@phnx-labs/agents-cli 1.22.14 → 1.22.15

package/dist/commands/routines.js

@@ -14,7 +14,7 @@ import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemo
 import { assertSchedulerEnabled } from '../lib/device-config.js';
 import { resolveAgentName, isAgentHardDeprecated, hardDeprecationError } from '../lib/agents.js';
 import { humanizeCron, humanizeNextRun, formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
-import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, routineStats, getLatestRun, getRunDir, getJobPath, parseAtTime, hasCompletedOneShotRun, isOneShotLikeSchedule, isOneShotRoutine, isPastOneShotRoutine, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, placementRequiresFiringPin, HOST_STRATEGIES, } from '../lib/routines.js';
+import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, routineStats, getLatestRun, getRunDir, getJobPath, parseAtTime, hasCompletedOneShotRun, isOneShotLikeSchedule, isOneShotRoutine, isPastOneShotRoutine, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, HOST_STRATEGIES, } from '../lib/routines.js';
 import { discoverProjectRoutinesAt, enableProjectRoutines, disableProjectRoutines, syncProjectRoutines, syncAllProjectRoutines, listEnabledProjectRoots, resolveProjectRoot, displayProjectPath, listProjectRoutineFiles, } from '../lib/routines-project.js';
 import { fireWebhookJobs, matchJobsToWebhook } from '../lib/triggers/webhook.js';
 import { getRoutinesDir } from '../lib/state.js';
@@ -29,6 +29,9 @@ import { setHelpSections } from '../lib/help.js';
 import { loadDevices, loadDevicesSync } from '../lib/devices/registry.js';
 import { machineId, normalizeHost } from '../lib/machine-id.js';
 import { addHostOption } from '../lib/hosts/option.js';
+import { devicesWithRoutineEnabled } from '../lib/routine-activation.js';
+import { spawnSync } from 'node:child_process';
+import { getCliLaunch } from '../lib/cli-entry.js';
 /**
  * Human-friendly wall-clock a run took (e.g. "  · 3 min", "  · 45 sec"), or ""
  * when it hasn't completed or timestamps are unparseable. Leading separator lets
@@ -131,7 +134,7 @@ function placementTag(job) {
     return '->cloud';
 }
 function deviceLabel(job, width) {
-    const full = [job.devices?.join(',') ?? '', placementTag(job)]
+    const full = [devicesWithRoutineEnabled(job.name).join(','), placementTag(job)]
         .filter(Boolean)
         .join(' ');
     const raw = full.length === 0 ? 'all' : full;
@@ -182,9 +185,9 @@ export function groupRoutineJobsByDevice(jobs, registry, self = machineId()) {
             add(`host:${normalizeHost(host)}`, titleWithDeviceState(`Host: ${host}`, host, registry), job);
             continue;
         }
-        const devices = job.devices ?? [];
+        const devices = devicesWithRoutineEnabled(job.name);
         if (devices.length === 0) {
-            add('fleet', 'Fleet-wide', job);
+            add('disabled', 'Disabled', job);
             continue;
         }
         for (const device of devices) {
@@ -202,12 +205,14 @@ export function groupRoutineJobsByDevice(jobs, registry, self = machineId()) {
             return 0;
         if (group.key === 'fleet')
             return 1;
-        if (group.key === 'cloud')
+        if (group.key === 'disabled')
             return 2;
-        if (group.key.startsWith('device:'))
+        if (group.key === 'cloud')
             return 3;
-        if (group.key.startsWith('host:'))
+        if (group.key.startsWith('device:'))
             return 4;
+        if (group.key.startsWith('host:'))
+            return 5;
         return 5;
     };
     return [...groups.values()].sort((a, b) => order(a) - order(b) || a.title.localeCompare(b.title));
@@ -545,6 +550,7 @@ export function registerRoutinesCommands(program) {
             const nowJson = new Date();
             const payload = jobs.map((job) => {
                 const latestRun = localLatestRun(job);
+                const enabledDevices = devicesWithRoutineEnabled(job.name);
                 return {
                     name: job.name,
                     agent: job.agent ?? null,
@@ -555,7 +561,8 @@ export function registerRoutinesCommands(program) {
                     scheduleHuman: fireConditionLabel(job),
                     trigger: job.trigger ?? null,
                     timezone: job.timezone ?? null,
-                    devices: job.devices ?? [],
+                    devices: enabledDevices,
+                    enabledDevices,
                     host: job.host ?? null,
                     hostStrategy: resolveHostStrategy(job),
                     source: job.source ?? null,
@@ -628,7 +635,7 @@ export function registerRoutinesCommands(program) {
         .option('-t, --timeout <timeout>', 'Kill the agent if it runs longer than this (e.g., 10m, 2h, 3d, 1w; max 1w)', '10m')
         .option('--timezone <tz>', 'Interpret schedule in this timezone (e.g., America/Los_Angeles)')
         .option('--devices <names>', 'Fleet allowlist (comma-separated): only listed devices schedule and fire this routine. Omit for unrestricted.')
-        .option('--run-on <name>', 'BODY placement: execute the job body on this machine over SSH (registered host, device, capability tag, or user@host). Sets hostStrategy=host. Not eligibility — see --devices. Auto-pins devices to THIS machine unless --devices is given. Same model as agents run --where device:<name> (docs/00-concepts.md#placement).')
+        .option('--run-on <name>', 'BODY placement: execute the job body on this machine over SSH (registered host, device, capability tag, or user@host). Sets hostStrategy=host. Same model as agents run --where device:<name> (docs/00-concepts.md#placement).')
         .option('--placement <strategy>', `BODY placement strategy: ${HOST_STRATEGIES.join('|')} (default: local, or host when --run-on is set). Maps to the shared Placement model (local|device|fleet|cloud). Not the same as --host (which manages routines on a remote machine).`)
         .option('--run-cwd <dir>', 'Working directory on the --run-on host (--remote-cwd is taken by the remote-management passthrough)')
         .option('--at <time>', 'One-shot mode: run once at this time (e.g., "14:30" or "2026-02-24 09:00"), then disable')
@@ -727,15 +734,6 @@ export function registerRoutinesCommands(program) {
                 console.error(chalk.red('--placement host requires --run-on <name>'));
                 process.exit(1);
             }
-            // Off-box placement without a --devices pin would fire on EVERY daemon
-            // in the fleet, each dispatching once — duplicate runs (RUSH-1980).
-            // Pin to this machine unless the user chose an explicit eligibility set.
-            const strategyForPin = hostStrategy
-                ?? (options.runOn ? 'host' : 'local');
-            if (placementRequiresFiringPin(strategyForPin) && !devices) {
-                devices = [machineId()];
-                console.error(chalk.gray(`--placement ${strategyForPin} with no --devices: pinned firing to this machine (${devices[0]}).`));
-            }
             const config = {
                 name: nameOrPath,
                 ...(schedule ? { schedule } : {}),
@@ -767,6 +765,7 @@ export function registerRoutinesCommands(program) {
                 process.exit(1);
             }
             writeJob(config);
+            setJobEnabled(config.name, config.enabled && (!devices || devices.map(normalizeHost).includes(normalizeHost(machineId()))));
             if (options.json) {
                 writeJson({
                     ok: true,
@@ -831,14 +830,8 @@ export function registerRoutinesCommands(program) {
                 config.runOnce = true;
                 console.error(chalk.yellow(`Schedule "${config.schedule}" pins minute, hour, day, and month; treating it as one-shot. Prefer --at for one-time routines.`));
             }
-            // Same duplicate-fire guard as --placement/--run-on: off-box placement
-            // with no eligibility pin would fire from every daemon in the fleet.
-            const fileStrategy = resolveHostStrategy(config);
-            if (placementRequiresFiringPin(fileStrategy) && (!config.devices || config.devices.length === 0)) {
-                config.devices = [machineId()];
-                console.error(chalk.gray(`${fileStrategy} placement with no devices pin: pinned firing to this machine (${config.devices[0]}).`));
-            }
             writeJob(config);
+            setJobEnabled(config.name, config.enabled && (!config.devices || config.devices.map(normalizeHost).includes(normalizeHost(machineId()))));
             if (options.json) {
                 writeJson({
                     ok: true,
@@ -1435,12 +1428,13 @@ export function registerRoutinesCommands(program) {
             process.exit(1);
         }
     });
-    // Fleet allowlist management for a single routine.
+    // Device activation management for a single routine. Each mutation executes
+    // on the target device so only that host writes devices/<hostname>/agents.yaml.
     routinesCmd
         .command('devices [name]')
-        .description('View or change which devices may run a routine. Without flags, opens an interactive picker (requires a TTY).')
-        .option('--set <devices>', 'Replace the allowlist with this comma-separated list (strict fleet validation)')
-        .option('--clear', 'Remove the allowlist so the routine runs on every device')
+        .description('View or change the devices where a routine is enabled. Without flags, opens an interactive picker (requires a TTY).')
+        .option('--set <devices>', 'Replace the enabled-device set with this comma-separated list')
+        .option('--clear', 'Disable the routine on every registered device')
         .action(async (name, options) => {
         const hasSet = options.set !== undefined;
         if (hasSet && options.clear) {
@@ -1457,33 +1451,37 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.red(`Job '${name}' not found`));
             process.exit(1);
         }
+        const applyDevices = async (selected) => {
+            const registry = await loadDevices();
+            const registered = Object.keys(registry).map(normalizeHost);
+            const all = [...new Set([...registered, machineId()].map(normalizeHost))].sort();
+            const selectedSet = new Set(selected.map(normalizeHost));
+            const unknown = [...selectedSet].filter((device) => !all.includes(device));
+            if (unknown.length > 0)
+                throw new Error(`Unknown device${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}`);
+            for (const device of all) {
+                const action = selectedSet.has(device) ? 'resume' : 'pause';
+                if (device === normalizeHost(machineId())) {
+                    setJobEnabled(name, action === 'resume');
+                    if (isDaemonRunning())
+                        signalDaemonReload();
+                    continue;
+                }
+                const launch = getCliLaunch(['routines', action, name, '--host', device]);
+                const result = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env });
+                if ((result.status ?? 1) !== 0)
+                    throw new Error(`Could not ${action} '${name}' on ${device}`);
+            }
+            console.log(chalk.green(selected.length === 0
+                ? `Routine '${name}' disabled on every registered device`
+                : `Routine '${name}' enabled on: ${selected.join(', ')}`));
+        };
         if (options.clear) {
-            const strategy = resolveHostStrategy(job);
-            if (placementRequiresFiringPin(strategy)) {
-                console.error(chalk.red(`Cannot clear devices for hostStrategy: ${strategy} — without a pin every fleet daemon would dispatch once.`));
-                console.error(chalk.gray(`Keep a single-machine pin (e.g. --set ${machineId()}) or switch to --placement local.`));
-                process.exit(1);
-            }
-            job.devices = undefined;
-            writeJob(job);
-            console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
-            if (isDaemonRunning())
-                signalDaemonReload();
+            await applyDevices([]);
             return;
         }
         if (hasSet) {
-            const devices = await parseAndValidateDevices(options.set);
-            job.devices = devices;
-            // Re-validate so host/fleet/cloud can't be left with an empty set via --set ""
-            const errs = validateJob(job);
-            if (errs.length > 0) {
-                console.error(chalk.red(errs.join('\n')));
-                process.exit(1);
-            }
-            writeJob(job);
-            console.log(chalk.green(`Devices for '${name}' set to: ${devices.join(', ')}`));
-            if (isDaemonRunning())
-                signalDaemonReload();
+            await applyDevices(await parseAndValidateDevices(options.set));
             return;
         }
         // Interactive picker
@@ -1496,34 +1494,18 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.yellow('No devices registered. Enroll with: agents devices sync'));
             return;
         }
-        const currentSet = new Set((job.devices ?? []).map((d) => normalizeHost(d)));
+        const currentSet = new Set(devicesWithRoutineEnabled(name).map(normalizeHost));
         try {
             const { checkbox } = await import('@inquirer/prompts');
             const selected = await checkbox({
-                message: `Devices allowed to run '${name}' (space to toggle, enter to confirm, empty = unrestricted):`,
+                message: `Devices where '${name}' is enabled (space to toggle, enter to confirm):`,
                 choices: registeredNames.map((d) => ({
                     value: d,
                     name: d,
                     checked: currentSet.has(d),
                 })),
             });
-            if (selected.length === 0) {
-                const strategy = resolveHostStrategy(job);
-                if (placementRequiresFiringPin(strategy)) {
-                    console.error(chalk.red(`Cannot clear devices for hostStrategy: ${strategy} — without a pin every fleet daemon would dispatch once.`));
-                    return;
-                }
-                job.devices = undefined;
-                writeJob(job);
-                console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
-            }
-            else {
-                job.devices = selected;
-                writeJob(job);
-                console.log(chalk.green(`Devices for '${name}' set to: ${selected.join(', ')}`));
-            }
-            if (isDaemonRunning())
-                signalDaemonReload();
+            await applyDevices(selected);
         }
         catch (err) {
             if (isPromptCancelled(err)) {

package/dist/commands/setup-watchdog.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function runWatchdogSetupWizard(): Promise<void>;
+export declare function registerSetupWatchdogCommand(setup: Command): void;

package/dist/commands/setup-watchdog.js

@@ -0,0 +1,54 @@
+import chalk from 'chalk';
+import { spawnSync } from 'node:child_process';
+import { getCliLaunch } from '../lib/cli-entry.js';
+import { loadDevices } from '../lib/devices/registry.js';
+import { machineId, normalizeHost } from '../lib/machine-id.js';
+import { devicesWithRoutineEnabled } from '../lib/routine-activation.js';
+import { readJob, setJobEnabled } from '../lib/routines.js';
+import { isPromptCancelled, requireInteractiveSelection } from './utils.js';
+const ROUTINE = 'watchdog';
+export async function runWatchdogSetupWizard() {
+    if (!readJob(ROUTINE)) {
+        throw new Error("Built-in routine 'watchdog' is missing. Run: agents repo pull system");
+    }
+    const registry = await loadDevices();
+    const devices = [...new Set([...Object.keys(registry), machineId()].map(normalizeHost))].sort();
+    const enabled = new Set(devicesWithRoutineEnabled(ROUTINE).map(normalizeHost));
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        requireInteractiveSelection('watchdog devices', ['agents watchdog on', 'agents watchdog on --host <device>']);
+    }
+    try {
+        const { checkbox } = await import('@inquirer/prompts');
+        const selected = await checkbox({
+            message: 'Devices where the watchdog should run:',
+            choices: devices.map((device) => ({ name: device, value: device, checked: enabled.has(device) })),
+        });
+        const selectedSet = new Set(selected);
+        for (const device of devices) {
+            const on = selectedSet.has(device);
+            if (device === normalizeHost(machineId())) {
+                setJobEnabled(ROUTINE, on);
+                continue;
+            }
+            const launch = getCliLaunch(['routines', on ? 'resume' : 'pause', ROUTINE, '--host', device]);
+            const result = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env });
+            if ((result.status ?? 1) !== 0)
+                throw new Error(`Could not configure watchdog on ${device}`);
+        }
+        console.log(chalk.green(selected.length === 0
+            ? 'Watchdog disabled on every registered device'
+            : `Watchdog enabled on: ${selected.join(', ')}`));
+    }
+    catch (error) {
+        if (isPromptCancelled(error)) {
+            console.log(chalk.gray('Cancelled'));
+            return;
+        }
+        throw error;
+    }
+}
+export function registerSetupWatchdogCommand(setup) {
+    setup.command('watchdog')
+        .description('Choose the devices where the built-in watchdog routine runs.')
+        .action(runWatchdogSetupWizard);
+}

package/dist/commands/setup.js

@@ -24,6 +24,7 @@ import { registerSetupShareCommand, runShareWizard } from './setup-share.js';
 import { registerSetupMineCommand } from './setup-mine.js';
 import { registerSetupSecretsCommand } from './setup-secrets.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
+import { registerSetupWatchdogCommand, runWatchdogSetupWizard } from './setup-watchdog.js';
 import { runPreferencesStep } from './setup-preferences.js';
 const HOME = os.homedir();
 /**
@@ -247,6 +248,7 @@ async function runSetupHub() {
                 { name: 'share    — publish shareable links (Cloudflare R2 + Worker)', value: 'share' },
                 { name: 'secrets  — choose storage defaults and import existing credentials', value: 'secrets' },
                 { name: 'fleet    — discover Tailscale devices and configure SSH access', value: 'fleet' },
+                { name: 'watchdog — resume stalled agent sessions on selected devices', value: 'watchdog' },
             ],
         });
         for (const pick of picks) {
@@ -261,6 +263,8 @@ async function runSetupHub() {
                 await import('./setup-secrets.js').then((m) => m.runSecretsSetupWizard());
             else if (pick === 'fleet')
                 await import('./setup-fleet.js').then((m) => m.runFleetSetupWizard());
+            else if (pick === 'watchdog')
+                await runWatchdogSetupWizard();
         }
     }
     catch (err) {
@@ -283,6 +287,7 @@ export function registerSetupCommand(program) {
     registerSetupMineCommand(setupCmd);
     registerSetupSecretsCommand(setupCmd);
     registerSetupFleetCommand(setupCmd);
+    registerSetupWatchdogCommand(setupCmd);
     setHelpSections(setupCmd, {
         examples: `
       # First-time setup (clones the system repo into ~/.agents/.system/)
@@ -297,12 +302,13 @@ export function registerSetupCommand(program) {
       agents setup share
       agents setup secrets
       agents setup fleet
+      agents setup watchdog
     `,
         notes: `
       What it does:
         1. Clones the system repo into ~/.agents/.system/
         2. Imports any unmanaged agent installations it finds
-        3. On a TTY, offers to set up optional capabilities (browser/computer/share/secrets/fleet)
+        3. On a TTY, offers to set up optional capabilities (browser/computer/share/secrets/fleet/watchdog)
         4. On a TTY, asks preferences: which machine you sit at (interactive host)
            and which browser agents drive here — both skippable, both the same
            keys 'agents devices set-interactive' / 'browser profiles set-default' write
@@ -313,6 +319,7 @@ export function registerSetupCommand(program) {
         agents setup share       # provision or join a Cloudflare share endpoint
         agents setup secrets     # choose secrets backend/policy defaults + import
         agents setup fleet       # discover Tailscale devices + configure SSH access
+        agents setup watchdog    # choose which devices run the watchdog routine
 
       To install CLIs from agents.yaml and sync resources into version homes:
         agents sync --local -y

package/dist/commands/ssh.d.ts

@@ -20,6 +20,17 @@ import { type CrabboxBox } from '../lib/crabbox/cli.js';
  * the row formatting is deterministic in tests.
  */
 export declare function renderLeasedBoxesSection(boxes: CrabboxBox[], nowSecs: number): string[];
+/**
+ * Whether `agents devices list` shows the "Leased boxes" section (RUSH-2190).
+ * Opt-in via --all only: loading it scans the keychain for bundle credentials
+ * and can raise a Touch ID sheet after the table has printed, so the default
+ * list must never reach for it. --no-stats stays the hard "instant, no provider
+ * calls" opt-out even when --all is passed.
+ */
+export declare function showLeasedBoxesSection(opts: {
+    all?: boolean;
+    stats?: boolean;
+}): boolean;
 /**
  * Race `fanOut` against an overall wall-clock deadline (RUSH-2041).
  *

package/dist/commands/ssh.js

@@ -191,6 +191,16 @@ function loadLeasedBoxesSection() {
         return []; // crabbox not installed / no provider creds — omit the section
     }
 }
+/**
+ * Whether `agents devices list` shows the "Leased boxes" section (RUSH-2190).
+ * Opt-in via --all only: loading it scans the keychain for bundle credentials
+ * and can raise a Touch ID sheet after the table has printed, so the default
+ * list must never reach for it. --no-stats stays the hard "instant, no provider
+ * calls" opt-out even when --all is passed.
+ */
+export function showLeasedBoxesSection(opts) {
+    return opts.all === true && opts.stats !== false;
+}
 /**
  * `agents ssh <slug>` targeting a leased crabbox box. crabbox provisions a
  * per-lease identity key, so we ssh via crabbox's OWN emitted invocation
@@ -1152,10 +1162,13 @@ Typical workflow:
             console.log(chalk.gray(`  updated ${formatCheckedAge(freshness.oldestFetchedAt)} — pass --refresh (--live) for a live probe`));
         }
         // Ephemeral crabbox leases live alongside the registered fleet but are never
-        // written into the registry — surface them as their own live section. This is
-        // a live provider call, so honor --no-stats (the explicit "instant, no probes"
-        // opt-out) and bound it so a slow provider can't hang `agents devices`.
-        if (opts.stats !== false) {
+        // written into the registry — surface them as their own live section, but only
+        // behind --all (RUSH-2190). Reading them routes through crabboxEnv, whose
+        // bundle auto-detect scans the keychain and can raise a Touch ID sheet AFTER
+        // the table has printed — unacceptable for the default list, which hooks and
+        // other non-interactive callers rely on. The predicate is exported so the
+        // gate itself is unit-tested; keep it the ONLY condition guarding this call.
+        if (showLeasedBoxesSection(opts)) {
             for (const line of loadLeasedBoxesSection())
                 console.log(line);
         }
@@ -1170,6 +1183,7 @@ Typical workflow:
         .option('--refresh', 'force a live probe of every device, bypassing the cache')
         .option('--live', 'alias of --refresh (shorter to type)')
         .option('-f, --full', 'full mode: add per-device core count and free/total memory')
+        .option('--all', 'also show ephemeral leased boxes (live crabbox call; may need bundle secrets)')
         .action(runList);
     devicesCmd
         .command('status')

package/dist/commands/watchdog.d.ts

@@ -10,13 +10,12 @@
  *   agents watchdog --nudge            one tick, actually injects (explicit opt-in)
  *   agents watchdog --watch            manual poll loop (dry unless --nudge)
  *   agents watchdog --json             machine-readable tick output (for the menu-bar)
- *   agents watchdog enable|disable     turn the always-on watchdog routine on/off
+ *   agents watchdog on|off             turn the always-on watchdog routine on/off
  *   agents watchdog policy <id> <p>    per-session policy: off | keep | handsoff
  *
  * The always-on watchdog is a daemon-fired ROUTINE, not a private sentinel + a
- * hand-rolled loop: `enable` creates/enables a `watchdog` command routine
- * (`agents watchdog --nudge` every couple of minutes) and reloads the daemon;
- * `disable` pauses it. See ../lib/watchdog/routine.ts.
+ * hand-rolled loop. Its immutable definition comes from the system DotAgents
+ * repo; on/off only changes this device's routine membership.
  */
 import type { Command } from 'commander';
 /** Register the `agents watchdog` command tree. */

package/dist/commands/watchdog.js

@@ -10,26 +10,26 @@
  *   agents watchdog --nudge            one tick, actually injects (explicit opt-in)
  *   agents watchdog --watch            manual poll loop (dry unless --nudge)
  *   agents watchdog --json             machine-readable tick output (for the menu-bar)
- *   agents watchdog enable|disable     turn the always-on watchdog routine on/off
+ *   agents watchdog on|off             turn the always-on watchdog routine on/off
  *   agents watchdog policy <id> <p>    per-session policy: off | keep | handsoff
  *
  * The always-on watchdog is a daemon-fired ROUTINE, not a private sentinel + a
- * hand-rolled loop: `enable` creates/enables a `watchdog` command routine
- * (`agents watchdog --nudge` every couple of minutes) and reloads the daemon;
- * `disable` pauses it. See ../lib/watchdog/routine.ts.
+ * hand-rolled loop. Its immutable definition comes from the system DotAgents
+ * repo; on/off only changes this device's routine membership.
  */
 import chalk from 'chalk';
 import * as path from 'path';
 import { setHelpSections } from '../lib/help.js';
 import { parseDuration } from '../lib/hooks/cache.js';
 import { getRuntimeStateDir } from '../lib/state.js';
-import { setJobEnabled } from '../lib/routines.js';
+import { readJob, setJobEnabled } from '../lib/routines.js';
 import { getActiveSessions } from '../lib/session/active.js';
 import { mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { gcMailbox } from '../lib/mailbox-gc.js';
-import { ensureWatchdogRoutine, isWatchdogRoutineEnabled, watchdogRoutineExists, WATCHDOG_ROUTINE_NAME, WATCHDOG_ROUTINE_SCHEDULE, } from '../lib/watchdog/routine.js';
+import { devicesWithRoutineEnabled, routineEnabledOnThisDevice } from '../lib/routine-activation.js';
 import { runWatchdogTick, writePolicySentinel, DEFAULT_THRESHOLDS, } from '../lib/watchdog/runner.js';
 import { isWatchdogRotateEnabled, listRotateStates, setWatchdogRotateEnabled } from '../lib/watchdog/rotate.js';
+const WATCHDOG_ROUTINE_NAME = 'watchdog';
 /** Default state dir the runner and these subcommands share. */
 function stateDir() {
     return path.join(getRuntimeStateDir(), 'watchdog');
@@ -120,7 +120,7 @@ export function registerWatchdogCommand(program) {
         .command('watchdog')
         .description('Auto-nudge stalled agent terminals: detect stalls, resolve the exact split, inject "Continue." — no menu-bar needed.')
         .option('--nudge', 'Actually inject (default is a dry run that only reports what it would do)')
-        .option('--watch', 'Manual poll loop: run a tick every --interval (dry unless --nudge; the always-on path is `watchdog enable`)')
+        .option('--watch', 'Manual poll loop: run a tick every --interval (dry unless --nudge; the always-on path is `watchdog on`)')
         .option('--interval <dur>', 'Poll interval in --watch mode (e.g. 30s, 1m)', '30s')
         .option('--stall <dur>', 'Idle time before a session counts as stalled', humanMs(DEFAULT_THRESHOLDS.stallMs))
         .option('--cooldown <dur>', 'Minimum time between nudges to the same session', humanMs(DEFAULT_THRESHOLDS.cooldownMs))
@@ -166,7 +166,7 @@ export function registerWatchdogCommand(program) {
         const intervalMs = durationMsOr(opts.interval, 30_000);
         if (!computeWillInject() && !opts.json) {
             console.log(chalk.yellow(`watchdog --watch is DETECT-ONLY. Pass --nudge to inject, ` +
-                `or run 'agents watchdog enable' for the always-on daemon routine.`));
+                `or run 'agents watchdog on' for the always-on daemon routine.`));
         }
         // eslint-disable-next-line no-constant-condition
         while (true) {
@@ -197,7 +197,7 @@ export function registerWatchdogCommand(program) {
       agents watchdog --json
 
       # Turn on the ALWAYS-ON watchdog (a daemon-fired routine)
-      agents watchdog enable
+      agents watchdog on
 
       # Show the routine, rotate config, and any in-flight in-place rotates
       agents watchdog status
@@ -242,36 +242,45 @@ export function registerWatchdogCommand(program) {
       'watchdog.rotate: off' to ~/.agents/agents.yaml; nudging stays on).
       State machine: ~/.agents/.cache/state/watchdog/rotate/<sessionId>.json.
 
-      Always-on: 'agents watchdog enable' creates + enables a 'watchdog' command
-      routine ('${WATCHDOG_ROUTINE_SCHEDULE}' -> agents watchdog --nudge) and reloads the
-      daemon; 'disable' pauses it. Inspect it with 'agents routines list'. Defaults
+      Always-on: 'agents watchdog on' enables the system-defined 'watchdog' routine
+      on this device and reloads the daemon; 'off' disables it here. Inspect it with
+      'agents routines list'. Defaults
       OFF. Per-session policy: off (ignore), keep (default), handsoff (detect + flag).
 
       State (tray-readable): ${path.join('~/.agents/.cache/state/watchdog', '{nudges,flags,last-tick}.json')}
     `,
     });
     // --- always-on enable/disable/status (backed by the daemon routine) --------
-    cmd.command('enable')
-        .description('Turn ON the always-on watchdog: create/enable the `watchdog` routine and (re)load the daemon.')
-        .action(async () => {
-        ensureWatchdogRoutine(true);
+    const turnOn = async () => {
+        const routine = readJob(WATCHDOG_ROUTINE_NAME);
+        if (!routine)
+            throw new Error("Built-in routine 'watchdog' is missing. Run: agents repo pull system");
+        setJobEnabled(WATCHDOG_ROUTINE_NAME, true);
         await reloadDaemonForRoutine(true);
-        console.log(chalk.green(`watchdog: ENABLED — routine '${WATCHDOG_ROUTINE_NAME}' fires ${WATCHDOG_ROUTINE_SCHEDULE} (agents watchdog --nudge)`));
-    });
-    cmd.command('disable')
-        .description('Turn OFF the always-on watchdog (pause the `watchdog` routine).')
-        .action(async () => {
-        if (!watchdogRoutineExists()) {
-            console.log(chalk.dim('watchdog: already off (no routine)'));
-            return;
-        }
+        console.log(chalk.green(`watchdog: ON on this device (${routine.schedule ?? 'event-triggered'})`));
+    };
+    const turnOff = async () => {
+        if (!readJob(WATCHDOG_ROUTINE_NAME))
+            throw new Error("Built-in routine 'watchdog' is missing. Run: agents repo pull system");
         setJobEnabled(WATCHDOG_ROUTINE_NAME, false);
         await reloadDaemonForRoutine(false);
-        console.log(chalk.yellow('watchdog: DISABLED (routine paused)'));
+        console.log(chalk.yellow('watchdog: OFF on this device'));
+    };
+    cmd.command('on')
+        .description('Enable the built-in watchdog routine on this device.')
+        .action(async () => {
+        await turnOn();
+    });
+    cmd.command('off')
+        .description('Disable the built-in watchdog routine on this device.')
+        .action(async () => {
+        await turnOff();
     });
+    cmd.command('enable', { hidden: true }).action(turnOn);
+    cmd.command('disable', { hidden: true }).action(turnOff);
     cmd.command('rotate <state>')
         .description('Turn in-place rotate of rate-limited sessions on|off (watchdog.rotate in agents.yaml). ' +
-        'Rotate-only: nudging stays on — unlike `watchdog disable`, which pauses the whole watchdog.')
+        'Rotate-only: nudging stays on — unlike `watchdog off`, which disables the whole watchdog on this device.')
         .action((state) => {
         const s = state.toLowerCase();
         if (s !== 'on' && s !== 'off') {
@@ -292,13 +301,15 @@ export function registerWatchdogCommand(program) {
         // parent, not this subcommand. optsWithGlobals() merges both levels, so we
         // read it correctly regardless of which command commander bound it to.
         const json = command.optsWithGlobals().json === true;
-        const on = isWatchdogRoutineEnabled();
+        const on = routineEnabledOnThisDevice(WATCHDOG_ROUTINE_NAME) === true;
+        const enabledDevices = devicesWithRoutineEnabled(WATCHDOG_ROUTINE_NAME);
         const rotate = isWatchdogRotateEnabled() ? 'on' : 'off';
         const rotates = listRotateStates(stateDir());
         const inflight = rotates.filter((r) => r.phase !== 'done' && r.phase !== 'failed');
         if (json) {
             console.log(JSON.stringify({
                 enabled: on,
+                enabledDevices,
                 routine: WATCHDOG_ROUTINE_NAME,
                 stateDir: stateDir(),
                 rotate,
@@ -314,6 +325,7 @@ export function registerWatchdogCommand(program) {
             return;
         }
         console.log(`always-on watchdog: ${on ? chalk.green('ON') : chalk.dim('off')} (routine '${WATCHDOG_ROUTINE_NAME}')`);
+        console.log(`enabled devices: ${enabledDevices.length > 0 ? enabledDevices.join(', ') : chalk.dim('none')}`);
         console.log(`rotate: ${rotate === 'on' ? chalk.green('on') : chalk.yellow('off')} (watchdog.rotate in agents.yaml) · ${inflight.length} in-flight`);
         for (const r of inflight) {
             console.log(`  ${chalk.magenta(r.phase.padEnd(12))} ${chalk.bold(r.sessionId.slice(0, 8))} → ${r.newSessionId.slice(0, 8)}${r.error ? chalk.red(`  ${r.error}`) : ''}`);

package/dist/lib/auto-dispatch.d.ts

@@ -8,12 +8,13 @@
  *
  * The dispatch goes through the same provider layer as `agents cloud run`, so Rush
  * (Prix) is just one provider among rush/codex/factory — NOT a hidden requirement.
- * A project may pin its provider via `provider` in ~/.agents/factory/projects.json.
+ * A project pins its provider via `dispatch.provider` in its
+ * ~/.agents/projects/<name>.yaml definition.
  *
- * OPT-IN: a project auto-dispatches ONLY when `autoDispatch: true` AND `maxAgents > 0`.
- * Nothing global is on by default.
+ * OPT-IN: a project auto-dispatches ONLY when `dispatch.enabled: true` AND
+ * `dispatch.maxAgents > 0` AND it has a `linear.projectId`. Nothing is on by default.
  */
-/** The subset of a managed project this module needs (mirror of the shared JSON). */
+/** The subset of a project definition this module needs. */
 export interface AutoDispatchProject {
     id: string;
     name: string;
@@ -44,13 +45,10 @@ export interface PlannedDispatch {
     delegateName: string;
 }
 /**
- * Path to the shared factory project registry (written by the factory UI).
- * `AGENTS_FACTORY_PROJECTS_PATH` overrides it, mirroring `AGENTS_PROJECTS_DIR`
- * (`state.ts`) — that seam is what lets `projects import --from-factory` be
- * tested end-to-end against a real fixture file instead of a mock.
+ * Read auto-dispatch candidates from canonical project YAML definitions
+ * (~/.agents/projects/<name>.yaml). Only projects with `dispatch.enabled: true`
+ * are returned; the caller's `isEligible` gate then checks the cap and Linear id.
  */
-export declare function factoryProjectsPath(): string;
-/** Read the project registry rows this module cares about. */
 export declare function readAutoDispatchProjects(): AutoDispatchProject[];
 /** A project is eligible only when it has explicitly opted in with a positive cap. */
 export declare function isEligible(p: AutoDispatchProject): boolean;