@phnx-labs/agents-cli 1.20.77 → 1.20.82

package/CHANGELOG.md

@@ -1,5 +1,594 @@
 # Changelog
 
+## 1.20.82
+
+- **Codex hook sync no longer leaves startup warnings after upgrades.** The Codex
+  hook registrar now prunes hook commands from sibling Codex version homes before
+  writing `hooks.json`, so removed versions such as `0.142.0` cannot leave dead
+  PreToolUse/Stop handlers that exit `127`. It also writes `SessionEnd` hook
+  timeouts at Codex's 3-second limit instead of emitting `timeout: 5` and making
+  Codex warn that it is clamping the value on every startup. Source:
+  `apps/cli/src/lib/hooks.ts`.
+
+- **`agents secrets export`/`list`/`view` now accept `--device`/`--devices` as
+  aliases for `--host`/`--hosts`, and a keychain-backed `export --host` push is
+  verified.** `--device mac-mini` used to fail with "unknown option" on the secrets
+  commands even though the rest of the fleet vocabulary (`agents activity`,
+  `agents run --device`) accepts it; it now resolves identically to `--host`. And a
+  default keychain-backend push to a macOS host over headless SSH — the sign host a
+  Linux-driven release offloads `apple.com` provisioning to — used to land the bundle
+  metadata but no readable secret items (the remote login keychain is locked over
+  SSH), then fail every later read with the confusing `Bundle 'X' key 'Y': stored
+  item '...' not found`. The push now reads the bundle back the way a headless release
+  will and **fails loudly** when the keys didn't persist, naming the locked-login-keychain
+  cause and steering to `--remote-backend file` (headless-readable) or unlocking the
+  remote keychain. This unblocks headless Linux-driven releases. Source:
+  `apps/cli/src/commands/secrets.ts`, `apps/cli/src/lib/secrets/remote.ts`.
+
+- **`agents sessions resume` shows session previews immediately and opens one tab
+  per session by default (RUSH-2023).** The multi-select picker now starts its
+  preview pane open whenever the caller supplies preview content; `tab` still
+  toggles it. Batch resume now uses full-width tabs across terminal backends,
+  with side-by-side two-per-tab packing available explicitly via `--splits`.
+  Source: `apps/cli/src/lib/picker.ts`,
+  `apps/cli/src/commands/sessions-resume.ts`.
+
+- **`agents sessions --active` now distinguishes dead and abandoned sessions
+  (RUSH-2066).** The active-session engine computes lifecycle from PID liveness and
+  transcript mtime: a dead process reports `closed`, a transcript stale for
+  `ABANDONED_STALE_MS` reports `abandoned`, and a live opaque harness still reports
+  `running` as its honest floor. The default list, grouped active tallies, and
+  `agents hq floor` render `closed` / `abandoned` distinctly, and Factory maps
+  `closed` to done and `abandoned` to failed so dead work no longer appears idle.
+  Source:
+  `apps/cli/src/lib/session/active.ts`, `apps/cli/src/commands/sessions.ts`,
+  `apps/factory/src/core/remoteSessions.ts`.
+
+- **`agents view` now surfaces the Cursor account and its usage.** Cursor was
+  absent from the account view; it now shows the signed-in account (email/authId
+  from `~/.cursor/cli-config.json`, token from `~/.config/cursor/auth.json`) and,
+  for request-capped (free/legacy) plans, a monthly request bar (`M`) from
+  `cursor.com/api/usage`. Usage-based plans have no request cap, so they render the
+  account row without a bar. Source: `apps/cli/src/lib/usage.ts`,
+  `apps/cli/src/lib/agents.ts`.
+
+- **The routines daemon now anchors its working directory to `$HOME` on startup,
+  so a deleted launch directory no longer crashes every scheduled routine.** The
+  daemon is long-lived and inherited whatever cwd it was launched from — commonly a
+  git worktree under `.agents/worktrees/`. When that directory was later removed
+  (`git worktree remove`, `rm -rf`), the daemon kept the deleted inode as its cwd
+  (a process cannot chdir out of a deleted directory on its own), and every job it
+  spawned inherited the dead cwd — `spawnJobAttempt` and command runs pass no
+  explicit `cwd`. Bun then failed `getcwd()` at startup and *every* routine died at
+  0 seconds with `ENOENT: Bun could not find a file` (or `The current working
+  directory was deleted`) before the agent ran — a fleet-wide routine outage from a
+  single removed worktree. `runDaemon` now re-anchors to the home directory once at
+  startup (`anchorDaemonCwd`), making the scheduler immune regardless of how it was
+  launched. Source: `apps/cli/src/lib/daemon.ts` (`anchorDaemonCwd`, `runDaemon`).
+
+- **`agents repo refresh` is deprecated in favor of `agents sync`.** The command is
+  now hidden from help and prints a deprecation notice on use, pointing at the
+  replacement: `agents sync --local` (reconcile all installed agents, no git) or
+  `agents sync <agent>` (one agent). It still runs for now so existing scripts and
+  muscle memory don't break — `refresh` was a partial variant of `sync` (it only
+  ever materialized the single global-default version, and silently no-op'd for an
+  agent with installed versions but no global default), whereas `sync` covers
+  every installed version. Internal callers (crabbox bootstrap, the `agents pull`
+  redirect, `agents setup` help) now use `agents sync --local`. The underlying
+  `refresh()` function stays — it is the reconcile stage behind `agents sync`.
+  Source: `apps/cli/src/commands/repo.ts`, `apps/cli/src/lib/crabbox/`.
+
+- **`agents view` now shows Grok usage limits.** Grok's network usage endpoints
+  404, so usage is parsed from the local `~/.grok/logs/unified.jsonl` log instead —
+  the latest billing-period config and subscription tier render as a `W` window,
+  matching the other agents' live-usage display. Source: `apps/cli/src/lib/usage.ts`.
+
+- **`agents run --host` now starts in the same project you launched it from, not the remote `$HOME`.** A host run with neither `--cwd` nor `--remote-cwd` sent no `cd` at all, so the remote agent opened in the home directory with no project context — every launch from a repo (including every Factory "Pick Host" tab) began with a manual `cd`. The dispatch now derives a working directory from the local cwd when the caller named none: a cwd under the local home is re-rooted onto the *remote* home (`~/src/x` → the host's `$HOME/src/x`), which is the normal fleet layout where the same checkout sits at the same home-relative path on every box. Because a derived directory is a best-effort mirror rather than something the user asked for, a host that lacks that checkout falls back to its home instead of failing the run; an explicit `--cwd`/`--remote-cwd` is never mirrored, so a directory you named that does not exist still fails loudly. A cwd outside the local home is not mirrored — a path like `/opt/thing` says nothing about the target's filesystem. Source: `apps/cli/src/lib/hosts/dispatch.ts` (`deriveMirroredCwd`, `remoteCdPrefix`), `apps/cli/src/commands/exec.ts`.
+
+- **The Cmd+Shift+O quick-dispatch bar is now Plan / Run, and never runs an agent
+  in your home directory.** The two spotlight modes were renamed from File
+  Ticket / Fix to **Plan** (investigate → file a Linear ticket) and **Run**
+  (headless `agents run`). A new repo dropdown is populated from your recent
+  session working directories with `$HOME` dropped, and the pick is passed as
+  `--cwd` to both modes, so an agent is always scoped to a real repo instead of
+  the too-broad home dir; the last-picked repo is remembered. Run now always uses
+  `--strategy balanced` (auto load-balance across signed-in versions with
+  headroom, skipping rate-limited), and `--name` is seeded from a slug of your
+  task text instead of an opaque `quick-<timestamp>`. Source:
+  `apps/cli/menubar/Sources/MenubarHelper/PromptPanel.swift`,
+  `apps/cli/menubar/Sources/MenubarHelper/AgentsCLI.swift`.
+
+- **The keychain Touch ID prompt now names the session that triggered the read
+  (RUSH-1971).** When a bundle read pops Touch ID, the operation prompt already
+  named the requesting agent, bundle, and reason; it now also carries the
+  triggering session's 8-char short-id — e.g. *"Claude is requesting to unlock the
+  'prod' bundle (session e0a1b2c3) for 7 days …"* — so an unexpected prompt is
+  attributable when an interactive agent, headless workers, and `secrets exec`
+  deploys all run at once. The short-id is derived from the `AGENT_SESSION_ID` the
+  exec env already exports; no keychain-helper re-sign is required (the enriched
+  string flows through the existing `AGENTS_KEYCHAIN_PROMPT` env). Source:
+  `apps/cli/src/lib/secrets/index.ts`, `apps/cli/src/lib/secrets/bundles.ts`.
+
+- **`agents teams list` renders from cached team metadata instead of full status
+  probes (RUSH-1996).** The list and picker rows now read the team registry plus
+  teammate `meta.json` snapshots, so listing teams no longer blocks on remote log
+  pulls or unreachable hosts. Full teammate status is still loaded when a user picks
+  a team or runs `agents teams status <team>`. Source:
+  `apps/cli/src/commands/teams.ts`, `apps/cli/src/commands/teams.test.ts`,
+  `apps/cli/docs/teams.md`.
+
+- **`agents setup secrets` now guides first-run secrets onboarding (RUSH-1999).**
+  The setup command registers a new `secrets` capability wizard that chooses a
+  default storage backend (`keychain`, encrypted `file`, or synced `vault`), sets
+  the existing default prompt policy (`daily`/`always`, with `never` gated for
+  explicit automation use), persists `secrets.backend` so future `agents
+  secrets create/import` commands use the selected backend when no backend flag is
+  passed, optionally delegates imports to `agents secrets import`, and writes
+  setup preferences under `~/.agents/.history/setup`. Source:
+  `apps/cli/src/commands/setup-secrets.ts`, `apps/cli/src/commands/secrets.ts`,
+  `apps/cli/src/commands/setup.ts`.
+
+- **`agents setup fleet` now guides Tailscale device onboarding (RUSH-2000).**
+  The setup command registers a new `fleet` capability wizard that verifies
+  Tailscale, syncs discovered devices through the existing `agents devices sync`
+  path, applies SSH auth with `agents devices set`, optionally writes the
+  managed SSH config include, tests connectivity with `agents ssh <device>
+  uname`, and can run `agents fleet update` after registration. Source:
+  `apps/cli/src/commands/setup-fleet.ts`, `apps/cli/src/commands/setup.ts`.
+
+- **`agents feed post` carries artifacts and a project chip, and progress posts
+  render rich (RUSH-2013 / RUSH-2014).** `feed post` gains `--attach <path-or-url…>`
+  (repeatable): a local file is copied under
+  `~/.agents/.history/attachments/<session>/<update>/` so the link survives a
+  worktree delete, and a URL is kept as a link — each classified to an
+  image/audio/video/file/link kind by extension. Every post is now stamped with its
+  project (basename of cwd, worktree-aware) on the activity event itself, so the
+  chip shows without a live-session join. A `status.posted` event renders as a
+  multi-line update — `agent · session · host · project` chips, the message, an
+  attachment row with per-kind glyphs, and a `↳ ag focus/sessions` hint — wherever
+  it appears (`feed post` echo, the feed activity lane, `agents feed --filter
+  updates`, and `agents activity`).
+- **`agents feed --filter needs|updates|all` (RUSH-2015).** `needs` (default) is the
+  open-blocks inbox as before; `updates` shows only deliberate progress posts over
+  the local activity timeline (no block pipeline, no remote fan-out); `all` renders
+  the blocks then appends the updates view. `--json` under `--filter updates` emits
+  the raw `status.posted` events. Source:
+  `apps/cli/src/lib/activity.ts`, `apps/cli/src/lib/feed-post.ts`,
+  `apps/cli/src/commands/feed.ts`, `apps/cli/src/commands/activity.ts`.
+
+- **Fix: actor attribution now actually reaches `agents sessions` and `--active`
+  for real runs (RUSH-2018/2019).** Two bugs, found by driving a real `agents run`
+  end-to-end: (1) the session index's `actor`/`initiated_by` were kept out of the
+  upsert `ON CONFLICT` entirely, so any row indexed *before* its actor sidecar
+  landed (an older scanner, or a scan racing the spawn-time write) was locked to
+  `NULL` forever — now `COALESCE(existing, incoming)` backfills a null while still
+  never clobbering a stored owner; (2) the live `--active` **owner** read only the
+  per-pid registry entry, which the SessionStart hook rewrites without an actor, so
+  real runs showed no owner — `--active` now falls back to the durable per-session
+  actor sidecar. Verified with a real `agents run`: the actor reaches `sessions.db`
+  and the `--active` owner resolves. Source: `apps/cli/src/lib/session/db.ts`,
+  `apps/cli/src/lib/session/active.ts` (`resolveOwner`).
+
+- **Session lists expose the model and richer navigation metadata (RUSH-1981,
+  RUSH-1991, RUSH-1992, RUSH-1994).** Static flat rows add a compact model column
+  only when the result set has model data, with width sized to that set so an
+  80-column terminal does not wrap. Local CWD and ticket/PR cells are clickable
+  in supporting terminals, previews identify browser/computer use and sub-agent
+  counts, and `agents sessions --active --json` adds an always-present `prLink`
+  key. Existing session indexes migrate to schema v20 and rescan transcripts to
+  backfill model data.
+
+## 1.20.81
+
+- **Generic `--device all` / `--host all` fleet fan-out for every fleet-aware
+  command (RUSH-1969).** The passthrough now treats `all` as a sentinel value on
+  `--host`, `--device`, `--hosts`, and `--devices`. For any routable command
+  (`view`, `output`, `sync`, `doctor`, `list`, …) it runs `agents <cmd> --json`
+  on every registered device concurrently, then renders an OS-grouped roster
+  (`●` installed, `○` offline/skipped, `▸ … ← this machine`). Offline and
+  no-address devices render as rows instead of hanging the whole run. Add
+  `--json` to get a device-keyed object. Commands that already own `--all-hosts`
+  (`output`) keep their existing behavior. Source:
+  `apps/cli/src/lib/hosts/passthrough.ts`, `apps/cli/src/lib/hosts/option.ts`.
+
+- **`agents apply` no longer propagates single-use rotating refresh tokens
+  (RUSH-1958).** Droid (WorkOS) credentials use a refresh token that rotates
+  server-side on every exchange; copying one credential file across N boxes
+  caused the first refresh on any box to invalidate every other holder, collapsing
+  the fleet to a single working login. `agents apply` now excludes droid — and any
+  future harness added to the shared `SINGLE_USE_ROTATING_REFRESH_AGENTS` set in
+  `src/lib/fleet/auth-sync.ts` — from credential propagation. The plan surfaces
+  these as `manual login needed (single-use rotating refresh token)` with the
+  device name, routing the user to log in on the target box itself. Source:
+  `src/lib/fleet/auth-sync.ts`, `src/lib/fleet/apply.ts`,
+  `src/commands/apply.ts`.
+
+- **Non-Claude remote/tmux agent sessions now surface with their real id
+  (RUSH-2007).** `agents sessions --active` and the `agents sessions focus` picker
+  dropped every non-Claude tmux session (codex/gemini/kimi/grok/…) that lacked a
+  launch-minted id, so a live `agents run --device <host> <agent>` was invisible and
+  un-refocusable after an SSH drop. `listTmuxAgentSessions` now backfills the id from
+  the **deployed** SessionStart hook's own per-pid record at
+  `~/.agents/.cache/state/sessions/<pid>.json` — the CLI previously only read the
+  un-deployed session-tracker path (`terminals/sessions/`, empty on the fleet). A
+  targeted per-pid read (never a scan of that graveyard dir), freshness-guarded by
+  the launch's known start so a reused-pid record can't cross sessions. Source:
+  `apps/cli/src/lib/session/hook-sessions.ts`, `apps/cli/src/lib/session/active.ts`.
+
+- **Releases publish the CI-tested tree, not a drifted merge.** On a busy default
+  branch, unrelated PRs merging during a release PR's CI window made the
+  squash-merge tree diverge from what CI actually tested, so `release.sh` refused
+  to publish (`merged tree != built tree`) and the release stalled — every attempt
+  merged a version bump it could never tag. The publish now tags the exact release
+  commit the full matrix went green on (the PR head), letting the intervening
+  commits ride the next release; the merge commit is still tagged when its tree
+  matches (no drift). The `wait_for_ci_green` gate is unchanged, so the published
+  tarball is always a tree the full matrix validated. The tree-comparison decision
+  is extracted into `scripts/select-publish-commit.sh` and unit-tested against a
+  real git repo. Source: `apps/cli/scripts/release.sh`,
+  `apps/cli/scripts/select-publish-commit.sh`.
+
+- **Consolidate the observability + inspection commands into one role each; remove
+  `check` and `resources` (RUSH-1234).** Two overlapping command clusters had grown
+  ambiguous. `agents check` (the CI drift gate) is folded into `agents doctor --check`
+  — same drift engine, now with a scriptable exit code. `--check --quiet`,
+  `--check --json` (backward-compatible payload: every field the old `check --json`
+  emitted, plus additive `unwiredHookVersions`/`sourceBehind`), and `--check --devices`
+  all carry over; the standalone `check` command is removed. `agents resources` (the merged first-wins cross-layer
+  resource table) is folded into `agents view --merged`; the standalone `resources`
+  command is removed. The observability surfaces (`events`, `feed`, `activity`,
+  `output`, `sessions`) now have a documented one-role-each taxonomy — `events` is the
+  raw unified audit stream, `feed` the cross-agent decisions/status inbox, `activity`
+  the human milestone timeline, `output` productivity accounting, `sessions` the live
+  roster + transcripts. Running the removed `agents check` / `agents resources` now
+  reports `error: unknown command`. Source:
+  `apps/cli/src/commands/doctor.ts`, `apps/cli/src/commands/view.ts`,
+  `apps/cli/src/lib/merged-resources.ts`, `apps/cli/src/lib/startup/command-registry.ts`,
+  `apps/cli/docs/06-observability.md`.
+
+- **`agents sessions --active` shows who launched each run (RUSH-2018).** New
+  **owner** column on the active-sessions table (and an `owner` field in
+  `--active --json`), sourced from the resolved actor stamped at spawn into the
+  per-pid registry and onto each teammate record. Displays the actor's short id
+  (an email's local-part) and stays honest — an unresolved local run shows `-`,
+  never a guessed box owner. The session index (`sessions.db`) also gains
+  write-once `actor` / `initiated_by` columns, kept out of the upsert
+  `ON CONFLICT` set so a content rescan never clobbers the original owner.
+  Source: `apps/cli/src/lib/session/pid-registry.ts`,
+  `apps/cli/src/lib/session/active.ts`, `apps/cli/src/commands/sessions.ts`
+  (`ownerLabel`), `apps/cli/src/lib/session/db.ts`, `apps/cli/src/lib/exec.ts`.
+
+- **`agents sessions` attributes historical sessions to a person, and teams carry
+  spawn lineage (RUSH-2019).** Each run now writes a durable `sessionId -> actor`
+  sidecar at spawn (`~/.agents/.history/by-session/`, unlike the pruned pid
+  registry), and the session scanner joins it while indexing — so the write-once
+  `actor` / `initiated_by` columns added in RUSH-2018 populate automatically and the
+  durable `agents sessions` listing (not just `--active`) shows who launched each
+  session. Teammate spawns inherit the orchestrator's frozen actor and now record a
+  `parent_session_id` (the orchestrator's own `AGENTS_SESSION_ID`), so a team traces
+  back to the one human who started it and the spawn chain is walkable. Source:
+  `apps/cli/src/lib/session/actor-sidecar.ts`, `apps/cli/src/lib/exec.ts`,
+  `apps/cli/src/lib/session/db.ts`, `apps/cli/src/lib/teams/agents.ts`.
+
+- **Actor provenance reaches events, routines, and browser tasks (RUSH-2020).**
+  Completes the actor layer's coverage beyond sessions: every emitted **event** now
+  records `actor` + `kind` through the audit origin (so `agents events` stats carry
+  a `byActor` breakdown in `agents logs stats`); a **routine** stamps its creator's
+  actor id at creation and seeds it into each fired run's env (`AGENTS_ACTOR`), so an
+  unattended cron's session and events attribute to the person who scheduled it
+  instead of `UNRESOLVED@<host>` — its run records gain `actor` (creator) and
+  `triggeredBy` (who kicked off that run); a **browser task** records the `owner` who
+  launched it, on the live task and in history. Source:
+  `apps/cli/src/lib/events.ts`, `apps/cli/src/lib/runner.ts`,
+  `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/browser/{types,service}.ts`.
+
+- **`agents sessions` now shows an accurate working / waiting / idle status for
+  every harness, and shows it as text in the default list — not just a glyph.** Two
+  gaps are closed. (1) A live non-Claude/Codex agent (grok, droid, gemini, rush,
+  kimi, hermes, opencode, antigravity) used to fall through to a blanket `unknown`
+  because `findSessionFileForKind` / `computeLiveSignals` only resolved and parsed
+  Claude and Codex transcripts — a running Codex or grok session displayed
+  `unknown`. Every tracked harness whose transcript is locatable + parseable is now
+  wired into the same state engine: `findSessionFileForKind` resolves each kind's
+  transcript through the session index (`latestSessionFileForCwd`), and
+  `computeLiveSignals` parses it with that harness's own parser and runs it through
+  the same `inferSessionState`, so it gets a real `working` / `waiting_input` /
+  `idle` the principled way Claude/Codex do. For a genuinely opaque kind (cursor) or
+  an unreadable transcript, `resolveFallbackStatus` now reports `running` for any
+  live process — **a running agent never displays `unknown`** (that state is reserved
+  for the sole un-answerable case: a dead process whose transcript vanished
+  mid-read), and a live process is never downgraded to a fabricated `idle`. (2) The
+  default `agents sessions` list (flat, tree, and the project overview) showed only a
+  colored glyph for live rows; it now also prints the status **word** —
+  `working` / `waiting` / `idle` — next to the glyph, the same three states the
+  `--active` column shows, with `waiting` the unmistakable "needs you" case. The
+  single-session preview (`agents sessions <id> --preview`) leads with the same live
+  status line, flagging `← needs you` when the agent is waiting on a question,
+  permission, or plan review. Source: `apps/cli/src/lib/session/active.ts`
+  (`findSessionFileForKind`, `computeLiveSignals`, `resolveFallbackStatus`),
+  `apps/cli/src/commands/sessions.ts` (`liveStatusWord`, `flatSessionRow`,
+  `treeSessionRow`, `renderSessionPreview`).
+
+- **`agents sessions inject` now addresses VSCodium / Cursor / VS Code and iTerm sessions, not just tmux.** It resolves targets through the same canonical resolver the watchdog uses (`resolveInjectTargetForSession`), so the manual unblock path and the watchdog agree on which sessions are reachable — and a failed resolve now surfaces the precise reason (host/rail) instead of a misleading "not running under tmux". Source: `apps/cli/src/commands/sessions-inject.ts`.
+- **Watchdog brain focuses on driving idle agents to completion, with context-aware, tool-pointing nudges.** The decider prompt now reads the stalled agent's goal first, restates the conclusion it already reached, names the concrete next step (including a tool it forgot it has — `agents computer` / `agents browser` / `agents ssh <mac> "agents computer …"`), splits do-it-yourself from ask-the-human, and treats `idle` as its territory while leaving `waiting` prompts to the user's feed. Design + normative spec: `apps/cli/docs/watchdog.md`, `apps/cli/docs/specifications.md#watchdog`. Source: `apps/cli/src/lib/watchdog/watchdog.ts`.
+
+## 1.20.80
+
+- **`agents activity` goes fleet-wide, grouped, and session-enriched.** The activity
+  lane was a flat, local-only, newest-first list; it now shows progress-so-far across
+  the whole fleet — who did what, where, on which project, for which ticket. New flags:
+  `--devices-all` (alias `--hosts-all`) fans the same `activity --json` payload out to
+  every reachable device (feed-style, via `gatherRemoteAgentsJson`) and merges each
+  peer's stream host-tagged; `-H/--host` / `--device` scope to specific boxes; `--local`
+  forces local-only (still the default). `--group-by project|device|agent` buckets the
+  stream (e.g. per project, what each agent did and for which ticket) and `--filter
+  <text>` narrows by project/device/agent/event/ticket. Each item is enriched by JOINING
+  to live sessions — the resolved project (repo/worktree slug from cwd), the execution
+  host (`provenance.host`), and the Linear ticket (`ActiveSession.ticket`) — never by
+  re-parsing transcripts. Milestone tiering (`--milestones`) and the default collapse are
+  unchanged, and `--json` stays a mergeable per-host payload (now carrying the enriched
+  fields). Source: `apps/cli/src/commands/activity.ts`, `apps/cli/src/lib/activity.ts`
+  (`enrichActivityEvents`, `mergeActivityEvents`, `parseActivityPayload`, `groupActivity`,
+  `filterActivityEvents`, `projectFromCwd`).
+
+- **Add `agents set` — a short front door for per-version run defaults.** `agents set claude@2.1.220 --model opus-5` pins the default model (and/or `--mode`) that `agents run` uses for that agent version. It reads and writes the same store as `agents defaults run set` (`agents.yaml` -> `run.defaults`), so the two stay consistent. Bare `agents set` lists every default; `agents set <selector>` shows one. Source: `apps/cli/src/commands/set.ts`.
+
+- **`agents doctor` now reads as a triaged health report, not neutral status.**
+  The verdict was terse status text ("Verdict: 1 divergent, source ~/.agents 16
+  commits behind…") a user had to decode. It is now a severity-ranked health block
+  that leads with what is unhealthy, why it matters, and the exact fix — one row
+  per finding, tagged with a restrained terminal glyph (`✓` `✗` `⚠` and a subtle
+  info dot, colored via chalk to match the man-page voice):
+  ```
+  Claude@2.1.220
+    ✗ unhealthy — 3 issues (1 critical · 2 warnings)
+
+    ✗ critical  ask-user-question-guard — on disk but not wired into settings.json; the hook never fires
+                → agents sync claude@2.1.220 --yes
+    ⚠ warning   ~/.agents — 16 commits behind origin/main; you're running stale config
+                → agents repo pull user
+    ⚠ warning   11-activity-log — differs from source
+                → agents doctor claude@2.1.220 --fix
+
+    heal what's auto-fixable:  agents doctor claude@2.1.220 --fix
+  ```
+  A clean install collapses to one green line —
+  `✓ healthy — 34 resources reconciled · hooks wired · sources current`. Each
+  finding carries an agent-agnostic **severity**: **critical** (silent breakage —
+  an unwired hook, a missing/unparseable `settings.json`, a MISSING resource),
+  **warning** (stale/drift — a source layer behind origin, a DIVERGENT resource, a
+  stale/never-synced version), or **info** (an orphan/EXTRA resource →
+  `agents prune cleanup`). Both surfaces get the same treatment: the target report
+  `agents doctor <agent>@<version>` and the bare `agents doctor` overview, which
+  now opens with a `Health` banner aggregated across every installed version. The
+  existing per-resource detail rows are kept — the health block layers on top of
+  them as the verdict. `--json` gains a `verdict` field (target mode) and a
+  `health` field (overview), each carrying `severity`/`category`/`subject`/
+  `impact`/`fix` per issue; the existing `summary`/`kinds`/`hookWiring`/
+  `sourceBehind`/`sync`/`orphans` fields are unchanged. Source:
+  `apps/cli/src/commands/doctor.ts` (`computeVerdict`, `computeOverviewHealth`,
+  `healthBlockLines`, `renderHealthBlock`, `verdictIsAutoFixable`).
+
+- **The daemon's `MenubarHelper --notify` one-shots can no longer pile up in the
+  menu bar.** Each routine notification (start/finish/overdue/heal) spawned a
+  fresh, detached, unsupervised `MenubarHelper --notify` process; on a stalled
+  delivery — a locked screen or a WindowServer/XPC hiccup — the helper's runloop
+  spin never reached its deadline and the process hung indefinitely, so duplicate
+  "Agents" instances accumulated. The one-shot is now bounded by two independent
+  watchdogs: `runOneShot` arms a background-thread force-exit at 3s (off the main
+  queue, so a wedged main thread can't starve it — unlike the 0.6s runloop
+  deadline it backs up), and the Node spawner (`spawnDetachedQuiet`) SIGKILLs the
+  child at 4s if it never self-exits. A notifier that posts normally (the common
+  sub-second path) is untouched; only a genuinely hung one is killed. Source:
+  `apps/cli/menubar/Sources/MenubarHelper/PromptPanel.swift` (`Notifier.runOneShot`),
+  `apps/cli/src/lib/menubar/notify-desktop.ts` (`spawnDetachedQuiet`,
+  `NOTIFY_TIMEOUT_MS`).
+
+- **Removed the dead `commitOwnDeviceMeta` auto-commit from the pull path.** It
+  committed this machine's `devices/<host>/agents.yaml` pin snapshot to the user
+  repo's `main` on nearly every `pullRepo`, without pushing — so `main` diverged
+  N-ahead per machine and wedged `agents sync` across the fleet. Now that
+  per-device pins are gitignored (they are local runtime state — written by
+  `writeMetaUnlocked`, read on-disk by pinned-strategy resolution and the shim),
+  the function only ever no-ops, so it and its sole `pullRepo` call are deleted
+  along with their tests. `--strategy balanced` never read pins; the only behavior
+  removed is the never-reached auto-commit. Source: `apps/cli/src/lib/git.ts`
+  (`pullRepo`), `apps/cli/src/lib/git.test.ts`.
+
+- **Remove Forge and hard-deprecate Gemini (RUSH-2060).** ForgeCode is no longer
+  an `AgentId`, install target, resource-sync target, subagent target, MCP target,
+  or permissions target. Gemini remains a legacy id so existing sessions/config can
+  still be read, but it is no longer a managed harness: `agents add gemini`,
+  `agents import gemini`, and `agents sync gemini` now fail and point users to
+  Antigravity. Gemini is also excluded from capability-driven resource writers,
+  staleness detectors, import choices, teams choices, model choices, fleet auth
+  sync, and plugin/MCP/permissions/subagent sync. Source:
+  `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/types.ts`,
+  `apps/cli/src/lib/capabilities.ts`, `apps/cli/src/commands/{versions,import,sync}.ts`,
+  and the resource writers under `apps/cli/src/lib/`.
+  (RUSH-2060)
+
+- **Every agent secret access and unlock is now captured in the raw event stream and the audit log.** After the recent relaxation that lets agents read and unlock bundles more freely, `agents events --module secrets` now surfaces two typed, value-free events for the complete access picture. `secrets.get` records every path that resolves a secret VALUE out of a bundle (`run --secrets`, `secrets exec`/`export`, `view --reveal`, raw `get <item>`, `sync push`, remote `bundle@host`), and a new `secrets.unlocked` records the deliberate `agents secrets unlock` grant into the broker/durable session — the longer-lived grant a per-read event does not capture, carrying its TTL and the harness scope it was granted to (`*` = global). Every record is tagged with the resolving `agent` scope and lands at audit level in the append-only `~/.agents/events.jsonl` audit trail, but is non-milestone so it does not clutter `agents activity` / `agents feed`. The resolved value is never written — only bundle name, key NAMES, and counts. All value-read/unlock audits now funnel through one canonical `emitSecretAudit` helper (`apps/cli/src/lib/secrets/audit.ts`), wired into `lib/secrets/bundles.ts`, `commands/secrets.ts` (reveal / raw get / unlock), `lib/secrets/sync.ts`, and `lib/secrets/remote.ts`; the new event type is registered in `lib/events.ts`. Source: `apps/cli/src/lib/secrets/audit.ts`, `apps/cli/src/lib/events.ts`, `apps/cli/src/commands/secrets.ts`.
+
+## 1.20.79
+
+- **A daemon bounce no longer orphans the secrets broker.** Installing agents-cli ran `stopDaemon()`, which sent SIGTERM, scheduled its hard-kill escalation on a `setTimeout`, and cleared the daemon pid file immediately — without waiting for the process to actually exit. In a short-lived process like the npm postinstall the timer never fired at all, and the cleared pid file made `isDaemonRunning()` report false, so `startDaemon()` launched a second daemon alongside the live one. Its hosted broker then found the socket in use, missed one 700ms ping against the busy owner, unlinked the live socket and rebound — leaving the first broker running with every unlocked bundle in RAM that no client could reach. On a machine with two installs (nvm + homebrew) this reproduced on every upgrade: `lsof` showed two processes on one socket path at two different kernel socket addresses. `stopDaemon` now waits for the process to actually stop serving before clearing the pid file (and escalates to a tree-kill only if it does not), and `bindBrokerSocket` probes an in-use socket several times and refuses to reclaim it while a live process still owns the broker pid file, surfacing a clear error instead of silently starting a second broker. A zombie counts as exited — it holds no socket — so a daemon that is the caller's own child is not hard-killed after it has already gone.  The socket owner is recorded in a dedicated `agent.owner` file rather than the standalone service's `agent.pid` single-instance claim, so the signal is present for the daemon-hosted broker (the primary configuration) without making a losing standalone service exit into a launchd restart loop; `ensureAgentRunning`'s one-off fallback and `teardownStaleBroker` also wait for a broker to stop serving before unlinking its socket and ownership record, instead of destroying the evidence the check depends on. Source: `apps/cli/src/lib/platform/process.ts` (`waitForExit`, `hasExited`), `apps/cli/src/lib/daemon.ts` (`stopDaemon`), `apps/cli/src/lib/secrets/agent.ts` (`ownerPath`, `brokerPidAlive`, `releaseBrokerPid`, `bindBrokerSocket`, `ensureAgentRunning`, `teardownStaleBroker`).
+
+- **`agents doctor` now checks hook WIRING, not just hook files — and treats a
+  stale source layer as unhealthy.** Two blind spots let a version home read
+  "healthy" while its hooks were dead. (1) Doctor only compared hook FILES against
+  source, never that `settings.json` actually references each hook in the right
+  event array — so a hook whose script was byte-identical to source but never
+  wired into `PreToolUse`/`Stop`/… reported `ok` and silently never fired
+  (reproduced on `yosemite-s1`: `Claude@2.1.207` printed `hooks 32 items 32 ok`
+  while its `settings.json` PreToolUse array omitted `ask-user-question-guard.sh`).
+  Doctor now inspects the version's native `settings.json` (Claude-family: claude,
+  droid), verifying each hook per `(event, matcher)` group, and reports a
+  present-but-not-wired hook as `UNWIRED <hook> event=<event> matcher=<matcher>`,
+  counted against the verdict; a missing/unparseable `settings.json` is surfaced
+  too. `--fix` re-wires via the same `registerHooksToSettings` path `agents sync`
+  uses. (2) A source layer behind `origin/main` means the home is reconciled
+  against stale truth, yet the "N commits behind" fact was a buried preamble while
+  the verdict still said healthy — it now flips the per-version verdict to unhealthy
+  with the `agents repo pull` remediation. Both checks run in every mode, not just
+  `agents doctor <agent>@<version>`: bare `agents doctor` (overview) and the CI gate
+  `agents check` now flag a present-but-unwired hook and a behind-origin source
+  layer, and `agents check` exits non-zero on them. Source:
+  `apps/cli/src/lib/hooks.ts` (`checkVersionHookWiring`), `apps/cli/src/lib/drift.ts`
+  (`checkSyncStatus`/`computeSourceBehind`/`computeDrift`),
+  `apps/cli/src/lib/doctor-diff.ts`, `apps/cli/src/commands/doctor.ts`
+  (`computeVerdict`), `apps/cli/src/commands/check.ts`, `apps/cli/src/lib/git.ts`
+  (`commitsBehindUpstream`).
+
+- **`agents repo pull` reconciles a diverged repo instead of wedging on it.** It ran
+  `git merge --ff-only`, which refuses *any* divergence — conflict or not — so a
+  single local commit permanently blocked every later pull with nothing actually in
+  conflict. Since `pullRepo` itself auto-commits the machine's own
+  `devices/<host>/agents.yaml` before pulling, every device eventually created that
+  commit and stopped receiving updates: on one fleet, nine machines sat 9 commits
+  behind and merged rule changes never reached any of them. It now rebases, which is
+  what its own documentation has always described. Per-device paths are disjoint, so
+  they replay cleanly. A genuine conflict aborts the rebase and rolls the checkout
+  back untouched, so a failed pull can never leave the repo detached, mid-rebase, or
+  with conflict markers in live config; a rebase already in progress is reported as
+  itself rather than as a dirty tree.
+- **`agents repo pull` / `push` exit non-zero when a repo fails.** Both printed a
+  failure line and returned 0, so `agents fleet run "agents repo pull user"` reported
+  `11 ok` across a fleet that pulled nothing. Any automation gating on the exit code
+  read a total no-op as success. Matches `agents sync <repo>`, which already did this.
+
+- **`agents repo status` reports across the fleet.** New `--devices-all` (alias
+  `--hosts-all`) fans `repo status`/`repo list` out to every reachable device and
+  renders one aggregated table (device · repo · sync · changes); `--devices <who>`
+  (alias `--hosts`) takes `all` or a comma-separated device list. Unreachable peers
+  are skipped with a clear marker, never failing the command, and a single
+  `--device`/`--host` still streams that one box as before. Source:
+  `apps/cli/src/commands/repo.ts`.
+
+- **Routines now always authenticate as the machine they run on, never on an inherited Claude token.** The daemon was already forbidden from *injecting* a Claude OAuth token into a routine, but nothing stopped it *inheriting* one: `buildExecEnv` spreads the ambient `process.env`, and `sanitizeProcessEnv` only strips loader/interpreter variables, never credentials. So on any box whose daemon environment happened to carry `CLAUDE_CODE_OAUTH_TOKEN` — a provisioned fleet machine, a shell that exported it — every routine spawn silently ran on that one shared, rotating token instead of the host's own login. That is the fleet-wide-logout path the no-token design exists to prevent, reached by inheritance rather than injection: when the server rotates a refresh token, every other holder drops to "run /login". No CI runner has a token to inherit, so the existing test passed everywhere and the leak only appeared on a real machine (it surfaced on the release VM, halting a release). `buildRoutineSpawnEnv` now drops the variable, and the routine still authenticates exactly as before — `CLAUDE_CONFIG_DIR` is pinned to that box's per-account version home, so a routine uses whatever agent login is set up there and needs no token of its own. Source: `apps/cli/src/lib/runner.ts` (`buildRoutineSpawnEnv`).
+
+- **The `daily` secrets policy is now called `hold`, because it was never daily.** The default prompt policy holds a bundle for `secrets.agent.holdMs` — 7 days out of the box — yet it was named `daily`, so `agents secrets policy --help` read as "you will be asked once a day" while the code comment beside it said "one Touch ID per ~7d". Both the CLI help and `docs/secrets.md` had resorted to apologising for it in prose ("Name is historical", "Despite the name, it is not tied to one calendar day"), which is a name stating something false, not a name that is merely unclear. It is not one day, not one session, and not any fixed period — it is the configured hold window, so it is now named for that. **`daily` and the wire token `session` remain accepted everywhere** (`agents secrets policy <bundle> daily`, `secrets.policy: daily` in agents.yaml, and the `tier: session` key already written into every bundle on every synced machine), so no config or stored bundle changes behaviour on upgrade. **One machine-readable surface does change**: `agents secrets list --json` and `agents secrets view --json` now report `"policy": "hold"` where a default-tier bundle previously reported `"daily"`. Anything matching on that string needs updating — the CLI keeps accepting `daily` as input, but it no longer emits it, because a JSON field that reports a name the CLI itself has retired is a worse trap than a one-line change. The help text now also states what the tier actually depends on: the hold is a property of the running broker plus the durable session, not of the stored keychain item, so a broker that is down degrades `hold` to prompt-every-read; only `never` is prompt-free independently of the broker. Source: `apps/cli/src/lib/secrets/bundles.ts` (`SecretsPolicy`, `parsePolicy`, `secretsDefaultPolicy`), `apps/cli/src/commands/secrets.ts` (`parsePolicyOpt`, `policy` command help), `apps/cli/src/lib/secrets/index.ts` (legacy token mapping for the signed helper), `apps/cli/docs/secrets.md`.
+
+- **Claude usage/probe reads can authenticate with a file-based setup-token
+  instead of the login keychain — no Touch ID.** On macOS, reading a Claude
+  account's usage went through Claude Code's ACL-bound
+  `Claude Code-credentials-<hash>` keychain item (`loadClaudeOauth` →
+  `/usr/bin/security`), popping a Touch ID sheet on every cold read — per account,
+  roughly every 8h, and again on the routines daemon's 3-minute auth-health probe
+  (`probeLocalFleetAuth`), so `ag view` and the background warm both prompted.
+  `loadClaudeOauth` now first resolves a per-account `claude setup-token` from the
+  reserved **file-based** `auth` secrets bundle (keyed by account email as
+  `CLAUDE_CODE_OAUTH_TOKEN_<slug>`); when present, the usage endpoint is
+  authenticated with that long-lived, non-rotating token and the keychain is never
+  touched — killing the prompt. This applies only to the read-only usage/probe
+  callers (`accessTokenCache`); the full-credential run/export path (which needs the
+  refresh token) is unchanged, and an account with no provisioned setup-token still
+  falls through to the keychain for now. Keyed strictly per-account (never a bare
+  shared key) so one account's token can't be misapplied to another. Source:
+  `apps/cli/src/lib/usage.ts`; design: `docs/design/credential-management.md`.
+
+## 1.20.78
+
+- **`agents sessions <uuid>` now resolves a remote session exactly, across the
+  fleet.** A full session id absent from the local disk used to fall back to an
+  FTS content search — and because a UUID appears verbatim in other sessions'
+  transcripts (a watchdog `/continue <uuid>` reference), that surfaced a list of
+  unrelated "matches" instead of the one session, which actually lived on another
+  machine. A UUID is now treated as an identifier: on a local miss the CLI fans
+  the id lookup out to the online fleet (the existing `gatherRemoteList` SSH
+  sweep), and when exactly one machine holds it, renders that session's summary
+  from the owning peer via `runOnPeer` (instead of `Session transcript not
+  available`). Same id on more than one box surfaces a machine-labeled conflict to
+  disambiguate with `--device <host>`; a UUID found nowhere prints a clear "no
+  session on this machine" message. There is **no** fuzzy/content fallback for a
+  UUID anywhere — the peer's `--json` answer id-resolves too, so a content
+  mentioner can never masquerade as the session. `--local` still restricts the
+  lookup to the local machine, and a peer already answering a parent's sweep
+  (`AGENTS_SESSIONS_LOCAL=1`) never re-fans-out. Source:
+  `resolveSessionAcrossFleet` / `fleetHitsById` / `shouldFanOutForId` in
+  `apps/cli/src/commands/sessions.ts` (wired into `renderOneSession`), and the
+  id-only `--json` resolution at the sessions listing seam. (RUSH-2024)
+
+- **`agents doctor --devices` now detects cross-device harness divergence (RUSH-2027).** The umbrella fleet diagnostic compares each registered device's installed harness inventory — resources (commands, skills, hooks, rules, mcp, permissions, subagents, plugins, promptcuts, workflows), per-agent installed versions, and `.agents`/`.system` config-repo state (branch, HEAD, dirty) — against the local machine as the baseline, and flags anything present on one box but missing on another. A plugin like `swarm` installed on `zion` but absent on `yosemite-s0` now surfaces as a clear warning (`yosemite-s0 is missing plugin 'swarm' (present on zion)`) instead of only being discovered at runtime as `Unknown command: /swarm:run`. Agent-version gaps (`yosemite-s0 is missing claude@2.1.220`) and diverged config repos are reported too. Read-only by default — it never installs or syncs; `--json` carries a stable `fleet` divergence block for the VS Code extension to consume. `agents fleet status` gained the same per-device divergence warning in its rollup. Every device's top-level `doctor --json` now emits a `fleet` inventory field so the comparison needs no extra probe. Source: `apps/cli/src/lib/devices/fleet-divergence.ts` (comparator), `apps/cli/src/lib/devices/fleet-inventory.ts` (`collectLocalFleetInventory`), `apps/cli/src/commands/doctor.ts` (`runDevicesDoctor`, `renderFleetDivergence`, `--json` `fleet` field), `apps/cli/src/lib/devices/health-report.ts` (`buildFleetHealthReport` divergence warning), `apps/cli/src/lib/git.ts` (`readRepoState`).
+
+- **`agents doctor` now shows repo-behind notices; they no longer appear on stderr during normal commands (RUSH-2048).** `printPendingUpdateNotices()` — which wrote "agents-cli: ~/.agents/ is N commits behind origin/main" to stderr on every CLI invocation — is replaced by `readRepoBehindMarkers()`, which returns the same data without printing. `agents doctor` reads these markers and renders a "Repo updates" section showing which repos are behind and the `agents repo pull <alias>` fix command. `agents doctor --json` emits a `repos` array so menubar helpers and other consumers can read the same data. Markers persist on disk until the next background fetch overwrites them, so the notice stays visible until the user acts. Source: `apps/cli/src/lib/auto-pull.ts`, `apps/cli/src/commands/doctor.ts`, `apps/cli/src/index.ts`.
+
+- **Session affinity data + host affinity resolver (RUSH-2049).** Sessions index
+  persists `machine` (schema v18) so affinity can `GROUP BY machine`.
+  `queryAffinityRollup` returns launch counts by device (and harness/joint for
+  analytics). Host affinity sampling lives in `smart-launch.ts` as
+  `resolveDeviceAffinity` / `applyDeviceAutoToOptions` (weight ∝ launches^α;
+  online hosts with no history still explore at weight 1). Account pick stays
+  the existing balanced strategy (live session/week rate-limit windows).
+  **User-facing host pick shipped as `--device auto` / `--host auto` in
+  RUSH-2059** (not a public `--smart` flag and not harness auto-pick). Source:
+  `apps/cli/src/lib/session/db.ts`, `origin-machine.ts`, `smart-launch.ts`.
+
+- **`agents sessions --all` now widens every non-status filter, not just the
+  directory (RUSH-2055).** `--all` used to only drop the current-project scope; it
+  now also drops the 30-day window cap, so one flag means "all values for every
+  non-status filter" — all directories AND all time. `--active` still composes as a
+  status filter, and `-a` / `--device` / `--since` still narrow their own axis (an
+  explicit `--since` overrides the all-time default). Applies to both the bare
+  listing and `--active`. Source: `apps/cli/src/commands/sessions-browser.ts`.
+
+- **Device affinity is `--device auto` (not `--smart` / harness `auto`) (RUSH-2059).**
+  Host pick from 14d usage affinity is a special value on the existing host flags:
+  `agents run claude --device auto` or `--host auto`. The harness is always the
+  agent you type — never auto-selected. Deprecated hidden `--smart` maps to
+  `--device auto` for one release. Extension New Agent unpinned launches use
+  `--device auto`. Banner: `device=auto → <host> (affinity …) · accounts=balanced`.
+  Source: `apps/cli/src/commands/exec.ts`, `smart-launch.ts`,
+  `apps/factory/src/core/agents.ts`.
+
+- **`agents sessions --active` no longer hides most of your running sessions.** On a TTY, `--active` opens the interactive browser, and the browser resolved "running" two ways that both dropped live sessions: its live scan called the local-only `getActiveSessions()` instead of the fleet sweep the static view uses, and it treated running as an *intersection* with the transcript index (`pool.filter(r => live.has(r.id))`) rather than a source of rows. Together they meant every session on another machine was invisible, as was any local one the index didn't already carry — a fleet with 32 live sessions across 7 machines showed 4. The browser now shares one gather with the static view (`gatherActiveSessions`) and folds live sessions the index lacks in as their own rows, keyed by session id, cloud task id, or `machine:pid` so two id-less sessions never collapse into one. Picking a row that has no session id yet reports where the process is instead of trying to open a transcript that doesn't exist. Source: `apps/cli/src/commands/sessions.ts` (`gatherActiveSessions`, `isIdlessLiveRow`), `apps/cli/src/commands/sessions-browser.ts` (`liveRowKey`, `indexLiveRows`, `liveSessionToMeta`, `mergeLiveIntoPool`).
+- **The session browser now shows which program each running session is in.** A new host column names the terminal or editor hosting the session — `codium`, `ghostty`, `tmux`, or `tmux→ghostty` when a tmux session is being watched through another app (a bare `tmux` means it is running detached) — so a session in the list can actually be found. The column is live-only and appears just in the running view, since transcript metadata carries no host. The id column also truncates now, so a row named by a 7-digit pid can no longer shunt every later column out of alignment. Source: `apps/cli/src/commands/sessions.ts` (`liveHostLabel`, `formatPickerLabel`, `PickerColumns.showHost`).
+
+- **The routines daemon holds no Claude credential and injects no token.** A
+  scheduled or daemon-fired Claude run now authenticates exactly like an
+  interactive `agents run claude` on the same machine: through the rotation-pinned
+  account's own `CLAUDE_CONFIG_DIR` login (`.credentials.json`), which Claude Code
+  refreshes per-device. The daemon previously read a token from the `claude`
+  secrets bundle and injected it into every routine spawn — first as one ambient
+  `CLAUDE_CODE_OAUTH_TOKEN` (RUSH-1759), then also as per-account
+  `CLAUDE_CODE_OAUTH_TOKEN_<account>` setup-tokens — which shadowed each account's
+  own on-disk login and made the daemon a second, competing credential store. Both
+  paths are removed, along with the sandbox `ENV_ALLOWLIST` entry that forwarded
+  them; a sandboxed routine now strips `CLAUDE_CODE_OAUTH_TOKEN` from its
+  environment and falls through to the per-account login. A box whose interactive
+  login has expired is skipped up front by the auth-health preflight with a
+  `re-login required` hint instead of running on an injected fallback — log in once
+  on that box (`agents run claude`) to restore it; no daemon restart is needed. This
+  keeps the daemon out of the credential entirely, which is what avoids the
+  fleet-wide rotation logout (a shared/injected token was the cause, not the fix).
+  Removed: `readDaemonClaudeOAuthToken` / `readDaemonClaudeBundleEnv` /
+  `buildDetachedDaemonEnv` (`daemon.ts`), `resolveAccountSetupToken` and
+  `apps/cli/src/lib/secrets/account-token.ts`, `claudeHomeHasOwnCredential`
+  (`agents.ts`). Source: `apps/cli/src/lib/daemon.ts`, `runner.ts`, `sandbox.ts`,
+  `agents.ts`.
+
+- **`agents sessions` no longer over-counts test results from arbitrary stdout.** The catch-up digest scraped any `\d+ pass`-shaped substring anywhere in a command's output, so a `442 passwords generated` log, a `git status: 442 files` line, or a `442 passes/sec` benchmark was reported as `Tests ✓ tests 442 pass`. It also treated any command merely containing a runner token as a test run, so npm-script sub-targets like `bun test:setup`, `npm run test:watch`, or `pnpm test:ci` were counted. Test-run classification now matches only real invocations (`bun/npm/yarn/pnpm test` bare, `vitest`, `jest`, `mocha`, `pytest`, `go test`, `cargo test`, `tsc`) and rejects `:sub-target` scripts, and pass/fail counts are read only from each runner's authoritative summary construct — vitest's ` Tests  N passed` / ` Tests  N failed | M passed` row, jest's `Tests:` line, pytest's `=== N passed[, M failed] in Xs ===` rule, bun's ` N pass`/` N fail` block closed by `Ran N tests`, and mocha's ` N passing`/` N failing`. A verdict is reported only when a real summary matched, so an ambiguous blob now shows nothing instead of a fabricated pass count. Source: `apps/cli/src/lib/session/digest.ts` (`TEST_RUNNERS` classification with `(?![:\w-])` guard, new `parseSummaryLine`, `parseTestOutput`); consumed by `apps/cli/src/lib/session/render.ts` (`renderTestsLine`) and `apps/cli/src/commands/sessions-picker.ts`.
+
+- **Readable `Dirs:` line in `agents sessions`.** The session preview's touched-directories line no longer renders raw Claude project-slugs (`-home-me--agents-…`) or nested worktree paths. Paths under a git worktree collapse to `⧉ <slug>/<remainder>`; a Claude project-slug is matched in slug space (its cwd/`.`-encoding is lossy, so it is never decoded to a fake path) — a slug worktree shows `⧉ <name>` and a slug pointing at the session's own cwd (internal projects-storage scratch) is dropped; real paths still relativize against the session cwd and home (`~`). Source: `apps/cli/src/commands/sessions-picker.ts`.
+
+- **`release.sh` is now a zero-config, self-routing release — runnable from any fleet box with an empty environment.** No routing/secret environment variables: `SIGN_HOST`, `SECRET_HOST`, `SIGN_HOST_REPO`, `FORCE_REMOTE_SIGN`, the `PREFERRED_SIGN_HOSTS` list, the `zion` fallback, and the `agents devices` fleet discovery are all gone. The release has three self-selected homes: git/gh orchestration on the invoking box, the Linux test suite on a **dynamic crabbox** (`scripts/sandbox.sh` selects an available Hetzner VM for the repo's `.crabbox.yaml` profile or warms one — never a hardcoded instance), and build + sign + notarize + `npm publish` + computer-helper on the **`mac-mini` home base** (the one hardcoded name, `RELEASE_HOME_BASE`). The script detects its own host (`scutil --get LocalHostName` / `hostname -s`) and runs the privileged phase on the home base — locally if already there, else over ssh — always by checking out the `v<version>` tag into a throwaway worktree and running **that worktree's** `release.sh --home-base-phase`, so the publishing script is the one carried by the release tag, never the home base's stale on-disk checkout; the worktree is removed on exit on success or failure. The npm token is resolved on the home base and never borrowed to the trigger box. A new shared `scripts/headless-sign-context.sh` factors the headless keychain-unlock + `AGENTS_SECRETS_PASSPHRASE` preamble (no Touch ID) used by both the on-home-base publish and `remote-sign-mac.sh`. A phase tracker (`[n/N]`, N=6 for a normal release, 4 for a catch-up publish) labels each phase with the box it runs on and a ✓/✗ result; a crabbox test failure prints the failing tests + the captured log path and halts before any PR/publish. Idempotency/catch-up/tree-verification guards are preserved. Source: `apps/cli/scripts/release.sh`, `apps/cli/scripts/remote-sign-mac.sh`, `apps/cli/scripts/headless-sign-context.sh`.
+
+- **`agents secrets unlock` now grants globally, so one Touch ID actually covers everything.** An unlock was silently scoped to the ambient `AGENTS_AGENT_NAME`: typed in a plain shell it was stored under a literal `cli` harness, while a read from inside an agent looked under *its* harness (`claude`, `codex`, …). The two never met, so a valid 7-day grant was invisible to every agent for its whole life — `agents secrets exec <bundle>` reported "not unlocked in the secrets agent" while the bundle sat unexpired in the store, and each miss cost another Touch ID or blocked a headless run outright. An unlock with no `--for` is now a global grant that every harness and a plain shell can read; `--for <agent>` still narrows it to one harness, and readers resolve own-harness → global so a narrow grant wins where it applies. The broker's in-memory store and the durable session store share one scope chain, so behavior is identical before and after a daemon restart. Grants already written under the old `cli` scope migrate to global on the next broker start — an unlock you already paid Touch ID for keeps working across the upgrade instead of going unreadable. Source: `apps/cli/src/lib/secrets/scope.ts` (`GLOBAL_HARNESS`, `bundleScopeChain`), `apps/cli/src/lib/secrets/agent.ts` (`get` handler), `apps/cli/src/lib/secrets/session-store.ts` (`resolveSession`, `cli`→global migration), `apps/cli/src/lib/secrets/bundles.ts` (`readAndResolveBundleEnv`), `apps/cli/src/commands/secrets.ts` (`unlock --for`).
+
+- **`agents sessions export <id>` now resolves a short id the same way `sessions
+  <id>` does — by id only, never fuzzy content.** The id-only fix landed for the
+  `sessions` view but `sessions export` still gated its index lookup on
+  `isCompleteSessionId`, so a bare hex short-id like `d3470b57` absent from the
+  discovered pool skipped the index and fell through to the text query — bundling
+  every transcript that merely MENTIONED the id into the export. The one canonical
+  id-shaped test, `looksLikeSessionId`, now lives beside `isCompleteSessionId` in
+  `lib/session/discover.ts` and is shared: `sessions export` resolves any id-shaped
+  selector through the index (exact -> prefix -> `findSessionsById`) and reports
+  "No session with id …" on a miss instead of shipping the mentioner. Source:
+  `apps/cli/src/lib/session/discover.ts`, `apps/cli/src/commands/sessions-export.ts`.
+
+- **Resolve a Claude transcript across every version home, not just the live `~/.claude`.** A session launched under an earlier agent version keeps its transcript under that version's home; resolving only the `~/.claude` symlink (which repoints to the newest installed version) meant that installing a new version silently hid every still-running older-version session — no `sessionFile`, so `agents sessions` rendered it `unknown` and the watchdog skipped it as "no activity timestamp". `findClaudeSessionFile` now searches all version-home project roots via `getAgentSessionDirs`, newest mtime winning. Source: `apps/cli/src/lib/session/active.ts`.
+
 ## 1.20.77
 
 - **Interactive `agents run --host` now tracks the real session for every agent,