@phnx-labs/agents-cli 1.20.73 → 1.20.76

package/dist/lib/sqlite.js

@@ -3,8 +3,9 @@
  *
  * Picks `bun:sqlite` under Bun and `node:sqlite` under Node (>=22.5). Avoids
  * the native `better-sqlite3` addon entirely so there is no prebuild compile
- * and no Node/Bun ABI mismatch when the same source runs in tests (Bun) and
- * production (Node).
+ * and no Node/Bun ABI mismatch. Both runtimes are production: `dist/index.js`
+ * runs under Node, while the signed standalone `dist/bin/agents` (what the
+ * shims exec) embeds Bun.
  *
  * Exposes the small better-sqlite3-shaped surface area the rest of the
  * codebase already uses: `prepare/exec/pragma/transaction/close` on the DB,
@@ -21,9 +22,31 @@ const sqliteMod = isBun
 // bun:sqlite exports `Database`; node:sqlite exports `DatabaseSync`.
 const NativeDatabase = sqliteMod.Database
     ?? sqliteMod.DatabaseSync;
+/**
+ * bun:sqlite binds a named-parameter object ONLY when its keys carry the SQL
+ * sigil (`{ '@id': … }` for `VALUES (@id)`); bare keys (`{ id: … }`) match
+ * nothing and every parameter stays NULL, so the first NOT NULL column raises a
+ * constraint error and the write is lost. node:sqlite accepts the bare keys.
+ * `strict: true` makes bun accept them too, so the bare-key call shape this
+ * codebase uses works on both runtimes. node:sqlite has no such option and
+ * rejects a second argument that isn't an object, so the argument list is built
+ * per runtime.
+ *
+ * The two runtimes are still not interchangeable at the edges, and only bun's
+ * half is exercised by the shipped binary rather than by vitest — so keep binds
+ * inside the intersection:
+ *   - omit a named key: bun throws `Missing parameter "x"`, node binds NULL.
+ *   - pass an extra named key: bun accepts it, node throws `Unknown named
+ *     parameter`.
+ *   - use sigil keys (`{'@id': …}`): node accepts them, strict bun rejects them.
+ *   - a single non-plain object positional arg (e.g. `run(new Date())`) reaches
+ *     the named path via bindArgs below and throws under strict bun.
+ */
+const NATIVE_ARGS = isBun ? [{ strict: true }] : [];
 function bindArgs(params) {
     // Both bindings accept positional `(a, b, c)` and named `({ a, b, c })`
-    // forms. Pass an object through unchanged so callers using named binds work.
+    // forms — bun only under `strict: true` (see NATIVE_ARGS). Pass an object
+    // through unchanged so callers using named binds work.
     if (params.length === 1 &&
         params[0] !== null &&
         typeof params[0] === 'object' &&
@@ -51,7 +74,7 @@ class StatementImpl {
 class Database {
     inner;
     constructor(filename) {
-        this.inner = new NativeDatabase(filename);
+        this.inner = new NativeDatabase(filename, ...NATIVE_ARGS);
     }
     prepare(sql) {
         return new StatementImpl(this.inner.prepare(sql));

package/dist/lib/staleness/detectors/commands.js

@@ -1,7 +1,7 @@
 /**
  * Commands detector — mirrors versions.ts:343-357. Inspects the version home,
  * returns command names. Honors the commands-as-skills marker for skills-only
- * agents (grok, kimi, Codex >= 0.117.0, …); falls back to scanning
+ * agents (kimi, Codex >= 0.117.0, …); falls back to scanning
  * `{agentDir}/<commandsSubdir>/` for the native path.
  */
 import * as fs from 'fs';

package/dist/lib/staleness/detectors/workflows.js

@@ -1,12 +1,14 @@
 /**
- * Workflows detector — scans `{versionHome}/workflows/` for subdirectories
- * containing WORKFLOW.md. Mirrors versions.ts:551-558.
+ * Workflows detector — scans the agent-specific on-disk layout for synced
+ * workflow names (Claude WORKFLOW.md trees, Kimi flow skills, Antigravity
+ * global_workflows, Goose recipes, OpenClaw Lobster, Grok Rhai).
  */
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { capableAgents } from '../../capabilities.js';
+import { grokWorkflowMarker } from '../../workflows.js';
 import { lazyAgentMap } from '../writers/lazy-map.js';
 function buildWorkflowsDetector(agent) {
     return {
@@ -93,6 +95,15 @@ function buildWorkflowsDetector(agent) {
                 })
                     .map(d => d.name.slice(0, -'.lobster'.length));
             }
+            if (agent === 'grok') {
+                const workflowsDir = path.join(versionHome, '.grok', 'workflows');
+                if (!fs.existsSync(workflowsDir))
+                    return [];
+                return fs.readdirSync(workflowsDir, { withFileTypes: true })
+                    .filter(d => d.isFile() && d.name.endsWith('.rhai') && !d.name.startsWith('.'))
+                    .filter(d => grokWorkflowMarker(path.join(workflowsDir, d.name)) === d.name.slice(0, -'.rhai'.length))
+                    .map(d => d.name.slice(0, -'.rhai'.length));
+            }
             const workflowsDir = path.join(versionHome, 'workflows');
             if (!fs.existsSync(workflowsDir))
                 return [];

package/dist/lib/staleness/writers/commands.js

@@ -4,10 +4,10 @@
  * Two physical formats, picked per-(agent, version) at write time:
  *
  *  - command-as-skill — fires when `shouldInstallCommandAsSkill(agent, version)`
- *    is true. Used for grok (no native commands, but skills/) and Codex
- *    >= 0.117.0 (commands capability ends, skills capability remains).
- *    Writes `{agentDir}/skills/<name>/SKILL.md` with the `agents_command`
- *    marker; the agent picks it up as a slash-command equivalent.
+ *    is true. Used for Codex >= 0.117.0 (commands capability ends, skills
+ *    capability remains) and agents with skills but no native command-file dir
+ *    such as kimi. Writes `{agentDir}/skills/<name>/SKILL.md` with the
+ *    `agents_command` marker; the agent picks it up as a slash-command equivalent.
  *
  *  - native command file — `{agentDir}/<commandsSubdir>/<name>.md` (or .toml
  *    when the agent's format is toml). Standard path for Claude, Codex
@@ -83,8 +83,8 @@ function buildCommandsWriter(agent) {
 // Built lazily on first access — see lazy-map.ts for the cycle rationale.
 //
 // Registration covers two cases:
-//   - native commands (claude, codex < 0.117.0, gemini, etc.) — `commands` cap
-//   - commands-as-skills (grok, codex >= 0.117.0)
+//   - native commands (claude, codex < 0.117.0, gemini, grok, etc.) — `commands` cap
+//   - commands-as-skills (kimi, codex >= 0.117.0)
 //
 // Agents that have skills but use a NATIVE non-file slash-command system
 // (openclaw → Gateway-based commands) are NOT registered. They declare
@@ -97,7 +97,7 @@ export const commandsWriters = lazyAgentMap(() => {
         if (cfg.capabilities.commands === false && (!cfg.skillsDir || cfg.skillsDir === ''))
             continue;
         // Skills-capable agent with no native command-file dir: convert commands to
-        // skills by default (grok, kimi, …). Opt out only agents with their own
+        // skills by default (kimi, …). Opt out only agents with their own
         // slash-command runtime (openclaw).
         if (cfg.capabilities.commands === false && (!cfg.commandsSubdir || cfg.commandsSubdir === '')) {
             if (cfg.nativeCommandRuntime)

package/dist/lib/staleness/writers/workflows.d.ts

@@ -1,6 +1,8 @@
 /**
- * Workflows writer — copies each workflow directory into
- * `<versionHome>/workflows/<name>/` via `syncWorkflowToVersion`.
+ * Workflows writer — copies each selected workflow into the agent-specific
+ * on-disk layout via `syncWorkflowToVersion` (Claude: WORKFLOW.md tree under
+ * `{versionHome}/workflows/`; Grok: native `.rhai` under
+ * `{versionHome}/.grok/workflows/`).
  */
 import type { AgentId } from '../../types.js';
 import type { ResourceWriter } from './types.js';

package/dist/lib/startup/command-registry.d.ts

@@ -41,6 +41,7 @@ export declare const loadWorkflows: ModuleLoader;
 export declare const loadWorktree: ModuleLoader;
 export declare const loadVersions: ModuleLoader;
 export declare const loadImport: ModuleLoader;
+export declare const loadExport: ModuleLoader;
 export declare const loadPackages: ModuleLoader;
 export declare const loadRoutines: ModuleLoader;
 export declare const loadMonitors: ModuleLoader;
@@ -56,6 +57,7 @@ export declare const loadApply: ModuleLoader;
 export declare const loadCheck: ModuleLoader;
 export declare const loadStatus: ModuleLoader;
 export declare const loadProfiles: ModuleLoader;
+export declare const loadHarness: ModuleLoader;
 export declare const loadSecrets: ModuleLoader;
 export declare const loadLogin: ModuleLoader;
 export declare const loadWallet: ModuleLoader;

package/dist/lib/startup/command-registry.js

@@ -19,6 +19,7 @@ export const loadWorkflows = async () => (await import('../../commands/workflows
 export const loadWorktree = async () => (await import('../../commands/worktree.js')).registerWorktreeCommands;
 export const loadVersions = async () => (await import('../../commands/versions.js')).registerVersionsCommands;
 export const loadImport = async () => (await import('../../commands/import.js')).registerImportCommand;
+export const loadExport = async () => (await import('../../commands/export.js')).registerExportCommand;
 export const loadPackages = async () => (await import('../../commands/packages.js')).registerPackagesCommands;
 export const loadRoutines = async () => (await import('../../commands/routines.js')).registerRoutinesCommands;
 export const loadMonitors = async () => (await import('../../commands/monitors.js')).registerMonitorsCommands;
@@ -34,6 +35,7 @@ export const loadApply = async () => (await import('../../commands/apply.js')).r
 export const loadCheck = async () => (await import('../../commands/check.js')).registerCheckCommand;
 export const loadStatus = async () => (await import('../../commands/status.js')).registerStatusCommand;
 export const loadProfiles = async () => (await import('../../commands/profiles.js')).registerProfilesCommands;
+export const loadHarness = async () => (await import('../../commands/harness.js')).registerHarnessCommands;
 export const loadSecrets = async () => (await import('../../commands/secrets.js')).registerSecretsCommands;
 export const loadLogin = async () => (await import('../../commands/login.js')).registerLoginCommands;
 export const loadWallet = async () => (await import('../../commands/wallet.js')).registerWalletCommands;
@@ -127,6 +129,7 @@ export const COMMAND_LOADERS = {
     purge: [loadVersions],
     prune: [loadVersions, loadPrune],
     import: [loadImport],
+    export: [loadExport],
     registry: [loadPackages],
     search: [loadPackages],
     install: [loadPackages],
@@ -144,6 +147,8 @@ export const COMMAND_LOADERS = {
     status: [loadStatus],
     profile: [loadProfiles],
     profiles: [loadProfiles],
+    harness: [loadHarness],
+    harnesses: [loadHarness],
     secrets: [loadSecrets],
     login: [loadLogin],
     logout: [loadLogin],

package/dist/lib/state.d.ts

@@ -165,7 +165,7 @@ export declare function getDriveDir(): string;
 export declare function getTrashDir(): string;
 /** Path to local session indexer storage (~/.agents/.history/sessions/). */
 export declare function getSessionsDir(): string;
-/** Path to the session index database (~/.agents/.history/sessions.db). */
+/** Path to the session index database (~/.agents/.history/sessions/sessions.db). */
 export declare function getSessionsDbPath(): string;
 /** Path to teams config + registry (~/.agents/teams/). */
 export declare function getTeamsDir(): string;

package/dist/lib/state.js

@@ -27,7 +27,6 @@ import * as path from 'path';
 import * as os from 'os';
 import * as yaml from 'yaml';
 import { ensureLockTarget, atomicWriteFileSync, withFileLock } from './fs-atomic.js';
-import { SEEDED_REGISTRIES } from './types.js';
 import { machineId } from './machine-id.js';
 const HOME = process.env.HOME ?? os.homedir();
 /**
@@ -376,7 +375,7 @@ export function getDriveDir() { return DRIVE_DIR; }
 export function getTrashDir() { return TRASH_DIR; }
 /** Path to local session indexer storage (~/.agents/.history/sessions/). */
 export function getSessionsDir() { return SESSIONS_DIR; }
-/** Path to the session index database (~/.agents/.history/sessions.db). */
+/** Path to the session index database (~/.agents/.history/sessions/sessions.db). */
 export function getSessionsDbPath() { return SESSIONS_DB_PATH; }
 /** Path to teams config + registry (~/.agents/teams/). */
 export function getTeamsDir() { return TEAMS_DIR; }
@@ -606,18 +605,25 @@ function writeIfChanged(filePath, content) {
  * `agents:` / `versions:` are not written (no empty committed files).
  */
 function writeMetaUnlocked(meta) {
-    const { agents, versions, defaultBrowserProfile, ...central } = meta;
+    const { agents, isolatedAgents, versions, defaultBrowserProfile, ...central } = meta;
     // Write the machine-local files FIRST, then strip central — so a crash mid-write
     // never removes pins/versions from central before they're persisted elsewhere.
     const devicePath = getDeviceMetaPath();
     const hasAgents = !!agents && Object.keys(agents).length > 0;
+    // The isolated pointer names a version installed on THIS machine, exactly like a
+    // global pin, so it belongs beside `agents:` in the device file rather than in the
+    // central doc that syncs — otherwise another machine inherits a pointer to a copy
+    // it does not have.
+    const hasIsolatedAgents = !!isolatedAgents && Object.keys(isolatedAgents).length > 0;
     const hasDefaultBrowser = !!defaultBrowserProfile;
-    if (hasAgents || hasDefaultBrowser) {
+    if (hasAgents || hasIsolatedAgents || hasDefaultBrowser) {
         // Device-local doc carries `agents:` pins and `defaultBrowserProfile:` — both
         // are per-machine and must never land in central agents.yaml (which syncs).
         const deviceDoc = {};
         if (hasAgents)
             deviceDoc.agents = agents;
+        if (hasIsolatedAgents)
+            deviceDoc.isolatedAgents = isolatedAgents;
         if (hasDefaultBrowser)
             deviceDoc.defaultBrowserProfile = defaultBrowserProfile;
         fs.mkdirSync(path.dirname(devicePath), { recursive: true });
@@ -640,8 +646,9 @@ function writeMetaUnlocked(meta) {
 }
 /**
  * Overlay this machine's local state onto a central-portable Meta:
- *   - `agents:` from the device file (device wins; the union both preserves the
- *     one-level merge and self-heals a pre-migration central that still has pins)
+ *   - `agents:` and `isolatedAgents:` from the device file (device wins; the union
+ *     both preserves the one-level merge and self-heals a pre-migration central that
+ *     still has pins)
  *   - `defaultBrowserProfile:` from the device file (device is the sole source;
  *     the field is stripped from central on write, so nothing to merge against)
  *   - `versions:` from the history JSON (wholesale replace; falls back to
@@ -654,6 +661,8 @@ function overlayMachineLocal(meta) {
             const dm = yaml.parse(fs.readFileSync(devicePath, 'utf-8'));
             if (dm?.agents)
                 meta.agents = { ...meta.agents, ...dm.agents };
+            if (dm?.isolatedAgents)
+                meta.isolatedAgents = { ...meta.isolatedAgents, ...dm.isolatedAgents };
             if (dm?.defaultBrowserProfile)
                 meta.defaultBrowserProfile = dm.defaultBrowserProfile;
         }
@@ -670,29 +679,6 @@ function overlayMachineLocal(meta) {
     }
     return meta;
 }
-function applyRegistrySeeds(meta) {
-    const seeded = new Set(meta.seededPresets || []);
-    let changed = false;
-    for (const [type, presets] of Object.entries(SEEDED_REGISTRIES)) {
-        for (const [name, config] of Object.entries(presets)) {
-            const key = `${type}.${name}`;
-            if (seeded.has(key))
-                continue;
-            if (!meta.registries)
-                meta.registries = { mcp: {}, skill: {} };
-            if (!meta.registries[type])
-                meta.registries[type] = {};
-            if (!meta.registries[type][name]) {
-                meta.registries[type][name] = { ...config };
-            }
-            seeded.add(key);
-            changed = true;
-        }
-    }
-    if (changed)
-        meta.seededPresets = [...seeded];
-    return changed;
-}
 /**
  * One-shot migration: move agents.yaml from system repo to user repo.
  * Idempotent — no-ops if user file already exists or system file absent.
@@ -803,17 +789,10 @@ export function readMeta() {
             };
         }
         overlayMachineLocal(meta);
-        if (applyRegistrySeeds(meta)) {
-            writeMeta(meta);
-            return rememberMeta(meta);
-        }
         return rememberMeta(meta);
     }
     const meta = createDefaultMeta();
     overlayMachineLocal(meta);
-    if (applyRegistrySeeds(meta)) {
-        writeMeta(meta);
-    }
     return rememberMeta(meta);
 }
 /** Serialize and write agents.yaml to the user repo, invalidating the in-memory cache. */

package/dist/lib/teams/agents.d.ts

@@ -1,3 +1,4 @@
+import { captureProcessStartTime } from '../platform/index.js';
 import { AgentType } from './parsers.js';
 /**
  * Compute the Lowest Common Ancestor (LCA) of multiple file paths.
@@ -26,18 +27,25 @@ export type { AgentType } from './parsers.js';
  */
 export declare function buildSentinelCommand(cmd: string[], exitCodePath: string): string;
 /**
- * Capture a stable identifier for a process at the moment it was started.
- * Used to defeat PID reuse: a kill(pid, ...) is only safe when the process
- * still occupies the PID we observed at spawn time. A bare kill(pid, 0)
- * probe cannot tell whether the OS has recycled the slot to an unrelated
- * process — combined with detached spawns and unref(), that's exactly how
- * `agents teams stop` ends up SIGKILLing random process groups.
+ * Env for a locally-spawned teammate. Freezes ONE actor for the whole spawn
+ * tree: actorEnv(resolveActor()) stamps AGENTS_ACTOR* onto the child env, so the
+ * teammate's inner `agents run` reads it via inheritedActor and short-circuits
+ * computeActor instead of re-resolving — every teammate under one orchestrator
+ * shares the orchestrator's single frozen actor (see actor.ts). Precedence:
+ * process env < actor < the teammate's --env overrides, so an explicit override
+ * still wins. Single source of truth shared by launchProcess() and its test.
+ */
+export declare function buildTeammateSpawnEnv(envOverrides: Record<string, string> | null): NodeJS.ProcessEnv;
+/**
+ * Re-exported from `platform/process.ts`, which owns the one implementation.
  *
- * Linux:  field 22 of /proc/<pid>/stat (starttime in clock ticks since boot).
- * macOS:  output of `ps -o lstart= -p <pid>` (start time in human format).
- * Returns null on any error so callers can skip the guard rather than crash.
+ * This module used to carry its own near-identical copy, and that copy had no
+ * Windows branch — it fell through to `ps`, which does not exist there, so
+ * `captureProcessStartTime` always returned null and the pid-reuse guard at
+ * `stop()` was silently inert on Windows. That is exactly how `agents teams stop`
+ * ends up SIGKILLing an unrelated process group once the OS recycles a pid.
  */
-export declare function captureProcessStartTime(pid: number): string | null;
+export { captureProcessStartTime };
 /**
  * Reasoning-intensity knob. Passed through to `agents run --effort`, which
  * translates it into per-agent reasoning flags (claude --effort, codex
@@ -130,6 +138,7 @@ export declare class AgentProcess {
     startedAt: Date;
     completedAt: Date | null;
     parentSessionId: string | null;
+    actor: string | null;
     cloudSessionId: string | null;
     cloudProvider: string | null;
     prUrl: string | null;

package/dist/lib/teams/agents.js

@@ -7,7 +7,7 @@
  * dependency scheduling via --after, per-teammate model/effort overrides, and
  * multiple permission modes (plan, edit, full).
  */
-import { spawn, execSync, execFileSync } from 'child_process';
+import { spawn, execSync } from 'child_process';
 import { getAgentsInvocation } from '../daemon.js';
 import * as fs from 'fs/promises';
 import * as fsSync from 'fs';
@@ -15,7 +15,7 @@ import * as path from 'path';
 import * as os from 'os';
 import { randomUUID } from 'crypto';
 import { resolveAgentsDir } from './persistence.js';
-import { findExecutable } from '../platform/index.js';
+import { findExecutable, captureProcessStartTime } from '../platform/index.js';
 import { normalizeEvents } from './parsers.js';
 import { debug } from './debug.js';
 import { setGeminiAutoUpdateDisabled, updateGeminiSettings } from '../gemini-settings.js';
@@ -23,6 +23,7 @@ import { getAgentsDir as getSystemAgentsDir, getShimsDir } from '../state.js';
 import { AGENTS, getAccountInfo } from '../agents.js';
 import { resolveVersion, isVersionInstalled, verifyInstalledBinaryLaunches } from '../versions.js';
 import { sanitizeProcessEnv } from '../secrets/bundles.js';
+import { resolveActor, actorEnv } from '../actor.js';
 import { recordRunName } from '../session/run-names.js';
 import { sshExec, shellQuote } from '../ssh-exec.js';
 import { resolveHost } from '../hosts/registry.js';
@@ -169,42 +170,31 @@ export function buildSentinelCommand(cmd, exitCodePath) {
     return `${cmd.map(shSingleQuote).join(' ')}; echo $? > ${shSingleQuote(exitCodePath)}`;
 }
 /**
- * Capture a stable identifier for a process at the moment it was started.
- * Used to defeat PID reuse: a kill(pid, ...) is only safe when the process
- * still occupies the PID we observed at spawn time. A bare kill(pid, 0)
- * probe cannot tell whether the OS has recycled the slot to an unrelated
- * process — combined with detached spawns and unref(), that's exactly how
- * `agents teams stop` ends up SIGKILLing random process groups.
- *
- * Linux:  field 22 of /proc/<pid>/stat (starttime in clock ticks since boot).
- * macOS:  output of `ps -o lstart= -p <pid>` (start time in human format).
- * Returns null on any error so callers can skip the guard rather than crash.
+ * Env for a locally-spawned teammate. Freezes ONE actor for the whole spawn
+ * tree: actorEnv(resolveActor()) stamps AGENTS_ACTOR* onto the child env, so the
+ * teammate's inner `agents run` reads it via inheritedActor and short-circuits
+ * computeActor instead of re-resolving — every teammate under one orchestrator
+ * shares the orchestrator's single frozen actor (see actor.ts). Precedence:
+ * process env < actor < the teammate's --env overrides, so an explicit override
+ * still wins. Single source of truth shared by launchProcess() and its test.
  */
-export function captureProcessStartTime(pid) {
-    if (!pid || pid <= 0)
-        return null;
-    try {
-        if (process.platform === 'linux') {
-            const stat = fsSync.readFileSync(`/proc/${pid}/stat`, 'utf-8');
-            const lastParen = stat.lastIndexOf(')');
-            if (lastParen < 0)
-                return null;
-            const tail = stat.slice(lastParen + 2);
-            const fields = tail.split(' ');
-            // After comm we are at field 3; starttime is field 22, so index 19 here.
-            return fields[19] || null;
-        }
-        const out = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
-            encoding: 'utf-8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        const trimmed = out.trim();
-        return trimmed.length > 0 ? trimmed : null;
-    }
-    catch {
-        return null;
-    }
+export function buildTeammateSpawnEnv(envOverrides) {
+    return {
+        ...sanitizeProcessEnv(process.env),
+        ...actorEnv(resolveActor()),
+        ...(envOverrides ?? {}),
+    };
 }
+/**
+ * Re-exported from `platform/process.ts`, which owns the one implementation.
+ *
+ * This module used to carry its own near-identical copy, and that copy had no
+ * Windows branch — it fell through to `ps`, which does not exist there, so
+ * `captureProcessStartTime` always returned null and the pid-reuse guard at
+ * `stop()` was silently inert on Windows. That is exactly how `agents teams stop`
+ * ends up SIGKILLing an unrelated process group once the OS recycles a pid.
+ */
+export { captureProcessStartTime };
 /** Agent types the team runner supports. */
 const TEAM_AGENT_TYPES = ['codex', 'cursor', 'gemini', 'claude', 'opencode', 'grok', 'antigravity', 'kimi', 'droid'];
 // Suffix appended to all prompts to ensure agents provide a summary
@@ -479,6 +469,12 @@ export class AgentProcess {
     startedAt = new Date();
     completedAt = null;
     parentSessionId = null;
+    // Frozen actor (resolveActor().id) this teammate runs under. Stamped onto the
+    // local spawn env via actorEnv (buildTeammateSpawnEnv) so the teammate's inner
+    // `agents run` inherits one actor for the whole tree instead of re-resolving,
+    // and persisted so the record shows who ran it. Set from the resolved actor at
+    // construction; loadFromDisk restores the persisted value.
+    actor = null;
     cloudSessionId = null;
     cloudProvider = null;
     prUrl = null;
@@ -564,6 +560,7 @@ export class AgentProcess {
         this.completedAt = completedAt;
         this.baseDir = baseDir;
         this.parentSessionId = parentSessionId;
+        this.actor = resolveActor().id;
         this.cloudSessionId = cloudSessionId;
         this.cloudProvider = cloudProvider;
         this.prUrl = prUrl;
@@ -628,6 +625,7 @@ export class AgentProcess {
             duration: this.duration(),
             mode: this.mode,
             parent_session_id: this.parentSessionId,
+            actor: this.actor,
             workspace_dir: this.workspaceDir,
             cloud_session_id: this.cloudSessionId,
             cloud_provider: this.cloudProvider,
@@ -884,6 +882,7 @@ export class AgentProcess {
             started_at: this.startedAt.toISOString(),
             completed_at: this.completedAt?.toISOString() || null,
             parent_session_id: this.parentSessionId,
+            actor: this.actor,
             cloud_session_id: this.cloudSessionId,
             cloud_provider: this.cloudProvider,
             pr_url: this.prUrl,
@@ -948,6 +947,10 @@ export class AgentProcess {
                 ? meta.task_type
                 : null, meta.cloud_repo || null, meta.cloud_branch || null, meta.worktree_name || null, meta.worktree_path || null, meta.profile_name || null);
             agent.startTime = typeof meta.start_time === 'string' ? meta.start_time : null;
+            // The persisted actor is the truth for a reload; the constructor set it to
+            // THIS process's resolved actor, which is wrong for a teammate someone else
+            // ran. Legacy teammates predating the field carry no actor -> null.
+            agent.actor = meta.actor ?? null;
             // Distributed-team fields: set post-construction (like startTime) so the
             // constructor signature stays fixed. Null on every pre-existing teammate.
             agent.hostName = meta.host_name || null;
@@ -1556,9 +1559,7 @@ export class AgentManager {
                 stdio: ['ignore', stdoutFd, stdoutFd],
                 cwd: agent.cwd || undefined,
                 detached: true,
-                env: agent.envOverrides
-                    ? { ...sanitizeProcessEnv(process.env), ...agent.envOverrides }
-                    : sanitizeProcessEnv(process.env),
+                env: buildTeammateSpawnEnv(agent.envOverrides),
             });
             await new Promise((resolve, reject) => {
                 childProcess.once('spawn', resolve);

package/dist/lib/types.d.ts

@@ -689,9 +689,40 @@ export interface BrandConfig {
     /** False to keep the config but stop minting/using the brand. */
     enabled: boolean;
 }
+/**
+ * An actor -- a responsible entity behind a run (a human today, a top-level
+ * agent later). Keyed in the `actors:` map by a short slug. Every field is
+ * optional enrichment over what `tailscale whois` already resolves: pin a
+ * preferred git email, add a github handle, or override the display name.
+ * `login` is the tailnet login-name to match against (defaults to the map key).
+ * See lib/actor.ts.
+ */
+export interface ActorConfig {
+    /** 'human' (default) or 'agent'. Only humans get personal git credit. */
+    kind?: 'human' | 'agent';
+    /** Display + git author name. Overrides the tailnet DisplayName. */
+    name?: string;
+    /** Git author email. Overrides the tailnet login email. */
+    email?: string;
+    /** GitHub handle, for PR attribution. */
+    github?: string;
+    /** Tailnet login-name this entry matches. Defaults to the map key. */
+    login?: string;
+}
 /** Top-level structure of ~/.agents/.system/agents.yaml -- the CLI's persistent state. */
 export interface Meta {
     agents?: Partial<Record<AgentId, string>>;
+    /**
+     * Per-agent preferred ISOLATED version — which copy a bare `agents run <agent>`
+     * resolves to when the agent has no global default.
+     *
+     * Kept separate from `agents` on purpose. An entry there is the global default,
+     * which owns the launcher, the bare shim and the real `~/.<agent>` config
+     * symlink, and arms the self-heal `shadowing` check. An isolated copy must never
+     * acquire any of that, so it cannot be recorded in the same place — the
+     * separation is what keeps `getGlobalDefault` incapable of returning one.
+     */
+    isolatedAgents?: Partial<Record<AgentId, string>>;
     run?: RunConfig;
     /**
      * `agents run --lease` config. `secretsBundle` names the keychain secrets bundle
@@ -754,8 +785,23 @@ export interface Meta {
      */
     brands?: Record<string, BrandConfig>;
     /**
-     * Keys like `skill.hermes` — registries seeded from SEEDED_REGISTRIES exactly
-     * once. Tracked so a user `registry remove` won't silently re-seed.
+     * Actors keyed by slug -- who is behind a run. Enriches or overrides the
+     * identity `tailscale whois` resolves (git email, github handle, display
+     * name, human vs agent). See lib/actor.ts.
+     */
+    actors?: Record<string, ActorConfig>;
+    /**
+     * Removal tombstones for SEEDED_REGISTRIES presets, keyed like `skill.hermes`.
+     *
+     * Seeded presets are resolved in memory by `getRegistries` (see
+     * `offeredSeeds`) rather than written into agents.yaml — persisting them from
+     * the read path dirtied this git-tracked file and deadlocked
+     * `agents repo pull` (RUSH-1925). A key listed here means the user ran
+     * `registry remove` on that preset, so it is no longer offered.
+     *
+     * Entries written by the pre-RUSH-1925 seeding also appear here; those files
+     * carry the registry in their own `registries:` block too, which takes
+     * precedence, so the preset stays exactly as configured.
      */
     seededPresets?: string[];
     /**

package/dist/lib/uninstall.js

@@ -20,6 +20,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { AGENTS, ALL_AGENT_IDS } from './agents.js';
 import { getAgentConfigPath, getConfigSymlinkVersion, stripShimPathLines, releaseAdoptedLauncher, } from './shims.js';
+import { moveDirCrossDevice, copyDirStrippingAgentsSymlinks } from './config-transfer.js';
 import { getUserAgentsDir, getBackupsDir, getHistoryDir, getShimsDir, getLegacySystemAgentsDir, } from './state.js';
 /** Home dir honoring the AGENTS_REAL_HOME test/override, mirroring shims.ts. */
 function realHome() {
@@ -60,51 +61,6 @@ function symlinkTarget(p) {
 function removeLink(p) {
     fs.unlinkSync(p);
 }
-/**
- * Move `source` onto `dest` across possibly-different volumes. `renameSync` is
- * atomic but throws EXDEV when `~/.agents` lives on a different filesystem than
- * `$HOME`; fall back to copy-then-remove so the restore still completes. The
- * source (a backup inside `~/.agents`) is removed only after the copy succeeds,
- * so a mid-copy failure never destroys the sole surviving copy.
- */
-function moveDirCrossDevice(source, dest) {
-    try {
-        fs.renameSync(source, dest);
-    }
-    catch (err) {
-        if (err.code !== 'EXDEV')
-            throw err;
-        fs.cpSync(source, dest, { recursive: true });
-        fs.rmSync(source, { recursive: true, force: true });
-    }
-}
-/**
- * Copy `source` to `dest`, dropping any symlink whose target resolves back into
- * `~/.agents`. Adoption syncs managed resources (skills/commands) into the
- * version home as symlinks into `~/.agents`; copying them verbatim would leave
- * the restored config full of links that dangle the moment `~/.agents` is
- * disposed. Stripping them yields a clean, self-contained restore.
- */
-function copyDirStrippingAgentsSymlinks(source, dest, agentsDir) {
-    const inside = agentsDir + path.sep;
-    fs.cpSync(source, dest, {
-        recursive: true,
-        filter: (src) => {
-            try {
-                const st = fs.lstatSync(src);
-                if (st.isSymbolicLink()) {
-                    const tgt = path.resolve(path.dirname(src), fs.readlinkSync(src));
-                    if (tgt === agentsDir || tgt.startsWith(inside))
-                        return false;
-                }
-            }
-            catch {
-                /* unreadable entry — let cpSync surface it on the real copy */
-            }
-            return true;
-        },
-    });
-}
 /** Classify one agent's config dir without mutating anything. */
 function planConfig(agent) {
     const realPath = getAgentConfigPath(agent);