@phnx-labs/agents-cli 1.20.76 → 1.20.77

package/CHANGELOG.md

@@ -1,5 +1,167 @@
 # Changelog
 
+## 1.20.77
+
+- **Interactive `agents run --host` now tracks the real session for every agent,
+  not just Claude.** Codex, Kimi, Grok, and Gemini coin their own session id and
+  reject a caller-supplied one, so an interactive host run of any of them showed a
+  stale/absent id locally — `agents sessions` couldn't surface it and a dropped
+  link couldn't auto-reconnect it (RUSH-2033 fixed only the Claude `--session-id`
+  path). The launcher now forwards one correlation key it controls
+  (`AGENT_LAUNCH_ID`); the remote `agents run` adopts that key
+  (`resolveLaunchId`), so its SessionStart hook records the agent's real session id
+  under it. After the stream the launcher does one ssh read of the remote hook
+  record, resolves the real id by launch id (`resolveRemoteSessionId` /
+  `pickRemoteSessionId`), registers it in the local session index, and reconnects
+  against it on a dropped link. Claude still forces its own id up front and is
+  unchanged. Source: `apps/cli/src/lib/hosts/remote-session-id.ts`,
+  `resolveLaunchId` in `apps/cli/src/lib/exec.ts`, and the interactive `--host`
+  branch in `apps/cli/src/commands/exec.ts`. (RUSH-2034)
+
+- **Project routines can opt into daemon firing with source tracking, sync, and
+  host placement (RUSH-2035).** Project YAML under `<project>/.agents/routines/*.yml`
+  stays inspection-only until `agents routines enable-project` (with interactive /
+  `--yes` approval) records the project on `meta.routines.projects` and materialises
+  copies into `~/.agents/routines/` with a `source:` block (`projectPath`, git
+  `repo`/`branch`/`commit`). `agents routines sync` (and daemon start/SIGHUP reload)
+  refreshes those copies when project YAML changes; `disable-project` / `projects`
+  manage the allowlist. New `hostStrategy: local|host|fleet|cloud` (CLI `--placement`)
+  chooses where the job body runs: local, a named `--run-on` host, one online fleet
+  device per fire (no cross-device double-fire — off-box strategies auto-pin
+  `devices`), or the agent's native cloud provider. `--host` remains the remote-
+  management passthrough. List/JSON surfaces source repo/branch and strategy. Source:
+  `apps/cli/src/lib/routines.ts`, `routines-project.ts`, `routines-placement.ts`,
+  `runner.ts`, `daemon.ts`, `commands/routines.ts`, `docs/03-routines.md`.
+
+- **Factory interactive launches default to `--mode auto` (RUSH-2038).** The Factory VS Code extension no longer inherits the CLI's `plan` default for interactive terminal launches. Codex, Claude, Gemini, Cursor, OpenCode, and Antigravity now start in `auto` (writable-but-gated) when opened from Factory without an explicit mode, so the agent can edit files instead of stalling in a read-only sandbox. Source: `apps/factory/src/core/agents.ts`.
+
+- **Codex approval blocks now notify you.** A headless or terminal Codex agent
+  blocked on an approval prompt used to stall silently — the feed/notification path
+  only fired for Claude. Codex emits `PermissionRequest` (not Claude's
+  `Notification`), which the `feed-publish` hook now handles: it publishes an
+  approval-class block with a high cost-of-delay and a `deny` safe-default, so the
+  blocked agent surfaces on `agents feed` and `agents feed --dispatch` pages the
+  phone as urgent. A Codex approval card clears once the approved tool runs, via a
+  matcher-less `PostToolUse` clear hook registered **for Codex only** — so Claude's
+  card lifetime (its `permission_prompt`/`idle_prompt`/`elicitation_dialog`
+  notification blocks persist until `Stop`/`SessionEnd`) and per-tool overhead are
+  exactly as before. The other feed hooks are now registered for Codex too, not
+  Claude only. The Factory extension bridges the same waiting state to an
+  edge-triggered VS Code notification with a "Focus terminal" action. Claude's path
+  is unchanged. Source: `FEED_PUBLISH_HOOK_SCRIPT` / `ensureFeedPublishHook` in
+  `apps/cli/src/lib/feed.ts`, `apps/factory/src/core/waitingNotifier.ts`.
+  (RUSH-2039)
+
+- **`agents fleet ping` now completes within ~15 s per device and ~30 s total, even when several fleet devices are offline or slow (RUSH-2041).** The per-device remote auth probe timeout was lowered from 60 s to 15 s (matching the `fleet status` version-probe budget, which is enough for the ~8 s provider-fetch inside the local auth probe). `fanOutDevices` gained an optional `perDeviceTimeoutMs` that races each probe against a deadline and records it as `failed: timed out` instead of hanging. `runFleetPing` now also wraps the entire fan-out in a 30 s hard cap so the command can never outlast a reasonable budget. Offline devices are now reported promptly as failed/timed-out rather than left hanging in the spinner. Source: `apps/cli/src/lib/devices/fleet.ts` (`fanOutDevices`, `FanOutDeviceOptions`), `apps/cli/src/commands/ssh.ts` (`probeRemoteAuth`, `runFleetPing`).
+
+- **`agents sessions` surfaces checklist progress in every list/preview (RUSH-2045).** The picker preview, `--active` rows (local + cross-machine), flat `doing` cell, and metadata-only previews now show compact `✓done/total · current step` from `SessionMeta.todos` / `ActiveSession.todos`, plus the originating prompt and a directories-touched activity line. Active/cross-machine rows also show label + clickable project/ticket alongside the agent short id. Covers interactive, headless, teams, and sub-agent sessions that share the preview infra. Source: `apps/cli/src/commands/sessions-picker.ts`, `apps/cli/src/commands/sessions.ts`.
+
+- **Checklist completions emit a feed event (RUSH-2046).** When an agent marks a
+  task-checklist item done, the `11-activity-log.py` hook now appends a
+  `task.completed` milestone to the session activity log (and `checklist.created`
+  the first time a checklist appears), so completions show in `agents feed` and the
+  unified `agents events` stream with the item subject and running `N/M`. Detection
+  folds the transcript across harnesses — Claude `TaskUpdate`/`TodoWrite`, Grok
+  `todo_write`, Codex `update_plan` — so a completion is recognized regardless of
+  which agent produced it. Source: `apps/cli/src/lib/activity.ts` (incl. the embedded
+  hook), `apps/cli/src/lib/events.ts`, `apps/cli/src/commands/feed.ts`.
+
+- **Actor provenance now survives the SSH hop.** A run dispatched to another host
+  (`agents run --host`, a remote `agents teams` supervisor, or any `--host`
+  passthrough) used to drop the resolved actor at the SSH boundary, so the remote
+  re-resolved it from the *originating* box's `SSH_CONNECTION` and mis-credited the
+  work to the shared machine or `UNRESOLVED@<host>`. The dispatch layer now forwards
+  `AGENTS_ACTOR*` / `GIT_*` across the wire (POSIX `export` and Windows `$env:`
+  alike), so the remote inherits the origin identity instead of re-resolving. A
+  caller-supplied env value still wins on collision (mirrors `buildExecEnv`).
+  Source: `withActorEnv` in `apps/cli/src/lib/hosts/dispatch.ts`, wired into
+  `launchDetached` / `runInteractiveOnHost` and the `--host` passthrough. (RUSH-2028)
+
+- **A Linux-driven release now auto-discovers its macOS sign host instead of
+  hardcoding `mac-mini`.** `scripts/remote-sign-mac.sh` previously defaulted
+  `SIGN_HOST` to `mac-mini`, so a release from a Linux box failed outright whenever
+  that one appliance was offline — the recurring reason a release stalled and a
+  human had to finish it by hand. With `SIGN_HOST` unset the script now reads
+  `agents devices list --json`, keeps the reachable/online macOS devices, and picks
+  the first that answers `ssh` in preference order `mac-mini` → `zion` → any other
+  online Mac. `mac-mini` stays first because it signs headlessly (no Touch ID);
+  `zion` (the interactive Mac) is the fallback. An explicit `SIGN_HOST=<host>` still
+  pins one and skips discovery, and when no reachable Mac qualifies the script fails
+  with the ordered list it tried rather than hanging on a dead host. Source:
+  `apps/cli/scripts/remote-sign-mac.sh`.
+
+- **An agent launch never raises a Touch ID sheet.** On macOS, starting an agent
+  terminal or firing a routine could pop several biometric prompts in a row, because
+  each keychain read runs in its own helper process and the biometric assertion never
+  reuses across processes. Two causes: `interactiveUnlock` defaulted to true whenever
+  an agent name was present, which let an agent-initiated read fall through the
+  `agentOnly` guard; and `isHeadlessSecretsContext` recognized the `headless` and
+  `teams` runtimes but not `terminal`, which is what an interactive run sets. Agent
+  launches now resolve broker-only and a locked bundle fails fast naming
+  `agents secrets unlock <bundle>`; `AGENTS_SECRETS_NO_PROMPT=1` is no longer needed
+  as a workaround. `agents secrets get/export/exec` typed in a **plain shell** still
+  prompts — it carries no `AGENTS_RUNTIME`, so the guard does not apply. Run beneath
+  an agent it refuses, because there the agent is the caller. This narrows the
+  agent-triggered approval added in RUSH-2032, which is unreleased.
+
+- **`release.sh` now borrows the npm token from a primary device when the local box
+  has none, so a Linux-driven release stops asking a human to approve a token.**
+  Token resolution was env → local `npmjs.com` bundle → *die*. On a fleet box whose
+  own keychain holds no npm token, that dead end pushed agents to hand-move a
+  credential between machines (and correctly get gated on it). A third step now
+  resolves the bundle **ephemerally from a primary device over SSH** —
+  `agents secrets exec npmjs.com --host <host>`, which resolves on the remote and
+  injects into the run only, never storing the token locally. It tries `SECRET_HOST`
+  first, then `zion`, then `mac-mini`, and fails with the list it tried if none
+  answer. Combined with the sign-host auto-discovery, a Linux box can now cut a full
+  release end-to-end given a reachable Mac for signing and any reachable device that
+  holds the npm token. Source: `apps/cli/scripts/release.sh`.
+
+- **Branded, actionable daemon notifications on the routine lifecycle (RUSH-2030).**
+  Daemon desktop notifications (overdue routines, config heal, the no-credential
+  warning) now route through the `MenubarHelper.app` companion instead of raw
+  AppleScript, so they carry the agents-cli mark rather than the generic Script
+  Editor icon; they degrade to `osascript`/`notify-send` only when the helper is
+  not installed. The daemon also notifies when a routine **starts** and
+  **finishes** (success/failure, with the report's first line or the error reason
+  folded in), suppressing command-housekeeping start/success pings to avoid spam.
+  Clicking a finish notification opens the run report/log; start/overdue open the
+  runs folder. Source: `apps/cli/src/lib/menubar/notify-desktop.ts`,
+  `apps/cli/src/lib/routine-notify.ts`, `apps/cli/src/lib/daemon.ts`,
+  `apps/cli/menubar/Sources/MenubarHelper/PromptPanel.swift`.
+
+- **`agents secrets status` now suggests which bundles to unlock.** It reads the existing `secrets.get` audit events and surfaces bundles you keep getting a Touch ID prompt for — read from the keychain (not served silently by the broker/session) 3+ times in the last 7 days and not currently held — with a ready `agents secrets unlock <name>` command. `never`/no-ACL bundles (which never prompt) are excluded, and the hint is best-effort so it never breaks `status`. Source: `apps/cli/src/lib/secrets/unlock-hints.ts`, `apps/cli/src/commands/secrets.ts`.
+
+- **`agents sessions <id>` with a short/partial id resolves by id only — no more
+  "Multiple sessions match" from fuzzy content.** A complete UUID already resolved
+  by id, but a bare hex short-id like `d3470b57` was not caught by
+  `isCompleteSessionId`, so it fell through to the ranked content search and
+  surfaced every transcript that merely MENTIONED the string (a resume prompt
+  echoes the parent id into the body of many later sessions) — a real view id
+  returned a list of unrelated sessions. Any id-shaped query — complete id OR hex
+  short-id/prefix (`looksLikeSessionId`) — now resolves through the index by id in
+  both `resolveSessionQuery` and the `renderOneSession` content-widen gate, and
+  reports "no session found" when nothing matches instead of content-searching.
+  Free-text phrases keep the ranked search path. Source:
+  `apps/cli/src/commands/sessions.ts`.
+
+- **`agents sessions --active` attributes the initiating device for SSH-launched
+  sessions.** A session started by ssh'ing into a box (common for tmux-hosted
+  runs) used to render as `local` with no origin, because the tmux discovery path
+  stamped a `transport:'local'` placeholder that made provenance enrichment skip
+  it. Enrichment now probes the pane process's env and upgrades the row to `ssh`
+  with the real origin, then resolves the SSH client IP against the device
+  registry into `provenance.origin` (`{ device, user? }`). Both the flat listing
+  and the interactive browser read `ssh←<device>` (e.g. `ssh←zion`); an
+  unregistered IP stays bare `ssh`. Answers "which box launched this session"
+  without scraping `ps`/`who`/`tailscale`. Source:
+  `apps/cli/src/lib/session/active.ts`, `apps/cli/src/lib/session/provenance.ts`,
+  `apps/cli/src/commands/sessions.ts`, `apps/cli/src/commands/sessions-browser.ts`.
+
+- **`agents sessions --include user` / `--first` / `--last` now count genuine user turns, not harness-injected scaffolding (#1550).** A Claude session opened with a `!`-prefix command (e.g. `j <dir>`) stores `<bash-input>`/`<bash-stdout>` as `role=user` records, and `<system-reminder>`/`<task-notification>`/`<command-*>`/hook-feedback/skill bodies land the same way — so `--include user --first 3` returned the jump command and its shell output before the real ask, and every consumer of `--include user` (the `verify-work-complete` Stop hook's "original request" self-audit, `session-recall`) inherited the noise. `parseSession` now flags these injected `role=user` events `_synthetic` at its central post-parse chokepoint via one shared classifier (`isSyntheticUserMessage`), so turn slicing (`applyTurnSlice`) and role filtering (`roleOfEvent`) skip them; they stay in the default/`--markdown` stream for full fidelity. Claude-specific in practice — Codex/Gemini/OpenCode/Grok/Kimi/Rush route shell output to `tool_result`, never to `role=user`, and Droid's `<system-reminder>` was already dropped — but the classifier is cross-harness by construction. Source: `apps/cli/src/lib/session/{prompt,parse,render,types}.ts`.
+
+- **Routine/daemon Claude runs authenticate the rotation-pinned account via its own long-lived setup-token — fixes fleet-wide daily logout.** Claude Code's interactive OAuth session uses single-use *rotating* refresh tokens: when one fleet machine refreshes, the server invalidates that account's token on every other machine, so unattended boxes 401 and drop (Claude Code #25609/#56339). A `claude setup-token` is a 1-year, non-rotating token that sidesteps this. The daemon now injects every `CLAUDE_CODE_OAUTH_TOKEN_<account>` present in the `claude` bundle (not just the one ambient token), and a routine spawn selects the token matching the account its version-home is pinned to (`runner.ts` `buildRoutineSpawnEnv` → `resolveAccountSetupToken`), so each unattended account authenticates with its own setup-token instead of the rotating interactive session. Works on macOS too, where the prior drop-based path was inert. Inert (no behavior change) until per-account setup-tokens are stored in the no-ACL `claude` bundle. Interactive `agents run` and remote `--host` dispatch are unchanged (out of scope; noted for follow-up). Source: `apps/cli/src/lib/secrets/account-token.ts`, `apps/cli/src/lib/runner.ts`, `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/sandbox.ts`.
+
 ## 1.20.76
 
 - **The routines daemon can read a `never`/no-ACL secrets bundle headlessly again — fixes a false "no Claude credential" alert.** The headless secrets guard (`readAndResolveBundleEnv`'s `agentOnly` branch) threw for every keychain-backed bundle absent from the broker, but a `never`/no-ACL bundle carries no biometry ACL — its reads raise no Touch ID sheet, so blocking it served no purpose. That wrongly blocked the automation-only `claude` bundle the routines daemon reads at startup (`readDaemonClaudeOAuthToken`), leaving every scheduled Claude routine token-less, and — on the new auth-failure alert path — firing "no Claude credential" on each daemon start even when the bundle was configured correctly. The guard now exempts `never`/no-ACL bundles (policy learned via a prompt-less metadata read), matching the existing file-backend exemption. Source: `apps/cli/src/lib/secrets/bundles.ts`.

package/dist/commands/exec.js

@@ -20,8 +20,9 @@ import { sshResolve } from '../lib/hosts/ssh-config.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { randomUUID } from 'crypto';
 import { spawnSync } from 'child_process';
+import { randomUUID } from 'crypto';
+import { isSessionTrackedAgent } from '../lib/session/types.js';
 /** Distinguish a terminal account-picker marker from an explicit @version pin. */
 export function parseRunAccountPickerRequest(agentSpec) {
     const requested = agentSpec.endsWith('@');
@@ -877,7 +878,7 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             const hostName = hostGiven[0];
-            const { resolveHostRunTarget, dispatchPromptToHost, HostResolutionError } = await import('../lib/hosts/run-target.js');
+            const { resolveHostRunTarget, resolveHostSessionId, dispatchPromptToHost, HostResolutionError } = await import('../lib/hosts/run-target.js');
             const { runInteractiveOnHost } = await import('../lib/hosts/dispatch.js');
             const { registerInteractiveHostSession } = await import('../lib/hosts/session-index.js');
             const { RUN_OPTION_REJECT_MESSAGES } = await import('../lib/hosts/remote-cmd.js');
@@ -1035,10 +1036,21 @@ export function registerRunCommand(program) {
                         process.exit(1);
                     }
                     // Mirror the local path (lib/exec.ts): only Claude accepts a forced
-                    // `--session-id`. Generating it here lets us register the run in the
-                    // local index and makes it resumable by id. On resume the remote
-                    // session keeps its existing id — don't mint a new one.
-                    const hostSessionId = runAgent === 'claude' && !resumeId ? randomUUID() : undefined;
+                    // `--session-id`. Adopt the caller's id when present; otherwise mint
+                    // one here. Registering that same id keeps the local index aligned
+                    // with the remote agent. On resume, don't mint a new one.
+                    const hostSessionId = resolveHostSessionId(runAgent, resumeId, options.sessionId);
+                    // For every OTHER agent the remote coins its own id, which we can't
+                    // know up front. Forward a launch id we control as AGENT_LAUNCH_ID:
+                    // the remote `agents run` adopts it (exec.ts resolveLaunchId) and its
+                    // SessionStart hook records the real id under that exact key, so after
+                    // the stream we resolve the id by one ssh read of the remote hook
+                    // record — the same launch-id join used locally (RUSH-2034). Not
+                    // needed for Claude (id forced) or resume (id already known).
+                    const correlationLaunchId = !hostSessionId && !resumeId && isSessionTrackedAgent(runAgent) ? randomUUID() : undefined;
+                    const hostEnv = correlationLaunchId
+                        ? [...options.env, `AGENT_LAUNCH_ID=${correlationLaunchId}`]
+                        : options.env;
                     if (hostSessionId) {
                         registerInteractiveHostSession({
                             cwd: process.cwd(),
@@ -1058,7 +1070,7 @@ export function registerRunCommand(program) {
                         mode: options.mode,
                         model: options.model,
                         effort: options.effort,
-                        env: options.env,
+                        env: hostEnv,
                         addDir: hostAddDirs,
                         json: options.json,
                         verbose: options.verbose,
@@ -1074,14 +1086,41 @@ export function registerRunCommand(program) {
                         forceInteractive: options.interactive,
                         copyCreds: hostCopyCreds,
                     });
+                    // Resolve a non-Claude agent's REAL remote session id now the run has
+                    // booted (its hook has fired on the peer): one ssh read of the remote
+                    // hook record, keyed by the launch id we forwarded. Register it so the
+                    // run shows in `agents sessions` and can be reconnected/focused —
+                    // closing the non-Claude gap RUSH-2033 left. Best-effort: an
+                    // unreachable host or a not-yet-landed record leaves the run un-mapped
+                    // rather than mis-mapped.
+                    let resolvedRemoteId;
+                    if (correlationLaunchId) {
+                        const { resolveRemoteSessionId } = await import('../lib/hosts/remote-session-id.js');
+                        const { sshTargetFor } = await import('../lib/hosts/types.js');
+                        try {
+                            resolvedRemoteId = resolveRemoteSessionId(sshTargetFor(host), correlationLaunchId);
+                        }
+                        catch {
+                            /* ssh read is best-effort — keep the run un-mapped, never guess */
+                        }
+                        if (resolvedRemoteId) {
+                            registerInteractiveHostSession({
+                                cwd: process.cwd(),
+                                host: host.name,
+                                agent: runAgent,
+                                sessionId: resolvedRemoteId,
+                                name: options.name,
+                            });
+                        }
+                    }
                     // A network drop kills the local ssh client (exit 255) but the remote
                     // agent survives in its detached tmux session. With a known session id
-                    // (Claude, or a resumed run) and a tmux-hosted run, re-attach the live
-                    // pane automatically instead of exiting — the user never has to notice
-                    // the drop and `agents sessions focus` by hand. `raw` runs aren't tmux
-                    // wrapped, so there is nothing to reconnect to. Non-Claude id capture is
-                    // tracked in RUSH-2007.
-                    const reconnectId = hostSessionId ?? resumeId;
+                    // (Claude's forced id, a resumed run, or a non-Claude id we just
+                    // resolved from the remote hook record) and a tmux-hosted run,
+                    // re-attach the live pane automatically instead of exiting — the user
+                    // never has to notice the drop and `agents sessions focus` by hand.
+                    // `raw` runs aren't tmux wrapped, so there is nothing to reconnect to.
+                    const reconnectId = hostSessionId ?? resolvedRemoteId ?? resumeId;
                     if (reconnectId && !isRaw) {
                         const { reconnectInteractiveSession, SSH_CONN_FAILURE } = await import('../lib/hosts/reconnect.js');
                         if (exitCode === SSH_CONN_FAILURE) {
@@ -1127,6 +1166,7 @@ export function registerRunCommand(program) {
                     remoteCwd: hostCwd,
                     name: options.name,
                     resume: resumeId,
+                    sessionId: options.sessionId,
                     follow: options.follow !== false,
                     passthroughArgs,
                     copyCreds: hostCopyCreds,
@@ -1883,11 +1923,13 @@ export function registerRunCommand(program) {
                 else {
                     const { bundle, env: bundleEnv } = readAndResolveBundleEnv(bundleName, {
                         caller: `agent ${agent}`,
+                        agent,
                         keys: secretsKeysSubset,
                         allowExpired: options.allowExpired,
-                        // A headless/background run (routine, teammate, detached) must not
-                        // pop a Touch ID sheet nobody can answer — resolve broker-only and
-                        // fail fast with an actionable error. Interactive runs still prompt.
+                        // The harness identity scopes any cached grant. It no longer lets the
+                        // requesting agent wait for interactive approval — an agent launch
+                        // resolves broker-only and fails fast naming
+                        // `agents secrets unlock <bundle>` (bundles.ts:interactiveUnlock).
                         agentOnly: isHeadlessSecretsContext(),
                     });
                     const entries = describeBundle(bundle);