@phnx-labs/agents-cli 1.21.1 → 1.21.3

package/dist/lib/menubar/MenubarHelper.app/Contents/Info.plist

@@ -7,7 +7,9 @@
     <key>CFBundleIdentifier</key>
     <string>com.phnx-labs.agents-menubar</string>
     <key>CFBundleName</key>
-    <string>Agents Menu Bar</string>
+    <string>AGI Menu</string>
+    <key>CFBundleDisplayName</key>
+    <string>AGI Menu</string>
     <key>CFBundleIconFile</key>
     <string>AppIcon</string>
     <key>CFBundlePackageType</key>

package/dist/lib/menubar/install-menubar.d.ts

@@ -40,10 +40,17 @@ export declare function codesignVerifies(appPath: string): boolean;
  * bootstrap a helper macOS would reject.
  */
 export declare function gatekeeperAssesses(appPath: string): boolean;
+/** True when the bundle carries a Developer ID TeamIdentifier (not ad-hoc). */
+export declare function hasDeveloperIdSignature(appPath: string): boolean;
 /**
  * Copy the bundled `.app` to the stable user path (idempotent unless forced).
  * Returns the installed executable path, or null if no source bundle ships
  * with this install (e.g. Linux package, or a build without the helper).
+ *
+ * Also heals an older install that was ad-hoc re-signed over a Developer ID
+ * source: that unstable identity made Accessibility re-prompt on every upgrade.
+ * When the shipped source is Developer ID and the installed copy is only
+ * ad-hoc, replace it — even without forceReinstall.
  */
 export declare function ensureMenubarAppInstalled(opts?: {
     forceReinstall?: boolean;

package/dist/lib/menubar/install-menubar.js

@@ -205,10 +205,25 @@ export function gatekeeperAssesses(appPath) {
     const r = spawnSync('spctl', ['--assess', '--type', 'exec', appPath], { stdio: ['ignore', 'ignore', 'ignore'] });
     return r.status === 0;
 }
+/** True when the bundle carries a Developer ID TeamIdentifier (not ad-hoc). */
+export function hasDeveloperIdSignature(appPath) {
+    const r = spawnSync('codesign', ['-dv', '--verbose=4', appPath], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        encoding: 'utf-8',
+    });
+    const out = `${r.stderr || ''}${r.stdout || ''}`;
+    const team = out.match(/TeamIdentifier=([A-Z0-9]+)/)?.[1];
+    return Boolean(team && team !== 'not set');
+}
 /**
  * Copy the bundled `.app` to the stable user path (idempotent unless forced).
  * Returns the installed executable path, or null if no source bundle ships
  * with this install (e.g. Linux package, or a build without the helper).
+ *
+ * Also heals an older install that was ad-hoc re-signed over a Developer ID
+ * source: that unstable identity made Accessibility re-prompt on every upgrade.
+ * When the shipped source is Developer ID and the installed copy is only
+ * ad-hoc, replace it — even without forceReinstall.
  */
 export function ensureMenubarAppInstalled(opts = {}) {
     if (!onDarwin())
@@ -218,7 +233,11 @@ export function ensureMenubarAppInstalled(opts = {}) {
         return null;
     const dest = installedAppPath();
     if (!opts.forceReinstall && fs.existsSync(dest)) {
-        return installedExecutablePath();
+        const sourceIsDevId = hasDeveloperIdSignature(src);
+        const destIsDevId = hasDeveloperIdSignature(dest);
+        if (!(sourceIsDevId && !destIsDevId)) {
+            return installedExecutablePath();
+        }
     }
     copyAppBundle(src, dest);
     // A fresh copy is exactly when the bundle's icon can be new (first install) or
@@ -325,7 +344,7 @@ export function enableMenubarService(opts = { clearOptOut: true }) {
     // this passes; if it ever doesn't, skip the service and point at the upgrade
     // rather than re-signing over it (an ad-hoc re-sign never satisfies Gatekeeper).
     if (!(codesignVerifies(installedAppPath()) && gatekeeperAssesses(installedAppPath()))) {
-        process.stderr.write('agents: menu-bar helper is not notarized/valid on this machine; skipping launch. ' +
+        process.stderr.write('agents: AGI Menu is not notarized/valid on this machine; skipping launch. ' +
             'Upgrade to a notarized build (npm i -g @phnx-labs/agents-cli), then `agents menubar setup`.\n');
         return false;
     }
@@ -472,8 +491,10 @@ export function installMenubarLaunchAgentOnUpgrade() {
         }
         // Re-enable (recopy helper + rewrite plist) when the version drifted OR the
         // plist's baked interpreter/entry no longer point at the install now running
-        // `agents` — the dual-install skew a version bump alone can't catch.
-        if (menubarSetupStale() || menubarSetupNeedsRepoint()) {
+        // `agents` — the dual-install skew a version bump alone can't catch — OR the
+        // installed copy is still ad-hoc while the shipped source is Developer ID
+        // (older heal path; Accessibility re-prompts until the identity is restored).
+        if (menubarSetupStale() || menubarSetupNeedsRepoint() || installedNeedsDevIdHeal()) {
             enableMenubarService({ clearOptOut: false });
         }
     }
@@ -481,6 +502,15 @@ export function installMenubarLaunchAgentOnUpgrade() {
         /* never block startup on the menu bar */
     }
 }
+/** True when App Support still has an ad-hoc copy but the npm bundle is Developer ID. */
+function installedNeedsDevIdHeal() {
+    const src = sourceAppPath();
+    if (!src || !fs.existsSync(installedAppPath()))
+        return false;
+    if (hasDeveloperIdSignature(installedAppPath()))
+        return false;
+    return hasDeveloperIdSignature(src);
+}
 /**
  * Decide which live helper processes must be ended so exactly one status item
  * survives. Pure so the choice is unit-testable without a live menu bar.
@@ -521,12 +551,12 @@ export function runMenubarSetup() {
         steps.push({ name, outcome, detail });
     };
     if (!onDarwin()) {
-        step('platform', 'failed', `the menu bar helper is macOS only (this is ${process.platform})`);
+        step('platform', 'failed', `AGI Menu is macOS only (this is ${process.platform})`);
         return { steps, configured: false, status: getMenubarStatus() };
     }
     const before = getMenubarStatus();
     if (!sourceAppPath()) {
-        step('bundle', 'failed', 'no menu-bar helper bundle ships with this install');
+        step('bundle', 'failed', 'no AGI Menu bundle ships with this install');
         return { steps, configured: false, status: before };
     }
     // 3 before 1: end the running copies BEFORE swapping the bundle underneath

package/dist/lib/percentile.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Percentile of a sorted-ascending array, linear interpolation. p in [0,100].
+ *
+ * Deliberately its own file with zero imports: `perf/db.ts` (the SQLite
+ * warehouse), `hooks/profile.ts` (the legacy JSONL hook profile), and
+ * `routines.ts` (routineStats) all need this exact formula, but `routines.ts`
+ * and `hooks/profile.ts` must NOT pull in `perf/db.ts`'s `../sqlite.js`
+ * dependency just to round a percentile — sqlite is a heavier, perf-warehouse-
+ * specific dependency that has no business loading into every routines- or
+ * hooks-touching code path.
+ */
+export declare function percentile(sorted: number[], p: number): number;

package/dist/lib/percentile.js

@@ -0,0 +1,24 @@
+/**
+ * Percentile of a sorted-ascending array, linear interpolation. p in [0,100].
+ *
+ * Deliberately its own file with zero imports: `perf/db.ts` (the SQLite
+ * warehouse), `hooks/profile.ts` (the legacy JSONL hook profile), and
+ * `routines.ts` (routineStats) all need this exact formula, but `routines.ts`
+ * and `hooks/profile.ts` must NOT pull in `perf/db.ts`'s `../sqlite.js`
+ * dependency just to round a percentile — sqlite is a heavier, perf-warehouse-
+ * specific dependency that has no business loading into every routines- or
+ * hooks-touching code path.
+ */
+export function percentile(sorted, p) {
+    if (sorted.length === 0)
+        return 0;
+    if (sorted.length === 1)
+        return sorted[0];
+    const rank = (p / 100) * (sorted.length - 1);
+    const lo = Math.floor(rank);
+    const hi = Math.ceil(rank);
+    if (lo === hi)
+        return sorted[lo];
+    const frac = rank - lo;
+    return sorted[lo] * (1 - frac) + sorted[hi] * frac;
+}

package/dist/lib/perf/db.d.ts

@@ -8,16 +8,20 @@ import Database from '../sqlite.js';
 import type { AggregateOptions, PerfAggregateRow } from './types.js';
 export type { AggregateOptions, PerfAggregateRow, PerfSample } from './types.js';
 export { recordSample, shortSessionId, resolveSpoolPath } from './spool.js';
+export { percentile } from '../percentile.js';
 export declare const PERF_SCHEMA_VERSION = 1;
 export declare const DEFAULT_RETENTION_DAYS = 30;
 /** Test seam — redirect the warehouse path (like AGENTS_EVENTS_PATH). */
 export declare function _resetPerfDbForTest(overridePath?: string | null): void;
 /** Drain the NDJSON spool into samples. Idempotent; truncates on success. */
 export declare function drainSpool(db?: Database.Database): number;
-/** Percentile of a sorted-ascending array. p in [0,100]. */
-export declare function percentile(sorted: number[], p: number): number;
 /**
- * Aggregate samples by (kind, label) with p50/p99. Drains the spool first.
+ * Aggregate samples by (kind, label) with p50/p95/p99. Drains the spool first.
+ *
+ * `opts.project` scopes the query to samples whose recorded `cwd` resolves to
+ * that project key (see project-key.ts) — resolution runs per unique cwd
+ * (memoized) rather than per row, since `resolveProjectKey` does a filesystem
+ * walk and a warehouse query can carry many rows sharing the same cwd.
  */
 export declare function aggregateSamples(opts?: AggregateOptions): PerfAggregateRow[];
 export declare function perfDbPath(): string;

package/dist/lib/perf/db.js

@@ -9,8 +9,11 @@ import * as path from 'path';
 import Database from '../sqlite.js';
 import { getPerfDbPath, getPerfDir } from '../state.js';
 import { localMachineId } from '../session/origin-machine.js';
+import { resolveProjectKey } from '../project-key.js';
+import { percentile } from '../percentile.js';
 import { resolveSpoolPath, shortSessionId, _resetPerfSpoolForTest } from './spool.js';
 export { recordSample, shortSessionId, resolveSpoolPath } from './spool.js';
+export { percentile } from '../percentile.js';
 export const PERF_SCHEMA_VERSION = 1;
 export const DEFAULT_RETENTION_DAYS = 30;
 const SCHEMA = `
@@ -185,22 +188,13 @@ function maybeRetain(db) {
         // ignore
     }
 }
-/** Percentile of a sorted-ascending array. p in [0,100]. */
-export function percentile(sorted, p) {
-    if (sorted.length === 0)
-        return 0;
-    if (sorted.length === 1)
-        return sorted[0];
-    const rank = (p / 100) * (sorted.length - 1);
-    const lo = Math.floor(rank);
-    const hi = Math.ceil(rank);
-    if (lo === hi)
-        return sorted[lo];
-    const frac = rank - lo;
-    return sorted[lo] * (1 - frac) + sorted[hi] * frac;
-}
 /**
- * Aggregate samples by (kind, label) with p50/p99. Drains the spool first.
+ * Aggregate samples by (kind, label) with p50/p95/p99. Drains the spool first.
+ *
+ * `opts.project` scopes the query to samples whose recorded `cwd` resolves to
+ * that project key (see project-key.ts) — resolution runs per unique cwd
+ * (memoized) rather than per row, since `resolveProjectKey` does a filesystem
+ * walk and a warehouse query can carry many rows sharing the same cwd.
  */
 export function aggregateSamples(opts = {}) {
     const db = openDb();
@@ -228,14 +222,29 @@ export function aggregateSamples(opts = {}) {
         clauses.push('agent = ?');
         params.push(opts.agent);
     }
-    const rows = db.prepare(`SELECT kind, label, duration_ms, cache, exit_code
+    const rows = db.prepare(`SELECT kind, label, duration_ms, cache, exit_code, status, cwd
      FROM samples WHERE ${clauses.join(' AND ')}`).all(...params);
+    // Memoize cwd -> project key: resolveProjectKey walks the filesystem for
+    // a repo root, and many rows in one warehouse query share the same cwd.
+    const projectCache = new Map();
+    const projectForCwd = (cwd) => {
+        if (!cwd)
+            return undefined;
+        let key = projectCache.get(cwd);
+        if (key === undefined && !projectCache.has(cwd)) {
+            key = resolveProjectKey(cwd);
+            projectCache.set(cwd, key);
+        }
+        return key;
+    };
     const map = new Map();
     for (const r of rows) {
+        if (opts.project && projectForCwd(r.cwd) !== opts.project)
+            continue;
         const key = `${r.kind}\0${r.label}`;
         let b = map.get(key);
         if (!b) {
-            b = { kind: r.kind, label: r.label, durations: [], hits: 0, stale: 0, misses: 0, errors: 0 };
+            b = { kind: r.kind, label: r.label, durations: [], hits: 0, stale: 0, misses: 0, errors: 0, timeouts: 0 };
             map.set(key, b);
         }
         b.durations.push(Number(r.duration_ms));
@@ -245,7 +254,9 @@ export function aggregateSamples(opts = {}) {
             b.stale++;
         else if (r.cache === 'miss' || r.cache === 'none')
             b.misses++;
-        if (typeof r.exit_code === 'number' && r.exit_code !== 0)
+        if (r.status === 'timeout')
+            b.timeouts++;
+        else if (typeof r.exit_code === 'number' && r.exit_code !== 0)
             b.errors++;
     }
     const out = [];
@@ -260,6 +271,7 @@ export function aggregateSamples(opts = {}) {
             label: b.label,
             n,
             p50Ms: Math.round(percentile(sorted, 50)),
+            p95Ms: Math.round(percentile(sorted, 95)),
             p99Ms: Math.round(percentile(sorted, 99)),
             meanMs: Math.round(sum / n),
             maxMs: sorted[n - 1],
@@ -270,8 +282,14 @@ export function aggregateSamples(opts = {}) {
             row.cacheStalePct = Math.round((b.stale / n) * 100);
             row.cacheMissPct = Math.round((b.misses / n) * 100);
         }
-        if (b.errors > 0)
+        if (b.errors > 0) {
             row.errorCount = b.errors;
+            row.errorRate = Math.round((b.errors / n) * 1000) / 1000;
+        }
+        if (b.timeouts > 0)
+            row.timeoutRate = Math.round((b.timeouts / n) * 1000) / 1000;
+        if (opts.project)
+            row.project = opts.project;
         out.push(row);
     }
     out.sort((a, b) => b.p99Ms - a.p99Ms);

package/dist/lib/perf/types.d.ts

@@ -26,6 +26,7 @@ export interface PerfAggregateRow {
     label: string;
     n: number;
     p50Ms: number;
+    p95Ms: number;
     p99Ms: number;
     meanMs: number;
     maxMs: number;
@@ -34,6 +35,13 @@ export interface PerfAggregateRow {
     cacheStalePct?: number;
     cacheMissPct?: number;
     errorCount?: number;
+    /** Fraction (0-1) of samples with a nonzero exit code. */
+    errorRate?: number;
+    /** Fraction (0-1) of samples with status:'timeout'. */
+    timeoutRate?: number;
+    /** Project key (see project-key.ts) the row is scoped to — set only when
+     *  the `project` filter narrowed the query to one project. */
+    project?: string;
 }
 export interface AggregateOptions {
     days?: number;
@@ -42,4 +50,6 @@ export interface AggregateOptions {
     machine?: string;
     agent?: string;
     minN?: number;
+    /** Scope results to samples whose cwd resolves to this project key. */
+    project?: string;
 }

package/dist/lib/plugins.js

@@ -14,7 +14,7 @@ import * as yaml from 'yaml';
 import { execFileSync } from 'child_process';
 import { getPluginsDir, getTrashPluginsDir, getExtraPluginsDir, getProjectPluginsDir, getSystemPluginsDir } from './state.js';
 import { IS_WINDOWS, isWindowsAbsolutePath, homeDir } from './platform/index.js';
-import { assertSafeGitTransport } from './git.js';
+import { assertSafeGitTransport, resolveSnapshotSha } from './git.js';
 import { listInstalledVersions, getVersionHomePath } from './versions.js';
 import { AGENTS, agentConfigDirName } from './agents.js';
 import { capableAgents, isCapable } from './capabilities.js';
@@ -90,6 +90,13 @@ export function discoverPlugins(opts = {}) {
     return out;
 }
 export function buildDiscoveredPlugin(pluginRoot, manifest, spec = { kind: 'user' }) {
+    // Every marketplace kind lays plugins out as `<repo>/plugins/<name>`, so the
+    // repo root is always the grandparent of pluginRoot — true for user
+    // (~/.agents), system (~/.agents/.system), each extra repo, and the project
+    // repo (<cwd>/.agents) alike. Deriving it here means every caller of
+    // buildDiscoveredPlugin (discoverPluginsInDir, inspectPluginCapabilities, …)
+    // gets provenance for free with no signature change.
+    const repoRoot = path.dirname(path.dirname(pluginRoot));
     return {
         name: manifest.name,
         root: pluginRoot,
@@ -107,6 +114,10 @@ export function buildDiscoveredPlugin(pluginRoot, manifest, spec = { kind: 'user
         monitors: discoverPluginMonitors(pluginRoot),
         hasMcp: fs.existsSync(path.join(pluginRoot, '.mcp.json')),
         hasSettings: pluginHasNonPermissionSettings(pluginRoot),
+        repoRoot,
+        get snapshotSha() {
+            return resolveSnapshotSha(repoRoot);
+        },
     };
 }
 /**

package/dist/lib/project-doctor.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Definition-vs-reality checks for `agents projects`.
+ *
+ * A project definition is hand-editable YAML that nothing validates against the
+ * world it describes, so it can drift into being confidently wrong. The one that
+ * bit for real: `repo:` said `<user>/agents-cli` while the checkout's `origin`
+ * was `phnx-labs/agents-cli`. Both are real repositories, so nothing errored —
+ * the card's merged-PR and release lines simply reported a stranger's repo (0
+ * merges in 7 days instead of 100). A wrong answer that looks like a right one
+ * is worse than a missing one, so the mismatch gets said out loud wherever the
+ * def is shown.
+ *
+ * Findings carry their own fix, mirroring `DoctorFinding.remediation`
+ * (`lib/devices/doctor-findings.ts`) — a warning the reader has to go work out
+ * how to act on is half a warning. Pure: the caller supplies the observed
+ * remote, so this is unit-testable with no git and no fixture repo.
+ */
+import type { ProjectDef } from './projects.js';
+/** A definition that disagrees with the machine it describes. */
+export interface ProjectFinding {
+    project: string;
+    /** One line naming the disagreement, both sides quoted. */
+    message: string;
+    /** The exact command that fixes it. */
+    remediation: string;
+}
+/**
+ * Compare a def's `repo` slug against the checkout's real `origin` remote.
+ *
+ * - remote unreadable (no checkout on this machine, not a git repo) → no
+ *   finding. The def may be perfectly right; this machine just can't say.
+ * - def has no `repo` → a finding only when a remote exists to adopt, so the
+ *   fix is a real one-liner rather than a nag.
+ * - they disagree → a finding. This is the case that silently lies.
+ */
+export declare function checkRepoSlug(def: ProjectDef, actualRemote: string | undefined): ProjectFinding | undefined;

package/dist/lib/project-doctor.js

@@ -0,0 +1,45 @@
+/**
+ * Definition-vs-reality checks for `agents projects`.
+ *
+ * A project definition is hand-editable YAML that nothing validates against the
+ * world it describes, so it can drift into being confidently wrong. The one that
+ * bit for real: `repo:` said `<user>/agents-cli` while the checkout's `origin`
+ * was `phnx-labs/agents-cli`. Both are real repositories, so nothing errored —
+ * the card's merged-PR and release lines simply reported a stranger's repo (0
+ * merges in 7 days instead of 100). A wrong answer that looks like a right one
+ * is worse than a missing one, so the mismatch gets said out loud wherever the
+ * def is shown.
+ *
+ * Findings carry their own fix, mirroring `DoctorFinding.remediation`
+ * (`lib/devices/doctor-findings.ts`) — a warning the reader has to go work out
+ * how to act on is half a warning. Pure: the caller supplies the observed
+ * remote, so this is unit-testable with no git and no fixture repo.
+ */
+/**
+ * Compare a def's `repo` slug against the checkout's real `origin` remote.
+ *
+ * - remote unreadable (no checkout on this machine, not a git repo) → no
+ *   finding. The def may be perfectly right; this machine just can't say.
+ * - def has no `repo` → a finding only when a remote exists to adopt, so the
+ *   fix is a real one-liner rather than a nag.
+ * - they disagree → a finding. This is the case that silently lies.
+ */
+export function checkRepoSlug(def, actualRemote) {
+    if (!actualRemote)
+        return undefined;
+    if (def.repo === actualRemote)
+        return undefined;
+    const fix = `agents projects set ${def.name} --repo ${actualRemote}`;
+    if (!def.repo) {
+        return {
+            project: def.name,
+            message: `no repo set; origin is ${actualRemote}`,
+            remediation: fix,
+        };
+    }
+    return {
+        project: def.name,
+        message: `repo is ${def.repo} but origin is ${actualRemote} — PR and release counts are being read from the wrong repository`,
+        remediation: fix,
+    };
+}

package/dist/lib/project-import.d.ts

@@ -63,8 +63,18 @@ export declare function validateImportOpts(flags: RawImportFlags): ImportOptions
  * `repoSlug`→`repo`, `linearProjectId`→`linear.projectId`), now gated on the
  * row's `confidence`. A row with no confidence field is a guess with no stated
  * strength, so it ranks below every floor and only `--all` takes it.
+ *
+ * `resolveRemote` reads the checkout's actual `origin` and OVERRIDES the row's
+ * `repoSlug`. Factory derives that slug from the checkout path's last two
+ * segments (`apps/factory/src/core/projectIndex.ts:19-26`), which is only right
+ * when the directory tree happens to mirror the GitHub org. It commonly does
+ * not: a checkout at `~/src/github.com/<you>/agents-cli` whose remote is
+ * `phnx-labs/agents-cli` imported as `<you>/agents-cli` — a real, different
+ * repo — so the card's merged-PR and release lines silently reported a
+ * stranger's repository instead of failing. The remote is the only authority on
+ * which repo a checkout is; the path is a guess about it.
  */
-export declare function buildFactoryImportCandidates(rows: unknown[], existing: Map<string, ProjectDef>, opts: Pick<ImportOptions, 'minConfidence' | 'force'>): ImportPlan;
+export declare function buildFactoryImportCandidates(rows: unknown[], existing: Map<string, ProjectDef>, opts: Pick<ImportOptions, 'minConfidence' | 'force'>, resolveRemote?: (root: string) => string | undefined): ImportPlan;
 /**
  * Turn a Linear project name into a definition slug: lowercase, every run of
  * unusable characters collapsed to one `-`, trimmed of leading/trailing

package/dist/lib/project-import.js

@@ -60,8 +60,18 @@ export function validateImportOpts(flags) {
  * `repoSlug`→`repo`, `linearProjectId`→`linear.projectId`), now gated on the
  * row's `confidence`. A row with no confidence field is a guess with no stated
  * strength, so it ranks below every floor and only `--all` takes it.
+ *
+ * `resolveRemote` reads the checkout's actual `origin` and OVERRIDES the row's
+ * `repoSlug`. Factory derives that slug from the checkout path's last two
+ * segments (`apps/factory/src/core/projectIndex.ts:19-26`), which is only right
+ * when the directory tree happens to mirror the GitHub org. It commonly does
+ * not: a checkout at `~/src/github.com/<you>/agents-cli` whose remote is
+ * `phnx-labs/agents-cli` imported as `<you>/agents-cli` — a real, different
+ * repo — so the card's merged-PR and release lines silently reported a
+ * stranger's repository instead of failing. The remote is the only authority on
+ * which repo a checkout is; the path is a guess about it.
  */
-export function buildFactoryImportCandidates(rows, existing, opts) {
+export function buildFactoryImportCandidates(rows, existing, opts, resolveRemote = () => undefined) {
     const floor = CONFIDENCE_RANK[opts.minConfidence];
     const defs = [];
     const skipped = [];
@@ -97,8 +107,12 @@ export function buildFactoryImportCandidates(rows, existing, opts) {
         const def = { name };
         if (typeof o.path === 'string')
             def.root = toHomeRelative(o.path);
-        if (typeof o.repoSlug === 'string')
-            def.repo = o.repoSlug;
+        // The checkout's own remote wins over the registry's path-derived guess;
+        // the guess is the fallback for a path with no git remote to ask.
+        const fromRemote = typeof o.path === 'string' ? resolveRemote(o.path) : undefined;
+        const repo = fromRemote ?? (typeof o.repoSlug === 'string' ? o.repoSlug : undefined);
+        if (repo)
+            def.repo = repo;
         if (typeof o.linearProjectId === 'string')
             def.linear = { projectId: o.linearProjectId };
         defs.push(def);

package/dist/lib/project-status.d.ts

@@ -54,11 +54,25 @@ export interface ProjectSessionRollup {
  * with the full definition list to show zero-agent projects.
  */
 export declare function rollupSessionsByProject(defs: ProjectDef[], sessions: ActiveSession[]): Map<string, ProjectSessionRollup>;
-/** Plan completion percentage (0–100), or undefined when nothing is tracked. */
-export declare function planPct(plan: {
-    done: number;
-    total: number;
-}): number | undefined;
+/** Live vs finished sessions on a project. */
+export interface LiveDeadSplit {
+    live: number;
+    dead: number;
+    /** Dead broken out by status, for the card's parenthetical. */
+    deadByStatus: Array<{
+        status: string;
+        n: number;
+    }>;
+}
+/**
+ * Split a rollup's sessions into what is working and what is wreckage.
+ *
+ * The headline used to be the raw session count, which on a real project read
+ * `39 agents` when 19 of those had crashed. A count that is half corpses is not
+ * a throughput signal — but the corpses are worth their own number, because 19
+ * crashed sessions is itself a thing to go fix.
+ */
+export declare function liveDeadSplit(byStatus: Partial<Record<ActiveStatus, number>>): LiveDeadSplit;
 /** Sort members for the card: running first, then idle, then the rest; agent name asc within a state. */
 export declare function sortProjectMembers(members: ProjectMember[]): ProjectMember[];
 /** Cap for the members line before it collapses to `+N more`. */
@@ -77,6 +91,12 @@ export interface ProjectRemoteSignals {
     windowDays: number;
     /** PRs merged into the primary repo within the window (via `gh`). */
     mergedPrs: number;
+    /**
+     * True when the `gh` fetch cap cut the count short — `mergedPrs` is then a
+     * LOWER bound (rendered `100+`), never presented as the complete count. Same
+     * contract `LinearProjectCounts.truncated` keeps for the Linear line.
+     */
+    mergedPrsTruncated?: boolean;
     /** Artifacts agents produced within the window (activity.created milestones). */
     artifacts: number;
     /** Basename of the most recent artifact, when any. */

package/dist/lib/project-status.js

@@ -17,6 +17,13 @@ import chalk from 'chalk';
 import { projectNameForCwd } from './projects.js';
 import { readRecentActivity } from './activity.js';
 const execFileAsync = promisify(execFile);
+/**
+ * How many recent merges `gh` is asked for. A repo busy enough that all of them
+ * land inside the window has more than this — agents-cli itself merged 100 of
+ * its 100 most recent PRs within 7 days — so the count is reported as a lower
+ * bound rather than as a total.
+ */
+const MERGED_PR_LIMIT = 100;
 function blank(name) {
     return {
         name,
@@ -77,11 +84,40 @@ export function rollupSessionsByProject(defs, sessions) {
     }
     return map;
 }
-/** Plan completion percentage (0–100), or undefined when nothing is tracked. */
-export function planPct(plan) {
-    if (plan.total <= 0)
-        return undefined;
-    return Math.round((plan.done / plan.total) * 100);
+/**
+ * Statuses that mean the session is over. Taken from the repo's own rule
+ * (`commands/sessions.ts`): "`closed` and `crashed` are unconditionally dead".
+ * `orphaned` is NOT among them — `session/active.ts` defines it as "Alive, but
+ * no client is attached", i.e. the agent outlived its window and is still
+ * working. Counting it as dead understates the project by exactly the sessions
+ * that are running unattended.
+ */
+const DEAD_STATUSES = new Set(['closed', 'crashed']);
+/**
+ * Split a rollup's sessions into what is working and what is wreckage.
+ *
+ * The headline used to be the raw session count, which on a real project read
+ * `39 agents` when 19 of those had crashed. A count that is half corpses is not
+ * a throughput signal — but the corpses are worth their own number, because 19
+ * crashed sessions is itself a thing to go fix.
+ */
+export function liveDeadSplit(byStatus) {
+    let live = 0;
+    let dead = 0;
+    const deadByStatus = [];
+    for (const [status, n] of Object.entries(byStatus)) {
+        if (!n)
+            continue;
+        if (DEAD_STATUSES.has(status)) {
+            dead += n;
+            deadByStatus.push({ status, n });
+        }
+        else {
+            live += n;
+        }
+    }
+    deadByStatus.sort((a, b) => b.n - a.n || a.status.localeCompare(b.status));
+    return { live, dead, deadByStatus };
 }
 /**
  * Display order for the members line: the states a human scans for first
@@ -158,9 +194,15 @@ export async function enrichProjectSignals(def, windowDays, nowMs, opts = {}) {
     }
     if (def.repo && !opts.skipRemote) {
         try {
-            const { stdout } = await execFileAsync('gh', ['pr', 'list', '--repo', def.repo, '--state', 'merged', '--json', 'number,mergedAt', '--limit', '100'], { timeout: 8000, encoding: 'utf8' });
+            const { stdout } = await execFileAsync('gh', ['pr', 'list', '--repo', def.repo, '--state', 'merged', '--json', 'number,mergedAt', '--limit', String(MERGED_PR_LIMIT)], { timeout: 8000, encoding: 'utf8' });
             const rows = JSON.parse(stdout);
             out.mergedPrs = rows.filter((r) => r.mergedAt && Date.parse(r.mergedAt) >= sinceMs).length;
+            // `--limit 100` caps the fetch, so a busy repo where every one of the 100
+            // most recent merges falls inside the window has MORE than 100 — this repo
+            // really does. Say so (`100+`) rather than presenting a cap as a count,
+            // the same contract `LinearProjectCounts.truncated` already keeps.
+            if (rows.length >= MERGED_PR_LIMIT && out.mergedPrs >= MERGED_PR_LIMIT)
+                out.mergedPrsTruncated = true;
         }
         catch {
             /* gh missing / unauthenticated / repo not found — skip this signal */

package/dist/lib/resources.d.ts

@@ -16,6 +16,22 @@ export interface ResolvedResource {
      * or the alias name (e.g. 'rush') for extra repos registered in agents.yaml.
      */
     source: string;
+    /**
+     * Absolute path to the DotAgents repo root this resource resolved from (the
+     * project/user/system/extra-repo dir — one level above the `kind`
+     * subdirectory). DotAgents repos are git-tracked (plugins.ts), so this pairs
+     * with {@link snapshotSha} to answer "which commit of which repo".
+     */
+    repoRoot: string;
+    /**
+     * Short HEAD sha of `repoRoot`'s git checkout, lazily resolved (a getter,
+     * not computed at construction) and memoized per repoRoot
+     * (`git.ts` `resolveSnapshotSha`) — a caller that never inspects provenance
+     * never pays for the git shell-out, and resolving many resources from the
+     * same repo pays for exactly one. `undefined` when `repoRoot` isn't a git
+     * repo (or has no commits).
+     */
+    readonly snapshotSha: string | undefined;
 }
 /**
  * True when `rawName` (a filename with its extension already stripped) names a