@phnx-labs/agents-cli 1.22.100 → 1.22.101

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.22.101
+
+- **`agents sync status` names what drifted, and a merged system-layer skill or subagent reaches the next `agents run` on every box (PHNX-4056).** The status readout said `11 drifted` per install and nothing more, although `AgentVersionStatus.resources` already carried the rows; both human renderers (`agents sync status`, the drift summary `agents sync` prints) now list each drifted or missing resource as `drifted skills/artifacts` under its install line, with the differ's detail when it has one. And when `~/.agents/.system/skills` or `subagents` changed since the last launch of an (agent, version), `agents run` rewrites those resources into the version home through the registered writers before spawning, filtered by the active resource profile like the full sync, with the same stat-tier sentinel shape as the rules run-sync: on 2026-09-10 a merged skill change left 31 of 33 installed copies stale until the 4-hour umbrella autosync, because the shim's `--launch` path mirrors project resources only. Source: `cli/src/lib/system-run-sync.ts`, `cli/src/lib/sync-status.ts`, `cli/src/commands/status.ts`, `cli/src/lib/drift-sync.ts`, `cli/src/lib/exec.ts`, `cli/src/commands/exec.ts`.
+
 ## 1.22.100
 
 - **The daemon's 20-minute auth-probe reuse works again on a box that has uninstalled a version (PHNX-4051).** `isCachedFleetAuthProbeFresh` required EVERY cached auth row to be under 20 minutes old, including rows left behind for versions that are no longer installed. Nothing re-probes those — the probe only walks homes that exist — so their timestamp froze and the check was permanently false: the 3-minute tick live-probed the rate-limited `/api/oauth/usage` for every account on every tick, re-arming the per-account 429 backoff and keeping the usage refresher parked (the RUSH-2998 failure the reuse window exists to prevent; observed on a worker holding rows dated Sep 2 / Sep 6 for uninstalled Claude versions). Freshness now considers only rows for currently installed `(agent, version)` homes and account slots, and the tick prunes the orphan rows when it writes the cache, so `agents view` and fleet status stop reporting a verdict for a version that is gone. `agents devices ping [--strict]` still forces a genuinely live probe. Source: `cli/src/lib/daemon-ticks.ts` (`installedAuthRows`, `isCachedFleetAuthProbeFresh`, `refreshLocalFleetAuthState`), `cli/src/lib/auth-health.ts` (`authTargetKey`, `enumerateLocalAuthInstalls`, `localAuthTargetKeys`, `writeFleetAuthRows`).

package/dist/commands/exec.js

@@ -26,6 +26,7 @@ import { spawnSync } from 'child_process';
 import { randomUUID } from 'crypto';
 import { isSessionTrackedAgent } from '../lib/session/types.js';
 import { applyActiveRulesPresetAtRun } from '../lib/rules/run-sync.js';
+import { applySystemResourcesAtRun } from '../lib/system-run-sync.js';
 import { handleBroadcast } from './run-broadcast.js';
 import { bootMark } from '../lib/boot-profile.js';
 /** Validate a caller-supplied session id before it reaches tmux, paths, indexes, or remote dispatch. */
@@ -2714,6 +2715,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         // path itself; there's no version home to sync into.
         if (defaultVersion) {
             applyActiveRulesPresetAtRun(agent, defaultVersion, getVersionHomePath(agent, defaultVersion));
+            applySystemResourcesAtRun(agent, defaultVersion, getVersionHomePath(agent, defaultVersion));
         }
         bootMark('rules-sync:done');
         // Login preflight (advisory, warn + continue). On a local INTERACTIVE

package/dist/commands/status.js

@@ -13,7 +13,7 @@ import chalk from 'chalk';
 import { AGENTS } from '../lib/agents.js';
 import { setHelpSections } from '../lib/help.js';
 import { addHostOption } from '../lib/hosts/option.js';
-import { computeSyncStatus } from '../lib/sync-status.js';
+import { computeSyncStatus, formatDriftRows } from '../lib/sync-status.js';
 import { promptDriftSync } from '../lib/drift-sync.js';
 import { resolveConfiguredModel } from '../lib/models.js';
 import { resolveSurface } from './utils.js';
@@ -93,6 +93,8 @@ export function registerStatusCommand(syncCmd) {
                 + (v.isDefault ? chalk.gray(' (default)') : '');
             const pad = ' '.repeat(Math.max(1, 34 - plain.length));
             console.log(`  ${shown}${pad}${versionSummary(v)}`);
+            for (const line of formatDriftRows(v))
+                console.log(chalk.gray(`      ${line}`));
         }
         if (status.totals.orphan > 0) {
             console.log(chalk.gray(`  (${status.totals.orphan} orphan${status.totals.orphan === 1 ? '' : 's'} — run \`agents prune cleanup\`)`));

package/dist/lib/drift-sync.js

@@ -24,7 +24,7 @@ import { pullRepo } from './git.js';
 import { repairAfterSync, renderRepairAfterSync } from './reconcile-and-repair.js';
 import { promptAgentVersionSelection } from './installations/versions.js';
 import { isInteractiveTerminal, isPromptCancelled } from './format.js';
-import { computeSyncStatus, } from './sync-status.js';
+import { computeSyncStatus, formatDriftRows } from './sync-status.js';
 const agentName = (id) => AGENTS[id]?.name ?? id;
 /** "claude@2.1.170  2 drifted · 1 missing" for one version. */
 function versionLine(v) {
@@ -42,8 +42,11 @@ function renderSummary(status, needing) {
     if (status.system.behind > 0) {
         console.log(`  ${'.system repo'.padEnd(28)} ${chalk.yellow(`${status.system.behind} commit${status.system.behind === 1 ? '' : 's'} behind`)} ${chalk.gray('— pull recommended')}`);
     }
-    for (const v of needing)
+    for (const v of needing) {
         console.log(versionLine(v));
+        for (const line of formatDriftRows(v))
+            console.log(chalk.gray(`      ${line}`));
+    }
     if (status.totals.orphan > 0) {
         console.log(chalk.gray(`  (${status.totals.orphan} orphan${status.totals.orphan === 1 ? '' : 's'} — run \`agents prune cleanup\`)`));
     }

package/dist/lib/exec.js

@@ -39,6 +39,7 @@ import { probeUnprivilegedUserns } from './linux-userns.js';
 import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { applyAddDirs } from './add-dir.js';
 import { applyActiveRulesPresetAtRun } from './rules/run-sync.js';
+import { applySystemResourcesAtRun } from './system-run-sync.js';
 import { resolveHarnessAdapter, stripForeignConfigDir } from './harness/index.js';
 import { resolveConfigVersion } from './harness/exec-config-version.js';
 import { getAccountInfo } from './agents.js';
@@ -2406,6 +2407,7 @@ export async function runWithFallback(options) {
         const rulesVersion = version ?? resolveVersion(agent);
         if (rulesVersion) {
             applyActiveRulesPresetAtRun(agent, rulesVersion, getVersionHomePath(agent, rulesVersion));
+            applySystemResourcesAtRun(agent, rulesVersion, getVersionHomePath(agent, rulesVersion));
         }
         // Record the entry we're about to attempt so the caller (audit log) sees the
         // agent+version that actually ran, even after a rate-limit handoff.

package/dist/lib/sync-status.d.ts

@@ -115,6 +115,12 @@ export interface ResidualDrift {
 export declare function verifyVersionConverged(agent: AgentId, version: string, cwd?: string): ResidualDrift | null;
 /** One-line-per-resource description of residual drift, for the sync exit line. */
 export declare function formatResidualDrift(residual: ResidualDrift[]): string[];
+/**
+ * The rows behind a "N drifted" count, one line each, for the human renderers.
+ * A count alone cannot be acted on; the name says which skill or hook to look
+ * at, and `detail` says what differs when the differ knows.
+ */
+export declare function formatDriftRows(v: AgentVersionStatus): string[];
 export interface SyncStatusOptions {
     cwd?: string;
     /** Restrict to specific agent ids; undefined = every supported agent. */

package/dist/lib/sync-status.js

@@ -54,6 +54,17 @@ export function formatResidualDrift(residual) {
     }
     return lines;
 }
+/**
+ * The rows behind a "N drifted" count, one line each, for the human renderers.
+ * A count alone cannot be acted on; the name says which skill or hook to look
+ * at, and `detail` says what differs when the differ knows.
+ */
+export function formatDriftRows(v) {
+    return v.resources
+        .filter((r) => r.status === 'drifted' || r.status === 'missing')
+        .sort((a, b) => a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name))
+        .map((r) => `${r.status.padEnd(7)} ${r.kind}/${r.name}${r.detail ? ` (${r.detail})` : ''}`);
+}
 const STATUS_MAP = {
     ok: 'synced',
     diff: 'drifted',

package/dist/lib/system-run-sync.d.ts

@@ -0,0 +1,11 @@
+import type { AgentId } from './types.js';
+export interface SystemRunSyncResult {
+    /** Names rewritten per kind; empty when the sentinel matched (skip-fast). */
+    skills: string[];
+    subagents: string[];
+}
+/**
+ * Refresh the system layer's skills and subagents into the version home when
+ * their source directories changed since the last run for (agent, version).
+ */
+export declare function applySystemResourcesAtRun(agent: AgentId, version: string, versionHome: string): SystemRunSyncResult;

package/dist/lib/system-run-sync.js

@@ -0,0 +1,114 @@
+/**
+ * System-layer skills and subagents refresh at `agents run` launch time.
+ *
+ * `agents sync <harness>@all system` rewrites every version home, but nothing
+ * runs it when the `.system` mirror moves: the shim's `--launch` path compiles
+ * project rules and mirrors project resources only, and the SessionStart
+ * autosync fires the umbrella at most once per 4 h. Rules already close that
+ * gap per run (`rules/run-sync.ts`); skills and subagents did not, so a merged
+ * system-layer skill change left 31 of 33 installed copies on the old text
+ * (PHNX-4056). This is the same shape as the rules run-sync: a small per-
+ * (agent, version) sentinel of source fingerprints, stat-tier comparison, and
+ * a write through the registered writers only when a source file changed.
+ *
+ * Scope: the system layer's `skills/` and `subagents/` directories. The
+ * writers resolve each name through the normal precedence (a user-layer
+ * shadow still wins), and the active resource profile filters both kinds the
+ * same way `syncResourcesToVersion` does. Never blocks a launch: any failure
+ * is swallowed and leaves the sentinel stale, so the next run retries.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { getCacheDir, getSystemSkillsDir, getSystemSubagentsDir } from './state.js';
+import { getWriter } from './staleness/registry.js';
+import { fingerprintDir, isDirStale } from './staleness/fingerprint.js';
+import { filterNamesForActiveResourceProfile } from './resource-profiles.js';
+/** ~/.agents/.cache/system-run-sync/ — regenerable; a lost sentinel costs one extra write. */
+function sentinelPath(agent, version) {
+    const key = `${agent}@${version}`.replace(/[^a-zA-Z0-9@._-]/g, '_');
+    return path.join(getCacheDir(), 'system-run-sync', `${key}.json`);
+}
+function loadSentinel(agent, version) {
+    try {
+        return JSON.parse(fs.readFileSync(sentinelPath(agent, version), 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+function saveSentinel(agent, version, sentinel) {
+    const p = sentinelPath(agent, version);
+    try {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, JSON.stringify(sentinel));
+    }
+    catch {
+        // Best-effort — a failed write just means the next run redoes the copy.
+    }
+}
+/** Subdirectories of `dir` that carry `marker` (SKILL.md / AGENT.md). */
+function namesWithMarker(dir, marker) {
+    const out = new Map();
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        if (!e.isDirectory() || e.name.startsWith('.'))
+            continue;
+        const src = path.join(dir, e.name, marker);
+        if (fs.existsSync(src))
+            out.set(e.name, src);
+    }
+    return out;
+}
+/**
+ * Refresh the system layer's skills and subagents into the version home when
+ * their source directories changed since the last run for (agent, version).
+ */
+export function applySystemResourcesAtRun(agent, version, versionHome) {
+    const result = { skills: [], subagents: [] };
+    const stored = loadSentinel(agent, version);
+    const next = { ...stored };
+    const kinds = [
+        { kind: 'skills', dir: getSystemSkillsDir(), marker: 'SKILL.md' },
+        { kind: 'subagents', dir: getSystemSubagentsDir(), marker: 'AGENT.md' },
+    ];
+    for (const { kind, dir, marker } of kinds) {
+        if (!fs.existsSync(dir))
+            continue;
+        const prev = stored[kind];
+        if (prev && prev.dir === dir && !isDirStale(prev.dir, prev.files, dir))
+            continue;
+        const writer = getWriter(kind, agent);
+        if (!writer)
+            continue;
+        const sources = namesWithMarker(dir, marker);
+        // The active resource profile is the per-client scoping seam (a brand pins
+        // one); it filters every kind here exactly as `syncResourcesToVersion` does.
+        const names = filterNamesForActiveResourceProfile(kind, Array.from(sources.keys()), sources);
+        if (names.length === 0) {
+            next[kind] = { dir, files: fingerprintDir(dir) };
+            continue;
+        }
+        let written;
+        try {
+            written = writer.write({ version, versionHome, selection: names, cwd: '' });
+        }
+        catch {
+            continue; // leave the sentinel stale so the next run retries
+        }
+        result[kind] = written.synced;
+        // A per-name failure (an AGENT.md that does not parse) also leaves the
+        // sentinel stale: the next run retries instead of never seeing it again.
+        if (written.errors?.length)
+            continue;
+        next[kind] = { dir, files: fingerprintDir(dir) };
+    }
+    if (JSON.stringify(next) !== JSON.stringify(stored))
+        saveSentinel(agent, version, next);
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.100",
+  "version": "1.22.101",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",