@phnx-labs/agents-cli 1.20.74 → 1.20.77

package/dist/lib/routines.js

@@ -15,6 +15,7 @@ import { safeJoin, isSafeSegmentName } from './paths.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { ALL_AGENT_IDS } from './agents.js';
 import { machineId, normalizeHost } from './machine-id.js';
+export const HOST_STRATEGIES = ['local', 'host', 'fleet', 'cloud'];
 /** Canonical set of accepted GitHub trigger events — single source for validation. */
 export const GITHUB_TRIGGER_EVENTS = [
     'pull_request',
@@ -84,6 +85,39 @@ export function jobRunsOnThisDevice(config) {
     const self = machineId();
     return config.devices.some((d) => normalizeHost(d) === self);
 }
+/**
+ * Resolve the effective host strategy for a job.
+ * Bare `host:` without an explicit strategy implies `host` (back-compat with
+ * pre-hostStrategy YAML). Otherwise default to `local`.
+ */
+export function resolveHostStrategy(config) {
+    if (config.hostStrategy)
+        return config.hostStrategy;
+    if (config.host)
+        return 'host';
+    return 'local';
+}
+/**
+ * Parse a CLI `--placement` value into a HostStrategy, or null when empty.
+ * Throws a human-readable Error for unknown values.
+ */
+export function parseHostStrategy(raw) {
+    if (raw === undefined || raw === null || raw === '')
+        return null;
+    const v = raw.trim().toLowerCase();
+    if (HOST_STRATEGIES.includes(v))
+        return v;
+    throw new Error(`Invalid placement '${raw}'. Use one of: ${HOST_STRATEGIES.join(', ')}`);
+}
+/**
+ * Strategies that dispatch the job body off the firing machine. Without a
+ * `devices` pin every daemon in the fleet would fire and each would dispatch
+ * once — N× duplicate runs. Callers pin to this machine when the user did not
+ * set an explicit allowlist.
+ */
+export function placementRequiresFiringPin(strategy) {
+    return strategy === 'host' || strategy === 'fleet' || strategy === 'cloud';
+}
 /**
  * Return null when the job may run here; otherwise return a structured,
  * human-friendly eligibility failure. Centralizes the message/suggestion
@@ -419,24 +453,48 @@ export function validateJob(config) {
     if (config.device !== undefined) {
         errors.push('singular "device" key is no longer supported — replace with devices: [<name>] (an array)');
     }
+    if (config.hostStrategy !== undefined) {
+        if (!HOST_STRATEGIES.includes(config.hostStrategy)) {
+            errors.push(`hostStrategy must be one of: ${HOST_STRATEGIES.join(', ')}`);
+        }
+    }
+    const strategy = resolveHostStrategy(config);
     if (config.host !== undefined) {
         if (typeof config.host !== 'string' || config.host.trim() === '') {
             errors.push('host must be a non-empty machine name (a registered host, device, capability tag, or user@host)');
         }
-        // v1: the workflow bundle and the loop driver (with its signal files) live
-        // on the firing machine — neither can cross SSH to the target yet.
+    }
+    if (strategy === 'host' && (!config.host || config.host.trim() === '')) {
+        errors.push("hostStrategy: host requires host: (set via --run-on or host: in YAML)");
+    }
+    // Remote placement (host/fleet/cloud) can't carry workflow/loop/command yet —
+    // those live on the firing machine.
+    if (strategy === 'host' || strategy === 'fleet' || strategy === 'cloud') {
         if (config.workflow) {
-            errors.push("host: can't be combined with workflow: yet (the bundle lives on the firing machine) — run the workflow locally or convert it to a plain prompt");
+            errors.push(`${strategy} placement can't be combined with workflow: yet — run the workflow locally or convert it to a plain prompt`);
         }
         if (config.loop) {
-            errors.push("host: can't be combined with loop: yet (the loop driver and its signal files live on the firing machine)");
+            errors.push(`${strategy} placement can't be combined with loop: yet (the loop driver and its signal files live on the firing machine)`);
         }
         if (config.command) {
-            errors.push("host: can't be combined with command: yet (a plain shell command has no agent to place remotely) — run it locally, or convert it to a prompt");
+            errors.push(`${strategy} placement can't be combined with command: yet (a plain shell command has no agent to place remotely)`);
         }
     }
-    if (config.remoteCwd !== undefined && config.host === undefined) {
-        errors.push('remoteCwd only applies to host:-placed routines — set host: too, or drop it');
+    if (config.remoteCwd !== undefined && strategy !== 'host' && strategy !== 'fleet') {
+        errors.push('remoteCwd only applies to host/fleet-placed routines — set hostStrategy: host|fleet, or drop it');
+    }
+    if (config.source !== undefined) {
+        if (!config.source || typeof config.source !== 'object') {
+            errors.push('source must be an object');
+        }
+        else {
+            if (config.source.kind !== 'project') {
+                errors.push("source.kind must be 'project'");
+            }
+            if (typeof config.source.projectPath !== 'string' || config.source.projectPath.trim() === '') {
+                errors.push('source.projectPath must be a non-empty absolute path');
+            }
+        }
     }
     if (config.devices !== undefined) {
         if (!Array.isArray(config.devices)) {
@@ -451,6 +509,15 @@ export function validateJob(config) {
             }
         }
     }
+    // Off-box placement without a devices pin fires on every fleet daemon and
+    // each dispatches once (RUSH-1980). Enforce the pin at validation so hand
+    // edits and devices --clear cannot re-open the hole.
+    if (placementRequiresFiringPin(strategy)) {
+        if (!config.devices || config.devices.length === 0) {
+            errors.push(`hostStrategy: ${strategy} requires devices: [<name>] to pin which daemon may fire ` +
+                '(otherwise every fleet daemon dispatches once). Pin to one machine, e.g. devices: [this-host]');
+        }
+    }
     return errors;
 }
 /** Validate a job trigger block, returning a list of human-readable errors. */
@@ -536,8 +603,11 @@ export function resolveJobPrompt(config) {
             prompt = prompt.replace(new RegExp(`\\{${key}\\}`, 'g'), value);
         }
     }
-    // Last report (special handling)
-    const latestRun = getLatestRun(config.name);
+    // Last report (special handling). Only a COMPLETED run's report is injected —
+    // a failed run's report.md is the agent's error text (e.g. a login prompt on
+    // an auth failure), and feeding that into the next prompt poisons every
+    // subsequent run until a human intervenes.
+    const latestRun = getLatestCompletedRun(config.name);
     if (latestRun) {
         const reportPath = path.join(getJobRunsDir(config.name), latestRun.runId, 'report.md');
         if (fs.existsSync(reportPath)) {
@@ -595,6 +665,20 @@ export function getLatestRun(jobName) {
     const runs = listRuns(jobName);
     return runs.length > 0 ? runs[runs.length - 1] : null;
 }
+/**
+ * Get the most recent COMPLETED run for a job, or null if none has completed.
+ * Used to resolve `{last_report}` so a failed run's error text (e.g. an auth
+ * login prompt written into report.md) can never be injected into the next
+ * run's prompt.
+ */
+export function getLatestCompletedRun(jobName) {
+    const runs = listRuns(jobName);
+    for (let i = runs.length - 1; i >= 0; i--) {
+        if (runs[i].status === 'completed')
+            return runs[i];
+    }
+    return null;
+}
 /** Persist run metadata to its run directory as meta.json. */
 export function writeRunMeta(meta) {
     ensureAgentsDir();

package/dist/lib/runner.d.ts

@@ -77,9 +77,19 @@ export declare function buildRoutineSpawnEnv(baseEnv: Record<string, string>, ag
  * failover across healthy same-agent accounts (RUSH-1016).
  */
 export declare function executeJob(config: JobConfig, deps?: LoopDeps): Promise<RunResult>;
+/**
+ * Optional lifecycle callbacks for a detached routine run. The daemon passes an
+ * `onFinish` that fires the branded finish/output notification (RUSH-2030) — it
+ * runs from the in-process settle() when the child exits, the only seam that
+ * observes the live running→terminal transition (the monitor tick would already
+ * see a finalized record and skip it). Never let a hook throw into finalization.
+ */
+export interface RoutineHooks {
+    /** Called once with the finalized meta when the run reaches a terminal state. */
+    onFinish?: (meta: RunMeta) => void;
+}
 /** Spawn a job as a detached process and return immediately with run metadata. */
-/** Spawn a job as a detached process and return immediately with run metadata. */
-export declare function executeJobDetached(config: JobConfig): Promise<RunMeta>;
+export declare function executeJobDetached(config: JobConfig, hooks?: RoutineHooks): Promise<RunMeta>;
 /** Extract the final assistant message from a stream-JSON log file as a markdown report. */
 export declare function extractReport(stdoutPath: string, agentType: AgentId): string | null;
 /** Scan all runs marked "running" and finalize any whose process has exited. */

package/dist/lib/runner.js

@@ -22,13 +22,17 @@ import { getRunsDir } from './state.js';
 import { prepareJobHome, buildSpawnEnv, getJobHomePath } from './sandbox.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { createTimer, maybeRotate, redactPrompt } from './events.js';
-import { normalizeMode, resolveHeadlessMode, buildExecEnv, detectRateLimit, } from './exec.js';
+import { normalizeMode, resolveHeadlessMode, buildExecEnv, detectRateLimit, detectAuthFailure, isAuthFailureFromLog, authFailureReason, } from './exec.js';
 import { loadTask as loadHostTask } from './hosts/tasks.js';
 import { reconcileTask as reconcileHostTask } from './hosts/reconcile.js';
 import { backgroundSpawnOptions } from './platform/process.js';
 import { walkForFiles } from './fs-walk.js';
-import { getBinaryPath, isVersionInstalled, resolveVersion } from './versions.js';
-import { getConfiguredRunStrategy, resolveRunVersion, rotationFailoverChain, readinessFromCandidate, } from './rotate.js';
+import { getBinaryPath, getVersionHomePath, isVersionInstalled, resolveVersion } from './versions.js';
+import { claudeHomeHasOwnCredential } from './agents.js';
+import { resolveAccountSetupToken } from './secrets/account-token.js';
+import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, } from './rotate.js';
+import { readAuthHealth, isDeadVerdict } from './auth-health.js';
+import { machineId } from './machine-id.js';
 /** CLI command templates per agent, with {prompt} as a placeholder. */
 const AGENT_COMMANDS = {
     claude: ['claude', '-p', '--verbose', '{prompt}', '--output-format', 'stream-json', '--permission-mode', 'plan'],
@@ -287,6 +291,19 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd()) {
             pinned: true,
         };
     }
+    // Account pin: resolve the login identity to the version slot that holds it and
+    // run pinned — no rotation, no failover onto other accounts — so concurrent
+    // unattended routines never share (and mutually revoke) one single-use OAuth
+    // credential (RUSH-1957). Falls through to the strategy only when the account
+    // is not signed in on this box, with a loud warning rather than a silent stall.
+    if (config.account) {
+        const version = await resolveAccountVersion(agent, config.account);
+        if (version) {
+            return { chain: [{ agent, version }], rotation: null, pinned: true };
+        }
+        process.stderr.write(`[agents] routine ${config.name}: account '${config.account}' is not signed in for ${agent}; ` +
+            `falling back to strategy — pin a signed-in account to stop OAuth-rotation revocation\n`);
+    }
     const strategy = getConfiguredRunStrategy(agent, cwd);
     let version;
     let rotation = null;
@@ -383,6 +400,29 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone) {
         if (v !== undefined)
             out[k] = v;
     }
+    // A headless routine should authenticate the rotation-pinned account via its
+    // long-lived, NON-rotating setup-token, not the interactive OAuth session.
+    // Claude Code's interactive session uses single-use rotating refresh tokens: one
+    // fleet machine refreshing invalidates that account on every other machine, so
+    // they 401 and log out (Claude Code #25609 / #56339) — the fleet-wide daily
+    // logout. If the daemon injected this account's per-account
+    // CLAUDE_CODE_OAUTH_TOKEN_<slug> (from a headless-readable no-ACL bundle), use it;
+    // that also works on macOS, where the drop path below is inert
+    // (claudeHomeHasOwnCredential is false on darwin, agents.ts).
+    //
+    // Fallback (RUSH-1979): with no per-account token, keep the prior behavior — drop
+    // the single ambient CLAUDE_CODE_OAUTH_TOKEN when the pinned account has its own
+    // on-disk credential (Linux) so it isn't shadowed; keep it otherwise.
+    if (agent === 'claude' && version && out.CLAUDE_CONFIG_DIR) {
+        const home = getVersionHomePath('claude', version);
+        const accountToken = resolveAccountSetupToken(baseEnv, home);
+        if (accountToken) {
+            out.CLAUDE_CODE_OAUTH_TOKEN = accountToken;
+        }
+        else if (claudeHomeHasOwnCredential(home)) {
+            delete out.CLAUDE_CODE_OAUTH_TOKEN;
+        }
+    }
     if (timezone)
         out.TZ = timezone;
     return out;
@@ -483,11 +523,19 @@ export async function executeJob(config, deps) {
     if (eligibility) {
         throw new Error(eligibility.message);
     }
-    // `host:` placement — the job body runs on another machine over SSH; local
-    // version selection / sandbox / spawn do not apply. Sync callers (manual
-    // `routines run`, catchup) follow the remote run to completion.
-    if (config.host) {
-        return executeJobOnHost(config, { detached: false });
+    // Placement (hostStrategy / bare host:) — body may run on another machine
+    // over SSH or in the cloud; local version selection / sandbox / spawn then
+    // do not apply. Sync callers (manual `routines run`, catchup) follow the
+    // remote run to completion when possible.
+    {
+        const { resolvePlacementTarget } = await import('./routines-placement.js');
+        const target = resolvePlacementTarget(config);
+        if (target.mode === 'host') {
+            return executeJobOnHost({ ...config, host: target.host }, { detached: false });
+        }
+        if (target.mode === 'cloud') {
+            return executeJobOnCloud(config, { detached: false });
+        }
     }
     // Command-mode: run a plain shell command directly (no agent, no rotation,
     // no pinning, no sandbox overlay). Reuses the run-record machinery so
@@ -536,6 +584,25 @@ export async function executeJob(config, deps) {
         exitCode: null,
     };
     writeRunMeta(meta);
+    // Auth preflight: if the last live probe rejected this (agent, version)'s
+    // token (verdict `revoked`), the run is guaranteed to fail auth — fail fast
+    // before spawning instead of producing a doomed run + poisoned report. Cache-
+    // only (the daemon refreshes it periodically); fail OPEN on any non-revoked or
+    // missing verdict so a stale/absent probe or a network blip never blocks a
+    // run, and agents with no live probe (codex/gemini/grok) are never blocked.
+    const preflightVersion = launch.chain[0]?.version;
+    if (preflightVersion) {
+        const health = readAuthHealth(machineId(), effectiveAgent, preflightVersion);
+        if (health && isDeadVerdict(health.verdict)) {
+            const reason = `auth_preflight: ${health.verdict}`;
+            process.stderr.write(`[agents] routine ${config.name}: ${effectiveAgent}@${preflightVersion} token ${health.verdict} — skipping run (re-login required)\n`);
+            finalizeRunMeta(meta, 'failed', 1, { errorMessage: reason });
+            writeRunMeta(meta);
+            timer.end({ status: 'failed', exitCode: 1, runId, error: reason });
+            archiveRoutineTranscripts(meta, runDir, overlayHome);
+            return { meta, reportPath: null };
+        }
+    }
     const timeoutMs = parseTimeout(config.timeout) || 10 * 60 * 1000;
     // Loop path: delegate to runLoop (same driver as `agents run --loop` / workflow loop:).
     if (config.loop) {
@@ -616,6 +683,21 @@ export async function executeJob(config, deps) {
             return { meta, reportPath };
         }
         if (attempt.status === 'completed') {
+            // Exit code alone is unreliable for auth: a logged-out Claude can exit 0
+            // with a `result` event carrying is_error:true (terminal_reason
+            // "completed"). Consult the SAME structural signal the detached path uses
+            // so both paths agree — raw text is deliberately NOT used here, so a
+            // genuinely-completed run that merely mentions an auth phrase stays a
+            // success (processFailed:false).
+            if (isAuthFailureFromLog(attempt.logText, effectiveAgent, { processFailed: false })) {
+                const reason = authFailureReason(attempt.logText) ?? 'authentication_failed';
+                finalizeRunMeta(meta, 'failed', attempt.exitCode ?? 1, { errorMessage: `auth_failed: ${reason}` });
+                writeRunMeta(meta);
+                timer.end({ status: 'failed', exitCode: meta.exitCode ?? undefined, runId, error: `auth_failed: ${reason}` });
+                // Never persist the login-error text as the report.
+                archiveRoutineTranscripts(meta, runDir, overlayHome);
+                return { meta, reportPath: null };
+            }
             finalizeRunMeta(meta, 'completed', 0);
             writeRunMeta(meta);
             timer.end({ status: 'completed', exitCode: 0, runId });
@@ -633,18 +715,36 @@ export async function executeJob(config, deps) {
             fs.appendFileSync(stdoutPath, `\n[agents] ${label} hit rate/usage limit — failover → ${nextLabel}\n`);
             continue;
         }
+        // Auth failure — the agent is logged out / token revoked. Unlike a rate
+        // limit it is not self-healing by failover (every chain entry on the same
+        // account fails identically), so rate-limit is classified first (above) and
+        // auth only when NOT rate-limited. Classified so the failure is visible and,
+        // critically, so the login-error text is never persisted as the report.
+        const authFailed = !rateLimited && (isAuthFailureFromLog(attempt.logText, effectiveAgent, { processFailed: true }) ||
+            (attempt.error ? detectAuthFailure(attempt.error) : false));
         if (attempt.error) {
             process.stderr.write(`[agents] routine ${config.name}: spawn failed for ${label}: ${attempt.error}\n`);
         }
-        finalizeRunMeta(meta, 'failed', attempt.exitCode ?? 1, attempt.error ? { errorMessage: attempt.error } : undefined);
+        const authReason = authFailed
+            ? (authFailureReason(attempt.logText)
+                ?? (attempt.error ? authFailureReason(attempt.error) : null)
+                ?? 'authentication_failed')
+            : null;
+        const failureErrorMessage = authReason
+            ? `auth_failed: ${authReason}`
+            : (attempt.error ?? undefined);
+        finalizeRunMeta(meta, 'failed', attempt.exitCode ?? 1, failureErrorMessage ? { errorMessage: failureErrorMessage } : undefined);
         writeRunMeta(meta);
         timer.end({
             status: 'failed',
             exitCode: meta.exitCode ?? undefined,
             runId,
-            ...(attempt.error ? { error: attempt.error } : {}),
+            ...(failureErrorMessage ? { error: failureErrorMessage } : {}),
         });
-        const reportPath = extractAndSaveReport(stdoutPath, effectiveAgent, runDir);
+        // On auth failure the last assistant text IS the login error — never persist
+        // it as report.md; it would otherwise be injected into the next run's prompt
+        // via {last_report}.
+        const reportPath = authFailed ? null : extractAndSaveReport(stdoutPath, effectiveAgent, runDir);
         archiveRoutineTranscripts(meta, runDir, overlayHome);
         return { meta, reportPath };
     }
@@ -654,6 +754,86 @@ export async function executeJob(config, deps) {
     timer.end({ status: 'failed', exitCode: 1, runId });
     return { meta, reportPath: null };
 }
+/**
+ * Dispatch a routine to the agent's native cloud provider (or the configured
+ * default). Writes a local run record with `cloudTaskId` so list/runs still
+ * work; does not wait for cloud completion on the detached path.
+ */
+async function executeJobOnCloud(config, opts) {
+    if (config.workflow) {
+        throw new Error(`Routine '${config.name}' runs a workflow bundle, which can't execute in the cloud yet — remove 'hostStrategy: cloud' or 'workflow:'.`);
+    }
+    if (config.loop) {
+        throw new Error(`Routine '${config.name}' uses 'loop:', which can't execute in the cloud yet — remove 'hostStrategy: cloud' or 'loop:'.`);
+    }
+    if (config.command) {
+        throw new Error(`Routine '${config.name}' uses 'command:', which can't execute in the cloud yet — remove 'hostStrategy: cloud' or 'command:'.`);
+    }
+    if (!config.agent) {
+        throw new Error(`Routine '${config.name}' hostStrategy: cloud requires an agent`);
+    }
+    const { resolveProvider } = await import('./cloud/registry.js');
+    const { insertTask } = await import('./cloud/store.js');
+    const provider = resolveProvider(undefined, config.agent);
+    const timer = createTimer('agent.run', {
+        agent: config.agent,
+        jobName: config.name,
+        mode: config.mode,
+        placement: 'cloud',
+        ...redactPrompt(config.prompt),
+        schedule: config.schedule,
+    });
+    const runId = generateRunId();
+    const runDir = getRunDir(config.name, runId);
+    fs.mkdirSync(runDir, { recursive: true });
+    const meta = {
+        jobName: config.name,
+        runId,
+        agent: config.agent,
+        pid: null,
+        spawnedAt: Date.now(),
+        status: 'running',
+        startedAt: new Date().toISOString(),
+        completedAt: null,
+        exitCode: null,
+    };
+    writeRunMeta(meta);
+    try {
+        const task = await provider.dispatch({
+            prompt: resolveJobPrompt(config),
+            agent: config.agent,
+            repo: config.repo,
+            timeout: config.timeout,
+            model: config.config?.model,
+        });
+        try {
+            insertTask(task);
+        }
+        catch { /* store is best-effort */ }
+        meta.cloudTaskId = task.id;
+        meta.cloudProvider = task.provider;
+        // Terminal cloud responses (e.g. antigravity) finalize immediately.
+        // Async providers leave the run `running` with the cloud task id for
+        // the user to follow via `agents cloud status`.
+        if (task.status === 'completed') {
+            finalizeRunMeta(meta, 'completed', 0);
+        }
+        else if (task.status === 'failed' || task.status === 'cancelled') {
+            finalizeRunMeta(meta, 'failed', 1, { errorMessage: task.summary ?? `cloud ${task.status}` });
+        }
+        // Non-terminal statuses stay `running` for both detached and sync paths;
+        // the user follows via `agents cloud status <id>`.
+        writeRunMeta(meta);
+        timer.end({ status: meta.status, exitCode: meta.exitCode ?? undefined, runId });
+        return { meta, reportPath: null };
+    }
+    catch (err) {
+        finalizeRunMeta(meta, 'failed', 1, { errorMessage: err.message });
+        writeRunMeta(meta);
+        timer.end({ status: 'failed', exitCode: 1, runId, error: err.message });
+        throw err;
+    }
+}
 async function executeJobOnHost(config, opts) {
     if (config.workflow) {
         throw new Error(`Routine '${config.name}' runs a workflow bundle, which can't execute on a host yet — remove 'host:' or 'workflow:'.`);
@@ -796,24 +976,44 @@ async function executeCommandJobForeground(config) {
     });
     return { meta, reportPath: null };
 }
+/** Invoke a lifecycle hook without letting a caller error break run finalization. */
+function safeHook(fn) {
+    if (!fn)
+        return;
+    try {
+        fn();
+    }
+    catch { /* hooks are best-effort */ }
+}
 /** Spawn a job as a detached process and return immediately with run metadata. */
-/** Spawn a job as a detached process and return immediately with run metadata. */
-export async function executeJobDetached(config) {
+export async function executeJobDetached(config, hooks) {
     const eligibility = checkJobDeviceEligibility(config);
     if (eligibility) {
         process.stderr.write(`[agents] daemon: skipping '${config.name}' — ${eligibility.message}\n`);
         throw new Error(eligibility.message);
     }
-    // `host:` placement — dispatch over SSH and return; the monitor finalizes.
-    if (config.host) {
-        const { meta } = await executeJobOnHost(config, { detached: true });
-        return meta;
+    // Placement (hostStrategy / bare host:) — dispatch off-box and return; the
+    // monitor finalizes host: runs, cloud runs stay terminal when dispatch ends.
+    // Either way the in-process onFinish hook does not fire for off-box routines
+    // (the monitor tick observes an already-finalized record), so notify-desktop
+    // sends the finish notification only for local detached runs below (RUSH-2030).
+    {
+        const { resolvePlacementTarget } = await import('./routines-placement.js');
+        const target = resolvePlacementTarget(config);
+        if (target.mode === 'host') {
+            const { meta } = await executeJobOnHost({ ...config, host: target.host }, { detached: true });
+            return meta;
+        }
+        if (target.mode === 'cloud') {
+            const { meta } = await executeJobOnCloud(config, { detached: true });
+            return meta;
+        }
     }
     // Command-mode: fire a plain shell command detached (no agent, no rotation,
     // no pinning, no sandbox overlay). Still writes a run record so the daemon,
     // list/runs, and overdue tracking keep working.
     if (config.command) {
-        return executeCommandJobDetached(config);
+        return executeCommandJobDetached(config, hooks);
     }
     // Pre-flight: pick a healthy version/account so the daemon does not launch
     // into a credit-exhausted install. Detached cannot mid-run failover (no exit
@@ -876,10 +1076,29 @@ export async function executeJobDetached(config) {
         finalizeRunMeta(meta, status, exitCode, errorMessage ? { errorMessage } : undefined);
         writeRunMeta(meta);
         archiveRoutineTranscripts(meta, runDir, overlayHome);
-        if (status !== 'timeout')
+        // Never persist the report on an auth failure — the last assistant text is
+        // the login error, which would poison the next run's {last_report} prompt.
+        const isAuthFailure = !!errorMessage && errorMessage.startsWith('auth_failed:');
+        if (status !== 'timeout' && !isAuthFailure)
             extractAndSaveReport(stdoutPath, effectiveAgent, runDir);
+        // Fire the finish/output notification AFTER the report is written so the hook
+        // can read report.md (RUSH-2030). Best-effort; never breaks finalization.
+        safeHook(hooks?.onFinish ? () => hooks.onFinish(meta) : undefined);
     };
     child.on('exit', (code) => {
+        let logText = '';
+        try {
+            logText = fs.readFileSync(stdoutPath, 'utf-8');
+        }
+        catch { /* log unreadable */ }
+        // processFailed gates the raw-text fallback so a COMPLETED run (exit 0) that
+        // merely mentions an auth phrase is never misclassified; the structural
+        // marker still catches an exit-0 auth failure on its own.
+        if (isAuthFailureFromLog(logText, effectiveAgent, { processFailed: (code ?? 1) !== 0 })) {
+            const reason = authFailureReason(logText) ?? 'authentication_failed';
+            settle('failed', code ?? 1, `auth_failed: ${reason}`);
+            return;
+        }
         const inferred = inferFinalStatusFromLog(stdoutPath, effectiveAgent);
         if (inferred) {
             settle(inferred.status, inferred.exitCode);
@@ -911,7 +1130,7 @@ export async function executeJobDetached(config) {
  * un-sandboxed, unref, then record the pid. The daemon does not wait for exit;
  * `monitorRunningJobs` reaps the record on the next tick.
  */
-function executeCommandJobDetached(config) {
+function executeCommandJobDetached(config, hooks) {
     const runId = generateRunId();
     const runDir = getRunDir(config.name, runId);
     fs.mkdirSync(runDir, { recursive: true });
@@ -956,6 +1175,9 @@ function executeCommandJobDetached(config) {
         settled = true;
         finalizeRunMeta(meta, status, exitCode, errorMessage ? { errorMessage } : undefined);
         writeRunMeta(meta);
+        // Finish notification (RUSH-2030). For command routines the threshold only
+        // surfaces failures, decided in routine-notify.ts. Best-effort.
+        safeHook(hooks?.onFinish ? () => hooks.onFinish(meta) : undefined);
     };
     child.on('exit', (code) => settle(code === 0 ? 'completed' : 'failed', code ?? 1));
     child.on('error', (err) => {

package/dist/lib/sandbox.js

@@ -75,6 +75,16 @@ export function buildSpawnEnv(overlayHome, extraEnv) {
             env[key] = process.env[key];
         }
     }
+    // Per-account Claude setup-tokens: the daemon injects a CLAUDE_CODE_OAUTH_TOKEN_<slug>
+    // for each account so a routine authenticates its rotation-pinned account via a
+    // long-lived, non-rotating token (see runner.ts buildRoutineSpawnEnv). Forward every
+    // such key by prefix — same trust tier as CLAUDE_CODE_OAUTH_TOKEN above; still no API
+    // keys or other provider secrets.
+    for (const key of Object.keys(process.env)) {
+        if (key.startsWith('CLAUDE_CODE_OAUTH_TOKEN_') && process.env[key]) {
+            env[key] = process.env[key];
+        }
+    }
     if (extraEnv) {
         Object.assign(env, extraEnv);
     }

package/dist/lib/secrets/account-token.d.ts

@@ -0,0 +1,20 @@
+/** The `CLAUDE_CODE_OAUTH_TOKEN_<slug>` env key for a given account email/id. */
+export declare function accountTokenKey(account: string): string;
+/**
+ * Read the signed-in account email for a Claude version home from
+ * `oauthAccount.emailAddress`. Sync, no keychain, no network. Tries both stores
+ * the canonical resolver uses (agents.ts getAccountInfo): the shim-set
+ * `CLAUDE_CONFIG_DIR` location `<home>/.claude/.claude.json` first, then the
+ * home-level `<home>/.claude.json` (an account signed in via the IDE / direct
+ * binary without the shim writes there). Returns null when neither has a usable
+ * email.
+ */
+export declare function readClaudeAccountEmail(home: string): string | null;
+/**
+ * Resolve the per-account setup-token for the account pinned to `home`, looking
+ * it up in the provided env (the daemon injects the `claude` bundle's
+ * `CLAUDE_CODE_OAUTH_TOKEN_*` keys). Returns null when the home has no known
+ * account, or no matching per-account token is present — callers then leave the
+ * existing ambient/interactive credential untouched (a safe no-op).
+ */
+export declare function resolveAccountSetupToken(env: Record<string, string | undefined>, home: string): string | null;

package/dist/lib/secrets/account-token.js

@@ -0,0 +1,64 @@
+// Per-account Claude setup-token resolution.
+//
+// A headless/unattended Claude run should authenticate with the account's
+// long-lived `claude setup-token` (exported as a per-account
+// `CLAUDE_CODE_OAUTH_TOKEN_<slug>` env var), NOT the interactive OAuth session.
+// Claude Code's interactive session uses single-use ROTATING refresh tokens: when
+// one machine refreshes, the server invalidates the old refresh token globally, so
+// every other machine on that account 401s and gets logged out (Claude Code
+// #25609 / #56339). The 1-year setup-token sits earlier in the auth precedence
+// (`CLAUDE_CODE_OAUTH_TOKEN`, before subscription login) and does not participate
+// in that rotation — so per-account setup-tokens keep the fleet signed in.
+//
+// The per-account env key encodes the account email. The convention (verified
+// against live bundles, e.g. `muqsit@getrush.ai` →
+// `CLAUDE_CODE_OAUTH_TOKEN_MUQSIT_AT_GETRUSH_DOT_AI`): upper-case, `@`→`_AT_`,
+// `.`→`_DOT_`, any other non-alphanumeric → `_`.
+import fs from 'node:fs';
+import path from 'node:path';
+/** The `CLAUDE_CODE_OAUTH_TOKEN_<slug>` env key for a given account email/id. */
+export function accountTokenKey(account) {
+    const slug = account
+        .trim()
+        .toUpperCase()
+        .replace(/@/g, '_AT_')
+        .replace(/\./g, '_DOT_')
+        .replace(/[^A-Z0-9_]/g, '_');
+    return `CLAUDE_CODE_OAUTH_TOKEN_${slug}`;
+}
+/**
+ * Read the signed-in account email for a Claude version home from
+ * `oauthAccount.emailAddress`. Sync, no keychain, no network. Tries both stores
+ * the canonical resolver uses (agents.ts getAccountInfo): the shim-set
+ * `CLAUDE_CONFIG_DIR` location `<home>/.claude/.claude.json` first, then the
+ * home-level `<home>/.claude.json` (an account signed in via the IDE / direct
+ * binary without the shim writes there). Returns null when neither has a usable
+ * email.
+ */
+export function readClaudeAccountEmail(home) {
+    for (const p of [path.join(home, '.claude', '.claude.json'), path.join(home, '.claude.json')]) {
+        try {
+            const email = JSON.parse(fs.readFileSync(p, 'utf-8')).oauthAccount?.emailAddress;
+            if (typeof email === 'string' && email.trim().length > 0)
+                return email.trim();
+        }
+        catch {
+            // Missing/unreadable/malformed at this location — try the next.
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the per-account setup-token for the account pinned to `home`, looking
+ * it up in the provided env (the daemon injects the `claude` bundle's
+ * `CLAUDE_CODE_OAUTH_TOKEN_*` keys). Returns null when the home has no known
+ * account, or no matching per-account token is present — callers then leave the
+ * existing ambient/interactive credential untouched (a safe no-op).
+ */
+export function resolveAccountSetupToken(env, home) {
+    const email = readClaudeAccountEmail(home);
+    if (!email)
+        return null;
+    const token = env[accountTokenKey(email)];
+    return typeof token === 'string' && token.trim().length > 0 ? token.trim() : null;
+}