@phnx-labs/agents-cli 1.20.76 → 1.20.78

package/dist/lib/feed.js

@@ -348,6 +348,10 @@ CLEAR_EVENTS = {
     "Stop",
     "SessionEnd",
 }
+# Codex emits a PermissionRequest event (not Claude's Notification) when it
+# blocks on an approval prompt. Claude never fires PermissionRequest, so the
+# same script handles both: PermissionRequest maps to an approval-class block
+# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.
 
 
 def read_json(path):
@@ -398,6 +402,19 @@ def main():
     hook_event = payload.get("hook_event_name", "PreToolUse")
 
     if hook_event in CLEAR_EVENTS:
+        # A matcher-less PostToolUse clear (registered for Codex so an approved
+        # tool clears its approval card) must NOT wipe an open AskUserQuestion
+        # while an unrelated tool runs mid-question -- those are cleared only by
+        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a
+        # 'question' block; approval/notification blocks clear once the tool runs.
+        if hook_event == "PostToolUse":
+            try:
+                with open(target) as existing_file:
+                    existing = json.load(existing_file)
+                if existing.get("kind") == "question" and payload.get("tool_name") != "AskUserQuestion":
+                    return
+            except Exception:
+                pass
         try:
             os.unlink(target)
         except FileNotFoundError:
@@ -442,6 +459,7 @@ def main():
         return
 
     notification_type = None
+    codex_approval = False
     if hook_event == "Notification":
         notification_type = payload.get("notification_type", "")
         if notification_type not in WAITING_NOTIFICATION_TYPES:
@@ -466,6 +484,34 @@ def main():
             "multiSelect": False,
         }]
         kind = "notification"
+    elif hook_event == "PermissionRequest":
+        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,
+        # tool_input) but carries no questions -- Codex is asking to run a tool,
+        # not asking the operator a multiple-choice question. Publish it as a
+        # notification-kind approval block naming the tool so the feed and the
+        # phone notifier can surface it, and so the Factory extension can bridge
+        # it to a VS Code notification.
+        tool_name = payload.get("tool_name") or "a tool"
+        tool_input = payload.get("tool_input", {})
+        command = ""
+        if isinstance(tool_input, dict):
+            command = (
+                tool_input.get("command")
+                or tool_input.get("cmd")
+                or tool_input.get("path")
+                or ""
+            )
+            if isinstance(command, list):
+                command = " ".join(str(c) for c in command)
+        detail = f": {command}" if command else ""
+        normalized_questions = [{
+            "text": f"Codex needs approval to run {tool_name}{detail}",
+            "header": "Approval needed",
+            "multiSelect": False,
+        }]
+        kind = "notification"
+        notification_type = "permission_prompt"
+        codex_approval = True
     else:
         tool_input = payload.get("tool_input", {})
         questions = tool_input.get("questions", [])
@@ -535,9 +581,21 @@ def main():
     if notification_type:
         block["notificationType"] = notification_type
 
+    # A Codex PermissionRequest is a real approval gate: mark it approval-class
+    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent
+    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default
+    # 'medium') and pages the phone. A plain 'deny' is the safe default.
+    if codex_approval:
+        block["blockClass"] = "approval"
+        block["costOfDelay"] = "high"
+        block["safeDefault"] = "deny"
+
     # Optional multi-operator control metadata passed by the agent in the
-    # AskUserQuestion tool_input. Defaults keep the existing behavior.
-    controls = payload.get("tool_input", {}) if hook_event != "Notification" else {}
+    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex
+    # PermissionRequest carries tool ARGS in tool_input (command/path), not
+    # operator controls, so it is excluded here -- its class/cost is stamped
+    # above from codex_approval.
+    controls = payload.get("tool_input", {}) if hook_event not in ("Notification", "PermissionRequest") else {}
     block_class = controls.get("blockClass") if isinstance(controls, dict) else None
     if block_class in ("approval", "decision"):
         block["blockClass"] = block_class
@@ -604,6 +662,15 @@ export const FEED_NOTIFICATION_HOOK_MANIFEST = {
     script: '10-feed-publish.py',
     timeout: 5,
 };
+// Codex fires PermissionRequest (not Claude's Notification) when it blocks on an
+// approval prompt. The same script handles it, publishing a high-cost approval
+// block so the feed dispatch pages the phone. PermissionRequest has no matcher.
+export const FEED_PERMISSION_HOOK_MANIFEST = {
+    name: 'feed-publish-permission',
+    events: ['PermissionRequest'],
+    script: '10-feed-publish.py',
+    timeout: 5,
+};
 export const FEED_ANSWERED_HOOK_MANIFEST = {
     name: 'feed-clear-answered',
     events: ['PostToolUse'],
@@ -644,28 +711,51 @@ export function ensureFeedPublishHook(userAgentsDir = getUserAgentsDir()) {
         }
         const desiredHooks = {
             'feed-publish': {
-                agents: ['claude'],
+                agents: ['claude', 'codex'],
                 events: ['PreToolUse'],
                 matcher: 'AskUserQuestion',
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
             'feed-publish-notification': {
-                agents: ['claude'],
+                agents: ['claude', 'codex'],
                 events: ['Notification'],
                 matcher: 'permission_prompt|idle_prompt|elicitation_dialog',
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
+            // Codex-specific approval gate: Codex emits PermissionRequest (Claude does
+            // not), so this hook is where a blocked Codex agent surfaces to the feed.
+            'feed-publish-permission': {
+                agents: ['claude', 'codex'],
+                events: ['PermissionRequest'],
+                script: '10-feed-publish.py',
+                timeout: 5,
+            },
             'feed-clear-answered': {
-                agents: ['claude'],
+                agents: ['claude', 'codex'],
                 events: ['PostToolUse'],
                 matcher: 'AskUserQuestion',
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
+            // Matcher-less PostToolUse clear: after Codex runs an approved tool, the
+            // approval card is stale, so clear it. Codex-only on purpose -- Claude
+            // never fires PermissionRequest, so it has no approval card to clear here,
+            // and a matcher-less PostToolUse for Claude would (1) re-run the script on
+            // every tool completion and (2) wipe Claude's notification-kind blocks
+            // (permission_prompt/idle_prompt/elicitation_dialog) the moment any later
+            // tool runs, instead of letting them persist to Stop/SessionEnd like they
+            // did before RUSH-2039. Registering it for codex alone keeps Claude's
+            // card lifetime exactly as it was.
+            'feed-clear-permission': {
+                agents: ['codex'],
+                events: ['PostToolUse'],
+                script: '10-feed-publish.py',
+                timeout: 5,
+            },
             'feed-clear-lifecycle': {
-                agents: ['claude'],
+                agents: ['claude', 'codex'],
                 events: ['Stop', 'UserPromptSubmit', 'SessionEnd'],
                 script: '10-feed-publish.py',
                 timeout: 5,

package/dist/lib/git.d.ts

@@ -86,6 +86,19 @@ export declare function clonePackage(source: string): Promise<{
 }>;
 /** Get the short commit hash (8 chars) of the latest commit in a repo. */
 export declare function getRepoCommit(repoPath: string): Promise<string>;
+/** Compact, self-contained state of a git repo — branch, short HEAD, and a
+ *  dirty flag — for cross-device comparison (RUSH-2027). Synchronous and
+ *  best-effort: a non-repo or unreadable path yields `null` fields, never a
+ *  throw, so a device's `doctor --json` payload always serializes. */
+export interface RepoStateSnapshot {
+    branch: string | null;
+    head: string | null;
+    dirty: boolean;
+}
+/** Read {@link RepoStateSnapshot} for `repoPath` using plumbing commands so the
+ *  result is stable across git versions and never mutates the tree. Returns null
+ *  when the path is not a git worktree. */
+export declare function readRepoState(repoPath: string): RepoStateSnapshot | null;
 /**
  * Get the current GitHub username using gh CLI.
  * Returns null if gh is not installed or user is not authenticated.

package/dist/lib/git.js

@@ -334,6 +334,34 @@ export async function getRepoCommit(repoPath) {
         return 'unknown';
     }
 }
+/** Read {@link RepoStateSnapshot} for `repoPath` using plumbing commands so the
+ *  result is stable across git versions and never mutates the tree. Returns null
+ *  when the path is not a git worktree. */
+export function readRepoState(repoPath) {
+    const runGit = (args) => {
+        try {
+            return execFileSync('git', ['-C', repoPath, ...args], {
+                stdio: ['ignore', 'pipe', 'ignore'],
+            })
+                .toString()
+                .trim();
+        }
+        catch {
+            return null;
+        }
+    };
+    // Gate on a real worktree first; `rev-parse --is-inside-work-tree` prints
+    // `true` only inside one, and returns non-zero (→ null) otherwise.
+    if (runGit(['rev-parse', '--is-inside-work-tree']) !== 'true')
+        return null;
+    const branchRaw = runGit(['rev-parse', '--abbrev-ref', 'HEAD']);
+    const branch = branchRaw && branchRaw !== 'HEAD' ? branchRaw : null; // detached → null
+    const headRaw = runGit(['rev-parse', 'HEAD']);
+    const head = headRaw ? headRaw.slice(0, 8) : null;
+    const porcelain = runGit(['status', '--porcelain']);
+    const dirty = porcelain != null && porcelain.length > 0;
+    return { branch, head, dirty };
+}
 /**
  * Get the current GitHub username using gh CLI.
  * Returns null if gh is not installed or user is not authenticated.
@@ -813,6 +841,39 @@ export async function commitOwnDeviceMeta(dir, metaAbs = getDeviceMetaPath()) {
 export async function pullRepo(dir) {
     try {
         const git = simpleGit(dir);
+        // A rebase left in progress by an earlier run must be reported as itself.
+        // Without this the dirty-tree guard below claims "Blocked by local changes",
+        // which is both wrong and actively harmful advice mid-rebase on a detached
+        // HEAD. Checked BEFORE commitOwnDeviceMeta so we never commit into one.
+        // Ask git where the state dirs live rather than assuming `<dir>/.git/` is a
+        // directory. In a worktree `.git` is a FILE containing `gitdir: <path>`, so
+        // path.join(dir, '.git', 'rebase-merge') can never exist and the check would
+        // silently never fire. `rev-parse --git-path` resolves both layouts.
+        const gitPath = async (name) => {
+            try {
+                const raw = (await git.raw(['rev-parse', '--git-path', name])).trim();
+                return path.isAbsolute(raw) ? raw : path.join(dir, raw);
+            }
+            catch {
+                return null;
+            }
+        };
+        const [rebaseMerge, rebaseApply] = await Promise.all([
+            gitPath('rebase-merge'),
+            gitPath('rebase-apply'),
+        ]);
+        const rebaseInProgress = (rebaseMerge !== null && fs.existsSync(rebaseMerge)) ||
+            (rebaseApply !== null && fs.existsSync(rebaseApply));
+        if (rebaseInProgress) {
+            return {
+                success: false,
+                commit: '',
+                error: `A previous rebase is still in progress — finish or abort it, then pull again.\n\n` +
+                    `  cd ${displayHomePath(dir)} && git status\n` +
+                    `  git rebase --continue   # after resolving\n` +
+                    `  git rebase --abort      # to discard the attempt`,
+            };
+        }
         // Commit this machine's own device-meta first so a per-machine pin change
         // never wedges the pull. Genuine edits elsewhere still block below.
         await commitOwnDeviceMeta(dir);
@@ -825,12 +886,15 @@ export async function pullRepo(dir) {
             };
         }
         const branch = status.current || 'main';
-        await git.fetch('origin');
         // Resolve the upstream ref to fast-forward against. Prefer the local
         // branch's tracking config; otherwise ask origin for its default branch.
         let tracking = status.tracking;
         if (!tracking) {
+            // No tracking config: fetch origin so its HEAD is known, then ask which
+            // branch it points at. This path only ever concerns origin — a branch with
+            // no upstream has no other remote to consult.
             try {
+                await git.fetch('origin');
                 await git.raw(['remote', 'set-head', 'origin', '--auto']);
                 const sym = await git.raw(['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
                 tracking = sym.trim();
@@ -839,6 +903,22 @@ export async function pullRepo(dir) {
                 tracking = `origin/${branch}`;
             }
         }
+        // Split the remote-tracking ref (<remote>/<branch>) into its parts and pull
+        // THOSE. Hardcoding 'origin' while comparing against `tracking` is how a
+        // branch tracking e.g. upstream/main silently 'succeeded': revparse saw a
+        // difference, the pull fetched origin/main (already current), and pullRepo
+        // returned success having moved nothing — the same "reported ok, pulled
+        // nothing" failure this change exists to remove. Branch names may contain
+        // slashes, so split on the FIRST separator only.
+        const sep = tracking.indexOf('/');
+        const remoteName = sep > 0 ? tracking.slice(0, sep) : 'origin';
+        const remoteBranch = sep > 0 ? tracking.slice(sep + 1) : branch;
+        // Bare fetch: updates every remote, so the revparse below sees a fresh ref
+        // whichever one the branch tracks. Deliberately argument-less — simple-git's
+        // fetchTask only forwards a remote when BOTH remote and branch are passed,
+        // so `fetch(remoteName)` would silently drop the argument and do exactly
+        // this anyway. Saying so beats an inert argument that reads as targeted.
+        await git.fetch();
         const localRef = await git.revparse(['HEAD']);
         const remoteRef = await git.revparse([tracking]).catch(() => null);
         if (!remoteRef) {
@@ -853,13 +933,31 @@ export async function pullRepo(dir) {
             };
         }
         try {
-            await git.merge(['--ff-only', tracking]);
+            // Rebase, not --ff-only. Fast-forward refuses ANY divergence, conflict or
+            // not, so a single local commit — including the one commitOwnDeviceMeta
+            // makes just above — permanently wedged the pull with nothing actually in
+            // conflict. Every device carries its own devices/<host>/ path, so those
+            // replay cleanly. Matches syncRepoGit (below) and this function's own doc.
+            //
+            // Pull the RESOLVED tracking ref, not `branch`: when the local branch has
+            // no tracking config the block above falls back to origin's default head,
+            // which may be named differently (local `main` vs origin `master`). Using
+            // `branch` there asks origin for a ref it does not have.
+            assertValidBranchName(remoteBranch);
+            await git.pull(remoteName, remoteBranch, { '--rebase': 'true' });
         }
-        catch {
+        catch (err) {
+            // Abort so the tree is restored, matching the atomicity --ff-only gave us.
+            // Without this a conflict leaves the repo detached, mid-rebase, with
+            // conflict markers written into live config (this repo is ~/.agents —
+            // agents.yaml and AGENTS.md are in it), and every later pull misreports
+            // the cause. `agents sync` reaches this path unattended across the fleet,
+            // so a wedged checkout would be worse than the bug this fixes.
+            await git.raw(['rebase', '--abort']).catch(() => { });
             return {
                 success: false,
                 commit: '',
-                error: `Blocked by local commits. Push or reset them before pulling.\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}`,
+                error: `Rebase onto ${tracking} hit a conflict — the pull was rolled back, nothing changed.\n\nResolve the divergence, then pull again:\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}\n\n${err.message}`,
             };
         }
         installGithooksSymlinks(dir);

package/dist/lib/heal.d.ts

@@ -87,10 +87,13 @@ export declare function healChangedAnything(r: HealResult): boolean;
 /** One-line summary of a heal pass for daemon logs. */
 export declare function summarizeHeal(r: HealResult): string;
 /**
- * Fire a native desktop notification when a background heal did something
- * noteworthy. Best-effort — missing `osascript`/`notify-send` or no display is
- * swallowed. Silent when the pass auto-fixed everything and nothing needs the
- * operator (no point pinging them for routine self-healing).
+ * Fire a branded desktop notification when a background heal did something
+ * noteworthy. Routed through the MenubarHelper companion (notify-desktop.ts) so
+ * it carries the agents-cli mark; clicking opens the runs folder
+ * (~/.agents/.history/runs, via the `routines:list` action the companion
+ * understands). Best-effort — a missing
+ * notifier or no display is swallowed. Silent when the pass auto-fixed everything
+ * and nothing needs the operator (no point pinging them for routine self-healing).
  */
 export declare function notifyHeal(r: HealResult): void;
 /**

package/dist/lib/heal.js

@@ -30,7 +30,7 @@ import { repairPluginManifestFile } from './plugin-marketplace.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { spawn } from 'child_process';
+import { notifyDesktop } from './menubar/notify-desktop.js';
 // ─── diff → selection mapping ────────────────────────────────────────────────
 // Which ResourceSelection key each healable diff kind writes through. `rules`
 // re-syncs via the whole-memory channel (not name-scoped); `promptcuts` is not
@@ -68,10 +68,13 @@ export function summarizeHeal(r) {
     return parts.length > 0 ? parts.join(', ') : 'nothing to heal';
 }
 /**
- * Fire a native desktop notification when a background heal did something
- * noteworthy. Best-effort — missing `osascript`/`notify-send` or no display is
- * swallowed. Silent when the pass auto-fixed everything and nothing needs the
- * operator (no point pinging them for routine self-healing).
+ * Fire a branded desktop notification when a background heal did something
+ * noteworthy. Routed through the MenubarHelper companion (notify-desktop.ts) so
+ * it carries the agents-cli mark; clicking opens the runs folder
+ * (~/.agents/.history/runs, via the `routines:list` action the companion
+ * understands). Best-effort — a missing
+ * notifier or no display is swallowed. Silent when the pass auto-fixed everything
+ * and nothing needs the operator (no point pinging them for routine self-healing).
  */
 export function notifyHeal(r) {
     const needsAttention = r.skippedPlugins.length;
@@ -79,27 +82,12 @@ export function notifyHeal(r) {
     if (needsAttention === 0 && healed === 0)
         return;
     const title = needsAttention > 0
-        ? `agents: ${needsAttention} plugin${needsAttention === 1 ? '' : 's'} need attention`
+        ? `${needsAttention} plugin${needsAttention === 1 ? '' : 's'} need attention`
         : 'agents: auto-healed config gaps';
     const body = needsAttention > 0
         ? `${summarizeHeal(r)}. Run: agents doctor --fix`
         : summarizeHeal(r);
-    const platform = os.platform();
-    try {
-        if (platform === 'darwin') {
-            const safeTitle = title.replace(/"/g, '\\"');
-            const safeBody = body.replace(/"/g, '\\"');
-            const child = spawn('osascript', ['-e', `display notification "${safeBody}" with title "${safeTitle}"`], { detached: true, stdio: 'ignore' });
-            child.unref();
-        }
-        else if (platform === 'linux') {
-            const child = spawn('notify-send', [title, body], { detached: true, stdio: 'ignore' });
-            child.unref();
-        }
-    }
-    catch {
-        // Notification is best-effort; nothing to do.
-    }
+    notifyDesktop({ title, body, action: 'routines:list' });
 }
 // ─── central plugin layer (version-independent, runs once per heal) ──────────
 /**

package/dist/lib/hosts/dispatch.d.ts

@@ -20,6 +20,15 @@ import { type HostCredentials } from './credentials.js';
  * remainder. Any other path (absolute or relative) is quoted verbatim.
  */
 export declare function remoteCdPrefix(remoteCwd?: string): string;
+/**
+ * Merge the resolved actor's provenance env UNDER a caller-supplied env, so every
+ * remote `agents …` invocation forwards `AGENTS_ACTOR*` / `GIT_*` across the SSH
+ * hop. Without it the remote re-resolves the actor from the ORIGINATING box's
+ * `SSH_CONNECTION` (the wrong IP) and mis-credits the run to the shared machine or
+ * `UNRESOLVED@<host>` (RUSH-2028). A caller-supplied value wins on any key
+ * collision, mirroring `buildExecEnv`'s `...options.env` precedence (exec.ts).
+ */
+export declare function withActorEnv(env?: Record<string, string>): Record<string, string>;
 /**
  * Launch a detached login-shell command in its own Unix session/process group.
  *

package/dist/lib/hosts/dispatch.js

@@ -12,8 +12,9 @@ import { randomUUID } from 'crypto';
 import { sshExec, sshStream, shellQuote } from '../ssh-exec.js';
 import { sshTargetFor } from './types.js';
 import { ensureHostReady } from './ready.js';
-import { remoteShellFor } from './remote-cmd.js';
+import { remoteShellFor, posixEnvExports } from './remote-cmd.js';
 import { resolveRemoteOsSync } from './remote-os.js';
+import { resolveActor, actorEnv } from '../actor.js';
 import { saveTask, updateTask, terminalPatch } from './tasks.js';
 import { followHostTask } from './progress.js';
 import { wrapHostCommandWithCredentials } from './credentials.js';
@@ -56,6 +57,17 @@ export function remoteCdPrefix(remoteCwd) {
         return `cd "$HOME"/${shellQuote(rest)} && `;
     return `cd ${shellQuote(remoteCwd)} && `;
 }
+/**
+ * Merge the resolved actor's provenance env UNDER a caller-supplied env, so every
+ * remote `agents …` invocation forwards `AGENTS_ACTOR*` / `GIT_*` across the SSH
+ * hop. Without it the remote re-resolves the actor from the ORIGINATING box's
+ * `SSH_CONNECTION` (the wrong IP) and mis-credits the run to the shared machine or
+ * `UNRESOLVED@<host>` (RUSH-2028). A caller-supplied value wins on any key
+ * collision, mirroring `buildExecEnv`'s `...options.env` precedence (exec.ts).
+ */
+export function withActorEnv(env) {
+    return { ...actorEnv(resolveActor()), ...(env ?? {}) };
+}
 /**
  * Launch a detached login-shell command in its own Unix session/process group.
  *
@@ -174,10 +186,14 @@ async function launchDetached(host, target, opts) {
     const id = randomUUID().slice(0, 8);
     const remoteLog = `${REMOTE_DIR}/${id}.log`;
     const remoteExit = `${REMOTE_DIR}/${id}.exit`;
-    // Inner command run under a login shell so PATH resolves `agents`.
+    // Inner command run under a login shell so PATH resolves `agents`. Export the
+    // resolved actor provenance first so the detached remote run inherits it
+    // instead of re-resolving from this box's SSH_CONNECTION (RUSH-2028).
     const invocation = ['agents', ...opts.forwardedArgs].map(shellQuote).join(' ');
     const cwd = remoteCdPrefix(opts.remoteCwd);
-    let inner = `${cwd}${invocation} > ${remoteLog} 2>&1; echo $? > ${remoteExit}`;
+    const actorExports = posixEnvExports(withActorEnv());
+    const prelude = actorExports ? `${actorExports}; ` : '';
+    let inner = `${prelude}${cwd}${invocation} > ${remoteLog} 2>&1; echo $? > ${remoteExit}`;
     if (opts.copyCreds) {
         inner = wrapHostCommandWithCredentials(inner, opts.copyCreds);
     }
@@ -370,7 +386,11 @@ export async function runInteractiveOnHost(host, opts) {
         process.stderr.write(`[hosts] warning: ${w}\n`);
     const invocation = ['agents', ...buildInteractiveRunForwardedArgs(opts)].map(shellQuote).join(' ');
     const cwd = remoteCdPrefix(opts.remoteCwd);
-    let remoteCmd = `${cwd}${invocation}`;
+    // Forward actor provenance so the interactive remote run inherits it rather
+    // than re-resolving from this box's SSH_CONNECTION (RUSH-2028).
+    const actorExports = posixEnvExports(withActorEnv());
+    const prelude = actorExports ? `${actorExports}; ` : '';
+    let remoteCmd = `${prelude}${cwd}${invocation}`;
     if (opts.copyCreds) {
         remoteCmd = wrapHostCommandWithCredentials(remoteCmd, opts.copyCreds);
     }

package/dist/lib/hosts/passthrough.js

@@ -20,7 +20,7 @@ import chalk from 'chalk';
 import { assertValidSshTarget, sshStream } from '../ssh-exec.js';
 import { resolveHost, resolveHostByCap } from './registry.js';
 import { sshTargetFor } from './types.js';
-import { dispatchAgentsCommand } from './dispatch.js';
+import { dispatchAgentsCommand, withActorEnv } from './dispatch.js';
 import { stripRoutingFlags, buildRemoteAgentsInvocation, HOST_ROUTING_SPECS, } from './remote-cmd.js';
 import { resolveRemoteOsSync } from './remote-os.js';
 import { machineId } from '../session/sync/config.js';
@@ -267,9 +267,14 @@ export async function maybeRunOnHost(command, allArgs) {
     // profile, and single-quoted env values would not expand $HOME/$PATH.
     const isDoctorCommand = command === 'doctor' || (command === 'teams' && forwarded[1] === 'doctor');
     const remoteOs = resolveRemoteOsSync(host.name);
-    const env = isDoctorCommand && !/^win/i.test((remoteOs ?? '').trim())
+    const doctorPath = isDoctorCommand && !/^win/i.test((remoteOs ?? '').trim())
         ? { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' }
         : undefined;
+    // Forward actor provenance (AGENTS_ACTOR*/GIT_*) across the SSH hop, merged
+    // UNDER the doctor PATH so that PATH still wins — without this the remote
+    // re-resolves the actor from THIS box's SSH_CONNECTION and mis-credits it
+    // (RUSH-2028). Flows to both POSIX (export) and Windows ($env:) dialects.
+    const env = withActorEnv(doctorPath);
     const remoteCmd = buildRemoteAgentsInvocation(forwarded, remoteCwd, remoteOs, env);
     const code = sshStream(target, remoteCmd, { tty: interactive, multiplex: true });
     if (code === 255) {

package/dist/lib/hosts/remote-cmd.d.ts

@@ -68,6 +68,17 @@ export declare const RUN_OPTION_REJECT_MESSAGES: Record<string, string>;
  * POSIX form, so linux/macos are byte-for-byte unchanged.
  */
 export declare function buildRemoteAgentsInvocation(forwardedArgs: string[], remoteCwd?: string, os?: string, env?: Record<string, string>): string;
+/**
+ * Build a POSIX `export K=V; …` prefix from an env map — empty string when the
+ * map is missing or empty. Values are rendered as shell LITERALS by default
+ * (single-quoted via {@link shellQuote}), so a `$(...)` or backtick in a value
+ * can never execute on the SSH target. Only {@link EXPAND_KEYS} (`PATH`) keep the
+ * expanding double-quote form (`\` and `"` escaped) so the remote `$HOME`/`$PATH`
+ * still resolve. Shared by {@link buildRemoteAgentsInvocation} and the
+ * detached/interactive dispatch builders (dispatch.ts) so every remote path
+ * exports env identically.
+ */
+export declare function posixEnvExports(env?: Record<string, string>): string;
 /** The two remote shell dialects we build commands for. */
 export type RemoteShell = 'posix' | 'powershell';
 /**

package/dist/lib/hosts/remote-cmd.js

@@ -116,6 +116,8 @@ export const RUN_OPTION_FORWARDING = {
     tailscale: 'local-only', // --tailscale/--no-tailscale gate the lease net mode; never forwarded
     copyCreds: 'local-only', // copies creds TO the host before dispatch — local concern only
     authCheck: 'local-only', // --no-auth-check gates the local interactive login preflight; --host runs skip that preflight entirely
+    // Deprecated alias for --device auto; resolved on the launching box before SSH.
+    smart: 'local-only',
 };
 /** Actionable messages for value-aware rejections, keyed by attribute name. */
 export const RUN_OPTION_REJECT_MESSAGES = {
@@ -144,18 +146,41 @@ export function buildRemoteAgentsInvocation(forwardedArgs, remoteCwd, os, env) {
     }
     const inner = ['agents', ...forwardedArgs].map(shellQuote).join(' ');
     const withCwd = remoteCwd ? `cd ${shellQuote(remoteCwd)} && ${inner}` : inner;
-    if (!env || Object.keys(env).length === 0) {
-        return `bash -lc ${shellQuote(withCwd)}`;
-    }
     // Prepend env exports so the remote command sees the shims dir even when the
     // login shell hasn't sourced the interactive rc files that usually add it.
-    // Values are double-quoted (not single-quoted) so remote variables like
-    // $HOME and $PATH are expanded by the login shell.
-    const exports = Object.entries(env)
-        .map(([k, v]) => `export ${shellQuote(k)}="${v.replace(/[\\"]/g, '\\$&')}"`)
-        .join('; ');
+    const exports = posixEnvExports(env);
+    if (!exports) {
+        return `bash -lc ${shellQuote(withCwd)}`;
+    }
     return `bash -lc ${shellQuote(`${exports}; ${withCwd}`)}`;
 }
+/**
+ * Keys whose values are trusted-static and legitimately need remote shell
+ * expansion — `PATH` references the remote `$HOME`/`$PATH`. Every other key is
+ * rendered as a shell literal, so an attacker-influenceable value (notably actor
+ * provenance, whose name/email can come from a tailnet peer's whois or an
+ * unvalidated `AGENTS_ACTOR_*` env var) can never inject shell into a dispatch.
+ */
+const EXPAND_KEYS = new Set(['PATH']);
+/**
+ * Build a POSIX `export K=V; …` prefix from an env map — empty string when the
+ * map is missing or empty. Values are rendered as shell LITERALS by default
+ * (single-quoted via {@link shellQuote}), so a `$(...)` or backtick in a value
+ * can never execute on the SSH target. Only {@link EXPAND_KEYS} (`PATH`) keep the
+ * expanding double-quote form (`\` and `"` escaped) so the remote `$HOME`/`$PATH`
+ * still resolve. Shared by {@link buildRemoteAgentsInvocation} and the
+ * detached/interactive dispatch builders (dispatch.ts) so every remote path
+ * exports env identically.
+ */
+export function posixEnvExports(env) {
+    if (!env || Object.keys(env).length === 0)
+        return '';
+    return Object.entries(env)
+        .map(([k, v]) => EXPAND_KEYS.has(k)
+        ? `export ${shellQuote(k)}="${v.replace(/[\\"]/g, '\\$&')}"`
+        : `export ${shellQuote(k)}=${shellQuote(v)}`)
+        .join('; ');
+}
 /**
  * Pick the remote shell dialect from a recorded OS/platform string. A Windows
  * host (device-registry `platform: 'windows'`, or an enrolled `HostEntry.os`

package/dist/lib/hosts/remote-session-id.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Resolve a remote-created session id back to an interactive `--host` launcher.
+ *
+ * A headless `--host` run captures the remote-coined id from the followed log
+ * (the `--emit-session-id` marker — see session-marker.ts). An INTERACTIVE run
+ * has no followed log: the local TTY is wired straight through `sshStream`
+ * (stdio:'inherit'), so nothing can tap the stream for a marker without breaking
+ * the agent's raw-mode TUI. Instead we correlate by AGENT_LAUNCH_ID.
+ *
+ * The launcher forwards a launch id it controls (`--env AGENT_LAUNCH_ID=<id>`);
+ * the remote `agents run` adopts it (exec.ts `resolveLaunchId`), so the remote
+ * SessionStart hook records the agent's REAL session id under that exact key in
+ * `~/.agents/.cache/terminals/sessions/<pid>.json`. After the stream returns we
+ * do ONE ssh read of that dir and pick the record whose `launch_id` matches —
+ * the same launch-id join `agents sessions --active` uses locally
+ * (session/hook-sessions.ts), just across the SSH hop.
+ *
+ * This gives the interactive path a real per-agent id to register in the local
+ * session index and to reconnect against, for Codex/Kimi/Grok/Gemini — closing
+ * the gap RUSH-2033 left for every non-Claude agent (Claude still forces its own
+ * id up front and never reaches here).
+ */
+/**
+ * Pick the real session id for `launchId` from the remote hook records.
+ *
+ * `recordsJson` is the newline-delimited JSON the remote read emits — one record
+ * per line (a `cat` of every `sessions/*.json`). Scan for the record whose
+ * `launch_id` matches and return its `session_id`; when several match (pid reuse,
+ * a lingering file) the NEWEST by `ts` wins, mirroring the local reader's
+ * keep-newest tie-break (session/hook-sessions.ts). Pure so the correlation is
+ * unit-testable from fixtures with no SSH. Returns undefined when no record
+ * carries the launch id (the hook hasn't landed yet, or a hookless harness).
+ */
+export declare function pickRemoteSessionId(recordsJson: string, launchId: string): string | undefined;
+/**
+ * Read the remote hook-session dir over ssh and resolve the real session id the
+ * remote run recorded under `launchId`. One round-trip, best-effort: any ssh
+ * failure, a missing dir, or an absent record yields undefined — the caller then
+ * keeps the un-mapped run rather than a fabricated id.
+ *
+ * `$HOME` expands on the REMOTE login shell (never the local box). The glob is a
+ * literal path with no user input, so it is injection-safe; a `2>/dev/null` on a
+ * globless dir keeps the command quiet when the dir is empty or absent.
+ */
+export declare function resolveRemoteSessionId(target: string, launchId: string, timeoutMs?: number): string | undefined;