@phnx-labs/agents-cli 1.22.115 → 1.22.117

package/dist/lib/browser/service.js

@@ -333,6 +333,11 @@ export function arcCreateMarker() {
 export function isArcCreateMarker(url) {
     return url.startsWith(ARC_CREATE_MARKER_PREFIX);
 }
+/** Run `fn` once per pass and share its promise, rejections included. */
+function onceAsync(fn) {
+    let pending;
+    return () => (pending ??= fn());
+}
 export class BrowserService {
     static SOURCE_PREFIX = {
         'rush-app': 'rush-app-',
@@ -2198,9 +2203,20 @@ export class BrowserService {
      * it used to return (RUSH-2709).
      */
     async status(profileRef) {
+        // Built before rehydration: a cold pass rehydrates every saved runtime dir
+        // first, and each Arc one probed Arc on its own, spending the budget before
+        // the snapshot existed. One enumeration and one liveness read cover the pass.
+        const arc = {
+            spaces: onceAsync(() => enumerateArcSpaces()),
+            running: onceAsync(() => isArcRunning()),
+        };
         // Reconnect live browsers after a daemon restart so status is not empty
-        // while tasks.json still holds open work.
-        await this.rehydrateAllFromDisk();
+        // while tasks.json still holds open work. Rehydration is per runtime dir:
+        // one unreadable saved profile is reported below, never fatal to the pass.
+        const rehydrateErrors = new Map();
+        await this.rehydrateAllFromDisk(arc.running, (key, err) => {
+            rehydrateErrors.set(key, err instanceof Error ? err.message : String(err));
+        });
         // A caller who pasted a runtime key out of an older listing still gets the
         // profile it belongs to, rather than an empty result.
         const profileName = profileRef ? parseConnectionKey(profileRef).profile : undefined;
@@ -2210,25 +2226,99 @@ export class BrowserService {
             ? [...this.connections.keys()].filter((k) => keyBelongsToProfile(k, profileName))
             : Array.from(this.connections.keys());
         for (const key of candidates) {
-            const status = await this.getProfileStatus(key);
+            // Read-only: a profile that cannot be read is reported as unreadable, not
+            // allowed to abort the listing. Before this, a single stale Arc task made
+            // `status` throw and EVERY profile vanished, including healthy ones.
+            let status;
+            try {
+                status = await this.getProfileStatus(key, arc);
+            }
+            catch (err) {
+                const parsed = parseConnectionKey(key);
+                statuses.push({
+                    name: this.connections.get(key)?.profile ?? parsed.profile,
+                    endpoint: parsed.endpoint,
+                    key,
+                    running: false,
+                    tasks: [],
+                    unavailable: err instanceof Error ? err.message : String(err),
+                });
+                seenProfiles.add(parsed.profile);
+                continue;
+            }
             if (status) {
                 statuses.push(status);
                 seenProfiles.add(status.name);
             }
         }
+        // Reported BEFORE the disk reconcile, and keyed by the runtime dir that
+        // actually failed. Reconcile reads the same `tasks.json`, so without this
+        // ordering one corrupt runtime produced two rows for the same profile: one
+        // keyed here and one unkeyed from reconcile, which the dedupe then missed.
+        for (const [key, message] of rehydrateErrors) {
+            const parsed = parseConnectionKey(key);
+            if (profileName && parsed.profile !== profileName)
+                continue;
+            if (statuses.some((status) => status.key === key))
+                continue;
+            statuses.push({
+                name: parsed.profile,
+                endpoint: parsed.endpoint,
+                key,
+                running: false,
+                tasks: [],
+                unavailable: message,
+            });
+            seenProfiles.add(parsed.profile);
+        }
+        // Disk reconcile reads `tasks.json` too, so it fails on exactly the same
+        // corrupt file — report that profile rather than let it empty the table.
+        const reconcile = async (name) => {
+            const failures = new Map();
+            let reconciled = null;
+            try {
+                reconciled = await this.reconcileFromDisk(name, (key, err) => {
+                    failures.set(key, err instanceof Error ? err.message : String(err));
+                });
+            }
+            catch (err) {
+                // Listing the profile's runtime dirs failed, so no single runtime is at
+                // fault and none is invented: this is reported at profile level.
+                statuses.push({
+                    name,
+                    running: false,
+                    tasks: [],
+                    unavailable: err instanceof Error ? err.message : String(err),
+                });
+                return;
+            }
+            if (reconciled)
+                statuses.push(reconciled);
+            // Keyed by the runtime dir that actually failed, so a profile with several
+            // runtimes names the unreadable one rather than guessing at the first.
+            for (const [key, message] of failures) {
+                if (statuses.some((status) => status.key === key))
+                    continue;
+                const parsed = parseConnectionKey(key);
+                statuses.push({
+                    name,
+                    endpoint: parsed.endpoint,
+                    key,
+                    running: false,
+                    tasks: [],
+                    unavailable: message,
+                });
+            }
+        };
         if (!profileName) {
             for (const profile of await listProfiles()) {
                 if (seenProfiles.has(profile.name))
                     continue;
-                const reconciled = await this.reconcileFromDisk(profile.name);
-                if (reconciled)
-                    statuses.push(reconciled);
+                await reconcile(profile.name);
             }
         }
         else if (statuses.length === 0) {
-            const reconciled = await this.reconcileFromDisk(profileName);
-            if (reconciled)
-                statuses.push(reconciled);
+            await reconcile(profileName);
         }
         return statuses;
     }
@@ -2241,14 +2331,27 @@ export class BrowserService {
      * ({@link listProfileCacheDirs}), including the legacy pre-composite dir named
      * exactly the profile.
      */
-    async reconcileFromDisk(profileName) {
+    async reconcileFromDisk(profileName, 
+    /**
+     * Read-only callers pass a sink so an unreadable runtime dir is attributed
+     * to the dir that actually failed, and the remaining dirs are still tried.
+     * Callers without a sink keep the strict behaviour.
+     */
+    onError) {
         const dirs = listProfileCacheDirs(profileName);
         for (const dir of dirs) {
             const key = asConnectionKey(path.basename(dir));
-            const info = getRunningChromeInfo(key);
-            if (!info)
-                continue;
-            return this.profileStatusFromDisk(profileName, key, info.port, info.pid);
+            try {
+                const info = getRunningChromeInfo(key);
+                if (!info)
+                    continue;
+                return await this.profileStatusFromDisk(profileName, key, info.port, info.pid);
+            }
+            catch (err) {
+                if (!onError)
+                    throw err;
+                onError(key, err);
+            }
         }
         return null;
     }
@@ -3347,7 +3450,13 @@ export class BrowserService {
      * Returns null when nothing is speaking CDP so callers can fall through
      * to disk reconcile.
      */
-    async attachRunningProfile(key, diskTasks) {
+    async attachRunningProfile(key, diskTasks, 
+    /**
+     * Shared Arc liveness for one status pass; each saved Arc runtime used to
+     * probe on its own. Callers with no pass to share pass nothing and probe
+     * directly, as before.
+     */
+    arcRunning) {
         const { profile: bare, endpoint: endpointFromKey } = parseConnectionKey(key);
         const profile = await getProfile(bare);
         if (!profile)
@@ -3371,7 +3480,7 @@ export class BrowserService {
         // is still running. No port, no CDP — just verify Arc is alive and restore
         // the task state.
         if (resolved.target.startsWith('arc-native:')) {
-            if (process.platform !== 'darwin' || !(await isArcRunning()))
+            if (process.platform !== 'darwin' || !(await (arcRunning ?? isArcRunning)()))
                 return null;
             const tasks = this.loadTaskState(key);
             for (const [k, t] of diskTasks) {
@@ -3575,7 +3684,14 @@ export class BrowserService {
         }
         return existing;
     }
-    async rehydrateAllFromDisk() {
+    async rehydrateAllFromDisk(arcRunning, 
+    /**
+     * Read-only callers pass a sink to make rehydration per-runtime: one saved
+     * dir that cannot be read (corrupt `tasks.json`, an Arc Apple Event that
+     * times out) is reported through this instead of aborting the pass. Callers
+     * without a sink keep the strict behaviour and the error propagates.
+     */
+    onError) {
         const runtimeRoot = getBrowserRuntimeDir();
         let dirNames = [];
         try {
@@ -3599,24 +3715,31 @@ export class BrowserService {
             // Skip non-runtime dirs (e.g. profiles/)
             if (dirName === 'profiles' || dirName === 'sessions' || dirName === 'exports')
                 continue;
-            const tasks = this.loadTaskState(key);
-            if (tasks.size === 0)
-                continue;
-            // Soft attach only — never launch / never clear pid files.
-            const conn = await this.attachRunningProfile(key, tasks);
-            if (!conn)
-                continue;
-            // A concurrent rehydrate may have registered one for this key while we
-            // awaited the attach; keep the winner and tear our loser's tunnel down.
-            const registered = this.registerRehydratedConnection(key, conn);
-            if (registered !== conn)
-                continue;
             try {
-                if (conn.backend !== 'arc-native' && conn.backend !== 'bidi')
-                    await this.applyDefaultDownloadBehavior(conn, key);
+                const tasks = this.loadTaskState(key);
+                if (tasks.size === 0)
+                    continue;
+                // Soft attach only — never launch / never clear pid files.
+                const conn = await this.attachRunningProfile(key, tasks, arcRunning);
+                if (!conn)
+                    continue;
+                // A concurrent rehydrate may have registered one for this key while we
+                // awaited the attach; keep the winner and tear our loser's tunnel down.
+                const registered = this.registerRehydratedConnection(key, conn);
+                if (registered !== conn)
+                    continue;
+                try {
+                    if (conn.backend !== 'arc-native' && conn.backend !== 'bidi')
+                        await this.applyDefaultDownloadBehavior(conn, key);
+                }
+                catch {
+                    // Non-fatal for rehydrate.
+                }
             }
-            catch {
-                // Non-fatal for rehydrate.
+            catch (err) {
+                if (!onError)
+                    throw err;
+                onError(key, err);
             }
         }
     }
@@ -3708,14 +3831,29 @@ export class BrowserService {
         return tabs;
     }
     /** Live status for ONE registered connection, addressed by its runtime key. */
-    async getProfileStatus(key) {
+    async getProfileStatus(key, arc) {
         const conn = this.connections.get(key);
         if (!conn)
             return null;
         if (conn.backend === 'arc-native') {
+            // One snapshot and one liveness read for the whole pass, shared across
+            // every task and every Arc profile (built in `status`).
+            const spaces = arc?.spaces ?? onceAsync(() => enumerateArcSpaces());
+            const running = arc?.running ?? onceAsync(() => isArcRunning());
             const tasks = [];
             for (const task of conn.tasks.values()) {
-                const tabs = await this.listArcTaskTabs(task);
+                // The moved-tab refusal is the ownership guarantee actions rely on and
+                // stays strict. `status` only reads, so one stale task must not take down
+                // its neighbours: report what disk knows plus the reason, and leave
+                // `tabs` ABSENT rather than empty so nothing claims a moved tab is live.
+                let tabs = [];
+                let unavailable;
+                try {
+                    tabs = await this.listArcTaskTabsFromSnapshot(task, spaces);
+                }
+                catch (err) {
+                    unavailable = err instanceof Error ? err.message : String(err);
+                }
                 const domains = tabs.flatMap((tab) => {
                     try {
                         const domain = new URL(tab.url).hostname.replace(/^www\./, '');
@@ -3734,6 +3872,7 @@ export class BrowserService {
                     createdAt: task.createdAt,
                     tabs: tabs.length ? tabs : undefined,
                     domains: [...new Set(domains)],
+                    unavailable,
                 });
             }
             const parsed = parseConnectionKey(key);
@@ -3741,7 +3880,7 @@ export class BrowserService {
                 name: conn.profile ?? parsed.profile,
                 endpoint: parsed.endpoint,
                 key,
-                running: await isArcRunning(),
+                running: await running(),
                 port: 0,
                 pid: 0,
                 tasks,
@@ -4217,6 +4356,39 @@ export class BrowserService {
         }
         return executeJavaScript(ref, expression);
     }
+    /**
+     * Resolve a task's owned Arc tabs against one shared snapshot of every
+     * window/space/tab, rather than asking Arc per tab as `listArcTaskTabs` does.
+     *
+     * Same ownership rule as the live path — `requireArcTask`, then the recorded
+     * ref must be present in its original window and Space. The snapshot changes
+     * how often Arc is asked, never what counts as owned. Actions keep the live
+     * path, because a snapshot can go stale before it is acted on.
+     */
+    async listArcTaskTabsFromSnapshot(task, spaces) {
+        // Before the snapshot on purpose: a ref naming a window its task does not
+        // own is a moved tab on the record alone, so it needs no round trip and
+        // reports the right reason even when Arc is unreachable.
+        const native = this.requireArcTask(task);
+        const snapshot = await spaces();
+        const tabs = [];
+        for (const [shortId, ref] of Object.entries(native.tabs)) {
+            const live = snapshot
+                .find((space) => space.windowId === ref.windowId && space.spaceId === ref.spaceId)
+                ?.tabs.find((tab) => tab.tabId === ref.tabId);
+            if (!live) {
+                throw new Error(`Owned Arc tab ${shortId} is missing from its original window/Space; refusing to adopt a moved tab.`);
+            }
+            tabs.push({
+                id: shortId,
+                url: live.url,
+                title: live.title,
+                task: task.name,
+                current: shortId === task.currentTabId,
+            });
+        }
+        return tabs;
+    }
     async listArcTaskTabs(task) {
         const native = this.requireArcTask(task);
         const tabs = [];

package/dist/lib/browser/types.d.ts

@@ -358,6 +358,15 @@ export interface ProfileStatus {
     /** The port declared in the profile's first endpoint, when it differs from the running port. */
     configuredPort?: number;
     tasks: TaskStatus[];
+    /**
+     * Why this profile's live state could not be read, when it could not be.
+     *
+     * `status` is read-only, so one unreadable profile must not hide the others:
+     * the profile is still listed, with what is known from disk, and this says
+     * what is missing. Absent means the read succeeded — it is never set to paper
+     * over a failure that did not happen.
+     */
+    unavailable?: string;
 }
 export interface TaskStatus {
     id: string;
@@ -376,6 +385,15 @@ export interface TaskStatus {
         current?: boolean;
         task?: string;
     }>;
+    /**
+     * Why this task's live tabs could not be enumerated, when they could not be.
+     *
+     * Set together with an ABSENT {@link tabs} — the recorded {@link tabCount}
+     * still reports what the task owns on disk, but nothing claims those tabs are
+     * live, because that is exactly what could not be verified. An Arc tab moved
+     * to another window or Space is the case this exists for.
+     */
+    unavailable?: string;
 }
 export interface HistoricalTask {
     id: string;

package/dist/lib/config-keys.d.ts

@@ -16,7 +16,7 @@ export type ConfigScope = 'run' | 'interactive' | 'auto' | 'browser' | 'project'
  * CONFIG_KEYS (user scope); this list is only the parser's allow-set so an
  * unknown `menubar.menu.<x>` fails loud here instead of at the store.
  */
-export declare const MENUBAR_MENU_PROPERTIES: readonly ["defaultProject", "workingRowsShown", "showPreviews", "projectPriorityFilter", "hideCompletedMilestones", "bannerWhenNeedsYou", "includeOtherDeviceRequests", "groupBy", "thenBy", "projectScope", "projectSort", "ticketSort", "showPullRequests"];
+export declare const MENUBAR_MENU_PROPERTIES: readonly ["defaultProject", "workingRowsShown", "showPreviews", "projectPriorityFilter", "hideCompletedMilestones", "bannerWhenNeedsYou", "includeOtherDeviceRequests", "groupBy", "thenBy", "projectScope", "projectSort", "ticketSort", "showPullRequests", "sessionUpdates", "deviceSort", "headlessAgent", "headlessFallbackAgent", "headlessPlacement"];
 /** A run-time default key: model, mode, effort, or tier override. */
 export interface ParsedRunConfigKey {
     scope: 'run';

package/dist/lib/config-keys.js

@@ -29,6 +29,11 @@ export const MENUBAR_MENU_PROPERTIES = [
     'projectSort',
     'ticketSort',
     'showPullRequests',
+    'sessionUpdates',
+    'deviceSort',
+    'headlessAgent',
+    'headlessFallbackAgent',
+    'headlessPlacement',
 ];
 const DEVICE_CONFIG_PROPERTIES = [
     'browser.viewer',

package/dist/lib/device-config.js

@@ -505,6 +505,67 @@ export const CONFIG_KEYS = [
         defaultValue: true,
         description: 'AGI Menu: show the open pull requests section for each project.',
     },
+    {
+        name: 'menubar.menu.sessionUpdates',
+        yamlKey: 'menubarMenuSessionUpdates',
+        scope: 'user',
+        type: 'bool',
+        defaultValue: true,
+        description: 'AGI Menu: show the session-updates section on Home. Off leaves Home to requests and progress ' +
+            'only; the full list stays on the Sessions tab either way.',
+    },
+    {
+        name: 'menubar.menu.deviceSort',
+        yamlKey: 'menubarMenuDeviceSort',
+        scope: 'user',
+        type: 'string',
+        defaultValue: 'name',
+        description: 'AGI Menu: how the device list is ordered — name, role, load, memory, or disk. The spec orders read ' +
+            'the same cached fleet stats the rows render, so a device with no observation sorts last rather than ' +
+            'as zero.',
+        validate: oneOf('menubar.menu.deviceSort', ['name', 'role', 'load', 'memory', 'disk']),
+    },
+    {
+        name: 'menubar.menu.headlessAgent',
+        yamlKey: 'menubarMenuHeadlessAgent',
+        scope: 'user',
+        type: 'string',
+        description: 'AGI Menu: the harness a Headless run dispatches to by default (an agent id, e.g. claude). Unset ' +
+            'leaves the choice to the menu\'s own default — this key never invents a primary harness.',
+        validate: (v) => isAgentId(v) ? null : `menubar.menu.headlessAgent must be an agent id (e.g. claude, codex), got ${JSON.stringify(v)}.`,
+    },
+    {
+        name: 'menubar.menu.headlessFallbackAgent',
+        yamlKey: 'menubarMenuHeadlessFallbackAgent',
+        scope: 'user',
+        type: 'string',
+        description: 'AGI Menu: the permitted alternate harness for a Headless run, dispatched as `agents run --fallback ' +
+            '<agent>`. It is reached only after every usable account of the primary harness is exhausted (the ' +
+            'run\'s own same-agent account failover runs first). Unset sends no --fallback.',
+        validate: (v) => isAgentId(v) ? null : `menubar.menu.headlessFallbackAgent must be an agent id (e.g. codex, grok), got ${JSON.stringify(v)}.`,
+    },
+    {
+        name: 'menubar.menu.headlessPlacement',
+        yamlKey: 'menubarMenuHeadlessPlacement',
+        scope: 'user',
+        type: 'string',
+        defaultValue: 'auto',
+        description: 'AGI Menu: where a Headless run executes — `auto` (the CLI picks an eligible worker; `agents run ' +
+            '--device auto` never picks a personal or desktop box), `local` (this machine, no --device), ' +
+            '`interactive` (the box pinned as interactive.host), or a device name to pin one explicitly.',
+        validate: (v) => {
+            const value = v;
+            if (value === 'auto' || value === 'local' || value === 'interactive')
+                return null;
+            try {
+                assertValidDeviceName(value);
+                return null;
+            }
+            catch {
+                return 'menubar.menu.headlessPlacement must be auto | local | interactive | a device name.';
+            }
+        },
+    },
 ];
 /** Look up a key spec by CLI dotted name, or throw listing the known keys. */
 /**

package/dist/lib/devices/doctor-findings.js

@@ -41,7 +41,7 @@ import chalk from 'chalk';
 import * as path from 'path';
 import { AGENTS, ALL_AGENT_IDS, supportsAccountInspection } from '../agents.js';
 import { blocksLocalScripts } from '../platform/winpath.js';
-import { loginHint } from '../signin-badge.js';
+import { loginHint, loginSubcommand, SUBCOMMAND_LOGIN_AGENTS } from '../signin-badge.js';
 import { CONFIG_ENV_ISOLATED_AGENTS } from '../installations/shims.js';
 import { padToWidth, stringWidth } from '../text/width.js';
 import { windowsSshEnrollmentProblem } from './windows-ssh-enrollment.js';
@@ -78,11 +78,7 @@ const NO_PER_VERSION_LOGIN = new Set(ALL_AGENT_IDS.filter((a) => !ISOLATED_LOGIN
  *    `subcommand` — `<cli> login` / `<cli> auth login`, runnable via `--`
  *    `in-tui`     — claude only: a `/login` slash command inside its own TUI
  *    `on-launch`  — the device/oauth flow starts when the agent launches */
-const LOGIN_SUBCOMMAND = {
-    codex: 'login',
-    grok: 'login',
-    opencode: 'auth login',
-};
+const LOGIN_SUBCOMMAND = Object.fromEntries(SUBCOMMAND_LOGIN_AGENTS.map((agent) => [agent, loginSubcommand(agent)]));
 /** Kinds whose fix is inherently PER VERSION, so a row collapsed across versions
  *  could not carry a correct remediation. A login is the whole set: there is no
  *  `@all` selector for it, and dropping the version falls back to the bare native