@phnx-labs/agents-cli 1.20.74 → 1.20.77

package/dist/commands/inspect.js

@@ -21,6 +21,7 @@ import { truncate, termLink } from '../lib/format.js';
 import * as yaml from 'yaml';
 import { AGENTS, getCliState, resolveAgentName } from '../lib/agents.js';
 import { supports } from '../lib/capabilities.js';
+import { resolveConfiguredModel } from '../lib/models.js';
 import { resolveSingleAgentTarget, AgentSpecError } from '../lib/agent-spec/index.js';
 import { readMeta, getUserAgentsDir, getSystemAgentsDir, getProjectAgentsDir, getEnabledExtraRepos, } from '../lib/state.js';
 import { getVersionHomePath } from '../lib/versions.js';
@@ -585,8 +586,10 @@ async function renderSummary(agent, version, versionHome, options) {
         console.log(JSON.stringify(json, null, 2));
         return;
     }
-    // Plain text
-    const head = `${chalk.bold(agent)} ${chalk.gray('@')} ${chalk.cyan(version)}${isDefault ? '  ' + chalk.green('[default]') : ''}`;
+    // Plain text — model sits right beside the version, same priority (no label).
+    const configuredModel = resolveConfiguredModel(agent, version)?.model;
+    const modelPart = configuredModel ? '  ' + chalk.yellow(configuredModel) : '';
+    const head = `${chalk.bold(agent)} ${chalk.gray('@')} ${chalk.cyan(version)}${modelPart}${isDefault ? '  ' + chalk.green('[default]') : ''}`;
     console.log('\n' + head + '\n');
     const rows = [
         ['install', versionHome],

package/dist/commands/profiles.d.ts

@@ -15,5 +15,25 @@ import { type Preset } from '../lib/profiles-presets.js';
  * without mocking @inquirer/prompts.
  */
 export declare function buildProfileFromCollection(name: string, preset: Preset, collected: Record<string, string>, version?: string): Profile;
+/** Options accepted by {@link addProfile} — shared by `agents profiles add` and `agents harness add`. */
+export interface AddProfileOptions {
+    preset?: string;
+    host?: string;
+    model?: string;
+    baseUrl?: string;
+    authProvider?: string;
+    version?: string;
+    keyStdin?: boolean;
+    force?: boolean;
+}
+/**
+ * Create a profile ("custom harness"). Two paths:
+ *  - `--host <agent> --model <id>`: one-shot custom harness from a host + model
+ *    (no preset needed). This is what makes a model like Muse Spark a named,
+ *    runnable harness.
+ *  - otherwise: apply a built-in preset (existing behavior).
+ * `label` only tunes the success wording (Profile vs Harness). Throws on error.
+ */
+export declare function addProfile(name: string, opts: AddProfileOptions, label?: 'Profile' | 'Harness'): Promise<void>;
 /** Register the `agents profiles` command tree. */
 export declare function registerProfilesCommands(program: Command): void;

package/dist/commands/profiles.js

@@ -9,13 +9,13 @@
 import chalk from 'chalk';
 import { readStdinSync } from '../lib/format.js';
 import { spawn } from 'child_process';
-import { listProfiles, readProfile, writeProfile, deleteProfile, profileExists, profileFromPreset, validateProfileName, getPresetForProfile, } from '../lib/profiles.js';
+import { listProfiles, readProfile, writeProfile, deleteProfile, profileExists, profileFromPreset, profileFromHostModel, baseUrlEnvKeyForHost, authEnvKeyForHost, validateProfileName, getPresetForProfile, } from '../lib/profiles.js';
 import { getPreset, listPresets, expandPreset } from '../lib/profiles-presets.js';
 import { hasKeychainToken, keychainItemName, setKeychainToken, deleteKeychainToken, } from '../lib/secrets/profiles.js';
 import { isInteractiveTerminal } from './utils.js';
 import { getAgentsInvocation } from '../lib/daemon.js';
 import { getActiveResourceProfileName, getResourceProfilePreset, listResourceProfileNames, setActiveResourceProfile, upsertResourceProfilePreset, validateResourceProfileName, } from '../lib/resource-profiles.js';
-import { AGENTS } from '../lib/agents.js';
+import { AGENTS, ALL_AGENT_IDS } from '../lib/agents.js';
 import { listInstalledVersions, syncResourcesToVersion } from '../lib/versions.js';
 /**
  * Pure helper: builds a Profile from collected wizard inputs. Extracted so the
@@ -31,6 +31,7 @@ export function buildProfileFromCollection(name, preset, collected, version) {
             envVar: preset.authEnvVar,
             keychainItem: keychainItemName(preset.provider),
         },
+        authOptional: preset.authOptional,
         description: preset.description,
         preset: preset.name,
         provider: preset.provider,
@@ -65,6 +66,66 @@ async function ensureProviderToken(provider, signupUrl, fromStdin) {
     setKeychainToken(item, token);
     console.log(chalk.green(`Stored in keychain: ${item}`));
 }
+/**
+ * Create a profile ("custom harness"). Two paths:
+ *  - `--host <agent> --model <id>`: one-shot custom harness from a host + model
+ *    (no preset needed). This is what makes a model like Muse Spark a named,
+ *    runnable harness.
+ *  - otherwise: apply a built-in preset (existing behavior).
+ * `label` only tunes the success wording (Profile vs Harness). Throws on error.
+ */
+export async function addProfile(name, opts, label = 'Profile') {
+    validateProfileName(name);
+    if (profileExists(name) && !opts.force) {
+        throw new Error(`${label} '${name}' already exists. Use --force to overwrite.`);
+    }
+    // One-shot host + model → custom harness, no preset required.
+    if (opts.host || opts.model) {
+        if (!opts.host || !opts.model) {
+            throw new Error('Both --host <agent> and --model <id> are required to build a harness from a host + model.');
+        }
+        if (!ALL_AGENT_IDS.includes(opts.host)) {
+            throw new Error(`Unknown host '${opts.host}'. Valid hosts: ${ALL_AGENT_IDS.join(', ')}`);
+        }
+        const host = opts.host;
+        if (opts.baseUrl && !baseUrlEnvKeyForHost(host)) {
+            console.error(chalk.yellow(`Note: --base-url has no known env var for host '${host}'; ignoring it.`));
+        }
+        let authEnvVar;
+        if (opts.authProvider) {
+            const key = authEnvKeyForHost(host);
+            if (!key) {
+                throw new Error(`--auth-provider is set but host '${host}' has no known auth env var. Use a preset or a hand-written profile YAML.`);
+            }
+            authEnvVar = key;
+            await ensureProviderToken(opts.authProvider, undefined, opts.keyStdin);
+        }
+        const profile = profileFromHostModel(name, host, opts.model, {
+            version: opts.version,
+            baseUrl: opts.baseUrl,
+            provider: opts.authProvider,
+            authEnvVar,
+        });
+        writeProfile(profile);
+        console.log(chalk.green(`${label} '${name}' added — ${host} + ${opts.model}.`));
+        console.log(chalk.gray(`Try: agents run ${name} "hello"`));
+        return;
+    }
+    // Preset path.
+    const presetName = opts.preset || name;
+    const preset = getPreset(presetName);
+    if (!preset) {
+        throw new Error(`No preset '${presetName}'.\nAvailable presets: ${listPresets().map((p) => p.name).join(', ')}\n` +
+            'Or build a custom harness: --host <agent> --model <id>.');
+    }
+    if (!preset.authOptional) {
+        await ensureProviderToken(preset.provider, preset.signupUrl, opts.keyStdin);
+    }
+    const profile = profileFromPreset(name, preset, opts.version);
+    writeProfile(profile);
+    console.log(chalk.green(`${label} '${name}' added.`));
+    console.log(chalk.gray(`Try: agents run ${name} "hello"`));
+}
 /** Format a single profile as a table row for the `profiles list` output. */
 function renderProfileRow(p) {
     const host = p.host.version ? `${p.host.agent}@${p.host.version}` : p.host.agent;
@@ -462,27 +523,13 @@ Examples:
         .option('--version <version>', 'Pin the host CLI version (e.g., 2.1.113)')
         .option('--key-stdin', 'Read API key from stdin instead of prompting (for scripts/CI)')
         .option('--force', 'Overwrite an existing profile with the same name')
+        .addHelpText('after', '\nTo build a custom harness from a host CLI + model in one shot, use `agents harness add`.\n')
         .action(async (name, opts) => {
+        // Preset-only surface here — `--host` on `profiles` is reserved for remote
+        // device routing (see lib/hosts/passthrough.ts). The host+model one-shot
+        // lives on `agents harness add`, which owns its own `--host`.
         try {
-            if (profileExists(name) && !opts.force) {
-                console.error(chalk.red(`Profile '${name}' already exists. Use --force to overwrite.`));
-                process.exit(1);
-            }
-            const presetName = opts.preset || name;
-            const preset = getPreset(presetName);
-            if (!preset) {
-                console.error(chalk.red(`No preset '${presetName}'.`));
-                console.error(chalk.gray('Available presets: ' + listPresets().map((p) => p.name).join(', ')));
-                console.error(chalk.gray('Or pass --preset <name> to pick explicitly.'));
-                process.exit(1);
-            }
-            if (!preset.authOptional) {
-                await ensureProviderToken(preset.provider, preset.signupUrl, opts.keyStdin);
-            }
-            const profile = profileFromPreset(name, preset, opts.version);
-            writeProfile(profile);
-            console.log(chalk.green(`Profile '${name}' added.`));
-            console.log(chalk.gray(`Try: agents run ${name} "hello"`));
+            await addProfile(name, { preset: opts.preset, version: opts.version, keyStdin: opts.keyStdin, force: opts.force }, 'Profile');
         }
         catch (err) {
             console.error(chalk.red(err.message));

package/dist/commands/repo.js

@@ -812,6 +812,7 @@ export function registerRepoCommands(program) {
             console.log(chalk.gray('No repos to pull.'));
             return;
         }
+        let anyPulled = false;
         for (const t of targets) {
             if (!fs.existsSync(t.dir) || !isGitRepo(t.dir)) {
                 // A plain (never-cloned) user repo — setup makes ~/.agents a bare dir and
@@ -851,11 +852,24 @@ export function registerRepoCommands(program) {
             const result = await pullRepo(t.dir);
             if (result.success) {
                 spinner.succeed(`${formatRepoTarget(t.alias, t.dir, result.branch)}: ${result.commit}`);
+                anyPulled = true;
             }
             else {
                 spinner.fail(`${formatRepoTarget(t.alias, t.dir)}: ${result.error}`);
             }
         }
+        // RUSH-1980: a pull rewrites the routine YAML on disk, but the daemon's
+        // scheduler froze its JobConfigs (device pins included) at load. Without a
+        // reload it keeps firing the pre-pull pins — a routine re-pinned to another
+        // host still fires here, double-firing across the fleet. SIGHUP the daemon
+        // so scheduler.reloadAll() re-reads the synced YAML and device pins refresh.
+        // No-op when the daemon isn't running (or on Windows, which has no SIGHUP).
+        if (anyPulled) {
+            const { isDaemonRunning, signalDaemonReload } = await import('../lib/daemon.js');
+            if (isDaemonRunning() && signalDaemonReload()) {
+                console.log(chalk.gray('Reloaded the routines daemon (device pins refreshed).'));
+            }
+        }
     });
     repoCmd
         .command('push [alias]')

package/dist/commands/routines.js

@@ -12,7 +12,8 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemonLog, getDaemonStatus, } from '../lib/daemon.js';
 import { humanizeCron, humanizeNextRun, formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
-import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, getLatestRun, getRunDir, getJobPath, parseAtTime, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, } from '../lib/routines.js';
+import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, getLatestRun, getRunDir, getJobPath, parseAtTime, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, placementRequiresFiringPin, HOST_STRATEGIES, } from '../lib/routines.js';
+import { discoverProjectRoutinesAt, enableProjectRoutines, disableProjectRoutines, syncProjectRoutines, syncAllProjectRoutines, listEnabledProjectRoots, resolveProjectRoot, displayProjectPath, listProjectRoutineFiles, } from '../lib/routines-project.js';
 import { fireWebhookJobs, matchJobsToWebhook } from '../lib/triggers/webhook.js';
 import { getRoutinesDir } from '../lib/state.js';
 import { IS_WINDOWS } from '../lib/platform/index.js';
@@ -131,6 +132,24 @@ function ensureSchedulerRunning(opts = {}) {
 function writeJson(payload) {
     process.stdout.write(JSON.stringify(payload) + '\n');
 }
+function printSyncResult(sync) {
+    console.log(chalk.bold(displayProjectPath(sync.projectRoot)));
+    if (sync.synced.length === 0 && sync.skipped.length === 0 && sync.removed.length === 0 && sync.errors.length === 0) {
+        console.log(chalk.gray('  (no project routines)'));
+    }
+    if (sync.synced.length > 0) {
+        console.log(chalk.green(`  synced: ${sync.synced.join(', ')}`));
+    }
+    if (sync.removed.length > 0) {
+        console.log(chalk.gray(`  removed: ${sync.removed.join(', ')}`));
+    }
+    for (const s of sync.skipped) {
+        console.log(chalk.yellow(`  skipped ${s.name}: ${s.reason}`));
+    }
+    for (const e of sync.errors) {
+        console.log(chalk.red(`  error ${e.name}: ${e.error}`));
+    }
+}
 function runMetaJson(run) {
     return {
         jobId: run.jobName,
@@ -233,6 +252,14 @@ export function registerRoutinesCommands(program) {
       # Create from YAML (for complex routines with multiple settings)
       agents routines add weekly-report.yml
 
+      # Place the job body on a fleet device / cloud / named host (not --host)
+      agents routines add drain --schedule "0 3 * * *" --agent claude --placement fleet --prompt "Drain queue"
+      agents routines add review --schedule "0 9 * * 1" --agent claude --placement cloud --prompt "Review open PRs"
+
+      # Opt a project's .agents/routines/*.yml into daemon firing (never auto)
+      agents routines enable-project --yes
+      agents routines sync
+
       # List all routines and their next run times
       agents routines list
 
@@ -323,6 +350,10 @@ export function registerRoutinesCommands(program) {
                     timezone: job.timezone ?? null,
                     devices: job.devices ?? [],
                     host: job.host ?? null,
+                    hostStrategy: resolveHostStrategy(job),
+                    source: job.source ?? null,
+                    sourceRepo: job.source?.repo ?? job.repo ?? null,
+                    sourceBranch: job.source?.branch ?? null,
                     runsHere: jobRunsOnThisDevice(job),
                     enabled: job.enabled,
                     overdue: overdueSet.has(job.name),
@@ -368,7 +399,12 @@ export function registerRoutinesCommands(program) {
             }
             const latestRun = getLatestRun(job.name);
             const lastStatus = latestRun?.status || '-';
-            const repoInfo = formatRepoLink(job.repo);
+            // Prefer project-source repo (with optional @branch) over bare job.repo.
+            const sourceRepo = job.source?.repo ?? job.repo;
+            const sourceLabel = sourceRepo
+                ? (job.source?.branch ? `${sourceRepo}@${job.source.branch}` : sourceRepo)
+                : null;
+            const repoInfo = formatRepoLink(sourceLabel ?? job.repo);
             const repoCell = link(repoInfo.display, repoInfo.href);
             // Pad based on the display string, not the raw cell (which may include escape codes).
             const repoPadding = Math.max(0, REPO_W - repoInfo.display.length);
@@ -376,8 +412,16 @@ export function registerRoutinesCommands(program) {
             // chalk adds escape codes; pad the raw word and let chalk wrap it.
             const enabledWord = job.enabled ? 'yes' : 'no';
             const enabledPad = Math.max(0, ENABLED_W - enabledWord.length);
-            // Placement (`→host`) rides in the Devices cell: eligibility →execution.
-            const deviceFull = [job.devices?.join(',') ?? '', job.host ? `→${job.host}` : '']
+            // Placement rides in the Devices cell: eligibility →execution strategy.
+            const strategy = resolveHostStrategy(job);
+            const placementTag = strategy === 'local'
+                ? (job.host ? `→${job.host}` : '')
+                : strategy === 'host'
+                    ? `→${job.host ?? '?'}`
+                    : strategy === 'fleet'
+                        ? '→fleet'
+                        : '→cloud';
+            const deviceFull = [job.devices?.join(',') ?? '', placementTag]
                 .filter(Boolean)
                 .join(' ');
             const deviceWord = deviceFull.length === 0
@@ -423,7 +467,8 @@ export function registerRoutinesCommands(program) {
         .option('-t, --timeout <timeout>', 'Kill the agent if it runs longer than this (e.g., 10m, 2h, 3d, 1w; max 1w)', '10m')
         .option('--timezone <tz>', 'Interpret schedule in this timezone (e.g., America/Los_Angeles)')
         .option('--devices <names>', 'Fleet allowlist (comma-separated): only listed devices schedule and fire this routine. Omit for unrestricted.')
-        .option('--run-on <name>', 'Execute the job body on this machine over SSH (a registered host, device, capability tag, or user@host). Placement, not eligibility — see --devices. Auto-pins devices to THIS machine unless --devices is given.')
+        .option('--run-on <name>', 'Execute the job body on this machine over SSH (a registered host, device, capability tag, or user@host). Sets hostStrategy=host. Placement, not eligibility — see --devices. Auto-pins devices to THIS machine unless --devices is given.')
+        .option('--placement <strategy>', `Where the job body runs: ${HOST_STRATEGIES.join('|')} (default: local, or host when --run-on is set). Not the same as --host (which manages routines on a remote machine).`)
         .option('--run-cwd <dir>', 'Working directory on the --run-on host (--remote-cwd is taken by the remote-management passthrough)')
         .option('--at <time>', 'One-shot mode: run once at this time (e.g., "14:30" or "2026-02-24 09:00"), then disable')
         .option('--on <source:event>', 'Webhook trigger instead of/in addition to a schedule: github:pull_request or linear:Issue')
@@ -490,12 +535,29 @@ export function registerRoutinesCommands(program) {
             if (options.devices !== undefined) {
                 devices = await parseAndValidateDevices(options.devices);
             }
-            // --run-on without a --devices pin would fire on EVERY daemon in the
-            // fleet, each dispatching to the same host — duplicate runs. Pin to
-            // this machine unless the user chose an explicit eligibility set.
-            if (options.runOn && !devices) {
+            let hostStrategy;
+            try {
+                hostStrategy = parseHostStrategy(options.placement) ?? undefined;
+            }
+            catch (err) {
+                console.error(chalk.red(err.message));
+                process.exit(1);
+            }
+            // --run-on implies host strategy when the user didn't pick one.
+            if (options.runOn && !hostStrategy)
+                hostStrategy = 'host';
+            if (hostStrategy === 'host' && !options.runOn) {
+                console.error(chalk.red('--placement host requires --run-on <name>'));
+                process.exit(1);
+            }
+            // Off-box placement without a --devices pin would fire on EVERY daemon
+            // in the fleet, each dispatching once — duplicate runs (RUSH-1980).
+            // Pin to this machine unless the user chose an explicit eligibility set.
+            const strategyForPin = hostStrategy
+                ?? (options.runOn ? 'host' : 'local');
+            if (placementRequiresFiringPin(strategyForPin) && !devices) {
                 devices = [machineId()];
-                console.error(chalk.gray(`--run-on set with no --devices: pinned firing to this machine (${devices[0]}).`));
+                console.error(chalk.gray(`--placement ${strategyForPin} with no --devices: pinned firing to this machine (${devices[0]}).`));
             }
             const config = {
                 name: nameOrPath,
@@ -512,6 +574,7 @@ export function registerRoutinesCommands(program) {
                 timezone: options.timezone,
                 ...(devices ? { devices } : {}),
                 ...(options.runOn ? { host: options.runOn } : {}),
+                ...(hostStrategy ? { hostStrategy } : {}),
                 ...(options.runCwd ? { remoteCwd: options.runCwd } : {}),
                 ...(runOnce ? { runOnce: true } : {}),
                 ...(options.endAt ? { endAt: options.endAt } : {}),
@@ -586,11 +649,12 @@ export function registerRoutinesCommands(program) {
                 enabled: true,
                 ...parsed,
             };
-            // Same duplicate-fire guard as the --run-on flag: a host-placed routine
+            // Same duplicate-fire guard as --placement/--run-on: off-box placement
             // with no eligibility pin would fire from every daemon in the fleet.
-            if (config.host && (!config.devices || config.devices.length === 0)) {
+            const fileStrategy = resolveHostStrategy(config);
+            if (placementRequiresFiringPin(fileStrategy) && (!config.devices || config.devices.length === 0)) {
                 config.devices = [machineId()];
-                console.error(chalk.gray(`host: set with no devices pin: pinned firing to this machine (${config.devices[0]}).`));
+                console.error(chalk.gray(`${fileStrategy} placement with no devices pin: pinned firing to this machine (${config.devices[0]}).`));
             }
             writeJob(config);
             if (options.json) {
@@ -783,18 +847,26 @@ export function registerRoutinesCommands(program) {
         try {
             const result = await executeJob(job);
             const logPath = `${getRunDir(name, result.meta.runId)}/stdout.log`;
+            const succeeded = result.meta.status === 'completed';
             if (options.json) {
                 writeJson({
-                    ok: true,
+                    ok: succeeded,
                     job: name,
                     logDir: getRunDir(name, result.meta.runId),
                     ...runMetaJson(result.meta),
                     logPath,
                     reportPath: result.reportPath ?? null,
                 });
+                // A failed run must exit non-zero so cron wrappers, `&&` chains, and
+                // `--json` consumers actually see the failure (a logged-out agent used
+                // to exit 0 with ok:true, hiding the whole auth-failure epidemic). Set
+                // exitCode rather than process.exit() so the JSON payload is fully
+                // flushed to a pipe before the process ends.
+                if (!succeeded)
+                    process.exitCode = 1;
                 return;
             }
-            if (result.meta.status === 'completed') {
+            if (succeeded) {
                 spinner.succeed(`Job completed (exit code: ${result.meta.exitCode})`);
             }
             else if (result.meta.status === 'timeout') {
@@ -805,10 +877,15 @@ export function registerRoutinesCommands(program) {
             }
             console.log(chalk.gray(`  Run: ${result.meta.runId}`));
             console.log(chalk.gray(`  Log: ${logPath}`));
+            if (result.meta.errorMessage) {
+                console.log(chalk.gray(`  Reason: ${result.meta.errorMessage}`));
+            }
             if (result.reportPath) {
                 console.log(chalk.bold('\nReport:\n'));
                 console.log(fs.readFileSync(result.reportPath, 'utf-8'));
             }
+            if (!succeeded)
+                process.exitCode = 1;
         }
         catch (err) {
             if (options.json) {
@@ -1107,6 +1184,12 @@ export function registerRoutinesCommands(program) {
             process.exit(1);
         }
         if (options.clear) {
+            const strategy = resolveHostStrategy(job);
+            if (placementRequiresFiringPin(strategy)) {
+                console.error(chalk.red(`Cannot clear devices for hostStrategy: ${strategy} — without a pin every fleet daemon would dispatch once.`));
+                console.error(chalk.gray(`Keep a single-machine pin (e.g. --set ${machineId()}) or switch to --placement local.`));
+                process.exit(1);
+            }
             job.devices = undefined;
             writeJob(job);
             console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
@@ -1117,6 +1200,12 @@ export function registerRoutinesCommands(program) {
         if (hasSet) {
             const devices = await parseAndValidateDevices(options.set);
             job.devices = devices;
+            // Re-validate so host/fleet/cloud can't be left with an empty set via --set ""
+            const errs = validateJob(job);
+            if (errs.length > 0) {
+                console.error(chalk.red(errs.join('\n')));
+                process.exit(1);
+            }
             writeJob(job);
             console.log(chalk.green(`Devices for '${name}' set to: ${devices.join(', ')}`));
             if (isDaemonRunning())
@@ -1145,6 +1234,11 @@ export function registerRoutinesCommands(program) {
                 })),
             });
             if (selected.length === 0) {
+                const strategy = resolveHostStrategy(job);
+                if (placementRequiresFiringPin(strategy)) {
+                    console.error(chalk.red(`Cannot clear devices for hostStrategy: ${strategy} — without a pin every fleet daemon would dispatch once.`));
+                    return;
+                }
                 job.devices = undefined;
                 writeJob(job);
                 console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
@@ -1237,6 +1331,183 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.gray('\n  Start the scheduler to begin firing routines: agents routines start'));
         }
     });
+    routinesCmd
+        .command('enable-project [path]')
+        .description('Opt a project\'s .agents/routines/*.yml into daemon firing. Requires explicit approval — project routines never auto-fire from a cloned repo. Materialises copies into ~/.agents/routines/ with source provenance.')
+        .option('--yes', 'Skip the interactive confirmation prompt')
+        .option('--json', 'Emit machine-readable JSON')
+        .action(async (projectPath, options) => {
+        const root = projectPath
+            ? path.resolve(projectPath)
+            : resolveProjectRoot(process.cwd());
+        if (!root) {
+            console.error(chalk.red('No project .agents/ directory found from the current directory.'));
+            console.error(chalk.gray('Run from inside a project, or pass the project path: agents routines enable-project /path/to/repo'));
+            process.exit(1);
+        }
+        const files = listProjectRoutineFiles(root);
+        if (files.length === 0) {
+            console.error(chalk.red(`No routines found under ${path.join(root, '.agents', 'routines')}`));
+            process.exit(1);
+        }
+        if (!options.yes) {
+            if (!isInteractiveTerminal()) {
+                console.error(chalk.red('Refusing to enable project routines non-interactively without --yes.'));
+                console.error(chalk.gray(`Found ${files.length} routine(s) in ${displayProjectPath(root)}. Re-run with --yes to confirm.`));
+                process.exit(1);
+            }
+            try {
+                const { confirm } = await import('@inquirer/prompts');
+                const ok = await confirm({
+                    message: `Enable daemon firing for ${files.length} project routine(s) in ${displayProjectPath(root)}?`,
+                    default: false,
+                });
+                if (!ok) {
+                    console.log(chalk.gray('Cancelled'));
+                    return;
+                }
+            }
+            catch (err) {
+                if (isPromptCancelled(err)) {
+                    console.log(chalk.gray('Cancelled'));
+                    return;
+                }
+                throw err;
+            }
+        }
+        const newly = enableProjectRoutines(root);
+        const sync = syncProjectRoutines(root);
+        if (isDaemonRunning())
+            signalDaemonReload();
+        if (options.json) {
+            writeJson({
+                ok: true,
+                projectRoot: root,
+                newlyEnabled: newly,
+                synced: sync.synced,
+                skipped: sync.skipped,
+                removed: sync.removed,
+                errors: sync.errors,
+            });
+            return;
+        }
+        console.log(chalk.green(newly
+            ? `Enabled project routines for ${displayProjectPath(root)}`
+            : `Project routines already enabled for ${displayProjectPath(root)}`));
+        if (sync.synced.length > 0) {
+            console.log(chalk.gray(`  Synced: ${sync.synced.join(', ')}`));
+        }
+        for (const s of sync.skipped) {
+            console.log(chalk.yellow(`  Skipped ${s.name}: ${s.reason}`));
+        }
+        for (const e of sync.errors) {
+            console.log(chalk.red(`  Error ${e.name}: ${e.error}`));
+        }
+        console.log(chalk.gray('Daemon will fire these after reload. Re-sync later with: agents routines sync'));
+    });
+    routinesCmd
+        .command('disable-project [path]')
+        .description('Remove a project from the project-routines allowlist. Use --remove-synced to also delete the user-layer copies.')
+        .option('--remove-synced', 'Delete user-layer routines that were materialised from this project')
+        .option('--json', 'Emit machine-readable JSON')
+        .action(async (projectPath, options) => {
+        const root = projectPath
+            ? path.resolve(projectPath)
+            : resolveProjectRoot(process.cwd());
+        if (!root) {
+            console.error(chalk.red('No project .agents/ directory found from the current directory.'));
+            process.exit(1);
+        }
+        const result = disableProjectRoutines(root, { removeSynced: options.removeSynced });
+        if (isDaemonRunning())
+            signalDaemonReload();
+        if (options.json) {
+            writeJson({ ok: true, projectRoot: root, ...result });
+            return;
+        }
+        if (!result.removed) {
+            console.log(chalk.gray(`Project ${displayProjectPath(root)} was not on the allowlist`));
+        }
+        else {
+            console.log(chalk.green(`Disabled project routines for ${displayProjectPath(root)}`));
+        }
+        if (result.deletedJobs.length > 0) {
+            console.log(chalk.gray(`  Removed user-layer copies: ${result.deletedJobs.join(', ')}`));
+        }
+    });
+    routinesCmd
+        .command('sync [path]')
+        .description('Refresh user-layer copies of opted-in project routines from their .agents/routines/*.yml sources. With no path, syncs every enabled project. Also runs automatically on daemon reload (SIGHUP).')
+        .option('--json', 'Emit machine-readable JSON')
+        .action(async (projectPath, options) => {
+        if (projectPath) {
+            const root = path.resolve(projectPath);
+            const isEnabled = listEnabledProjectRoots().some((p) => p === root);
+            if (!isEnabled) {
+                console.error(chalk.red(`Project ${displayProjectPath(root)} is not enabled. Run: agents routines enable-project ${root}`));
+                process.exit(1);
+            }
+            const sync = syncProjectRoutines(root);
+            if (isDaemonRunning())
+                signalDaemonReload();
+            if (options.json) {
+                writeJson({ ok: true, ...sync });
+                return;
+            }
+            printSyncResult(sync);
+            return;
+        }
+        const all = syncAllProjectRoutines();
+        if (isDaemonRunning())
+            signalDaemonReload();
+        if (options.json) {
+            writeJson({ ok: true, ...all });
+            return;
+        }
+        if (all.projects.length === 0 && all.missing.length === 0) {
+            console.log(chalk.gray('No project roots on the routines allowlist.'));
+            console.log(chalk.gray('  Enable one with: agents routines enable-project'));
+            return;
+        }
+        for (const p of all.projects)
+            printSyncResult(p);
+        for (const m of all.missing) {
+            console.log(chalk.yellow(`Missing project root (still on allowlist): ${displayProjectPath(m)}`));
+        }
+    });
+    routinesCmd
+        .command('projects')
+        .description('List project roots opted into daemon-fired project routines')
+        .option('--json', 'Emit machine-readable JSON')
+        .action((options) => {
+        const roots = listEnabledProjectRoots();
+        if (options.json) {
+            writeJson(roots.map((r) => ({
+                path: r,
+                display: displayProjectPath(r),
+                routines: listProjectRoutineFiles(r).map((f) => f.name),
+            })));
+            return;
+        }
+        if (roots.length === 0) {
+            console.log(chalk.gray('No projects enabled. Use: agents routines enable-project'));
+            // Offer a discovery hint for the current project.
+            const discovered = discoverProjectRoutinesAt(process.cwd());
+            if (discovered) {
+                console.log(chalk.gray(`  Found ${discovered.files.length} routine(s) in ${displayProjectPath(discovered.projectRoot)} — enable with: agents routines enable-project`));
+            }
+            return;
+        }
+        console.log(chalk.bold('Enabled project routines\n'));
+        for (const r of roots) {
+            const files = listProjectRoutineFiles(r);
+            console.log(`  ${chalk.cyan(displayProjectPath(r))}  ${chalk.gray(`(${files.length} routine${files.length === 1 ? '' : 's'})`)}`);
+            for (const f of files) {
+                console.log(chalk.gray(`    - ${f.name}`));
+            }
+        }
+        console.log();
+    });
     routinesCmd
         .command('scheduler-logs')
         .description('Read scheduler log output (for debugging why a routine did not fire). Use --follow to stream.')