@phnx-labs/agents-cli 1.22.0 → 1.22.3

package/CHANGELOG.md

@@ -1,5 +1,120 @@
 # Changelog
 
+## 1.22.3
+
+- **Menubar home-base self-test accepts `MenubarHelper-universal`.** The
+  signed-helper gate required `executablePath` to end in exactly `MenubarHelper`,
+  but lipo production builds name the binary `MenubarHelper-universal`, so every
+  1.22.2 publish on mac-mini failed after the release PR had already merged and
+  tagged. Source: `menubar/Sources/MenubarHelper/ChildProcessSelfTest.swift`.
+
+## 1.22.2
+
+- **Menu bar recovers from a stale single-instance lock instead of staying dead.**
+  The helper's lock fd is now opened `O_CLOEXEC`, so a spawned `doctor` child can
+  never inherit it and hold the `menubar.lock` flock after the helper crashes; and
+  `SingleInstance.acquire` now self-heals — when the flock is held but no live
+  `MenubarHelper` owns it (a leaked orphan / dead pid), it reaps the orphan and
+  retries rather than exiting as "already running". Previously a leaked orphan
+  bricked the menu bar until reboot. The headless Swift self-tests (single-instance
+  + child-process) now run as a build gate (`menubar/scripts/test-menubar.sh`),
+  which nothing invoked before. Source: `apps/cli/menubar/Sources/MenubarHelper/SingleInstance.swift`.
+
+- **`agents projects` definitions can now carry goals — the OKR-shaped "why".**
+  A project serves one or more `goals[]`, each an `objective` (the outcome) plus an
+  optional `measure` (the key result). Set them at scaffold time with
+  `agents projects add <name> --goal "objective:measure"` (repeatable), replace them
+  later with `agents projects set <name> --goal …`, or hand-edit the YAML. Goals show
+  on the `status` card (compact) and in `projects view` (in full), and survive a
+  `--from-linear` re-import like every other hand-set field. Milestones (pulled from
+  Linear) remain the dated checkpoints toward these goals. Source:
+  `apps/cli/src/lib/projects.ts`, `apps/cli/src/commands/projects.ts`.
+
+- **Balanced rotation no longer picks version homes that only inherit the active login.**
+  `getAccountInfo` falls back to the active/global HOME credential so `agents view`
+  still shows who is signed in when a version home has no auth file of its own.
+  Launch paths isolate config (`GROK_HOME`, `CODEX_HOME`, …) to the per-version home,
+  so those empty homes died at spawn with "Not signed in" after balanced picked them
+  (observed: `grok@0.2.118` with no `auth.json` looking signed-in via `~/.grok` →
+  `0.2.32`). Rotation now requires a real per-version credential when we know where
+  it lives (`credentialPresence.perVersion`). Source: `src/lib/rotate.ts`
+  (`isLaunchableSignedIn`, `collectRunCandidates`).
+
+- **A `never`-policy secrets bundle now actually stays silent — no more Touch ID for a bundle you set to silent, and no more double prompt.** Two bugs made `agents secrets policy <b> never` a lie. (1) The command rewrote only the bundle *metadata*, never the value items — but macOS gates each read on the item's own ACL, not the tier label, so a bundle created under `hold`/`always` kept its biometry ACL and kept popping Touch ID forever after the switch. `policy` now reconciles the value items to the new tier (`reAclBundleItems`): tightening to `never` re-stores them no-ACL (a single last prompt to read them once), and loosening back re-attaches the gate. (2) The signed keychain helper's just-in-time migration (`migrateInline`/`rehomeOrphan`) re-stamped a biometry ACL onto *every* `agents-cli.*` item it touched on read — including bundle metadata and the HMAC key, which are supposed to be silent — so a metadata/hmackey read in its own helper process raised a *second* Touch ID sheet on top of the value read. The migration now re-adds silent items (metadata, hmackey) without an ACL, so metadata enumeration and the pre-value hmackey read never prompt. Net: unlock/read a `never` bundle once and it stays silent through sleep, reboot, 30+ days, an agents-cli upgrade, and a macOS upgrade — with no Touch ID and no passphrase. The `never` tier's durability and attribution guarantees are now written into the `§Secrets` spec (SEC-19, SEC-27, SEC-28). Source: `apps/cli/src/commands/secrets.ts`, `apps/cli/src/lib/secrets/bundles.ts`, `apps/cli/src/lib/secrets/keychain-helper.swift`, `apps/cli/docs/specifications.md`.
+
+- **The per-run Touch ID storm is fixed: `agents run` no longer pops a sheet to auto-inject the share token.** On every `agents run`, `shareRuntimeEnv` auto-reads the `share` bundle's R2 write token to hand it to the spawned agent — and because `share` is a keychain bundle that is rarely broker-held, an interactive read spawned the helper and raised Touch ID on EVERY launch. Auto-injecting a token on an agent launch is a background convenience, not a user-initiated secret access, so it must never raise a sheet (SEC-13): the read is now always `agentOnly` — it resolves the token from the injected env or an already-held / no-ACL bundle and silently returns nothing otherwise (the agent can still publish via its own explicit `agents share`). And a NEW `share` bundle now defaults to the `never` tier (no biometry ACL) — the write token is low-sensitivity automation infra — so auto-share is silent with no unlock at all; an existing bundle keeps its tier (change it with `agents secrets policy share never`, which now actually strips the ACL). Source: `apps/cli/src/lib/share/config.ts`, `apps/cli/src/commands/exec.ts`.
+
+- **The daemon watchdog now rotates rate-limited sessions in place.** A stalled session whose transcript tail shows a hard account limit ("You've hit your weekly limit · resets …", "usage limit reached", "out of credits") is rotated instead of nudged: the tick gates on the same first-party healthy-account selection `agents run auto` makes (`collectHarnessCandidates` + `pickHarnessWeighted` — zero healthy logs one `rotate` skip event per cooldown window to `watchdog.log` and leaves the terminal untouched), injects the harness's exit sequence (claude: Esc, Ctrl+C, Ctrl+C; codex/gemini/cursor/opencode: Ctrl+C twice), relaunches `agents run auto --interactive --session-id <uuid>` in the SAME tab via the inject rail, then — once the new session's TUI is live — injects the resume replay for the old session. Readiness is the new session's transcript (primary) or a fresh active session correlated by cwd + machine, never an unrelated one; the wait is bounded (60s), and on timeout the session is flagged with a bare-shell message pointing at a manual `agents run auto` and suppressed for 15m before retry — never blind-typed into. The state machine (`exiting → launching → awaiting-tui → replaying → done | failed`) persists at `~/.agents/.cache/state/watchdog/rotate/<sessionId>.json` and spans ticks via a post-loop sweep. Config: **`agents watchdog rotate on|off`** writes `watchdog.rotate` in `~/.agents/agents.yaml` (default on; rotate-only, nudging is unaffected), honored per tick; `agents watchdog status` / `--json` report the rotate config and every persisted rotate state. This replaces the Factory extension's own watchdog rotate loop, which is being deleted in the companion change. Source: `apps/cli/src/lib/watchdog/rotate.ts`, `apps/cli/src/lib/watchdog/runner.ts`, `apps/cli/src/commands/watchdog.ts`.
+
+## 1.22.1
+
+- **`agents doctor` de-noise: never-synced and cross-version hook drift are warnings, not criticals (RUSH-2162).** The CRITICAL section now holds only "needs you now" problems — a logged-out account, or a hook/plugin missing from a version you keep synced. A version that was never synced (an old/unused install with nothing installed) and a hook that merely *differs* across versions (installed but stale) are surfaced as WARNINGs instead, cutting the critical count on a busy machine from ~11 to the handful that actually need action. Source: `apps/cli/src/lib/devices/doctor-findings.ts`.
+
+- **The "… is damaged and can't be opened" dialog stops — both helper `.app` bundles now install atomically and serialized.** The secrets keychain helper (`Agents CLI.app`) and the menu-bar helper (`MenubarHelper.app`) are each (re)installed on the hot path of ordinary `agents` invocations, and both did a non-atomic `rm -rf dest` + `cp -R src dest` straight onto the live bundle. On a busy box dozens of concurrent invocations raced that path, so a reader (Gatekeeper, or an exec of the bundle) could see a half-written `.app` — a truncated Mach-O / mismatched code signature — which macOS reports as damaged. A new shared installer (`lib/app-bundle-install.ts`, replacing the two duplicated copy functions) stages the copy in a sibling dir and swaps it in with renames (the live bundle is only ever a complete, signed `.app`, and a failed copy never touches it), and serializes concurrent installers behind the shared `withFileLock` with a double-checked skip so a burst copies once instead of stampeding. Source: `apps/cli/src/lib/app-bundle-install.ts`, `apps/cli/src/lib/secrets/install-helper.ts`, `apps/cli/src/lib/menubar/install-menubar.ts`.
+
+- **`agents doctor --json` no longer stampedes into dozens of concurrent runs — the overview is singleflighted and cached, with a new `--refresh` to force a live recompute.** The bare `doctor --json` overview probes every host CLI, every agent's sign-in, and every agent×version diff — seconds on an idle box, minutes on a loaded one. The menu-bar helper polls it on a timer with only a per-*process* in-flight guard, so a helper relaunch (or any second poller) each launched its own live compute, and a helper killed mid-run orphaned a `doctor --json` that kept spinning — stacking to dozens of concurrent runs pinning the CPU. Now a fresh snapshot (< 90s) serves instantly from a disk cache, and when a live compute IS needed exactly one runs while every other caller serves its result (a lock-directory singleflight that self-heals if the computer dies). `agents doctor --json --refresh` bypasses the cache. Source: `apps/cli/src/lib/devices/doctor-overview-cache.ts`, `apps/cli/src/commands/doctor.ts`.
+
+- **`doctor --json` releases its singleflight lock before it returns.** The overview gate
+  fired the lock release without awaiting it on the path where a waiter serves the winner's
+  fresh snapshot, so the call returned with the lockfile still on disk. The next caller then
+  retried against a lock that was already logically free — the pile-up the gate exists to
+  prevent, narrowed to the window between return and unlink. The release is now awaited.
+  The existing coalescing test failed 5 times in 15 runs before this and 0 in 15 after.
+  Source: `apps/cli/src/lib/devices/doctor-overview-cache.ts`.
+
+- **`agents add grok@latest` no longer strands the freshly-downloaded binary in the old version's home.** When the post-install version probe (`<cli> --version`) transiently failed right after grok's self-updating installer exited, `installVersion` silently fell back to the literal string `'latest'` as the resolved version — creating a bogus `versions/grok/latest/` directory and defeating `relocateGrokBinaryToVersionHome`'s exact-filename match (its regex could never match `grok-latest-...`, since the real file is named `grok-<semver>-<platform>`). The real multi-hundred-MB binary was left behind in the PREVIOUS default's downloads dir, and `agents view grok` never listed the new version as installed even though `agents add` reported success. The probe now retries briefly instead of silently falling back, and fails loudly if it still can't resolve a version rather than corrupting the version bookkeeping. Relocation also now self-heals: if the current `~/.grok` symlink target has nothing matching, it sweeps every other installed grok version home for a binary stranded by a past occurrence of this bug. Source: `apps/cli/src/lib/versions.ts`.
+
+- **A blocked menu-bar row now takes you to the session (RUSH-2110).** A NEEDS-YOU row
+  exists because an agent is waiting on you, but its only action was "Reveal working
+  dir", which unblocks nothing — you still had to go find the session by hand. Blocked
+  rows now lead with **Focus session**, which runs `agents focus <id>`: attach the live
+  terminal, or open a new tab and resume, cross-host. Reveal stays underneath. Both
+  render paths are covered — the single inline row and each entry inside a collapsed
+  multi-waiter group. A row the engine could not identify (a cloud task, a stale
+  sentinel) simply omits the item rather than offering an action that would do nothing.
+  Source: `apps/cli/menubar/Sources/MenubarHelper/StatusItemController.swift`,
+  `AgentsCLI.swift`.
+
+- **Two projects sharing one monorepo checkout are no longer indistinguishable.** Session,
+  activity, and feed attribution anchored a project on `root ?? defaultPath`, so a subproject
+  whose `root` is the monorepo and whose `defaultPath` is a subdir collapsed onto the same
+  path as its umbrella — the longest-match tiebreak had nothing to separate them, and work in
+  `rush/apps/cli` counted toward whichever definition happened to be listed first. A
+  `defaultPath` nested under `root` now takes precedence over that `root` (the root says where
+  the checkout is; `defaultPath` says which work is this project's), and each bound repo's
+  checkout and subpath anchor too. A narrowed `root` still covers the rest of its checkout as
+  a fallback, so a lone project defined with `--path` keeps attributing work across its own
+  repo instead of only inside the subdir. Source: `apps/cli/src/lib/projects.ts`.
+
+- **`agents projects view <name>` now shows more than `status`, not less.** The command you
+  open to learn everything about one project built its own short list — root, repos, a raw
+  Linear project id, an issue count, milestones — and never called the card renderer, so it
+  omitted the agents roster, merged PRs and release, focus areas, the schedule verdict,
+  tickets, and artifacts that `status` had shown all along. `view` and `status` now gather
+  through one function and render through one card; `view` adds every milestone (instead of
+  just the next) and the stored definition in full underneath — each repo with its subpath and
+  checkout, each context with its purpose, each integration with its URL. It also takes
+  `--window <days>` to match `status`. Source: `apps/cli/src/commands/projects.ts`.
+- **The `agents` roster on the card lists live sessions only.** It included every matched
+  session, so a card headed `23 live` went on to print `claude · crashed ×25` — the corpses the
+  `dead` row already reports, counted twice and contradicting the headline. Both now derive
+  from one `isDeadStatus` predicate, pinned by a test across every `ActiveStatus`. Source:
+  `apps/cli/src/lib/project-status.ts`.
+
+- **`--host <self>` and the fleet-health fan-out now short-circuit ALL of the
+  local machine's names, not just its short hostname (RUSH-2114).** A `--host`
+  target or fleet probe that referenced this box by its **tailscale dnsName**
+  (`zion.tail1a85a1.ts.net`) slipped past a `=== machineId()` check and SSH'd to
+  the local box over its own name; on a loaded machine that self-SSH'd `doctor
+  --json` orphaned on timeout and piled up until the host was crushed. A new
+  `isSelfHost()` matches every identity the box answers to (short id, loopback,
+  tailscale dnsName + its short form) and gates all four self-checks — the
+  generic `--host` passthrough (`maybeRunOnHost`), the `--devices`-all fan-out
+  (`runFleetPassthrough`), `remoteFleetTargets`, and `runFleet` — so a
+  self-reference runs locally instead of self-SSHing. Source:
+  `apps/cli/src/lib/devices/self-host.ts`, `apps/cli/src/lib/hosts/passthrough.ts`,
+  `apps/cli/src/lib/devices/fleet.ts`.
+
 ## 1.22.0
 
 - **`agents run auto` — full-auto dispatch (RUSH-2132).** `run auto` composes all three routing layers: host (14d launch affinity, unless `--host` is given), harness (installed CLIs weighted by best-account headroom), and account (the configured strategy). `balanced`/`available` now exit nonzero when every installed account is unhealthy — naming each excluded account, the earliest window reset, and the `--strategy pinned` escape hatch — instead of warning "falling back to defaults" and launching the exhausted pinned default. The error text is a machine-readable contract (`no healthy` + `resets <iso-time>`) the Factory watchdog tail-detects for rotate cooldowns. Source: `apps/cli/src/lib/rotate.ts`, `apps/cli/src/commands/exec.ts`, `apps/cli/src/lib/runner.ts`.

package/README.md

@@ -382,6 +382,8 @@ agents watchdog --watch    # daemon loop: a tick every --interval
 
 `agents watchdog` detects a stalled session, resolves the *exact* terminal split it lives in (tmux, iTerm, VSCodium, or a raw pty), and injects a nudge -- `Continue.` by default, or set `--text`. It's dry by default; `--nudge` acts on a single tick, and `agents watchdog enable` flips global auto-nudge on so `--watch` injects on its own. Steer a single run with `agents watchdog policy <id> off | keep | handsoff`.
 
+A stalled session whose tail shows a hard account limit ("You've hit your weekly limit · resets …") is **rotated in place** instead of nudged: the watchdog gates on the same healthy-account selection `agents run auto` makes (zero healthy → one skip event per cooldown window, terminal untouched), injects the harness's exit sequence, relaunches `agents run auto --interactive --session-id <uuid>` in the *same* tab, then replays the old session's resume once the new TUI is live. Default on; `agents watchdog rotate off` disables it (nudging stays on).
+
 ---
 
 ## Sync the fleet

package/dist/commands/cloud.js

@@ -248,7 +248,7 @@ Examples:
             model: options.model,
             providerOptions: {},
         };
-        const shareEnv = shareRuntimeEnv({ agentOnly: true });
+        const shareEnv = shareRuntimeEnv();
         if (shareEnv)
             dispatchOptions.env = shareEnv;
         if (options.env)

package/dist/commands/doctor.js

@@ -4,6 +4,7 @@ import { addHostOption } from '../lib/hosts/option.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
 import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
 import { fanOutDevices, planFleetTargets, remoteFleetTargets } from '../lib/devices/fleet.js';
+import { enterDoctorOverviewGate, writeDoctorOverviewCache } from '../lib/devices/doctor-overview-cache.js';
 import { fleetDialTarget } from '../lib/devices/connect.js';
 import { compareFleetInventories } from '../lib/devices/fleet-divergence.js';
 import { collectLocalFleetInventory } from '../lib/devices/fleet-inventory.js';
@@ -1155,12 +1156,18 @@ export function registerDoctorCommand(program) {
         .option('--devices', 'Check agent readiness AND cross-device harness divergence (missing resources/versions, repo drift) on every registered device (alias --hosts)')
         .option('--hosts', 'Alias of --devices')
         .option('--check', 'CI drift gate: exit non-zero when any installed version is out of sync (stale or never-synced), zero when clean. Combine with --devices to gate the whole fleet.')
+        .option('--refresh', 'Bypass the cached overview snapshot: recompute the bare `doctor --json` overview live and refresh the shared cache that the menu-bar and other pollers read')
         .option('-q, --quiet', 'With --check, suppress per-version lines; print only the one-line verdict');
     setHelpSections(doctorCmd, {
         examples: `
       # Overview: CLI availability + sync status + orphans across all defaults
       agents doctor
 
+      # Machine-readable overview (served from a ~90s cache for pollers like the
+      # menu-bar helper); --refresh recomputes live and refreshes that cache
+      agents doctor --json
+      agents doctor --json --refresh
+
       # Full per-resource report for the active default
       agents doctor claude@default
 
@@ -1288,6 +1295,26 @@ export function registerDoctorCommand(program) {
             return;
         }
         if (!target) {
+            // Singleflight + short-TTL cache for the bare `doctor --json` overview.
+            // This overview probes every host CLI, every agent's sign-in, and every
+            // agent×version diff — seconds on an idle box, minutes on a loaded one.
+            // The menu-bar helper polls it with only a per-*process* in-flight guard,
+            // so a helper relaunch (or any second poller) each launched its own live
+            // compute, and a helper killed mid-run orphaned a `doctor --json` that
+            // kept spinning — stacking to dozens of concurrent runs pinning the CPU
+            // (RUSH-2153). Now: a fresh snapshot serves instantly, and when a compute
+            // IS needed exactly one runs while every other caller serves its result.
+            // A crashed computer never wedges the gate — the lock is stolen once its
+            // directory mtime goes stale (see enterDoctorOverviewGate).
+            let releaseOverviewGate;
+            if (opts.json) {
+                const gate = await enterDoctorOverviewGate({ forceRefresh: !!opts.refresh });
+                if (gate.cached !== null) {
+                    console.log(gate.cached);
+                    return;
+                }
+                releaseOverviewGate = gate.release;
+            }
             const clis = checkAllClis();
             const syncRows = checkSyncStatus(cwd);
             const orphanRows = countOrphans();
@@ -1355,7 +1382,7 @@ export function registerDoctorCommand(program) {
                 isolatedVersions,
             });
             if (opts.json) {
-                console.log(JSON.stringify({
+                const overviewPayload = {
                     clis,
                     signIn,
                     // Cached auth-health rollup for THIS host — lets `agents fleet status`
@@ -1398,7 +1425,12 @@ export function registerDoctorCommand(program) {
                         branch: m.branch,
                         fetchedAt: m.fetchedAt,
                     })),
-                }, null, 2));
+                };
+                // Persist for the next poller and release the singleflight lock BEFORE
+                // printing, so a concurrent caller picks up the fresh snapshot at once.
+                writeDoctorOverviewCache(overviewPayload);
+                releaseOverviewGate?.();
+                console.log(JSON.stringify(overviewPayload, null, 2));
                 return;
             }
             // Single-machine hybrid: CRITICAL section + one `▸ <machine>` block.

package/dist/commands/exec.js

@@ -2261,7 +2261,7 @@ export function registerRunCommand(program) {
             }
         }
         const autoShareEnv = options.autoSecrets !== false
-            ? shareRuntimeEnv({ agentOnly: isHeadlessSecretsContext() })
+            ? shareRuntimeEnv()
             : undefined;
         // Merge order (later wins): profile env < auto share token < secrets bundles < --env K=V.
         // Profile carries provider auth; secrets bundles carry user-defined

package/dist/commands/projects.js

@@ -25,7 +25,7 @@ import { gatherRemoteAgentsJson } from '../lib/remote-agents-json.js';
 import { factoryProjectsPath } from '../lib/auto-dispatch.js';
 import { formatFleetWorkspaces, parseRemoteProbe, probeProjectWorkspaces, workspaceTargetsForDef, } from '../lib/project-probe.js';
 import { listProjectDefs, loadProjectDef, writeProjectDef, removeProjectDef, projectDefPath, isSafeProjectName, } from '../lib/projects.js';
-import { rollupSessionsByProject, liveDeadSplit, enrichProjectSignals, formatProjectMembers, } from '../lib/project-status.js';
+import { rollupSessionsByProject, isDeadStatus, liveDeadSplit, enrichProjectSignals, formatProjectMembers, } from '../lib/project-status.js';
 import { fetchLinearProjectCounts } from '../lib/linear-project-counts.js';
 import { listLinearProjects, pickLinearProject } from '../lib/linear-projects.js';
 import { checkRepoSlug } from '../lib/project-doctor.js';
@@ -59,6 +59,17 @@ function parseContextFlag(raw) {
         return { path: raw.trim(), purpose: '' };
     return { path: raw.slice(0, i).trim(), purpose: raw.slice(i + 1).trim() };
 }
+/** `objective:measure` → a goal. The measure is optional; the objective may contain colons only after the first is claimed. */
+function parseGoalFlag(raw) {
+    const i = raw.indexOf(':');
+    if (i === -1)
+        return { objective: raw.trim() };
+    const measure = raw.slice(i + 1).trim();
+    const goal = { objective: raw.slice(0, i).trim() };
+    if (measure)
+        goal.measure = measure;
+    return goal;
+}
 /**
  * Best-effort `owner/repo` from a repo's origin remote.
  *
@@ -268,11 +279,45 @@ function statusBar(r) {
         parts.push(chalk.gray(`+${live - shown} other`));
     return parts.join(' · ') || chalk.gray('no live agents');
 }
+/**
+ * Gather the live/remote/Linear/focus signals for the projects about to be
+ * rendered. `status` and `view` share this deliberately: `view` used to build
+ * its own thinner picture, so the command you open to learn everything about
+ * ONE project showed strictly less than the roll-up across all of them — no
+ * agents, no ships, no focus, no schedule verdict. One gatherer means a signal
+ * added for either surface appears on both.
+ *
+ * Only the shown projects are enriched. `skipRemote` still reads the local
+ * artifact log and git focus, and skips just the network calls (`gh`, Linear).
+ */
+async function enrichProjectsForRender(defs, all, opts) {
+    const roll = rollupSessionsByProject(all, [...(await getActiveSessions()), ...(opts.extraSessions ?? [])]);
+    const remote = new Map();
+    const linear = new Map();
+    // Local git, no API, no rate limit — measured 0.23s over a 897-commit week.
+    const focus = new Map();
+    await Promise.all(defs.map(async (d) => {
+        const [sig, counts] = await Promise.all([
+            enrichProjectSignals(d, opts.windowDays, opts.nowMs, { skipRemote: opts.skipRemote }),
+            !opts.skipRemote && d.linear?.projectId
+                ? fetchLinearProjectCounts(d.linear.projectId)
+                : Promise.resolve(undefined),
+        ]);
+        remote.set(d.name, sig);
+        if (counts)
+            linear.set(d.name, counts);
+        if (d.root)
+            focus.set(d.name, await readFocusAreas(expandLocalHome(d.root), opts.windowDays));
+    }));
+    return { roll, remote, linear, focus };
+}
 function renderCard(def, r, remote, fleet, linear, nowMs = Date.now(), 
 /** How many milestones to print. `status` shows the next one; `view` shows all. */
 milestoneLimit = 1, 
 /** Directories the window's work landed in, from local git. */
-focus = []) {
+focus = [], 
+/** `view` mode: the caller prints the stored definition in full afterwards. */
+detail = false) {
     // The headline counts LIVE agents. It used to be every matched session, which
     // read `39 agents` on a project where 19 had crashed. `planPct` used to sit
     // here too and is gone: it summed each session's latest checklist snapshot,
@@ -288,8 +333,12 @@ focus = []) {
         const detail = split.deadByStatus.map((d) => `${d.n} ${d.status}`).join(', ');
         console.log(`  ${chalk.dim('dead')}     ${chalk.yellow(`${split.dead} finished or lost`)} ${chalk.dim(`(${detail})`)}`);
     }
-    if (r && r.members.length)
-        console.log(`  ${chalk.dim('agents')}   ${formatProjectMembers(r.members)}`);
+    // Live only. The roster used to list every matched session, so a card headed
+    // `23 live` went on to show `crashed ×25` — the corpses the `dead` row above
+    // already accounts for, counted twice and contradicting the headline.
+    const liveMembers = r?.members.filter((m) => !isDeadStatus(m.status)) ?? [];
+    if (liveMembers.length)
+        console.log(`  ${chalk.dim('agents')}   ${formatProjectMembers(liveMembers)}`);
     const ships = [];
     if (remote?.mergedPrs) {
         ships.push(chalk.green(`${remote.mergedPrs}${remote.mergedPrsTruncated ? '+' : ''} merged (${remote.windowDays}d)`));
@@ -343,13 +392,19 @@ focus = []) {
         console.log(`  ${chalk.yellow('!')}        ${chalk.yellow(mismatch.message)}`);
         console.log(`  ${' '.repeat(8)}${chalk.gray(mismatch.remediation)}`);
     }
-    if (def.contexts?.length) {
+    // `view` prints these in full (path + purpose, label + URL) right below, so
+    // the compact one-line summaries would just say the same thing twice.
+    if (!detail && def.goals?.length) {
+        console.log(`  ${chalk.dim('goal')}     ${def.goals.map((g) => g.objective).join(' · ')}`);
+    }
+    if (!detail && def.contexts?.length) {
         console.log(`  ${chalk.dim('context')}  ${def.contexts.map((c) => c.path).join(' · ')}`);
     }
-    if (def.integrations?.length) {
+    if (!detail && def.integrations?.length) {
         console.log(`  ${chalk.dim('links')}    ${def.integrations.map((i) => i.label ?? i.kind).join(' · ')}`);
     }
-    console.log('');
+    if (!detail)
+        console.log('');
 }
 export function registerProjectsCommands(program) {
     const enabled = isBetaEnabled('projects');
@@ -426,6 +481,7 @@ export function registerProjectsCommands(program) {
         .option('--path <subdir>', 'Default cwd for agents (a monorepo subdir)')
         .option('--repo <owner/repo>', 'Primary GitHub slug (defaults to the origin remote)')
         .option('--context <path:purpose...>', 'A described starting point; repeatable')
+        .option('--goal <objective:measure...>', 'An outcome the project serves; repeatable')
         .option('--linear <url-or-id>', 'Linear project URL or id')
         .option('--force', 'Overwrite an existing definition')
         .action(async (name, opts) => {
@@ -456,6 +512,8 @@ export function registerProjectsCommands(program) {
             def.repo = repo;
         if (opts.context?.length)
             def.contexts = opts.context.map(parseContextFlag);
+        if (opts.goal?.length)
+            def.goals = opts.goal.map(parseGoalFlag);
         if (opts.linear) {
             def.linear = /^https?:/.test(opts.linear) ? { url: opts.linear } : { projectId: opts.linear };
         }
@@ -468,58 +526,72 @@ export function registerProjectsCommands(program) {
     projects
         .command('view <name>')
         .alias('show')
-        .description('Show a project definition, resolved paths, repos, contexts, links, and milestones.')
+        .description('Everything about one project: the full status card, every milestone, and the stored definition.')
         .option('--json', 'Machine-readable output')
-        .option('--no-remote', 'Skip the Linear lookup; definition only')
+        .option('--window <days>', 'Window for merged PRs, artifacts, and focus areas', '7')
+        .option('--no-remote', 'Skip the GitHub and Linear lookups; definition only')
         .action(async (name, opts) => {
         const def = loadProjectDef(name);
         if (!def) {
             console.error(chalk.red(`No project named "${name}". List them: agents projects list`));
             process.exit(1);
         }
-        // Every milestone the project declares, not just the next one — the whole
-        // point of opening ONE project is to see the shape of its plan.
-        const counts = opts.remote !== false && def.linear?.projectId
-            ? await fetchLinearProjectCounts(def.linear.projectId)
-            : undefined;
+        // `view` is `status` for one project PLUS the stored definition and every
+        // milestone. It used to render its own short list — root, repos, a raw
+        // Linear id, issues — so opening a single project told you LESS than the
+        // roll-up did: no agents, no ships, no focus, no schedule verdict.
+        const windowDays = Math.max(1, Number.parseInt(opts.window ?? '7', 10) || 7);
+        const nowMs = Date.now();
+        const all = listProjectDefs();
+        const { roll, remote, linear, focus } = await enrichProjectsForRender([def], all, {
+            windowDays,
+            nowMs,
+            skipRemote: opts.remote === false,
+        });
+        const r = roll.get(def.name);
+        const sig = remote.get(def.name);
+        const counts = linear.get(def.name);
         if (opts.json) {
-            console.log(JSON.stringify({ ...def, linear: { ...def.linear, ...(counts ?? {}) } }, null, 2));
+            console.log(JSON.stringify({
+                ...def,
+                linear: { ...def.linear, ...(counts ?? {}) },
+                schedule: counts?.milestones?.length ? scheduleVerdict(counts.milestones, nowMs) : null,
+                live: r ? liveDeadSplit(r.byStatus).live : 0,
+                dead: r ? liveDeadSplit(r.byStatus).dead : 0,
+                byStatus: r?.byStatus ?? {},
+                members: r?.members ?? [],
+                openPrs: r?.openPrs ?? [],
+                tickets: r?.tickets ?? [],
+                mergedPrs: sig?.mergedPrs ?? 0,
+                latestRelease: sig?.latestRelease ?? null,
+                artifacts: sig?.artifacts ?? 0,
+                focus: focus.get(def.name) ?? [],
+            }, null, 2));
             return;
         }
-        console.log(chalk.bold(def.name) + (def.description ? chalk.dim(`  — ${def.description}`) : ''));
+        // The same card `status` prints, with every milestone instead of the next.
+        renderCard(def, r, sig, undefined, counts, nowMs, Number.POSITIVE_INFINITY, focus.get(def.name) ?? [], true);
+        // Then what only `view` shows: the stored definition, in full.
+        console.log();
         if (def.root)
-            console.log(`  root         ${def.root}`);
+            console.log(`  ${chalk.dim('root')}     ${def.root}`);
         if (def.defaultPath)
-            console.log(`  defaultPath  ${def.defaultPath}`);
-        const repos = [def.repo, ...(def.repos ?? []).map((r) => (r.subpath ? `${r.slug} (${r.subpath})` : r.slug))].filter(Boolean);
-        if (repos.length)
-            console.log(`  repos        ${repos.join(', ')}`);
+            console.log(`  ${chalk.dim('path')}     ${def.defaultPath}`);
+        for (const rp of def.repos ?? []) {
+            const where = [rp.subpath ? `subpath ${rp.subpath}` : undefined, rp.path].filter(Boolean).join(' · ');
+            console.log(`  ${chalk.dim('repo')}     ${rp.slug}${where ? chalk.dim(`  (${where})`) : ''}`);
+        }
+        for (const g of def.goals ?? [])
+            console.log(`  ${chalk.dim('goal')}     ${g.objective}${g.measure ? chalk.dim(`  · ${g.measure}`) : ''}`);
         for (const c of def.contexts ?? [])
-            console.log(`  context      ${chalk.cyan(c.path)} — ${c.purpose}`);
-        for (const i of def.integrations ?? [])
-            console.log(`  ${i.kind.padEnd(12)} ${i.url}${i.label ? chalk.dim(`  (${i.label})`) : ''}`);
+            console.log(`  ${chalk.dim('context')}  ${chalk.cyan(c.path)} ${chalk.dim('—')} ${c.purpose}`);
+        for (const ig of def.integrations ?? []) {
+            console.log(`  ${chalk.dim(ig.kind.padEnd(8))} ${ig.url}${ig.label ? chalk.dim(`  (${ig.label})`) : ''}`);
+        }
         if (def.linear?.url || def.linear?.projectId)
-            console.log(`  linear       ${def.linear.url ?? def.linear.projectId}`);
+            console.log(`  ${chalk.dim('linear')}   ${def.linear.url ?? def.linear.projectId}`);
         for (const d of def.docs ?? [])
-            console.log(`  doc          ${d}`);
-        if (counts) {
-            const staleNote = counts.stale ? chalk.dim('  (cached)') : '';
-            console.log(`  issues       ${counts.done}/${counts.total}${counts.truncated ? '+' : ''} done · ${counts.inProgress} in progress${staleNote}`);
-        }
-        const ms = counts?.milestones ?? [];
-        if (ms.length) {
-            console.log(`  ${chalk.bold('milestones')}`);
-            for (const m of ms) {
-                const mark = m.name === counts?.nextMilestone?.name ? chalk.cyan('next') : '';
-                console.log(`    ${mark.padEnd(6)}     ${formatNextMilestone(m, Date.now())}`);
-            }
-            // A milestone nothing is filed against cannot report progress. Say that
-            // once, plainly, rather than printing a row of silent 0%s.
-            const unfiled = ms.filter((m) => m.total === 0).length;
-            if (unfiled === ms.length) {
-                console.log(`    ${chalk.yellow('!')}          ${chalk.yellow(`no issues are assigned to any milestone — progress against them cannot be measured`)}`);
-            }
-        }
+            console.log(`  ${chalk.dim('doc')}      ${d}`);
         console.log(chalk.gray(`  ${projectDefPath(name)}`));
     });
     // ---- edit ----
@@ -590,27 +662,12 @@ export function registerProjectsCommands(program) {
             fleetSkipped = probeRes.skipped;
             fleetSessions = activeRes.sessions;
         }
-        const roll = rollupSessionsByProject(all, [...await getActiveSessions(), ...fleetSessions]);
-        // Enrich only the shown projects. --no-remote still reads the local artifact
-        // log but skips the gh calls + Linear counts (both are network).
-        const remote = new Map();
-        const linear = new Map();
-        // Local git, no API, no rate limit — measured 0.23s over a 897-commit week.
-        const focus = new Map();
-        await Promise.all(defs.map(async (d) => {
-            const skipRemote = opts.remote === false;
-            const [sig, counts] = await Promise.all([
-                enrichProjectSignals(d, windowDays, nowMs, { skipRemote }),
-                !skipRemote && d.linear?.projectId
-                    ? fetchLinearProjectCounts(d.linear.projectId)
-                    : Promise.resolve(undefined),
-            ]);
-            remote.set(d.name, sig);
-            if (counts)
-                linear.set(d.name, counts);
-            if (d.root)
-                focus.set(d.name, await readFocusAreas(expandLocalHome(d.root), windowDays));
-        }));
+        const { roll, remote, linear, focus } = await enrichProjectsForRender(defs, all, {
+            windowDays,
+            nowMs,
+            skipRemote: opts.remote === false,
+            extraSessions: fleetSessions,
+        });
         /** This def's slice of the fleet probe, in its own target order. */
         const fleetFor = (d) => {
             const targets = new Set(workspaceTargetsForDef(d));
@@ -704,6 +761,7 @@ export function registerProjectsCommands(program) {
         .option('--root <path>', 'Repo / monorepo root')
         .option('--path <subdir>', 'Default cwd for agents (a monorepo subdir)')
         .option('--description <text>', 'One-line description shown on the card')
+        .option('--goal <objective:measure...>', 'Replace the goals this project serves; repeatable')
         .action((name, opts) => {
         const def = loadProjectDef(name);
         if (!def) {
@@ -711,7 +769,7 @@ export function registerProjectsCommands(program) {
             process.exit(1);
         }
         const fields = ['repo', 'root', 'path', 'description'].filter((k) => opts[k] !== undefined);
-        if (fields.length === 0) {
+        if (fields.length === 0 && !opts.goal?.length) {
             console.error(chalk.red('Nothing to set. Pass a field, e.g. --repo <owner/repo>.'));
             process.exit(1);
         }
@@ -724,6 +782,8 @@ export function registerProjectsCommands(program) {
             def.root = opts.root;
         if (opts.description !== undefined)
             def.description = opts.description;
+        if (opts.goal?.length)
+            def.goals = opts.goal.map(parseGoalFlag);
         if (opts.path !== undefined) {
             // `--path` is a subdir OF the root, so without one there is nothing to
             // hang it off. A def imported with `--from-linear` that found no local
@@ -742,6 +802,8 @@ export function registerProjectsCommands(program) {
         console.log(chalk.green(`Updated ${def.name}`));
         for (const f of fields)
             console.log(chalk.gray(`  ${f}  ${f === 'path' ? def.defaultPath : def[f]}`));
+        if (opts.goal?.length)
+            console.log(chalk.gray(`  goals  ${def.goals?.map((g) => g.objective).join(' · ')}`));
     });
     // ---- link ----
     projects

package/dist/commands/secrets.js

@@ -18,7 +18,7 @@ import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon.js';
 import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveHostSshTarget, verifyRemoteKeychainPush, keychainWriteFailureMessage, } from '../lib/secrets/remote.js';
 import { remoteShellFor, buildWindowsStdinImportCommand } from '../lib/hosts/remote-cmd.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
-import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, readBundleIfDecryptable, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
+import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
 import { parseListFilters, bundleMatchesFilter, bundleExpiry, filterIsActive, describeFilter, parseSortField, sortBundles, SORT_FIELDS, REF_KINDS, DEFAULT_EXPIRING_DAYS, } from '../lib/secrets/list-filter.js';
 import { encryptForFallback, decryptForFallback } from '../lib/secrets/filestore.js';
 import { getKeychainToken, getKeychainTokens, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from '../lib/secrets/index.js';
@@ -2738,10 +2738,14 @@ Examples:
                 return;
             }
             bundle.policy = next;
-            // writeBundle evicts any broker-held copy, so tightening hold ->
-            // always/never takes effect NOW: the next read re-prompts (`always`)
-            // or reads its no-ACL item directly (`never`).
-            writeBundle(bundle);
+            // Re-store the VALUE items so their keychain ACL matches the new tier —
+            // NOT just the metadata. macOS gates each read on the item's own ACL
+            // (SEC-19); a metadata-only write would leave a hold/always bundle's
+            // biometry ACL in place and keep popping Touch ID forever after a switch
+            // to `never`. reAclBundleItems reads once (the last prompt this bundle
+            // raises when tightening to `never`), rewrites no-ACL, and evicts any
+            // broker-held copy so the change takes effect on the very next read.
+            reAclBundleItems(bundle);
             console.log(chalk.green(`${bundle.name} policy set to ${next}.`));
             if (next === 'hold') {
                 console.log(chalk.gray('Held by the secrets-agent for ~7 days after one unlock (auto-cache is on by default; disable with `secrets.agent.auto: false` in agents.yaml).'));

package/dist/commands/teams.js

@@ -1539,7 +1539,7 @@ export function registerTeamsCommands(program) {
                     repo: opts.repo,
                     branch: opts.branch,
                     model: a.model ?? undefined,
-                    env: shareRuntimeEnv({ agentOnly: true }),
+                    env: shareRuntimeEnv(),
                 };
                 const cloudTask = await prov.dispatch(dispatchOpts);
                 return { cloudSessionId: cloudTask.id };
@@ -1557,7 +1557,7 @@ export function registerTeamsCommands(program) {
                 repo: opts.repo,
                 branch: opts.branch,
                 model: opts.model,
-                env: shareRuntimeEnv({ agentOnly: true }),
+                env: shareRuntimeEnv(),
             };
             try {
                 const cloudTask = await prov.dispatch(dispatchOpts);