@phnx-labs/agents-cli 1.20.78 → 1.20.82

package/CHANGELOG.md

@@ -1,5 +1,492 @@
 # Changelog
 
+## 1.20.82
+
+- **Codex hook sync no longer leaves startup warnings after upgrades.** The Codex
+  hook registrar now prunes hook commands from sibling Codex version homes before
+  writing `hooks.json`, so removed versions such as `0.142.0` cannot leave dead
+  PreToolUse/Stop handlers that exit `127`. It also writes `SessionEnd` hook
+  timeouts at Codex's 3-second limit instead of emitting `timeout: 5` and making
+  Codex warn that it is clamping the value on every startup. Source:
+  `apps/cli/src/lib/hooks.ts`.
+
+- **`agents secrets export`/`list`/`view` now accept `--device`/`--devices` as
+  aliases for `--host`/`--hosts`, and a keychain-backed `export --host` push is
+  verified.** `--device mac-mini` used to fail with "unknown option" on the secrets
+  commands even though the rest of the fleet vocabulary (`agents activity`,
+  `agents run --device`) accepts it; it now resolves identically to `--host`. And a
+  default keychain-backend push to a macOS host over headless SSH — the sign host a
+  Linux-driven release offloads `apple.com` provisioning to — used to land the bundle
+  metadata but no readable secret items (the remote login keychain is locked over
+  SSH), then fail every later read with the confusing `Bundle 'X' key 'Y': stored
+  item '...' not found`. The push now reads the bundle back the way a headless release
+  will and **fails loudly** when the keys didn't persist, naming the locked-login-keychain
+  cause and steering to `--remote-backend file` (headless-readable) or unlocking the
+  remote keychain. This unblocks headless Linux-driven releases. Source:
+  `apps/cli/src/commands/secrets.ts`, `apps/cli/src/lib/secrets/remote.ts`.
+
+- **`agents sessions resume` shows session previews immediately and opens one tab
+  per session by default (RUSH-2023).** The multi-select picker now starts its
+  preview pane open whenever the caller supplies preview content; `tab` still
+  toggles it. Batch resume now uses full-width tabs across terminal backends,
+  with side-by-side two-per-tab packing available explicitly via `--splits`.
+  Source: `apps/cli/src/lib/picker.ts`,
+  `apps/cli/src/commands/sessions-resume.ts`.
+
+- **`agents sessions --active` now distinguishes dead and abandoned sessions
+  (RUSH-2066).** The active-session engine computes lifecycle from PID liveness and
+  transcript mtime: a dead process reports `closed`, a transcript stale for
+  `ABANDONED_STALE_MS` reports `abandoned`, and a live opaque harness still reports
+  `running` as its honest floor. The default list, grouped active tallies, and
+  `agents hq floor` render `closed` / `abandoned` distinctly, and Factory maps
+  `closed` to done and `abandoned` to failed so dead work no longer appears idle.
+  Source:
+  `apps/cli/src/lib/session/active.ts`, `apps/cli/src/commands/sessions.ts`,
+  `apps/factory/src/core/remoteSessions.ts`.
+
+- **`agents view` now surfaces the Cursor account and its usage.** Cursor was
+  absent from the account view; it now shows the signed-in account (email/authId
+  from `~/.cursor/cli-config.json`, token from `~/.config/cursor/auth.json`) and,
+  for request-capped (free/legacy) plans, a monthly request bar (`M`) from
+  `cursor.com/api/usage`. Usage-based plans have no request cap, so they render the
+  account row without a bar. Source: `apps/cli/src/lib/usage.ts`,
+  `apps/cli/src/lib/agents.ts`.
+
+- **The routines daemon now anchors its working directory to `$HOME` on startup,
+  so a deleted launch directory no longer crashes every scheduled routine.** The
+  daemon is long-lived and inherited whatever cwd it was launched from — commonly a
+  git worktree under `.agents/worktrees/`. When that directory was later removed
+  (`git worktree remove`, `rm -rf`), the daemon kept the deleted inode as its cwd
+  (a process cannot chdir out of a deleted directory on its own), and every job it
+  spawned inherited the dead cwd — `spawnJobAttempt` and command runs pass no
+  explicit `cwd`. Bun then failed `getcwd()` at startup and *every* routine died at
+  0 seconds with `ENOENT: Bun could not find a file` (or `The current working
+  directory was deleted`) before the agent ran — a fleet-wide routine outage from a
+  single removed worktree. `runDaemon` now re-anchors to the home directory once at
+  startup (`anchorDaemonCwd`), making the scheduler immune regardless of how it was
+  launched. Source: `apps/cli/src/lib/daemon.ts` (`anchorDaemonCwd`, `runDaemon`).
+
+- **`agents repo refresh` is deprecated in favor of `agents sync`.** The command is
+  now hidden from help and prints a deprecation notice on use, pointing at the
+  replacement: `agents sync --local` (reconcile all installed agents, no git) or
+  `agents sync <agent>` (one agent). It still runs for now so existing scripts and
+  muscle memory don't break — `refresh` was a partial variant of `sync` (it only
+  ever materialized the single global-default version, and silently no-op'd for an
+  agent with installed versions but no global default), whereas `sync` covers
+  every installed version. Internal callers (crabbox bootstrap, the `agents pull`
+  redirect, `agents setup` help) now use `agents sync --local`. The underlying
+  `refresh()` function stays — it is the reconcile stage behind `agents sync`.
+  Source: `apps/cli/src/commands/repo.ts`, `apps/cli/src/lib/crabbox/`.
+
+- **`agents view` now shows Grok usage limits.** Grok's network usage endpoints
+  404, so usage is parsed from the local `~/.grok/logs/unified.jsonl` log instead —
+  the latest billing-period config and subscription tier render as a `W` window,
+  matching the other agents' live-usage display. Source: `apps/cli/src/lib/usage.ts`.
+
+- **`agents run --host` now starts in the same project you launched it from, not the remote `$HOME`.** A host run with neither `--cwd` nor `--remote-cwd` sent no `cd` at all, so the remote agent opened in the home directory with no project context — every launch from a repo (including every Factory "Pick Host" tab) began with a manual `cd`. The dispatch now derives a working directory from the local cwd when the caller named none: a cwd under the local home is re-rooted onto the *remote* home (`~/src/x` → the host's `$HOME/src/x`), which is the normal fleet layout where the same checkout sits at the same home-relative path on every box. Because a derived directory is a best-effort mirror rather than something the user asked for, a host that lacks that checkout falls back to its home instead of failing the run; an explicit `--cwd`/`--remote-cwd` is never mirrored, so a directory you named that does not exist still fails loudly. A cwd outside the local home is not mirrored — a path like `/opt/thing` says nothing about the target's filesystem. Source: `apps/cli/src/lib/hosts/dispatch.ts` (`deriveMirroredCwd`, `remoteCdPrefix`), `apps/cli/src/commands/exec.ts`.
+
+- **The Cmd+Shift+O quick-dispatch bar is now Plan / Run, and never runs an agent
+  in your home directory.** The two spotlight modes were renamed from File
+  Ticket / Fix to **Plan** (investigate → file a Linear ticket) and **Run**
+  (headless `agents run`). A new repo dropdown is populated from your recent
+  session working directories with `$HOME` dropped, and the pick is passed as
+  `--cwd` to both modes, so an agent is always scoped to a real repo instead of
+  the too-broad home dir; the last-picked repo is remembered. Run now always uses
+  `--strategy balanced` (auto load-balance across signed-in versions with
+  headroom, skipping rate-limited), and `--name` is seeded from a slug of your
+  task text instead of an opaque `quick-<timestamp>`. Source:
+  `apps/cli/menubar/Sources/MenubarHelper/PromptPanel.swift`,
+  `apps/cli/menubar/Sources/MenubarHelper/AgentsCLI.swift`.
+
+- **The keychain Touch ID prompt now names the session that triggered the read
+  (RUSH-1971).** When a bundle read pops Touch ID, the operation prompt already
+  named the requesting agent, bundle, and reason; it now also carries the
+  triggering session's 8-char short-id — e.g. *"Claude is requesting to unlock the
+  'prod' bundle (session e0a1b2c3) for 7 days …"* — so an unexpected prompt is
+  attributable when an interactive agent, headless workers, and `secrets exec`
+  deploys all run at once. The short-id is derived from the `AGENT_SESSION_ID` the
+  exec env already exports; no keychain-helper re-sign is required (the enriched
+  string flows through the existing `AGENTS_KEYCHAIN_PROMPT` env). Source:
+  `apps/cli/src/lib/secrets/index.ts`, `apps/cli/src/lib/secrets/bundles.ts`.
+
+- **`agents teams list` renders from cached team metadata instead of full status
+  probes (RUSH-1996).** The list and picker rows now read the team registry plus
+  teammate `meta.json` snapshots, so listing teams no longer blocks on remote log
+  pulls or unreachable hosts. Full teammate status is still loaded when a user picks
+  a team or runs `agents teams status <team>`. Source:
+  `apps/cli/src/commands/teams.ts`, `apps/cli/src/commands/teams.test.ts`,
+  `apps/cli/docs/teams.md`.
+
+- **`agents setup secrets` now guides first-run secrets onboarding (RUSH-1999).**
+  The setup command registers a new `secrets` capability wizard that chooses a
+  default storage backend (`keychain`, encrypted `file`, or synced `vault`), sets
+  the existing default prompt policy (`daily`/`always`, with `never` gated for
+  explicit automation use), persists `secrets.backend` so future `agents
+  secrets create/import` commands use the selected backend when no backend flag is
+  passed, optionally delegates imports to `agents secrets import`, and writes
+  setup preferences under `~/.agents/.history/setup`. Source:
+  `apps/cli/src/commands/setup-secrets.ts`, `apps/cli/src/commands/secrets.ts`,
+  `apps/cli/src/commands/setup.ts`.
+
+- **`agents setup fleet` now guides Tailscale device onboarding (RUSH-2000).**
+  The setup command registers a new `fleet` capability wizard that verifies
+  Tailscale, syncs discovered devices through the existing `agents devices sync`
+  path, applies SSH auth with `agents devices set`, optionally writes the
+  managed SSH config include, tests connectivity with `agents ssh <device>
+  uname`, and can run `agents fleet update` after registration. Source:
+  `apps/cli/src/commands/setup-fleet.ts`, `apps/cli/src/commands/setup.ts`.
+
+- **`agents feed post` carries artifacts and a project chip, and progress posts
+  render rich (RUSH-2013 / RUSH-2014).** `feed post` gains `--attach <path-or-url…>`
+  (repeatable): a local file is copied under
+  `~/.agents/.history/attachments/<session>/<update>/` so the link survives a
+  worktree delete, and a URL is kept as a link — each classified to an
+  image/audio/video/file/link kind by extension. Every post is now stamped with its
+  project (basename of cwd, worktree-aware) on the activity event itself, so the
+  chip shows without a live-session join. A `status.posted` event renders as a
+  multi-line update — `agent · session · host · project` chips, the message, an
+  attachment row with per-kind glyphs, and a `↳ ag focus/sessions` hint — wherever
+  it appears (`feed post` echo, the feed activity lane, `agents feed --filter
+  updates`, and `agents activity`).
+- **`agents feed --filter needs|updates|all` (RUSH-2015).** `needs` (default) is the
+  open-blocks inbox as before; `updates` shows only deliberate progress posts over
+  the local activity timeline (no block pipeline, no remote fan-out); `all` renders
+  the blocks then appends the updates view. `--json` under `--filter updates` emits
+  the raw `status.posted` events. Source:
+  `apps/cli/src/lib/activity.ts`, `apps/cli/src/lib/feed-post.ts`,
+  `apps/cli/src/commands/feed.ts`, `apps/cli/src/commands/activity.ts`.
+
+- **Fix: actor attribution now actually reaches `agents sessions` and `--active`
+  for real runs (RUSH-2018/2019).** Two bugs, found by driving a real `agents run`
+  end-to-end: (1) the session index's `actor`/`initiated_by` were kept out of the
+  upsert `ON CONFLICT` entirely, so any row indexed *before* its actor sidecar
+  landed (an older scanner, or a scan racing the spawn-time write) was locked to
+  `NULL` forever — now `COALESCE(existing, incoming)` backfills a null while still
+  never clobbering a stored owner; (2) the live `--active` **owner** read only the
+  per-pid registry entry, which the SessionStart hook rewrites without an actor, so
+  real runs showed no owner — `--active` now falls back to the durable per-session
+  actor sidecar. Verified with a real `agents run`: the actor reaches `sessions.db`
+  and the `--active` owner resolves. Source: `apps/cli/src/lib/session/db.ts`,
+  `apps/cli/src/lib/session/active.ts` (`resolveOwner`).
+
+- **Session lists expose the model and richer navigation metadata (RUSH-1981,
+  RUSH-1991, RUSH-1992, RUSH-1994).** Static flat rows add a compact model column
+  only when the result set has model data, with width sized to that set so an
+  80-column terminal does not wrap. Local CWD and ticket/PR cells are clickable
+  in supporting terminals, previews identify browser/computer use and sub-agent
+  counts, and `agents sessions --active --json` adds an always-present `prLink`
+  key. Existing session indexes migrate to schema v20 and rescan transcripts to
+  backfill model data.
+
+## 1.20.81
+
+- **Generic `--device all` / `--host all` fleet fan-out for every fleet-aware
+  command (RUSH-1969).** The passthrough now treats `all` as a sentinel value on
+  `--host`, `--device`, `--hosts`, and `--devices`. For any routable command
+  (`view`, `output`, `sync`, `doctor`, `list`, …) it runs `agents <cmd> --json`
+  on every registered device concurrently, then renders an OS-grouped roster
+  (`●` installed, `○` offline/skipped, `▸ … ← this machine`). Offline and
+  no-address devices render as rows instead of hanging the whole run. Add
+  `--json` to get a device-keyed object. Commands that already own `--all-hosts`
+  (`output`) keep their existing behavior. Source:
+  `apps/cli/src/lib/hosts/passthrough.ts`, `apps/cli/src/lib/hosts/option.ts`.
+
+- **`agents apply` no longer propagates single-use rotating refresh tokens
+  (RUSH-1958).** Droid (WorkOS) credentials use a refresh token that rotates
+  server-side on every exchange; copying one credential file across N boxes
+  caused the first refresh on any box to invalidate every other holder, collapsing
+  the fleet to a single working login. `agents apply` now excludes droid — and any
+  future harness added to the shared `SINGLE_USE_ROTATING_REFRESH_AGENTS` set in
+  `src/lib/fleet/auth-sync.ts` — from credential propagation. The plan surfaces
+  these as `manual login needed (single-use rotating refresh token)` with the
+  device name, routing the user to log in on the target box itself. Source:
+  `src/lib/fleet/auth-sync.ts`, `src/lib/fleet/apply.ts`,
+  `src/commands/apply.ts`.
+
+- **Non-Claude remote/tmux agent sessions now surface with their real id
+  (RUSH-2007).** `agents sessions --active` and the `agents sessions focus` picker
+  dropped every non-Claude tmux session (codex/gemini/kimi/grok/…) that lacked a
+  launch-minted id, so a live `agents run --device <host> <agent>` was invisible and
+  un-refocusable after an SSH drop. `listTmuxAgentSessions` now backfills the id from
+  the **deployed** SessionStart hook's own per-pid record at
+  `~/.agents/.cache/state/sessions/<pid>.json` — the CLI previously only read the
+  un-deployed session-tracker path (`terminals/sessions/`, empty on the fleet). A
+  targeted per-pid read (never a scan of that graveyard dir), freshness-guarded by
+  the launch's known start so a reused-pid record can't cross sessions. Source:
+  `apps/cli/src/lib/session/hook-sessions.ts`, `apps/cli/src/lib/session/active.ts`.
+
+- **Releases publish the CI-tested tree, not a drifted merge.** On a busy default
+  branch, unrelated PRs merging during a release PR's CI window made the
+  squash-merge tree diverge from what CI actually tested, so `release.sh` refused
+  to publish (`merged tree != built tree`) and the release stalled — every attempt
+  merged a version bump it could never tag. The publish now tags the exact release
+  commit the full matrix went green on (the PR head), letting the intervening
+  commits ride the next release; the merge commit is still tagged when its tree
+  matches (no drift). The `wait_for_ci_green` gate is unchanged, so the published
+  tarball is always a tree the full matrix validated. The tree-comparison decision
+  is extracted into `scripts/select-publish-commit.sh` and unit-tested against a
+  real git repo. Source: `apps/cli/scripts/release.sh`,
+  `apps/cli/scripts/select-publish-commit.sh`.
+
+- **Consolidate the observability + inspection commands into one role each; remove
+  `check` and `resources` (RUSH-1234).** Two overlapping command clusters had grown
+  ambiguous. `agents check` (the CI drift gate) is folded into `agents doctor --check`
+  — same drift engine, now with a scriptable exit code. `--check --quiet`,
+  `--check --json` (backward-compatible payload: every field the old `check --json`
+  emitted, plus additive `unwiredHookVersions`/`sourceBehind`), and `--check --devices`
+  all carry over; the standalone `check` command is removed. `agents resources` (the merged first-wins cross-layer
+  resource table) is folded into `agents view --merged`; the standalone `resources`
+  command is removed. The observability surfaces (`events`, `feed`, `activity`,
+  `output`, `sessions`) now have a documented one-role-each taxonomy — `events` is the
+  raw unified audit stream, `feed` the cross-agent decisions/status inbox, `activity`
+  the human milestone timeline, `output` productivity accounting, `sessions` the live
+  roster + transcripts. Running the removed `agents check` / `agents resources` now
+  reports `error: unknown command`. Source:
+  `apps/cli/src/commands/doctor.ts`, `apps/cli/src/commands/view.ts`,
+  `apps/cli/src/lib/merged-resources.ts`, `apps/cli/src/lib/startup/command-registry.ts`,
+  `apps/cli/docs/06-observability.md`.
+
+- **`agents sessions --active` shows who launched each run (RUSH-2018).** New
+  **owner** column on the active-sessions table (and an `owner` field in
+  `--active --json`), sourced from the resolved actor stamped at spawn into the
+  per-pid registry and onto each teammate record. Displays the actor's short id
+  (an email's local-part) and stays honest — an unresolved local run shows `-`,
+  never a guessed box owner. The session index (`sessions.db`) also gains
+  write-once `actor` / `initiated_by` columns, kept out of the upsert
+  `ON CONFLICT` set so a content rescan never clobbers the original owner.
+  Source: `apps/cli/src/lib/session/pid-registry.ts`,
+  `apps/cli/src/lib/session/active.ts`, `apps/cli/src/commands/sessions.ts`
+  (`ownerLabel`), `apps/cli/src/lib/session/db.ts`, `apps/cli/src/lib/exec.ts`.
+
+- **`agents sessions` attributes historical sessions to a person, and teams carry
+  spawn lineage (RUSH-2019).** Each run now writes a durable `sessionId -> actor`
+  sidecar at spawn (`~/.agents/.history/by-session/`, unlike the pruned pid
+  registry), and the session scanner joins it while indexing — so the write-once
+  `actor` / `initiated_by` columns added in RUSH-2018 populate automatically and the
+  durable `agents sessions` listing (not just `--active`) shows who launched each
+  session. Teammate spawns inherit the orchestrator's frozen actor and now record a
+  `parent_session_id` (the orchestrator's own `AGENTS_SESSION_ID`), so a team traces
+  back to the one human who started it and the spawn chain is walkable. Source:
+  `apps/cli/src/lib/session/actor-sidecar.ts`, `apps/cli/src/lib/exec.ts`,
+  `apps/cli/src/lib/session/db.ts`, `apps/cli/src/lib/teams/agents.ts`.
+
+- **Actor provenance reaches events, routines, and browser tasks (RUSH-2020).**
+  Completes the actor layer's coverage beyond sessions: every emitted **event** now
+  records `actor` + `kind` through the audit origin (so `agents events` stats carry
+  a `byActor` breakdown in `agents logs stats`); a **routine** stamps its creator's
+  actor id at creation and seeds it into each fired run's env (`AGENTS_ACTOR`), so an
+  unattended cron's session and events attribute to the person who scheduled it
+  instead of `UNRESOLVED@<host>` — its run records gain `actor` (creator) and
+  `triggeredBy` (who kicked off that run); a **browser task** records the `owner` who
+  launched it, on the live task and in history. Source:
+  `apps/cli/src/lib/events.ts`, `apps/cli/src/lib/runner.ts`,
+  `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/browser/{types,service}.ts`.
+
+- **`agents sessions` now shows an accurate working / waiting / idle status for
+  every harness, and shows it as text in the default list — not just a glyph.** Two
+  gaps are closed. (1) A live non-Claude/Codex agent (grok, droid, gemini, rush,
+  kimi, hermes, opencode, antigravity) used to fall through to a blanket `unknown`
+  because `findSessionFileForKind` / `computeLiveSignals` only resolved and parsed
+  Claude and Codex transcripts — a running Codex or grok session displayed
+  `unknown`. Every tracked harness whose transcript is locatable + parseable is now
+  wired into the same state engine: `findSessionFileForKind` resolves each kind's
+  transcript through the session index (`latestSessionFileForCwd`), and
+  `computeLiveSignals` parses it with that harness's own parser and runs it through
+  the same `inferSessionState`, so it gets a real `working` / `waiting_input` /
+  `idle` the principled way Claude/Codex do. For a genuinely opaque kind (cursor) or
+  an unreadable transcript, `resolveFallbackStatus` now reports `running` for any
+  live process — **a running agent never displays `unknown`** (that state is reserved
+  for the sole un-answerable case: a dead process whose transcript vanished
+  mid-read), and a live process is never downgraded to a fabricated `idle`. (2) The
+  default `agents sessions` list (flat, tree, and the project overview) showed only a
+  colored glyph for live rows; it now also prints the status **word** —
+  `working` / `waiting` / `idle` — next to the glyph, the same three states the
+  `--active` column shows, with `waiting` the unmistakable "needs you" case. The
+  single-session preview (`agents sessions <id> --preview`) leads with the same live
+  status line, flagging `← needs you` when the agent is waiting on a question,
+  permission, or plan review. Source: `apps/cli/src/lib/session/active.ts`
+  (`findSessionFileForKind`, `computeLiveSignals`, `resolveFallbackStatus`),
+  `apps/cli/src/commands/sessions.ts` (`liveStatusWord`, `flatSessionRow`,
+  `treeSessionRow`, `renderSessionPreview`).
+
+- **`agents sessions inject` now addresses VSCodium / Cursor / VS Code and iTerm sessions, not just tmux.** It resolves targets through the same canonical resolver the watchdog uses (`resolveInjectTargetForSession`), so the manual unblock path and the watchdog agree on which sessions are reachable — and a failed resolve now surfaces the precise reason (host/rail) instead of a misleading "not running under tmux". Source: `apps/cli/src/commands/sessions-inject.ts`.
+- **Watchdog brain focuses on driving idle agents to completion, with context-aware, tool-pointing nudges.** The decider prompt now reads the stalled agent's goal first, restates the conclusion it already reached, names the concrete next step (including a tool it forgot it has — `agents computer` / `agents browser` / `agents ssh <mac> "agents computer …"`), splits do-it-yourself from ask-the-human, and treats `idle` as its territory while leaving `waiting` prompts to the user's feed. Design + normative spec: `apps/cli/docs/watchdog.md`, `apps/cli/docs/specifications.md#watchdog`. Source: `apps/cli/src/lib/watchdog/watchdog.ts`.
+
+## 1.20.80
+
+- **`agents activity` goes fleet-wide, grouped, and session-enriched.** The activity
+  lane was a flat, local-only, newest-first list; it now shows progress-so-far across
+  the whole fleet — who did what, where, on which project, for which ticket. New flags:
+  `--devices-all` (alias `--hosts-all`) fans the same `activity --json` payload out to
+  every reachable device (feed-style, via `gatherRemoteAgentsJson`) and merges each
+  peer's stream host-tagged; `-H/--host` / `--device` scope to specific boxes; `--local`
+  forces local-only (still the default). `--group-by project|device|agent` buckets the
+  stream (e.g. per project, what each agent did and for which ticket) and `--filter
+  <text>` narrows by project/device/agent/event/ticket. Each item is enriched by JOINING
+  to live sessions — the resolved project (repo/worktree slug from cwd), the execution
+  host (`provenance.host`), and the Linear ticket (`ActiveSession.ticket`) — never by
+  re-parsing transcripts. Milestone tiering (`--milestones`) and the default collapse are
+  unchanged, and `--json` stays a mergeable per-host payload (now carrying the enriched
+  fields). Source: `apps/cli/src/commands/activity.ts`, `apps/cli/src/lib/activity.ts`
+  (`enrichActivityEvents`, `mergeActivityEvents`, `parseActivityPayload`, `groupActivity`,
+  `filterActivityEvents`, `projectFromCwd`).
+
+- **Add `agents set` — a short front door for per-version run defaults.** `agents set claude@2.1.220 --model opus-5` pins the default model (and/or `--mode`) that `agents run` uses for that agent version. It reads and writes the same store as `agents defaults run set` (`agents.yaml` -> `run.defaults`), so the two stay consistent. Bare `agents set` lists every default; `agents set <selector>` shows one. Source: `apps/cli/src/commands/set.ts`.
+
+- **`agents doctor` now reads as a triaged health report, not neutral status.**
+  The verdict was terse status text ("Verdict: 1 divergent, source ~/.agents 16
+  commits behind…") a user had to decode. It is now a severity-ranked health block
+  that leads with what is unhealthy, why it matters, and the exact fix — one row
+  per finding, tagged with a restrained terminal glyph (`✓` `✗` `⚠` and a subtle
+  info dot, colored via chalk to match the man-page voice):
+  ```
+  Claude@2.1.220
+    ✗ unhealthy — 3 issues (1 critical · 2 warnings)
+
+    ✗ critical  ask-user-question-guard — on disk but not wired into settings.json; the hook never fires
+                → agents sync claude@2.1.220 --yes
+    ⚠ warning   ~/.agents — 16 commits behind origin/main; you're running stale config
+                → agents repo pull user
+    ⚠ warning   11-activity-log — differs from source
+                → agents doctor claude@2.1.220 --fix
+
+    heal what's auto-fixable:  agents doctor claude@2.1.220 --fix
+  ```
+  A clean install collapses to one green line —
+  `✓ healthy — 34 resources reconciled · hooks wired · sources current`. Each
+  finding carries an agent-agnostic **severity**: **critical** (silent breakage —
+  an unwired hook, a missing/unparseable `settings.json`, a MISSING resource),
+  **warning** (stale/drift — a source layer behind origin, a DIVERGENT resource, a
+  stale/never-synced version), or **info** (an orphan/EXTRA resource →
+  `agents prune cleanup`). Both surfaces get the same treatment: the target report
+  `agents doctor <agent>@<version>` and the bare `agents doctor` overview, which
+  now opens with a `Health` banner aggregated across every installed version. The
+  existing per-resource detail rows are kept — the health block layers on top of
+  them as the verdict. `--json` gains a `verdict` field (target mode) and a
+  `health` field (overview), each carrying `severity`/`category`/`subject`/
+  `impact`/`fix` per issue; the existing `summary`/`kinds`/`hookWiring`/
+  `sourceBehind`/`sync`/`orphans` fields are unchanged. Source:
+  `apps/cli/src/commands/doctor.ts` (`computeVerdict`, `computeOverviewHealth`,
+  `healthBlockLines`, `renderHealthBlock`, `verdictIsAutoFixable`).
+
+- **The daemon's `MenubarHelper --notify` one-shots can no longer pile up in the
+  menu bar.** Each routine notification (start/finish/overdue/heal) spawned a
+  fresh, detached, unsupervised `MenubarHelper --notify` process; on a stalled
+  delivery — a locked screen or a WindowServer/XPC hiccup — the helper's runloop
+  spin never reached its deadline and the process hung indefinitely, so duplicate
+  "Agents" instances accumulated. The one-shot is now bounded by two independent
+  watchdogs: `runOneShot` arms a background-thread force-exit at 3s (off the main
+  queue, so a wedged main thread can't starve it — unlike the 0.6s runloop
+  deadline it backs up), and the Node spawner (`spawnDetachedQuiet`) SIGKILLs the
+  child at 4s if it never self-exits. A notifier that posts normally (the common
+  sub-second path) is untouched; only a genuinely hung one is killed. Source:
+  `apps/cli/menubar/Sources/MenubarHelper/PromptPanel.swift` (`Notifier.runOneShot`),
+  `apps/cli/src/lib/menubar/notify-desktop.ts` (`spawnDetachedQuiet`,
+  `NOTIFY_TIMEOUT_MS`).
+
+- **Removed the dead `commitOwnDeviceMeta` auto-commit from the pull path.** It
+  committed this machine's `devices/<host>/agents.yaml` pin snapshot to the user
+  repo's `main` on nearly every `pullRepo`, without pushing — so `main` diverged
+  N-ahead per machine and wedged `agents sync` across the fleet. Now that
+  per-device pins are gitignored (they are local runtime state — written by
+  `writeMetaUnlocked`, read on-disk by pinned-strategy resolution and the shim),
+  the function only ever no-ops, so it and its sole `pullRepo` call are deleted
+  along with their tests. `--strategy balanced` never read pins; the only behavior
+  removed is the never-reached auto-commit. Source: `apps/cli/src/lib/git.ts`
+  (`pullRepo`), `apps/cli/src/lib/git.test.ts`.
+
+- **Remove Forge and hard-deprecate Gemini (RUSH-2060).** ForgeCode is no longer
+  an `AgentId`, install target, resource-sync target, subagent target, MCP target,
+  or permissions target. Gemini remains a legacy id so existing sessions/config can
+  still be read, but it is no longer a managed harness: `agents add gemini`,
+  `agents import gemini`, and `agents sync gemini` now fail and point users to
+  Antigravity. Gemini is also excluded from capability-driven resource writers,
+  staleness detectors, import choices, teams choices, model choices, fleet auth
+  sync, and plugin/MCP/permissions/subagent sync. Source:
+  `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/types.ts`,
+  `apps/cli/src/lib/capabilities.ts`, `apps/cli/src/commands/{versions,import,sync}.ts`,
+  and the resource writers under `apps/cli/src/lib/`.
+  (RUSH-2060)
+
+- **Every agent secret access and unlock is now captured in the raw event stream and the audit log.** After the recent relaxation that lets agents read and unlock bundles more freely, `agents events --module secrets` now surfaces two typed, value-free events for the complete access picture. `secrets.get` records every path that resolves a secret VALUE out of a bundle (`run --secrets`, `secrets exec`/`export`, `view --reveal`, raw `get <item>`, `sync push`, remote `bundle@host`), and a new `secrets.unlocked` records the deliberate `agents secrets unlock` grant into the broker/durable session — the longer-lived grant a per-read event does not capture, carrying its TTL and the harness scope it was granted to (`*` = global). Every record is tagged with the resolving `agent` scope and lands at audit level in the append-only `~/.agents/events.jsonl` audit trail, but is non-milestone so it does not clutter `agents activity` / `agents feed`. The resolved value is never written — only bundle name, key NAMES, and counts. All value-read/unlock audits now funnel through one canonical `emitSecretAudit` helper (`apps/cli/src/lib/secrets/audit.ts`), wired into `lib/secrets/bundles.ts`, `commands/secrets.ts` (reveal / raw get / unlock), `lib/secrets/sync.ts`, and `lib/secrets/remote.ts`; the new event type is registered in `lib/events.ts`. Source: `apps/cli/src/lib/secrets/audit.ts`, `apps/cli/src/lib/events.ts`, `apps/cli/src/commands/secrets.ts`.
+
+## 1.20.79
+
+- **A daemon bounce no longer orphans the secrets broker.** Installing agents-cli ran `stopDaemon()`, which sent SIGTERM, scheduled its hard-kill escalation on a `setTimeout`, and cleared the daemon pid file immediately — without waiting for the process to actually exit. In a short-lived process like the npm postinstall the timer never fired at all, and the cleared pid file made `isDaemonRunning()` report false, so `startDaemon()` launched a second daemon alongside the live one. Its hosted broker then found the socket in use, missed one 700ms ping against the busy owner, unlinked the live socket and rebound — leaving the first broker running with every unlocked bundle in RAM that no client could reach. On a machine with two installs (nvm + homebrew) this reproduced on every upgrade: `lsof` showed two processes on one socket path at two different kernel socket addresses. `stopDaemon` now waits for the process to actually stop serving before clearing the pid file (and escalates to a tree-kill only if it does not), and `bindBrokerSocket` probes an in-use socket several times and refuses to reclaim it while a live process still owns the broker pid file, surfacing a clear error instead of silently starting a second broker. A zombie counts as exited — it holds no socket — so a daemon that is the caller's own child is not hard-killed after it has already gone.  The socket owner is recorded in a dedicated `agent.owner` file rather than the standalone service's `agent.pid` single-instance claim, so the signal is present for the daemon-hosted broker (the primary configuration) without making a losing standalone service exit into a launchd restart loop; `ensureAgentRunning`'s one-off fallback and `teardownStaleBroker` also wait for a broker to stop serving before unlinking its socket and ownership record, instead of destroying the evidence the check depends on. Source: `apps/cli/src/lib/platform/process.ts` (`waitForExit`, `hasExited`), `apps/cli/src/lib/daemon.ts` (`stopDaemon`), `apps/cli/src/lib/secrets/agent.ts` (`ownerPath`, `brokerPidAlive`, `releaseBrokerPid`, `bindBrokerSocket`, `ensureAgentRunning`, `teardownStaleBroker`).
+
+- **`agents doctor` now checks hook WIRING, not just hook files — and treats a
+  stale source layer as unhealthy.** Two blind spots let a version home read
+  "healthy" while its hooks were dead. (1) Doctor only compared hook FILES against
+  source, never that `settings.json` actually references each hook in the right
+  event array — so a hook whose script was byte-identical to source but never
+  wired into `PreToolUse`/`Stop`/… reported `ok` and silently never fired
+  (reproduced on `yosemite-s1`: `Claude@2.1.207` printed `hooks 32 items 32 ok`
+  while its `settings.json` PreToolUse array omitted `ask-user-question-guard.sh`).
+  Doctor now inspects the version's native `settings.json` (Claude-family: claude,
+  droid), verifying each hook per `(event, matcher)` group, and reports a
+  present-but-not-wired hook as `UNWIRED <hook> event=<event> matcher=<matcher>`,
+  counted against the verdict; a missing/unparseable `settings.json` is surfaced
+  too. `--fix` re-wires via the same `registerHooksToSettings` path `agents sync`
+  uses. (2) A source layer behind `origin/main` means the home is reconciled
+  against stale truth, yet the "N commits behind" fact was a buried preamble while
+  the verdict still said healthy — it now flips the per-version verdict to unhealthy
+  with the `agents repo pull` remediation. Both checks run in every mode, not just
+  `agents doctor <agent>@<version>`: bare `agents doctor` (overview) and the CI gate
+  `agents check` now flag a present-but-unwired hook and a behind-origin source
+  layer, and `agents check` exits non-zero on them. Source:
+  `apps/cli/src/lib/hooks.ts` (`checkVersionHookWiring`), `apps/cli/src/lib/drift.ts`
+  (`checkSyncStatus`/`computeSourceBehind`/`computeDrift`),
+  `apps/cli/src/lib/doctor-diff.ts`, `apps/cli/src/commands/doctor.ts`
+  (`computeVerdict`), `apps/cli/src/commands/check.ts`, `apps/cli/src/lib/git.ts`
+  (`commitsBehindUpstream`).
+
+- **`agents repo pull` reconciles a diverged repo instead of wedging on it.** It ran
+  `git merge --ff-only`, which refuses *any* divergence — conflict or not — so a
+  single local commit permanently blocked every later pull with nothing actually in
+  conflict. Since `pullRepo` itself auto-commits the machine's own
+  `devices/<host>/agents.yaml` before pulling, every device eventually created that
+  commit and stopped receiving updates: on one fleet, nine machines sat 9 commits
+  behind and merged rule changes never reached any of them. It now rebases, which is
+  what its own documentation has always described. Per-device paths are disjoint, so
+  they replay cleanly. A genuine conflict aborts the rebase and rolls the checkout
+  back untouched, so a failed pull can never leave the repo detached, mid-rebase, or
+  with conflict markers in live config; a rebase already in progress is reported as
+  itself rather than as a dirty tree.
+- **`agents repo pull` / `push` exit non-zero when a repo fails.** Both printed a
+  failure line and returned 0, so `agents fleet run "agents repo pull user"` reported
+  `11 ok` across a fleet that pulled nothing. Any automation gating on the exit code
+  read a total no-op as success. Matches `agents sync <repo>`, which already did this.
+
+- **`agents repo status` reports across the fleet.** New `--devices-all` (alias
+  `--hosts-all`) fans `repo status`/`repo list` out to every reachable device and
+  renders one aggregated table (device · repo · sync · changes); `--devices <who>`
+  (alias `--hosts`) takes `all` or a comma-separated device list. Unreachable peers
+  are skipped with a clear marker, never failing the command, and a single
+  `--device`/`--host` still streams that one box as before. Source:
+  `apps/cli/src/commands/repo.ts`.
+
+- **Routines now always authenticate as the machine they run on, never on an inherited Claude token.** The daemon was already forbidden from *injecting* a Claude OAuth token into a routine, but nothing stopped it *inheriting* one: `buildExecEnv` spreads the ambient `process.env`, and `sanitizeProcessEnv` only strips loader/interpreter variables, never credentials. So on any box whose daemon environment happened to carry `CLAUDE_CODE_OAUTH_TOKEN` — a provisioned fleet machine, a shell that exported it — every routine spawn silently ran on that one shared, rotating token instead of the host's own login. That is the fleet-wide-logout path the no-token design exists to prevent, reached by inheritance rather than injection: when the server rotates a refresh token, every other holder drops to "run /login". No CI runner has a token to inherit, so the existing test passed everywhere and the leak only appeared on a real machine (it surfaced on the release VM, halting a release). `buildRoutineSpawnEnv` now drops the variable, and the routine still authenticates exactly as before — `CLAUDE_CONFIG_DIR` is pinned to that box's per-account version home, so a routine uses whatever agent login is set up there and needs no token of its own. Source: `apps/cli/src/lib/runner.ts` (`buildRoutineSpawnEnv`).
+
+- **The `daily` secrets policy is now called `hold`, because it was never daily.** The default prompt policy holds a bundle for `secrets.agent.holdMs` — 7 days out of the box — yet it was named `daily`, so `agents secrets policy --help` read as "you will be asked once a day" while the code comment beside it said "one Touch ID per ~7d". Both the CLI help and `docs/secrets.md` had resorted to apologising for it in prose ("Name is historical", "Despite the name, it is not tied to one calendar day"), which is a name stating something false, not a name that is merely unclear. It is not one day, not one session, and not any fixed period — it is the configured hold window, so it is now named for that. **`daily` and the wire token `session` remain accepted everywhere** (`agents secrets policy <bundle> daily`, `secrets.policy: daily` in agents.yaml, and the `tier: session` key already written into every bundle on every synced machine), so no config or stored bundle changes behaviour on upgrade. **One machine-readable surface does change**: `agents secrets list --json` and `agents secrets view --json` now report `"policy": "hold"` where a default-tier bundle previously reported `"daily"`. Anything matching on that string needs updating — the CLI keeps accepting `daily` as input, but it no longer emits it, because a JSON field that reports a name the CLI itself has retired is a worse trap than a one-line change. The help text now also states what the tier actually depends on: the hold is a property of the running broker plus the durable session, not of the stored keychain item, so a broker that is down degrades `hold` to prompt-every-read; only `never` is prompt-free independently of the broker. Source: `apps/cli/src/lib/secrets/bundles.ts` (`SecretsPolicy`, `parsePolicy`, `secretsDefaultPolicy`), `apps/cli/src/commands/secrets.ts` (`parsePolicyOpt`, `policy` command help), `apps/cli/src/lib/secrets/index.ts` (legacy token mapping for the signed helper), `apps/cli/docs/secrets.md`.
+
+- **Claude usage/probe reads can authenticate with a file-based setup-token
+  instead of the login keychain — no Touch ID.** On macOS, reading a Claude
+  account's usage went through Claude Code's ACL-bound
+  `Claude Code-credentials-<hash>` keychain item (`loadClaudeOauth` →
+  `/usr/bin/security`), popping a Touch ID sheet on every cold read — per account,
+  roughly every 8h, and again on the routines daemon's 3-minute auth-health probe
+  (`probeLocalFleetAuth`), so `ag view` and the background warm both prompted.
+  `loadClaudeOauth` now first resolves a per-account `claude setup-token` from the
+  reserved **file-based** `auth` secrets bundle (keyed by account email as
+  `CLAUDE_CODE_OAUTH_TOKEN_<slug>`); when present, the usage endpoint is
+  authenticated with that long-lived, non-rotating token and the keychain is never
+  touched — killing the prompt. This applies only to the read-only usage/probe
+  callers (`accessTokenCache`); the full-credential run/export path (which needs the
+  refresh token) is unchanged, and an account with no provisioned setup-token still
+  falls through to the keychain for now. Keyed strictly per-account (never a bare
+  shared key) so one account's token can't be misapplied to another. Source:
+  `apps/cli/src/lib/usage.ts`; design: `docs/design/credential-management.md`.
+
 ## 1.20.78
 
 - **`agents sessions <uuid>` now resolves a remote session exactly, across the