@phnx-labs/agents-cli 1.20.93 → 1.21.0

package/dist/index.js

@@ -94,11 +94,12 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadExport, loadPackages, loadRoutines, loadMonitors, loadProjects, loadRun, loadFork, loadDefaults, loadSet, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadStatus, loadProfiles, loadHarness, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadPerf, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadShare, loadSend, loadHq, loadFeed, loadActivity, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadExport, loadPackages, loadRoutines, loadMonitors, loadProjects, loadRun, loadFork, loadDefaults, loadSet, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadStatus, loadProfiles, loadHarness, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadFactory, loadUsage, loadCost, loadPerf, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadShare, loadSend, loadFeed, loadActivity, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { getCliLaunch } from './lib/cli-entry.js';
 import { emit, emitFriction, redactArgs } from './lib/events.js';
+import { die } from './lib/format.js';
 // Transparent shim delegate: the generated Windows `.cmd` shims invoke
 // `agents __shim <agent>[@version] <raw args>`. Intercept here, before commander
 // parses anything, so the agent's own flags (`--help`, `--version`, etc.) pass
@@ -281,7 +282,6 @@ Run and dispatch:
   run <agent|profile> [prompt]    Run an agent. Omit prompt for interactive mode.
   defaults                        Configure run defaults by agent/version selector
   teams                           Coordinate multiple agents on shared work
-  hq                              JSON bridge for the interactive Agents HQ floor
   routines                        Run agents on a cron schedule (scheduler auto-starts)
   webhook                         Receive signed GitHub/Linear webhooks for trigger routines
   funnel                          Expose a webhook receiver through Tailscale Funnel
@@ -301,14 +301,13 @@ Diagnostics:
   perf                            Latency rollups (hooks, commands, runs) from the disposable perf warehouse
 
 Config sync:
-  drive                           Sync session history across machines via rsync
   pull                            Clone or pull the system repo at ~/.agents/.system/
   repo init --path <dir>          Scaffold your own editable repo from a template
   repo add <path|gh:user/repo>    Merge an extra repo after the system repo
   lock [--frozen]                 Write/verify agents.lock (SHA-256 of resolved resources); --frozen fails on drift
 
 Beta features:
-  beta                            Enable preview features (factory, drive, and more)
+  beta                            Enable preview features (factory and more)
 
 Automation tips:
   Pass explicit names/IDs         Avoid pickers: agents sessions <id> --markdown
@@ -721,6 +720,21 @@ function registerResourcesTombstoneCommand(p) {
         await program.parseAsync(['node', 'agents', ...args]);
     });
 }
+/**
+ * Removed `hq` command — the JSON bridge for the interactive Agents HQ floor
+ * (`agents hq floor --json`). No UI ever consumed it (apps/factory has zero
+ * references) and it had no external users, so it is gone with no replacement.
+ * Kept as a hidden tombstone so a stale invocation gets a clear message and a
+ * non-zero exit instead of commander's raw "unknown command".
+ */
+function registerHqTombstoneCommand(p) {
+    p.command('hq', { hidden: true })
+        .allowUnknownOption()
+        .allowExcessArguments()
+        .action(() => {
+        die('"agents hq" was removed (internal Agents HQ floor bridge, no longer used).');
+    });
+}
 /**
  * Hidden `agents _internal <sub>` namespace for machine-to-machine calls that
  * are not user-facing. The first subcommand is `friction`, used by shell guard
@@ -840,6 +854,9 @@ async function registerEagerForRequest(name) {
             registerResourcesTombstoneCommand(program);
             await reg(loadView);
             return true;
+        case 'hq':
+            registerHqTombstoneCommand(program);
+            return true;
         case '_internal':
             registerInternalCommand(program);
             return true;
@@ -912,7 +929,6 @@ async function registerAllEagerCommands() {
     await reg(loadSync);
     await reg(loadLock);
     await reg(loadRefreshRules);
-    await reg(loadDrive);
     await reg(loadFactory);
     await reg(loadUsage);
     await reg(loadCost);
@@ -932,7 +948,7 @@ async function registerAllEagerCommands() {
     await reg(loadAudit);
     await reg(loadWebhook);
     await reg(loadFunnel);
-    await reg(loadHq);
+    registerHqTombstoneCommand(program);
     await reg(loadFeed);
     await reg(loadActivity);
     await reg(loadMailboxes);

package/dist/lib/activity.d.ts

@@ -1,3 +1,4 @@
+import type { ActorKind } from './actor.js';
 import type { EventRecord } from './events.js';
 /** Recognizable milestone events, ordered first in any activity lane. */
 export type MilestoneEvent = 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created'
@@ -80,6 +81,10 @@ export interface ActivityEvent {
     project?: string;
     /** Agent that produced the event (claude, codex, ...). */
     agent?: string;
+    /** Resolved actor id shared with the operational event stream. */
+    actor?: string;
+    /** Resolved actor kind shared with the operational event stream. */
+    kind?: ActorKind | 'unknown';
     /** Tool that triggered the event (Bash, Task, ExitPlanMode, feed.post, ...). */
     tool?: string;
     /** One-line human summary (plan title, PR command, sub-agent role, status text). */
@@ -90,6 +95,8 @@ export interface ActivityEvent {
     pid?: number;
     /** Spawn-time join key (`AGENT_LAUNCH_ID`) when known. */
     launchId?: string;
+    /** Session that spawned this session (`AGENTS_PARENT_SESSION_ID`) when known. */
+    parentSessionId?: string;
     /** Factory terminal id when the launch inherited one. */
     terminalId?: string;
     /** `$TMUX_PANE` at launch when recorded. */

package/dist/lib/activity.js

@@ -25,6 +25,7 @@ import { relTime, truncate } from './format.js';
 import { getActivityDir, getUserAgentsDir } from './state.js';
 import { normalizeHost } from './machine-id.js';
 import { projectKeyFromCwd } from './project-key.js';
+import { stampProvenance } from './event-provenance.js';
 /** The set of milestone events, for tier classification and ordering. */
 export const MILESTONE_EVENTS = [
     'plan.created',
@@ -109,6 +110,7 @@ export function appendActivityEvent(event, root) {
     const dir = root ?? getActivityDir();
     fs.mkdirSync(dir, { recursive: true });
     const record = {
+        ...stampProvenance(),
         v: event.v ?? 1,
         tier: event.tier ?? tierForEvent(event.event),
         ...event,
@@ -135,11 +137,14 @@ function parseLine(line) {
             cwd: parsed.cwd,
             project: parsed.project,
             agent: parsed.agent,
+            actor: parsed.actor,
+            kind: parsed.kind,
             tool: parsed.tool,
             detail: parsed.detail,
             url: parsed.url,
             pid: typeof parsed.pid === 'number' ? parsed.pid : undefined,
             launchId: parsed.launchId,
+            parentSessionId: parsed.parentSessionId,
             terminalId: parsed.terminalId,
             tmuxPane: parsed.tmuxPane,
             category: typeof parsed.category === 'string' ? parsed.category : undefined,
@@ -268,10 +273,12 @@ export function activityEventToRecord(ev) {
         level: 'info',
         caller: ev.tool === 'feed.post' ? 'agent' : 'hook',
         session: ev.sessionId,
-        osUser: ev.agent ?? 'agent',
+        osUser: 'unknown',
         transport: 'local',
         // payload
         agent: ev.agent,
+        actor: ev.actor ?? 'unknown',
+        kind: ev.kind ?? 'unknown',
         sessionId: ev.sessionId,
         cwd: ev.cwd,
         module: 'activity',
@@ -281,6 +288,7 @@ export function activityEventToRecord(ev) {
         tier: ev.tier,
         ...(ev.project ? { project: ev.project } : {}),
         ...(ev.launchId ? { launchId: ev.launchId } : {}),
+        ...(ev.parentSessionId ? { parentSessionId: ev.parentSessionId } : {}),
         ...(ev.terminalId ? { terminalId: ev.terminalId } : {}),
         ...(ev.tmuxPane ? { tmuxPane: ev.tmuxPane } : {}),
         ...(ev.attachments?.length ? { attachments: ev.attachments } : {}),
@@ -1521,8 +1529,17 @@ def main():
         cwd = payload.get("cwd") or os.environ.get("AGENTS_CWD")
         if cwd:
             record["cwd"] = cwd
-        agent = os.environ.get("AGENTS_AGENT_NAME") or "claude"
+        agent = os.environ.get("AGENTS_AGENT_NAME") or "unknown"
         record["agent"] = agent
+        record["actor"] = os.environ.get("AGENTS_ACTOR") or "unknown"
+        actor_kind = os.environ.get("AGENTS_ACTOR_KIND")
+        record["kind"] = actor_kind if actor_kind in ("human", "agent") else "unknown"
+        launch_id = os.environ.get("AGENT_LAUNCH_ID")
+        if launch_id:
+            record["launchId"] = launch_id
+        parent_session_id = os.environ.get("AGENTS_PARENT_SESSION_ID")
+        if parent_session_id:
+            record["parentSessionId"] = parent_session_id
 
     try:
         os.makedirs(activity_dir, exist_ok=True)

package/dist/lib/auto-dispatch.d.ts

@@ -43,7 +43,12 @@ export interface PlannedDispatch {
     title: string;
     delegateName: string;
 }
-/** Path to the shared factory project registry (written by the factory UI). */
+/**
+ * Path to the shared factory project registry (written by the factory UI).
+ * `AGENTS_FACTORY_PROJECTS_PATH` overrides it, mirroring `AGENTS_PROJECTS_DIR`
+ * (`state.ts`) — that seam is what lets `projects import --from-factory` be
+ * tested end-to-end against a real fixture file instead of a mock.
+ */
 export declare function factoryProjectsPath(): string;
 /** Read the project registry rows this module cares about. */
 export declare function readAutoDispatchProjects(): AutoDispatchProject[];

package/dist/lib/auto-dispatch.js

@@ -16,9 +16,14 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { homedir } from 'os';
-/** Path to the shared factory project registry (written by the factory UI). */
+/**
+ * Path to the shared factory project registry (written by the factory UI).
+ * `AGENTS_FACTORY_PROJECTS_PATH` overrides it, mirroring `AGENTS_PROJECTS_DIR`
+ * (`state.ts`) — that seam is what lets `projects import --from-factory` be
+ * tested end-to-end against a real fixture file instead of a mock.
+ */
 export function factoryProjectsPath() {
-    return path.join(homedir(), '.agents', 'factory', 'projects.json');
+    return process.env.AGENTS_FACTORY_PROJECTS_PATH ?? path.join(homedir(), '.agents', 'factory', 'projects.json');
 }
 /** Read the project registry rows this module cares about. */
 export function readAutoDispatchProjects() {

package/dist/lib/beta.d.ts

@@ -8,7 +8,7 @@
  * checks.
  */
 import type { BetaFeatureName } from './types.js';
-export declare const ALL_BETA_FEATURES: readonly ["drive", "factory", "session-sync", "projects"];
+export declare const ALL_BETA_FEATURES: readonly ["factory", "projects"];
 export declare function getEnabledBetaFeatures(): BetaFeatureName[];
 export declare function isBetaEnabled(feature: BetaFeatureName): boolean;
 export declare function getBetaConfigLocation(): {

package/dist/lib/beta.js

@@ -10,7 +10,7 @@
 import * as path from 'path';
 import { getAgentsDir, getOptionalUserAgentsDir, readMeta, writeMeta } from './state.js';
 import { readManifest, writeManifest } from './manifest.js';
-export const ALL_BETA_FEATURES = ['drive', 'factory', 'session-sync', 'projects'];
+export const ALL_BETA_FEATURES = ['factory', 'projects'];
 function isBetaFeatureName(value) {
     return typeof value === 'string' && ALL_BETA_FEATURES.includes(value);
 }

package/dist/lib/daemon.d.ts

@@ -16,6 +16,19 @@ import { getAgentsBinPath } from './cli-entry.js';
  * broker is hosting, and never clobber a reachable (healthy) broker.
  */
 export declare function shouldTakeOverBroker(isHosting: boolean, brokerReachable: boolean): boolean;
+/**
+ * What a gate re-evaluation must do with the routines scheduler. The daemon
+ * re-evaluates `scheduler.enabled` on every SIGHUP reload so flipping the key
+ * takes effect without a daemon restart (and `routines add`'s reload signal on
+ * a re-enabled box boots the scheduler — the reload is truthful, not a no-op).
+ *
+ *   running + enabled   → reload (the normal SIGHUP path)
+ *   running + !enabled  → stop  (gate flipped off since boot)
+ *   !running + enabled  → boot  (gate flipped on since boot)
+ *   !running + !enabled → none  (stay dark)
+ */
+export type SchedulerGateTransition = 'reload' | 'stop' | 'boot' | 'none';
+export declare function schedulerGateTransition(running: boolean, enabled: boolean): SchedulerGateTransition;
 /** Read the stored daemon PID from disk. Returns null if not present or invalid. */
 export declare function readDaemonPid(): number | null;
 /** Write the daemon PID to the pid file. */

package/dist/lib/daemon.js

@@ -24,6 +24,7 @@ import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { redactSecrets } from './redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from './cli-entry.js';
+import { isSchedulerEnabled, assertSchedulerEnabled } from './device-config.js';
 const PID_FILE = 'daemon.pid';
 const LOCK_FILE = 'daemon.lock';
 const LOG_FILE = 'logs.jsonl';
@@ -53,6 +54,11 @@ const WEDGE_THRESHOLD_TICKS = 3;
 export function shouldTakeOverBroker(isHosting, brokerReachable) {
     return !isHosting && !brokerReachable;
 }
+export function schedulerGateTransition(running, enabled) {
+    if (running)
+        return enabled ? 'reload' : 'stop';
+    return enabled ? 'boot' : 'none';
+}
 function getDaemonDir() {
     const dir = getDaemonDirRoot();
     fs.mkdirSync(dir, { recursive: true });
@@ -398,7 +404,7 @@ export async function runDaemon() {
         log('ERROR', `Stray daemon reaper failed: ${err.message}`);
     }
     // #416: host the secrets broker socket-first — before the scheduler and the
-    // heavy browser/session-sync services — so `agents secrets` resolves within
+    // heavy browser services — so `agents secrets` resolves within
     // ms of daemon start. Only host when no broker is already reachable, so we
     // never orphan a live standalone broker's clients (that broker stays the
     // server until it idle-exits or the daemon restarts). Best-effort: a failure
@@ -419,7 +425,23 @@ export async function runDaemon() {
     catch (err) {
         log('WARN', `Secrets broker host skipped: ${err.message}`);
     }
-    const scheduler = new JobScheduler(async (config) => {
+    // scheduler.enabled=false in this machine's device doc means NO routines fire
+    // here — the scheduler and its catchup recovery simply never start, while the
+    // daemon keeps its other duties (secrets broker, browser IPC, session sync).
+    // The refusal message is the same one the start surfaces
+    // (`routines add` auto-start, manual `routines start`) raise. The gate is
+    // re-evaluated on every SIGHUP reload (handleReload below) via
+    // schedulerGateTransition, so flipping the key never needs a daemon restart.
+    const schedulerEnabledAtBoot = isSchedulerEnabled();
+    if (!schedulerEnabledAtBoot) {
+        try {
+            assertSchedulerEnabled();
+        }
+        catch (err) {
+            log('WARN', err.message);
+        }
+    }
+    const triggerJob = async (config) => {
         const jobLabel = config.command
             ? 'command'
             : config.workflow
@@ -458,7 +480,36 @@ export async function runDaemon() {
             }
             catch { /* best-effort */ }
         }
-    });
+    };
+    let scheduler = null;
+    let catchupInterval;
+    // Catchup overlap guard. Declared up here (not beside catchupPass) because
+    // bootScheduler() runs before catchupPass's textual position — a `let` down
+    // there would still be in its TDZ at the first call and crash the daemon.
+    let catchingUp = false;
+    // Boot the scheduler + catchup recovery. Called at daemon start when the gate
+    // allows, and again from handleReload when the gate flips on (function
+    // declarations hoist — catchupPass below is in scope).
+    function bootScheduler() {
+        scheduler = new JobScheduler(triggerJob);
+        scheduler.loadAll();
+        const scheduled = scheduler.listScheduled();
+        log('INFO', `Loaded ${scheduled.length} jobs`);
+        for (const job of scheduled) {
+            log('INFO', `  ${job.name} -> next: ${job.nextRun?.toISOString() || 'unknown'}`);
+        }
+        void catchupPass();
+        catchupInterval = setInterval(() => { void catchupPass(); }, CATCHUP_TICK_MS);
+    }
+    // Stop the scheduler + catchup recovery (gate flipped off on reload).
+    function stopScheduler() {
+        scheduler?.stopAll();
+        scheduler = null;
+        if (catchupInterval !== undefined) {
+            clearInterval(catchupInterval);
+            catchupInterval = undefined;
+        }
+    }
     // Materialise opted-in project routines into the user layer on every start
     // so a fresh daemon picks up project YAML without a separate sync step.
     try {
@@ -470,12 +521,8 @@ export async function runDaemon() {
     catch (err) {
         log('WARN', `Project routines sync failed: ${err.message}`);
     }
-    scheduler.loadAll();
-    const scheduled = scheduler.listScheduled();
-    log('INFO', `Loaded ${scheduled.length} jobs`);
-    for (const job of scheduled) {
-        log('INFO', `  ${job.name} -> next: ${job.nextRun?.toISOString() || 'unknown'}`);
-    }
+    if (schedulerEnabledAtBoot)
+        bootScheduler();
     // Monitor engine: event-triggered watchers, beside the cron scheduler. Same
     // daemon, same dispatch seam — a monitor is a routine whose trigger is a
     // watched source instead of a clock. Reloads on SIGHUP alongside the scheduler.
@@ -495,15 +542,16 @@ export async function runDaemon() {
     // `catchup: false`, RUN late. Runs on a timer as well as at startup: a startup
     // pass alone misses a fire lost while the daemon stayed up but its event loop
     // was wedged, or one lost across an OS suspend that the process survived.
-    // Overlap guard, same shape as runSessionSync/runHealCheck below. A pass
+    // Overlap guard, same shape as runHealCheck below. A pass
     // awaits executeJobDetached per job and an off-box (host/cloud) dispatch can
     // block for a while, so a slow pass could still be working when the next tick
     // fires. Both passes would then see a job the first has not yet reached as
     // overdue — the miss is recorded before the await, but only for jobs already
     // processed — and spawn it twice. The idempotency of the `missed` record
     // guards across passes, not within one that is mid-flight.
-    let catchingUp = false;
-    const catchupPass = async () => {
+    // Function declaration (hoisted) so bootScheduler() can schedule it. Its
+    // guard (`catchingUp`) is declared beside `scheduler` above for TDZ safety.
+    async function catchupPass() {
         if (catchingUp)
             return;
         catchingUp = true;
@@ -553,9 +601,7 @@ export async function runDaemon() {
             // throw must not leave the guard latched shut for the daemon's lifetime.
             catchingUp = false;
         }
-    };
-    await catchupPass();
-    const catchupInterval = setInterval(() => { void catchupPass(); }, CATCHUP_TICK_MS);
+    }
     // Before the BrowserService comes up, reap browser + tunnel processes
     // spawned by previous daemons that are no longer alive. Without this,
     // a daemon hard-crash (SIGKILL, OOM) would leak every browser and SSH
@@ -588,42 +634,6 @@ export async function runDaemon() {
         writeHeartbeat();
         monitorRunningJobs();
     }, MONITOR_TICK_MS);
-    // Cross-machine session sync: push this machine's transcripts to R2 and pull
-    // every other machine's, ~every 90s. Skipped silently when the r2.backups
-    // bundle is absent. An overlap guard prevents a slow cycle from stacking.
-    let syncing = false;
-    const runSessionSync = async () => {
-        if (syncing)
-            return;
-        syncing = true;
-        try {
-            const { isBetaEnabled } = await import('./beta.js');
-            // Off by default: session sync is an opt-in beta feature. Check the beta
-            // flag FIRST so a machine that hasn't opted in skips the keychain read
-            // (isSyncConfigured) entirely, not just the network cycle.
-            if (!isBetaEnabled('session-sync'))
-                return;
-            const { isSyncConfigured } = await import('./session/sync/config.js');
-            if (!isSyncConfigured())
-                return;
-            const { syncSessions } = await import('./session/sync/sync.js');
-            const r = await syncSessions();
-            if (r.pushed || r.pulled || r.errors.length) {
-                log('INFO', `sessions sync: pushed ${r.pushed}, pulled ${r.pulled}, merged ${r.merged}` +
-                    (r.errors.length ? `, ${r.errors.length} error(s): ${r.errors[0]}` : ''));
-            }
-            if (r.warnings.length)
-                log('WARN', `sessions sync: ${r.warnings[0]}`);
-        }
-        catch (err) {
-            log('ERROR', `sessions sync failed: ${err.message}`);
-        }
-        finally {
-            syncing = false;
-        }
-    };
-    const syncInterval = setInterval(() => { void runSessionSync(); }, 90_000);
-    void runSessionSync(); // kick once at startup
     // Resource safety check: heal gaps between what DotAgents repos define and
     // what's actually installed in each agent home — the slow rot that nothing
     // else catches (a non-default version left stale, a Claude-invalid plugin
@@ -875,27 +885,37 @@ export async function runDaemon() {
         catch (err) {
             log('WARN', `Project routines sync failed: ${err.message}`);
         }
-        scheduler.reloadAll();
-        const reloaded = scheduler.listScheduled();
-        log('INFO', `Reloaded ${reloaded.length} jobs`);
+        // Re-evaluate the scheduler.enabled gate: flipping the key takes effect on
+        // this reload, no daemon restart needed. A `routines add` on a re-enabled
+        // box signals exactly this reload, which boots the scheduler — the
+        // "Scheduler reloaded" it prints is then truthful, not a dead-end.
+        const transition = schedulerGateTransition(scheduler !== null, isSchedulerEnabled());
+        if (transition === 'boot') {
+            log('INFO', 'scheduler.enabled is now on — booting the scheduler');
+            bootScheduler();
+        }
+        else if (transition === 'stop') {
+            log('WARN', 'scheduler.enabled is now off — stopping the scheduler; no routines will fire on this device');
+            stopScheduler();
+        }
+        else if (transition === 'reload') {
+            scheduler.reloadAll();
+            const reloaded = scheduler.listScheduled();
+            log('INFO', `Reloaded ${reloaded.length} jobs`);
+        }
         try {
             monitorEngine.reload();
         }
         catch (err) {
             log('ERROR', `Monitor engine reload failed: ${err.message}`);
         }
-        // Drop the memoized R2 config so rotated/added sync credentials are re-read
-        // on the next cycle instead of waiting for a restart.
-        void import('./session/sync/config.js').then(m => m.clearR2ConfigCache());
     };
     const handleShutdown = async () => {
         log('INFO', 'Daemon shutting down');
-        scheduler.stopAll();
+        stopScheduler();
         monitorEngine.stop();
         await browserIPC.stop();
         clearInterval(monitorInterval);
-        clearInterval(catchupInterval);
-        clearInterval(syncInterval);
         clearInterval(healInterval);
         clearTimeout(healKickoff);
         clearInterval(autoDispatchInterval);

package/dist/lib/device-config.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Device/user config keys — typed read/write over the two-tier agents.yaml store.
+ *
+ * One registry (`CONFIG_KEYS`) maps each CLI dotted name to where it lives:
+ *   - user scope   → central `~/.agents/agents.yaml` under `config:` (syncs
+ *                    fleet-wide via `agents repo push/pull`)
+ *   - device scope → `~/.agents/devices/<host>/agents.yaml` under `config:`
+ *                    (per-machine; mirrors how `defaultBrowserProfile` is routed)
+ *
+ * This machine's keys go through the readMeta/updateMeta funnel (state.ts) so the
+ * partition/overlay logic stays the single writer. Another device's doc is
+ * read/written in place — the devices/ tree syncs via the DotAgents repo, so
+ * editing `devices/mac-mini/agents.yaml` locally is how `configure`/`note`
+ * target a peer (`--device`-style).
+ *
+ * `browser.profile` is NOT a `config:` key — it is the existing
+ * `Meta.defaultBrowserProfile` field; the registry entry documents the mapping
+ * and set/get route to it so there is one source of truth (no duplicate key).
+ *
+ * Unset always means today's behavior.
+ */
+/** Which tier of the agents.yaml store a key lives in. */
+export type ConfigScope = 'user' | 'device';
+/** Value type of a config key — drives validation and `--json` rendering. */
+export type ConfigType = 'string' | 'int' | 'bool' | 'string-list';
+/** One known config key. */
+export interface ConfigKeySpec {
+    /** CLI dotted name, e.g. `interactive.host`. */
+    name: string;
+    /** camelCase key under the YAML `config:` block. */
+    yamlKey: string;
+    scope: ConfigScope;
+    type: ConfigType;
+    /** One-line description for help/list output. */
+    description: string;
+    /**
+     * When set, the value lives in this top-level Meta field instead of the
+     * `config:` block (only `browser.profile` → `defaultBrowserProfile` today).
+     */
+    field?: 'defaultBrowserProfile';
+    /** Extra validation beyond the type check; return an error string or null. */
+    validate?: (value: unknown) => string | null;
+}
+/** A key with its resolved value and the layer that set it. */
+export interface ConfigEntry {
+    spec: ConfigKeySpec;
+    /** The stored value, or undefined when unset (unset = default behavior). */
+    value: unknown;
+    /** Which layer set it; undefined when unset. */
+    layer?: ConfigScope;
+}
+/** Options scoping a read/write to a specific device's doc (default: this machine). */
+export interface ConfigTarget {
+    device?: string;
+}
+export declare const CONFIG_KEYS: readonly ConfigKeySpec[];
+/** Look up a key spec by CLI dotted name, or throw listing the known keys. */
+export declare function configKeySpec(name: string): ConfigKeySpec;
+/** Get one config key's value and the layer that set it. */
+export declare function getConfigValue(name: string, opts?: ConfigTarget): ConfigEntry;
+/** List every known key with its value and the layer that set it. */
+export declare function listConfig(opts?: ConfigTarget): ConfigEntry[];
+/** Set a config key (validated). Device-scope keys target this machine unless `opts.device` names a peer. */
+export declare function setConfigValue(name: string, value: unknown, opts?: ConfigTarget): void;
+/** Unset a config key — restores default behavior. No-op when already unset. */
+export declare function unsetConfigValue(name: string, opts?: ConfigTarget): void;
+/** True unless this machine's device doc disables the routines scheduler. */
+export declare function isSchedulerEnabled(): boolean;
+/**
+ * Throw when the routines scheduler is disabled on this machine, naming the
+ * setting and the fix. The single message every scheduler-start surface
+ * (auto-start on `routines add`, manual `routines start`, the daemon's own
+ * scheduler init) refuses with.
+ */
+export declare function assertSchedulerEnabled(): void;
+/**
+ * Read the `agents.max-concurrent` cap for each named device from its synced
+ * device doc (no SSH). Devices without a cap are omitted — uncapped is the
+ * default. Used as an input to host ranking (teams placement, Factory
+ * auto-launch), never as a remote probe.
+ */
+export declare function readMaxConcurrentCaps(devices: string[]): Record<string, number>;