@phnx-labs/agents-cli 1.22.1 → 1.22.4

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## 1.22.4
+
+- **Background processes no longer storm macOS Touch ID sheets (secrets-touchid-storm).**
+  Raw keychain item reads — a profile's provider token on `agents run <profile>`,
+  the Claude OAuth read behind `agents view`, any `getKeychainToken` caller — now
+  fail fast with an actionable error naming the item when the process is
+  non-interactive (an agent runtime, or a TTY-less background spawn like the
+  Factory extension host's `agents view` poll), instead of raising a sheet nobody
+  is watching. A cancelled or failed interactive read opens a 5-minute back-off
+  memo (`~/.agents/.cache/keychain-read-backoff/`) so a polling caller can't
+  re-prompt every few seconds; any successful read or write clears it. Reads that
+  are prompt-free by construction (bundle metadata, `never`-policy bundles, the
+  unlock session store, the OAuth token cache) attest their no-ACL write and are
+  unaffected. crabbox's tailscale key is now read at most once per process
+  instead of on every `crabboxEnv` call (list/wait/spawn/stop). Source:
+  `apps/cli/src/lib/secrets/index.ts`, `apps/cli/src/lib/secrets/headless.ts`,
+  `apps/cli/src/lib/secrets/read-backoff.ts`,
+  `apps/cli/src/lib/secrets/bundles.ts`, `apps/cli/src/lib/crabbox/cli.ts`,
+  `apps/cli/docs/specifications.md` (SEC-13, SEC-27).
+
+## 1.22.3
+
+- **Menubar home-base self-test accepts `MenubarHelper-universal`.** The
+  signed-helper gate required `executablePath` to end in exactly `MenubarHelper`,
+  but lipo production builds name the binary `MenubarHelper-universal`, so every
+  1.22.2 publish on mac-mini failed after the release PR had already merged and
+  tagged. Source: `menubar/Sources/MenubarHelper/ChildProcessSelfTest.swift`.
+
+## 1.22.2
+
+- **Menu bar recovers from a stale single-instance lock instead of staying dead.**
+  The helper's lock fd is now opened `O_CLOEXEC`, so a spawned `doctor` child can
+  never inherit it and hold the `menubar.lock` flock after the helper crashes; and
+  `SingleInstance.acquire` now self-heals — when the flock is held but no live
+  `MenubarHelper` owns it (a leaked orphan / dead pid), it reaps the orphan and
+  retries rather than exiting as "already running". Previously a leaked orphan
+  bricked the menu bar until reboot. The headless Swift self-tests (single-instance
+  + child-process) now run as a build gate (`menubar/scripts/test-menubar.sh`),
+  which nothing invoked before. Source: `apps/cli/menubar/Sources/MenubarHelper/SingleInstance.swift`.
+
+- **`agents projects` definitions can now carry goals — the OKR-shaped "why".**
+  A project serves one or more `goals[]`, each an `objective` (the outcome) plus an
+  optional `measure` (the key result). Set them at scaffold time with
+  `agents projects add <name> --goal "objective:measure"` (repeatable), replace them
+  later with `agents projects set <name> --goal …`, or hand-edit the YAML. Goals show
+  on the `status` card (compact) and in `projects view` (in full), and survive a
+  `--from-linear` re-import like every other hand-set field. Milestones (pulled from
+  Linear) remain the dated checkpoints toward these goals. Source:
+  `apps/cli/src/lib/projects.ts`, `apps/cli/src/commands/projects.ts`.
+
+- **Balanced rotation no longer picks version homes that only inherit the active login.**
+  `getAccountInfo` falls back to the active/global HOME credential so `agents view`
+  still shows who is signed in when a version home has no auth file of its own.
+  Launch paths isolate config (`GROK_HOME`, `CODEX_HOME`, …) to the per-version home,
+  so those empty homes died at spawn with "Not signed in" after balanced picked them
+  (observed: `grok@0.2.118` with no `auth.json` looking signed-in via `~/.grok` →
+  `0.2.32`). Rotation now requires a real per-version credential when we know where
+  it lives (`credentialPresence.perVersion`). Source: `src/lib/rotate.ts`
+  (`isLaunchableSignedIn`, `collectRunCandidates`).
+
+- **A `never`-policy secrets bundle now actually stays silent — no more Touch ID for a bundle you set to silent, and no more double prompt.** Two bugs made `agents secrets policy <b> never` a lie. (1) The command rewrote only the bundle *metadata*, never the value items — but macOS gates each read on the item's own ACL, not the tier label, so a bundle created under `hold`/`always` kept its biometry ACL and kept popping Touch ID forever after the switch. `policy` now reconciles the value items to the new tier (`reAclBundleItems`): tightening to `never` re-stores them no-ACL (a single last prompt to read them once), and loosening back re-attaches the gate. (2) The signed keychain helper's just-in-time migration (`migrateInline`/`rehomeOrphan`) re-stamped a biometry ACL onto *every* `agents-cli.*` item it touched on read — including bundle metadata and the HMAC key, which are supposed to be silent — so a metadata/hmackey read in its own helper process raised a *second* Touch ID sheet on top of the value read. The migration now re-adds silent items (metadata, hmackey) without an ACL, so metadata enumeration and the pre-value hmackey read never prompt. Net: unlock/read a `never` bundle once and it stays silent through sleep, reboot, 30+ days, an agents-cli upgrade, and a macOS upgrade — with no Touch ID and no passphrase. The `never` tier's durability and attribution guarantees are now written into the `§Secrets` spec (SEC-19, SEC-27, SEC-28). Source: `apps/cli/src/commands/secrets.ts`, `apps/cli/src/lib/secrets/bundles.ts`, `apps/cli/src/lib/secrets/keychain-helper.swift`, `apps/cli/docs/specifications.md`.
+
+- **The per-run Touch ID storm is fixed: `agents run` no longer pops a sheet to auto-inject the share token.** On every `agents run`, `shareRuntimeEnv` auto-reads the `share` bundle's R2 write token to hand it to the spawned agent — and because `share` is a keychain bundle that is rarely broker-held, an interactive read spawned the helper and raised Touch ID on EVERY launch. Auto-injecting a token on an agent launch is a background convenience, not a user-initiated secret access, so it must never raise a sheet (SEC-13): the read is now always `agentOnly` — it resolves the token from the injected env or an already-held / no-ACL bundle and silently returns nothing otherwise (the agent can still publish via its own explicit `agents share`). And a NEW `share` bundle now defaults to the `never` tier (no biometry ACL) — the write token is low-sensitivity automation infra — so auto-share is silent with no unlock at all; an existing bundle keeps its tier (change it with `agents secrets policy share never`, which now actually strips the ACL). Source: `apps/cli/src/lib/share/config.ts`, `apps/cli/src/commands/exec.ts`.
+
+- **The daemon watchdog now rotates rate-limited sessions in place.** A stalled session whose transcript tail shows a hard account limit ("You've hit your weekly limit · resets …", "usage limit reached", "out of credits") is rotated instead of nudged: the tick gates on the same first-party healthy-account selection `agents run auto` makes (`collectHarnessCandidates` + `pickHarnessWeighted` — zero healthy logs one `rotate` skip event per cooldown window to `watchdog.log` and leaves the terminal untouched), injects the harness's exit sequence (claude: Esc, Ctrl+C, Ctrl+C; codex/gemini/cursor/opencode: Ctrl+C twice), relaunches `agents run auto --interactive --session-id <uuid>` in the SAME tab via the inject rail, then — once the new session's TUI is live — injects the resume replay for the old session. Readiness is the new session's transcript (primary) or a fresh active session correlated by cwd + machine, never an unrelated one; the wait is bounded (60s), and on timeout the session is flagged with a bare-shell message pointing at a manual `agents run auto` and suppressed for 15m before retry — never blind-typed into. The state machine (`exiting → launching → awaiting-tui → replaying → done | failed`) persists at `~/.agents/.cache/state/watchdog/rotate/<sessionId>.json` and spans ticks via a post-loop sweep. Config: **`agents watchdog rotate on|off`** writes `watchdog.rotate` in `~/.agents/agents.yaml` (default on; rotate-only, nudging is unaffected), honored per tick; `agents watchdog status` / `--json` report the rotate config and every persisted rotate state. This replaces the Factory extension's own watchdog rotate loop, which is being deleted in the companion change. Source: `apps/cli/src/lib/watchdog/rotate.ts`, `apps/cli/src/lib/watchdog/runner.ts`, `apps/cli/src/commands/watchdog.ts`.
+
 ## 1.22.1
 
 - **`agents doctor` de-noise: never-synced and cross-version hook drift are warnings, not criticals (RUSH-2162).** The CRITICAL section now holds only "needs you now" problems — a logged-out account, or a hook/plugin missing from a version you keep synced. A version that was never synced (an old/unused install with nothing installed) and a hook that merely *differs* across versions (installed but stale) are surfaced as WARNINGs instead, cutting the critical count on a busy machine from ~11 to the handful that actually need action. Source: `apps/cli/src/lib/devices/doctor-findings.ts`.

package/README.md

@@ -382,6 +382,8 @@ agents watchdog --watch    # daemon loop: a tick every --interval
 
 `agents watchdog` detects a stalled session, resolves the *exact* terminal split it lives in (tmux, iTerm, VSCodium, or a raw pty), and injects a nudge -- `Continue.` by default, or set `--text`. It's dry by default; `--nudge` acts on a single tick, and `agents watchdog enable` flips global auto-nudge on so `--watch` injects on its own. Steer a single run with `agents watchdog policy <id> off | keep | handsoff`.
 
+A stalled session whose tail shows a hard account limit ("You've hit your weekly limit · resets …") is **rotated in place** instead of nudged: the watchdog gates on the same healthy-account selection `agents run auto` makes (zero healthy → one skip event per cooldown window, terminal untouched), injects the harness's exit sequence, relaunches `agents run auto --interactive --session-id <uuid>` in the *same* tab, then replays the old session's resume once the new TUI is live. Default on; `agents watchdog rotate off` disables it (nudging stays on).
+
 ---
 
 ## Sync the fleet

package/dist/commands/cloud.js

@@ -248,7 +248,7 @@ Examples:
             model: options.model,
             providerOptions: {},
         };
-        const shareEnv = shareRuntimeEnv({ agentOnly: true });
+        const shareEnv = shareRuntimeEnv();
         if (shareEnv)
             dispatchOptions.env = shareEnv;
         if (options.env)

package/dist/commands/exec.js

@@ -2261,7 +2261,7 @@ export function registerRunCommand(program) {
             }
         }
         const autoShareEnv = options.autoSecrets !== false
-            ? shareRuntimeEnv({ agentOnly: isHeadlessSecretsContext() })
+            ? shareRuntimeEnv()
             : undefined;
         // Merge order (later wins): profile env < auto share token < secrets bundles < --env K=V.
         // Profile carries provider auth; secrets bundles carry user-defined

package/dist/commands/projects.js

@@ -59,6 +59,17 @@ function parseContextFlag(raw) {
         return { path: raw.trim(), purpose: '' };
     return { path: raw.slice(0, i).trim(), purpose: raw.slice(i + 1).trim() };
 }
+/** `objective:measure` → a goal. The measure is optional; the objective may contain colons only after the first is claimed. */
+function parseGoalFlag(raw) {
+    const i = raw.indexOf(':');
+    if (i === -1)
+        return { objective: raw.trim() };
+    const measure = raw.slice(i + 1).trim();
+    const goal = { objective: raw.slice(0, i).trim() };
+    if (measure)
+        goal.measure = measure;
+    return goal;
+}
 /**
  * Best-effort `owner/repo` from a repo's origin remote.
  *
@@ -383,6 +394,9 @@ detail = false) {
     }
     // `view` prints these in full (path + purpose, label + URL) right below, so
     // the compact one-line summaries would just say the same thing twice.
+    if (!detail && def.goals?.length) {
+        console.log(`  ${chalk.dim('goal')}     ${def.goals.map((g) => g.objective).join(' · ')}`);
+    }
     if (!detail && def.contexts?.length) {
         console.log(`  ${chalk.dim('context')}  ${def.contexts.map((c) => c.path).join(' · ')}`);
     }
@@ -467,6 +481,7 @@ export function registerProjectsCommands(program) {
         .option('--path <subdir>', 'Default cwd for agents (a monorepo subdir)')
         .option('--repo <owner/repo>', 'Primary GitHub slug (defaults to the origin remote)')
         .option('--context <path:purpose...>', 'A described starting point; repeatable')
+        .option('--goal <objective:measure...>', 'An outcome the project serves; repeatable')
         .option('--linear <url-or-id>', 'Linear project URL or id')
         .option('--force', 'Overwrite an existing definition')
         .action(async (name, opts) => {
@@ -497,6 +512,8 @@ export function registerProjectsCommands(program) {
             def.repo = repo;
         if (opts.context?.length)
             def.contexts = opts.context.map(parseContextFlag);
+        if (opts.goal?.length)
+            def.goals = opts.goal.map(parseGoalFlag);
         if (opts.linear) {
             def.linear = /^https?:/.test(opts.linear) ? { url: opts.linear } : { projectId: opts.linear };
         }
@@ -564,6 +581,8 @@ export function registerProjectsCommands(program) {
             const where = [rp.subpath ? `subpath ${rp.subpath}` : undefined, rp.path].filter(Boolean).join(' · ');
             console.log(`  ${chalk.dim('repo')}     ${rp.slug}${where ? chalk.dim(`  (${where})`) : ''}`);
         }
+        for (const g of def.goals ?? [])
+            console.log(`  ${chalk.dim('goal')}     ${g.objective}${g.measure ? chalk.dim(`  · ${g.measure}`) : ''}`);
         for (const c of def.contexts ?? [])
             console.log(`  ${chalk.dim('context')}  ${chalk.cyan(c.path)} ${chalk.dim('—')} ${c.purpose}`);
         for (const ig of def.integrations ?? []) {
@@ -742,6 +761,7 @@ export function registerProjectsCommands(program) {
         .option('--root <path>', 'Repo / monorepo root')
         .option('--path <subdir>', 'Default cwd for agents (a monorepo subdir)')
         .option('--description <text>', 'One-line description shown on the card')
+        .option('--goal <objective:measure...>', 'Replace the goals this project serves; repeatable')
         .action((name, opts) => {
         const def = loadProjectDef(name);
         if (!def) {
@@ -749,7 +769,7 @@ export function registerProjectsCommands(program) {
             process.exit(1);
         }
         const fields = ['repo', 'root', 'path', 'description'].filter((k) => opts[k] !== undefined);
-        if (fields.length === 0) {
+        if (fields.length === 0 && !opts.goal?.length) {
             console.error(chalk.red('Nothing to set. Pass a field, e.g. --repo <owner/repo>.'));
             process.exit(1);
         }
@@ -762,6 +782,8 @@ export function registerProjectsCommands(program) {
             def.root = opts.root;
         if (opts.description !== undefined)
             def.description = opts.description;
+        if (opts.goal?.length)
+            def.goals = opts.goal.map(parseGoalFlag);
         if (opts.path !== undefined) {
             // `--path` is a subdir OF the root, so without one there is nothing to
             // hang it off. A def imported with `--from-linear` that found no local
@@ -780,6 +802,8 @@ export function registerProjectsCommands(program) {
         console.log(chalk.green(`Updated ${def.name}`));
         for (const f of fields)
             console.log(chalk.gray(`  ${f}  ${f === 'path' ? def.defaultPath : def[f]}`));
+        if (opts.goal?.length)
+            console.log(chalk.gray(`  goals  ${def.goals?.map((g) => g.objective).join(' · ')}`));
     });
     // ---- link ----
     projects

package/dist/commands/secrets.js

@@ -18,7 +18,7 @@ import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon.js';
 import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveHostSshTarget, verifyRemoteKeychainPush, keychainWriteFailureMessage, } from '../lib/secrets/remote.js';
 import { remoteShellFor, buildWindowsStdinImportCommand } from '../lib/hosts/remote-cmd.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
-import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, readBundleIfDecryptable, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
+import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
 import { parseListFilters, bundleMatchesFilter, bundleExpiry, filterIsActive, describeFilter, parseSortField, sortBundles, SORT_FIELDS, REF_KINDS, DEFAULT_EXPIRING_DAYS, } from '../lib/secrets/list-filter.js';
 import { encryptForFallback, decryptForFallback } from '../lib/secrets/filestore.js';
 import { getKeychainToken, getKeychainTokens, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from '../lib/secrets/index.js';
@@ -2738,10 +2738,14 @@ Examples:
                 return;
             }
             bundle.policy = next;
-            // writeBundle evicts any broker-held copy, so tightening hold ->
-            // always/never takes effect NOW: the next read re-prompts (`always`)
-            // or reads its no-ACL item directly (`never`).
-            writeBundle(bundle);
+            // Re-store the VALUE items so their keychain ACL matches the new tier —
+            // NOT just the metadata. macOS gates each read on the item's own ACL
+            // (SEC-19); a metadata-only write would leave a hold/always bundle's
+            // biometry ACL in place and keep popping Touch ID forever after a switch
+            // to `never`. reAclBundleItems reads once (the last prompt this bundle
+            // raises when tightening to `never`), rewrites no-ACL, and evicts any
+            // broker-held copy so the change takes effect on the very next read.
+            reAclBundleItems(bundle);
             console.log(chalk.green(`${bundle.name} policy set to ${next}.`));
             if (next === 'hold') {
                 console.log(chalk.gray('Held by the secrets-agent for ~7 days after one unlock (auto-cache is on by default; disable with `secrets.agent.auto: false` in agents.yaml).'));

package/dist/commands/teams.js

@@ -1539,7 +1539,7 @@ export function registerTeamsCommands(program) {
                     repo: opts.repo,
                     branch: opts.branch,
                     model: a.model ?? undefined,
-                    env: shareRuntimeEnv({ agentOnly: true }),
+                    env: shareRuntimeEnv(),
                 };
                 const cloudTask = await prov.dispatch(dispatchOpts);
                 return { cloudSessionId: cloudTask.id };
@@ -1557,7 +1557,7 @@ export function registerTeamsCommands(program) {
                 repo: opts.repo,
                 branch: opts.branch,
                 model: opts.model,
-                env: shareRuntimeEnv({ agentOnly: true }),
+                env: shareRuntimeEnv(),
             };
             try {
                 const cloudTask = await prov.dispatch(dispatchOpts);

package/dist/commands/watchdog.js

@@ -29,6 +29,7 @@ import { mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { gcMailbox } from '../lib/mailbox-gc.js';
 import { ensureWatchdogRoutine, isWatchdogRoutineEnabled, watchdogRoutineExists, WATCHDOG_ROUTINE_NAME, WATCHDOG_ROUTINE_SCHEDULE, } from '../lib/watchdog/routine.js';
 import { runWatchdogTick, writePolicySentinel, DEFAULT_THRESHOLDS, } from '../lib/watchdog/runner.js';
+import { isWatchdogRotateEnabled, listRotateStates, setWatchdogRotateEnabled } from '../lib/watchdog/rotate.js';
 /** Default state dir the runner and these subcommands share. */
 function stateDir() {
     return path.join(getRuntimeStateDir(), 'watchdog');
@@ -79,6 +80,8 @@ async function runMailboxGc(sessions) {
 function colorForOutcome(o) {
     if (o.injected)
         return chalk.green;
+    if (o.decision === 'rotate')
+        return chalk.magenta;
     if (o.addressable === false)
         return chalk.yellow;
     if (o.stall === 'stalled' && o.decision === 'nudge')
@@ -92,12 +95,14 @@ function printTick(result, willInject) {
     console.log(`${chalk.bold('watchdog')} ${mode}  ` +
         `${counts.total} live · ${counts.stalled} stalled · ` +
         `${chalk.green(String(counts.nudged))} nudged · ` +
-        `${chalk.yellow(String(counts.unaddressable))} un-addressable`);
+        `${chalk.yellow(String(counts.unaddressable))} un-addressable` +
+        (counts.rotating > 0 ? ` · ${chalk.magenta(String(counts.rotating))} rotating` : ''));
     for (const o of result.outcomes) {
         const tag = o.injected ? 'NUDGED'
-            : o.addressable === false ? 'FLAGGED'
-                : o.decision === 'nudge' ? 'WOULD-NUDGE'
-                    : 'skip';
+            : o.decision === 'rotate' ? (o.rotatePhase === 'failed' ? 'ROTATE-FAIL' : 'ROTATE')
+                : o.addressable === false ? 'FLAGGED'
+                    : o.decision === 'nudge' ? 'WOULD-NUDGE'
+                        : 'skip';
         const c = colorForOutcome(o);
         const who = o.label || o.sessionId?.slice(0, 8) || o.kind;
         const where = o.host ? chalk.dim(`[${o.host}]`) : '';
@@ -194,8 +199,14 @@ export function registerWatchdogCommand(program) {
       # Turn on the ALWAYS-ON watchdog (a daemon-fired routine)
       agents watchdog enable
 
+      # Show the routine, rotate config, and any in-flight in-place rotates
+      agents watchdog status
+
       # Leave one session detected-but-untouched
       agents watchdog policy <sessionId> handsoff
+
+      # Opt out of in-place rotate only (nudging stays on)
+      agents watchdog rotate off
     `,
         notes: `
       Decision path: a cheap deterministic pre-filter resolves the obvious cases
@@ -217,6 +228,20 @@ export function registerWatchdogCommand(program) {
       Ghostty with no tmux) is flagged for the menu-bar and SKIPPED -- never a
       guessed or frontmost target.
 
+      Rotate: a stalled session whose tail shows a HARD account limit ("You've
+      hit your weekly limit - resets ...") is ROTATED IN PLACE instead of nudged:
+      the tick gates on the same healthy-account selection 'agents run auto'
+      makes (zero healthy -> one skip event per cooldown window, terminal
+      untouched), injects the harness's exit sequence, relaunches
+      'agents run auto --interactive --session-id <uuid>' in the SAME tab, waits
+      (bounded, 60s) for the new TUI, then injects the resume replay for the old
+      session. On timeout the session is flagged and never blind-typed into; the
+      flag says the terminal may sit at a bare shell and needs a manual
+      'agents run auto'. A failed rotate is suppressed for 15m before retry.
+      Default ON; disable with 'agents watchdog rotate off' (writes
+      'watchdog.rotate: off' to ~/.agents/agents.yaml; nudging stays on).
+      State machine: ~/.agents/.cache/state/watchdog/rotate/<sessionId>.json.
+
       Always-on: 'agents watchdog enable' creates + enables a 'watchdog' command
       routine ('${WATCHDOG_ROUTINE_SCHEDULE}' -> agents watchdog --nudge) and reloads the
       daemon; 'disable' pauses it. Inspect it with 'agents routines list'. Defaults
@@ -244,6 +269,20 @@ export function registerWatchdogCommand(program) {
         await reloadDaemonForRoutine(false);
         console.log(chalk.yellow('watchdog: DISABLED (routine paused)'));
     });
+    cmd.command('rotate <state>')
+        .description('Turn in-place rotate of rate-limited sessions on|off (watchdog.rotate in agents.yaml). ' +
+        'Rotate-only: nudging stays on — unlike `watchdog disable`, which pauses the whole watchdog.')
+        .action((state) => {
+        const s = state.toLowerCase();
+        if (s !== 'on' && s !== 'off') {
+            console.error(chalk.red(`invalid state '${state}'. Use: on | off`));
+            process.exitCode = 1;
+            return;
+        }
+        setWatchdogRotateEnabled(s === 'on');
+        console.log(`watchdog: rotate ${s === 'on' ? chalk.green('ON') : chalk.yellow('OFF')} ` +
+            chalk.dim(`(watchdog.rotate: ${s} in agents.yaml)`));
+    });
     cmd.command('status')
         .description('Show whether the always-on watchdog routine is enabled and where state is written.')
         .option('--json', 'Emit status as JSON (for the menu-bar / scripts)')
@@ -254,11 +293,31 @@ export function registerWatchdogCommand(program) {
         // read it correctly regardless of which command commander bound it to.
         const json = command.optsWithGlobals().json === true;
         const on = isWatchdogRoutineEnabled();
+        const rotate = isWatchdogRotateEnabled() ? 'on' : 'off';
+        const rotates = listRotateStates(stateDir());
+        const inflight = rotates.filter((r) => r.phase !== 'done' && r.phase !== 'failed');
         if (json) {
-            console.log(JSON.stringify({ enabled: on, routine: WATCHDOG_ROUTINE_NAME, stateDir: stateDir() }));
+            console.log(JSON.stringify({
+                enabled: on,
+                routine: WATCHDOG_ROUTINE_NAME,
+                stateDir: stateDir(),
+                rotate,
+                rotates: rotates.map((r) => ({
+                    sessionId: r.sessionId,
+                    newSessionId: r.newSessionId,
+                    agent: r.agent,
+                    phase: r.phase,
+                    updatedAtMs: r.updatedAtMs,
+                    error: r.error,
+                })),
+            }));
             return;
         }
         console.log(`always-on watchdog: ${on ? chalk.green('ON') : chalk.dim('off')} (routine '${WATCHDOG_ROUTINE_NAME}')`);
+        console.log(`rotate: ${rotate === 'on' ? chalk.green('on') : chalk.yellow('off')} (watchdog.rotate in agents.yaml) · ${inflight.length} in-flight`);
+        for (const r of inflight) {
+            console.log(`  ${chalk.magenta(r.phase.padEnd(12))} ${chalk.bold(r.sessionId.slice(0, 8))} → ${r.newSessionId.slice(0, 8)}${r.error ? chalk.red(`  ${r.error}`) : ''}`);
+        }
         console.log(`state dir: ${chalk.dim(stateDir())}`);
     });
     // --- per-session policy ----------------------------------------------------

package/dist/lib/crabbox/cli.d.ts

@@ -83,6 +83,8 @@ export declare function pickTailscaleBundleFromList(bundles: SecretsBundle[]): {
     name: string;
     key: string;
 } | undefined;
+/** Test seam: drop every crabboxEnv secrets memo so each test resolves fresh. */
+export declare function resetCrabboxSecretsMemosForTest(): void;
 /** A resolved lease bundle: its name, plus (auto-detect only) the exact keys to inject. */
 export interface ResolvedLeaseBundle {
     name: string;

package/dist/lib/crabbox/cli.js

@@ -67,6 +67,42 @@ function resolveTailscaleBundleMemo() {
     }
     return tailscaleBundleMemo.value;
 }
+/**
+ * Process-lifetime memo for the RESOLVED tailscale key value, next to the pick
+ * memo above. `crabboxEnv` runs several times per lease (list/wait/spawn/stop),
+ * and the single-key subset read (`keys: [ts.key]`) is rejected by
+ * `canCacheResolvedEnv` for broker auto-cache — so without this memo a
+ * non-broker-held tailscale bundle re-read the keychain on EVERY call (and,
+ * pre-guard, could pop a Touch ID sheet each time). One read per process,
+ * success or failure (a failed read memoizes as undefined: the catch below
+ * already degrades to a public-network lease, retrying mid-process only
+ * repeats the same failure).
+ */
+let tailscaleValueMemo;
+function resolveTailscaleKeyValueMemo(ts) {
+    if (!tailscaleValueMemo) {
+        let value;
+        try {
+            const { env } = readAndResolveBundleEnv(ts.name, {
+                caller: 'agents run --lease (crabbox tailscale)',
+                keys: [ts.key],
+                agentOnly: isHeadlessSecretsContext(),
+            });
+            value = env[ts.key];
+        }
+        catch {
+            /* best-effort — tailscale is opt-in plumbing, never blocks a public lease */
+        }
+        tailscaleValueMemo = { value };
+    }
+    return tailscaleValueMemo.value;
+}
+/** Test seam: drop every crabboxEnv secrets memo so each test resolves fresh. */
+export function resetCrabboxSecretsMemosForTest() {
+    tailscaleBundleMemo = undefined;
+    tailscaleValueMemo = undefined;
+    leaseBundleMemo = undefined;
+}
 /**
  * The secrets bundle to feed crabbox, resolved in priority order:
  *   1. `AGENTS_LEASE_SECRETS_BUNDLE` env var          — explicit, no keychain
@@ -151,23 +187,15 @@ export function crabboxEnv(opts) {
     // declares a tailscale auth key, when the ambient env doesn't already set one.
     // Best-effort and opt-in — a missing/unreadable tailscale bundle never fails a
     // public-network lease; `crabboxWarmup({ netMode: 'tailscale' })` is what decides
-    // whether the key is actually used.
+    // whether the key is actually used. The resolved value is memoized per process
+    // (see resolveTailscaleKeyValueMemo) so repeated crabboxEnv calls read the
+    // keychain at most once.
     if (!out.CRABBOX_TAILSCALE_AUTH_KEY) {
         const ts = resolveTailscaleBundleMemo();
         if (ts) {
-            try {
-                const { env } = readAndResolveBundleEnv(ts.name, {
-                    caller: 'agents run --lease (crabbox tailscale)',
-                    keys: [ts.key],
-                    agentOnly: isHeadlessSecretsContext(),
-                });
-                const value = env[ts.key];
-                if (value)
-                    out.CRABBOX_TAILSCALE_AUTH_KEY = value;
-            }
-            catch {
-                /* best-effort — tailscale is opt-in plumbing, never blocks a public lease */
-            }
+            const value = resolveTailscaleKeyValueMemo(ts);
+            if (value)
+                out.CRABBOX_TAILSCALE_AUTH_KEY = value;
         }
     }
     return out;

package/dist/lib/projects.d.ts

@@ -51,6 +51,19 @@ export interface ProjectContext {
     /** One line on how this subtree relates to the project. */
     purpose: string;
 }
+/**
+ * A project goal — the OKR-shaped "why". A project serves one or more goals: a
+ * qualitative `objective` ("Ship agents-cli 2.0") and an optional `measure`, the
+ * key result that says whether it's landing ("fleet on 2.x", "p95 < 200ms"). The
+ * goal is the outcome the work is chasing; milestones (dated checkpoints, pulled
+ * from Linear) and live work (agents / PRs / artifacts) are how far along it is.
+ */
+export interface ProjectGoal {
+    /** The outcome, in a line. */
+    objective: string;
+    /** Optional key result — how success is measured. */
+    measure?: string;
+}
 /** An external context source hung off the project (surfaced in `projects show`). */
 export interface ProjectIntegration {
     /** e.g. `gdrive`, `notion`, `figma`, `url`. */
@@ -73,6 +86,8 @@ export interface ProjectDef {
     repos?: ProjectRepo[];
     /** Described starting points inside the project. */
     contexts?: ProjectContext[];
+    /** The outcomes this project serves (OKR-shaped); a project may have several. */
+    goals?: ProjectGoal[];
     /** External context sources (Drive, docs, …). */
     integrations?: ProjectIntegration[];
     /** Linear project link — reuses the existing GraphQL path. */

package/dist/lib/projects.js

@@ -121,6 +121,18 @@ export function validateProjectDef(raw, sourceName) {
             return [];
         });
     }
+    if (Array.isArray(o.goals)) {
+        def.goals = o.goals.flatMap((g) => {
+            if (g && typeof g === 'object' && typeof g.objective === 'string') {
+                const gg = g;
+                const goal = { objective: gg.objective };
+                if (typeof gg.measure === 'string')
+                    goal.measure = gg.measure;
+                return [goal];
+            }
+            return [];
+        });
+    }
     if (Array.isArray(o.integrations)) {
         def.integrations = o.integrations.flatMap((i) => {
             if (i &&

package/dist/lib/rotate.d.ts

@@ -6,7 +6,7 @@
  */
 import type { AgentId, RunStrategy } from './types.js';
 import type { FallbackEntry } from './exec.js';
-import { type AccountInfo } from './agents.js';
+import { type AccountInfo, type CredentialPresence } from './agents.js';
 import { type UsageSnapshot } from './usage.js';
 export interface RotateCandidate {
     agent: AgentId;
@@ -75,6 +75,21 @@ export declare function getProjectRunStrategy(agent: AgentId, startPath: string)
 export declare function getConfiguredRunStrategy(agent: AgentId, startPath?: string): RunStrategy;
 /** Persist the global run strategy used by bare `agents run <agent>`. */
 export declare function setGlobalRunStrategy(agent: AgentId, strategy: RunStrategy): void;
+/**
+ * Whether a version home can actually authenticate a launch.
+ *
+ * `getAccountInfo` falls back to the active/global HOME when a version home has
+ * no credential of its own, so `agents view` still shows who is logged in. Launch
+ * paths isolate config (GROK_HOME, CODEX_HOME, KIMI_CODE_HOME, CLAUDE_CONFIG_DIR,
+ * …) to the per-version home, so a home that only "inherits" the active login
+ * cannot spawn a signed-in agent — balanced kept picking those empty homes and
+ * the run died on "Not signed in".
+ *
+ * When we know where the credential lives (`knownLocation`), require it under
+ * THIS version home. When we don't (keychain-only / unmapped agents), trust the
+ * existing `signedIn` signal.
+ */
+export declare function isLaunchableSignedIn(signedIn: boolean, presence: Pick<CredentialPresence, 'knownLocation' | 'perVersion'>): boolean;
 /**
  * How old a usage snapshot may be and still settle a routing DECISION.
  *

package/dist/lib/rotate.js

@@ -6,7 +6,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { accountDisplayLabel, getAccountInfo, ALL_AGENT_IDS } from './agents.js';
+import { accountDisplayLabel, getAccountInfo, credentialPresence, ALL_AGENT_IDS, } from './agents.js';
 import { readMeta, writeMeta, getHelpersDir } from './state.js';
 import { listInstalledVersions, getVersionHomePath, resolveVersion } from './versions.js';
 import { getProjectRunConfigs } from './run-config.js';
@@ -68,6 +68,27 @@ export function setGlobalRunStrategy(agent, strategy) {
 function isRotationEligible(candidate) {
     return candidate.signedIn && hasUsageAvailable(candidate);
 }
+/**
+ * Whether a version home can actually authenticate a launch.
+ *
+ * `getAccountInfo` falls back to the active/global HOME when a version home has
+ * no credential of its own, so `agents view` still shows who is logged in. Launch
+ * paths isolate config (GROK_HOME, CODEX_HOME, KIMI_CODE_HOME, CLAUDE_CONFIG_DIR,
+ * …) to the per-version home, so a home that only "inherits" the active login
+ * cannot spawn a signed-in agent — balanced kept picking those empty homes and
+ * the run died on "Not signed in".
+ *
+ * When we know where the credential lives (`knownLocation`), require it under
+ * THIS version home. When we don't (keychain-only / unmapped agents), trust the
+ * existing `signedIn` signal.
+ */
+export function isLaunchableSignedIn(signedIn, presence) {
+    if (!signedIn)
+        return false;
+    if (!presence.knownLocation)
+        return true;
+    return presence.perVersion;
+}
 function isAvailableEligible(candidate) {
     return isRotationEligible(candidate);
 }
@@ -484,17 +505,22 @@ export async function collectRunCandidates(agent) {
         // one per installed version, every time `agents run` cold-starts. If
         // claude's stored token has actually expired, the spawned agent detects
         // it at its own startup and re-auths; that's the correct UX.
+        //
+        // Gate signedIn on a real per-version credential when we know where it
+        // lives — see isLaunchableSignedIn. Do not reuse the active-home fallback
+        // identity for routing, or empty version homes look healthy and die at spawn.
+        const launchable = isLaunchableSignedIn(info.signedIn, credentialPresence(agent, home));
         return {
             agent,
             version,
             home,
             info,
-            accountKey: info.accountKey,
-            accountLabel: accountDisplayLabel(info),
-            email: info.email,
-            usageStatus: info.usageStatus,
-            plan: info.plan,
-            signedIn: info.signedIn,
+            accountKey: launchable ? info.accountKey : null,
+            accountLabel: launchable ? accountDisplayLabel(info) : '',
+            email: launchable ? info.email : null,
+            usageStatus: launchable ? info.usageStatus : null,
+            plan: launchable ? info.plan : null,
+            signedIn: launchable,
             lastActive: info.lastActive,
         };
     }));