@phnx-labs/agents-cli 1.20.74 → 1.20.76

package/dist/commands/watchdog.js

@@ -8,41 +8,41 @@
  *
  *   agents watchdog                    one tick, dry — prints what it WOULD nudge/skip and why
  *   agents watchdog --nudge            one tick, actually injects (explicit opt-in)
- *   agents watchdog --watch            daemon loop (poll every --interval)
+ *   agents watchdog --watch            manual poll loop (dry unless --nudge)
  *   agents watchdog --json             machine-readable tick output (for the menu-bar)
- *   agents watchdog enable|disable     flip the global auto-nudge sentinel (default OFF)
+ *   agents watchdog enable|disable     turn the always-on watchdog routine on/off
  *   agents watchdog policy <id> <p>    per-session policy: off | keep | handsoff
+ *
+ * The always-on watchdog is a daemon-fired ROUTINE, not a private sentinel + a
+ * hand-rolled loop: `enable` creates/enables a `watchdog` command routine
+ * (`agents watchdog --nudge` every couple of minutes) and reloads the daemon;
+ * `disable` pauses it. See ../lib/watchdog/routine.ts.
  */
 import chalk from 'chalk';
-import * as fs from 'fs';
 import * as path from 'path';
 import { setHelpSections } from '../lib/help.js';
 import { parseDuration } from '../lib/hooks/cache.js';
 import { getRuntimeStateDir } from '../lib/state.js';
+import { setJobEnabled } from '../lib/routines.js';
+import { ensureWatchdogRoutine, isWatchdogRoutineEnabled, watchdogRoutineExists, WATCHDOG_ROUTINE_NAME, WATCHDOG_ROUTINE_SCHEDULE, } from '../lib/watchdog/routine.js';
 import { runWatchdogTick, writePolicySentinel, DEFAULT_THRESHOLDS, } from '../lib/watchdog/runner.js';
 /** Default state dir the runner and these subcommands share. */
 function stateDir() {
     return path.join(getRuntimeStateDir(), 'watchdog');
 }
-/** Global auto-nudge sentinel — present = enabled. Default OFF (opt-in). */
-function enabledSentinelPath() {
-    return path.join(stateDir(), 'enabled');
-}
-function isGloballyEnabled() {
-    return fs.existsSync(enabledSentinelPath());
-}
-function setGloballyEnabled(on) {
-    const p = enabledSentinelPath();
-    if (on) {
-        fs.mkdirSync(path.dirname(p), { recursive: true });
-        fs.writeFileSync(p, 'enabled\n');
-    }
-    else {
-        try {
-            fs.rmSync(p);
-        }
-        catch { /* already off */ }
+/**
+ * (Re)load the daemon so a just-changed routine takes effect without a restart.
+ * Best-effort: enabling starts the daemon if it is not running, then SIGHUPs it.
+ * Dynamic import keeps daemon.ts's heavy deps off the watchdog command's load path.
+ */
+async function reloadDaemonForRoutine(startIfStopped) {
+    const { isDaemonRunning, ensureDaemonStarted, signalDaemonReload } = await import('../lib/daemon.js');
+    if (isDaemonRunning()) {
+        signalDaemonReload();
+        return;
     }
+    if (startIfStopped)
+        ensureDaemonStarted();
 }
 /** Parse a duration flag ("60s", "5m", "1h") to ms, or fall back to `fallbackMs`. */
 function durationMsOr(raw, fallbackMs) {
@@ -97,7 +97,7 @@ export function registerWatchdogCommand(program) {
         .command('watchdog')
         .description('Auto-nudge stalled agent terminals: detect stalls, resolve the exact split, inject "Continue." — no menu-bar needed.')
         .option('--nudge', 'Actually inject (default is a dry run that only reports what it would do)')
-        .option('--watch', 'Daemon loop: run a tick every --interval until interrupted')
+        .option('--watch', 'Manual poll loop: run a tick every --interval (dry unless --nudge; the always-on path is `watchdog enable`)')
         .option('--interval <dur>', 'Poll interval in --watch mode (e.g. 30s, 1m)', '30s')
         .option('--stall <dur>', 'Idle time before a session counts as stalled', humanMs(DEFAULT_THRESHOLDS.stallMs))
         .option('--cooldown <dur>', 'Minimum time between nudges to the same session', humanMs(DEFAULT_THRESHOLDS.cooldownMs))
@@ -113,12 +113,11 @@ export function registerWatchdogCommand(program) {
             cooldownMs: durationMsOr(opts.cooldown, DEFAULT_THRESHOLDS.cooldownMs),
             dormantMs: durationMsOr(opts.dormant, DEFAULT_THRESHOLDS.dormantMs),
         };
-        // Injection gate: --nudge is the explicit per-run opt-in; the global sentinel
-        // enables the automatic daemon. Default OFF: bare `agents watchdog` is dry.
-        // Re-read the sentinel every tick so a running `--watch` daemon reflects a
-        // later `agents watchdog enable`/`disable` (or the Swift menu-bar toggle)
-        // from another shell without a restart.
-        const computeWillInject = () => opts.nudge === true || (opts.watch === true && isGloballyEnabled());
+        // Injection gate: --nudge is the explicit opt-in to actually inject. Bare
+        // `agents watchdog` (and `--watch` without `--nudge`) is dry. The always-on
+        // path is the daemon routine, which runs `agents watchdog --nudge` — so the
+        // routine's enabled state IS the on/off switch, not a flag read here.
+        const computeWillInject = () => opts.nudge === true;
         const tickOnce = async (willInject) => runWatchdogTick({
             nudge: willInject,
             nudgeText: opts.text,
@@ -137,11 +136,11 @@ export function registerWatchdogCommand(program) {
                 printTick(result, willInject);
             return;
         }
-        // Daemon loop.
+        // Manual poll loop (for ad-hoc use; the always-on path is `enable`'s routine).
         const intervalMs = durationMsOr(opts.interval, 30_000);
         if (!computeWillInject() && !opts.json) {
-            console.log(chalk.yellow(`watchdog --watch is DETECT-ONLY (global auto-nudge is ${isGloballyEnabled() ? 'on' : 'off'}). ` +
-                `Pass --nudge or run 'agents watchdog enable' to inject.`));
+            console.log(chalk.yellow(`watchdog --watch is DETECT-ONLY. Pass --nudge to inject, ` +
+                `or run 'agents watchdog enable' for the always-on daemon routine.`));
         }
         // eslint-disable-next-line no-constant-condition
         while (true) {
@@ -163,50 +162,67 @@ export function registerWatchdogCommand(program) {
       # One tick, actually inject "Continue." into stalled+addressable splits
       agents watchdog --nudge
 
-      # Watch loop every 30s, tighter stall threshold
-      agents watchdog --watch --interval 30s --stall 60s --cooldown 5m
+      # Manual watch loop every 30s, tighter stall threshold (ad-hoc; dry unless --nudge)
+      agents watchdog --watch --nudge --interval 30s --stall 60s --cooldown 5m
 
       # Machine-readable for the menu-bar
       agents watchdog --json
 
-      # Turn on the global auto-nudge (so --watch injects without --nudge)
+      # Turn on the ALWAYS-ON watchdog (a daemon-fired routine)
       agents watchdog enable
 
       # Leave one session detected-but-untouched
       agents watchdog policy <sessionId> handsoff
     `,
         notes: `
-      Decision path (default, deterministic): a session is nudged only when its
-      transcript tail shows it ANNOUNCED an action but no tool call followed
-      (promise-without-toolcall) AND it is not waiting on the user. Completions and
-      open questions are skipped.
+      Decision path: a cheap deterministic pre-filter resolves the obvious cases
+      (clearly complete -> skip; a clear promise-without-toolcall -> nudge) and
+      ESCALATES the judgment-heavy cases -- a session parked on a question, or an
+      ambiguous stall -- to a smart brain. The brain drives the agent to finish
+      end-to-end when it asked a needless / already-authorized question or paused
+      with work left, and leaves it for the human on genuine cases (credentials,
+      an irreversible or outward-facing action, a real ambiguous decision, or a
+      completed task). The brain is a customizable 'watchdog' workflow (drop a
+      WORKFLOW.md in project/user workflows/ to override the prompt + model);
+      absent one, the built-in prompt runs via 'agents run --mode plan'. Pass
+      --smart to force every stalled candidate through the brain.
 
-      Safety gate: a nudge is delivered ONLY when the resolver can name the EXACT
-      split the agent lives in (tmux / iTerm / IDE terminal). Un-addressable stalls
-      (e.g. Ghostty with no tmux) are flagged for the menu-bar and SKIPPED — never
-      a guessed or frontmost target.
+      Delivery (answer-router): a running agent is steered via its mailbox; a
+      parked-on-question agent is answered into its EXACT split -- tmux / iTerm /
+      an IDE integrated terminal (VS Codium / Cursor / VS Code) -- or re-entered
+      via resume when headless. A parked agent with no addressable rail (e.g.
+      Ghostty with no tmux) is flagged for the menu-bar and SKIPPED -- never a
+      guessed or frontmost target.
 
-      Policy: global auto-nudge defaults OFF (opt-in via 'enable' or --nudge).
-      Per-session: off (ignore), keep (default), handsoff (detect + flag, never inject).
+      Always-on: 'agents watchdog enable' creates + enables a 'watchdog' command
+      routine ('${WATCHDOG_ROUTINE_SCHEDULE}' -> agents watchdog --nudge) and reloads the
+      daemon; 'disable' pauses it. Inspect it with 'agents routines list'. Defaults
+      OFF. Per-session policy: off (ignore), keep (default), handsoff (detect + flag).
 
       State (tray-readable): ${path.join('~/.agents/.cache/state/watchdog', '{nudges,flags,last-tick}.json')}
     `,
     });
-    // --- global enable/disable/status -----------------------------------------
+    // --- always-on enable/disable/status (backed by the daemon routine) --------
     cmd.command('enable')
-        .description('Turn ON global auto-nudge (so `agents watchdog --watch` injects without --nudge).')
-        .action(() => {
-        setGloballyEnabled(true);
-        console.log(chalk.green('watchdog: global auto-nudge ENABLED'));
+        .description('Turn ON the always-on watchdog: create/enable the `watchdog` routine and (re)load the daemon.')
+        .action(async () => {
+        ensureWatchdogRoutine(true);
+        await reloadDaemonForRoutine(true);
+        console.log(chalk.green(`watchdog: ENABLED — routine '${WATCHDOG_ROUTINE_NAME}' fires ${WATCHDOG_ROUTINE_SCHEDULE} (agents watchdog --nudge)`));
     });
     cmd.command('disable')
-        .description('Turn OFF global auto-nudge (back to detect-only unless --nudge is passed).')
-        .action(() => {
-        setGloballyEnabled(false);
-        console.log(chalk.yellow('watchdog: global auto-nudge DISABLED'));
+        .description('Turn OFF the always-on watchdog (pause the `watchdog` routine).')
+        .action(async () => {
+        if (!watchdogRoutineExists()) {
+            console.log(chalk.dim('watchdog: already off (no routine)'));
+            return;
+        }
+        setJobEnabled(WATCHDOG_ROUTINE_NAME, false);
+        await reloadDaemonForRoutine(false);
+        console.log(chalk.yellow('watchdog: DISABLED (routine paused)'));
     });
     cmd.command('status')
-        .description('Show whether global auto-nudge is on and where state is written.')
+        .description('Show whether the always-on watchdog routine is enabled and where state is written.')
         .option('--json', 'Emit status as JSON (for the menu-bar / scripts)')
         .action((_opts, command) => {
         // The parent `watchdog` command also declares --json and greedily parses it
@@ -214,12 +230,12 @@ export function registerWatchdogCommand(program) {
         // parent, not this subcommand. optsWithGlobals() merges both levels, so we
         // read it correctly regardless of which command commander bound it to.
         const json = command.optsWithGlobals().json === true;
-        const on = isGloballyEnabled();
+        const on = isWatchdogRoutineEnabled();
         if (json) {
-            console.log(JSON.stringify({ enabled: on, stateDir: stateDir() }));
+            console.log(JSON.stringify({ enabled: on, routine: WATCHDOG_ROUTINE_NAME, stateDir: stateDir() }));
             return;
         }
-        console.log(`global auto-nudge: ${on ? chalk.green('ON') : chalk.dim('off')}`);
+        console.log(`always-on watchdog: ${on ? chalk.green('ON') : chalk.dim('off')} (routine '${WATCHDOG_ROUTINE_NAME}')`);
         console.log(`state dir: ${chalk.dim(stateDir())}`);
     });
     // --- per-session policy ----------------------------------------------------

package/dist/index.js

@@ -26,11 +26,49 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageJsonPath = path.join(__dirname, '..', 'package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
 const VERSION = packageJson.version;
+import { SYNC_GET_CMD, SYNC_PING_CMD, SYNC_LOCK_CMD } from './lib/secrets/sync-commands.js';
 if (process.argv[2] === '__vault-age-helper') {
     const { runVaultAgeHelperCli } = await import('./lib/secrets/vault-age-helper.js');
     await runVaultAgeHelperCli();
     process.exit(process.exitCode ?? 0);
 }
+// Synchronous secrets-broker clients (src/lib/secrets/agent.ts). These are the
+// hot read path: `readAndResolveBundleEnv` is synchronous all the way down, so
+// it can't await a socket round-trip — it spawns one of these and reads the
+// exit code (0 = hit/alive, 3 = miss/down).
+//
+// Intercepted HERE, before commander and before the startup STATEMENTS, for the
+// same reason as __daemon-run and __vault-age-helper above. Everything below
+// this point runs `checkForUpdates()` and `spawnDetachedSync()` on every
+// non-help invocation — so registering these as ordinary hidden subcommands
+// would fire an update check and fork a detached background sync on *every
+// cache hit*, which is both a fork storm on the hot path and a source of stdout
+// writes that could corrupt the JSON payload. Keep them above the line;
+// agent.test.ts asserts this ordering so the block can't drift downward.
+//
+// The tokens are imported from the leaf module sync-commands.ts — the SAME
+// bindings the clients spawn with, so this dispatch and those spawns cannot
+// drift apart. It is a leaf precisely so binding them here is free: importing
+// agent.js would pull the whole secrets graph into every invocation. Matching
+// string literals were the earlier design; a text-scanning test could not
+// reliably catch their divergence, and the divergence is silent — the CLI says
+// "unknown command", the client reads that as "broker down", and every read
+// falls back to a Touch ID prompt.
+//
+// "Before the startup statements", not "before all code": ESM hoists the
+// imports below, so those module bodies evaluate first. They are side-effect
+// free today (no top-level stdout write or spawn) — which is what makes this
+// safe, and worth preserving.
+if (process.argv[2] === SYNC_GET_CMD ||
+    process.argv[2] === SYNC_PING_CMD ||
+    process.argv[2] === SYNC_LOCK_CMD) {
+    const { runAgentGetSync, runAgentPingSync, runAgentLockSync } = await import('./lib/secrets/agent.js');
+    const name = process.argv[3] ?? '';
+    const code = process.argv[2] === SYNC_GET_CMD ? await runAgentGetSync(name)
+        : process.argv[2] === SYNC_PING_CMD ? await runAgentPingSync()
+            : await runAgentLockSync(name);
+    process.exit(code);
+}
 import { NPM_PACKAGE_NAME, deriveGlobalPrefix, detectPackageManager, installPackageIntoPrefix, installPackageWithBun, verifyInstalledVersion, refreshAliasShims, downloadVerifiedTarball, } from './lib/self-update.js';
 // Detect dev/working-tree builds and default the noisy startup steps off.
 // Three cases trip this:
@@ -55,9 +93,10 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadResources, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadExport, loadPackages, loadRoutines, loadMonitors, loadRun, loadFork, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadShare, loadSend, loadHq, loadFeed, loadActivity, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadResources, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadExport, loadPackages, loadRoutines, loadMonitors, loadRun, loadFork, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadHarness, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadShare, loadSend, loadHq, loadFeed, loadActivity, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
+import { getCliLaunch } from './lib/cli-entry.js';
 import { emit, redactArgs } from './lib/events.js';
 // Transparent shim delegate: the generated Windows `.cmd` shims invoke
 // `agents __shim <agent>[@version] <raw args>`. Intercept here, before commander
@@ -294,7 +333,7 @@ async function showWhatsNew(fromVersion, toVersion) {
 const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 import { getUpdateCheckPath, getMigratedSentinelPath, getUserAgentsDir, getRuntimeStateDir } from './lib/state.js';
 import { resolveBrandName, disabledCommandsForActiveBrand } from './lib/brand.js';
-import { readUpdateCache, saveUpdateCheck, dismissUpdateVersion, shouldPromptUpgrade, findAgentsCliInstalls, } from './lib/self-update.js';
+import { readUpdateCache, saveUpdateCheck, dismissUpdateVersion, shouldPromptUpgrade, findAgentsCliInstalls, resolveRunningPackageRoot, } from './lib/self-update.js';
 const UPDATE_CHECK_FILE = getUpdateCheckPath();
 /**
  * Warn once when PATH resolves `agents` to a different agents-cli install
@@ -306,7 +345,16 @@ const UPDATE_CHECK_FILE = getUpdateCheckPath();
  */
 function maybeWarnMultiInstall() {
     const sentinel = path.join(getRuntimeStateDir(), 'multi-install-warned');
-    const runningRoot = path.resolve(__dirname, '..');
+    let runningRoot;
+    try {
+        runningRoot = resolveRunningPackageRoot(__dirname);
+    }
+    catch {
+        // Without a real root for the running copy there is nothing to compare
+        // against, and a guess here is exactly what produced the phantom
+        // "/$bunfs" install. This warning is advisory — stay silent instead.
+        return;
+    }
     const byRoot = new Map();
     byRoot.set(runningRoot, { version: VERSION, note: 'running' });
     for (const install of findAgentsCliInstalls(process.env.PATH || '')) {
@@ -370,7 +418,7 @@ function printResolvedPackage(metadata) {
     console.log(chalk.gray(`Integrity: ${metadata.integrity}`));
 }
 async function installResolvedPackage(metadata) {
-    const packageRoot = path.resolve(__dirname, '..');
+    const packageRoot = resolveRunningPackageRoot(__dirname);
     // Download the published tarball and prove its bytes match the registry
     // integrity BEFORE installing anything. A `name@version` spec would let the
     // package manager fetch and install whatever the registry serves with no
@@ -466,9 +514,11 @@ async function promptUpgrade(latestVersion) {
             console.log();
             // Re-exec the verified install's entrypoint and exit. PATH lookup of
             // `agents` could resolve a different copy (dev build, another prefix)
-            // than the one that was just upgraded.
-            const entrypoint = path.resolve(__dirname, '..', 'dist', 'index.js');
-            const result = spawnSync(process.execPath, [entrypoint, ...process.argv.slice(2)], {
+            // than the one that was just upgraded. getCliLaunch resolves the JS-vs-
+            // standalone shape — never hand-roll `[process.execPath, entrypoint]`,
+            // which hands the bun virtual entry to a compiled binary as a bogus arg.
+            const { command, args } = getCliLaunch(process.argv.slice(2));
+            const result = spawnSync(command, args, {
                 stdio: 'inherit',
                 shell: false,
             });
@@ -747,6 +797,7 @@ async function registerAllEagerCommands() {
     await reg(loadStatus);
     registerExecAliasCommand(program);
     await reg(loadProfiles);
+    await reg(loadHarness);
     await reg(loadSecrets);
     await reg(loadLogin);
     await reg(loadWallet);

package/dist/lib/activity.d.ts

@@ -1,6 +1,8 @@
 import type { EventRecord } from './events.js';
 /** Recognizable milestone events, ordered first in any activity lane. */
-export type MilestoneEvent = 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created';
+export type MilestoneEvent = 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created'
+/** Deliberate agent-authored progress post (`agents feed post`). */
+ | 'status.posted';
 /** Routine activity events, collapsed to counts by readers. */
 export type ActivityKind = 'file.edited';
 export type ActivityEventKind = MilestoneEvent | ActivityKind;
@@ -29,12 +31,20 @@ export interface ActivityEvent {
     cwd?: string;
     /** Agent that produced the event (claude, codex, ...). */
     agent?: string;
-    /** Tool that triggered the event (Bash, Task, ExitPlanMode, ...). */
+    /** Tool that triggered the event (Bash, Task, ExitPlanMode, feed.post, ...). */
     tool?: string;
-    /** One-line human summary (plan title, PR command, sub-agent role). */
+    /** One-line human summary (plan title, PR command, sub-agent role, status text). */
     detail?: string;
     /** Extracted URL when the event has one (e.g. the opened PR). */
     url?: string;
+    /** Auto-stamped process identity for deliberate posts (from pid registry / env). */
+    pid?: number;
+    /** Spawn-time join key (`AGENT_LAUNCH_ID`) when known. */
+    launchId?: string;
+    /** Factory terminal id when the launch inherited one. */
+    terminalId?: string;
+    /** `$TMUX_PANE` at launch when recorded. */
+    tmuxPane?: string;
 }
 /**
  * Append one event to a session's activity log. Primarily the Python hook
@@ -110,7 +120,7 @@ export declare function formatActivityLine(ev: ActivityEvent, opts?: {
  * Edit|MultiEdit) so read-only tools never pay the hook cost. Fail-open: any
  * error is swallowed so a logging hiccup never blocks a tool call.
  */
-export declare const ACTIVITY_LOG_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Append agent-activity events for `agents feed` / `agents activity`.\n\nBound to PreToolUse (ExitPlanMode, Task) and PostToolUse (Bash, Write, Edit,\nMultiEdit). One append-only file per session; read-only tools never trigger it\nbecause the manifest matcher excludes them.\n\nSub-agent gate: when the payload carries `agent_type`, this is a Task/Agent\nsub-agent -- skip so only the top-level agent logs its own activity.\n\nFail-open: ANY error is swallowed so a logging hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport re\nimport sys\nimport json\nimport shlex\nimport socket\nfrom datetime import datetime, timezone\n\nMAX_LOG_BYTES = 5 * 1024 * 1024  # cap a pathological session's log\nMILESTONE_EVENTS = {\n    \"plan.created\", \"pr.opened\", \"pr.merged\", \"worktree.created\",\n    \"worktree.removed\", \"commit.created\", \"pushed\", \"subagent.spawned\",\n    \"artifact.created\",\n}\n\n# Deliverable file types + locations -- a Write here is a recognizable artifact\n# (an HTML plan, a PDF report, a rendered image), not a routine code edit.\nARTIFACT_EXTS = {\n    \".html\", \".htm\", \".pdf\", \".png\", \".jpg\", \".jpeg\", \".gif\", \".svg\",\n    \".webp\", \".mp4\", \".mov\", \".webm\", \".csv\", \".xlsx\", \".pptx\", \".docx\",\n}\nARTIFACT_DIR_HINTS = (\"/tmp/\", \"/downloads/\", \"/.agents/artifacts/\")\n\n\ndef is_artifact(file_path):\n    low = (file_path or \"\").lower()\n    if os.path.splitext(low)[1] in ARTIFACT_EXTS:\n        return True\n    return any(hint in low for hint in ARTIFACT_DIR_HINTS)\n\n\ndef first_line(text, limit=140):\n    for raw in (text or \"\").splitlines():\n        s = raw.strip().lstrip(\"#\").strip()\n        if s:\n            return s[:limit]\n    return \"\"\n\n\ndef _subcommand(tokens, tool):\n    \"\"\"First non-flag token after `tool`, i.e. its subcommand (skips -C <path>,\n    -c <cfg>, and other leading flags). None if `tool` isn't the invoked command.\"\"\"\n    try:\n        i = tokens.index(tool) + 1\n    except ValueError:\n        return None, []\n    while i < len(tokens):\n        t = tokens[i]\n        if t in (\"-C\", \"-c\", \"--git-dir\", \"--work-tree\"):\n            i += 2  # flag that consumes the next token\n            continue\n        if t.startswith(\"-\"):\n            i += 1\n            continue\n        return t, tokens[i + 1:]\n    return None, []\n\n\ndef classify_bash(command):\n    \"\"\"Return the milestone event for a git/gh command, else None. Tokenizes so a\n    path like `git diff -- src/commit.ts` is not mistaken for a commit.\"\"\"\n    try:\n        tokens = shlex.split(command or \"\")\n    except Exception:\n        tokens = (command or \"\").split()\n\n    verb, rest = _subcommand(tokens, \"git\")\n    if verb == \"worktree\":\n        sub = rest[0] if rest else \"\"\n        if sub == \"add\":\n            return \"worktree.created\"\n        if sub == \"remove\":\n            return \"worktree.removed\"\n    elif verb == \"commit\":\n        return \"commit.created\"\n    elif verb == \"push\":\n        return \"pushed\"\n\n    verb, rest = _subcommand(tokens, \"gh\")\n    if verb == \"pr\" and rest:\n        if rest[0] == \"create\":\n            return \"pr.opened\"\n        if rest[0] == \"merge\":\n            return \"pr.merged\"\n    return None\n\n\ndef extract_url(tool_response):\n    \"\"\"Pull the first https URL out of a Bash tool response (stdout).\"\"\"\n    text = \"\"\n    if isinstance(tool_response, dict):\n        text = str(tool_response.get(\"stdout\") or tool_response.get(\"output\") or \"\")\n    elif isinstance(tool_response, str):\n        text = tool_response\n    m = re.search(r\"https?://\\S+\", text)\n    return m.group(0).rstrip(\").,\") if m else None\n\n\ndef build_event(payload, hook_event):\n    tool_name = payload.get(\"tool_name\", \"\")\n    tool_input = payload.get(\"tool_input\", {}) or {}\n    tool_response = payload.get(\"tool_response\", {})\n\n    event = None\n    detail = None\n    url = None\n\n    if hook_event == \"PreToolUse\":\n        if tool_name == \"ExitPlanMode\":\n            event = \"plan.created\"\n            detail = first_line(tool_input.get(\"plan\", \"\")) or \"plan presented\"\n        elif tool_name == \"Task\":\n            event = \"subagent.spawned\"\n            role = tool_input.get(\"subagent_type\") or \"agent\"\n            desc = tool_input.get(\"description\") or tool_input.get(\"prompt\") or \"\"\n            detail = (role + \": \" + first_line(desc)).strip(\": \").strip()\n    elif hook_event == \"PostToolUse\":\n        if tool_name == \"Bash\":\n            event = classify_bash(tool_input.get(\"command\", \"\"))\n            if event:\n                detail = first_line(tool_input.get(\"command\", \"\"))\n                url = extract_url(tool_response)\n        elif tool_name in (\"Write\", \"Edit\", \"MultiEdit\"):\n            fp = tool_input.get(\"file_path\") or tool_input.get(\"path\") or \"\"\n            # A freshly-written deliverable is a milestone; edits and code\n            # writes stay routine and collapse to a count.\n            if tool_name == \"Write\" and is_artifact(fp):\n                event = \"artifact.created\"\n            else:\n                event = \"file.edited\"\n            detail = os.path.basename(fp) if fp else tool_name\n\n    if not event:\n        return None, tool_name\n\n    tier = \"milestone\" if event in MILESTONE_EVENTS else \"activity\"\n    record = {\n        \"v\": 1,\n        \"ts\": datetime.now(timezone.utc).isoformat(),\n        \"event\": event,\n        \"tier\": tier,\n    }\n    if detail:\n        record[\"detail\"] = detail\n    if url:\n        record[\"url\"] = url\n    record[\"tool\"] = tool_name\n    return record, tool_name\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate -- only the top-level agent logs.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    hook_event = payload.get(\"hook_event_name\", \"\")\n    record, tool_name = build_event(payload, hook_event)\n    if not record:\n        return\n\n    safe_session = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id) or \"unknown\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    activity_dir = os.path.join(home, \".agents\", \".history\", \"activity\")\n    target = os.path.join(activity_dir, safe_session + \".jsonl\")\n\n    # Identity (mirrors 10-feed-publish.py).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", hostname.split(\".\")[0].strip().lower()) or \"unknown\"\n\n    record[\"sessionId\"] = session_id\n    record[\"mailboxId\"] = mailbox_id\n    record[\"host\"] = host\n    record[\"runtime\"] = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    if cwd:\n        record[\"cwd\"] = cwd\n    agent = os.environ.get(\"AGENTS_AGENT_NAME\") or \"claude\"\n    record[\"agent\"] = agent\n\n    try:\n        os.makedirs(activity_dir, exist_ok=True)\n        # Cap growth: once over the size limit, keep only milestones.\n        if record[\"tier\"] != \"milestone\":\n            try:\n                if os.path.getsize(target) > MAX_LOG_BYTES:\n                    return\n            except OSError:\n                pass\n        with open(target, \"a\") as f:\n            f.write(json.dumps(record) + \"\\n\")\n    except Exception:\n        pass  # fail open\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
+export declare const ACTIVITY_LOG_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Append agent-activity events for `agents feed` / `agents activity`.\n\nBound to PreToolUse (ExitPlanMode, Task) and PostToolUse (Bash, Write, Edit,\nMultiEdit). One append-only file per session; read-only tools never trigger it\nbecause the manifest matcher excludes them.\n\nSub-agent gate: when the payload carries `agent_type`, this is a Task/Agent\nsub-agent -- skip so only the top-level agent logs its own activity.\n\nFail-open: ANY error is swallowed so a logging hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport re\nimport sys\nimport json\nimport shlex\nimport socket\nfrom datetime import datetime, timezone\n\nMAX_LOG_BYTES = 5 * 1024 * 1024  # cap a pathological session's log\nMILESTONE_EVENTS = {\n    \"plan.created\", \"pr.opened\", \"pr.merged\", \"worktree.created\",\n    \"worktree.removed\", \"commit.created\", \"pushed\", \"subagent.spawned\",\n    \"artifact.created\", \"status.posted\",\n}\n\n# Deliverable file types + locations -- a Write here is a recognizable artifact\n# (an HTML plan, a PDF report, a rendered image), not a routine code edit.\nARTIFACT_EXTS = {\n    \".html\", \".htm\", \".pdf\", \".png\", \".jpg\", \".jpeg\", \".gif\", \".svg\",\n    \".webp\", \".mp4\", \".mov\", \".webm\", \".csv\", \".xlsx\", \".pptx\", \".docx\",\n}\nARTIFACT_DIR_HINTS = (\"/tmp/\", \"/downloads/\", \"/.agents/artifacts/\")\n\n\ndef is_artifact(file_path):\n    low = (file_path or \"\").lower()\n    if os.path.splitext(low)[1] in ARTIFACT_EXTS:\n        return True\n    return any(hint in low for hint in ARTIFACT_DIR_HINTS)\n\n\ndef first_line(text, limit=140):\n    for raw in (text or \"\").splitlines():\n        s = raw.strip().lstrip(\"#\").strip()\n        if s:\n            return s[:limit]\n    return \"\"\n\n\ndef _subcommand(tokens, tool):\n    \"\"\"First non-flag token after `tool`, i.e. its subcommand (skips -C <path>,\n    -c <cfg>, and other leading flags). None if `tool` isn't the invoked command.\"\"\"\n    try:\n        i = tokens.index(tool) + 1\n    except ValueError:\n        return None, []\n    while i < len(tokens):\n        t = tokens[i]\n        if t in (\"-C\", \"-c\", \"--git-dir\", \"--work-tree\"):\n            i += 2  # flag that consumes the next token\n            continue\n        if t.startswith(\"-\"):\n            i += 1\n            continue\n        return t, tokens[i + 1:]\n    return None, []\n\n\ndef classify_bash(command):\n    \"\"\"Return the milestone event for a git/gh command, else None. Tokenizes so a\n    path like `git diff -- src/commit.ts` is not mistaken for a commit.\"\"\"\n    try:\n        tokens = shlex.split(command or \"\")\n    except Exception:\n        tokens = (command or \"\").split()\n\n    verb, rest = _subcommand(tokens, \"git\")\n    if verb == \"worktree\":\n        sub = rest[0] if rest else \"\"\n        if sub == \"add\":\n            return \"worktree.created\"\n        if sub == \"remove\":\n            return \"worktree.removed\"\n    elif verb == \"commit\":\n        return \"commit.created\"\n    elif verb == \"push\":\n        return \"pushed\"\n\n    verb, rest = _subcommand(tokens, \"gh\")\n    if verb == \"pr\" and rest:\n        if rest[0] == \"create\":\n            return \"pr.opened\"\n        if rest[0] == \"merge\":\n            return \"pr.merged\"\n    return None\n\n\ndef extract_url(tool_response):\n    \"\"\"Pull the first https URL out of a Bash tool response (stdout).\"\"\"\n    text = \"\"\n    if isinstance(tool_response, dict):\n        text = str(tool_response.get(\"stdout\") or tool_response.get(\"output\") or \"\")\n    elif isinstance(tool_response, str):\n        text = tool_response\n    m = re.search(r\"https?://\\S+\", text)\n    return m.group(0).rstrip(\").,\") if m else None\n\n\ndef build_event(payload, hook_event):\n    tool_name = payload.get(\"tool_name\", \"\")\n    tool_input = payload.get(\"tool_input\", {}) or {}\n    tool_response = payload.get(\"tool_response\", {})\n\n    event = None\n    detail = None\n    url = None\n\n    if hook_event == \"PreToolUse\":\n        if tool_name == \"ExitPlanMode\":\n            event = \"plan.created\"\n            detail = first_line(tool_input.get(\"plan\", \"\")) or \"plan presented\"\n        elif tool_name == \"Task\":\n            event = \"subagent.spawned\"\n            role = tool_input.get(\"subagent_type\") or \"agent\"\n            desc = tool_input.get(\"description\") or tool_input.get(\"prompt\") or \"\"\n            detail = (role + \": \" + first_line(desc)).strip(\": \").strip()\n    elif hook_event == \"PostToolUse\":\n        if tool_name == \"Bash\":\n            event = classify_bash(tool_input.get(\"command\", \"\"))\n            if event:\n                detail = first_line(tool_input.get(\"command\", \"\"))\n                url = extract_url(tool_response)\n        elif tool_name in (\"Write\", \"Edit\", \"MultiEdit\"):\n            fp = tool_input.get(\"file_path\") or tool_input.get(\"path\") or \"\"\n            # A freshly-written deliverable is a milestone; edits and code\n            # writes stay routine and collapse to a count.\n            if tool_name == \"Write\" and is_artifact(fp):\n                event = \"artifact.created\"\n            else:\n                event = \"file.edited\"\n            detail = os.path.basename(fp) if fp else tool_name\n\n    if not event:\n        return None, tool_name\n\n    tier = \"milestone\" if event in MILESTONE_EVENTS else \"activity\"\n    record = {\n        \"v\": 1,\n        \"ts\": datetime.now(timezone.utc).isoformat(),\n        \"event\": event,\n        \"tier\": tier,\n    }\n    if detail:\n        record[\"detail\"] = detail\n    if url:\n        record[\"url\"] = url\n    record[\"tool\"] = tool_name\n    return record, tool_name\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate -- only the top-level agent logs.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    hook_event = payload.get(\"hook_event_name\", \"\")\n    record, tool_name = build_event(payload, hook_event)\n    if not record:\n        return\n\n    safe_session = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id) or \"unknown\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    activity_dir = os.path.join(home, \".agents\", \".history\", \"activity\")\n    target = os.path.join(activity_dir, safe_session + \".jsonl\")\n\n    # Identity (mirrors 10-feed-publish.py).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", hostname.split(\".\")[0].strip().lower()) or \"unknown\"\n\n    record[\"sessionId\"] = session_id\n    record[\"mailboxId\"] = mailbox_id\n    record[\"host\"] = host\n    record[\"runtime\"] = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    if cwd:\n        record[\"cwd\"] = cwd\n    agent = os.environ.get(\"AGENTS_AGENT_NAME\") or \"claude\"\n    record[\"agent\"] = agent\n\n    try:\n        os.makedirs(activity_dir, exist_ok=True)\n        # Cap growth: once over the size limit, keep only milestones.\n        if record[\"tier\"] != \"milestone\":\n            try:\n                if os.path.getsize(target) > MAX_LOG_BYTES:\n                    return\n            except OSError:\n                pass\n        with open(target, \"a\") as f:\n            f.write(json.dumps(record) + \"\\n\")\n    except Exception:\n        pass  # fail open\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
 /** Hook manifest entries (agents.yaml shape) for the activity-log hook. */
 export declare const ACTIVITY_HOOK_DEFINITIONS: Record<string, Record<string, unknown>>;
 /**

package/dist/lib/activity.js

@@ -34,6 +34,7 @@ export const MILESTONE_EVENTS = [
     'pushed',
     'subagent.spawned',
     'artifact.created',
+    'status.posted',
 ];
 const MILESTONE_SET = new Set(MILESTONE_EVENTS);
 export function tierForEvent(event) {
@@ -82,6 +83,10 @@ function parseLine(line) {
             tool: parsed.tool,
             detail: parsed.detail,
             url: parsed.url,
+            pid: typeof parsed.pid === 'number' ? parsed.pid : undefined,
+            launchId: parsed.launchId,
+            terminalId: parsed.terminalId,
+            tmuxPane: parsed.tmuxPane,
         };
     }
     catch {
@@ -193,11 +198,11 @@ export function activityEventToRecord(ev) {
         hostname: ev.host,
         platform: process.platform,
         arch: process.arch,
-        pid: 0,
+        pid: ev.pid ?? 0,
         ppid: 0,
         event: ev.event,
         level: 'info',
-        caller: 'hook',
+        caller: ev.tool === 'feed.post' ? 'agent' : 'hook',
         session: ev.sessionId,
         osUser: ev.agent ?? 'agent',
         transport: 'local',
@@ -210,6 +215,9 @@ export function activityEventToRecord(ev) {
         detail: ev.detail,
         url: ev.url,
         tier: ev.tier,
+        ...(ev.launchId ? { launchId: ev.launchId } : {}),
+        ...(ev.terminalId ? { terminalId: ev.terminalId } : {}),
+        ...(ev.tmuxPane ? { tmuxPane: ev.tmuxPane } : {}),
     };
 }
 /** Read recent activity across sessions as unified {@link EventRecord}s. */
@@ -230,6 +238,7 @@ export const EVENT_STYLE = {
     'pushed': { glyph: '↥', color: chalk.yellow, label: 'pushed' },
     'subagent.spawned': { glyph: '⑂', color: chalk.magenta, label: 'sub-agent spawned' },
     'artifact.created': { glyph: '▤', color: chalk.cyan, label: 'artifact' },
+    'status.posted': { glyph: '▸', color: chalk.white, label: 'status' },
     'file.edited': { glyph: '·', color: chalk.gray, label: 'file edited' },
 };
 export function styleForEvent(event) {
@@ -240,10 +249,13 @@ export function formatActivityLine(ev, opts = {}) {
     const s = styleForEvent(ev.event);
     const host = opts.showHost && ev.host && ev.host !== 'unknown' ? chalk.gray(`[${ev.host}] `) : '';
     const label = s.color(`${s.glyph} ${s.label}`);
-    const detail = ev.detail ? ` ${truncate(ev.detail, 60)}` : '';
+    // Status posts are the message; allow a longer snippet than tool-derived detail.
+    const detailLimit = ev.event === 'status.posted' ? 100 : 60;
+    const detail = ev.detail ? ` ${truncate(ev.detail, detailLimit)}` : '';
     const url = ev.url ? chalk.gray(` ${ev.url}`) : '';
+    const agent = ev.event === 'status.posted' && ev.agent ? chalk.gray(` · ${ev.agent}`) : '';
     const when = chalk.gray(relTime(ev.ts).padStart(7));
-    return `  ${when}  ${host}${label}${detail}${url}`;
+    return `  ${when}  ${host}${label}${detail}${agent}${url}`;
 }
 // ---------------------------------------------------------------------------
 // Hook installation
@@ -281,7 +293,7 @@ MAX_LOG_BYTES = 5 * 1024 * 1024  # cap a pathological session's log
 MILESTONE_EVENTS = {
     "plan.created", "pr.opened", "pr.merged", "worktree.created",
     "worktree.removed", "commit.created", "pushed", "subagent.spawned",
-    "artifact.created",
+    "artifact.created", "status.posted",
 }
 
 # Deliverable file types + locations -- a Write here is a recognizable artifact

package/dist/lib/actor.d.ts

@@ -0,0 +1,50 @@
+import type { ActorConfig } from './types.js';
+export type ActorKind = 'human' | 'agent';
+export interface ResolvedActor {
+    /**
+     * Stable id for the responsible entity: the tailnet login (usually an email)
+     * for a resolved human, or `UNRESOLVED@<host>` when it can't be determined.
+     */
+    id: string;
+    kind: ActorKind;
+    /** Human-readable name, for git author + display. */
+    name?: string;
+    /** Email, for git author + as a durable key. */
+    email?: string;
+    /** GitHub handle, when the actors map records one. */
+    github?: string;
+}
+/** Result of `tailscale whois --json <ip>` we care about. */
+export interface WhoisIdentity {
+    login?: string;
+    displayName?: string;
+}
+/**
+ * Map a resolved tailnet identity (+ the actors map) to a ResolvedActor. Pure --
+ * the impure whois/config reads happen in computeActor -- so the enrich/override
+ * path is fully testable. No login (local, or an unnameable peer) yields the
+ * honest `UNRESOLVED@<host>`; a login without a config entry still credits git
+ * from the tailnet DisplayName + login email.
+ */
+export declare function actorFromIdentity(who: WhoisIdentity | undefined, host: string, actors: Record<string, ActorConfig>): ResolvedActor;
+/**
+ * Compute the actor for a given environment. Pure with respect to `env` (the
+ * only impurity is the `tailscale whois` / config read on the fresh-SSH path),
+ * so tests can drive every branch by passing an env explicitly.
+ */
+export declare function computeActor(env?: NodeJS.ProcessEnv): ResolvedActor;
+/**
+ * Resolve the actor for the current process, cached for the process lifetime
+ * (the SSH `whois` shell-out runs at most once).
+ */
+export declare function resolveActor(): ResolvedActor;
+/** Clear the per-process cache. For tests, and for env changes within a run. */
+export declare function resetActorCache(): void;
+/**
+ * The env an actor propagates to child processes. Always carries the actor id +
+ * kind (so children inherit and don't re-resolve). For a resolved human with a
+ * real name and email, it also carries `GIT_AUTHOR_*` / `GIT_COMMITTER_*` so the
+ * agent's own commits are credited to the person, not the shared account. An
+ * unresolved actor sets no git identity -- git keeps its ambient config.
+ */
+export declare function actorEnv(actor: ResolvedActor): Record<string, string>;