stdout) ?? extractTaskId(stderr);
+        if (!taskId) {
+            throw new Error('codex cloud exec did not report a task id — the run may have dispatched, but ' +
+                'without the id it cannot be tracked. Find it with `agents cloud list --provider codex`, ' +
+                `then \`agents cloud status <id>\`.\nRaw output: ${(stdout || stderr).trim().slice(0, 400)}`);
+        }
         const now = new Date().toISOString();
         return {
             id: taskId,
@@ -232,7 +243,7 @@ export class CodexCloudProvider {
     }
 }
 /** Extract a task ID from codex CLI output (JSON field, key:value line, or UUID pattern). */
-function extractTaskId(output) {
+export function extractTaskId(output) {
     // Try JSON first
     try {
         const data = JSON.parse(output);

package/dist/lib/cloud/session-index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Register cloud-dispatched tasks into the LOCAL session index, keyed by the
+ * real execution id, so a launch is mappable to a session immediately.
+ *
+ * The cloud store (`tasks.db`) and the session index (`sessions` table) were two
+ * disjoint stores: a `agents cloud run` wrote only the store, and the session
+ * index learned about the run only later, via `discoverCloudSessions` hitting the
+ * proxy. Until that discovery ran there was no launch→session mapping at all —
+ * the run was orphaned in `agents sessions` exactly like the non-Claude host runs.
+ *
+ * This mirrors hosts/session-index.ts: the transcript is remote (fetched on
+ * demand by session/cloud.ts), so the row is registered with an EMPTY `file_path`
+ * — the sentinel db.js's stale-row filter treats as "always live" — and a
+ * `[cloud/<status>]` label. The row is written at dispatch and refreshed on every
+ * status poll so the label tracks the task's lifecycle. Non-session-agent cloud
+ * providers (a task whose agent has no transcript format) are skipped: there is
+ * nothing to resolve or resume by id.
+ */
+import type { CloudTask } from './types.js';
+/** Context a cloud task needs to become a session row — the LOCAL dir it was launched from. */
+export interface CloudSessionContext {
+    /** Local directory `agents cloud run` was invoked from. Defaults to process.cwd(). */
+    cwd?: string;
+}
+/**
+ * Register (or refresh) a cloud task in the local session index. No-op when the
+ * task's agent isn't a known session agent, or its id isn't a usable execution id
+ * (never a fabricated `codex-<ts>` — codex.ts fails loud instead of minting one,
+ * but guard here too so a bad id can never seed a bogus row). Best-effort: a
+ * failed index write must never break the dispatch/poll it rides on.
+ */
+export declare function registerCloudSession(task: CloudTask, ctx?: CloudSessionContext): void;

package/dist/lib/cloud/session-index.js

@@ -0,0 +1,58 @@
+/**
+ * Register cloud-dispatched tasks into the LOCAL session index, keyed by the
+ * real execution id, so a launch is mappable to a session immediately.
+ *
+ * The cloud store (`tasks.db`) and the session index (`sessions` table) were two
+ * disjoint stores: a `agents cloud run` wrote only the store, and the session
+ * index learned about the run only later, via `discoverCloudSessions` hitting the
+ * proxy. Until that discovery ran there was no launch→session mapping at all —
+ * the run was orphaned in `agents sessions` exactly like the non-Claude host runs.
+ *
+ * This mirrors hosts/session-index.ts: the transcript is remote (fetched on
+ * demand by session/cloud.ts), so the row is registered with an EMPTY `file_path`
+ * — the sentinel db.js's stale-row filter treats as "always live" — and a
+ * `[cloud/<status>]` label. The row is written at dispatch and refreshed on every
+ * status poll so the label tracks the task's lifecycle. Non-session-agent cloud
+ * providers (a task whose agent has no transcript format) are skipped: there is
+ * nothing to resolve or resume by id.
+ */
+import { upsertSession } from '../session/db.js';
+import { SESSION_AGENTS } from '../session/types.js';
+import { deriveShortId } from '../session/short-id.js';
+/** The execution-id charset the session index will accept as a row id. */
+const EXECUTION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/;
+/**
+ * Register (or refresh) a cloud task in the local session index. No-op when the
+ * task's agent isn't a known session agent, or its id isn't a usable execution id
+ * (never a fabricated `codex-<ts>` — codex.ts fails loud instead of minting one,
+ * but guard here too so a bad id can never seed a bogus row). Best-effort: a
+ * failed index write must never break the dispatch/poll it rides on.
+ */
+export function registerCloudSession(task, ctx = {}) {
+    if (!SESSION_AGENTS.includes(task.agent))
+        return;
+    if (!task.id || !EXECUTION_ID_RE.test(task.id))
+        return;
+    try {
+        upsertSession({
+            id: task.id,
+            shortId: deriveShortId(task.id),
+            agent: task.agent,
+            timestamp: task.createdAt,
+            lastActivity: task.updatedAt,
+            cwd: ctx.cwd ?? process.cwd(),
+            project: task.repo ?? task.repos?.[0],
+            // Remote transcript — no local file yet. Empty file_path is the sentinel
+            // the DB stale-filter treats as "always live" (see hosts/session-index.ts).
+            filePath: '',
+            topic: task.prompt.split('\n')[0]?.slice(0, 120) || undefined,
+            // Mirrors session/cloud.ts's discovered label, so the dispatch-time row and
+            // a later proxy-discovered row read the same in `agents sessions`.
+            label: `[cloud/${task.status}]${task.branch ? ` ${task.branch}` : ''}`,
+            prUrl: task.prUrl,
+        }, '');
+    }
+    catch {
+        /* index write is best-effort; the task is already persisted in the cloud store */
+    }
+}

package/dist/lib/cloud/store.d.ts

@@ -6,6 +6,13 @@
  * remote provider each time.
  */
 import type { CloudTask, CloudProviderId, CloudTaskStatus } from './types.js';
+/**
+ * Release the tasks.db connection so the file (and its WAL sidecars) can be
+ * removed. The mirror of `closeDB()` in `../session/db.ts`, which this module
+ * had no counterpart for — on Windows an open handle makes the file
+ * un-unlinkable, so anything tearing down a temp home must close this too.
+ */
+export declare function closeStore(): void;
 /** Persist a task snapshot, replacing any existing row with the same ID. */
 export declare function insertTask(task: CloudTask): void;
 /** Update a task's status and optionally patch summary, PR URL, or branch. */

package/dist/lib/cloud/store.js

@@ -9,6 +9,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import Database from '../sqlite.js';
 import { getCloudDir } from '../state.js';
+import { registerCloudSession } from './session-index.js';
 const CLOUD_DIR = getCloudDir();
 const DB_PATH = path.join(CLOUD_DIR, 'tasks.db');
 const SCHEMA = `
@@ -41,12 +42,29 @@ function db() {
     _db.exec(SCHEMA);
     return _db;
 }
+/**
+ * Release the tasks.db connection so the file (and its WAL sidecars) can be
+ * removed. The mirror of `closeDB()` in `../session/db.ts`, which this module
+ * had no counterpart for — on Windows an open handle makes the file
+ * un-unlinkable, so anything tearing down a temp home must close this too.
+ */
+export function closeStore() {
+    if (_db) {
+        _db.close();
+        _db = null;
+    }
+}
 /** Persist a task snapshot, replacing any existing row with the same ID. */
 export function insertTask(task) {
     db().prepare(`
     INSERT OR REPLACE INTO tasks (id, provider, status, agent, prompt, repo, branch, pr_url, summary, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(task.id, task.provider, task.status, task.agent ?? null, task.prompt, task.repo ?? null, task.branch ?? null, task.prUrl ?? null, task.summary ?? null, task.createdAt, task.updatedAt);
+    // Every cloud dispatch flows through here, so this is the one chokepoint that
+    // reconciles the cloud store with the session index: register a session row
+    // keyed by the real execution id so the launch is mappable to a session
+    // immediately, not only after a later proxy discovery (see session-index.ts).
+    registerCloudSession(task);
 }
 /** Update a task's status and optionally patch summary, PR URL, or branch. */
 export function updateTaskStatus(id, status, extra) {
@@ -67,6 +85,13 @@ export function updateTaskStatus(id, status, extra) {
     }
     params.push(id);
     db().prepare(`UPDATE tasks SET ${sets.join(', ')} WHERE id = ?`).run(...params);
+    // Keep the session index in lockstep with the store on every poll: refresh the
+    // row so its `[cloud/<status>]` label tracks the task's lifecycle (and picks up
+    // a newly-opened PR url). Reads the just-written row so the label reflects the
+    // update we just made, not a stale snapshot.
+    const updated = getTaskById(id);
+    if (updated)
+        registerCloudSession(updated);
 }
 /** Fetch a single task by its provider-assigned ID, or null if not found locally. */
 export function getTaskById(id) {

package/dist/lib/config-transfer.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Move `source` onto `dest` across possibly-different volumes. `renameSync` is
+ * atomic but throws EXDEV when `~/.agents` lives on a different filesystem than
+ * `$HOME`; fall back to copy-then-remove so the restore still completes. The
+ * source is removed only after the copy succeeds, so a mid-copy failure never
+ * destroys the sole surviving copy.
+ */
+export declare function moveDirCrossDevice(source: string, dest: string): void;
+/**
+ * Copy `source` to `dest`, dropping any symlink whose target resolves back into
+ * `~/.agents`. Managed resources (skills/commands) are synced into a version home
+ * as symlinks into `~/.agents`; copying them verbatim would leave the result full
+ * of links that dangle the moment `~/.agents` is disposed. Stripping them yields a
+ * clean, self-contained copy — which is the entire point of an export.
+ */
+export declare function copyDirStrippingAgentsSymlinks(source: string, dest: string, agentsDir: string): void;

package/dist/lib/config-transfer.js

@@ -0,0 +1,60 @@
+/**
+ * Primitives for moving an agent config directory across the agents-cli boundary.
+ *
+ * Both helpers were part of {@link ./uninstall.ts} and are unchanged — teardown was
+ * simply the first caller. `agents export` needs the same two operations (relocate a
+ * directory that may sit on another volume; copy one without dragging `~/.agents`
+ * symlinks along), so they live here rather than being duplicated or imported out of
+ * a module named for teardown.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * Move `source` onto `dest` across possibly-different volumes. `renameSync` is
+ * atomic but throws EXDEV when `~/.agents` lives on a different filesystem than
+ * `$HOME`; fall back to copy-then-remove so the restore still completes. The
+ * source is removed only after the copy succeeds, so a mid-copy failure never
+ * destroys the sole surviving copy.
+ */
+export function moveDirCrossDevice(source, dest) {
+    try {
+        fs.renameSync(source, dest);
+    }
+    catch (err) {
+        if (err.code !== 'EXDEV')
+            throw err;
+        fs.cpSync(source, dest, { recursive: true });
+        fs.rmSync(source, { recursive: true, force: true });
+    }
+}
+/**
+ * Copy `source` to `dest`, dropping any symlink whose target resolves back into
+ * `~/.agents`. Managed resources (skills/commands) are synced into a version home
+ * as symlinks into `~/.agents`; copying them verbatim would leave the result full
+ * of links that dangle the moment `~/.agents` is disposed. Stripping them yields a
+ * clean, self-contained copy — which is the entire point of an export.
+ */
+export function copyDirStrippingAgentsSymlinks(source, dest, agentsDir) {
+    const inside = agentsDir + path.sep;
+    fs.cpSync(source, dest, {
+        recursive: true,
+        // `force: true` is Node's default, but Bun drops it when a `filter` is supplied —
+        // existing files are then silently left alone. `dist/bin/agents` is bun-compiled,
+        // so this is a production path, not just a test artifact. State it explicitly.
+        force: true,
+        filter: (src) => {
+            try {
+                const st = fs.lstatSync(src);
+                if (st.isSymbolicLink()) {
+                    const tgt = path.resolve(path.dirname(src), fs.readlinkSync(src));
+                    if (tgt === agentsDir || tgt.startsWith(inside))
+                        return false;
+                }
+            }
+            catch {
+                /* unreadable entry — let cpSync surface it on the real copy */
+            }
+            return true;
+        },
+    });
+}

package/dist/lib/daemon.js

@@ -16,7 +16,7 @@ import { listJobs as listAllJobs } from './routines.js';
 import { JobScheduler } from './scheduler.js';
 import { MonitorEngine } from './monitors/engine.js';
 import { executeJobDetached, monitorRunningJobs } from './runner.js';
-import { detectOverdueJobs, notifyOverdue } from './overdue.js';
+import { detectOverdueJobs, notifyOverdue, notifyDesktop } from './overdue.js';
 import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { readAndResolveBundleEnv } from './secrets/bundles.js';
@@ -320,6 +320,15 @@ export async function runDaemon() {
             process.env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
             log('INFO', 'Loaded Claude OAuth token from secrets bundle for routine runs');
         }
+        else {
+            // No token available (e.g. a headless macOS daemon whose keychain was
+            // locked at start resolves broker-only and gets nothing). Historically
+            // this was silent, so every Claude routine the daemon spawned failed auth
+            // with no signal. Make it loud: WARN in the log and fire a desktop alert.
+            log('WARN', 'No Claude OAuth token available — Claude routine runs will fail auth on this host. ' +
+                'Restart the daemon with the keychain unlocked, or unlock the `claude` secrets bundle.');
+            notifyDesktop('agents daemon: no Claude credential', 'Claude routines will fail auth on this host. Restart the daemon with the keychain unlocked.');
+        }
     }
     // Reap any stray duplicate daemon of this install that slipped past the start
     // lock or was orphaned by a hard-crash — before it can double-fire jobs.
@@ -623,9 +632,16 @@ export async function runDaemon() {
         checkingLaunchHealth = true;
         try {
             const { healBrokenDefaultLaunches } = await import('./versions.js');
-            const repaired = await healBrokenDefaultLaunches((m) => log('INFO', `launch-health: ${m}`));
+            // Unattended pass: repair the current default in place, but NEVER repoint
+            // the global default (allowDefaultSwitch: false). A background default
+            // switch installs a fresh version home → a fresh empty Claude credential
+            // scope, i.e. a silent logout uncorrelated with anything the user did.
+            const { repaired, unhealed } = await healBrokenDefaultLaunches((m) => log('INFO', `launch-health: ${m}`), { allowDefaultSwitch: false });
             if (repaired.length)
                 log('INFO', `launch-health: repaired ${repaired.join(', ')}`);
+            if (unhealed.length) {
+                log('WARN', `launch-health: ${unhealed.join(', ')} won't launch and will not be auto-switched — choose a version with \`agents use <agent> <version>\` or \`agents add <agent>@latest\``);
+            }
         }
         catch (err) {
             log('ERROR', `launch-health check failed: ${err.message}`);

package/dist/lib/devices/connect.d.ts

@@ -3,6 +3,14 @@ import { type DeviceProfile } from './registry.js';
 export declare const ASKPASS_BUNDLE_ENV = "AGENTS_SSH_BUNDLE";
 /** Env var the askpass shim reads to know which key in the bundle is the password. */
 export declare const ASKPASS_KEY_ENV = "AGENTS_SSH_KEY";
+/**
+ * Env var that forces the askpass bundle resolve to be broker-only (`agentOnly`)
+ * regardless of TTY. A read-only stats probe (`agents devices` load/mem columns)
+ * sets this so an uncached password-auth device resolves from the already-unlocked
+ * secrets broker or degrades to an unreachable row — never a foreground Touch ID
+ * sheet. See {@link buildSshInvocation}'s `agentOnly` option and `runAskpass`. (RUSH-1970)
+ */
+export declare const ASKPASS_AGENT_ONLY_ENV = "AGENTS_SSH_AGENT_ONLY";
 /**
  * Build the `user@host` (or bare `host`) ssh target for a device and validate
  * it against the shared injection guard. Throws if the device has no address.
@@ -51,8 +59,14 @@ export interface SshHostKeyOptions {
  * Host-key checking runs against the CLI-managed known_hosts store (never the
  * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
  * `accept-new` to learn+pin the key on first connect (RUSH-1767).
+ *
+ * `opts.agentOnly` marks the connection as a read-only probe: for password auth
+ * it sets {@link ASKPASS_AGENT_ONLY_ENV} in the overlay so the askpass resolve
+ * stays broker-only and never pops a foreground biometric (RUSH-1970).
  */
-export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions): {
+export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions, opts?: {
+    agentOnly?: boolean;
+}): {
     args: string[];
     env: Record<string, string>;
 };

package/dist/lib/devices/connect.js

@@ -25,6 +25,14 @@ import { hostNameFor } from './ssh-config.js';
 export const ASKPASS_BUNDLE_ENV = 'AGENTS_SSH_BUNDLE';
 /** Env var the askpass shim reads to know which key in the bundle is the password. */
 export const ASKPASS_KEY_ENV = 'AGENTS_SSH_KEY';
+/**
+ * Env var that forces the askpass bundle resolve to be broker-only (`agentOnly`)
+ * regardless of TTY. A read-only stats probe (`agents devices` load/mem columns)
+ * sets this so an uncached password-auth device resolves from the already-unlocked
+ * secrets broker or degrades to an unreachable row — never a foreground Touch ID
+ * sheet. See {@link buildSshInvocation}'s `agentOnly` option and `runAskpass`. (RUSH-1970)
+ */
+export const ASKPASS_AGENT_ONLY_ENV = 'AGENTS_SSH_AGENT_ONLY';
 /**
  * Build the `user@host` (or bare `host`) ssh target for a device and validate
  * it against the shared injection guard. Throws if the device has no address.
@@ -83,8 +91,12 @@ export function wrapRemoteCommand(device, cmd) {
  * Host-key checking runs against the CLI-managed known_hosts store (never the
  * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
  * `accept-new` to learn+pin the key on first connect (RUSH-1767).
+ *
+ * `opts.agentOnly` marks the connection as a read-only probe: for password auth
+ * it sets {@link ASKPASS_AGENT_ONLY_ENV} in the overlay so the askpass resolve
+ * stays broker-only and never pops a foreground biometric (RUSH-1970).
  */
-export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}) {
+export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, opts = {}) {
     const target = sshTargetFor(device);
     const remote = wrapRemoteCommand(device, cmd);
     const env = {};
@@ -100,6 +112,8 @@ export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}) {
         env.SSH_ASKPASS_REQUIRE = 'force';
         env[ASKPASS_BUNDLE_ENV] = device.auth.bundle;
         env[ASKPASS_KEY_ENV] = device.auth.bundleKey ?? 'password';
+        if (opts.agentOnly)
+            env[ASKPASS_AGENT_ONLY_ENV] = '1';
         args.push('-o', 'PreferredAuthentications=password', '-o', 'PubkeyAuthentication=no', '-o', 'NumberOfPasswordPrompts=1');
     }
     else {

package/dist/lib/devices/fleet.d.ts

@@ -8,6 +8,7 @@
  * the remaining devices.
  */
 import { type DeviceProfile, type DeviceRegistry } from './registry.js';
+import type { DeviceStats } from './health.js';
 export type FleetSkipReason = 'offline' | 'no-address' | 'control';
 /** npm dist-tags / semver pins only — rejects shell metacharacters. */
 export declare const FLEET_VERSION_RE: RegExp;
@@ -55,6 +56,26 @@ export declare function planFleetTargets(reg: DeviceRegistry): FleetTarget[];
  * surface — so their `skip` reason still flows through as an `unreachable` row.
  */
 export declare function remoteFleetTargets(planned: FleetTarget[], self: string): FleetTarget[];
+/**
+ * Decide whether a fleet-health target should skip the expensive version+doctor
+ * dials (`agents fleet status`). The cheap stats probe (~2.5s, same registry
+ * address) has already tried this box one step earlier. If it came back
+ * unreachable, dialing `agents --version` (15s) + `agents doctor --json` (30s)
+ * would almost certainly fail the same way — just 45s slower — so one
+ * genuinely-offline box would stall the whole matrix (the ~60s hang, RUSH-1964).
+ *
+ * We trust the stats verdict on the DEFAULT path, not only under
+ * `--refresh`/`--live`: `probeDeviceStats` and the version/doctor dials share
+ * one ssh path (`fleetDialTarget`), so reachability is not per-probe. The
+ * verdict is either freshly probed this run or daemon-warmed (~3min) with the
+ * live write-back from RUSH-1965, so a box that came online in the last few
+ * minutes is the only false-negative window — it renders `unreachable` until the
+ * next stats warm, which beats letting it hang the status glance for 45s.
+ *
+ * An existing skip (control/offline/no-address from {@link planFleetTargets})
+ * always wins — those are classified before any probe.
+ */
+export declare function fleetHealthSkip(currentSkip: FleetSkipReason | string | undefined, stats: DeviceStats | undefined): FleetSkipReason | string | undefined;
 /** Human label for a skip reason. */
 export declare function skipLabel(reason: FleetSkipReason): string;
 /**