@phnx-labs/agents-cli 1.22.21 → 1.22.23

package/CHANGELOG.md

@@ -1,5 +1,261 @@
 # Changelog
 
+## 1.22.23
+
+- **Daemon-warmed cross-surface session-status cache (RUSH-2062).** Menubar,
+  Factory, watchdog, and CLI used to each re-run a full `sessions --active`
+  gather (~9s / ~170MB) with no sharing. The daemon now warms a local active-
+  session snapshot every 15s; those surfaces read the warm file when fresh.
+  `session/remote.ts` is cache-first too — a reachable host skips SSH while its
+  cache is within the freshness window (it used to replay only on
+  unreachable). Immutable per-session fields (topic, label, cwd, …) are memoized
+  by transcript mtime; live status never rides that memo. Source:
+  `apps/cli/src/lib/session/session-cache.ts`, `apps/cli/src/lib/session/remote.ts`,
+  `apps/cli/src/lib/daemon.ts`.
+
+- **`agents sessions <id>` / `agents resume <id>` resolve across the fleet fast, with
+  early-exit and SSH cancellation (RUSH-2203).** The cross-machine resolve fanned out
+  with `await Promise.all` and no cancellation, so one slow or unreachable peer stalled
+  the whole lookup to the 12s per-peer timeout even after a fast peer already returned
+  the exact match — a full-UUID resolve on a fleet with an offline box took ~16-40s. A
+  **full-UUID** resolve (globally unique) now opts into a cancellable, early-exit
+  fan-out: the first peer holding it resolves the sweep and SIGTERMs every
+  still-outstanding peer, and a local UUID hit resolves with **zero** SSH.
+  `agents resume <label>` auto-resumes the one exact-label match; labels are not globally
+  unique, so they stay all-settle (a same-label session may live on another peer) — a
+  unique label resumes, a cross-machine collision surfaces as an ambiguity. The not-found
+  message reports the actual sweep result (devices searched, which were unreachable)
+  instead of the misleading "search with `--device <host>`" — fleet search is already the
+  default. `--device all` / `--devices` are accepted and mean "the whole fleet". The
+  all-settle default is unchanged for the shared fan-out's other callers (tool-search,
+  program-count) and for labels / ambiguous short-id prefixes, which still wait for every
+  peer. Source:
+  `apps/cli/src/lib/remote-agents-json.ts`, `apps/cli/src/lib/session/remote-list.ts`,
+  `apps/cli/src/commands/sessions.ts`, `apps/cli/src/commands/resume.ts`.
+
+- **`agents sessions focus` gains device + live-state scoping and multi-select tabs
+  (RUSH-2206).** `focus` now honors `--device/--host <name>` (scope the picker to a
+  device's live sessions) and the same live-state filters `sessions --active` defines
+  (`--orphan`/`--crashed`/`--waiting`/`--idle`/`--working`/`--closed`/`--abandoned`/
+  `--queued`/`--unknown`) — they compose, so `agents sessions focus --orphan --device
+  yosemite-s0` lists only that host's orphans. The interactive picker is now
+  multi-select: check several sessions and each opens as a new tab in the terminal
+  you're in (Ghostty / iTerm / tmux, auto-detected), reusing `resume`'s batch open and
+  flood guard. Per tab, live semantics hold — a tmux session is joined (a second
+  client, no fork), local or remote over SSH; a session with no attach rail resumes a
+  copy in the tab, reported never silently dropped. `focus <id>` direct-jump and
+  `--attach-only` (old `go`) behavior are unchanged. Source:
+  `apps/cli/src/commands/focus.ts`, `apps/cli/src/commands/go.ts`.
+
+- **`agents harness edit` is now wizard-capable, on a shared step engine (RUSH-2219).**
+  Run `agents harness edit <name>` with no flags in a terminal and it walks each field
+  (model, endpoint, auth, version, fallback, description) pre-filled with the harness's
+  current values — where before it was flag-only and errored without one. Both `add`/`fork`
+  and `edit` now drive one shared step engine: every step is skippable by the matching flag,
+  so scripting stays non-interactive and a flagless non-interactive `edit` still errors as
+  before. Endpoint and version prompts are gated by the host's API format (a host with no
+  custom-endpoint slot, or one that self-updates, shows the field disabled with a reason
+  instead of silently accepting a value the run would drop). This is the foundation the
+  model catalog, connection test, edit matrix, and cross-host portability build on.
+  Source: `apps/cli/src/commands/harness-wizard.ts`, `apps/cli/src/commands/harness.ts`.
+
+- **Codex launches now default to safe writable access instead of an offline
+  read-only sandbox.** When no configured run default exists, omitting `--mode`
+  selects a managed workspace profile with network access, on-request approvals,
+  `~/.agents`, and regenerable build caches. Explicit `--mode plan` remains
+  filesystem-read-only but now retains network access. The same policy covers
+  `agents run`, fallback attempts, resumes, routines, direct `codex` shims,
+  versioned aliases, and Windows shim passthrough; only explicit `skip` disables
+  the sandbox and approvals. Source: `apps/cli/src/lib/codex-policy.ts`.
+
+- **Phone forwards are shaped to a text, not a wall.** `agents feed post`
+  (`--level important` / `--blocked`), `agents notify`, and `agents send --to owner`
+  all forward to the owner's phone through one seam, `composeBroadcastMessage`; it now
+  keeps the post **title** (the scannable headline) and truncates a long **body** to a
+  short excerpt marked `… (full in feed)` (caps: 500 chars / 8 lines). The full post is
+  untouched in the feed — only the outbound phone copy is shortened — so a requested
+  long write is not lost, and enforcing it at this seam covers every sink (owner alias,
+  in-process `channel:`, spawned `command:` via `{message}`), which a per-command shell
+  hook cannot. Source: `apps/cli/src/lib/feed-broadcast.ts` (`truncateBroadcastBody`).
+
+- **`agents run --lease` self-cleans its warm pool.** Each lease now auto-stops **expired, idle** boxes in the run's profile pool (an expired box can never be reused, so it was pure cost the 1h-idle `agents lease gc` window left running). Conservative: only a box that is running, in the same profile+netMode pool, past its lease expiry, and untouched for a grace window is stopped — a mid-boot or in-use box is never touched. Skipped when an explicit `--box <slug>` is named. Source: `apps/cli/src/lib/crabbox/lease.ts`.
+
+- **Muse Code (Meta) harness support.** `muse` is a first-class agent: install via
+  `curl -fsSL https://dev.meta.ai/install.sh | sh`, run with `agents run muse`,
+  and use in teams. Modes map to Muse safety flags (`--disable-write` /
+  `--disable-approval` / `--yolo`); `--model` and `--reasoning-effort` are
+  forwarded; headless is `muse exec` with `--json`; interactive resume is
+  `muse resume <id>` (id immediately after the verb), headless resume is
+  `--session-id`. Sessions under `~/.local/share/muse/sessions/` (plus version
+  homes) are discovered and parsed; usage shows Meta Model API rate limits when
+  a key is present, otherwise local 7-day token totals. MCP writes to
+  `~/.config/muse/settings.json` (`mcp_servers`, `schema_version: 1`). Model
+  catalog: `muse-spark-1.2` (default), `1.1`, `1.2-contributor` with offline
+  pricing. Aliases: `muse-code`, `meta-muse`. Hooks write Claude-shaped
+  matcher groups into `~/.config/muse/settings.json` (`schema_version: 1`);
+  plugins use the Claude marketplace layout under the XDG data plugin store
+  (`~/.local/share/muse/plugins`) with `.muse-plugin` manifests. Allowlist
+  stays false (Muse uses approval-mode + sandbox, not tool-name allow/deny).
+  Source: `apps/cli/src/lib/{agents,exec,models,usage,mcp,hooks,plugins,
+  plugin-marketplace,runner,shims}.ts`, `apps/cli/src/lib/session/*`.
+
+- **Release CI no longer re-runs the six-job cross-platform matrix on `v*` tags.**
+  The expensive `ci.yml` matrix (ubuntu + macOS + Windows × Node 22/24) still
+  runs on `release/**` branch pushes and manual `workflow_dispatch`, but not when
+  a version tag is pushed. `release.sh` tags the exact commit that already passed
+  the release-branch matrix, so the post-tag matrix was pure cost. Source:
+  `.github/workflows/ci.yml`.
+
+- **`claude-opus-5` and `claude-sonnet-5` were unpriced, so every session using them
+  cost $0.** The pricing table carried `claude-opus-4`, `claude-sonnet-4`,
+  `claude-fable-5` and `claude-mythos-5` but not the Opus/Sonnet 5 line. Matching is
+  dash-bounded (`getModelPricing`), so `claude-opus-5` cannot fall back to the
+  `claude-opus-4` entry — it resolved to null, and an unpriced model contributes
+  nothing rather than erroring. On one real index that silently zeroed **526 sessions**,
+  478 of them the current default model, understating `agents cost`, `agents output`
+  and `agents insights` alike. Rates from the published table: Opus 5 $5/$25 per MTok
+  (cache write $6.25, cache read $0.50); Sonnet 5 $2/$10 (cache write $2.50, cache read
+  $0.20). Source: `apps/cli/src/lib/pricing/prices.json`.
+
+- **Schema v34 reprices the sessions that were zeroed.** Adding prices alone fixes
+  nothing already indexed: `cost_usd` is computed at scan time and the scanner skips any
+  transcript whose `(file_mtime_ms, file_size)` is unchanged, so those rows would keep
+  their NULL forever. They cannot be repaired in place either — the row stores
+  `token_count` and `output_tokens` but not the uncached-input / cache-read / cache-write
+  split the price table needs. So v34 flushes `scan_ledger`, the same remedy v5 → v6 used
+  for this exact column when cost was introduced. One slower scan, then correct numbers.
+  Source: `apps/cli/src/lib/session/db.ts`.
+
+  **Sonnet 5's $2/$10 is introductory pricing that ends 2026-08-31.** From 2026-09-01 the
+  standard rate is $3/$15. The table holds one current rate per model with no notion of an
+  effective date, so that entry must be updated then or Sonnet 5 spend reads ~33% low.
+  Called out at the top of `table.ts`.
+
+- **`agents sessions --orphan`/`--active`: cross-harness live discovery + richer rows (RUSH-2205).**
+  Two fixes. (1) The headless `ps`-scan recognized only 6 agent executables, so a
+  bare-headless `grok`/`kimi`/`antigravity`/`openclaw`/`hermes`/`rush` run was
+  silently dropped from the live views; the comm→kind map is now derived from
+  `SESSION_AGENTS` × the AGENTS registry (`cliCommand`), so every discoverable
+  harness surfaces. (2) Each live row now shows the agent **version** and a human
+  **created · idle** time cell, and backfills the **ticket/PR/label** from the
+  indexed session history onto orphan rows that lack them, with the label/topic on
+  its own line — grouped-by-directory layout unchanged, rows stay width-safe.
+  Source: `apps/cli/src/lib/session/active.ts`, `apps/cli/src/commands/sessions.ts`.
+
+- **`agents doctor --check` verdict lines now carry a `check:` prefix and a total
+  version count**, so CI logs and log-scrapers get one consistent, grep-alike shape
+  whether the result is clean or drifted: `check: ok — 3 version(s) in sync` /
+  `check: drift — 2 stale, 1 never-synced across 3 version(s)`. The per-version
+  status badge for a never-synced version now reads `never-synced` (its real
+  status) instead of the unrelated `cold` label, and all three badges
+  (`stale`/`never-synced`/`unwired`) share one fixed-width column so the rows
+  align. Source: `apps/cli/src/commands/doctor.ts` (`runCheckGate`).
+
+- **`agents secrets export --host --remote-backend file` no longer requires
+  `AGENTS_SECRETS_PASSPHRASE`.** Since the file store became passphrase-free
+  (auto-provisioning a 0600 machine-local key under `~/.agents/.secrets-key/`), the
+  remote `import --backend file` reads headlessly under that key with no passphrase
+  and no Touch ID — but the export path still hard-failed unless a passphrase was
+  set, and forcing one made the remote bundle require that shared passphrase to
+  read, defeating the headless use it was for. The passphrase is now **optional**:
+  with none set, the remote command carries no `AGENTS_SECRETS_PASSPHRASE`
+  read/export prologue and the .env is the only stdin, so the remote keys the bundle
+  under its own machine-local key (headless reads); set `AGENTS_SECRETS_PASSPHRASE`
+  locally only to opt into a shared off-disk key, which is still forwarded over ssh
+  stdin (never argv). This unblocks hands-off Linux-driven releases that provision
+  `apple.com` on a headless macOS sign host. Windows targets are still refused
+  cleanly. Source: `apps/cli/src/lib/secrets/remote.ts`,
+  `apps/cli/src/commands/secrets.ts`.
+
+- **Docs: the per-command secrets Touch-ID contract is now written down and
+  accurate.** The `view --reveal` (1.22.14) and `exec` (1.22.21) interactive-unlock
+  changes shipped in code + CHANGELOG only; the reference docs still implied every
+  value command behaves the same. `docs/secrets.md` and the `secrets` skill now
+  carry an explicit Touch-ID matrix (deliberate `view --reveal`/`exec` at a real
+  terminal → one sheet on a locked bundle; `get`/`export` automation primitives →
+  never prompt, fail closed to `agents secrets unlock`; anything an agent launches →
+  broker-only), `specifications.md` adds **SEC-13b** + a `Prompts?` column on the
+  materialization table + `GWT-S2b`, and the skill's stale hold-window facts are
+  corrected (7-day default, screen-lock does not drop the hold). Docs-only; no
+  behavior change. Source: `apps/cli/docs/secrets.md`,
+  `apps/cli/docs/specifications.md`, `skills/secrets/SKILL.md`.
+
+- **Resume session identities through one live-first path across the fleet.**
+  `agents sessions resume <selector>` accepts a full UUID, unique UUID prefix,
+  durable tmux name (`ag-codex-c1f3d813`), or unique alias suffix (`c1f3d813`). It
+  resolves the owning device, rechecks whether the process and pane are alive,
+  attaches a live pane, and otherwise resumes the harness-native conversation with
+  its recorded version, cwd, and mode. Retained dead tmux panes no longer count as
+  attachable, and native resume no longer collides with an existing live wrapper.
+  Source: `apps/cli/src/commands/focus.ts`,
+  `apps/cli/src/commands/sessions-resume.ts`, `apps/cli/src/lib/exec.ts`.
+
+- **`agents fork` is now `agents sessions fork`.** Forking is a session operation, so
+  it lives under the `sessions` group next to `resume`/`focus` — `agents sessions fork
+  <id>` branches a conversation into a new, independent copy you can continue separately,
+  leaving the original untouched. The old top-level `agents fork` keeps working as a
+  hidden alias, so nothing that scripted it breaks. For a harness without a native copy
+  (anything but Claude today), the command now fails loud and names the manual branch —
+  start a fresh agent and seed it with `/continue <id>` — instead of only saying
+  "unsupported". Source: `apps/cli/src/commands/fork.ts`,
+  `apps/cli/src/commands/sessions.ts`.
+
+- **Muse Code global binary is visible to `agents view` / `isVersionInstalled`.**
+  Muse installs a single self-updating launcher at `~/.local/bin/muse` (same
+  shape as droid), but `getBinaryPath` still resolved a version-home
+  `node_modules/.bin/muse` that never exists. After `agents import muse` /
+  `agents add muse`, version dirs now resolve to that global path so managed
+  view, collapse, and live-version bookkeeping match what actually executes;
+  install no longer writes a self-referential shim symlink. Source:
+  `apps/cli/src/lib/versions.ts`.
+
+## 1.22.22
+
+- **New: `agents insights` — how you work, split by the Claude account that did the
+  work.** Tool and language mix, friction (interruptions, tool-error classes, your own
+  reply latency), what you changed (line deltas, files, commits), an hour-of-day
+  rhythm, and how often two accounts ran at once. Modelled on Claude Code's
+  `/insights`, with the difference that motivated it: that command reads one account's
+  directory, while `balanced` rotation sprays sessions across every signed-in account,
+  so it describes a fraction of the work and credits all of it to one org. Source:
+  `apps/cli/src/commands/insights.ts`, `apps/cli/src/lib/session/insights.ts`.
+
+  Deterministic and offline by default. `--narrative` is opt-in and adds a written read
+  by piping the *aggregate* — never raw transcripts, unlike `/insights` — through a
+  headless `claude -p`. Facets are cached per session in a new `session_insights` table
+  keyed on `(file_mtime_ms, file_size)`, so the first run parses every transcript once
+  and later runs re-read only what changed.
+
+- **The Claude parser can surface interruption markers on request.** `[Request
+  interrupted` text was dropped outright, so the signal was unrecoverable downstream.
+  `parseSession(..., { includeInterrupts: true })` now emits a dedicated `interrupt`
+  event. It stays OFF by default because the event array is a versioned consumer
+  contract: `agents sessions <id> --json` serializes it verbatim, `computeSummaryStats`
+  folds every timestamp into the session duration, and the live-state reader inspects a
+  fixed window of trailing events. `agents insights` is the only caller that opts in.
+  Source: `apps/cli/src/lib/session/parse.ts`.
+
+- **`digest.ts` now classifies droid's `Create` as a file write.** Its tool-vocabulary
+  set claimed cross-harness coverage but omitted it, so droid file creations classified
+  as nothing. Source: `apps/cli/src/lib/session/digest.ts`.
+
+- **Codex usage bars no longer show a previous account's numbers after you switch accounts.** `agents view` derives a Codex version's usage from that home's session transcripts, which carry no account identity and are not removed on logout — so after logging a version out and into a different ChatGPT account, the bar kept showing the old account's last-seen percentage (e.g. "S: 99%") until the new account ran a session. Usage is now scoped to the current login: only sessions written at/after the id_token's `auth_time` (the OIDC authentication time) count, and a signed-out home reports no usage. `auth_time` is used rather than the auth.json file mtime because Codex rewrites auth.json on every token refresh, but a refresh does not re-authenticate, so `auth_time` stays at the real login — an actively-refreshing account keeps its bar, only a real re-login or account switch moves the floor. Source: `apps/cli/src/lib/usage.ts`.
+
+- **The interactive session picker's detailed preview no longer collapses to empty.**
+  `agents sessions`, `agents sessions <query>`, and `agents sessions --active` open the
+  picker with the rich preview pane (prompt, files, hooks, errors, tests, last response)
+  on by default, but the preview had no guaranteed height: a 15-row list
+  (`PICKER_RECENT_COUNT`) on a short terminal consumed the whole viewport, the computed
+  `availablePreviewRows` went to zero, and the pane silently vanished — worse when
+  fleet-unreachable warnings and the hidden-session footer had scrolled lines above the
+  prompt. The picker now caps the visible list page so the preview keeps a floor of
+  `PREVIEW_MIN_ROWS` (6) rows, and accounts for the lines printed above the prompt so
+  those notices and the preview stay on screen together. Applied consistently across
+  `itemPicker`, `dynamicPicker`, and `multiItemPicker`, so the bare browser, the query
+  picker, and the `--active` browser all behave the same; the space/tab preview toggle
+  is unchanged. Source: `apps/cli/src/lib/picker.ts`,
+  `apps/cli/src/commands/sessions-picker.ts`, `apps/cli/src/commands/sessions.ts`.
+
 ## 1.22.21
 
 - **`agents secrets exec <bundle> -- <cmd>` now resolves a locked keychain bundle

package/README.md

@@ -32,6 +32,8 @@
       
   <a href="https://factory.ai" title="Factory AI Droid"><strong>Droid</strong></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://dev.meta.ai/docs/muse-code" title="Meta Muse Code"><strong>Muse</strong></a>
+  &nbsp;&nbsp;&nbsp;&nbsp;
   <a href="https://omp.sh" title="Oh My Pi"><strong>Pi</strong></a>
 </p>
 
@@ -218,7 +220,11 @@ otherwise the first permission option offered by the server. The same last-resor
 warning applies.
 
 Codex has no native smart-classifier mode, so `agents run codex --mode auto` resolves
-to sandboxed `edit` and can still prompt. `agents run codex --mode skip` is different:
+to sandboxed `edit` and can still prompt. When `--mode` is omitted for Codex, the same
+safe writable mode is used: the workspace, `~/.agents`, and regenerable toolchain caches
+are writable; network access is enabled; and approvals are requested on demand. An
+explicit `--mode plan` keeps the filesystem read-only while leaving network access on.
+`agents run codex --mode skip` is different:
 it bypasses approvals **and** removes the sandbox. `full` remains an alias for `skip`,
 but new scripts should use the explicit `skip` name.
 
@@ -684,7 +690,7 @@ tools:
 ---
 ```
 
-Workflows that need to write — post PR comments, edit files, send Slack — should run with `--mode edit`, or `--mode auto` on Claude Code and GitHub Copilot. Reserve `--mode skip` (legacy alias: `full`) for last-resort bypasses. `agents run` defaults to `--mode plan` (read-only), which deadlocks at `ExitPlanMode` in headless runs.
+Workflows that need to write — post PR comments, edit files, send Slack — should run with `--mode edit`, or `--mode auto` on Claude Code and GitHub Copilot. Reserve `--mode skip` (legacy alias: `full`) for last-resort bypasses. `agents run` defaults to `--mode plan` for other harnesses; Codex defaults to its safe writable profile. An explicit Codex `--mode plan` is read-only with network access.
 
 Resolution is project > user > system: a `<repo>/.agents/workflows/<name>/` overrides a same-named workflow in `~/.agents/workflows/`. Commit project workflows with your repo so teammates get the same pipeline.
 

package/dist/commands/doctor.js

@@ -1022,10 +1022,13 @@ function runCheckGate(opts, cwd) {
         const orphanNote = drift.orphanVersionCount > 0
             ? chalk.gray(` (${drift.orphanVersionCount} version(s) carry orphans — run \`agents prune cleanup\`)`)
             : '';
-        console.log(`${chalk.green('ok')}  ${drift.syncRows.length} version(s) in sync${orphanNote}`);
+        console.log(`${chalk.gray('check:')} ${chalk.green('ok')} — ${drift.syncRows.length} version(s) in sync${orphanNote}`);
         process.exit(0);
     }
-    // Drift: one-line verdict always, per-version detail unless --quiet.
+    // Drift: one-line verdict always, per-version detail unless --quiet. The
+    // `check:` prefix and total count make every verdict line grep/parse-alike
+    // whether it's clean or drifted, instead of the bare `drift  <parts>` shape
+    // that gave CI logs no anchor to search on.
     const parts = [];
     if (drift.staleCount > 0)
         parts.push(`${drift.staleCount} stale`);
@@ -1035,16 +1038,21 @@ function runCheckGate(opts, cwd) {
         parts.push(`${drift.unwiredHookVersions} with unwired hooks`);
     if (drift.sourceBehind.length > 0)
         parts.push(`${drift.sourceBehind.length} source layer(s) behind origin`);
-    console.error(`${chalk.red('drift')}  ${parts.join(', ')}`);
+    console.error(`${chalk.gray('check:')} ${chalk.red('drift')} — ${parts.join(', ')} across ${drift.syncRows.length} version(s)`);
     if (!opts.quiet) {
+        // Fixed-width, left-aligned so rows form a real column; the badge text is
+        // the actual status name ('never-synced'), not the unrelated 'cold' label
+        // that used to hide it. Width is 'never-synced'.length + a 2-space gap so
+        // the longest badge still separates cleanly from the label that follows.
+        const STATUS_BADGE_WIDTH = 'never-synced'.length + 2;
         for (const row of drift.syncRows) {
             const unwired = (row.unwiredHooks ?? 0) > 0;
             if (row.status === 'fresh' && !unwired)
                 continue;
-            const tag = row.status === 'stale' ? chalk.yellow('stale')
-                : row.status === 'never-synced' ? chalk.gray('cold ')
-                    : chalk.red('unwired'); // fresh but hooks not wired into settings.json
-            console.error(`  ${tag}  ${checkLabel(row)}`);
+            const tag = row.status === 'stale' ? chalk.yellow('stale'.padEnd(STATUS_BADGE_WIDTH))
+                : row.status === 'never-synced' ? chalk.gray('never-synced'.padEnd(STATUS_BADGE_WIDTH))
+                    : chalk.red('unwired'.padEnd(STATUS_BADGE_WIDTH)); // fresh but hooks not wired into settings.json
+            console.error(`  ${tag}${checkLabel(row)}`);
             for (const line of row.divergence ?? []) {
                 console.error(chalk.gray(`           ${line}`));
             }

package/dist/commands/exec.js

@@ -516,7 +516,7 @@ export function registerRunCommand(program) {
     const runCmd = program
         .command('run <agent> [prompt]')
         .description('Execute an agent. Pass a prompt for headless runs; omit it to launch the agent interactively.')
-        .option('-m, --mode <mode>', 'How much the agent can do: plan (read-only), edit (can write files), auto (smart classifier auto-approves safe ops, prompts for risky), skip (bypass all permission prompts). \'full\' accepted as alias for skip.', 'plan')
+        .option('-m, --mode <mode>', 'How much the agent can do: plan (read-only), edit (can write files), auto (smart classifier auto-approves safe ops, prompts for risky), skip (bypass all permission prompts). Omitted Codex mode defaults to safe writable edit; other harnesses default to plan. \'full\' accepted as alias for skip.', 'plan')
         .option('-e, --effort <effort>', 'Reasoning effort: low | medium | high | xhigh | max | auto (claude and codex only)', 'auto')
         .option('--model <model>', 'Cost tier (cheap|default|best|ultra) or a concrete model id; tiers resolve per harness+version to a supported model')
         .option('--env <key=value>', 'Pass environment variable to the agent (repeatable, e.g., --env DEBUG=1 --env API_KEY=xyz)', (val, prev) => [...prev, val], [])
@@ -882,8 +882,10 @@ export function registerRunCommand(program) {
             // the normal new-run default as a real value, so consult its provenance
             // rather than mistaking the default for an explicit override.
             if (command.getOptionValueSource('mode') === 'default') {
-                if (resolvedResumeSource.mode)
+                if (resolvedResumeSource.mode) {
                     options.mode = resolvedResumeSource.mode;
+                    command.setOptionValueWithSource('mode', resolvedResumeSource.mode, 'implied');
+                }
                 else if (!options.quiet)
                     process.stderr.write(chalk.yellow(`[agents] session ${resolvedResumeSource.shortId} predates stored launch modes; using --mode ${options.mode}\n`));
             }
@@ -1540,13 +1542,15 @@ export function registerRunCommand(program) {
                         });
                     }
                     const isRaw = options.raw || options.tmux === false || options.disableTmux === true;
+                    const { modeForRemoteDispatch } = await import('../lib/codex-policy.js');
+                    const forwardedMode = modeForRemoteDispatch(options.mode, command.getOptionValueSource('mode'));
                     const exitCode = await runInteractiveOnHost(host, {
                         agent: runAgent,
                         version: resumeId ? undefined : runVersion,
                         strategy: resumeId ? undefined : runStrategy,
                         fallback: options.fallback,
                         prompt,
-                        mode: options.mode,
+                        mode: forwardedMode,
                         model: options.model,
                         effort: options.effort,
                         env: hostEnv,
@@ -1625,13 +1629,15 @@ export function registerRunCommand(program) {
                 }
                 // Session-id mint, detached dispatch, and local session-index
                 // registration all live in the shared helper (lib/hosts/run-target.ts).
+                const { modeForRemoteDispatch } = await import('../lib/codex-policy.js');
+                const forwardedMode = modeForRemoteDispatch(options.mode, command.getOptionValueSource('mode'));
                 const { task, exitCode } = await dispatchPromptToHost(host, {
                     agent: runAgent,
                     version: resumeId ? undefined : runVersion,
                     strategy: resumeId ? undefined : runStrategy,
                     fallback: options.fallback,
                     prompt,
-                    mode: options.mode,
+                    mode: forwardedMode,
                     model: options.model,
                     effort: options.effort,
                     env: options.env,
@@ -1770,7 +1776,7 @@ export function registerRunCommand(program) {
                 await warnUnpushedWork(resumeExec.cwd ?? process.cwd());
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
@@ -2407,7 +2413,14 @@ export function registerRunCommand(program) {
         // `skip` still hard-fails when unsupported — pretending we bypassed
         // permissions would be unsafe.
         const modeIsDefault = modeSource === 'default';
-        const requestedMode = normalizeMode(mode);
+        let requestedMode = normalizeMode(mode);
+        // Codex's intrinsic omitted-mode default is safe writable: workspace plus
+        // common caches, network enabled, approvals on request. An explicit
+        // --mode plan and a configured run default remain read-only.
+        const { modeWasImplicit } = await import('../lib/codex-policy.js');
+        const wasModeImplicit = modeWasImplicit(modeSource, modeFromRunDefault);
+        if (wasModeImplicit)
+            requestedMode = implicitModeFor(agent);
         let resolvedMode;
         try {
             resolvedMode = resolveMode(agent, requestedMode);
@@ -2531,6 +2544,7 @@ export function registerRunCommand(program) {
             prompt,
             interactive: options.interactive || forceInteractive,
             mode: requestedMode,
+            modeWasImplicit: wasModeImplicit,
             effort,
             cwd: options.cwd,
             model,

package/dist/commands/focus.d.ts

@@ -16,6 +16,29 @@ import type { Command } from 'commander';
 import { type UnreachableFallback } from './go.js';
 import type { ActiveSession } from '../lib/session/active.js';
 import type { SessionMeta } from '../lib/session/types.js';
+import { type LiveStatusFilter } from './sessions.js';
+import { openSurfaces, type Backend } from '../lib/terminal/index.js';
+/** Options for `sessions focus` — device/host scope + the `--active` live-state filters. */
+export interface FocusOptions {
+    local?: boolean;
+    attachOnly?: boolean;
+    host?: string[];
+    device?: string[];
+    working?: boolean;
+    idle?: boolean;
+    waiting?: boolean;
+    orphan?: boolean;
+    orphaned?: boolean;
+    crashed?: boolean;
+    closed?: boolean;
+    abandoned?: boolean;
+    queued?: boolean;
+    unknown?: boolean;
+}
+/** `--device` is an alias of `--host`; both are repeatable. Merge into one host list. */
+export declare function mergeFocusHosts(opts: FocusOptions): string[];
+/** Picker header that reflects the active filter + device, e.g. "Focus orphaned sessions on yosemite-s0:". */
+export declare function focusHeader(statuses: LiveStatusFilter[], hosts: string[]): string;
 export declare function registerFocusCommand(program: Command): void;
 /**
  * Which fallback fires when a session has no attach rail. `--attach-only` (the old
@@ -23,9 +46,58 @@ export declare function registerFocusCommand(program: Command): void;
  * without touching `jumpTo`'s side effects.
  */
 export declare function selectFallback(attachOnly: boolean | undefined): UnreachableFallback;
-export declare function focusAction(id: string | undefined, opts: {
-    local?: boolean;
-    attachOnly?: boolean;
-}): Promise<void>;
+export declare function focusAction(id: string | undefined, opts: FocusOptions): Promise<void>;
+/** A retained pane is not attachable merely because tmux can still display it. */
+export declare function isAttachableLiveSession(session: ActiveSession): boolean;
+/**
+ * How a single selected live session opens in its new tab.
+ *  - `attach` — a live tmux pane joined in the tab (a second client, no fork),
+ *    local (`sh -c`) or remote (`ssh -tt`). tmux is the only rail that can be
+ *    *joined* without forking (see the file header).
+ *  - `resume` — no attach rail, so resume a copy in the tab (the original keeps
+ *    running); never a silent drop.
+ *  - `skip` — not resumable AND no rail: reported, not dropped.
+ */
+export type FocusSurfacePlan = {
+    kind: 'attach';
+    command: string[];
+    note: string;
+} | {
+    kind: 'resume';
+    command: string[];
+    note: string;
+} | {
+    kind: 'skip';
+    note: string;
+};
+/**
+ * Shell that resolves a tmux pane to its session and attaches it — the exact form
+ * `jumpTo` uses, minus the pre-select-window nicety, so a batch tab joins the live
+ * session (a second client) without forking. Reused for local and (wrapped in ssh)
+ * remote panes.
+ */
+export declare function tmuxAttachScript(mux: {
+    socket?: string;
+    pane: string;
+}): string;
+/**
+ * Decide how one live session opens as a tab. Pure over the session + a
+ * `resumeCommandFor` resolver (injected so the local version-pinned resume command
+ * and the tests stay decoupled from `discoverSessions`).
+ */
+export declare function planFocusSurface(s: ActiveSession, self: string, resumeCommandFor: (s: ActiveSession) => string[] | null): FocusSurfacePlan;
+/** The engine seam — real `openSurfaces`, overridable in tests to assert the tab requests. */
+export type OpenSurfacesFn = typeof openSurfaces;
+/** Test seams for `openFocusTabs`: inject the engine boundary + force a backend. */
+export interface OpenFocusTabsDeps {
+    open?: OpenSurfacesFn;
+    /** Skip `resolveBackend` (which needs a live terminal) when set — tests pass 'tmux'. */
+    backend?: Backend | 'inplace';
+}
+/**
+ * Open each selected live session as a tab: attach its live pane where one exists,
+ * else resume a copy. Reuses `resume`'s backend resolution + flood guard.
+ */
+export declare function openFocusTabs(targets: ActiveSession[], self: string, deps?: OpenFocusTabsDeps): Promise<void>;
 /** Minimal SessionMeta for a live session, enough for `buildResumeCommand` + placement. */
 export declare function metaFromActive(s: ActiveSession): SessionMeta;