@phnx-labs/agents-cli 1.20.73 → 1.20.76

package/dist/lib/profiles-presets.js

@@ -4,7 +4,9 @@
  * Each preset bundles a host CLI, API base URL, default model, and provider
  * name so users can `agents profiles add kimi` without manual configuration.
  */
-// Model IDs verified against openrouter.ai/api/v1/models on 2026-04-20.
+// Model IDs verified against openrouter.ai/api/v1/models on 2026-07-31
+// (spark presets corrected from the never-served meta/claude-spark-1.1 to the
+// live meta/muse-spark-1.1, confirmed on both OpenRouter and OpenCode id:meta).
 // Presets target the top-ranked open-source model per provider based on
 // SWE-bench Verified, LiveCodeBench, HumanEval, and Chatbot Arena rankings.
 //
@@ -100,18 +102,18 @@ export const PRESETS = [
     },
     {
         name: 'claude-spark',
-        description: 'Meta Claude Spark 1.1 via OpenRouter inside Claude Code (open alternative). Model: meta/claude-spark-1.1 — free via opencode, now usable in Claude Code UI. HEADLESS-SAFE. For open-claude spark usage.',
+        description: 'Meta Muse Spark 1.1 via OpenRouter inside Claude Code (open alternative). Model: meta/muse-spark-1.1 — now usable in the Claude Code UI. HEADLESS-SAFE. For open-claude spark usage.',
         ...OPENROUTER_AUTH,
         env: {
             ANTHROPIC_BASE_URL: OPENROUTER_BASE,
-            ANTHROPIC_MODEL: 'meta/claude-spark-1.1',
-            ANTHROPIC_SMALL_FAST_MODEL: 'meta/claude-spark-1.1',
+            ANTHROPIC_MODEL: 'meta/muse-spark-1.1',
+            ANTHROPIC_SMALL_FAST_MODEL: 'meta/muse-spark-1.1',
         },
     },
     // ----- OpenCode CLI (open-claude harness) -----
     {
         name: 'opencode',
-        description: 'OpenCode default — uses your configured model via opencode auth. Run `opencode auth` to login, then `agents run opencode --model meta/claude-spark-1.1 "prompt"` for spark usage.',
+        description: 'OpenCode default — uses your configured model via opencode auth. Run `opencode auth` to login, then `agents run opencode --model meta/muse-spark-1.1 "prompt"` for spark usage.',
         provider: 'opencode',
         host: 'opencode',
         authEnvVar: 'OPENCODE_API_KEY',
@@ -120,13 +122,13 @@ export const PRESETS = [
     },
     {
         name: 'opencode-spark',
-        description: 'Meta Claude Spark 1.1 via OpenCode (free, headless-safe). Pinned to meta/claude-spark-1.1 — best for open-claude usage with opencode harness.',
+        description: 'Meta Muse Spark 1.1 via OpenCode (free, headless-safe). Pinned to meta/muse-spark-1.1 — best for open-claude usage with opencode harness.',
         provider: 'opencode',
         host: 'opencode',
         authEnvVar: 'OPENCODE_API_KEY',
         authOptional: true,
         env: {
-            OPENCODE_MODEL: 'meta/claude-spark-1.1',
+            OPENCODE_MODEL: 'meta/muse-spark-1.1',
         },
     },
     {

package/dist/lib/profiles.d.ts

@@ -19,6 +19,13 @@ export interface Profile {
         envVar: string;
         keychainItem: string;
     };
+    /**
+     * When true, the host manages its own login and the keychain token named by
+     * `auth` is optional: if it is not stored, no auth env var is injected and the
+     * run proceeds on the host's own credentials (e.g. `opencode auth`). Without
+     * this flag a missing keychain item is a hard error at exec time.
+     */
+    authOptional?: boolean;
     description?: string;
     preset?: string;
     provider?: string;
@@ -92,6 +99,30 @@ export declare function profileSummary(profile: Profile): ProfileSummary;
  * for the OpenRouter key exactly once.
  */
 export declare function profileFromPreset(profileName: string, preset: Preset, version?: string): Profile;
+/** Return the model-override env var for a host (known hosts mapped; else `<HOST>_MODEL`). */
+export declare function modelEnvKeyForHost(host: AgentId): string;
+/** Return the base-URL env var for a host, or null when the host has no known override var. */
+export declare function baseUrlEnvKeyForHost(host: AgentId): string | null;
+/** Return the auth-token env var for a host, or null when unknown. */
+export declare function authEnvKeyForHost(host: AgentId): string | null;
+/** Options for {@link profileFromHostModel}. */
+export interface HostModelOptions {
+    version?: string;
+    /** Base URL for OpenAI/Anthropic-compatible hosts (claude, codex). Ignored for hosts without a known var. */
+    baseUrl?: string;
+    /** Provider label + keychain namespace; only needed when the host requires a token. */
+    provider?: string;
+    /** Env var the host reads its auth token from; pair with `provider` to attach keychain auth. */
+    authEnvVar?: string;
+    description?: string;
+}
+/**
+ * Build a custom-harness profile from a host CLI + model in one shot, without a
+ * preset. The model lands on the host's model env var ({@link modelEnvKeyForHost});
+ * auth is attached only when both `provider` and `authEnvVar` are supplied
+ * (hosts that manage their own login — e.g. opencode — need neither).
+ */
+export declare function profileFromHostModel(name: string, host: AgentId, model: string, opts?: HostModelOptions): Profile;
 /**
  * Resolve a profile into the env block that should be injected into the
  * spawned agent process. Reads the token from keychain at exec time so the

package/dist/lib/profiles.js

@@ -223,11 +223,75 @@ export function profileFromPreset(profileName, preset, version) {
             envVar: preset.authEnvVar,
             keychainItem: keychainItemName(preset.provider),
         },
+        authOptional: preset.authOptional,
         description: preset.description,
         preset: preset.name,
         provider: preset.provider,
     };
 }
+/**
+ * Env var each host CLI reads to override its model. Mirror of the read-side
+ * `MODEL_ENV_KEYS` above, keyed by host so a one-shot `--host <agent> --model
+ * <id>` writes the model onto the var that host actually honors.
+ */
+const MODEL_ENV_KEY_BY_HOST = {
+    claude: 'ANTHROPIC_MODEL',
+    opencode: 'OPENCODE_MODEL',
+    grok: 'GROK_MODEL',
+    gemini: 'GEMINI_MODEL',
+    codex: 'OPENAI_MODEL',
+};
+/** Base-URL env var per host, for the OpenAI/Anthropic-compatible hosts where it applies. */
+const BASE_URL_ENV_KEY_BY_HOST = {
+    claude: 'ANTHROPIC_BASE_URL',
+    codex: 'OPENAI_BASE_URL',
+};
+/** Return the model-override env var for a host (known hosts mapped; else `<HOST>_MODEL`). */
+export function modelEnvKeyForHost(host) {
+    return MODEL_ENV_KEY_BY_HOST[host] ?? `${host.toUpperCase()}_MODEL`;
+}
+/** Return the base-URL env var for a host, or null when the host has no known override var. */
+export function baseUrlEnvKeyForHost(host) {
+    return BASE_URL_ENV_KEY_BY_HOST[host] ?? null;
+}
+/** Env var each host reads its auth token from, for custom-endpoint (`--auth-provider`) harnesses. */
+const AUTH_ENV_KEY_BY_HOST = {
+    claude: 'ANTHROPIC_AUTH_TOKEN',
+    codex: 'OPENAI_API_KEY',
+    gemini: 'GEMINI_API_KEY',
+    grok: 'XAI_API_KEY',
+    opencode: 'OPENCODE_API_KEY',
+};
+/** Return the auth-token env var for a host, or null when unknown. */
+export function authEnvKeyForHost(host) {
+    return AUTH_ENV_KEY_BY_HOST[host] ?? null;
+}
+/**
+ * Build a custom-harness profile from a host CLI + model in one shot, without a
+ * preset. The model lands on the host's model env var ({@link modelEnvKeyForHost});
+ * auth is attached only when both `provider` and `authEnvVar` are supplied
+ * (hosts that manage their own login — e.g. opencode — need neither).
+ */
+export function profileFromHostModel(name, host, model, opts = {}) {
+    const env = { [modelEnvKeyForHost(host)]: model };
+    if (opts.baseUrl) {
+        const key = baseUrlEnvKeyForHost(host);
+        if (key)
+            env[key] = opts.baseUrl;
+    }
+    const profile = {
+        name,
+        host: { agent: host, version: opts.version },
+        env,
+        description: opts.description ?? `Custom harness: ${host} + ${model}`,
+        provider: opts.provider ?? host,
+    };
+    if (opts.provider && opts.authEnvVar) {
+        profile.auth = { envVar: opts.authEnvVar, keychainItem: keychainItemName(opts.provider) };
+        profile.authOptional = false;
+    }
+    return profile;
+}
 /**
  * Resolve a profile into the env block that should be injected into the
  * spawned agent process. Reads the token from keychain at exec time so the
@@ -236,6 +300,12 @@ export function profileFromPreset(profileName, preset, version) {
 export function resolveProfileEnv(profile) {
     const env = { ...profile.env };
     if (profile.auth) {
+        // Optional auth (host manages its own login) with no stored token: inject
+        // nothing and let the host use its own credentials. Only required auth
+        // hard-fails on a missing keychain item.
+        if (profile.authOptional && !hasKeychainToken(profile.auth.keychainItem)) {
+            return env;
+        }
         const token = getKeychainToken(profile.auth.keychainItem);
         env[profile.auth.envVar] = token;
     }

package/dist/lib/project-resources.js

@@ -41,7 +41,7 @@ function loadProjectManifest(agentRoot) {
             return null;
         if (!raw.paths.every((p) => typeof p === 'string' && p.length > 0))
             return null;
-        return raw;
+        return { ...raw, paths: raw.paths.map(toPosixRel) };
     }
     catch {
         return null;
@@ -106,10 +106,22 @@ function projectEntries(projectAgentsDir, kind) {
         return [];
     }
 }
+/**
+ * Manifest paths are persisted to `.agents-managed.json`, which lives in the
+ * version-controlled project dir and therefore travels between machines. Store
+ * them POSIX-style: `path.join` yields `skills\myskill` on Windows, and a
+ * manifest carrying that would silently fail to match — and so fail to clean up
+ * its managed files — when the same project is synced on macOS or Linux.
+ * Normalizing on both write and read also repairs manifests written by earlier
+ * Windows builds.
+ */
+function toPosixRel(rel) {
+    return rel.replace(/\\/g, '/');
+}
 function record(kind, name, relPaths, result, manifestPaths) {
     result.synced.push(`${kind}/${name}`);
     for (const rel of relPaths)
-        manifestPaths.add(rel);
+        manifestPaths.add(toPosixRel(rel));
 }
 function skip(dest, projectRoot, result) {
     const rel = path.relative(projectRoot, dest);
@@ -209,8 +221,8 @@ function syncProjectSubagents(agent, version, projectAgentsDir, projectRoot, age
         return;
     const all = readProjectSubagents(projectAgentsDir);
     const dir = target.dir(projectRoot);
-    const targetDirRel = path.relative(agentRoot, dir);
-    const hadManagedTarget = manifest?.paths.some((rel) => rel === targetDirRel || rel.startsWith(targetDirRel + path.sep)) ?? false;
+    const targetDirRel = toPosixRel(path.relative(agentRoot, dir));
+    const hadManagedTarget = manifest?.paths.some((rel) => rel === targetDirRel || rel.startsWith(targetDirRel + '/')) ?? false;
     for (const sub of all.values()) {
         const occupied = target.occupied(dir, sub.name);
         const existing = occupied.find((entry) => pathExists(entry.path));
@@ -234,7 +246,10 @@ function syncProjectSubagents(agent, version, projectAgentsDir, projectRoot, age
     if (target.finalize && (syncedNames.length > 0 || hadManagedTarget)) {
         target.finalize(dir, syncedNames);
         for (const entry of target.finalizeOccupied?.(dir) ?? []) {
-            manifestPaths.add(path.relative(agentRoot, entry.path));
+            // Same normalization as record(): this is the one manifest write that
+            // doesn't funnel through it (the parent subagent index, e.g. Kimi's
+            // agents/_agents-cli.yaml).
+            manifestPaths.add(toPosixRel(path.relative(agentRoot, entry.path)));
         }
     }
 }

package/dist/lib/pty-server.d.ts

@@ -8,16 +8,8 @@
  *
  * Protocol: newline-delimited JSON over ~/.agents/.system/pty.sock
  */
-/**
- * Capture a stable identifier for a process at the moment it was started.
- * Used to defeat PID reuse: a kill(pid, ...) is only safe when the process
- * still occupies the PID we observed at spawn time.
- *
- * Linux:  field 22 of /proc/<pid>/stat (starttime in clock ticks since boot).
- * macOS:  output of `ps -o lstart= -p <pid>` (start time in human format).
- * Returns null on any error so callers can skip the guard rather than crash.
- */
-export declare function captureProcessStartTime(pid: number): string | null;
+import { captureProcessStartTime } from './platform/index.js';
+export { captureProcessStartTime };
 /**
  * Wrap a user command so a `__SENTINEL__:<exit>` line is printed after it
  * finishes — that line drives completion detection in the exec/read flow.

package/dist/lib/pty-server.js

@@ -12,46 +12,12 @@ import * as net from 'net';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as crypto from 'crypto';
-import { execFileSync } from 'child_process';
 import { fileURLToPath } from 'url';
 import { getPtyDir as getPtyDirRoot } from './state.js';
-import { isAlive } from './platform/index.js';
-/**
- * Capture a stable identifier for a process at the moment it was started.
- * Used to defeat PID reuse: a kill(pid, ...) is only safe when the process
- * still occupies the PID we observed at spawn time.
- *
- * Linux:  field 22 of /proc/<pid>/stat (starttime in clock ticks since boot).
- * macOS:  output of `ps -o lstart= -p <pid>` (start time in human format).
- * Returns null on any error so callers can skip the guard rather than crash.
- */
-export function captureProcessStartTime(pid) {
-    if (!pid || pid <= 0)
-        return null;
-    try {
-        if (process.platform === 'linux') {
-            const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf-8');
-            // The comm field (#2) is wrapped in parens and may contain spaces, so
-            // split off everything after the last `)` to get a clean field list.
-            const lastParen = stat.lastIndexOf(')');
-            if (lastParen < 0)
-                return null;
-            const tail = stat.slice(lastParen + 2);
-            const fields = tail.split(' ');
-            // After comm we are at field 3; starttime is field 22, so index 19 here.
-            return fields[19] || null;
-        }
-        const out = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
-            encoding: 'utf-8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        const trimmed = out.trim();
-        return trimmed.length > 0 ? trimmed : null;
-    }
-    catch {
-        return null;
-    }
-}
+import { isAlive, captureProcessStartTime } from './platform/index.js';
+// Re-exported for the existing importers of this module; the implementation is
+// in platform/process.ts, shared with teams/agents.ts so the two cannot drift.
+export { captureProcessStartTime };
 // --- Constants ---
 const IS_WINDOWS = process.platform === 'win32';
 const SENTINEL = '__AGENTS_PTY_DONE__';

package/dist/lib/registry.d.ts

@@ -17,7 +17,7 @@ export declare function getEnabledRegistries(type: RegistryType): Array<{
 }>;
 /** Add or update a registry configuration in agents.yaml. */
 export declare function setRegistry(type: RegistryType, name: string, config: Partial<RegistryConfig>): void;
-/** Remove a user-configured registry. Returns false if it did not exist. */
+/** Remove a user-configured or seeded registry. Returns false if it did not exist. */
 export declare function removeRegistry(type: RegistryType, name: string): boolean;
 /** Search MCP registries for servers matching a query string. */
 export declare function searchMcpRegistries(query: string, options?: {

package/dist/lib/registry.js

@@ -8,7 +8,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { createHash } from 'crypto';
-import { DEFAULT_REGISTRIES } from './types.js';
+import { DEFAULT_REGISTRIES, SEEDED_REGISTRIES } from './types.js';
 import { readMeta, writeMeta } from './state.js';
 import { discoverSkillsFromRepo } from './skills.js';
 const UNSAFE_PACKAGE_SPEC_CHARS = /[;&|`$\s\x00-\x1f\x7f]/;
@@ -26,13 +26,38 @@ export function validatedPyPISpec(spec) {
     }
     return spec;
 }
+/**
+ * Seeded presets offered for `type`, minus any the user has removed.
+ *
+ * These are resolved here rather than written into agents.yaml. Seeding used to
+ * happen on the state READ path and persisted the entry — but agents.yaml is
+ * git-tracked in the user's DotAgents repo, so that write left the working tree
+ * dirty and every `agents repo pull` aborted with "Working tree has uncommitted
+ * changes", naming neither the file nor the cause. Since every `agents`
+ * invocation reads state, the dirt returned the instant it was cleared, and the
+ * loop could not be escaped through the CLI at all (RUSH-1925).
+ *
+ * `seededPresets` is the removal tombstone: a key listed there means the user
+ * removed that preset, so it is not offered again. Users who were seeded under
+ * the old behaviour have the key listed *and* the entry in their own
+ * `registries:` block, which still wins below — so nothing disappears for them.
+ */
+function offeredSeeds(type, meta) {
+    const removed = new Set(meta.seededPresets || []);
+    const offered = {};
+    for (const [name, config] of Object.entries(SEEDED_REGISTRIES[type] || {})) {
+        if (!removed.has(`${type}.${name}`))
+            offered[name] = { ...config };
+    }
+    return offered;
+}
 /** Get all registries of a given type, merging defaults with user overrides. */
 export function getRegistries(type) {
     const meta = readMeta();
     const defaultRegs = DEFAULT_REGISTRIES[type] || {};
     const userRegs = meta.registries?.[type] || {};
     // Merge defaults with user config (user overrides defaults)
-    return { ...defaultRegs, ...userRegs };
+    return { ...defaultRegs, ...offeredSeeds(type, meta), ...userRegs };
 }
 /** Get only the enabled registries of a given type. */
 export function getEnabledRegistries(type) {
@@ -50,19 +75,34 @@ export function setRegistry(type, name, config) {
     if (!meta.registries[type]) {
         meta.registries[type] = {};
     }
-    const existing = meta.registries[type][name] || DEFAULT_REGISTRIES[type]?.[name];
+    // Seeded presets are resolved in memory and never materialized in agents.yaml
+    // (see offeredSeeds), so a partial update — `registry disable`, `enable`, or
+    // `config --api-key` — has nothing stored to merge with. Without the
+    // SEEDED_REGISTRIES fallback it would persist only the changed fields and drop
+    // `url`, and because userRegs wins over the in-memory seed in getRegistries the
+    // preset would stay broken even after re-enabling.
+    const existing = meta.registries[type][name]
+        || DEFAULT_REGISTRIES[type]?.[name]
+        || SEEDED_REGISTRIES[type]?.[name];
     meta.registries[type][name] = { ...existing, ...config };
     writeMeta(meta);
 }
-/** Remove a user-configured registry. Returns false if it did not exist. */
+/** Remove a user-configured or seeded registry. Returns false if it did not exist. */
 export function removeRegistry(type, name) {
     const meta = readMeta();
-    if (meta.registries?.[type]?.[name]) {
+    const inUserConfig = !!meta.registries?.[type]?.[name];
+    // A seeded preset has no entry in agents.yaml until the user edits it, so
+    // removal is recorded as a tombstone in seededPresets instead of a deletion.
+    const isOfferedSeed = !!offeredSeeds(type, meta)[name];
+    if (!inUserConfig && !isOfferedSeed)
+        return false;
+    if (inUserConfig)
         delete meta.registries[type][name];
-        writeMeta(meta);
-        return true;
+    if (SEEDED_REGISTRIES[type]?.[name]) {
+        meta.seededPresets = [...new Set([...(meta.seededPresets || []), `${type}.${name}`])];
     }
-    return false;
+    writeMeta(meta);
+    return true;
 }
 /**
  * Cap every registry network call. Without this a slow or unreachable registry

package/dist/lib/rotate.d.ts

@@ -126,6 +126,24 @@ export declare function pickBalancedCandidate(candidates: RotateCandidate[]): Ro
  */
 export declare function pickAvailableCandidate(candidates: RotateCandidate[], preferredVersion?: string | null): RotateResult | null;
 export declare function collectRunCandidates(agent: AgentId): Promise<RotateCandidate[]>;
+/**
+ * Resolve an account identity to the installed version slot that holds it, over
+ * an already-collected candidate list. Pure — no I/O — so it is unit-tested
+ * directly. Matches, case-insensitively, against a candidate's login `email`
+ * (the usual form) or its `accountKey`, and only ever returns a signed-in slot.
+ * Returns null when nothing matches, so the caller can fall back and warn.
+ */
+export declare function matchAccountVersion(candidates: RotateCandidate[], account: string): string | null;
+/**
+ * Resolve a routine's `account:` pin (login email or account key) to the
+ * installed version currently holding that account. Thin I/O wrapper over
+ * {@link collectRunCandidates} + {@link matchAccountVersion}; returns null when
+ * no signed-in version matches. Pinning a routine to a distinct account is the
+ * durable cure for the shared-single-use-refresh-token revocation storm
+ * (RUSH-1957): the pinned run never rotates and never lands on another
+ * routine's credential.
+ */
+export declare function resolveAccountVersion(agent: AgentId, account: string): Promise<string | null>;
 /**
  * Pick a healthy version for `agent` using weighted random by remaining
  * capacity. See `pickBalancedCandidate` for algorithm details.

package/dist/lib/rotate.js

@@ -316,6 +316,34 @@ export async function collectRunCandidates(agent) {
         };
     });
 }
+/**
+ * Resolve an account identity to the installed version slot that holds it, over
+ * an already-collected candidate list. Pure — no I/O — so it is unit-tested
+ * directly. Matches, case-insensitively, against a candidate's login `email`
+ * (the usual form) or its `accountKey`, and only ever returns a signed-in slot.
+ * Returns null when nothing matches, so the caller can fall back and warn.
+ */
+export function matchAccountVersion(candidates, account) {
+    const needle = account.trim().toLowerCase();
+    if (!needle)
+        return null;
+    const match = candidates.find((c) => c.signedIn &&
+        (c.email?.toLowerCase() === needle || c.accountKey?.toLowerCase() === needle));
+    return match?.version ?? null;
+}
+/**
+ * Resolve a routine's `account:` pin (login email or account key) to the
+ * installed version currently holding that account. Thin I/O wrapper over
+ * {@link collectRunCandidates} + {@link matchAccountVersion}; returns null when
+ * no signed-in version matches. Pinning a routine to a distinct account is the
+ * durable cure for the shared-single-use-refresh-token revocation storm
+ * (RUSH-1957): the pinned run never rotates and never lands on another
+ * routine's credential.
+ */
+export async function resolveAccountVersion(agent, account) {
+    const candidates = await collectRunCandidates(agent);
+    return matchAccountVersion(candidates, account);
+}
 /**
  * Pick a healthy version for `agent` using weighted random by remaining
  * capacity. See `pickBalancedCandidate` for algorithm details.

package/dist/lib/routines.d.ts

@@ -111,6 +111,25 @@ export interface JobConfig {
     allow?: JobAllowConfig;
     config?: Record<string, unknown>;
     version?: string;
+    /**
+     * Pin this routine to a signed-in account by identity (its login email, or its
+     * account key) instead of rotating. At launch it resolves to whichever
+     * installed version currently holds that account and runs pinned — no
+     * `balanced` rotation, no usage-read refresh, no failover onto other accounts.
+     *
+     * This is the durable way to keep concurrent unattended routines off a *shared*
+     * Claude OAuth credential: the refresh token is single-use and rotates
+     * server-side on every refresh, so two routines running the same account
+     * concurrently (on one box or across the fleet) mutually revoke each other —
+     * the `401 OAuth access token has been revoked` storm (RUSH-1957). Give each
+     * routine (or each device's routines) a distinct account and no run rotates a
+     * credential out from under another.
+     *
+     * Prefer this over `version:`, which pins a version *number* that is GC'd on
+     * the next agent upgrade — when the pinned version disappears the routine
+     * silently falls back to `balanced` and the stampede returns.
+     */
+    account?: string;
     runOnce?: boolean;
     endAt?: string;
     /**
@@ -251,6 +270,13 @@ export declare function parseTimeout(timeout: string): number | null;
 export declare function listRuns(jobName: string): RunMeta[];
 /** Get the most recent run for a job, or null if never run. */
 export declare function getLatestRun(jobName: string): RunMeta | null;
+/**
+ * Get the most recent COMPLETED run for a job, or null if none has completed.
+ * Used to resolve `{last_report}` so a failed run's error text (e.g. an auth
+ * login prompt written into report.md) can never be injected into the next
+ * run's prompt.
+ */
+export declare function getLatestCompletedRun(jobName: string): RunMeta | null;
 /** Persist run metadata to its run directory as meta.json. */
 export declare function writeRunMeta(meta: RunMeta): void;
 /** Read run metadata from disk. Returns null if missing or corrupt. */

package/dist/lib/routines.js

@@ -536,8 +536,11 @@ export function resolveJobPrompt(config) {
             prompt = prompt.replace(new RegExp(`\\{${key}\\}`, 'g'), value);
         }
     }
-    // Last report (special handling)
-    const latestRun = getLatestRun(config.name);
+    // Last report (special handling). Only a COMPLETED run's report is injected —
+    // a failed run's report.md is the agent's error text (e.g. a login prompt on
+    // an auth failure), and feeding that into the next prompt poisons every
+    // subsequent run until a human intervenes.
+    const latestRun = getLatestCompletedRun(config.name);
     if (latestRun) {
         const reportPath = path.join(getJobRunsDir(config.name), latestRun.runId, 'report.md');
         if (fs.existsSync(reportPath)) {
@@ -595,6 +598,20 @@ export function getLatestRun(jobName) {
     const runs = listRuns(jobName);
     return runs.length > 0 ? runs[runs.length - 1] : null;
 }
+/**
+ * Get the most recent COMPLETED run for a job, or null if none has completed.
+ * Used to resolve `{last_report}` so a failed run's error text (e.g. an auth
+ * login prompt written into report.md) can never be injected into the next
+ * run's prompt.
+ */
+export function getLatestCompletedRun(jobName) {
+    const runs = listRuns(jobName);
+    for (let i = runs.length - 1; i >= 0; i--) {
+        if (runs[i].status === 'completed')
+            return runs[i];
+    }
+    return null;
+}
 /** Persist run metadata to its run directory as meta.json. */
 export function writeRunMeta(meta) {
     ensureAgentsDir();