@phnx-labs/agents-cli 1.22.117 → 1.22.119

package/dist/commands/daemon.d.ts

@@ -2,11 +2,12 @@
  * `agents daemon` — runtime, hosted services, and failure visibility for the
  * always-on daemon (RUSH-2354).
  *
- * The daemon holds the routines scheduler, the browser IPC server, and the
+ * The daemon holds the routines scheduler, the session/usage sync, and the
  * watchdog pass — but until this command group existed it had no user-facing
  * surface: no way to see it, restart it, or turn it off. The secrets broker
  * moved out of this daemon entirely with the standalone `secrets` engine
- * (PHNX-3989 OWN-1); `agents daemon status` only probes its reachability.
+ * (PHNX-3989 OWN-1), and the browser IPC server with the standalone `browser`
+ * CLI (PHNX-4101); `agents daemon status` only probes the broker's reachability.
  * `daemon.ts` (the runtime) has always implemented every mechanism this file
  * wires up; nothing here is new machinery, only the missing CLI surface.
  *
@@ -17,6 +18,42 @@
  * duplicating it.
  */
 import type { Command } from 'commander';
+import { type SubsystemHealth } from '../lib/daemon-health.js';
 /** Elapsed wall-clock seconds since `pid` started, or null if unavailable (best-effort, POSIX only). */
 export declare function uptimeSeconds(pid: number): number | null;
+interface SecretsBrokerHealth {
+    reachable: boolean;
+    /**
+     * True when this box routes `keychain`-backend items to the standalone's
+     * encrypted file store (a headless worker with no reachable keyring). The
+     * broker exists only to hold an UNLOCKED keychain across reads without a
+     * Touch ID prompt — a file-backed box reads every secret one-shot with no
+     * broker at all, so an absent broker there is normal, not a fault (PHNX-4116).
+     */
+    fileBacked: boolean;
+    /**
+     * Always `null` — the broker's socket now lives entirely inside the
+     * standalone `secrets` engine's own process (PHNX-3989 OWN-1); the daemon
+     * neither hosts it nor knows its transport details. Kept in the shape for
+     * `--json` compatibility.
+     */
+    socketPath: string | null;
+    heldBundles: number | null;
+    /**
+     * Always `null` — no daemon service writes a health record for the broker
+     * anymore (the daemon does not host or supervise it). Kept in the shape for
+     * `--json` compatibility.
+     */
+    record: SubsystemHealth | null;
+}
+/**
+ * The `secrets broker` health line. Reachable → healthy. Unreachable is a FAULT
+ * (`down`) only when the store is keychain-backed — there the broker is what
+ * holds the unlocked keychain across reads. On a file-backed box (every
+ * headless worker) no broker is needed: secrets read one-shot, so an absent
+ * broker is expected and reads as INFO, not `down` (PHNX-4116). Pure, so the
+ * three cases are unit-tested with no live daemon.
+ */
+export declare function secretsBrokerHealthLine(secrets: SecretsBrokerHealth): string;
 export declare function registerDaemonCommand(program: Command): void;
+export {};

package/dist/commands/daemon.js

@@ -2,11 +2,12 @@
  * `agents daemon` — runtime, hosted services, and failure visibility for the
  * always-on daemon (RUSH-2354).
  *
- * The daemon holds the routines scheduler, the browser IPC server, and the
+ * The daemon holds the routines scheduler, the session/usage sync, and the
  * watchdog pass — but until this command group existed it had no user-facing
  * surface: no way to see it, restart it, or turn it off. The secrets broker
  * moved out of this daemon entirely with the standalone `secrets` engine
- * (PHNX-3989 OWN-1); `agents daemon status` only probes its reachability.
+ * (PHNX-3989 OWN-1), and the browser IPC server with the standalone `browser`
+ * CLI (PHNX-4101); `agents daemon status` only probes the broker's reachability.
  * `daemon.ts` (the runtime) has always implemented every mechanism this file
  * wires up; nothing here is new machinery, only the missing CLI surface.
  *
@@ -21,10 +22,10 @@ import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import { setHelpSections } from '../lib/help.js';
-import { getDaemonStatus, isDaemonRunning, isDaemonWedged, readDaemonLog, startDaemon, stopDaemon, signalDaemonReload, findSurvivingStateDirDaemons, getDaemonLogPath, isDaemonAutostartCircuitOpen, RedirectedHomeDaemonError, } from '../lib/daemon/daemon.js';
+import { getDaemonStatus, isDaemonRunning, readDaemonLog, startDaemon, stopDaemon, signalDaemonReload, findSurvivingStateDirDaemons, getDaemonLogPath, isDaemonAutostartCircuitOpen, RedirectedHomeDaemonError, } from '../lib/daemon/daemon.js';
 import { listDaemonRunProcesses } from '../lib/daemon/leaked-daemons.js';
 import { getConfigValue, setConfigValue, isDaemonEnabled } from '../lib/device-config.js';
-import { readSubsystemHealth, readAllSubsystemHealth, SUBSYSTEM_BROWSER_IPC, SUBSYSTEM_DAEMON_START, } from '../lib/daemon-health.js';
+import { readSubsystemHealth, readAllSubsystemHealth, SUBSYSTEM_DAEMON_START, } from '../lib/daemon-health.js';
 import { DAEMON_SERVICE_IDS, listDaemonServiceStates, setDaemonServiceEnabled, getDaemonServicesConfigPath, queueDaemonServiceRestart, } from '../lib/daemon-services.js';
 import { listJobs, getLatestRun } from '../lib/scheduling/routines.js';
 import { JobScheduler } from '../lib/scheduler.js';
@@ -293,25 +294,24 @@ function humanDuration(seconds) {
 }
 /** Reachability probe only — the daemon does not host, supervise, or take over the broker (OWN-1). */
 async function probeSecretsBroker() {
+    const { agentPing, agentStatus, keychainUsesFileFallback } = await import('../lib/secrets-client.js');
     try {
-        const { agentPing, agentStatus } = await import('../lib/secrets-client.js');
         const ping = await agentPing();
-        if (!ping.reachable)
-            return { reachable: false, socketPath: null, heldBundles: null, record: null };
-        const entries = await agentStatus();
-        return { reachable: true, socketPath: null, heldBundles: entries.length, record: null };
+        if (ping.reachable) {
+            const entries = await agentStatus();
+            return { reachable: true, fileBacked: false, socketPath: null, heldBundles: entries.length, record: null };
+        }
     }
-    catch {
-        return { reachable: false, socketPath: null, heldBundles: null, record: null };
+    catch { /* fall through to the unreachable classification below */ }
+    // Unreachable: distinguish "broker needed and absent" (a keychain-backed box)
+    // from "no broker needed" (a file-backed worker reads secrets one-shot). An
+    // unknown store defaults to broker-needed, the louder verdict.
+    let fileBacked = false;
+    try {
+        fileBacked = await keychainUsesFileFallback();
     }
-}
-async function probeBrowserIPC() {
-    const record = readSubsystemHealth(SUBSYSTEM_BROWSER_IPC);
-    const { isBrowserServiceReachable, getSocketPath } = await import('../lib/browser/ipc.js');
-    const { listAllProfileSnapshots } = await import('../lib/browser/runtime-state.js');
-    const bound = await isBrowserServiceReachable();
-    const sessionCount = listAllProfileSnapshots().filter((s) => s.pidAlive && s.daemonAlive).length;
-    return { bound, socketPath: getSocketPath(), sessionCount, record };
+    catch { /* unknown → not file-backed */ }
+    return { reachable: false, fileBacked, socketPath: null, heldBundles: null, record: null };
 }
 function schedulerSummary() {
     const jobs = listJobs();
@@ -357,6 +357,23 @@ function healthLine(label, live, record) {
             : '';
     return `  ${chalk.red('down')}  ${label} ${detail}`;
 }
+/**
+ * The `secrets broker` health line. Reachable → healthy. Unreachable is a FAULT
+ * (`down`) only when the store is keychain-backed — there the broker is what
+ * holds the unlocked keychain across reads. On a file-backed box (every
+ * headless worker) no broker is needed: secrets read one-shot, so an absent
+ * broker is expected and reads as INFO, not `down` (PHNX-4116). Pure, so the
+ * three cases are unit-tested with no live daemon.
+ */
+export function secretsBrokerHealthLine(secrets) {
+    if (secrets.reachable) {
+        return healthLine(`secrets broker  (${secrets.socketPath}, ${secrets.heldBundles} bundle(s) held)`, true, secrets.record);
+    }
+    if (secrets.fileBacked) {
+        return `  ${chalk.cyan('info')}  secrets agent not running (file-backed stores)`;
+    }
+    return healthLine('secrets broker  (unreachable)', false, secrets.record);
+}
 async function runStatus(opts) {
     const status = getDaemonStatus();
     const enabled = isDaemonEnabled();
@@ -378,7 +395,7 @@ async function runStatus(opts) {
     const staleTiers = staleDaemons(processes, pid ?? null, registeredPids);
     const stale = staleTiers.visible;
     const ownerEntryGone = owner ? entryIsGone(owner) : false;
-    const [secrets, browserIpc] = await Promise.all([probeSecretsBroker(), probeBrowserIPC()]);
+    const secrets = await probeSecretsBroker();
     const scheduler = schedulerSummary();
     if (opts.json) {
         console.log(JSON.stringify({
@@ -386,6 +403,9 @@ async function runStatus(opts) {
             pid,
             uptimeSeconds: uptime,
             heartbeatAgeMs,
+            restarts24h: status.restarts24h,
+            lastRestartCause: status.lastRestartCause,
+            lastRestartAt: status.lastRestartAt,
             logPath: status.logPath,
             binaryPath: owner?.entry ?? status.binaryPath,
             binaryVersion: owner?.version ?? null,
@@ -409,12 +429,6 @@ async function runStatus(opts) {
                     heldBundles: secrets.heldBundles,
                     health: secrets.record,
                 },
-                browserIpc: {
-                    bound: browserIpc.bound,
-                    socketPath: browserIpc.socketPath,
-                    sessionCount: browserIpc.sessionCount,
-                    health: browserIpc.record,
-                },
             },
             scheduler: {
                 enabled: getConfigValue('scheduler.enabled').value !== false,
@@ -427,9 +441,8 @@ async function runStatus(opts) {
         return;
     }
     const stateLabel = state === 'running' ? chalk.green('running')
-        : state === 'wedged' ? chalk.red('wedged')
-            : state === 'disabled' ? chalk.yellow('disabled')
-                : chalk.gray('stopped');
+        : state === 'disabled' ? chalk.yellow('disabled')
+            : chalk.gray('stopped');
     console.log(chalk.bold('Identity\n'));
     console.log(`  State:      ${stateLabel}`);
     if (pid)
@@ -438,6 +451,12 @@ async function runStatus(opts) {
         console.log(`  Uptime:     ${humanDuration(uptime)}`);
     if (heartbeatAgeMs !== null)
         console.log(`  Heartbeat:  ${Math.round(heartbeatAgeMs / 1000)}s ago`);
+    if (status.restarts24h > 0) {
+        const when = status.lastRestartAt ? ` (last ${new Date(status.lastRestartAt).toLocaleString()})` : '';
+        console.log(`  Restarts:   ${status.restarts24h} in the last 24h${when}`);
+        if (status.lastRestartCause)
+            console.log(`  Last cause: ${chalk.gray(status.lastRestartCause)}`);
+    }
     const binaryLabel = owner?.entry ?? status.binaryPath ?? 'unknown';
     console.log(`  Binary:     ${ownerEntryGone ? chalk.red(`${binaryLabel}  (MISSING from disk)`) : chalk.gray(binaryLabel)}`);
     console.log(`  Version:    ${chalk.gray(owner?.version ?? 'unknown')}`);
@@ -476,17 +495,13 @@ async function runStatus(opts) {
         console.log(chalk.gray('\n  Only one install should own the daemon. Stop the stray(s): kill <pid>'));
     }
     console.log(chalk.bold('\nHealth\n'));
-    console.log(healthLine(`secrets broker  ${secrets.reachable ? `(${secrets.socketPath}, ${secrets.heldBundles} bundle(s) held)` : '(unreachable)'}`, secrets.reachable, secrets.record));
-    console.log(healthLine(`browser IPC     ${browserIpc.bound ? `(${browserIpc.socketPath}, ${browserIpc.sessionCount} session(s))` : '(unbound)'}`, browserIpc.bound, browserIpc.record));
+    console.log(secretsBrokerHealthLine(secrets));
     const schedulerEnabled = getConfigValue('scheduler.enabled').value !== false;
     console.log(`  ${schedulerEnabled ? chalk.green('enabled') : chalk.yellow('disabled')}  scheduler — ${scheduler.enabledCount}/${scheduler.routineCount} routine(s) enabled` +
         (scheduler.nextFire ? `, next ${scheduler.nextFire.toLocaleString()}` : ''));
     if (scheduler.failingCount > 0) {
         console.log(chalk.red(`  ${scheduler.failingCount} routine(s) failing their last run — see: agents routines stats`));
     }
-    if (state === 'wedged') {
-        console.log(chalk.red('\nThe daemon is wedged (heartbeat stale). Restart: agents daemon restart'));
-    }
 }
 /**
  * Combine the persisted enable/disable toggles with whatever health the
@@ -503,8 +518,8 @@ function buildServiceRows(daemonRunning) {
         // A persisted supervisor state (health.json) is only trustworthy while the
         // daemon is actually up. If it is not running (crash / kill -9 / never
         // started), every service is stopped no matter what the last-written record
-        // says — trusting a stale 'running'/'parked'/'idle' here would print a
-        // report that contradicts the live-probed socket rows below (RUSH-2368).
+        // says — trusting a stale 'running'/'idle' here would print a report that
+        // contradicts the live-probed socket rows below (RUSH-2368).
         const state = daemonRunning
             ? (h?.state ?? (s.enabled ? 'running (unsupervised)' : 'stopped'))
             : 'stopped';
@@ -524,8 +539,6 @@ function buildServiceRows(daemonRunning) {
 function serviceStateLabel(state) {
     if (state === 'running')
         return chalk.green('running');
-    if (state === 'parked')
-        return chalk.red('parked');
     if (state === 'stopped')
         return chalk.gray('stopped');
     if (state === 'idle')
@@ -533,13 +546,12 @@ function serviceStateLabel(state) {
     return chalk.yellow(state); // 'running (unsupervised)' or any future label
 }
 async function runServices(opts) {
-    const [secrets, browserIpc] = await Promise.all([probeSecretsBroker(), probeBrowserIPC()]);
+    const secrets = await probeSecretsBroker();
     const rows = buildServiceRows(isDaemonRunning());
     if (opts.json) {
         console.log(JSON.stringify({
             // Existing fields — unchanged shape, agents/CI consume these directly.
             secretsBroker: { reachable: secrets.reachable, socketPath: secrets.socketPath, heldBundles: secrets.heldBundles, health: secrets.record },
-            browserIpc: { bound: browserIpc.bound, socketPath: browserIpc.socketPath, sessionCount: browserIpc.sessionCount, health: browserIpc.record },
             // Additive: every registered service, supervised or legacy.
             services: rows,
         }, null, 2));
@@ -554,8 +566,7 @@ async function runServices(opts) {
             console.log(chalk.gray(`    last-error: ${row.lastError}`));
     }
     console.log(chalk.bold('\nHosted sockets\n'));
-    console.log(healthLine(`secrets broker  ${secrets.reachable ? `(${secrets.socketPath}, ${secrets.heldBundles} bundle(s) held)` : '(unreachable)'}`, secrets.reachable, secrets.record));
-    console.log(healthLine(`browser IPC     ${browserIpc.bound ? `(${browserIpc.socketPath}, ${browserIpc.sessionCount} session(s))` : '(unbound)'}`, browserIpc.bound, browserIpc.record));
+    console.log(secretsBrokerHealthLine(secrets));
     console.log(chalk.gray('\nScheduled routines run through `agents routines` — see: agents routines stats'));
     console.log(chalk.gray('agents daemon services enable|disable|restart <id> apply live for supervised services.'));
 }
@@ -633,8 +644,6 @@ async function runDoctor(opts) {
     const problems = [];
     if (!status.running && enabled)
         problems.push('Daemon is not running. Start it: agents daemon start');
-    if (status.running && isDaemonWedged())
-        problems.push('Daemon is wedged (heartbeat stale). Restart: agents daemon restart');
     // RUSH-2418: an open auto-start circuit breaker is the FIRST thing to report
     // for a stopped daemon — otherwise the only advice is "agents daemon start",
     // which is the exact action the breaker just refused, with no hint that a
@@ -672,12 +681,6 @@ async function runDoctor(opts) {
     if (secrets.record && secrets.record.consecutiveFailures > 0) {
         problems.push(`Secrets broker has ${secrets.record.consecutiveFailures} consecutive failure(s): ${secrets.record.lastError}`);
     }
-    const browserIpc = await probeBrowserIPC();
-    if (!browserIpc.bound)
-        problems.push('Browser IPC is unbound.');
-    if (browserIpc.record && browserIpc.record.consecutiveFailures > 0) {
-        problems.push(`Browser IPC has ${browserIpc.record.consecutiveFailures} consecutive failure(s): ${browserIpc.record.lastError}`);
-    }
     const scheduler = schedulerSummary();
     if (scheduler.failingCount > 0) {
         problems.push(`${scheduler.failingCount} routine(s) failing their last run. See: agents routines stats`);
@@ -841,7 +844,7 @@ function runWebhooksList(json) {
 export function registerDaemonCommand(program) {
     const cmd = program
         .command('daemon')
-        .description('The always-on daemon: browser IPC, watchdog, and the routines scheduler. Bare `agents daemon` shows status.')
+        .description('The always-on daemon: watchdog, session/usage sync, and the routines scheduler. Bare `agents daemon` shows status.')
         .option('--json', 'Emit as JSON')
         .action(async (opts, command) => {
         await runStatus({ json: command.optsWithGlobals().json === true });
@@ -870,12 +873,12 @@ export function registerDaemonCommand(program) {
       agents daemon services
 
       # Toggle or restart a service live — applies without a daemon restart
-      # for supervisor-managed services (browser-ipc, account-state,
-      # session-index, monitors' off-transition, watchdog, device-probe,
-      # self-heal, state-dir-check)
-      agents daemon services disable browser-ipc
-      agents daemon services enable browser-ipc
-      agents daemon services restart browser-ipc
+      # for supervisor-managed services (account-state, session-index,
+      # monitors' off-transition, watchdog, device-probe, self-heal,
+      # state-dir-check)
+      agents daemon services disable account-state
+      agents daemon services enable account-state
+      agents daemon services restart account-state
 
       # Host a signed webhook receiver here, supervised and restarted on crash
       agents daemon webhooks add --secrets-bundle linear-webhook
@@ -912,12 +915,10 @@ export function registerDaemonCommand(program) {
 
       'agents daemon services enable|disable|restart <id>' applies live (no
       daemon restart) for supervisor-managed services that were registered at
-      boot. browser-ipc is also registered while disabled, specifically so a
-      browser client can enable it live. The inline scheduler re-evaluates its
-      toggle on every reload as well. A boot-disabled service other than
-      browser-ipc, the monitor on-transition, and webhook-receiver still need an
-      operator 'agents daemon restart'. 'agents daemon services' names which
-      case you're in per row.
+      boot. The inline scheduler re-evaluates its toggle on every reload as
+      well. A boot-disabled service other than the monitor on-transition and
+      webhook-receiver still needs an operator 'agents daemon restart'. 'agents
+      daemon services' names which case you're in per row.
     `,
     });
     cmd.command('status')
@@ -1033,16 +1034,15 @@ export function registerDaemonCommand(program) {
       agents daemon services list
 
       # Toggle or restart live — no daemon restart for a supervisor-managed
-      # service (browser-ipc, account-state, session-index)
-      agents daemon services disable browser-ipc
-      agents daemon services enable browser-ipc
-      agents daemon services restart browser-ipc
+      # service (account-state, session-index)
+      agents daemon services disable account-state
+      agents daemon services enable account-state
+      agents daemon services restart account-state
     `,
         notes: `
       A service disabled at daemon boot is normally not registered on the
-      supervisor, so enabling it needs an operator restart. browser-ipc is the
-      exception: it is registered stopped and can be enabled live. The inline
-      scheduler also applies enable/disable on reload; webhook-receiver and the
+      supervisor, so enabling it needs an operator restart. The inline
+      scheduler applies enable/disable on reload; webhook-receiver and the
       monitor on-transition still require 'agents daemon restart'. Each row in
       the plain-text view names which case it is; 'supervised: true/false' does
       the same in --json.
@@ -1077,9 +1077,8 @@ export function registerDaemonCommand(program) {
      * Apply an enable/disable toggle live (RUSH-3193 P4): persist it, then signal
      * the running daemon to reload — its handler diffs the toggle and drives
      * `supervisor.start/stop(id)` for a supervised service, so no restart is
-     * needed for supervisor-managed services registered at boot. browser-ipc is
-     * registered even when disabled so it can be enabled live; the inline
-     * scheduler also re-evaluates its toggle on reload. webhook-receiver,
+     * needed for supervisor-managed services registered at boot. The inline
+     * scheduler re-evaluates its toggle on reload. webhook-receiver,
      * monitors' on-transition, and other boot-disabled services still need a
      * deliberate operator restart — the daemon's own reload log says so.
      */

package/dist/commands/events.js

@@ -203,7 +203,7 @@ export function addEventsReadOptions(command) {
         .option('--command <path>', 'Only this command path — prefix match (e.g. "teams create")')
         .option('--event <type>', 'Only this typed event (repeatable, e.g. secrets.get, run.dispatched, pr.opened)', collect, [])
         .option('--agent <name>', 'Only events tagged with this agent')
-        .option('--caller <kind>', 'Only this caller kind (claude-code, codex, gemini, cursor, terminal, script)')
+        .option('--caller <kind>', 'Only this caller kind (claude-code, codex, cursor, terminal, script)')
         .option('--level <level>', 'Only this level: audit, warn, info, debug')
         .option('--session <id>', 'Only events from this session (the provenance sessionId) — e.g. trace which session read a secret')
         .option('--bundle <name>', 'Only events carrying this bundle in their payload — e.g. `--module secrets --bundle share` for every read of the share bundle')

package/dist/commands/exec.js

@@ -17,6 +17,7 @@ import { parseLoopInterval } from '../lib/loop.js';
 import { AGENTS, resolveAgentName, isAgentHardDeprecated, hardDeprecationError } from '../lib/agents.js';
 import { parseAgentVersionSpec } from '../lib/agent-spec/agents.js';
 import { recordDispatchedRun } from '../lib/audit/log.js';
+import { recordRunAuthOutcome } from '../lib/auth-health.js';
 import { maybeShowStarNudge } from '../lib/star-nudge.js';
 import { warnUnpushedWork, shouldWarnUnpushed } from '../lib/warn-unpushed.js';
 import { warnOrphanedOpenPr } from '../lib/pr-land-detach.js';
@@ -2681,6 +2682,37 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         // the only `continue` is the preflight exhaustion handoff below, which
         // consumes one entry of the `--fallback` spec before retrying as that
         // alternate. The spec is finite, so this terminates (PHNX-3999 F19).
+        // A balanced pick or the no-fresh-usage picker returns a CANDIDATE. Since
+        // PHNX-3940 a native candidate is a registered account SLOT, not the
+        // version home the executable lives in, so the spawn must resolve that
+        // slot (home + durable env) through the canonical local launch resolver.
+        // Without this the run launched the version home and whichever login it
+        // held: on yosemite-m0 (2026-09-23) the picker chose trp and Claude
+        // started as a different account in its first-run wizard. A remote run
+        // re-resolves on the peer, which runs this same code locally.
+        const applyPickedCandidate = async (candidate) => {
+            if (!candidate.nativeAccount || options.host || options.device)
+                return;
+            const { resolveLocalAccountLaunch } = await import('../lib/accounting/account-launch.js');
+            try {
+                launchAccount = await resolveLocalAccountLaunch({
+                    agent,
+                    executableVersion: version ?? candidate.version,
+                    candidate,
+                    useDefault: false,
+                });
+            }
+            catch (err) {
+                console.error(chalk.red(err.message));
+                process.exit(1);
+            }
+            if (launchAccount.execHome)
+                execHome = launchAccount.execHome;
+            if (launchAccount.configVersion)
+                accountConfigVersion = launchAccount.configVersion;
+            if (Object.keys(launchAccount.env).length > 0)
+                accountEnv = { ...accountEnv, ...launchAccount.env };
+        };
         preflight: for (;;) {
             if (!accountPickerRequested && !configuredAccount && (!version || strategy !== 'pinned' || options.balanced || explicitStrategy)) {
                 if (version) {
@@ -2818,6 +2850,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                                 // Keep the rotation so mid-run failover can still cascade across
                                 // the other (stale) healthy accounts after a real rejection.
                                 rotationResult = resolved.rotation;
+                                await applyPickedCandidate(selected);
                                 if (!options.quiet) {
                                     const identity = selected.accountLabel || 'signed-in account';
                                     process.stderr.write(chalk.gray(`[agents] no fresh usage for any ${agent} account — you picked ${identity} · ${agent}@${selected.version}\n`));
@@ -2836,12 +2869,13 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                             if (resolved.rotation) {
                                 launchSignedIn = resolved.rotation.picked.signedIn;
                                 launchEmail = resolved.rotation.picked.email;
+                                await applyPickedCandidate(resolved.rotation.picked);
                             }
                             // A balanced/available pick of a PROVIDER account (setup-token /
                             // API-key) carries `providerAccount`. Resolve its env through the
                             // same `resolveSpawnAccount` path an explicit `--account` uses, so
                             // exec injects the credential; a native pick has no providerAccount
-                            // and runs from its own version home unchanged (RUSH-3182).
+                            // and resolved its slot home in applyPickedCandidate above.
                             const pickedProviderAccount = resolved.rotation?.picked.providerAccount;
                             if (pickedProviderAccount) {
                                 try {
@@ -3561,6 +3595,24 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             // Governance chokepoint (#347): every dispatched run finalizes here.
             // ONE tamper-evident audit record per run — non-fatal by contract.
             recordDispatchedRun({ agent: ranAgent, version: ranVersion ?? 'unknown', mode, cwd, exitCode });
+            // A clean headless exit is real auth evidence — the account authenticated
+            // and produced a result. Record it as the per-account FACT `agents view`
+            // renders (`last used ok`), keyed to the slot the run used so it lands on
+            // the right row and clears any stale failure fact (PHNX-4116). A non-zero
+            // exit is NOT recorded as an auth failure: the exit code alone does not
+            // prove the token was rejected (a task can fail for a hundred reasons), and
+            // a lying "auth failure" fact is worse than none. Real auth failures are
+            // recorded where they are actually detected (the routine runner's
+            // isAuthFailureFromLog sites) and by the daemon probe.
+            if (exitCode === 0) {
+                recordRunAuthOutcome({
+                    agent: ranAgent,
+                    accountId: execOptions.accountId ?? null,
+                    version: ranVersion ?? null,
+                    home: execHome ?? null,
+                    outcome: { ok: true },
+                });
+            }
             // First-successful-run star nudge (one-time, non-nagging). Only on a
             // clean run, and never when output is machine-readable/quiet.
             if (exitCode === 0)

package/dist/commands/projects.js

@@ -30,7 +30,8 @@ import { checkRepoSlug } from '../lib/project-doctor.js';
 import { formatFocusAreas, readFocusAreas } from '../lib/project-focus.js';
 import { formatVerdict, scheduleVerdict } from '../lib/project-schedule.js';
 import { buildLinearImportCandidates, validateImportOpts, } from '../lib/project-import.js';
-import { buildProjectPrs } from '../lib/github/project-prs.js';
+import { buildProjectPrs, mergeProjectPr, resolveTargetSlugs, MERGE_METHODS } from '../lib/github/project-prs.js';
+import { ghExec } from '../lib/github/pr-mergeable.js';
 /** Recursion guard: a peer answering a probe fan-out never re-fans-out itself. */
 const PROJECTS_NO_FANOUT_ENV = 'AGENTS_PROJECTS_LOCAL';
 /** Max peers named in the skipped note before the rest collapse to `+N`. */
@@ -820,9 +821,14 @@ export function registerProjectsCommands(program) {
         await runProjectCard(name, opts, mode);
     });
     // ---- prs ----
+    // `list` is the default so `prs <name>` keeps its shape; a bare parent with
+    // no options of its own is what lets `prs merge` own --repo/--number/--json.
     const prsCmd = projects
-        .command('prs <name>')
-        .description('Every OPEN pull request across a project\'s attached repos (drafts included, no author filter).')
+        .command('prs')
+        .description('A project\'s open pull requests: list them (default), or merge one.');
+    const prsListCmd = prsCmd
+        .command('list <name>', { isDefault: true })
+        .description('Every OPEN pull request across a project\'s attached repos (drafts included, no author filter), scoped to this project\'s paths in a shared repo.')
         .option('--json', 'Machine-readable output (the AGI Menu contract shape)')
         .option('--repo <owner/repo>', 'Restrict to one of the project\'s attached repos')
         .option('--number <n>', 'Lazy detail: enrich exactly this PR with checks + reviewDecision (requires --repo)')
@@ -849,7 +855,7 @@ export function registerProjectsCommands(program) {
         }
         let envelope;
         try {
-            envelope = await buildProjectPrs(def, { repo: opts.repo, number }, undefined);
+            envelope = await buildProjectPrs(def, { repo: opts.repo, number }, undefined, listProjectDefs());
         }
         catch (e) {
             // A restriction error (repo not attached) is a hard, up-front failure —
@@ -875,7 +881,8 @@ export function registerProjectsCommands(program) {
                 console.log(`${chalk.bold(r.slug)}  ${chalk.dim(`${r.pullRequests.length} open`)}`);
                 for (const pr of r.pullRequests) {
                     const draft = pr.isDraft ? chalk.gray(' [draft]') : '';
-                    console.log(`  #${pr.number}${draft}  ${pr.title}  ${chalk.gray(`@${pr.author.login} · ${pr.headRefName}`)}`);
+                    const wide = pr.scope === 'repo-wide' ? chalk.gray(' [repo-wide]') : '';
+                    console.log(`  #${pr.number}${draft}${wide}  ${pr.title}  ${chalk.gray(`@${pr.author.login} · ${pr.headRefName}`)}`);
                 }
             }
             if (envelope.partial) {
@@ -886,11 +893,81 @@ export function registerProjectsCommands(program) {
         if (envelope.partial)
             process.exit(1);
     });
+    const mergeCmd = prsCmd
+        .command('merge <name>')
+        .description('Merge one open PR of a project, pinned to the head SHA you reviewed.')
+        .requiredOption('--repo <owner/repo>', 'One of the project\'s attached repos')
+        .requiredOption('--number <n>', 'The PR number')
+        .requiredOption('--sha <head-sha>', 'The head SHA you reviewed; GitHub refuses if the branch moved since')
+        .option('--method <method>', `${MERGE_METHODS.join(' | ')} (default: the first the repo allows, in that order)`)
+        .option('--json', 'Machine-readable result')
+        .action(async (name, opts) => {
+        const def = loadProjectDef(name);
+        if (!def) {
+            console.error(chalk.red(`No project named "${name}". List them: agents projects list`));
+            process.exit(1);
+        }
+        const raw = opts.number.trim();
+        const number = /^\d+$/.test(raw) ? Number.parseInt(raw, 10) : NaN;
+        if (!Number.isSafeInteger(number) || number <= 0) {
+            console.error(chalk.red(`--number expects a positive integer, got "${opts.number}".`));
+            process.exit(1);
+        }
+        if (!/^[0-9a-f]{7,40}$/i.test(opts.sha.trim())) {
+            console.error(chalk.red(`--sha expects a commit SHA, got "${opts.sha}".`));
+            process.exit(1);
+        }
+        if (opts.method !== undefined && !MERGE_METHODS.includes(opts.method)) {
+            console.error(chalk.red(`--method expects one of ${MERGE_METHODS.join(', ')}, got "${opts.method}".`));
+            process.exit(1);
+        }
+        let repo;
+        try {
+            [repo] = await resolveTargetSlugs(def, opts.repo, ghExec);
+        }
+        catch (e) {
+            console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+            process.exit(1);
+        }
+        const result = await mergeProjectPr(repo, number, opts.sha.trim(), opts.method);
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+        }
+        else if (result.merged) {
+            console.log(`${chalk.green('Merged')} ${repo}#${number} (${result.method}) ${chalk.gray(result.sha ?? '')}`);
+        }
+        else {
+            console.error(chalk.red(`Not merged: ${repo}#${number}: ${result.message}`));
+        }
+        if (!result.merged)
+            process.exit(1);
+    });
+    setHelpSections(mergeCmd, {
+        examples: `
+      agents projects prs rush --json --repo phnx-labs/agi-cli --number 3646   # read headSha + mergeableState
+      agents projects prs merge rush --repo phnx-labs/agi-cli --number 3646 --sha <headSha>
+      agents projects prs merge rush --repo phnx-labs/agi-cli --number 3646 --sha <headSha> --method squash --json
+    `,
+        notes: `
+      The merge is a single REST call pinned to --sha: if anything was pushed after
+      you read the PR, GitHub refuses and nothing merges. Branch protection, required
+      checks and reviews stay GitHub's to enforce; a refusal exits 1 with GitHub's
+      message (merged: false in --json).
+    `,
+    });
     setHelpSections(prsCmd, {
         examples: `
+      agents projects prs rush --json                       # every open PR across rush's repos (= prs list rush)
+      agents projects prs rush --json --repo phnx-labs/agi-cli --number 3646  # one PR, with checks + mergeability
+      agents projects prs merge rush --repo phnx-labs/agi-cli --number 3646 --sha <headSha>
+    `,
+    });
+    setHelpSections(prsListCmd, {
+        examples: `
       agents projects prs rush --json                       # every open PR across rush's repos
       agents projects prs rush --json --repo phnx-labs/agi-cli
-      agents projects prs rush --json --repo phnx-labs/agi-cli --number 3646  # one PR, with checks + review
+      agents projects prs rush --json --repo phnx-labs/agi-cli --number 3646  # one PR, with checks + review + mergeability
+      agents projects prs merge rush --repo phnx-labs/agi-cli --number 3646 --sha <headSha>
     `,
         notes: `
       Repos come from the project definition's attached repos only (repo + repos[].slug);
@@ -898,7 +975,15 @@ export function registerProjectsCommands(program) {
 
       The list is read from GitHub over REST and paginated in full, drafts included,
       with no author filter. checks and reviewDecision are null in the list; --number
-      enriches exactly that one PR against its live head SHA.
+      enriches exactly that one PR against its live head SHA, with mergeable and
+      mergeableState.
+
+      A repository attached to several projects (a monorepo) is scoped by the paths
+      each project claims, the same rule that attributes a session's cwd: a
+      defaultPath narrowed under root, or a repos[] subpath. A PR is listed when it
+      touches this project's paths (scope: project) or no sharing project's paths
+      (scope: repo-wide). Changed files are cached per head SHA, so only a new push
+      costs a read.
 
       A repository whose fetch fails is reported with an error and marks the result
       partial (JSON reports errors per repository; text mode exits non-zero).