@phnx-labs/agents-cli 1.20.78 → 1.20.83

package/dist/lib/project-resources.js

@@ -1,6 +1,6 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { AGENTS, agentConfigDirName } from './agents.js';
+import { AGENTS, agentConfigDirName, isAgentHardDeprecated } from './agents.js';
 import { supports } from './capabilities.js';
 import { buildCommandSkillContent, commandSkillName, readSkillSourceCommandMarker, shouldInstallCommandAsSkill } from './command-skills.js';
 import { commandAppliesTo, parseCommandMetadata } from './commands.js';
@@ -16,6 +16,9 @@ export function projectAgentRoot(projectRoot, agent) {
     return path.join(projectRoot, agentConfigDirName(agent));
 }
 export function syncProjectResourcesToAgent(agent, version, projectAgentsDir) {
+    if (isAgentHardDeprecated(agent)) {
+        return { synced: [], skipped: [] };
+    }
     const projectRoot = path.dirname(projectAgentsDir);
     const agentRoot = projectAgentRoot(projectRoot, agent);
     const manifest = loadProjectManifest(agentRoot);

package/dist/lib/refresh.d.ts

@@ -3,9 +3,11 @@
  * sync resources into installed version homes, register hooks, add shims to
  * PATH, prompt for missing default versions, install declared host-CLIs.
  *
- * Used by `agents repo refresh` (user-facing) and any other caller that needs
- * to re-derive local state from declared configuration. Does NOT do any git
- * operations — that lives in `agents repo pull`.
+ * The reconcile stage behind `agents sync` (the umbrella `--local` path calls
+ * this; see sync-umbrella.ts) and any other caller that needs to re-derive local
+ * state from declared configuration. Does NOT do any git operations — that lives
+ * in `agents repo pull`. (Also still reachable via the deprecated, hidden
+ * `agents repo refresh` alias.)
  */
 import type { AgentId } from './types.js';
 export interface RefreshOptions {

package/dist/lib/refresh.js

@@ -3,9 +3,11 @@
  * sync resources into installed version homes, register hooks, add shims to
  * PATH, prompt for missing default versions, install declared host-CLIs.
  *
- * Used by `agents repo refresh` (user-facing) and any other caller that needs
- * to re-derive local state from declared configuration. Does NOT do any git
- * operations — that lives in `agents repo pull`.
+ * The reconcile stage behind `agents sync` (the umbrella `--local` path calls
+ * this; see sync-umbrella.ts) and any other caller that needs to re-derive local
+ * state from declared configuration. Does NOT do any git operations — that lives
+ * in `agents repo pull`. (Also still reachable via the deprecated, hidden
+ * `agents repo refresh` alias.)
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -13,7 +15,7 @@ import chalk from 'chalk';
 import ora from 'ora';
 import { select, confirm } from '@inquirer/prompts';
 import { capableAgents } from './capabilities.js';
-import { AGENTS, ALL_AGENT_IDS, getAllCliStates, registerMcpToTargets, agentLabel, } from './agents.js';
+import { AGENTS, MANAGED_AGENT_IDS, getAllCliStates, registerMcpToTargets, agentLabel, } from './agents.js';
 import { readManifest, MANIFEST_FILENAME } from './manifest.js';
 import { getUserAgentsDir } from './state.js';
 import { installVersion, listInstalledVersions, isVersionIsolated, getGlobalDefault, setGlobalDefault, getVersionHomePath, syncResourcesToVersion, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, promptResourceSelection, resolveConfiguredAgentTargets, } from './versions.js';
@@ -114,7 +116,7 @@ export async function refresh(options = {}) {
     }
     // 3. Sync resources to default version homes
     const cliStates = await getAllCliStates();
-    const agentsToSync = agentFilter ? [agentFilter] : ALL_AGENT_IDS;
+    const agentsToSync = agentFilter ? [agentFilter] : MANAGED_AGENT_IDS;
     const available = getAvailableResources();
     for (const agentId of agentsToSync) {
         if (!cliStates[agentId]?.installed && listInstalledVersions(agentId).length === 0)

package/dist/lib/resources/commands.js

@@ -8,7 +8,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { getProjectAgentsDir, getUserAgentsDir, getSystemAgentsDir, getEnabledExtraRepos, } from '../state.js';
-import { AGENTS, agentConfigDirName } from '../agents.js';
+import { AGENTS, agentConfigDirName, isAgentHardDeprecated } from '../agents.js';
 import { markdownToToml } from '../convert.js';
 /**
  * Get the commands directory for a given layer root.
@@ -162,6 +162,9 @@ export class CommandsHandler {
      * Copies/transforms commands as needed for the agent's expected format.
      */
     sync(agent, versionHome, cwd) {
+        if (isAgentHardDeprecated(agent)) {
+            return;
+        }
         const agentConfig = AGENTS[agent];
         const targetFormat = this.format(agent);
         const targetDir = path.join(versionHome, agentConfigDirName(agent), this.targetDir(agent));

package/dist/lib/resources/mcp.js

@@ -115,8 +115,6 @@ export function getMcpConfigPath(agent, versionHome) {
             return path.join(versionHome, '.config', 'opencode', 'opencode.jsonc');
         case 'cursor':
             return path.join(versionHome, '.cursor', 'mcp.json');
-        case 'gemini':
-            return path.join(versionHome, '.gemini', 'settings.json');
         case 'openclaw':
             return path.join(versionHome, '.openclaw', 'openclaw.json');
         case 'antigravity':
@@ -126,8 +124,6 @@ export function getMcpConfigPath(agent, versionHome) {
             return path.join(versionHome, '.grok', 'mcp.json');
         case 'hermes':
             return path.join(versionHome, '.hermes', 'config.yaml');
-        case 'forge':
-            return path.join(versionHome, '.forge', '.mcp.json');
         default:
             return null;
     }

package/dist/lib/resources/permissions.d.ts

@@ -4,7 +4,7 @@
  * Permissions are stored as YAML files in permissions/ directories at each layer.
  * Resolution: project > user > system (higher layer wins on name conflict).
  * Unlike other resources, permissions merge into agent-specific config files
- * (Claude/Gemini: settings.json, Codex: config.toml, OpenCode: opencode.jsonc).
+ * (Claude: settings.json, Codex: config.toml, OpenCode: opencode.jsonc).
  */
 import type { ResourceHandler } from './types.js';
 import type { PermissionSet } from '../types.js';

package/dist/lib/resources/permissions.js

@@ -4,7 +4,7 @@
  * Permissions are stored as YAML files in permissions/ directories at each layer.
  * Resolution: project > user > system (higher layer wins on name conflict).
  * Unlike other resources, permissions merge into agent-specific config files
- * (Claude/Gemini: settings.json, Codex: config.toml, OpenCode: opencode.jsonc).
+ * (Claude: settings.json, Codex: config.toml, OpenCode: opencode.jsonc).
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -65,8 +65,6 @@ function getAgentConfigPath(agent, versionHome) {
             return path.join(versionHome, '.claude', 'settings.json');
         case 'codex':
             return path.join(versionHome, '.codex', 'config.toml');
-        case 'gemini':
-            return path.join(versionHome, '.gemini', 'settings.json');
         case 'opencode':
             return path.join(versionHome, '.config', 'opencode', 'opencode.jsonc');
         case 'kimi':
@@ -79,8 +77,6 @@ function getAgentConfigPath(agent, versionHome) {
             return path.join(versionHome, '.openclaw', 'openclaw.json');
         case 'copilot':
             return path.join(versionHome, '.copilot', 'permissions-config.json');
-        case 'forge':
-            return path.join(versionHome, '.forge', 'permissions.yaml');
         case 'hermes':
             return path.join(versionHome, '.hermes', 'config.yaml');
         case 'goose':

package/dist/lib/resources/rules.js

@@ -9,7 +9,7 @@
  * - All unique subrules across layers are unioned
  */
 import * as fs from 'fs';
-import { agentConfigDirName } from '../agents.js';
+import { agentConfigDirName, isAgentHardDeprecated } from '../agents.js';
 import * as path from 'path';
 import { getSystemRulesDir, getUserRulesDir, getProjectAgentsDir, getEnabledExtraRepos, } from '../state.js';
 const SUBRULES_DIR = 'subrules';
@@ -158,6 +158,9 @@ export const RulesHandler = {
         return resolveRule(name, getLayerDirs(cwd));
     },
     sync(agent, versionHome, _cwd) {
+        if (isAgentHardDeprecated(agent)) {
+            return;
+        }
         // Rules sync is handled by the compose module and syncResourcesToVersion.
         // This method ensures the agent config directory exists.
         // The actual composition and write happens in versions.ts via composeRulesFromState().

package/dist/lib/resources/skills.js

@@ -5,7 +5,7 @@
  * Format is the same for all agents. Resolution order: project > user > system.
  */
 import * as fs from 'fs';
-import { AGENTS, agentConfigDirName } from '../agents.js';
+import { AGENTS, agentConfigDirName, isAgentHardDeprecated } from '../agents.js';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { getSystemSkillsDir, getUserSkillsDir, getProjectAgentsDir, getEnabledExtraRepos, } from '../state.js';
@@ -201,6 +201,9 @@ export function createSkillsHandler(provider = defaultProvider) {
             return null;
         },
         sync(agent, versionHome, cwd) {
+            if (isAgentHardDeprecated(agent)) {
+                return;
+            }
             // Agents that read directly from central ~/.agents/skills/ (e.g. Gemini,
             // Goose via the Summon extension) should not get a per-version copy.
             if (AGENTS[agent]?.nativeAgentsSkillsDir) {

package/dist/lib/resources/subagents.js

@@ -8,6 +8,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { getProjectAgentsDir, getUserSubagentsDir, getSystemSubagentsDir, getEnabledExtraRepos, } from '../state.js';
+import { isAgentHardDeprecated } from '../agents.js';
 /** Get layer directories for subagent resolution. */
 function getLayerDirs(cwd) {
     const projectDir = getProjectAgentsDir(cwd);
@@ -155,6 +156,9 @@ export class SubagentsHandler {
      * Copies YAML files to the target directory.
      */
     sync(agent, versionHome, cwd) {
+        if (isAgentHardDeprecated(agent)) {
+            return;
+        }
         const targetDir = path.join(versionHome, this.targetDir(agent));
         // Ensure target directory exists
         if (!fs.existsSync(targetDir)) {

package/dist/lib/resources/types.d.ts

@@ -5,7 +5,7 @@
  * - Union: All resources from all layers are combined
  * - Override on name conflict: Higher layer wins (project > user > system)
  */
-export type AgentId = 'claude' | 'codex' | 'gemini' | 'cursor' | 'opencode' | 'openclaw' | 'copilot' | 'kiro' | 'goose' | 'antigravity' | 'grok' | 'kimi' | 'droid' | 'hermes' | 'forge';
+export type AgentId = 'claude' | 'codex' | 'gemini' | 'cursor' | 'opencode' | 'openclaw' | 'copilot' | 'kiro' | 'goose' | 'antigravity' | 'grok' | 'kimi' | 'droid' | 'hermes';
 export type Layer = 'system' | 'user' | 'project';
 export type ResourceKind = 'command' | 'hook' | 'skill' | 'rule' | 'mcp' | 'permission' | 'subagent' | 'workflow' | 'memory';
 /** A resolved resource with its origin layer. */

package/dist/lib/routines.d.ts

@@ -187,6 +187,14 @@ export interface JobConfig {
     resume?: string;
     /** When set, executeJob runs this job through the loop driver instead of once. */
     loop?: LoopConfig;
+    /**
+     * Actor id of whoever CREATED this routine (`resolveActor().id`, stamped by
+     * `writeJob` at creation and preserved across edits). Propagated into each
+     * fired run's env and RunMeta so an unattended cron traces back to the person
+     * who scheduled it, not the `UNRESOLVED@<host>` a live resolve would give.
+     * RUSH-2020.
+     */
+    actor?: string;
 }
 /** Metadata for a single job execution, persisted as JSON in the run directory. */
 export interface RunMeta {
@@ -216,6 +224,18 @@ export interface RunMeta {
     cloudTaskId?: string;
     /** Cloud provider id when the run was cloud-dispatched. */
     cloudProvider?: string;
+    /**
+     * Actor id of the routine's CREATOR (stamped at creation, carried from the job
+     * config). Answers "whose scheduled run is this" for an unattended cron fire,
+     * where resolving the actor live would only yield `UNRESOLVED@<host>`. RUSH-2020.
+     */
+    actor?: string;
+    /**
+     * Actor id that TRIGGERED this particular run (`resolveActor().id` at fire
+     * time): a person for a manual `agents routines run`, `UNRESOLVED@<host>` for
+     * an unattended scheduled fire. Distinct from {@link actor} (the creator).
+     */
+    triggeredBy?: string;
 }
 /**
  * Finalize a run record with a terminal status, computing `duration` from
@@ -327,6 +347,19 @@ export declare function validateJob(config: Partial<JobConfig>): string[];
 export declare function validateTrigger(trigger: unknown): string[];
 /** True when a job's endAt has already elapsed. False when endAt is unset or in the future. */
 export declare function isPastEndAt(config: Pick<JobConfig, 'endAt'>, now?: Date): boolean;
+export interface OneShotScheduleParts {
+    minute: number;
+    hour: number;
+    day: number;
+    month: number;
+}
+export declare function parseOneShotLikeSchedule(schedule: string | undefined | null): OneShotScheduleParts | null;
+export declare function isOneShotLikeSchedule(schedule: string | undefined | null): boolean;
+export declare function isOneShotRoutine(config: Pick<JobConfig, 'schedule' | 'runOnce'>): boolean;
+export declare function oneShotScheduleFireDate(schedule: string | undefined | null, now?: Date, timezone?: string): Date | null;
+export declare function isPastOneShotRoutine(config: Pick<JobConfig, 'schedule' | 'runOnce' | 'timezone'>, now?: Date): boolean;
+export declare function hasCompletedOneShotRun(config: Pick<JobConfig, 'name' | 'schedule' | 'runOnce' | 'timezone'>, now?: Date): boolean;
+export declare function shouldPurgeCompletedOneShotRoutine(config: Pick<JobConfig, 'name' | 'schedule' | 'runOnce' | 'timezone'>, now?: Date): boolean;
 /** Expand built-in and user-defined template variables in a job's prompt string. */
 export declare function resolveJobPrompt(config: JobConfig): string;
 /** Parse a human-readable timeout string (e.g. "10m", "2h", "1h30m", "3d", "1w") into milliseconds.

package/dist/lib/routines.js

@@ -15,6 +15,7 @@ import { safeJoin, isSafeSegmentName } from './paths.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { ALL_AGENT_IDS } from './agents.js';
 import { machineId, normalizeHost } from './machine-id.js';
+import { resolveActor } from './actor.js';
 export const HOST_STRATEGIES = ['local', 'host', 'fleet', 'cloud'];
 /** Canonical set of accepted GitHub trigger events — single source for validation. */
 export const GITHUB_TRIGGER_EVENTS = [
@@ -268,6 +269,11 @@ function readJobFile(filePath) {
  */
 export function writeJob(config) {
     ensureAgentsDir();
+    // Stamp the creator once (RUSH-2020). An edit re-writes a config loaded from
+    // disk, which already carries `actor`, so this preserves the original creator;
+    // only a brand-new routine (no actor yet) gets the current resolver.
+    if (!config.actor)
+        config.actor = resolveActor().id;
     const jobsDir = getRoutinesDir();
     const ymlPath = safeJoin(jobsDir, config.name + '.yml');
     const yamlPath = safeJoin(jobsDir, config.name + '.yaml');
@@ -580,6 +586,122 @@ export function isPastEndAt(config, now = new Date()) {
         return false;
     return now.getTime() >= end;
 }
+export function parseOneShotLikeSchedule(schedule) {
+    if (!schedule)
+        return null;
+    const parts = schedule.trim().split(/\s+/);
+    if (parts.length !== 5)
+        return null;
+    const [minuteRaw, hourRaw, dayRaw, monthRaw, weekdayRaw] = parts;
+    if (weekdayRaw !== '*')
+        return null;
+    if (![minuteRaw, hourRaw, dayRaw, monthRaw].every((p) => /^\d+$/.test(p)))
+        return null;
+    const minute = parseInt(minuteRaw, 10);
+    const hour = parseInt(hourRaw, 10);
+    const day = parseInt(dayRaw, 10);
+    const month = parseInt(monthRaw, 10);
+    if (minute < 0 || minute > 59)
+        return null;
+    if (hour < 0 || hour > 23)
+        return null;
+    if (month < 1 || month > 12)
+        return null;
+    if (day < 1 || day > 31)
+        return null;
+    return { minute, hour, day, month };
+}
+export function isOneShotLikeSchedule(schedule) {
+    return parseOneShotLikeSchedule(schedule) !== null;
+}
+export function isOneShotRoutine(config) {
+    return Boolean(config.runOnce || isOneShotLikeSchedule(config.schedule));
+}
+function zonedParts(date, timezone) {
+    const parts = new Intl.DateTimeFormat('en-US', {
+        timeZone: timezone,
+        year: 'numeric',
+        month: 'numeric',
+        day: 'numeric',
+        hour: 'numeric',
+        minute: 'numeric',
+        hour12: false,
+        hourCycle: 'h23',
+    }).formatToParts(date);
+    const get = (type) => parseInt(parts.find((p) => p.type === type)?.value ?? '0', 10);
+    return {
+        year: get('year'),
+        month: get('month'),
+        day: get('day'),
+        hour: get('hour'),
+        minute: get('minute'),
+    };
+}
+function zonedDateToUtc(year, parts, timezone) {
+    const targetUtc = Date.UTC(year, parts.month - 1, parts.day, parts.hour, parts.minute, 0, 0);
+    let candidate = new Date(targetUtc);
+    for (let i = 0; i < 4; i++) {
+        const actual = zonedParts(candidate, timezone);
+        const actualUtc = Date.UTC(actual.year, actual.month - 1, actual.day, actual.hour, actual.minute, 0, 0);
+        const delta = actualUtc - targetUtc;
+        if (delta === 0)
+            break;
+        candidate = new Date(candidate.getTime() - delta);
+    }
+    const verify = zonedParts(candidate, timezone);
+    if (verify.year !== year ||
+        verify.month !== parts.month ||
+        verify.day !== parts.day ||
+        verify.hour !== parts.hour ||
+        verify.minute !== parts.minute) {
+        return null;
+    }
+    return candidate;
+}
+export function oneShotScheduleFireDate(schedule, now = new Date(), timezone) {
+    const parts = parseOneShotLikeSchedule(schedule);
+    if (!parts)
+        return null;
+    if (timezone) {
+        try {
+            const year = zonedParts(now, timezone).year;
+            return zonedDateToUtc(year, parts, timezone);
+        }
+        catch {
+            return null;
+        }
+    }
+    const fireAt = new Date(now.getFullYear(), parts.month - 1, parts.day, parts.hour, parts.minute, 0, 0);
+    if (fireAt.getFullYear() !== now.getFullYear() ||
+        fireAt.getMonth() !== parts.month - 1 ||
+        fireAt.getDate() !== parts.day ||
+        fireAt.getHours() !== parts.hour ||
+        fireAt.getMinutes() !== parts.minute) {
+        return null;
+    }
+    return fireAt;
+}
+export function isPastOneShotRoutine(config, now = new Date()) {
+    if (!isOneShotRoutine(config))
+        return false;
+    const fireAt = oneShotScheduleFireDate(config.schedule, now, config.timezone);
+    return Boolean(fireAt && now.getTime() >= fireAt.getTime());
+}
+export function hasCompletedOneShotRun(config, now = new Date()) {
+    if (!isPastOneShotRoutine(config, now))
+        return false;
+    const fireAt = oneShotScheduleFireDate(config.schedule, now, config.timezone);
+    if (!fireAt)
+        return false;
+    const latest = getLatestRun(config.name);
+    if (!latest || latest.status === 'running')
+        return false;
+    const startedAt = Date.parse(latest.startedAt);
+    return Number.isFinite(startedAt) && startedAt >= fireAt.getTime() - 60_000;
+}
+export function shouldPurgeCompletedOneShotRoutine(config, now = new Date()) {
+    return hasCompletedOneShotRun(config, now);
+}
 /** Expand built-in and user-defined template variables in a job's prompt string. */
 export function resolveJobPrompt(config) {
     const now = new Date();

package/dist/lib/run-defaults.d.ts

@@ -36,6 +36,7 @@ export declare function parseRunDefaultSelector(input: string): ParsedRunDefault
 export declare function resolveRunDefaultsFromConfig(runConfig: RunConfig | undefined, agent: AgentId, version?: string | null): ResolvedRunDefaults;
 export declare function resolveRunDefaultsFromConfigs(runConfigs: Array<RunConfig | undefined>, agent: AgentId, version?: string | null): ResolvedRunDefaults;
 export declare function resolveRunDefaults(agent: AgentId, version?: string | null, startPath?: string): ResolvedRunDefaults;
+export declare function formatRunDefaultEntry(entry: RunDefaultEntry): string;
 export declare function listRunDefaults(): RunDefaultEntry[];
 export declare function setRunDefault(selectorInput: string, defaultsInput: RunDefaultsInput): RunDefaultEntry;
 export declare function unsetRunDefault(selectorInput: string): boolean;

package/dist/lib/run-defaults.js

@@ -15,6 +15,7 @@ import { ALL_MODES } from './types.js';
 import { AGENTS } from './agents.js';
 import { readMeta, updateMeta } from './state.js';
 import { getProjectRunConfigs } from './run-config.js';
+import chalk from 'chalk';
 const VERSION_RE = /^(?:\*|latest|(?!.*\.\.)[A-Za-z0-9._+-]{1,64})$/;
 function isAgentId(value) {
     return value in AGENTS;
@@ -128,6 +129,14 @@ export function resolveRunDefaults(agent, version, startPath = process.cwd()) {
     const projectRunConfigs = getProjectRunConfigs(startPath).reverse();
     return resolveRunDefaultsFromConfigs([readMeta().run, ...projectRunConfigs], agent, version);
 }
+export function formatRunDefaultEntry(entry) {
+    const parts = [];
+    if (entry.defaults.mode)
+        parts.push(`mode ${chalk.white(entry.defaults.mode)}`);
+    if (entry.defaults.model)
+        parts.push(`model ${chalk.white(entry.defaults.model)}`);
+    return `${chalk.cyan(entry.selector.padEnd(22))} ${parts.join('  ')}`;
+}
 export function listRunDefaults() {
     const defaults = readMeta().run?.defaults ?? {};
     return Object.entries(defaults)

package/dist/lib/runner.d.ts

@@ -64,18 +64,6 @@ export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow
  * with `agents run`.
  */
 export declare function buildRoutineSpawnEnv(baseEnv: Record<string, string>, agent: AgentId, version: string | undefined, timezone?: string): Record<string, string>;
-/**
- * Execute a job synchronously (waits for completion or timeout before resolving).
- *
- * When `config.loop` is set the job is routed through the loop driver (`runLoop`
- * from loop.ts) instead of a single spawn — same driver as `agents run --loop` and
- * workflow `loop:` blocks (issue #400). The optional `deps` parameter provides
- * injectable seams (runIteration, sleep, writeCheckpoint) used by tests; production
- * callers omit it and get the defaults.
- *
- * Single-shot path: pre-flight version/account selection + mid-run rate-limit
- * failover across healthy same-agent accounts (RUSH-1016).
- */
 export declare function executeJob(config: JobConfig, deps?: LoopDeps): Promise<RunResult>;
 /**
  * Optional lifecycle callbacks for a detached routine run. The daemon passes an

package/dist/lib/runner.js

@@ -23,6 +23,7 @@ import { prepareJobHome, buildSpawnEnv, getJobHomePath } from './sandbox.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { createTimer, maybeRotate, redactPrompt } from './events.js';
 import { normalizeMode, resolveHeadlessMode, buildExecEnv, detectRateLimit, detectAuthFailure, isAuthFailureFromLog, authFailureReason, } from './exec.js';
+import { resolveActor } from './actor.js';
 import { loadTask as loadHostTask } from './hosts/tasks.js';
 import { reconcileTask as reconcileHostTask } from './hosts/reconcile.js';
 import { backgroundSpawnOptions } from './platform/process.js';
@@ -398,12 +399,22 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone) {
         if (v !== undefined)
             out[k] = v;
     }
-    // No Claude token is injected here. A routine authenticates through the pinned
-    // account's own CLAUDE_CONFIG_DIR login (buildExecEnv points it at the
-    // per-account version home), identical to interactive `agents run`. Claude
-    // Code's interactive session refreshes itself per-device; keeping the daemon
-    // out of the credential entirely is what avoids the fleet-wide rotation logout
-    // — a shared/rotating token was the cause, not the fix.
+    // A routine authenticates through the pinned account's own CLAUDE_CONFIG_DIR
+    // login on THIS box (buildExecEnv points it at the per-account version home).
+    // Claude Code's interactive session refreshes itself per-device; keeping the
+    // daemon out of the credential entirely is what avoids the fleet-wide rotation
+    // logout — a shared/rotating token was the cause, not the fix.
+    //
+    // Injecting a token was already ruled out, but INHERITING one was not:
+    // buildExecEnv spreads the ambient process.env (exec.ts) and sanitizeProcessEnv
+    // only strips loader/interpreter vars, never credentials. So on any box whose
+    // daemon environment happens to carry CLAUDE_CODE_OAUTH_TOKEN, every routine
+    // spawn silently ran on that one shared rotating token instead of the host's
+    // own login — the exact fleet-wide-logout path, arriving by inheritance rather
+    // than injection. CI never caught it because CI has no token to inherit; a
+    // provisioned box does. Drop it here so a routine always uses the login of the
+    // machine it runs on.
+    delete out.CLAUDE_CODE_OAUTH_TOKEN;
     if (timezone)
         out.TZ = timezone;
     return out;
@@ -499,6 +510,28 @@ function spawnJobAttempt(cmd, env, attemptLogPath, timeoutMs, combinedLogPath) {
  * Single-shot path: pre-flight version/account selection + mid-run rate-limit
  * failover across healthy same-agent accounts (RUSH-1016).
  */
+/**
+ * Actor provenance for a routine run (RUSH-2020): `actor` is the routine's
+ * CREATOR (carried from the job config), `triggeredBy` is whoever kicked off THIS
+ * run (`resolveActor().id` — a person for a manual run, `UNRESOLVED@<host>` for an
+ * unattended scheduled fire). Spread into every RunMeta so a fired cron traces
+ * back to the person who scheduled it.
+ */
+function runProvenance(config) {
+    return { ...(config.actor ? { actor: config.actor } : {}), triggeredBy: resolveActor().id };
+}
+/**
+ * Inject the routine creator's actor into a run's base env so the fired agent
+ * INHERITS it (the `AGENTS_ACTOR` path in actor.ts) instead of re-resolving to
+ * `UNRESOLVED@<host>` on an unattended fire — so its session, events, and commits
+ * all attribute to the person who scheduled the routine (RUSH-2020). Mutates and
+ * returns the same env object for call-site brevity.
+ */
+function injectRoutineActor(env, config) {
+    if (config.actor && !env.AGENTS_ACTOR)
+        env.AGENTS_ACTOR = config.actor;
+    return env;
+}
 export async function executeJob(config, deps) {
     const eligibility = checkJobDeviceEligibility(config);
     if (eligibility) {
@@ -545,9 +578,9 @@ export async function executeJob(config, deps) {
     const runId = generateRunId();
     const runDir = getRunDir(config.name, runId);
     fs.mkdirSync(runDir, { recursive: true });
-    const baseEnv = useSandbox
+    const baseEnv = injectRoutineActor(useSandbox
         ? buildSpawnEnv(overlayHome)
-        : { ...process.env };
+        : { ...process.env }, config);
     // Workflows run via `agents run <workflow>` which delegates to claude under the hood.
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
     // (command jobs branched out earlier, so config.agent is set on the non-workflow path.)
@@ -555,6 +588,7 @@ export async function executeJob(config, deps) {
     const meta = {
         jobName: config.name,
         runId,
+        ...runProvenance(config),
         agent: effectiveAgent,
         ...(config.workflow ? { workflow: config.workflow } : {}),
         pid: null,
@@ -770,6 +804,7 @@ async function executeJobOnCloud(config, opts) {
     const meta = {
         jobName: config.name,
         runId,
+        ...runProvenance(config),
         agent: config.agent,
         pid: null,
         spawnedAt: Date.now(),
@@ -841,6 +876,7 @@ async function executeJobOnHost(config, opts) {
     const meta = {
         jobName: config.name,
         runId,
+        ...runProvenance(config),
         agent: config.agent,
         pid: null, // no local process — the run lives on the host
         spawnedAt: Date.now(),
@@ -888,6 +924,7 @@ async function executeCommandJobForeground(config) {
     const meta = {
         jobName: config.name,
         runId,
+        ...runProvenance(config),
         command: config.command,
         pid: null,
         spawnedAt: Date.now(),
@@ -1019,9 +1056,9 @@ export async function executeJobDetached(config, hooks) {
     fs.mkdirSync(runDir, { recursive: true });
     const stdoutPath = path.join(runDir, 'stdout.log');
     const stdoutFd = fs.openSync(stdoutPath, 'w', 0o600);
-    const baseEnv = useSandbox
+    const baseEnv = injectRoutineActor(useSandbox
         ? buildSpawnEnv(overlayHome)
-        : { ...process.env };
+        : { ...process.env }, config);
     const spawnEnv = dispatchesViaAgentsRun(config)
         ? (() => {
             const e = { ...baseEnv };
@@ -1035,6 +1072,7 @@ export async function executeJobDetached(config, hooks) {
     const meta = {
         jobName: config.name,
         runId,
+        ...runProvenance(config),
         agent: effectiveAgent,
         ...(config.workflow ? { workflow: config.workflow } : {}),
         pid: null,
@@ -1155,6 +1193,7 @@ function executeCommandJobDetached(config, hooks) {
     const meta = {
         jobName: config.name,
         runId,
+        ...runProvenance(config),
         command: config.command,
         pid: null,
         spawnedAt: Date.now(),

package/dist/lib/scheduler.js

@@ -6,7 +6,7 @@
  * on startup and reloads them on SIGHUP.
  */
 import { Cron } from 'croner';
-import { listJobs, deleteJob, isPastEndAt, setJobEnabled, jobRunsOnThisDevice } from './routines.js';
+import { listJobs, deleteJob, isPastEndAt, isPastOneShotRoutine, isOneShotRoutine, setJobEnabled, shouldPurgeCompletedOneShotRoutine, jobRunsOnThisDevice, } from './routines.js';
 /** In-memory cron scheduler that triggers a callback when jobs fire. */
 export class JobScheduler {
     jobs = new Map();
@@ -20,9 +20,15 @@ export class JobScheduler {
             // Trigger-only jobs (no cron schedule) fire via the webhook receiver,
             // not the cron loop — skip them here. Jobs pinned to another device
             // (routines are fleet-synced) never enter this machine's cron loop.
-            if (config.enabled && config.schedule && jobRunsOnThisDevice(config)) {
-                this.schedule(config);
+            if (!config.enabled || !config.schedule || !jobRunsOnThisDevice(config))
+                continue;
+            if (shouldPurgeCompletedOneShotRoutine(config)) {
+                deleteJob(config.name);
+                continue;
             }
+            if (isPastOneShotRoutine(config))
+                continue;
+            this.schedule(config);
         }
     }
     schedule(config) {
@@ -30,6 +36,12 @@ export class JobScheduler {
         if (!config.schedule)
             return;
         this.unschedule(config.name);
+        if (shouldPurgeCompletedOneShotRoutine(config)) {
+            deleteJob(config.name);
+            return;
+        }
+        if (isPastOneShotRoutine(config))
+            return;
         // catch: true — a throw from one job's callback should not kill the
         // whole cron loop. Each invocation of onTrigger is already wrapped in
         // try/catch, but a synchronous throw before the await would otherwise
@@ -59,7 +71,7 @@ export class JobScheduler {
                 console.error(`Job '${config.name}' failed:`, err.message);
             }
             // One-shot jobs: remove after first execution
-            if (config.runOnce) {
+            if (isOneShotRoutine(config)) {
                 this.unschedule(config.name);
                 deleteJob(config.name);
             }