@phnx-labs/agents-cli 1.20.92 → 1.21.0

package/CHANGELOG.md

@@ -1,5 +1,390 @@
 # Changelog
 
+## 1.21.0
+
+- **A clone of your own DotAgents repo no longer hijacks project-layer rule resolution (RUSH-2037).**
+  Cloning `~/.agents` to the canonical `~/src/github.com/<you>/.agents` path (to edit
+  rules in an editor) made that checkout eligible as a *project* layer whenever you
+  worked from its parent directory. Because project outranks user, a stale clone's
+  `rules/subrules/*` then silently shadowed the live user rules by filename, and the
+  compile planted an out-of-date `AGENTS.md` in an ancestor dir that every session
+  beneath it ingested. Project-layer discovery now identifies a DotAgents repo by
+  **repo identity** (git origin), not path: a `.agents/` that is itself a git checkout
+  whose origin matches the user's or system's DotAgents repo is skipped, so the live
+  user layer wins. Legitimate project `.agents/` layers (a plain subdirectory of a
+  project, or a git repo with an unrelated origin) are unaffected.
+  Source: `apps/cli/src/lib/state.ts`.
+
+- **`agents sessions --local` no longer dials remote-host teammates over ssh,
+  in the default listing or `--active` (RUSH-2118).** `--local` is supposed to
+  mean this-machine-only, but the underlying `AgentManager` poll still fired a
+  real ssh round-trip for every teammate dispatched via
+  `agents teams add --device` — even a teammate that had already finished.
+  On a box with 30 completed remote-host teammates that measured out to 180
+  real `ssh` execve calls (6 per teammate: two ssh calls in
+  `syncRemoteMirror`, run three times per poll) and a ~4.3s
+  `--active --local` call. A `--local` query now reads a remote-host
+  teammate's last-persisted `meta.json` state instead of dialing it, and a
+  teammate that has already reached a terminal status (completed/failed/
+  stopped) is never re-dialed by ANY `--active` query, local or not — its
+  final log bytes and exit code were already captured on the poll that
+  resolved it. The same gate now covers every `--local` surface: the bare
+  default listing's live-glyph enrichment (`maybeLiveIndex`) and `--preview`
+  (`renderSessionPreview`, freely combinable with `--local`) both called the
+  local-only `getActiveSessions()` with no `localOnly` threaded through,
+  despite the `--local` help text already promising this-machine-only for
+  all of them. Source: `apps/cli/src/lib/teams/agents.ts`
+  (`syncRemoteMirror`, `readNewEvents`, `updateStatusFromProcess`,
+  `AgentManager`), `apps/cli/src/lib/session/active.ts` (`listTeamsActive`,
+  `getActiveSessions`), `apps/cli/src/commands/sessions.ts`
+  (`gatherActiveSessions`, `maybeLiveIndex`, `renderSessionPreview`).
+
+- **A rules preset now applies at `agents run` time, not only after `agents
+  rules switch` (RUSH-2128).** `setActiveRulesPreset` used to take effect only on the next
+  explicit `agents rules switch`/`agents add`/`agents use` — a preset change
+  made any other way left the harness launching against a stale rules file
+  until someone remembered to re-sync. `agents run` now re-applies the active
+  preset for the resolved agent+version immediately before dispatch, every
+  time, with a skip-fast sentinel so an unchanged preset costs no recompose or
+  rewrite. Version-scoped only; per-model preset scoping is a follow-up.
+  Source: `apps/cli/src/lib/rules/run-sync.ts`, `apps/cli/src/commands/exec.ts`.
+
+- **Activity events now carry the same actor and session lineage as operational events.**
+  The TypeScript activity writer and the embedded PostToolUse hook stamp actor kind,
+  launch id, and parent session id from the shared execution provenance floor, so
+  `agents events` no longer invents an agent name as the activity record's OS user.
+  Source: `apps/cli/src/lib/event-provenance.ts`, `apps/cli/src/lib/activity.ts`.
+
+- **`agents view` no longer re-scans every installed Claude binary on each run.**
+  When a Claude model extractor produced zero models (a broken regex, or a
+  mid-install CLI), the result was never cached — so `getModelCatalog` re-ran a
+  full `readFileSync` scan of the 230-270MB Claude binary for every affected
+  installed version, on every invocation (~1.85s each). With 4 affected
+  versions installed, that was ~7.5s added to every `agents view`. A 0-model
+  extraction is now cached too, stamped with when it was attempted, and served
+  for 24 hours before self-healing by retrying; an upgrade/reinstall (a new
+  source mtime) still re-extracts immediately, as before. Measured on a real
+  install with 7 Claude versions (4 of them hitting the broken extractor): the
+  cold first-call cost (~12.5s, unavoidable) drops to ~1-2ms on every
+  subsequent call. Source: `apps/cli/src/lib/models.ts`.
+
+- **Per-device and fleet-wide config keys now have a home: the `config:` block in
+  the two-tier agents.yaml store.** Three new subcommands under `agents devices`
+  (no new top-level noun): `agents devices set-interactive <name>` records the one
+  device agents show YOU artifacts on (browser opens, dashboards) as
+  `config.interactiveHost` in the central, synced agents.yaml — skills no longer
+  guess "the online macOS box", and the host is marked `★ interactive` in
+  `agents devices list`. `agents devices configure <name> --max-agents N
+  --scheduler on|off` and `agents devices note <name> "…"` (repeat
+  to append, `--clear` to empty) write device-scope keys under `config:` in
+  `~/.agents/devices/<name>/agents.yaml` — targetable for any device from any box
+  (the devices/ tree syncs; each machine reads only its own). The default browser
+  profile joins the same registry as `browser.profile`, routed to the existing
+  device-local `defaultBrowserProfile` field (no duplicate key, resolution order
+  unchanged). Unset keys always mean today's behavior; everything is scriptable
+  with `--json`, and `devices list --json` now carries each row's `config` and an
+  `interactive` flag. agents.yaml files the CLI writes now carry a
+  `yaml-language-server` hint pointing at the new
+  `apps/cli/schema/agents-yaml.schema.json`.
+
+  The keys are live inputs, not just stored values. `--scheduler off` stops the
+  routines scheduler from starting on that device — `routines add` skips the
+  auto-start with the reason, a manual `routines start` refuses, and the daemon
+  re-evaluates the gate on every SIGHUP reload (boot it again with
+  `agents devices configure <host> --scheduler on` + any reload, no daemon
+  restart). `--max-agents` feeds host ranking: Factory auto-launch excludes a
+  device at its cap (counting device-wide running agents) and names the cap when
+  a pool is exhausted; teams placement excludes it from the least-loaded
+  auto-pick (counting the team's own roster, local teammates included) and an
+  all-capped pool fails loud instead of over-filling a machine. Setup asks
+  instead of guessing: bare `agents setup` ends with a skippable preferences
+  step (which machine you sit at → interactive host; which browser agents drive
+  here → device default), `agents setup fleet` offers the interactive host after
+  a sync, and the `agents setup browser` picker highlights the auto-detect
+  winner. Source: `apps/cli/src/lib/device-config.ts`,
+  `apps/cli/src/lib/state.ts`, `apps/cli/src/lib/daemon.ts`,
+  `apps/cli/src/lib/teams/scheduler.ts`, `apps/cli/src/commands/ssh.ts`,
+  `apps/cli/src/commands/setup-preferences.ts`,
+  `apps/factory/src/core/launchHost.ts`,
+  `apps/cli/schema/agents-yaml.schema.json`.
+
+- **Mailbox messages now expire and dead boxes are reaped automatically.** Messages
+  enqueued without an explicit TTL used to sit in the spool forever, so pending mail
+  would outlive the session that needed it. They now get a 24-hour default TTL
+  (`AGENTS_MAILBOX_TTL` overrides the default; `agents message … --ttl 2h` sets it
+  per message). When a message expires, a live-but-idle box archives it with a
+  `dropped: expired` receipt. The watchdog tick also runs a liveness sweep using the
+  same live-session set as `agents sessions --active`, archiving pending mail in dead
+  boxes as `dropped: dead` and pruning stale consumed entries. Dropped messages tied
+  to a feed block surface a failure receipt (`status: dropped` / `expired`) so the
+  sender sees the bounce instead of silence. Run the sweep manually with
+  `agents mailboxes gc` (`--json` supported). Source:
+  `apps/cli/src/lib/mailbox.ts`, `apps/cli/src/lib/mailbox-gc.ts`,
+  `apps/cli/src/commands/message.ts`, `apps/cli/src/commands/mailboxes.ts`,
+  `apps/cli/src/commands/watchdog.ts`, `apps/cli/src/lib/feed.ts`.
+
+- **The menu-bar helper can no longer leak CLI processes until the machine is unusable.**
+  Its poll shelled `agents doctor --json` through an unbounded `Process` +
+  `readDataToEndOfFile()`. Two properties composed badly: the call had no deadline
+  (`doctor --json` measures **136s on an idle box**, against a 60s poll interval), and a
+  helper that died mid-call left the child reparented to launchd (PPID 1) with nothing
+  to reap it — along with the `node -e` version probes that child had forked. Both fire
+  together, because the helper crashes under exactly the conditions that make the CLI
+  slow: `NSApplication.shared` segfaults inside `SLSNewConnection` when WindowServer is
+  too starved to hand out a connection, launchd's `KeepAlive` restarts it, and the
+  restart spawns a new doctor while the old one keeps burning a core. Observed on a real
+  machine: 38 orphaned doctors + 92 orphaned probes, ~13 of 18 cores consumed, load
+  average 490, keystrokes visibly lagging.
+  The crash itself cannot be prevented from inside the app — it is AppKit dereferencing
+  a null connection before any of our code runs — so a crash no longer costs anything
+  permanent: every child carries a deadline (30s; 180s for `doctor --json`, above its
+  real measured cost); it is spawned as its own process-group leader so a timeout kills
+  the whole subtree rather than just the CLI; and each live child is recorded on disk so
+  the *next* launch reaps whatever a crash abandoned (no exit handler runs on SIGSEGV).
+  The doctor refresh also drops from every 60s to every 15 minutes, and the launchd job
+  gains `ThrottleInterval` 30 so a startup crash-loop cannot respawn every 10s.
+  A poll that blows its deadline now shows a stale menu instead of taking the machine
+  down with it. Source: `apps/cli/menubar/Sources/MenubarHelper/ChildProcess.swift`,
+  `AgentsCLI.swift`, `StatusItemController.swift`, `main.swift`,
+  `apps/cli/src/lib/menubar/install-menubar.ts`.
+
+- **The macOS menu-bar helper is now notarized, ending the "app is damaged"
+  dialog and the per-run `no valid code signature; skipping launch` spam
+  (RUSH-2134).** The helper shipped Developer-ID signed but *not* notarized, so
+  Gatekeeper on macOS 26+ rejected it as damaged and the install path tried to
+  heal it by re-signing ad-hoc on every `agents` invocation — which can never
+  satisfy Gatekeeper, so the dialog and the noise persisted. The release now
+  notarizes + staples the helper (`menubar/scripts/build.sh`, mandatory for any
+  Developer-ID build, run under the release's `agents secrets exec apple.com`
+  context), the `prepack` gate refuses to pack an un-notarized bundle
+  (`scripts/verify-menubar-helper.sh` now requires a stapled ticket), and the
+  runtime ad-hoc re-sign band-aid is deleted — a notarized + stapled bundle
+  survives npm's tarball round-trip untouched, so the helper launches with no
+  per-machine healing. The launch guards now verify Gatekeeper acceptance (not
+  just `codesign --verify`) and fail loud pointing at an upgrade rather than
+  re-signing over it. Source: `apps/cli/menubar/scripts/build.sh`,
+  `apps/cli/scripts/verify-menubar-helper.sh`, `apps/cli/scripts/release.sh`,
+  `apps/cli/src/lib/menubar/install-menubar.ts`.
+
+- **`agents projects import` gains Linear as a source, and gates the Factory guess.**
+  `import --from-linear` turns the workspace's Linear projects into definitions via the
+  `linear` CLI, binding a local checkout only on an exact name match so it never
+  silently points a project at the wrong repo. `--from-factory` now imports only
+  `high`-confidence rows by default (`--min-confidence low|medium|high`, `--all` to
+  take everything), and prints why each row was skipped — the auto-detected registry
+  used to absorb every stale clone it found. Source: `apps/cli/src/lib/project-import.ts`.
+- **`agents projects list` columns line up again.** Widths are computed from the rows
+  being printed instead of a fixed 32-character path pad that every home-relative root
+  ran straight through. Source: `apps/cli/src/commands/projects.ts`.
+
+- **`agents projects status` shows the next Linear milestone.** A new `next` line names
+  the project's earliest unfinished milestone with its progress and a human due date
+  (`Beta cut · 3/8 · due in 6 days`, `overdue by 3 days`, `due Aug 21`) — a percentage
+  says how far along a project is, the milestone says what it is due to hit next. The
+  milestone list comes from the project rather than from issue assignments, so a
+  milestone with nothing filed under it yet still shows; it rides along on the first
+  page of the existing issue fetch, costing no extra request. Source:
+  `apps/cli/src/lib/linear-project-counts.ts`.
+
+- **`agents publish --branch <b>` now pushes the index to `<b>`, not just the printed URL (#1061).**
+  The flag rewrote the printed `raw.githubusercontent.com/.../<b>/skills-index.json`
+  URL, but the commit still landed on the checked-out branch — so `--branch dev` from a
+  `main` checkout published the index to `main` while advertising a `dev` URL that didn't
+  resolve. `commitAndPush` now takes an optional target branch and pushes
+  `<current>:<target>`, reporting back the branch the index actually landed on so the URL
+  references it. Omitting `--branch` still publishes to the repo's current branch.
+  Source: `apps/cli/src/lib/git.ts` (`commitAndPush`, `pushOrigin`, `getCurrentBranch`),
+  `apps/cli/src/commands/packages.ts`.
+
+- **Remove the unused `agents hq` command.** `agents hq floor --json` was a
+  machine-readable bridge for an interactive Agents HQ floor UI that was never
+  built — `apps/factory` has zero references to it and it had no other consumer.
+  Typing `agents hq` now prints a clear removal notice and exits non-zero instead
+  of silently disappearing. Source: `apps/cli/src/index.ts`,
+  `apps/cli/src/lib/startup/command-registry.ts` (removed
+  `apps/cli/src/commands/hq.ts`, `apps/cli/src/lib/hq/`).
+
+- **Removed `agents drive` and the R2/CRDT background session-sync beta.** Both
+  predate `agents sessions export`/`import`, which now cover the same ground
+  without a daemon: `agents drive` (rsync-based session/config mirroring) and
+  the opt-in `session-sync` beta (`agents sessions sync`, the daemon's ~90s R2
+  push/pull loop, `agents sync --sessions`) are gone. If you had `session-sync`
+  or `drive` enabled, re-enable is no longer possible — use `--host` for live
+  cross-machine reads or `agents sessions export --encrypt` /
+  `agents sessions import` for portable, encrypted transcript bundles instead.
+  The R2 network client and CRDT merge machinery are removed entirely with the
+  rest of the background sync. Export/import's own encrypted-bundle path
+  survives unchanged: it never talked to R2 over the network — it only reuses
+  the `r2.backups` bundle's shared `R2_SYNC_ENC_KEY` for local AES-256-GCM
+  encryption, falling back to a printed ephemeral key when that bundle isn't
+  configured. Source: `apps/cli/src/commands/drive.ts`,
+  `apps/cli/src/commands/sessions-sync.ts`, `apps/cli/src/lib/session/sync/crdt.ts`,
+  `apps/cli/src/lib/session/sync/sync.ts`, `apps/cli/src/lib/session/sync/r2.ts`,
+  `apps/cli/src/lib/daemon.ts`.
+
+- **A routine that fires less often than weekly can now be caught up at all.** Overdue
+  detection walked a fixed one-week window for the most recent expected fire, so any cron whose
+  gap exceeds that returned nothing and the routine was skipped entirely — never flagged
+  overdue on any device, never caught up, no `missed` record, silently. Monthly, semi-monthly,
+  quarterly and annual routines were all in that class. Measured on a real schedule
+  (`0 9 1,13,25 * *`, 12-day gaps): on **10 of every 28 days** the routine could not be
+  evaluated. The lookback now widens (week → month → quarter → year) only when the narrower
+  window finds nothing, so a dense schedule never walks more than a week of occurrences.
+- **Catch-up no longer resurrects a retired routine.** `detectOverdueJobs` never checked
+  `endAt`, and the scheduler only auto-disables lazily inside a live cron tick — so a routine
+  whose `endAt` elapsed while the daemon was down was still enabled on disk, rescheduled on
+  restart, and executed by the catch-up pass.
+- **One-shot detection matches the scheduler's.** Overdue used the raw `runOnce` flag while the
+  scheduler uses `isOneShotRoutine`, so a one-shot-*like* schedule (a fixed minute/hour/day/
+  month) that never carried the flag could be replayed by catch-up.
+- **The creation floor now covers built-in routines.** `routineEffectiveStart` resolved a
+  routine's file through a user-layer-only lookup, but `listJobs` reads the system layer too —
+  so a built-in shipped in the system repo had neither a `createdAt` stamp nor a resolvable
+  path, the floor was skipped, and it read as instantly overdue on first daemon start. Added
+  `resolveJobFilePath`, which resolves across every layer the loader reads.
+- **A `createdAt` in the future is clamped to now.** Left unclamped (clock skew, a hand-edited
+  year) it sits after every possible expected fire, so the routine could never be flagged
+  overdue until wall-clock time caught up.
+
+- **A routine now runs on exactly one device, instead of once per device listed.** `devices:`
+  was an allowlist where *every* listed device fired independently, so a routine pinned to two
+  boxes ran twice on every schedule — two full agent sessions doing identical work and burning
+  double the agent quota. On one live fleet seven routines were in that state: `security-sweep`
+  ran at 15:30:02 on one box and 15:30:03 on the other, both completing. Ownership is now a pure
+  function of the config (the first device in normalized sort order), so every daemon reaches the
+  same answer with no lease, no cross-device coordination, and no split brain when the fleet
+  partitions. Omitting `devices` still means fleet-wide, which is what `watchdog` and
+  `check-updates` want.
+- **`agents routines add --devices a,b` and `devices --set a,b` are now rejected.** A routine
+  belongs to one machine; the error names the fix. Routines already on disk with a multi-device
+  pin keep running — on their owner only — rather than being dropped.
+- **`agents doctor` lists any routine still carrying a multi-device pin**, with the devices it
+  names, the one that now fires, and the command to make it explicit. Also in `doctor --json` as
+  `ambiguousDevicePins`. The remediation deliberately offers the candidates rather than
+  prescribing the owner: the lowest-sorted name can be a registry alias that matches no live
+  machine, and cementing that would keep the routine dead.
+
+## 1.20.93
+
+- **`agents send` is a real delivery envelope; `notify` is just `--to owner` (RUSH-2123).** Flag-first form: `--to`, `--text`, `--channel`, `--attach`, `--url`. `--to owner` expands from `notify.owner` in agents.yaml. Positional text still works. Help names the three planes (deliver / record / control) so send is not confused with `feed post`, `activity`, or `message`/`sessions inject`. Source: `apps/cli/src/commands/send.ts`, `apps/cli/src/lib/channels/send.ts`.
+
+- **`agents events emit` — record events produced outside the CLI.** In-process code
+  calls `emit()` directly, but the producers that most need to record events are not
+  agents-cli processes: the Factory VS Code extension host, shell guards, external
+  tools. They now pipe JSONL on stdin —
+  `… | agents events emit --source factory`. `--source` is stamped as `module`, so
+  `agents events --module factory` filters to one producer. Routing is forced by the
+  stores rather than chosen: a milestone kind requires a `sessionId` and lands in that
+  session's activity log, everything else lands in the operational log. A milestone
+  with no `sessionId` is rejected, not quietly written elsewhere. Rejection is per
+  line, so one bad line never discards a batch, and the exit code is 1 if any line was
+  rejected. `--dry-run` validates without writing.
+  Source: `apps/cli/src/lib/events-ingest.ts`, `apps/cli/src/commands/events.ts`,
+  `apps/cli/docs/06-observability.md`.
+
+- **Four `factory.*` event kinds.** `factory.command`, `factory.action`, `factory.uri`
+  and `factory.launch` describe what a user did in the Factory VS Code extension.
+  `factory.launch` is a milestone — it carries the `sessionId` and `terminalId` that
+  later events join through — and `factory.uri` is audit-level, since an external
+  process driving the user's editor is a "who reached in from outside" fact.
+  Source: `apps/cli/src/lib/events.ts`, `apps/cli/src/lib/activity.ts`.
+
+- **`emit()` accepts a caller-supplied timestamp.** A batched producer records when
+  each event *happened* and flushes later; without this, every event in a flush was
+  stamped at flush time, collapsing their order and corrupting `--since` boundaries.
+  `ts` stays reserved against payload injection — only the explicit override can set
+  it. Source: `apps/cli/src/lib/events.ts`.
+
+- **Fixed: `agents _internal friction` recorded its own invocation.** The command
+  exists precisely because shell guards run before any `agents` process exists and so
+  cannot emit in-process, but it still fired the `command.start` / `command.end` audit
+  hooks, writing two records on top of every friction record. Recorder commands are now
+  exempt. Source: `apps/cli/src/index.ts`.
+
+- **Desktop notifications now show the agent on the right, not a second copy of
+  the app icon.** macOS draws two images on a banner: the sending app's icon on
+  the left and `contentImage` on the right (a YouTube notification uses the slots
+  for "YouTube" plus the channel avatar). agents-cli was putting its own lime mark
+  in the right slot, so both slots said the same thing. The right slot now carries
+  the harness the notification is *about* — a brand-colored tile with a two-letter
+  mark (`CL` claude, `CX` codex, `GK` grok, …), two letters because four harnesses
+  start with `c` and two with `g`. `agents run --notify` and agent/workflow
+  routines pass their harness through; a daemon heal, an overdue sweep, a command
+  routine, or a fan-out across several agents has no single agent and leaves the
+  right slot empty. Source:
+  `apps/cli/menubar/Sources/MenubarHelper/AgentAvatar.swift`,
+  `apps/cli/src/lib/menubar/notify-desktop.ts`, `apps/cli/src/lib/run-notify.ts`,
+  `apps/cli/src/lib/routine-notify.ts`, `apps/cli/docs/menubar.md`.
+
+- **`MenubarHelper --notify` gains `--agent <id>`.** The one-shot notifier accepts
+  the harness id that drives the right-hand avatar; omitting it is how a caller
+  says "no single agent owns this event".
+
+- **`agents projects status --fleet` — per-device workspace drift (beta).**
+  Projects are natively multi-device; `--fleet` adds a `fleet` line to the status
+  card showing, for each project, whether its workspace repos are present on every
+  fleet device, on which branch, ahead/behind their upstream (`↑`/`↓`), and how
+  many uncommitted changes they carry — plus a hidden `agents projects probe
+  --json <path...>` subcommand that is the peer half of the fan-out. One parallel
+  SSH call per device (12s timeout), **no `git fetch`** — drift is measured
+  against each peer's last-fetched upstream, and a repo with no upstream reports
+  no drift rather than zero. Peers that are unreachable or run an older CLI are
+  named once in a trailing note; `probe` itself is not beta-gated so peers answer
+  whenever their binary carries it. The schema gains `repos[].path` (home-relative
+  local checkout) to opt additional repos into probing beyond the primary `root`,
+  and `--json` gains per-project `workspaces[]` with the host-tagged probe rows.
+  The card's `live` line also counts agents on every box under `--fleet` via the
+  existing sessions fan-out. Source: `apps/cli/src/lib/project-probe.ts`,
+  `apps/cli/src/commands/projects.ts`, `apps/cli/src/lib/projects.ts`.
+
+- **`agents projects` outcomes on the card — agent×project members, releases,
+  Linear counts, and `projects link --linear` (beta).** The status card gains an
+  `agents` line under `live` naming WHICH harness is on each project
+  (`claude · running · RUSH-2107 @zion`, sorted running-first, capped at 6 with a
+  `+N more` tail; under `--fleet` remote agents carry their peer's hostname), a
+  latest-release tag on the `ships` line (primary repo only, best-effort
+  `gh release list`), and a `linear` line counting the bound Linear project's
+  issues by state type (`12/30 done · 5 in progress`) — best-effort with an 8s
+  budget, skipped by `--no-remote`, and omitted when the def has no
+  `linear.projectId`. The new `agents projects link <name> --linear [query]`
+  writes that binding: no query auto-suggests from the def name + repo slug via
+  the normalized-key matcher (ported from Factory's `linearProjects.ts`),
+  ambiguous/none prints the candidate list and exits 1. `--json` gains
+  `members[]`, `latestRelease`, and `linear`. Source:
+  `apps/cli/src/lib/project-status.ts`, `apps/cli/src/lib/linear-projects.ts`,
+  `apps/cli/src/lib/linear-project-counts.ts`, `apps/cli/src/commands/projects.ts`.
+
+- **Project sync no longer spams a warning per file it left alone.** Syncing a
+  project whose `.claude/commands/` you wrote yourself printed one wrapped
+  `Skipping project resource target …: already exists and is user-owned` line
+  per file — six hand-authored commands meant twelve lines of terminal noise in
+  the middle of `agents view claude`. Those files are the normal steady state,
+  not a warning, so the sync now reports them once, grouped, in plain words:
+  `Kept 6 of your own files in .claude/commands: debug.md, doc-gaps.md,
+  image-nbp.md, +3 more`. The list also rides out on `SyncResult.projectSkipped`
+  for callers that want it. Source: `apps/cli/src/lib/project-resources.ts`.
+
+- **`agents secrets` now tracks per-bundle usage and surfaces it.** Every secret
+  lifecycle/access event — create, import, export, view, access (a value read for
+  injection), unlock — funnels through the one `emitSecretAudit` chokepoint, which
+  writes to BOTH the append-only `~/.agents/events.jsonl` audit log AND a derived,
+  value-free read-model at `~/.agents/secrets/secrets.db` (never a secret value —
+  bundle name, event kind, key count, resolving agent/host, status only).
+  `agents secrets view <bundle>` now shows whether the bundle is currently
+  **unlocked** (held by the secrets-agent, so reads are prompt-free), a **usage**
+  summary ("accessed 42× (last 2h ago) · exported 3× (last 1d ago)"), and
+  **per-agent** attribution, and nudges when a bundle has no description (also at
+  `create` time). `agents secrets list` gains **`--sort uses`** (most frequently
+  accessed) alongside the existing `--sort used`, and the `--json` payloads carry
+  `uses`, `usage`, and `heldExpiresAt`. A new **`agents secrets activity [bundle]`**
+  prints the recent value-free event timeline (bounded to 90 days). Naming guidance
+  is taught in the help and skill: name a website bundle after its domain
+  (`stripe.com`, `openai.ai`), a desktop-app bundle after its binary suffix
+  (`slack.app`, `photoshop.exe`). Recording is best-effort and
+  `AGENTS_NO_USAGE_TRACK=1` disables it. Source:
+  `apps/cli/src/lib/secrets/usage-db.ts`, `apps/cli/src/lib/secrets/audit.ts`,
+  `apps/cli/src/commands/secrets.ts`, `apps/cli/src/lib/secrets/list-filter.ts`.
+
 ## 1.20.92
 
 - **`agents sessions` rows show creation time as well as last activity (RUSH-2107).**

package/README.md

@@ -476,6 +476,9 @@ agents devices list                     # fleet + headroom: load, mem, idle/busy
 agents devices list --live              # force a live probe of every device (alias of --refresh)
 agents devices list --full              # add per-device cores and free/total RAM
 agents devices list --no-stats          # instant: names/addresses only, skip the probe
+agents devices set-interactive zion     # the device agents show YOU artifacts on (★ in the list)
+agents devices configure mac-mini --max-agents 4 --scheduler off   # per-device config (syncs via devices/<name>/agents.yaml)
+agents devices note mac-mini "runs the releases — don't reboot"    # operator notes, repeat to append
 agents ssh mac-mini                     # hardened SSH: fails fast if offline,
                                         # PowerShell on Windows, password-from-Keychain,
                                         # auto-syncs your terminfo (Ghostty/kitty/…) so

package/dist/commands/beta.js

@@ -1,9 +1,7 @@
 import chalk from 'chalk';
 import { ALL_BETA_FEATURES, getBetaConfigLocation, getEnabledBetaFeatures, setBetaEnabled, } from '../lib/beta.js';
 const BETA_DESCRIPTIONS = {
-    drive: 'Google Drive integration for reading and writing files',
     factory: 'Cloud-based agent dispatch via Rush Factory',
-    'session-sync': 'Cross-machine session transcript sync via R2 (daemon push/pull)',
     projects: 'Named multi-repo projects with a progress rollup (agents projects)',
 };
 function parseFeatures(values) {
@@ -19,12 +17,12 @@ function parseFeatures(values) {
 export function registerBetaCommands(program) {
     const beta = program
         .command('beta')
-        .description('Enable or disable preview features like drive and factory.')
+        .description('Enable or disable preview features like factory.')
         .addHelpText('after', `
 Examples:
   agents beta list
-  agents beta enable drive factory
-  agents beta disable drive
+  agents beta enable factory
+  agents beta disable factory
 `);
     beta
         .command('list')

package/dist/commands/doctor.js

@@ -13,6 +13,7 @@ import { resolveHost } from '../lib/hosts/registry.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
 import { machineId, normalizeHost } from '../lib/session/sync/config.js';
+import { findAmbiguousDevicePins } from '../lib/routines.js';
 import chalk from 'chalk';
 import { checkAllClis, collectTeamsDoctorData } from '../lib/teams/agents.js';
 import { AGENTS, ALL_AGENT_IDS, resolveAgentName, formatAgentError, getAccountInfo } from '../lib/agents.js';
@@ -1298,6 +1299,10 @@ export function registerDoctorCommand(program) {
             const inventory = await collectLocalFleetInventory(cwd);
             const localName = machineId();
             const duplicateHooks = inspectDuplicateVersionHooks(cwd);
+            // A routine belongs to one device. A multi-device pin used to fire it
+            // once per listed device — duplicate agent runs, duplicate spend — so
+            // surface any that are still on disk with the exact fix.
+            const ambiguousPins = findAmbiguousDevicePins(cwd);
             // Legacy account-global sign-in map, kept for `--json` back-compat
             // (ssh.ts RemoteDoctorJson / menubar read `signIn`). File-based, no home.
             const signIn = {};
@@ -1361,6 +1366,9 @@ export function registerDoctorCommand(program) {
                     // reading `sync`/`orphans`/`repos` are unaffected.
                     health: computeOverviewHealth(syncRows, orphanRows, repoBehindMarkers, duplicateHooks),
                     duplicateHooks,
+                    // Routines whose `devices` names more than one machine — each used to
+                    // fire once per device. `owner` is the one that fires now.
+                    ambiguousDevicePins: ambiguousPins,
                     // Prioritized RUSH-2069 findings (critical/warning, per-version, with
                     // remediation). Additive alongside the legacy fields above.
                     findings,
@@ -1404,6 +1412,21 @@ export function registerDoctorCommand(program) {
             if (syncRows.some((r) => r.status !== 'fresh' || (r.unwiredHooks ?? 0) > 0) || repoBehindMarkers.some((m) => m.behind > 0)) {
                 console.log(chalk.gray('\nRun `agents status` to review and sync what has drifted.'));
             }
+            // A routine runs on exactly one device. Each of these named several and
+            // used to fire once per device — duplicate agent runs on every schedule.
+            if (ambiguousPins.length > 0) {
+                console.log();
+                console.log(chalk.yellow(`${ambiguousPins.length} routine(s) pin more than one device — a routine runs on exactly one:`));
+                for (const pin of ambiguousPins) {
+                    console.log(`  ${chalk.cyan(pin.name)} ${chalk.gray(`[${pin.devices.join(', ')}]`)} ` +
+                        `${chalk.gray('→ fires only on')} ${pin.owner}`);
+                    // Deliberately not prescribing `--set ${pin.owner}`: ownership is the
+                    // lowest-sorted name, which can be a registry alias that matches no
+                    // live machine (`worker` here), and cementing that keeps the routine
+                    // dead. Name the candidates and let the operator pick the real box.
+                    console.log(chalk.gray(`      fix: agents routines devices ${pin.name} --set <${pin.devices.join('|')}>`));
+                }
+            }
             return;
         }
         const parsed = parseTargetArg(target);

package/dist/commands/events.js

@@ -17,6 +17,8 @@ import chalk from 'chalk';
 import * as fs from 'fs';
 import { getLogsPath } from '../lib/events.js';
 import { readUnifiedEvents } from '../lib/event-stream.js';
+import { ingestBatch } from '../lib/events-ingest.js';
+import { setHelpSections } from '../lib/help.js';
 /**
  * Resolve `--limit` into a record cap. `0` means "no cap" — without it there is
  * no way to read the whole stream, and any aggregation (group-by failure, count
@@ -97,8 +99,93 @@ function renderRow(r) {
     const agent = r.agent ? chalk.gray(` ${r.agent}`) : '';
     return `${time}  ${originLabel(r).padEnd(24)} ${user.padEnd(22)} ${ev.padEnd(26)}${agent}  ${detailFor(r)}`;
 }
+/** Read all of stdin. Returns '' when nothing is piped. */
+async function readStdin() {
+    if (process.stdin.isTTY)
+        return '';
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf-8');
+}
+function registerEmitSubcommand(events) {
+    const emitCmd = events
+        .command('emit')
+        .description('Record events produced outside this process (reads JSONL on stdin)')
+        .requiredOption('--source <name>', 'Producer name; stamped as `module` so `events --module <name>` filters to it')
+        .option('--dry-run', 'Validate and report without writing')
+        .option('--json', 'Report {written, rejected} as JSON')
+        .action(async (opts, cmd) => {
+        // The parent `events` command also declares `--json` (for its read view).
+        // Commander binds a flag declared on BOTH to the parent, so a bare
+        // `events emit … --json` lands on parent.opts().json and the child sees
+        // undefined — the human string would print where a caller expects JSON.
+        // Read both, same as `feed post`.
+        const wantJson = Boolean(opts?.json ?? cmd?.parent?.opts?.().json);
+        const input = await readStdin();
+        if (input.trim() === '') {
+            console.error('events emit: nothing on stdin — pipe one JSON object per line.');
+            process.exitCode = 1;
+            return;
+        }
+        let result;
+        try {
+            result = ingestBatch(input, { source: opts.source, dryRun: opts.dryRun });
+        }
+        catch (err) {
+            console.error(`events emit: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+            return;
+        }
+        if (wantJson) {
+            console.log(JSON.stringify({ written: result.written, rejected: result.rejected, routed: result.routed }, null, 2));
+        }
+        else if (result.rejected.length === 0) {
+            console.log(`${result.written} event(s) recorded${opts.dryRun ? ' (dry run)' : ''}.`);
+        }
+        else {
+            console.log(`${result.written} event(s) recorded${opts.dryRun ? ' (dry run)' : ''}.`);
+            console.error(`rejected ${result.rejected.length} line(s):`);
+            for (const r of result.rejected)
+                console.error(`  line ${r.line}: ${r.reason}`);
+        }
+        // Valid siblings are already written; a non-zero exit reports that the
+        // batch was not fully accepted without pretending nothing landed.
+        if (result.rejected.length > 0)
+            process.exitCode = 1;
+    });
+    setHelpSections(emitCmd, {
+        examples: `
+      # 1. Produce one JSON object per line (this is the whole input format).
+      printf '%s\\n' '{"event":"factory.command","commandId":"agents.newClaude"}' \\
+        | agents events emit --source factory
+
+      # 2. Flush a batch and check what landed.
+      agents events emit --source factory --json < batch.jsonl
+
+      # 3. Read it back. --limit 0 matters whenever you aggregate.
+      agents events --module factory --limit 0 --json
+    `,
+        notes: `
+      \`event\` is required and must be a known kind. \`ts\` (ISO-8601) is optional
+      and defaults to now — pass it so a batched producer records when each event
+      HAPPENED rather than when it flushed.
+
+      Envelope keys: ts, sessionId, mailboxId, terminalId, launchId, tmuxPane,
+      host, runtime, agent, tool, detail, url, project, cwd. Any other key is
+      payload and passes through the usual redaction.
+
+      A milestone kind (e.g. factory.launch) REQUIRES a sessionId — the activity
+      log is one file per session. Milestones route there; everything else goes
+      to the operational log. \`agents events\` reads both.
+
+      Rejection is per line: one bad line never discards the batch. Exit is 1 if
+      any line was rejected.
+    `,
+    });
+}
 export function registerEventsCommand(program) {
-    program
+    const events = program
         .command('events')
         .description('Read the unified event stream (operational + agent activity)')
         .option('--module <name>', 'Only events from this group (e.g. teams, secrets, activity)')
@@ -166,6 +253,9 @@ Examples:
         if (truncated)
             console.log(chalk.yellow(capNote));
     });
+    // `events` both reads (its own action, above) and writes (this subcommand) —
+    // the same shape as `feed` / `feed post`.
+    registerEmitSubcommand(events);
 }
 /** commander repeatable-option collector. */
 function collect(value, previous) {

package/dist/commands/exec.js

@@ -23,6 +23,7 @@ import * as os from 'os';
 import { spawnSync } from 'child_process';
 import { randomUUID } from 'crypto';
 import { isSessionTrackedAgent } from '../lib/session/types.js';
+import { applyActiveRulesPresetAtRun } from '../lib/rules/run-sync.js';
 /** Distinguish a terminal account-picker marker from an explicit @version pin. */
 export function parseRunAccountPickerRequest(agentSpec) {
     const requested = agentSpec.endsWith('@');
@@ -1978,6 +1979,18 @@ export function registerRunCommand(program) {
             }
         }
         const defaultVersion = version ?? resolveVersion(agent, cwd);
+        // Re-apply the active rules preset before every launch (issue: preset
+        // changes via `setActiveRulesPreset` only took effect after an explicit
+        // `agents rules switch` / `agents sync`). Version-scoped, skip-fast when
+        // nothing changed — see lib/rules/run-sync.ts. Placed here (immediately
+        // after the resolved version is known, before ACP/loop/fallback branch
+        // off) so every downstream dispatch path for this agent+version sees a
+        // fresh rules file, not just the plain execAgent path. `defaultVersion`
+        // is null when nothing is installed yet — execAgent handles that error
+        // path itself; there's no version home to sync into.
+        if (defaultVersion) {
+            applyActiveRulesPresetAtRun(agent, defaultVersion, getVersionHomePath(agent, defaultVersion));
+        }
         // Login preflight (advisory, warn + continue). On a local INTERACTIVE
         // launch, probe whether this agent's account has a credential and print a
         // one-line warning if it looks logged out — so you find out BEFORE the TUI