@phnx-labs/agents-cli 1.22.115 → 1.22.117

package/CHANGELOG.md

@@ -1,5 +1,154 @@
 # Changelog
 
+## 1.22.117
+
+- **`agents run --local`, and `--device <this machine>` no longer SSHes to itself.** A bare
+  interactive run places itself like `--device auto` (PHNX-4083), and the documented way to
+  stay put was `--device <this machine>` — which took the remote path and probed its own
+  login shell over SSH, timing out on a loaded box. `--local` is the explicit local pin
+  (the same door as `--where local`, which previously expanded to nothing and was then
+  overridden by the default placement); any host flag naming this machine by short id,
+  MagicDNS name, loopback, or the `interactive` sentinel now resolves to the same local
+  run. The placement-failure hint names `--local`. Source: `cli/src/commands/exec.ts`
+  (`pinLocalWhenTargetIsSelf`), `cli/src/lib/placement.ts`, `cli/src/lib/hosts/remote-cmd.ts`.
+
+## 1.22.116
+
+- **`agents feed answer` is bounded, exactly-once, and truthful about delivery
+  (PHNX-3999).** The AGI Menu abandons a reply at 30s; this path used to blow
+  that budget and then report a fabricated receipt.
+  - **Bounded.** The requested attention key names its session, so only that
+    session is reconciled and the optional `gh pr view` enrichment runs only for
+    a key whose generation is a PR review. Previously every active session was
+    enriched — one 15s-bounded `gh` call each — *before* the key was compared.
+    The whole operation now runs under one deadline, and a forwarded answer is
+    raced against it directly rather than trusting the transport's own timer.
+  - **Exact tokens across the hop.** A forwarded answer is POSIX-quoted with the
+    canonical `shellQuote` and run through the canonical `sshExecAsync`, so a
+    multiline answer or one carrying `$`, backticks, quotes or `;` arrives
+    byte-identical instead of being re-parsed by the remote shell.
+  - **Multiline free text.** A multiline answer is delivered into a tmux rail as
+    one bracketed paste (`injectIntoTerminal`'s new `paste` option), so a TUI
+    inserts it verbatim instead of submitting one line at a time. A rail that
+    cannot carry the framing refuses *before* the claim is taken.
+  - **A claim is no longer a resolution.** `recordAnswer` gains a two-phase
+    `pending` mode: the claim locks the item but leaves the block `open` and
+    writes no resolution tombstone, so an unconfirmed delivery can no longer make
+    the request silently vanish from the feed. Only the AGENT's own
+    acknowledgement resolves it — a `consumed`/`continued` receipt promotes the
+    claim through `confirmAnswerResolution`, bound to the generation and attempt
+    it was taken for, so a slow delivery cannot resolve the question the agent
+    has since moved on to. A `queued` receipt never does.
+  - **Truthful, typed outcomes for the operator UI.** `--json` now emits
+    `status` (`delivered` / `already_answered` / `unknown` / `failed`),
+    `delivery` (`receipt` / `unconfirmed` / `failed`), `resolved`, `host`,
+    `attempt`, and the block's **real** `MessageReceipt` — never a synthesized
+    one. `queued` is delivery, never resolution; `dropped`/`expired` read as
+    failures rather than as the furthest-along success. A timeout, a truncated
+    remote reply, or a partly-written keystroke sequence is `unknown` (the claim
+    is kept, so a retry cannot double-send); only a provable non-delivery is
+    `failed`.
+  - **`agents feed answer <key> --check [--attempt <at>]`** is a new read-only
+    reconciliation — the "check delivery" path for an unconfirmed answer. It
+    never claims, routes or resends, and it is bound to the requested generation
+    and attempt, so a stale card can never be resolved by the next question's
+    receipt.
+  - **Stranded claims reconcile.** A claim a kill left with no receipt is adopted
+    and completed only on the mailbox rail, where the whole spool (inbox,
+    processing and consumed) is scanned by block id so the answer is never
+    enqueued twice, and only through a compare-and-swap so two retries cannot
+    both adopt it.
+
+- **AGI Menu: synchronized Headless-runs defaults, Home and device preferences.**
+  Five new `agents config` keys, validated at write time and synced fleet-wide like
+  the existing `menubar.menu.*` set: `menubar.menu.headlessAgent` and
+  `menubar.menu.headlessFallbackAgent` (each a registered agent id — a typo is
+  refused, not stored), `menubar.menu.headlessPlacement`
+  (`auto` | `local` | `interactive` | a device name),
+  `menubar.menu.sessionUpdates`, and `menubar.menu.deviceSort`
+  (`name` | `role` | `load` | `memory` | `disk`).
+- **`agents run --fallback <agent>` now reaches the alternate harness when the
+  primary's accounts are exhausted before the run starts.** Previously that case
+  printed "no healthy account" and exited 1, so a configured alternate never fired
+  for the one situation it exists for; the mid-run handoff also no longer stops at
+  three accounts when an explicit alternate is configured, so every healthy account
+  of the primary is tried before another harness. A signed-out primary still fails
+  loud with the login hint — logging in is the fix there, not a different harness.
+- **`agents menubar snapshot --json` reports each device's role and specs.** Every
+  `devices[]` row gains `role`, `autoEligible` (whether `--device auto` may pick it)
+  and `stats` — cores, total/free memory and disk, load, reachability, and when each
+  was observed. Read from the existing fleet-stats cache, so no fleet probe; `null`
+  for a device never measured, and every unobserved number is `null` rather than `0`.
+- **Session rows carry `confirmedProject`.** The registered project whose root
+  contains the session's working directory, or `null` when the association is not
+  confirmed, on `agents feed watch --json`, `agents sessions watch --json`, and
+  `agents sessions --active --json`. A directory no project definition names — even
+  one that happens to be a git repository — is no longer filed under a project
+  invented from its folder name. The existing `project` field is unchanged.
+- **Session titles exclude shell and control scaffolding.** A harness-generated
+  title that is a `<bash-input>`/`<command-name>`/`<system-reminder>` wrapper, or a
+  bare control command such as `/clear` or `/compact`, is rejected so the row shows
+  the generated title or the user's own first prompt instead. A `/rename` title is
+  still kept verbatim, and the original prompt stays on the row. Existing indexed
+  sessions are re-derived on their next scan.
+
+- **Session previews retain details across devices (PHNX-3999).** An exact session
+  ID and owning device use one bounded request, with a durable local copy for
+  offline reading. Reopening unchanged sessions avoids network requests; activity
+  changes invalidate the copy, and failed requests back off without hiding prior
+  content. Concurrent requests coalesce, including failed manual refreshes.
+  SQLite contention, lock waiting, and transport share a 10-second budget.
+- **Large local transcripts show bounded recent details.** Previews reuse the
+  canonical transcript parsers and timeline projection, mark partial history,
+  and report missing transcripts explicitly. Cached timeline data is accepted
+  only for the exact file modification time and size that produced it.
+
+- `agents setup secrets` / `agents clis install secrets` now install Secrets CLI 0.1.5, which accepts the shared Phoenix `--host` address grammar (`ssh://[user@]host`, bare `user@host`/alias; other schemes fail loud) on `secrets` and `secrets hosts pin` (PHNX-4090) — matching the `--host` grammar computer-cli 0.1.5 already ships. Existing installs are unaffected; the canonical pin lives in `cli/src/lib/secrets-cli.ts`.
+
+- **`agents setup` now installs the standalone `term` CLI as a first-class onboarding phase (PHNX-4092).** The PTY engine `agents fleet login` and `agents auth mint` spawn on demand lives in `@phnx-labs/term-cli` (extracted PHNX-4091); a fleet device with it missing failed those flows loud. The onboarding hub gains a `term` phase and an `agents setup term` wizard (with `--install-only` / `--terminal`) that installs the pinned `@phnx-labs/term-cli@0.1.0` — via the system `clis/term.yaml` manifest, else a pinned `npm i -g` — the same way `browser`/`computer`/`secrets` install. `agents setup status` and `--tool term` report its readiness: unlike the other tools `term` has no `status --json` health surface, so presence on PATH is the whole readiness signal (no probe, no configure step). Source: `cli/src/commands/setup-term.ts`, `cli/src/commands/setup.ts`, `cli/src/lib/setup-tool-status.ts`, `cli/src/lib/setup-tool-install.ts`.
+
+- **`browser status` no longer goes blank when one Arc task is stale (PHNX-3999).** A
+  single Arc tab that had been moved to another window or Space — or closed — made
+  `agents browser status` throw, and **every** profile vanished from the listing,
+  including healthy ones with nothing to do with Arc. The refusal to adopt a moved
+  tab is correct and is unchanged: an action still will not drive a tab its task no
+  longer owns. What changed is that read-only `status` no longer inherits the blast
+  radius. An unreadable task is reported with the tab count it owns on disk plus the
+  reason its live tabs could not be read, an unreadable profile is listed with an
+  `unavailable` reason instead of disappearing, and the other profiles are reported
+  normally. `tabs` is absent rather than empty for such a task, so nothing claims a
+  stale tab is live. Source: `cli/src/lib/browser/service.ts`.
+- **`browser status` reads Arc once per pass instead of once per tab (PHNX-3999).** A
+  profile with 28 tasks paid one AppleScript round trip per owned tab, plus one
+  liveness probe per saved Arc runtime while reconnecting, so a cold `status` spent
+  dozens of serialized round trips before printing anything. It now takes a single
+  snapshot and a single liveness probe for the entire pass, shared across every Arc
+  profile, and never contacts Arc at all when no Arc profile is present. Actions are
+  unchanged and still read Arc live per tab. Source: `cli/src/lib/browser/service.ts`.
+
+- **grok signs in through its device-code flow.** `agents accounts add grok`, `agents accounts login grok#<name>`, and the logged-out hint all run `grok login --device-auth`. Bare `grok login` defaults to `--oauth`, the loopback browser flow, which opens whatever browser profile the OS defaults to. The device-code screen prints the URL and code instead, so the human finishes the sign-in in the browser profile they choose — which is what makes it usable over an SSH shell on a worker. Source: `cli/src/lib/harness-auth-capabilities.ts`, `cli/src/lib/signin-badge.ts`.
+
+- **A feed snapshot larger than the reader budget now reaches the reader whole (PHNX-3999).**
+  The daemon's shared feed socket wrote each envelope in one `socket.write` and dropped the
+  reader the moment its unflushed bytes passed 4 MiB — so a healthy Menu or `agents feed
+  watch --json` client attaching to a fleet whose reset exceeded that got 8 KiB of it, no
+  newline, then EOF, and the CLI exited 0 as if the fleet were empty. Each connection now has
+  one ordered writer that streams the snapshot before any live event in 64 KiB chunks paced
+  by the socket's own `'drain'`. A reader is dropped only when it stays more than 4 MiB of
+  live events behind for 2 s, or leaves a chunk unaccepted for 30 s — a burst of peer resets
+  to a healthy reader is never a drop. The client rejects any close it did not ask for,
+  naming a mid-frame truncation, and a throwing consumer fails that same promise instead of
+  escaping as an uncaught exception. Source: `cli/src/lib/feed/hub-server.ts`.
+
+- **Browser setup installs Browser CLI 0.1.5 (PHNX-3999).** New installations
+  include the status fix that reports unavailable Arc tasks without hiding healthy
+  profiles and reads visible Arc tabs once per status request. Existing browser
+  installations are preserved; upgrade them explicitly with
+  `npm install -g @phnx-labs/browser-cli@0.1.5`. (0.1.5 is a clean re-cut of the
+  partially-published 0.1.4; same behavior.)
+
+- **Removed `agents devices login` (a.k.a. "fleet login").** The remote device-code login orchestration could not work in the account-slot model — a box may hold several accounts per harness, and a per-box native login has no way to say which account it is signing in. It is gone entirely (not deprecated-and-hidden). Accounts are provisioned from durable worker credentials (`agents accounts add/login <harness>#<name>`); a token-less harness (kimi/antigravity) logs in per box — run the harness on that device and complete its native login. Logged-out hints for per-device harnesses now point at that path instead. Source: `cli/src/commands/ssh.ts`, `cli/src/lib/fleet/auth-sync.ts`, `cli/src/lib/signin-badge.ts`, `cli/src/lib/accounts/add.ts`, `cli/src/lib/auth-mint.ts`.
+
 ## 1.22.115
 
 - **Artifact sharing moved out to the standalone `artifacts` CLI (breaking).**
@@ -93,20 +242,18 @@
 
 - **AGI Menu 1.5.0 adds tool sessions and Setup.** The menu separates Agents, Browser and Computer activity, shows browser controls and recorded computer captures, and reports installation and readiness for Browser, Computer and Secrets CLI. It consumes the shared daemon feed without periodic tool subprocesses. The helper floor selects the signed and notarized `menubar/v1.5.0` release.
 
-- **Replacing the browser daemon no longer kills a live browser (PHNX-3999).** The
-  daemon's startup reaper read "the daemon that launched this has exited" as "everything
-  it recorded is garbage" and SIGTERMed the browser — so activating the menu bar,
-  upgrading, or a daemon crash-restart closed a browser you were looking at, and the
-  runtime record was wiped so the survivor could not even be re-attached. But a live
-  browser outliving its daemon is the normal case: shutdown deliberately closes only
-  CDP, and on macOS the browser is spawned detached. A live local browser is now
-  preserved untouched, a dead record is cleared without signalling anything, and a
-  stale `ssh -L` tunnel — which genuinely cannot outlive its owner — is still reaped,
-  decided separately from the browser instead of sharing one kill path. Ownership of a
-  preserved browser transfers only after an identity-checked attach succeeds — including
-  the restart path that restores your open browser tasks — and that rewrites the
-  owning-daemon pid alone, keeping the original launch's metadata. Source:
-  `cli/src/lib/browser/runtime-state.ts`.
+- **Daemon startup preserves surviving local browsers (PHNX-3999).** The startup
+  reaper keeps a live local browser's runtime and task records when its previous
+  daemon has exited. Dead process records and stale SSH tunnels are handled
+  separately. Ownership changes only after an identity-checked reattach succeeds,
+  preserving the original launch metadata. Reconnection requires an existing
+  debugging port: `--remote-debugging-pipe` handles belong to the original service
+  process and cannot transfer to a replacement daemon. Coordinate release of an
+  active pipe-connected browser before restarting its daemon.
+- **Browser setup selects standalone Browser CLI 0.1.3.** The default package for
+  `agents setup browser --install-only` now includes the browser preservation and
+  task-restoration fixes. Existing installations and configured CLI manifests
+  retain their current behavior.
 
 - **BREAKING — deprecated command shims are deleted; every surface has one spelling.** The hidden and warned aliases that kept "still works this release" paths alive are gone, not tombstoned: a script that still calls one now gets commander's `unknown command` / `unknown option` and exits non-zero. Removed → replacement: `agents notify` → `agents send --to owner` (or `agents feed post --level important` for a milestone that should reach the owner; a `feed.broadcast` sink that spawned `agents notify "{message}"` becomes `channel: owner`); `agents doctor --fix` → `agents sync <agent>@all` (doctor is diagnose-only); `agents accounts connect|name|label|attach|detach|switch|set-default` and the hidden `agents accounts mint` / `agents auth mint` → `agents accounts add <harness> [name]`, `agents accounts login <harness>#<name>`, `agents accounts default <harness> [name]`, `agents accounts rename`, and `agents run <harness>#<name>` (accounts select by name; installation bindings are gone); `agents sessions go` → `agents sessions resume --attach-only`; `agents sessions attach` and `agents reconnect` / `agents sessions reconnect` → `agents sessions resume [id]`; `agents repo refresh` → `agents sync`; `agents mcp register` → `agents sync --mcp`; `agents memory sync` → `agents sync --memory`; `agents plugins sync <name>` → `agents sync --plugin <name>`; `agents skills info` → `agents skills view`; `agents run --smart` → `agents run --device auto`; `agents events --audit` → `agents events audit` or `--include ops`; `agents devices prefer|unprefer <name>` → `agents devices config <name> auto-launch.preferred on|--unset`; `agents devices set-interactive [name]` → `agents config set interactive.host <name>` (or `agents devices config <name> interactive.host <name>`); `agents devices configure|note|set <name>` → `agents devices config <name> <key> <value>`. `agents devices enable|disable <name>` stay as first-class, visible sugar over `auto-launch.enabled` (no deprecation notice). Folding `mcp register` into `agents sync` also closed a gap in the replacement: sync's reconcile stage skipped every HTTP MCP server declared in `agents.yaml` (`refresh.ts` `continue`d on `transport: http`) while the removed command registered it — it now registers HTTP servers through the same `registerMcpToTargets` path (`codex mcp add <name> --url <url>`), and the yaml-resource writer's Codex arm no longer silently no-ops on HTTP either (`installMcpViaCodex`). Source: `cli/src/commands/send.ts`, `doctor.ts`, `accounts.ts`, `auth.ts`, `go.ts`, `sessions.ts`, `repo.ts`, `mcp.ts`, `memory.ts`, `plugins.ts`, `skills.ts`, `exec.ts`, `events.ts`, `ssh.ts`, `cli/src/lib/smart-launch.ts`.
 

package/README.md

@@ -53,7 +53,7 @@ agents setup status                    # readiness for browser, computer, fleet,
 agents run claude "explain this repo"  # run any agent on your existing subscription
 ```
 
-Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` unlocks the hosted surfaces — [team spaces](#sign-in) and managed trace sync (`agents traces sync` with no Cloudflare setup). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
+Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` unlocks the hosted surfaces — [team spaces](#sign-in) and managed trace sync (`agents traces sync` with no Cloudflare setup). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, term, fleet, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
 
 The command surface teaches setup through `agents setup` and group-level `--help`.
 The durable system model starts at [`cli/docs/README.md`](cli/docs/README.md).

package/dist/commands/browser.js

@@ -2762,6 +2762,11 @@ function registerTaskCommands(browser) {
                 // instead of the raw `comet-local@endpoint-0` key (RUSH-2709).
                 const endpointLabel = profile.endpoint ? `endpoint: ${profile.endpoint}, ` : '';
                 console.log(`\n${profile.name} (${endpointLabel}${portLabel}, ${pidLabel})`);
+                // A profile whose live state could not be read is still listed, and
+                // says so — it is not silently dropped and not shown as healthy.
+                if (profile.unavailable) {
+                    console.log(`  Unavailable: ${profile.unavailable}`);
+                }
                 if (profile.tasks.length === 0) {
                     console.log('  No active tasks');
                 }
@@ -2783,6 +2788,12 @@ function registerTaskCommands(browser) {
                             String(task.tabCount).padEnd(6) +
                             domains.slice(0, 20).padEnd(22) +
                             age);
+                        // The recorded tab count above is what the task owns on disk; this
+                        // says the live tabs behind it could not be read, so the count is
+                        // not mistaken for verified-live tabs.
+                        if (task.unavailable) {
+                            console.log('  '.padEnd(14) + `↳ tabs unreadable: ${task.unavailable}`);
+                        }
                     }
                 }
             }

package/dist/commands/exec.d.ts

@@ -62,6 +62,7 @@ interface ExecCommandActionOptions {
     until?: string;
     interval?: string;
     where?: string;
+    local?: boolean;
     host?: string;
     device?: string;
     on?: string;
@@ -130,6 +131,20 @@ export declare function hostTargetGiven(options: {
     on?: string;
     computer?: string;
 }): string[];
+/**
+ * Turn a host target that names THIS machine into an explicit local pin: the
+ * host-family flags are cleared and `local` is set, so no dispatch path
+ * self-SSHes and the bare-interactive default (`bareInteractiveRunDefaultsToDeviceAuto`)
+ * sees a decided placement. Returns true when the pin was applied. Pure over
+ * the `isSelf` predicate so the rule is testable without a device registry.
+ */
+export declare function pinLocalWhenTargetIsSelf(options: {
+    host?: string;
+    device?: string;
+    on?: string;
+    computer?: string;
+    local?: boolean;
+}, isSelf: (name: string) => boolean): boolean;
 /**
  * Return every option whose selection semantics conflict with an account
  * choice (`agent#`). Device routing is deliberately absent: the marker rides
@@ -159,6 +174,7 @@ export declare function runDevicePickerConflicts(options: {
     device?: string;
     on?: string;
     computer?: string;
+    local?: boolean;
 }): string[];
 export { RUN_AUTO_KEYWORD };
 /**
@@ -179,6 +195,7 @@ export declare function runAutoDefaultsToAffinity(options: {
     device?: string;
     on?: string;
     computer?: string;
+    local?: boolean;
 }, env?: NodeJS.ProcessEnv): boolean;
 /**
  * Whether a bare human-facing `agents run <harness>` — no prompt, so an
@@ -210,6 +227,7 @@ export declare function bareInteractiveRunDefaultsToDeviceAuto(options: {
     lease?: string | boolean;
     box?: string;
     cloud?: boolean;
+    local?: boolean;
 }, run: {
     prompt?: string;
     devicePickerRequested?: boolean;