@phnx-labs/agents-cli 1.22.118 → 1.22.119

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## 1.22.119
+
+- **A setup-token (provider) Claude account no longer opens on Claude Code's first-run
+  theme picker on a worker.** A provider account has no slot, so it runs in the
+  executable's shared version home, and nothing ever marked that home onboarded: an AGI
+  EXT tab dispatched to a worker landed on "Choose the text style…" instead of the agent.
+  A credentialed Claude spawn on a non-headed device now seeds `hasCompletedOnboarding` in
+  the home it runs in, right after the worker login-trap preflight in `spawnAgentLeased`
+  (explicit `#account`, default account, balanced pick, interactive tmux). Headless paths
+  that spawn elsewhere (`--loop`, routines) never show onboarding in print mode; the
+  Windows `.cmd` shim passthrough is not covered. With no email the seed writes only the
+  flag, so the home's own login identity is untouched; it writes through the
+  `.claude/.claude.json -> ../.claude.json` link instead of replacing it; and a document
+  already onboarded is left byte-identical. Source: `cli/src/lib/exec.ts`,
+  `cli/src/lib/claude-account-token.ts`.
+
+- **A headless Cursor run in plan mode now runs in folders Cursor has not seen
+  before, and prints its answer.** Two bugs stopped `agents run cursor "…" --mode
+  plan`, a Cursor teammate (`agents teams add … cursor …`), and a plan-mode Cursor
+  routine from working unattended:
+  - They passed `--plan` without `--trust`. In a directory Cursor had not seen,
+    Cursor stopped on "Do you trust the contents of this directory?" and exited
+    with no one to answer, so a teammate failed in 7 seconds with 0 tools. Every
+    headless mode except skip (which passes `-f`) now passes `--trust`. `--trust`
+    only accepts the configured working directory and does not bypass tool
+    permissions.
+  - In `--plan` mode Cursor delivers its answer through its createPlan tool, which
+    `-p` text output never prints. A run would read the repo for 3 minutes, exit 0,
+    and leave an empty log. A headless plan run now uses Cursor's read-only ask
+    mode (`--mode ask`), which refuses file writes the same way and prints its
+    answer.
+
+  Interactive Cursor runs keep `--plan` and Cursor's own trust prompt. Source:
+  `cli/src/lib/harness/adapters/cursor.ts`.
+
+- **Grok subscription seats log in per worker through the device-code flow.** `grok` now has the
+  same `per-device:device-auth` worker path as `codex`: `agents accounts add grok <name> --per-device`
+  registers the account with no API key, and `agents accounts login grok#<name> --per-device` on a
+  worker runs `grok login --device-auth` into that account's slot. The box prints a URL and code
+  that you approve in your own browser, so SuperGrok / X Premium+ seats run on workers without an
+  `XAI_API_KEY`, which bills API credits rather than the subscription. `accounts login --per-device`
+  is new and is the one login a worker may run for a dual-path harness (codex too); the plain
+  re-login stays headed-only. Source: `cli/src/lib/harness-auth-capabilities.ts`,
+  `cli/src/lib/accounts/add.ts`, `cli/src/commands/accounts.ts`.
+
+- **The `grok` shim runs the release `grok update` installed.** Grok's updater now writes
+  `~/.grok/bin/grok-<version>` and repoints `~/.grok/bin/grok`, leaving `downloads/` alone, but the
+  shim only scanned `downloads/`, so it kept running the old binary after an update (on one worker,
+  1.0.4, which xAI rejects with `426 ... outdated`). The shim, the `grok@<version>` alias, and
+  `getBinaryPath` now follow grok's own `bin/grok` pointer first and fall back to the `downloads/`
+  scan for older layouts. The shim schema version is bumped so installed shims regenerate.
+  Source: `cli/src/lib/installations/shims.ts`, `cli/src/lib/installations/store.ts`.
+
+- **Editor terminals follow the current agent session after a restart (PHNX-4218).**
+  Active/watch rows adopt the live agent descendant's recorded session, transcript,
+  terminal ID and launch ID while keeping the tab's shell PID and metadata. Only the
+  nearest recorded agents qualify, so nested agents cannot take over the tab. The most
+  recent recorded start wins at that depth, with PID as a stable tie-breaker; known
+  tab kinds must match. Windows retains the published identity until process starts
+  can be verified. Published terminal IDs
+  also survive when no descendant supplies one. Rows expose a display-only `accountLabel`
+  when the indexed account identifies one registered native slot; ambiguous identities
+  stay unlabeled, and org-only keys require a matching email.
+
+- **`agents projects prs` scopes a shared monorepo per project, and `agents projects prs merge` merges one PR (PHNX-4215).** When several projects share one repository, each project now lists only the PRs whose changed files touch the paths it claims (`scope: project`) or touch no sharing project's paths (`scope: repo-wide`). It uses the same `defaultPath`/`subpath` claim that attributes a session's cwd, and changed files are cached per head SHA. Rows gain `createdAt`. The envelope gains `viewer` and a per-repo `sharedWith`, and the `--number` detail adds `mergeable`/`mergeableState`. `agents projects prs merge <name> --repo … --number … --sha <head>` merges with one REST call pinned to the reviewed head, so GitHub refuses if the branch moved since. Repo canonicalization moved from GraphQL `gh repo view` to a cached REST read, which drops a warm refresh from about 2s to under 1s. Source: `cli/src/lib/github/project-prs.ts`, `cli/src/lib/projects.ts`, `cli/src/commands/projects.ts`.
+
 ## 1.22.118
 
 - **`agents sessions <read> --device <name>` routes a SINGLE-device READ through the standalone `sessions --host` when both sides support it (PHNX-4012).**

package/dist/commands/accounts.js

@@ -364,7 +364,7 @@ agents accounts list --fleet`,
     const addCmd = accounts.command('add <target> [name]')
         .description('Add an account. Harness form: add <harness> [name] runs the native login in a fresh credential slot and provisions workers. Provider form: add <name> --provider <p> --auth <t> stores a durable credential.')
         .option('--api-key <key>', 'Worker credential for api-key harnesses (codex/grok/cursor/opencode); prompted when omitted')
-        .option('--per-device', 'codex: ChatGPT-plan account — no API key stored; workers log in per box')
+        .option('--per-device', 'codex/grok: subscription seat (ChatGPT plan, SuperGrok, X Premium+) — no API key stored; workers log in per box')
         .option('--no-worker-token', 'Skip minting/collecting the worker credential (this device only)')
         .option('--provider <provider>', `Provider form: credential provider (${listAccountProviders().join(', ')})`)
         .option('--auth <type>', 'Provider form: api-key | setup-token | bearer-token')
@@ -428,12 +428,13 @@ agents accounts add codex gmail --per-device        # ChatGPT-plan seat; workers
 agents accounts add claude                          # name derived from the login's email
 agents accounts add work --provider anthropic --auth setup-token   # provider form (non-harness name)
 agents run claude#work`,
-        notes: `Headed devices only: on a worker, add refuses before any slot, install, or browser — workers are provisioned automatically from the durable credential the add mints (claude: a setup-token; codex/grok/cursor/opencode: an API key via --api-key or a prompt; codex also accepts --per-device for a ChatGPT-plan seat; kimi/antigravity log in per box). An account is a credential SLOT, not a second installation: the harness has one managed install and each account is a HOME-shaped slot with its own native OAuth login (never copied, never fleet-synced). Re-running add for an already-added identity points at 'agents accounts login <harness>#<name>'. Supported: ${addSupportedList()}; other harnesses fail with the reason. An ambient CLAUDE_CODE_OAUTH_TOKEN in your shell refuses the mint (unset it or pass --no-worker-token).`,
+        notes: `Headed devices only: on a worker, add refuses before any slot, install, or browser — workers are provisioned automatically from the durable credential the add mints (claude: a setup-token; codex/grok/cursor/opencode: an API key via --api-key or a prompt; codex and grok also accept --per-device for a subscription seat; kimi/antigravity log in per box). An account is a credential SLOT, not a second installation: the harness has one managed install and each account is a HOME-shaped slot with its own native OAuth login (never copied, never fleet-synced). Re-running add for an already-added identity points at 'agents accounts login <harness>#<name>'. Supported: ${addSupportedList()}; other harnesses fail with the reason. An ambient CLAUDE_CODE_OAUTH_TOKEN in your shell refuses the mint (unset it or pass --no-worker-token).`,
     });
     const loginCmd = accounts.command('login <account>')
         .description('Re-authenticate an account into its slot on this device (<harness>#<name>); re-mints and re-syncs the worker credential')
         .option('--api-key <key>', 'Rotate the stored worker API key (api-key harnesses)')
         .option('--no-worker-token', 'Skip re-minting the worker credential')
+        .option('--per-device', 'codex/grok: sign this box in to the subscription seat via the device-code flow (allowed on workers)')
         .option('--json', 'Machine-readable result (never includes a credential)')
         .action(async (selector, o, command) => {
         await runAccountsAction(command, async () => {
@@ -448,6 +449,7 @@ agents run claude#work`,
                     console.log(chalk.gray(`  ${m}`)); },
                 apiKey: o.apiKey,
                 noWorkerToken: o.workerToken === false,
+                perDevice: o.perDevice,
             });
             printAddResult(result, json);
         });
@@ -455,8 +457,9 @@ agents run claude#work`,
     setHelpSections(loginCmd, {
         examples: `agents accounts login claude#work
 agents accounts login codex#personal --api-key sk-…   # rotate the worker key
-agents accounts login kimi#main                       # per-device: logs THIS box in`,
-        notes: 'Re-runs the native login into the SAME slot (never a new home) and fails closed when the completed login is a different identity than the account. Headed devices only for harnesses with a portable worker credential; a per-device harness (kimi) may log in on any box — that is how that box gets its login. The daemon re-syncs the account row and worker credential after a successful login.',
+agents accounts login kimi#main                       # per-device: logs THIS box in
+agents ssh <worker> agents accounts login grok#work --per-device   # the worker signs in to the subscription seat`,
+        notes: 'Re-runs the native login into the SAME slot (never a new home) and fails closed when the completed login is a different identity than the account. Headed devices only for harnesses with a portable worker credential; a per-device harness (kimi) may log in on any box — that is how that box gets its login. With --per-device a codex or grok account signs THIS box in to its subscription seat through the device-code flow: the box prints a URL and code, you approve it in your own browser, and no API key is stored or synced. The daemon re-syncs the account row and worker credential after a successful login.',
     });
     const defaultCmd = accounts.command('default <harness> [name]')
         .description('Set the fleet-wide default account for a harness (picker when no name)')

package/dist/commands/projects.js

@@ -30,7 +30,8 @@ import { checkRepoSlug } from '../lib/project-doctor.js';
 import { formatFocusAreas, readFocusAreas } from '../lib/project-focus.js';
 import { formatVerdict, scheduleVerdict } from '../lib/project-schedule.js';
 import { buildLinearImportCandidates, validateImportOpts, } from '../lib/project-import.js';
-import { buildProjectPrs } from '../lib/github/project-prs.js';
+import { buildProjectPrs, mergeProjectPr, resolveTargetSlugs, MERGE_METHODS } from '../lib/github/project-prs.js';
+import { ghExec } from '../lib/github/pr-mergeable.js';
 /** Recursion guard: a peer answering a probe fan-out never re-fans-out itself. */
 const PROJECTS_NO_FANOUT_ENV = 'AGENTS_PROJECTS_LOCAL';
 /** Max peers named in the skipped note before the rest collapse to `+N`. */
@@ -820,9 +821,14 @@ export function registerProjectsCommands(program) {
         await runProjectCard(name, opts, mode);
     });
     // ---- prs ----
+    // `list` is the default so `prs <name>` keeps its shape; a bare parent with
+    // no options of its own is what lets `prs merge` own --repo/--number/--json.
     const prsCmd = projects
-        .command('prs <name>')
-        .description('Every OPEN pull request across a project\'s attached repos (drafts included, no author filter).')
+        .command('prs')
+        .description('A project\'s open pull requests: list them (default), or merge one.');
+    const prsListCmd = prsCmd
+        .command('list <name>', { isDefault: true })
+        .description('Every OPEN pull request across a project\'s attached repos (drafts included, no author filter), scoped to this project\'s paths in a shared repo.')
         .option('--json', 'Machine-readable output (the AGI Menu contract shape)')
         .option('--repo <owner/repo>', 'Restrict to one of the project\'s attached repos')
         .option('--number <n>', 'Lazy detail: enrich exactly this PR with checks + reviewDecision (requires --repo)')
@@ -849,7 +855,7 @@ export function registerProjectsCommands(program) {
         }
         let envelope;
         try {
-            envelope = await buildProjectPrs(def, { repo: opts.repo, number }, undefined);
+            envelope = await buildProjectPrs(def, { repo: opts.repo, number }, undefined, listProjectDefs());
         }
         catch (e) {
             // A restriction error (repo not attached) is a hard, up-front failure —
@@ -875,7 +881,8 @@ export function registerProjectsCommands(program) {
                 console.log(`${chalk.bold(r.slug)}  ${chalk.dim(`${r.pullRequests.length} open`)}`);
                 for (const pr of r.pullRequests) {
                     const draft = pr.isDraft ? chalk.gray(' [draft]') : '';
-                    console.log(`  #${pr.number}${draft}  ${pr.title}  ${chalk.gray(`@${pr.author.login} · ${pr.headRefName}`)}`);
+                    const wide = pr.scope === 'repo-wide' ? chalk.gray(' [repo-wide]') : '';
+                    console.log(`  #${pr.number}${draft}${wide}  ${pr.title}  ${chalk.gray(`@${pr.author.login} · ${pr.headRefName}`)}`);
                 }
             }
             if (envelope.partial) {
@@ -886,11 +893,81 @@ export function registerProjectsCommands(program) {
         if (envelope.partial)
             process.exit(1);
     });
+    const mergeCmd = prsCmd
+        .command('merge <name>')
+        .description('Merge one open PR of a project, pinned to the head SHA you reviewed.')
+        .requiredOption('--repo <owner/repo>', 'One of the project\'s attached repos')
+        .requiredOption('--number <n>', 'The PR number')
+        .requiredOption('--sha <head-sha>', 'The head SHA you reviewed; GitHub refuses if the branch moved since')
+        .option('--method <method>', `${MERGE_METHODS.join(' | ')} (default: the first the repo allows, in that order)`)
+        .option('--json', 'Machine-readable result')
+        .action(async (name, opts) => {
+        const def = loadProjectDef(name);
+        if (!def) {
+            console.error(chalk.red(`No project named "${name}". List them: agents projects list`));
+            process.exit(1);
+        }
+        const raw = opts.number.trim();
+        const number = /^\d+$/.test(raw) ? Number.parseInt(raw, 10) : NaN;
+        if (!Number.isSafeInteger(number) || number <= 0) {
+            console.error(chalk.red(`--number expects a positive integer, got "${opts.number}".`));
+            process.exit(1);
+        }
+        if (!/^[0-9a-f]{7,40}$/i.test(opts.sha.trim())) {
+            console.error(chalk.red(`--sha expects a commit SHA, got "${opts.sha}".`));
+            process.exit(1);
+        }
+        if (opts.method !== undefined && !MERGE_METHODS.includes(opts.method)) {
+            console.error(chalk.red(`--method expects one of ${MERGE_METHODS.join(', ')}, got "${opts.method}".`));
+            process.exit(1);
+        }
+        let repo;
+        try {
+            [repo] = await resolveTargetSlugs(def, opts.repo, ghExec);
+        }
+        catch (e) {
+            console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+            process.exit(1);
+        }
+        const result = await mergeProjectPr(repo, number, opts.sha.trim(), opts.method);
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+        }
+        else if (result.merged) {
+            console.log(`${chalk.green('Merged')} ${repo}#${number} (${result.method}) ${chalk.gray(result.sha ?? '')}`);
+        }
+        else {
+            console.error(chalk.red(`Not merged: ${repo}#${number}: ${result.message}`));
+        }
+        if (!result.merged)
+            process.exit(1);
+    });
+    setHelpSections(mergeCmd, {
+        examples: `
+      agents projects prs rush --json --repo phnx-labs/agi-cli --number 3646   # read headSha + mergeableState
+      agents projects prs merge rush --repo phnx-labs/agi-cli --number 3646 --sha <headSha>
+      agents projects prs merge rush --repo phnx-labs/agi-cli --number 3646 --sha <headSha> --method squash --json
+    `,
+        notes: `
+      The merge is a single REST call pinned to --sha: if anything was pushed after
+      you read the PR, GitHub refuses and nothing merges. Branch protection, required
+      checks and reviews stay GitHub's to enforce; a refusal exits 1 with GitHub's
+      message (merged: false in --json).
+    `,
+    });
     setHelpSections(prsCmd, {
         examples: `
+      agents projects prs rush --json                       # every open PR across rush's repos (= prs list rush)
+      agents projects prs rush --json --repo phnx-labs/agi-cli --number 3646  # one PR, with checks + mergeability
+      agents projects prs merge rush --repo phnx-labs/agi-cli --number 3646 --sha <headSha>
+    `,
+    });
+    setHelpSections(prsListCmd, {
+        examples: `
       agents projects prs rush --json                       # every open PR across rush's repos
       agents projects prs rush --json --repo phnx-labs/agi-cli
-      agents projects prs rush --json --repo phnx-labs/agi-cli --number 3646  # one PR, with checks + review
+      agents projects prs rush --json --repo phnx-labs/agi-cli --number 3646  # one PR, with checks + review + mergeability
+      agents projects prs merge rush --repo phnx-labs/agi-cli --number 3646 --sha <headSha>
     `,
         notes: `
       Repos come from the project definition's attached repos only (repo + repos[].slug);
@@ -898,7 +975,15 @@ export function registerProjectsCommands(program) {
 
       The list is read from GitHub over REST and paginated in full, drafts included,
       with no author filter. checks and reviewDecision are null in the list; --number
-      enriches exactly that one PR against its live head SHA.
+      enriches exactly that one PR against its live head SHA, with mergeable and
+      mergeableState.
+
+      A repository attached to several projects (a monorepo) is scoped by the paths
+      each project claims, the same rule that attributes a session's cwd: a
+      defaultPath narrowed under root, or a repos[] subpath. A PR is listed when it
+      touches this project's paths (scope: project) or no sharing project's paths
+      (scope: repo-wide). Changed files are cached per head SHA, so only a new push
+      costs a read.
 
       A repository whose fetch fails is reported with an error and marks the result
       partial (JSON reports errors per repository; text mode exits non-zero).

package/dist/lib/accounts/add.d.ts

@@ -128,6 +128,8 @@ export declare function runAdd(agent: AgentId, name: string | undefined, opts: A
  * Drive one `agents accounts login <harness>#<name>`: re-auth into the SAME
  * slot (re-running add's steps 4–8), re-minting the worker credential and
  * re-syncing. On a per-device harness (worker `none`) any box may run it —
- * that IS how such a box logs in.
+ * that IS how such a box logs in. `--per-device` extends that to a dual-path
+ * harness (codex, grok): this box signs the account's subscription seat in for
+ * itself through the device-code flow instead of using a portable key.
  */
 export declare function runLogin(agent: AgentId, name: string, opts: AddOptions, runners?: AddRunners): Promise<AddResult>;

package/dist/lib/accounts/add.js

@@ -73,6 +73,12 @@ export function workerApiKeyEnv(agent) {
 function hasPortableWorkerKind(agent) {
     return harnessWorkerKinds(agent).some((k) => k === 'setup-token' || k.startsWith('api-key:'));
 }
+function hasPerDeviceWorkerKind(agent) {
+    return harnessWorkerKinds(agent).some((k) => k.startsWith('per-device'));
+}
+function perDeviceRefusal(agent) {
+    return `--per-device is only valid for a harness with a per-device worker path; ${agent} is provisioned from ${workerProvisioningHint(agent)}.`;
+}
 /** Whether `accounts add` can drive this harness (nameable, version-scoped, a real login command). */
 export function addSupported(agent) {
     const cap = nativeAccountCapability(agent);
@@ -232,9 +238,8 @@ async function mintWorkerCredential(agent, account, home, opts, runners, warning
         return { outcome: 'skipped', provisioning: 'per-device' };
     }
     if (opts.perDevice) {
-        if (!kinds.some((k) => k.startsWith('per-device'))) {
-            throw new Error(`--per-device is only valid for a harness with a per-device worker path (codex); ${agent} is provisioned from ${workerProvisioningHint(agent)}.`);
-        }
+        if (!hasPerDeviceWorkerKind(agent))
+            throw new Error(perDeviceRefusal(agent));
         return { outcome: 'per-device', provisioning: 'per-device' };
     }
     const { seedReservedStoreKey, seedReservedAuthToken, workerCredentialStoreKey, } = await import('../auth-mint.js');
@@ -260,7 +265,7 @@ async function mintWorkerCredential(agent, account, home, opts, runners, warning
         let value = opts.apiKey?.trim();
         if (!value) {
             if (!runners.promptApiKey) {
-                throw new Error(`${agent}'s worker credential is an ${env} API key. Pass --api-key <key> (or --no-worker-token to skip, --per-device for a codex ChatGPT-plan account).`);
+                throw new Error(`${agent}'s worker credential is an ${env} API key. Pass --api-key <key> (or --no-worker-token to skip, or --per-device for a subscription seat when the harness has one).`);
             }
             const entered = await runners.promptApiKey(agent, env);
             if (entered === null) {
@@ -290,8 +295,8 @@ export async function runAdd(agent, name, opts, runners) {
     // before the lock, slot, install, or browser — no side effects on a worker.
     assertAddAllowedOnThisDevice(agent, name);
     const kinds = harnessWorkerKinds(agent);
-    if (opts.perDevice && !kinds.some((k) => k.startsWith('per-device'))) {
-        throw new Error(`--per-device is only valid for a harness with a per-device worker path (codex); ${agent} is provisioned from ${workerProvisioningHint(agent)}.`);
+    if (opts.perDevice && !hasPerDeviceWorkerKind(agent)) {
+        throw new Error(perDeviceRefusal(agent));
     }
     // The ambient-token refusal is checked up front (not at the mint step) so the
     // user doesn't complete a browser login only to be refused at the end.
@@ -410,13 +415,18 @@ async function _runAddLocked(agent, name, opts, lock, runners) {
  * Drive one `agents accounts login <harness>#<name>`: re-auth into the SAME
  * slot (re-running add's steps 4–8), re-minting the worker credential and
  * re-syncing. On a per-device harness (worker `none`) any box may run it —
- * that IS how such a box logs in.
+ * that IS how such a box logs in. `--per-device` extends that to a dual-path
+ * harness (codex, grok): this box signs the account's subscription seat in for
+ * itself through the device-code flow instead of using a portable key.
  */
 export async function runLogin(agent, name, opts, runners) {
     // A harness with a portable worker credential authenticates workers from that
     // credential, so the interactive re-login stays headed-only. A per-device
-    // harness (kimi) is logged in per box BY DESIGN — any role may run this.
-    if (hasPortableWorkerKind(agent))
+    // harness (kimi), or a per-device login of a dual-path harness, is logged in
+    // per box BY DESIGN — any role may run it.
+    if (opts.perDevice && !hasPerDeviceWorkerKind(agent))
+        throw new Error(perDeviceRefusal(agent));
+    if (hasPortableWorkerKind(agent) && !opts.perDevice)
         assertAddAllowedOnThisDevice(agent, name);
     if (!opts.noWorkerToken && harnessWorkerKinds(agent).includes('setup-token')) {
         const refusal = ambientTokenRefusal(agent, opts.env ?? process.env);
@@ -437,6 +447,7 @@ export async function runLogin(agent, name, opts, runners) {
 async function _runLoginLocked(agent, name, opts, lock, runners) {
     const run = runners ?? await defaultAddRunners();
     lock.assertHeld();
+    const perDevice = !!opts.perDevice || !hasPortableWorkerKind(agent);
     const meta = readMeta();
     const account = findAddAccount(agent, name, meta);
     if (!account) {
@@ -452,7 +463,7 @@ async function _runLoginLocked(agent, name, opts, lock, runners) {
         const slot = ensureSlot(agent, account.id);
         recordSlot(account.id, {
             ...slot,
-            authMode: hasPortableWorkerKind(agent) ? 'native' : 'per-device',
+            authMode: perDevice ? 'per-device' : 'native',
         });
     }
     // Pre-launch guard: refuse to launch a login into a slot signed in as a
@@ -481,8 +492,8 @@ async function _runLoginLocked(agent, name, opts, lock, runners) {
     const warnings = [];
     let outcome = 'per-device';
     let ref;
-    let provisioning = account.provisioning ?? (hasPortableWorkerKind(agent) ? 'portable' : 'per-device');
-    if (hasPortableWorkerKind(agent)) {
+    let provisioning = perDevice ? 'per-device' : (account.provisioning ?? 'portable');
+    if (!perDevice) {
         if (opts.apiKey && workerApiKeyEnv(agent)) {
             // Explicit rotation of the stored API key.
             const minted = await mintWorkerCredential(agent, account, home, opts, run, warnings);
@@ -520,7 +531,7 @@ async function _runLoginLocked(agent, name, opts, lock, runners) {
     recordSlot(account.id, {
         accountId: account.id,
         slotDir: home,
-        authMode: hasPortableWorkerKind(agent) ? 'native' : 'per-device',
+        authMode: perDevice ? 'per-device' : 'native',
         verdict: 'live',
         checkedAt: new Date().toISOString(),
     });

package/dist/lib/agent-spec/agents.js

@@ -269,6 +269,7 @@ export const AGENTS = {
         variableSyntax: '$ARGUMENTS',
         supportsHooks: true,
         nativePluginSkills: true,
+        ownedSkillDirs: ['synced'],
         // Claude Code grew a native `claude --cloud "<prompt>"` (Anthropic-managed
         // infra, claude.ai/code; requires claude.ai subscription auth). Routing
         // still goes to Rush Cloud deliberately — it keeps cloud tasks in one

package/dist/lib/claude-account-token.d.ts

@@ -103,5 +103,11 @@ export declare function isClaudeWorkerHomeSeeded(home: string): boolean;
  * at it, so nothing else can complete Claude Code's first-run onboarding (theme
  * picker, "Let's get started"); without the flag every slot launch re-onboarded.
  * Everything else in the document is preserved.
+ *
+ * Without an email only the onboarding flag is seeded: a provider (setup-token)
+ * launch runs in the shared version home, whose identity belongs to whatever
+ * native login lives there, so it must not be rewritten. A document already
+ * carrying the requested state is left untouched, so a launch never rewrites a
+ * config Claude Code is using.
  */
-export declare function seedClaudeWorkerHomeIdentity(versionHome: string, email: string): void;
+export declare function seedClaudeWorkerHomeIdentity(versionHome: string, email?: string): void;

package/dist/lib/claude-account-token.js

@@ -393,15 +393,34 @@ export function isClaudeWorkerHomeSeeded(home) {
  * at it, so nothing else can complete Claude Code's first-run onboarding (theme
  * picker, "Let's get started"); without the flag every slot launch re-onboarded.
  * Everything else in the document is preserved.
+ *
+ * Without an email only the onboarding flag is seeded: a provider (setup-token)
+ * launch runs in the shared version home, whose identity belongs to whatever
+ * native login lives there, so it must not be rewritten. A document already
+ * carrying the requested state is left untouched, so a launch never rewrites a
+ * config Claude Code is using.
  */
 export function seedClaudeWorkerHomeIdentity(versionHome, email) {
-    const trimmed = email.trim();
-    if (!trimmed)
-        return;
+    const trimmed = email?.trim() || undefined;
+    // A version home usually links `.claude/.claude.json -> ../.claude.json`. The
+    // temp-write + rename below would replace that link with a regular file and
+    // split one config into two, so write through a link to the file it names.
+    const targets = new Set();
     for (const p of [
         path.join(versionHome, '.claude', '.claude.json'),
         path.join(versionHome, '.claude.json'),
     ]) {
+        let target = p;
+        try {
+            if (fs.lstatSync(p).isSymbolicLink())
+                target = path.resolve(path.dirname(p), fs.readlinkSync(p));
+        }
+        catch {
+            // Missing: written fresh below.
+        }
+        targets.add(target);
+    }
+    for (const p of targets) {
         let doc = {};
         try {
             doc = JSON.parse(fs.readFileSync(p, 'utf-8'));
@@ -416,7 +435,10 @@ export function seedClaudeWorkerHomeIdentity(versionHome, email) {
         const existing = (doc.oauthAccount && typeof doc.oauthAccount === 'object'
             ? doc.oauthAccount
             : {});
-        doc.oauthAccount = { ...existing, emailAddress: trimmed };
+        if (doc.hasCompletedOnboarding === true && (!trimmed || existing.emailAddress === trimmed))
+            continue;
+        if (trimmed)
+            doc.oauthAccount = { ...existing, emailAddress: trimmed };
         doc.hasCompletedOnboarding = true;
         fs.mkdirSync(path.dirname(p), { recursive: true });
         // Temp-write + rename: a reader mid-write never sees a truncated doc.

package/dist/lib/exec.js

@@ -33,12 +33,12 @@ import { recordRunName } from './session/run-names.js';
 import { mailboxDir, isValidMailboxId } from './mailbox.js';
 import { composeWin32CommandLine } from './platform/index.js';
 import { isTmuxInstalled } from './tmux/binary.js';
-import { isTmuxEnabled, selfConfiguredDeviceRole } from './device-config.js';
+import { isHeadedDeviceRole, isTmuxEnabled, selfConfiguredDeviceRole } from './device-config.js';
 import { machineId } from './machine-id.js';
 import { shellQuote } from './ssh-exec.js';
 import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
 import { probeUnprivilegedUserns } from './linux-userns.js';
-import { resolveClaudeSetupToken } from './claude-account-token.js';
+import { resolveClaudeSetupToken, seedClaudeWorkerHomeIdentity } from './claude-account-token.js';
 import { applyAddDirs } from './add-dir.js';
 import { applyActiveRulesPresetAtRun } from './rules/run-sync.js';
 import { applySystemResourcesAtRun } from './system-run-sync.js';
@@ -1932,6 +1932,14 @@ async function spawnAgentLeased(options) {
             process.stderr.write(`\x1b[31m${loginTrap}\x1b[0m\n`);
             return { exitCode: 1, stdout: '', stderr: loginTrap };
         }
+        // A credentialed run on a worker never needs Claude Code's first-run
+        // onboarding, and in a provider (setup-token) launch's shared version home
+        // nothing else completes it: the tab opened on the theme picker instead of
+        // the agent (yosemite-m1, 2026-09-28). A headed device keeps its own
+        // onboarding; the person at it answers it.
+        if (hasWorkerCredential && versionHome && !isHeadedDeviceRole(selfConfiguredDeviceRole())) {
+            seedClaudeWorkerHomeIdentity(versionHome);
+        }
     }
     // Budget live kill-switch (issue #346). For headless runs we incrementally
     // parse stream-json usage off stdout, accumulate cost, and kill the child the

package/dist/lib/github/pr-mergeable.d.ts

@@ -7,7 +7,7 @@
  *
  * This helper:
  *   1. Collects GitHub slugs from `~/.agents/projects/*.yaml` (`repo` / `repos[].slug`).
- *   2. Canonicalizes each slug (`gh repo view` — `phnx-labs/agents-cli` lists
+ *   2. Canonicalizes each slug (REST `repos/{slug}` — `phnx-labs/agents-cli` lists
  *      nothing; the live name is `phnx-labs/agi-cli`).
  *   3. Runs `gh pr list --repo <slug> --author @me` (cwd-independent).
  *   4. Keeps CI-green PRs with a merge-guard verdict (formal APPROVED review
@@ -27,7 +27,9 @@ export declare function projectRepoSlugs(defs: readonly ProjectDef[]): string[];
 /**
  * Resolve a slug to GitHub's current `nameWithOwner`. A renamed repo
  * (`phnx-labs/agents-cli` → `phnx-labs/agi-cli`) lists zero PRs under the old
- * name; `gh repo view` returns the live one. On error, keep the input slug.
+ * name; the REST repo read follows the rename redirect and returns the live one.
+ * REST + a 24h gh cache: a rename is rare, and every `projects prs` refresh asks.
+ * On error, keep the input slug.
  */
 export declare function canonicalizeRepo(slug: string, gh: GhExec): Promise<string>;
 interface ListedPr {

package/dist/lib/github/pr-mergeable.js

@@ -7,7 +7,7 @@
  *
  * This helper:
  *   1. Collects GitHub slugs from `~/.agents/projects/*.yaml` (`repo` / `repos[].slug`).
- *   2. Canonicalizes each slug (`gh repo view` — `phnx-labs/agents-cli` lists
+ *   2. Canonicalizes each slug (REST `repos/{slug}` — `phnx-labs/agents-cli` lists
  *      nothing; the live name is `phnx-labs/agi-cli`).
  *   3. Runs `gh pr list --repo <slug> --author @me` (cwd-independent).
  *   4. Keeps CI-green PRs with a merge-guard verdict (formal APPROVED review
@@ -65,12 +65,14 @@ export function projectRepoSlugs(defs) {
 /**
  * Resolve a slug to GitHub's current `nameWithOwner`. A renamed repo
  * (`phnx-labs/agents-cli` → `phnx-labs/agi-cli`) lists zero PRs under the old
- * name; `gh repo view` returns the live one. On error, keep the input slug.
+ * name; the REST repo read follows the rename redirect and returns the live one.
+ * REST + a 24h gh cache: a rename is rare, and every `projects prs` refresh asks.
+ * On error, keep the input slug.
  */
 export async function canonicalizeRepo(slug, gh) {
     try {
         const out = (await gh([
-            'repo', 'view', slug, '--json', 'nameWithOwner', '--jq', '.nameWithOwner',
+            'api', `repos/${slug}`, '--cache', '24h', '--jq', '.full_name',
         ])).trim();
         return out || slug;
     }