@phnx-labs/agents-cli 1.21.2 → 1.22.0

package/CHANGELOG.md

@@ -1,5 +1,106 @@
 # Changelog
 
+## 1.22.0
+
+- **`agents run auto` — full-auto dispatch (RUSH-2132).** `run auto` composes all three routing layers: host (14d launch affinity, unless `--host` is given), harness (installed CLIs weighted by best-account headroom), and account (the configured strategy). `balanced`/`available` now exit nonzero when every installed account is unhealthy — naming each excluded account, the earliest window reset, and the `--strategy pinned` escape hatch — instead of warning "falling back to defaults" and launching the exhausted pinned default. The error text is a machine-readable contract (`no healthy` + `resets <iso-time>`) the Factory watchdog tail-detects for rotate cooldowns. Source: `apps/cli/src/lib/rotate.ts`, `apps/cli/src/commands/exec.ts`, `apps/cli/src/lib/runner.ts`.
+
+- **Bash-command summaries are faster and recognize more of what actually ran (#1830).**
+  `classifyBashCommand` (behind `agents sessions` / `agents activity` summaries) tokenized
+  the *entire* command — every pipeline segment, multi-KB heredoc bodies included — just to
+  read the leading executable, costing up to ~1ms on a big `cat <<HEREDOC …`. It now
+  tokenizes only the head of the first simple command. Coverage gaps that dumped commands
+  into a raw `other` pile are closed too: a `cd` prefix separated by `;` or a newline (not
+  just `&&`) unwraps to the real command, a path/tilde executable
+  (`~/.agents/skills/linear/scripts/linear`) resolves by basename, and the repo's own
+  toolchain (`agents`, `linear`, plus `rmdir`) is recognized — `agents` was the single top
+  unrecognized token. `ag` stays the silver searcher, not an `agents` alias. Source:
+  `apps/cli/src/lib/session/bash-command.ts`.
+
+- **`agents computer describe` now counts toward `usedComputer`.** Every other
+  verb (`click`, `type`, `key`, `screenshot`, `run`, …) fires the
+  `computer.action` event via `emitComputerAction`; `describe` never did, so a
+  session that only ran `agents computer describe` read back
+  `usedComputer=false` — a false-negative in the sessions preview. A new
+  completeness-guard test pins every registered `agents computer` verb command
+  to a matching `emitComputerAction` call so a future verb can't ship the same
+  gap silently. Source: `apps/cli/src/commands/computer-actions.ts`,
+  `apps/cli/src/commands/computer-actions.test.ts`.
+
+- **Pick a model by cost tier — `--model cheap|default|best|ultra` — on `agents run` and `agents teams add`.** Instead of a concrete id that churns per release and differs per harness, a tier resolves per `(harness, installed version)` to a model that version actually ships, ranked by the provider's own lineup (`opus/sonnet/haiku/fable`; Codex "frontier/balanced/fast" → Sol/Terra/Luna), then price, then size tokens. Single-model harnesses (Grok) map the tiers to reasoning effort; Droid uses a curated credit-multiplier map capped at 2x. An unsupported tier clamps to the nearest lower one; an unresolvable tier drops the flag and falls back to the harness default. Concrete model ids keep working unchanged. `agents models [agent[@version]]` now prints the per-harness tier map (with `~$/Mtok` where priced) and emits `tiers` in `--json`, and Droid joins the model-capable set. Also fixes the Claude catalog extractor returning 0 models on the newest native-binary format (a fallback id scan), and refreshes `prices.json` with the GPT-5.6 Sol/Terra/Luna series. Source: `apps/cli/src/lib/model-tiers.ts`, `apps/cli/src/lib/models.ts`, `apps/cli/src/lib/exec.ts`, `apps/cli/src/commands/models.ts`, `apps/cli/docs/model-tiers.md`.
+
+- **`agents projects status` says what was worked on and what the dates prove.** Two new lines.
+  `focus` ranks the directories the window's commits landed in, read from the local checkout
+  with `git log --name-only` — no API call, no credential, no rate-limit budget, measured at
+  0.23s over a 897-commit week. Changelog fragments and lockfiles are excluded from the
+  ranking: this repo files one fragment per PR, so `.changelog` otherwise ranked second and
+  presented PR count as an area of focus. `schedule` states what the milestone dates prove —
+  `overdue by N days`, `due in N days`, `N milestones, no issues filed against any`, or
+  `none dated`. Source: `apps/cli/src/lib/project-focus.ts`, `project-schedule.ts`.
+- **The schedule line will never say "on track".** That verdict needs either project start and
+  target dates to interpolate expected progress, or a scope-history series to extrapolate a
+  finish date. Probed against a live workspace, all of them are absent (`health: null`,
+  `startDate`/`targetDate` null, `scopeHistory` and `completedScopeHistory` empty), so an
+  on-track or at-risk chip would be fabricated — and a confident wrong answer on a status card
+  is unfalsifiable from the card. When a human posts a Linear project health update, it is
+  relayed and attributed (`per Linear: atRisk`), never synthesized.
+
+- **The `--device`/`--host` auto-reconnect loop no longer trusts a remote-origin exit code of 255 as "the SSH link dropped."** `reattachRemoteSession`'s `connected` flag is set as soon as the fast SSH preflight probe succeeds, before the actual reattach runs — so if the remote command it drives (`agents sessions focus <id> --local --attach-only`) ever exited 255 for a reason that had nothing to do with the SSH transport, that would be indistinguishable from the link itself dropping, refill the retry budget every cycle, and loop forever — printing "attempt 1/6" on every cycle and leaving the terminal full of aborted-TTY escape codes. The remote invocation is now wrapped in `bash -lc` so that whatever exit code it decides on, a 255 is remapped to 254 before this process sees it, closing that gap in the exit-code channel regardless of which remote-side path or peer `agents` version might produce it. A genuinely recurring *local* SSH failure can still refill the retry budget on every attempt by design (unchanged, tracked separately: phnx-labs/agents-cli#1884). Source: `apps/cli/src/lib/hosts/reconnect.ts`.
+
+- **`agents sessions` can query distinct tool calls and count static Bash program occurrences locally or across the fleet.** Use `--include tools`, repeat `--query` with `tool:`, `program:`, `input:`, `output:`, `status:`, `exit:`, or `error:` fields, and add `--fleet` for live SSH fan-out. `--count` reports exact occurrence, containing-call, and session totals from ordered `wrapper`/`effective` rows without reparsing; synced mirrors are partitioned by origin so fleet evidence and totals do not duplicate sessions. Historical parsing is explicit and resumable through `agents sessions backfill tools`; normal scans index new and changed sessions once. Codex orchestration wrappers are parsed statically so only literal `tools.exec_command` commands reach the Bash AST, never wrapper code. Each device keeps a redacted, bounded relational SQLite/FTS5 cache, queries perform no transcript I/O or index writes, and no embeddings, vector database, or model calls are used. A sampling script explicitly backfills then extracts redacted shell-command origins from 50–100 sessions over the last seven days into a 16 MiB maximum artifact.
+
+- **Local team worktrees base on freshly-fetched `origin/<default>`, not `HEAD`.**
+  `createWorktree` (and `agents worktree provision` for new branches) now
+  `git fetch origin` then `worktree add -b … origin/<default>`, matching
+  `createRemoteWorktree`. Previously local teammates forked from the
+  orchestrator's current `HEAD`, so a stale checkout made every teammate write
+  on old code and only surface the conflict at merge. Source:
+  `apps/cli/src/lib/teams/worktree.ts`, `apps/cli/src/commands/worktree.ts`,
+  `apps/cli/docs/teams.md`.
+
+## 1.21.3
+
+- **`agents projects import --from-factory` stops printing raw git errors.** Reading each
+  checkout's real remote is done per registry row, and a checkout with no `origin` makes git
+  write `error: No such remote 'origin'` straight to the terminal — its own stderr, which the
+  surrounding try/catch never sees. Importing 12 rows printed two of them between the progress
+  lines. The probe now discards git's stderr; an absent remote is an expected answer, not
+  something to report. Source: `apps/cli/src/commands/projects.ts`.
+
+- **Sessions now track browser/computer tool use and skill/plugin/slash-command
+  usage, queryable with `agents sessions --skill <name>` / `--plugin <name>`.**
+  `browser.navigate`, `browser.screenshot`, and a new `computer.action` event
+  fire on every `agents browser`/`agents computer` action, carrying session
+  identity for free. The sessions index persists `usedBrowser`/`usedComputer`
+  (from a scoped events-log read, not a transcript re-scan) and a new
+  `session_resource_usage` table records every skill and slash-command
+  invocation with its owning plugin, source repo, and git commit — resolved
+  against `resolveResource()`/`discoverPlugins()` at scan time. The sessions
+  picker preview surfaces both as `browser`/`computer` and `Skills:` tags.
+  Source: `apps/cli/src/lib/browser/service.ts`, `apps/cli/src/commands/computer-actions.ts`,
+  `apps/cli/src/lib/session/db.ts`, `apps/cli/src/lib/session/highlights.ts`,
+  `apps/cli/src/lib/session/discover.ts`, `apps/cli/src/commands/sessions.ts`.
+- **`ResolvedResource` and `DiscoveredPlugin` carry provenance: `repoRoot` and a
+  lazily-resolved `snapshotSha`.** Every resource/plugin resolution can now
+  answer "which DotAgents repo, which commit" without an extra lookup; the git
+  shell-out is memoized per repo root and only runs when a caller actually
+  reads `snapshotSha`. Source: `apps/cli/src/lib/resources.ts`,
+  `apps/cli/src/lib/plugins.ts`, `apps/cli/src/lib/git.ts`.
+- **`SessionEvent.slashCommand` captures a typed or model-invoked slash command**
+  (both the `<command-name>` wrapper and the `SlashCommand` tool call), and
+  `agents sessions`'s perf sample for `command.end` now carries the session id
+  and agent instead of being anonymous. Source: `apps/cli/src/lib/session/prompt.ts`,
+  `apps/cli/src/lib/session/parse.ts`, `apps/cli/src/index.ts`.
+- **`agents routines status` no longer reports "stopped" for a live scheduler, and
+  `agents routines start` can't spawn a second one.** The daemon writes its pid file
+  once (on claim/start) but rewrites the heartbeat every tick. If the pid file was lost
+  while the daemon kept ticking — an earlier status check clearing a stale/reused pid, or
+  the file removed out from under a live daemon — `status` read only the pid file and
+  reported `stopped` for a scheduler that was in fact running and firing jobs, while
+  `claimDaemonInstance()` would start a concurrent `JobScheduler` that double-fires every
+  routine. `isDaemonRunning()` and the single-instance claim now also trust a fresh
+  heartbeat whose pid is alive, re-adopting the pid file to heal the desync.
+  Source: `apps/cli/src/lib/daemon.ts`.
+
 ## 1.21.2
 
 - **`agents trends` — resource and session analytics dashboard.** Baked recipes

package/README.md

@@ -161,7 +161,18 @@ agents run claude@
 agents run codex@ "review this branch"
 ```
 
-`--strategy balanced` spreads work across available versions of the same agent -- useful when you have multiple accounts and want to avoid burning through one.
+`--strategy balanced` spreads work across available versions of the same agent -- useful when you have multiple accounts and want to avoid burning through one. When every account is rate-limited, the run exits nonzero naming each excluded account and the earliest window reset (use `--strategy pinned` to force the default) -- it never launches into an exhausted account.
+
+### Don't care which harness? `agents run auto`
+
+```bash
+# Picks the host (14d usage affinity), the harness (installed CLIs weighted by
+# best-account headroom), and the account (balanced) -- all three layers.
+agents run auto "summarize recent commits"
+agents run auto --host yosemite-s0 "fix the flaky test"   # pin the host layer
+```
+
+`run auto` excludes any harness whose accounts are all rate-limited or signed out, and exits nonzero with the earliest reset time when nothing anywhere is healthy.
 
 A trailing `@` opens an account picker before either an interactive or prompt-based run. Each installed version shows its account identity, exact version, login state, plan, and every available session, weekly, or monthly limit. Logged-out, rate-limited, and out-of-credit accounts remain visible with the reason they cannot be selected; signed-in accounts whose provider does not expose quota data stay selectable and say `limits unavailable`. The choice pins only that run and does not change your default version.
 
@@ -244,11 +255,26 @@ agents sessions a1b2c3d4 --markdown
 
 # Just the last 3 turns, user messages only
 agents sessions a1b2c3d4 --last 3 --include user
+
+# Calls in recent Codex sessions on one device
+agents sessions --include tools --agent codex --device mac-mini --since 7d
+
+# One session where two different calls match; query every online device
+agents sessions --include tools \
+  --query 'program:git input:merge' \
+  --query 'program:gh output:CONFLICT' \
+  --fleet --json
+
+# Count pre-indexed static git sites, containing calls, and sessions
+agents sessions --include tools --query 'program:git' --count --fleet --json
+
+# Populate historical tool rows once on each device
+agents sessions backfill tools --fleet
 ```
 
 Interactive picker when you're in a terminal. Structured output (`--json`, `--markdown`, filtered by role or turn count) when piped.
 
-Backed by a SQLite + FTS5 index at `~/.agents/.history/sessions/sessions.db` with incremental scanning -- warm reads in ~100ms. External tools can consume `--json` output as a programmatic observability layer; see [docs/05-sessions.md](apps/cli/docs/05-sessions.md) for the schema and [docs/06-observability.md](apps/cli/docs/06-observability.md) for the consumption patterns.
+Backed by a SQLite + FTS5 index at `~/.agents/.history/sessions/sessions.db` with incremental scanning -- warm reads in ~100ms. Tool-call evidence is redacted and bounded before it is cached; repeated `--query` clauses must match distinct calls in one session. Tool queries read SQLite only: `agents sessions backfill tools` performs the one-time historical parse, while normal incremental scans index new and changed sessions. The index stores ordered static Bash program sites, so `--count` reports occurrences, containing tool calls, and distinct sessions without reparsing. `--fleet` executes one origin partition per device, so synced mirrors cannot duplicate compact evidence or counts returned over SSH; transcript bodies stay on their origin machine. This uses relational SQLite rows and literal FTS5 only, with no embeddings, vector database, or model calls. External tools can consume `--json` output as a programmatic observability layer; see [docs/05-sessions.md](apps/cli/docs/05-sessions.md) for the schemas and [docs/06-observability.md](apps/cli/docs/06-observability.md) for the consumption patterns.
 
 ### Live state, and catching up fast
 
@@ -1095,9 +1121,12 @@ Conversations with Claude, Codex, legacy Gemini, and other agents scatter across
 ```bash
 agents sessions "auth middleware"     # Full-text search across all agents
 agents sessions --agent claude --since 7d
+agents sessions --include tools --query 'program:git' --fleet --json
+agents sessions --include tools --query 'program:git' --count --fleet --json
+agents sessions backfill tools --fleet
 ```
 
-The index lives at `~/.agents/.history/sessions/sessions.db` (SQLite + FTS5). Nothing leaves your machine. See [Sessions](#sessions-across-agents) for full usage.
+The index lives at `~/.agents/.history/sessions/sessions.db` (SQLite + FTS5). A local query stays on the machine; an explicit `--fleet` tool query sends only redacted, bounded match evidence or aggregate counts over SSH. Historical tool parsing is explicit via `sessions backfill tools`; queries never parse transcripts. See [Sessions](#sessions-across-agents) for full usage.
 
 ### Secrets
 

package/dist/commands/computer-actions.d.ts

@@ -82,4 +82,8 @@ export declare function shouldRaise(opts: {
 }): boolean;
 export declare function appPathIsElectron(appPath: string | null, exists?: (p: string) => boolean): boolean;
 export declare function electronWebviewTip(appLabel: string): string;
+export declare function emitComputerAction(verb: string, targetPid: number | undefined, opts: {
+    bundle?: string;
+    host?: string;
+}, extra?: Record<string, unknown>): void;
 export declare function registerActionCommands(program: Command): void;

package/dist/commands/computer-actions.js

@@ -11,6 +11,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { openComputerClient, describeTransport, resolvePolicyPath, } from '../lib/computer-rpc.js';
 import { COMPUTER_INPUT_GATED_VERBS, formatComputerPermissionGrantHint, } from '../lib/permissions.js';
+import { emit as emitEvent } from '../lib/events.js';
 function isComputerInputVerb(verb) {
     return typeof verb === 'string' && COMPUTER_INPUT_GATED_VERBS.includes(verb);
 }
@@ -350,6 +351,22 @@ function emit(result, json, human) {
         console.log(human());
     }
 }
+// Record one `computer.action` per verb invocation, one call site per command
+// below. Session/agent/machine identity is stamped for free by emitEvent's
+// provenance floor (events.ts resolveProvenance) — this only carries the
+// action-specific facts: which verb, against which target pid/bundle/host.
+// NOTE: the field is `targetPid`, never `pid` — `pid` is a reserved envelope
+// key (the emitting process's OWN pid, events.ts RESERVED_META_KEYS) that
+// sanitizePayload() silently strips from the payload before it can collide.
+export function emitComputerAction(verb, targetPid, opts, extra = {}) {
+    emitEvent('computer.action', {
+        command: verb,
+        targetPid,
+        bundle: opts.bundle,
+        host: opts.host,
+        ...extra,
+    });
+}
 // Add the shared --pid/--bundle/--host target options to a verb. `--host` routes
 // the verb at a remote Windows device: the `computer` preAction hook hydrates
 // COMPUTER_HELPER_TCP from the tunnel `start --host` recorded, so withClient's
@@ -376,6 +393,7 @@ export function registerActionCommands(program) {
         await withClient(async (client) => {
             const res = unwrap(await client.call('list_apps'));
             const list = res.apps || [];
+            emitComputerAction('apps', undefined, opts);
             emit(res, Boolean(opts.json), () => list.length === 0
                 ? '(no allow-listed apps running)'
                 : list
@@ -395,6 +413,7 @@ export function registerActionCommands(program) {
             if (opts.depth != null)
                 params.max_depth = opts.depth;
             const res = unwrap(await client.call('describe', params));
+            emitComputerAction('describe', pid, opts, { depth: opts.depth });
             // The tree is inherently structured — always JSON, pretty unless --json.
             console.log(JSON.stringify(opts.json ? res : res.tree ?? res, null, 2));
         });
@@ -422,6 +441,7 @@ export function registerActionCommands(program) {
             if (opts.background)
                 params.background = true;
             const res = unwrap(await client.call('click', params));
+            emitComputerAction('click', pid, opts, { id: opts.id, count: opts.count });
             emit(res, Boolean(opts.json), () => `clicked (${res.action ?? 'ok'})`);
         });
     });
@@ -440,6 +460,7 @@ export function registerActionCommands(program) {
             }
             await applyFocusPolicy(client, pid, opts);
             const res = unwrap(await client.call('right_click', { pid, ...spec.params }));
+            emitComputerAction('right-click', pid, opts, { id: opts.id });
             emit(res, Boolean(opts.json), () => `right-clicked (${res.method ?? 'ok'})`);
         });
     });
@@ -466,6 +487,8 @@ export function registerActionCommands(program) {
             if (opts.allowSecureField)
                 params.allow_secure_field = true;
             const res = unwrap(await client.call('type', params));
+            // textLength, never the text itself — users type passwords/secrets into fields.
+            emitComputerAction('type', pid, opts, { id: opts.id, textLength: opts.text.length, committed: Boolean(res.committed) });
             emit(res, Boolean(opts.json), () => `typed ${opts.text.length} char(s)${res.committed ? ' (committed)' : ''}`);
         });
     });
@@ -493,6 +516,7 @@ export function registerActionCommands(program) {
                 params.char_delay_ms = charDelay;
             const res = unwrap(await client.call('type_text', params));
             warnIfNotFrontmost(res);
+            emitComputerAction('type-text', pid, opts, { textLength: opts.text.length, committed: Boolean(opts.commit) });
             emit(res, Boolean(opts.json), () => `typed ${res.chars ?? opts.text.length} char(s)`);
         });
     });
@@ -513,6 +537,7 @@ export function registerActionCommands(program) {
                 params.require_frontmost = true;
             const res = unwrap(await client.call('key', params));
             warnIfNotFrontmost(res);
+            emitComputerAction('key', pid, opts, { keys: opts.keys });
             emit(res, Boolean(opts.json), () => `sent ${opts.keys}`);
         });
     });
@@ -548,6 +573,7 @@ export function registerActionCommands(program) {
             if (opts.background)
                 params.background = true;
             const res = unwrap(await client.call('drag', params));
+            emitComputerAction('drag', pid, opts, { from: opts.from, to: opts.to });
             emit(res, Boolean(opts.json), () => `dragged ${opts.from} -> ${opts.to} (${res.method ?? 'ok'})`);
         });
     });
@@ -574,6 +600,7 @@ export function registerActionCommands(program) {
             if (opts.dx != null)
                 params.dx = opts.dx;
             const res = unwrap(await client.call('scroll', params));
+            emitComputerAction('scroll', pid, opts, { id: opts.id, dx: opts.dx, dy: opts.dy });
             emit(res, Boolean(opts.json), () => `scrolled (${res.method ?? 'ok'})`);
         });
     });
@@ -587,6 +614,7 @@ export function registerActionCommands(program) {
         await withClient(async (client) => {
             const pid = await resolveTargetPid(client, opts, { verb: 'ax-action' });
             const res = unwrap(await client.call('ax_action', { pid, element_id: opts.id, action: opts.action }));
+            emitComputerAction('ax-action', pid, opts, { id: opts.id, action: opts.action });
             emit(res, Boolean(opts.json), () => `performed ${opts.action}`);
         });
     });
@@ -599,6 +627,7 @@ export function registerActionCommands(program) {
         await withClient(async (client) => {
             const pid = await resolveTargetPid(client, opts, { verb: 'focus' });
             const res = unwrap(await client.call('set_focus', { pid, element_id: opts.id }));
+            emitComputerAction('focus', pid, opts, { id: opts.id });
             emit(res, Boolean(opts.json), () => `focused ${opts.id}`);
         });
     });
@@ -615,6 +644,7 @@ export function registerActionCommands(program) {
         await withClient(async (client) => {
             const pid = await resolveTargetPid(client, opts, { verb: 'raise' });
             const res = unwrap(await client.call('focus_window', { pid, ...buildRaiseParams(opts) }));
+            emitComputerAction('raise', pid, opts, { windowId: opts.windowId, title: opts.title });
             emit(res, Boolean(opts.json), () => {
                 const scope = res.raised_window ? `window ${res.title ?? res.window_id ?? ''}`.trim() : 'app';
                 return `raised ${scope} (${res.focus_elapsed_ms ?? 0}ms)`;
@@ -644,6 +674,9 @@ export function registerActionCommands(program) {
             if (params.duration_ms == null)
                 params.pid = await resolveTargetPid(client, opts, { verb: 'wait' });
             const res = unwrap(await client.call('wait', params));
+            emitComputerAction('wait', params.pid, opts, {
+                until: opts.until, durationMs: opts.duration, satisfied: Boolean(res.satisfied),
+            });
             emit(res, Boolean(opts.json), () => res.satisfied ? `satisfied (${res.waited_ms}ms)` : `timed out (${res.waited_ms}ms)`);
         });
     });
@@ -662,6 +695,7 @@ export function registerActionCommands(program) {
             if (opts.maxChars != null)
                 params.max_chars = opts.maxChars;
             const res = unwrap(await client.call('get_text', params));
+            emitComputerAction('get-text', pid, opts, { id: opts.id });
             emit(res, Boolean(opts.json), () => String(res.text ?? ''));
         });
     });
@@ -688,6 +722,7 @@ export function registerActionCommands(program) {
             if (opts.name)
                 params.name = opts.name;
             const res = unwrap(await client.call('launch_app', params));
+            emitComputerAction('launch', res.pid, opts, { path: opts.path, name: opts.name });
             emit(res, Boolean(opts.json), () => `launched ${res.name} (pid ${res.pid})`);
         });
     });

package/dist/commands/computer.js

@@ -7,7 +7,7 @@ import { openComputerClient, resolveHelperApp, resolveHelperExec, resolveSocketP
 import { setupRemoteHelper, startRemoteTunnel, stopRemoteHelper, hydrateRemoteEnvFromState, readRemoteState, resolveRemoteDevice, REMOTE_TASK_NAME, WIN_HELPER_EXE, } from '../lib/ssh-tunnel.js';
 import { sshExec } from '../lib/ssh-exec.js';
 import { encodePowershell } from '../lib/hosts/remote-cmd.js';
-import { registerActionCommands, withClient, unwrap, pickTarget } from './computer-actions.js';
+import { registerActionCommands, withClient, unwrap, pickTarget, emitComputerAction } from './computer-actions.js';
 import { runComputerLoop } from '../lib/computer/loop.js';
 import { makeVerbDispatcher } from '../lib/computer/dispatch.js';
 import { makeClaudeResponder, resolveApiKey, DEFAULT_CLAUDE_MODEL, DEFAULT_CLAUDE_BASE_URL } from '../lib/computer/model.js';
@@ -301,7 +301,7 @@ function registerRunCommand(program) {
             maxTokens: opts.maxTokens,
         });
         await withClient(async (client) => {
-            const dispatch = makeVerbDispatcher(client);
+            const dispatch = makeVerbDispatcher(client, { host: opts.host });
             const targetInput = opts.bundle ? { bundle: opts.bundle } : {};
             const result = await runComputerLoop({
                 task: opts.task,
@@ -375,6 +375,7 @@ function registerScreenshotCommand(program) {
             // --list: enumerate windows, no image.
             if (opts.list) {
                 const res = unwrap(await client.call('screenshot', { pid, list: true }));
+                emitComputerAction('screenshot', pid, opts, { list: true });
                 const windows = res.windows || [];
                 if (opts.json) {
                     console.log(JSON.stringify(res, null, 2));
@@ -402,6 +403,7 @@ function registerScreenshotCommand(program) {
                 console.error('helper returned no image_data');
                 process.exit(1);
             }
+            emitComputerAction('screenshot', pid, opts, { display: opts.display, windowId: opts.windowId });
             const buf = Buffer.from(b64, 'base64');
             // Sniff the real format and correct the extension so the filename never
             // lies about its bytes (macOS -> JPEG, Windows helper -> PNG).

package/dist/commands/exec.d.ts

@@ -7,6 +7,7 @@
  */
 import { type Command } from 'commander';
 import type { ExecEffort } from '../lib/exec.js';
+import { RUN_AUTO_KEYWORD } from '../lib/types.js';
 import { type SshGResult } from '../lib/hosts/ssh-config.js';
 export interface RunAccountPickerRequest {
     requested: boolean;
@@ -41,6 +42,32 @@ export declare function runAccountPickerConflicts(options: {
     on?: string;
     computer?: string;
 }): string[];
+export { RUN_AUTO_KEYWORD };
+/**
+ * Whether `run auto` should default its host layer to the affinity pick (the
+ * same machinery as `--device auto`). False when the caller pinned any host
+ * flag, and false when this process was itself dispatched by a host run — the
+ * dispatcher exports AGENTS_RUN_AUTO_HOST_RESOLVED=1 into the remote SHELL
+ * (hosts/dispatch.ts remoteRunShellPrelude) because it already resolved the
+ * host layer, and re-picking here would chain-hop the run across the fleet.
+ * Pure so the pinning matrix is unit-testable.
+ */
+export declare function runAutoDefaultsToAffinity(options: {
+    host?: string;
+    device?: string;
+    on?: string;
+    computer?: string;
+}, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Whether an interactive host dispatch must mint a correlation launch id and
+ * resolve the remote session via the launch-id join (RUSH-2034), rather than
+ * trusting a pre-known session id. `run auto` ALWAYS joins: the harness is
+ * picked on the remote, so an explicit --session-id is only adopted when the
+ * pick lands on claude — pre-registering it would strand a stale session-index
+ * entry naming an id a non-claude pick never used (RUSH-2132). Pure so the
+ * decision matrix is unit-testable.
+ */
+export declare function hostInteractiveNeedsCorrelationId(runAgent: string, hostSessionId: string | undefined, resumeId: string | undefined): boolean;
 /** The host descriptor fields the `--copy-creds` security gate reads. */
 export interface CopyCredsGateHost {
     name: string;

package/dist/commands/exec.js

@@ -7,6 +7,7 @@
  */
 import { Option } from 'commander';
 import chalk from 'chalk';
+import { RUN_AUTO_KEYWORD } from '../lib/types.js';
 import { setHelpSections } from '../lib/help.js';
 import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
 import { getUserAgentsDir } from '../lib/state.js';
@@ -66,6 +67,39 @@ export function runAccountPickerConflicts(options) {
 function isValidAgent(agent) {
     return agent in AGENTS;
 }
+// Reserved `<agent>` keyword for `agents run auto` — canonical definition in
+// lib/types.ts (shared with the host dispatch layer); re-exported here.
+export { RUN_AUTO_KEYWORD };
+/**
+ * Whether `run auto` should default its host layer to the affinity pick (the
+ * same machinery as `--device auto`). False when the caller pinned any host
+ * flag, and false when this process was itself dispatched by a host run — the
+ * dispatcher exports AGENTS_RUN_AUTO_HOST_RESOLVED=1 into the remote SHELL
+ * (hosts/dispatch.ts remoteRunShellPrelude) because it already resolved the
+ * host layer, and re-picking here would chain-hop the run across the fleet.
+ * Pure so the pinning matrix is unit-testable.
+ */
+export function runAutoDefaultsToAffinity(options, env = process.env) {
+    if (hostTargetGiven(options).length > 0)
+        return false;
+    return env.AGENTS_RUN_AUTO_HOST_RESOLVED !== '1';
+}
+/**
+ * Whether an interactive host dispatch must mint a correlation launch id and
+ * resolve the remote session via the launch-id join (RUSH-2034), rather than
+ * trusting a pre-known session id. `run auto` ALWAYS joins: the harness is
+ * picked on the remote, so an explicit --session-id is only adopted when the
+ * pick lands on claude — pre-registering it would strand a stale session-index
+ * entry naming an id a non-claude pick never used (RUSH-2132). Pure so the
+ * decision matrix is unit-testable.
+ */
+export function hostInteractiveNeedsCorrelationId(runAgent, hostSessionId, resumeId) {
+    if (resumeId)
+        return false;
+    if (runAgent === RUN_AUTO_KEYWORD)
+        return true;
+    return !hostSessionId && isSessionTrackedAgent(runAgent);
+}
 /** Build a one-line banner describing which version the strategy picked. */
 function formatRotationBanner(result, verb = 'balanced') {
     const { picked, healthy, excluded } = result;
@@ -483,7 +517,7 @@ export function registerRunCommand(program) {
         .description('Execute an agent. Pass a prompt for headless runs; omit it to launch the agent interactively.')
         .option('-m, --mode <mode>', 'How much the agent can do: plan (read-only), edit (can write files), auto (smart classifier auto-approves safe ops, prompts for risky), skip (bypass all permission prompts). \'full\' accepted as alias for skip.', 'plan')
         .option('-e, --effort <effort>', 'Reasoning effort: low | medium | high | xhigh | max | auto (claude and codex only)', 'auto')
-        .option('--model <model>', 'Override the model directly (e.g., claude-opus-4-6)')
+        .option('--model <model>', 'Cost tier (cheap|default|best|ultra) or a concrete model id; tiers resolve per harness+version to a supported model')
         .option('--env <key=value>', 'Pass environment variable to the agent (repeatable, e.g., --env DEBUG=1 --env API_KEY=xyz)', (val, prev) => [...prev, val], [])
         .option('--secrets <bundle>', 'Inject a secrets bundle (repeatable). Values resolve from macOS Keychain at run time. See `agents secrets`.', (val, prev) => [...prev, val], [])
         .option('--no-auto-secrets', 'Skip auto-injection of secrets declared by a workflow\'s frontmatter `secrets:` field. Has no effect on bare-agent runs.')
@@ -561,6 +595,11 @@ export function registerRunCommand(program) {
       # Pick a signed-in account/version for only this run
       agents run claude@
 
+      # Full-auto: affinity-pick the host, then the harness with the most
+      # account headroom, then a balanced account on it
+      agents run auto "fix the flaky test" --mode edit
+      agents run auto --host yosemite-s0 "fix the flaky test"   # pin the host
+
       # Open the session in a terminal tab — detected from where your sessions
       # already run (Ghostty / iTerm / Terminal.app); force one with a value
       agents run claude --terminal
@@ -599,6 +638,13 @@ export function registerRunCommand(program) {
         balanced   distribute load across healthy accounts by remaining capacity (default)
         A version/account is skipped when it is rate-limited right now — any usage window (incl. the 5-hour session window) at 100%, matching the 'agents view' badge.
         --balanced is shorthand for --strategy balanced. Ignored when @version is pinned, when a profile is used, or with --fallback.
+        Zero healthy accounts under balanced/available exits nonzero naming each
+        excluded account and the earliest window reset — use --strategy pinned to force.
+
+      'auto' harness (agents run auto): picks the host (14d usage affinity,
+      unless --host is given), the harness (installed CLIs weighted by
+      best-account headroom), and the account (the strategy above). Zero
+      healthy accounts on any harness exits nonzero with the earliest reset.
 
       Account picker: append @ with no version (agents run claude@) to choose one
         installed account for this run. Rows show identity, login state, plan,
@@ -682,6 +728,32 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
         }
+        // `agents run auto`: the reserved harness keyword — full-auto dispatch
+        // (host affinity → cross-harness balance → account balance, RUSH-2132).
+        if (normalizedAgentSpec.split('@')[0] === RUN_AUTO_KEYWORD && normalizedAgentSpec !== RUN_AUTO_KEYWORD) {
+            console.error(chalk.red(`agents run auto picks the harness itself — a @version pin does not apply. ` +
+                `Pin a concrete harness instead: agents run <harness>@<version>.`));
+            process.exit(1);
+        }
+        const autoHarnessRequested = normalizedAgentSpec === RUN_AUTO_KEYWORD;
+        if (autoHarnessRequested) {
+            // `auto` is reserved. If a future harness registers that id, the
+            // keyword collides — fail loud rather than silently shadow the harness.
+            if (RUN_AUTO_KEYWORD in AGENTS) {
+                console.error(chalk.red(`'${RUN_AUTO_KEYWORD}' is now a registered harness and collides with the reserved 'run auto' keyword. ` +
+                    `Run the harness by name instead.`));
+                process.exit(1);
+            }
+            if (accountPickerRequested) {
+                console.error(chalk.red(`agents run auto picks the harness and account itself — the trailing-@ account picker needs a concrete harness (agents run <harness>@).`));
+                process.exit(1);
+            }
+            // Host layer: with no explicit --host/--device, default to the
+            // affinity pick. Skipped on a host-dispatched run — its dispatcher
+            // already resolved this layer (see runAutoDefaultsToAffinity).
+            if (runAutoDefaultsToAffinity(options))
+                options.device = 'auto';
+        }
         // --device auto / --host auto (and deprecated --smart): affinity-pick host.
         // Harness is always the agent the user typed — never auto-picked.
         // Affinity failure degrades to local (does not kill the run).
@@ -1062,6 +1134,10 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             const hostName = hostGiven[0];
+            // Note: a `run auto` dispatch needs no marker forwarded from here — the
+            // dispatch layer (hosts/dispatch.ts remoteRunShellPrelude) exports the
+            // chain-hop guard into the remote shell for BOTH interactive and
+            // headless paths, keyed off the agent name being `auto`.
             const { resolveHostRunTarget, resolveHostSessionId, dispatchPromptToHost, HostResolutionError } = await import('../lib/hosts/run-target.js');
             const { runInteractiveOnHost } = await import('../lib/hosts/dispatch.js');
             const { registerInteractiveHostSession } = await import('../lib/hosts/session-index.js');
@@ -1242,11 +1318,16 @@ export function registerRunCommand(program) {
                     // the stream we resolve the id by one ssh read of the remote hook
                     // record — the same launch-id join used locally (RUSH-2034). Not
                     // needed for Claude (id forced) or resume (id already known).
-                    const correlationLaunchId = !hostSessionId && !resumeId && isSessionTrackedAgent(runAgent) ? randomUUID() : undefined;
+                    // `run auto` ALWAYS joins: the remote picks the harness, so an
+                    // explicit --session-id is only adopted by a claude pick.
+                    const correlationLaunchId = hostInteractiveNeedsCorrelationId(runAgent, hostSessionId, resumeId) ? randomUUID() : undefined;
                     const hostEnv = correlationLaunchId
                         ? [...options.env, `AGENT_LAUNCH_ID=${correlationLaunchId}`]
                         : options.env;
-                    if (hostSessionId) {
+                    // `run auto` never pre-registers: the explicit id is only real when
+                    // the remote pick lands on claude. The launch-id join below records
+                    // the id the remote ACTUALLY used, whatever the pick.
+                    if (hostSessionId && runAgent !== RUN_AUTO_KEYWORD) {
                         registerInteractiveHostSession({
                             cwd: process.cwd(),
                             host: host.name,
@@ -1316,7 +1397,11 @@ export function registerRunCommand(program) {
                     // re-attach the live pane automatically instead of exiting — the user
                     // never has to notice the drop and `agents sessions focus` by hand.
                     // `raw` runs aren't tmux wrapped, so there is nothing to reconnect to.
-                    const reconnectId = hostSessionId ?? resolvedRemoteId ?? resumeId;
+                    // For `run auto` prefer the join-resolved id (the harness the remote
+                    // ACTUALLY picked) over the explicit --session-id only claude adopts.
+                    const reconnectId = (runAgent === RUN_AUTO_KEYWORD
+                        ? resolvedRemoteId ?? hostSessionId
+                        : hostSessionId ?? resolvedRemoteId) ?? resumeId;
                     if (reconnectId && !isRaw) {
                         const { reconnectInteractiveSession, SSH_CONN_FAILURE } = await import('../lib/hosts/reconnect.js');
                         if (exitCode === SSH_CONN_FAILURE) {
@@ -1482,7 +1567,7 @@ export function registerRunCommand(program) {
                 await warnUnpushedWork(resumeExec.cwd ?? process.cwd());
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported, isHeadlessSecretsContext }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports }, { shareRuntimeEnv },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported, isHeadlessSecretsContext }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports }, { shareRuntimeEnv },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
@@ -1537,7 +1622,28 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
         }
-        if (isValidAgent(rawAgent)) {
+        if (autoHarnessRequested) {
+            // Harness layer (RUSH-2132): weighted pick across installed harnesses
+            // by best-account headroom. Zero healthy accounts anywhere fails loud
+            // — launching a default "because it's there" is how a rotate loop
+            // hammers an exhausted account.
+            const byHarness = await collectHarnessCandidates();
+            const harnessPick = pickHarnessWeighted(byHarness);
+            if (!harnessPick) {
+                console.error(chalk.red(formatNoHealthyHarnessError(classifyHarnessCandidates(byHarness))));
+                process.exit(1);
+            }
+            agent = harnessPick.picked.agent;
+            if (!options.quiet) {
+                process.stderr.write(chalk.gray(formatHarnessPickBanner(harnessPick) + '\n'));
+            }
+            // --session-id keeps its claude-only semantics: honored when auto
+            // picks claude, ignored (loudly) otherwise.
+            if (options.sessionId && agent !== 'claude' && !options.quiet) {
+                process.stderr.write(chalk.yellow(`[agents] --session-id ignored: auto picked ${agent} (only claude accepts a forced session id)\n`));
+            }
+        }
+        else if (isValidAgent(rawAgent)) {
             agent = rawAgent;
         }
         else if (profileExists(rawAgent)) {
@@ -1929,6 +2035,15 @@ export function registerRunCommand(program) {
             else {
                 try {
                     const resolved = await resolveRunVersion(agent, strategy, cwd);
+                    if (resolved.exhausted) {
+                        // Fail loud (RUSH-2132): the old behavior warned "found no
+                        // usable version; falling back to defaults" and launched the
+                        // pinned default anyway — the exact move that loops a rotate
+                        // into an exhausted account. The message text is a contract
+                        // the Factory watchdog tail-detects; do not reword it.
+                        console.error(chalk.red(formatNoHealthyAccountError(agent, strategy, resolved.exhausted)));
+                        process.exit(1);
+                    }
                     if (resolved.version) {
                         version = resolved.version;
                         rotationResult = resolved.rotation;
@@ -1938,6 +2053,8 @@ export function registerRunCommand(program) {
                         }
                     }
                     else if (!options.quiet) {
+                        // No installed version at all (not "accounts exhausted" — that
+                        // fails loud above): keep the pre-existing default resolution.
                         process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} found no usable ${agent} version; falling back to defaults\n`));
                     }
                 }