@phnx-labs/agents-cli 1.22.22 → 1.22.23

package/dist/lib/pricing/prices.json

@@ -1,153 +1,180 @@
 {
-    "version": "2026-08-03",
+    "version": "2026-08-05",
     "models": {
         "claude-opus-4": {
+            "inputPerToken": 5e-06,
+            "outputPerToken": 2.5e-05,
+            "cacheReadPerToken": 5e-07,
+            "cacheWritePerToken": 6.25e-06
+        },
+        "claude-sonnet-4": {
+            "inputPerToken": 3e-06,
+            "outputPerToken": 1.5e-05,
+            "cacheReadPerToken": 3e-07,
+            "cacheWritePerToken": 3.75e-06
+        },
+        "claude-haiku-4": {
+            "inputPerToken": 1e-06,
+            "outputPerToken": 5e-06,
+            "cacheReadPerToken": 1e-07,
+            "cacheWritePerToken": 1.25e-06
+        },
+        "claude-opus-5": {
             "inputPerToken": 0.000005,
             "outputPerToken": 0.000025,
             "cacheReadPerToken": 0.0000005,
             "cacheWritePerToken": 0.00000625
         },
-        "claude-sonnet-4": {
-            "inputPerToken": 0.000003,
-            "outputPerToken": 0.000015,
-            "cacheReadPerToken": 0.0000003,
-            "cacheWritePerToken": 0.00000375
-        },
-        "claude-haiku-4": {
-            "inputPerToken": 0.000001,
-            "outputPerToken": 0.000005,
-            "cacheReadPerToken": 0.0000001,
-            "cacheWritePerToken": 0.00000125
+        "claude-sonnet-5": {
+            "inputPerToken": 0.000002,
+            "outputPerToken": 0.00001,
+            "cacheReadPerToken": 0.0000002,
+            "cacheWritePerToken": 0.0000025
         },
         "claude-fable-5": {
-            "inputPerToken": 0.00001,
-            "outputPerToken": 0.00005,
-            "cacheReadPerToken": 0.000001,
-            "cacheWritePerToken": 0.0000125
+            "inputPerToken": 1e-05,
+            "outputPerToken": 5e-05,
+            "cacheReadPerToken": 1e-06,
+            "cacheWritePerToken": 1.25e-05
         },
         "claude-mythos-5": {
-            "inputPerToken": 0.00001,
-            "outputPerToken": 0.00005,
-            "cacheReadPerToken": 0.000001,
-            "cacheWritePerToken": 0.0000125
+            "inputPerToken": 1e-05,
+            "outputPerToken": 5e-05,
+            "cacheReadPerToken": 1e-06,
+            "cacheWritePerToken": 1.25e-05
         },
         "claude-3-5-sonnet": {
-            "inputPerToken": 0.000003,
-            "outputPerToken": 0.000015,
-            "cacheReadPerToken": 0.0000003,
-            "cacheWritePerToken": 0.00000375
+            "inputPerToken": 3e-06,
+            "outputPerToken": 1.5e-05,
+            "cacheReadPerToken": 3e-07,
+            "cacheWritePerToken": 3.75e-06
         },
         "claude-3-5-haiku": {
-            "inputPerToken": 0.0000008,
-            "outputPerToken": 0.000004,
-            "cacheReadPerToken": 0.00000008,
-            "cacheWritePerToken": 0.000001
+            "inputPerToken": 8e-07,
+            "outputPerToken": 4e-06,
+            "cacheReadPerToken": 8e-08,
+            "cacheWritePerToken": 1e-06
         },
         "claude-3-opus": {
-            "inputPerToken": 0.000015,
-            "outputPerToken": 0.000075,
-            "cacheReadPerToken": 0.0000015,
-            "cacheWritePerToken": 0.00001875
+            "inputPerToken": 1.5e-05,
+            "outputPerToken": 7.5e-05,
+            "cacheReadPerToken": 1.5e-06,
+            "cacheWritePerToken": 1.875e-05
         },
         "gpt-5.6-sol": {
-            "inputPerToken": 0.000005,
-            "outputPerToken": 0.00003,
-            "cacheReadPerToken": 0.0000005
+            "inputPerToken": 5e-06,
+            "outputPerToken": 3e-05,
+            "cacheReadPerToken": 5e-07
         },
         "gpt-5.6-terra": {
-            "inputPerToken": 0.0000025,
-            "outputPerToken": 0.000015,
-            "cacheReadPerToken": 0.00000025
+            "inputPerToken": 2.5e-06,
+            "outputPerToken": 1.5e-05,
+            "cacheReadPerToken": 2.5e-07
         },
         "gpt-5.6-luna": {
-            "inputPerToken": 0.000001,
-            "outputPerToken": 0.000006,
-            "cacheReadPerToken": 0.0000001
+            "inputPerToken": 1e-06,
+            "outputPerToken": 6e-06,
+            "cacheReadPerToken": 1e-07
         },
         "gpt-5.5": {
-            "inputPerToken": 0.000005,
-            "outputPerToken": 0.00003,
-            "cacheReadPerToken": 0.0000005
+            "inputPerToken": 5e-06,
+            "outputPerToken": 3e-05,
+            "cacheReadPerToken": 5e-07
         },
         "gpt-5.4": {
-            "inputPerToken": 0.0000025,
-            "outputPerToken": 0.000015,
-            "cacheReadPerToken": 0.00000025
+            "inputPerToken": 2.5e-06,
+            "outputPerToken": 1.5e-05,
+            "cacheReadPerToken": 2.5e-07
         },
         "gpt-5.4-mini": {
-            "inputPerToken": 0.00000075,
-            "outputPerToken": 0.0000045,
-            "cacheReadPerToken": 0.000000075
+            "inputPerToken": 7.5e-07,
+            "outputPerToken": 4.5e-06,
+            "cacheReadPerToken": 7.5e-08
         },
         "gpt-5.4-nano": {
-            "inputPerToken": 0.0000002,
-            "outputPerToken": 0.00000125,
-            "cacheReadPerToken": 0.00000002
+            "inputPerToken": 2e-07,
+            "outputPerToken": 1.25e-06,
+            "cacheReadPerToken": 2e-08
         },
         "gpt-5": {
-            "inputPerToken": 0.00000125,
-            "outputPerToken": 0.00001,
-            "cacheReadPerToken": 0.000000125
+            "inputPerToken": 1.25e-06,
+            "outputPerToken": 1e-05,
+            "cacheReadPerToken": 1.25e-07
         },
         "gpt-4.1": {
-            "inputPerToken": 0.000002,
-            "outputPerToken": 0.000008,
-            "cacheReadPerToken": 0.0000005
+            "inputPerToken": 2e-06,
+            "outputPerToken": 8e-06,
+            "cacheReadPerToken": 5e-07
         },
         "gpt-4.1-mini": {
-            "inputPerToken": 0.0000004,
-            "outputPerToken": 0.0000016,
-            "cacheReadPerToken": 0.0000001
+            "inputPerToken": 4e-07,
+            "outputPerToken": 1.6e-06,
+            "cacheReadPerToken": 1e-07
         },
         "gpt-4.1-nano": {
-            "inputPerToken": 0.0000001,
-            "outputPerToken": 0.0000004,
-            "cacheReadPerToken": 0.000000025
+            "inputPerToken": 1e-07,
+            "outputPerToken": 4e-07,
+            "cacheReadPerToken": 2.5e-08
         },
         "gpt-4o": {
-            "inputPerToken": 0.0000025,
-            "outputPerToken": 0.00001,
-            "cacheReadPerToken": 0.00000125
+            "inputPerToken": 2.5e-06,
+            "outputPerToken": 1e-05,
+            "cacheReadPerToken": 1.25e-06
         },
         "gpt-4o-mini": {
-            "inputPerToken": 0.00000015,
-            "outputPerToken": 0.0000006,
-            "cacheReadPerToken": 0.000000075
+            "inputPerToken": 1.5e-07,
+            "outputPerToken": 6e-07,
+            "cacheReadPerToken": 7.5e-08
         },
         "o3": {
-            "inputPerToken": 0.000002,
-            "outputPerToken": 0.000008,
-            "cacheReadPerToken": 0.0000005
+            "inputPerToken": 2e-06,
+            "outputPerToken": 8e-06,
+            "cacheReadPerToken": 5e-07
         },
         "o4-mini": {
-            "inputPerToken": 0.0000011,
-            "outputPerToken": 0.0000044,
-            "cacheReadPerToken": 0.000000275
+            "inputPerToken": 1.1e-06,
+            "outputPerToken": 4.4e-06,
+            "cacheReadPerToken": 2.75e-07
         },
         "gemini-2.5-pro": {
-            "inputPerToken": 0.00000125,
-            "outputPerToken": 0.00001,
-            "cacheReadPerToken": 0.0000003125
+            "inputPerToken": 1.25e-06,
+            "outputPerToken": 1e-05,
+            "cacheReadPerToken": 3.125e-07
         },
         "gemini-2.5-flash": {
-            "inputPerToken": 0.0000003,
-            "outputPerToken": 0.0000025,
-            "cacheReadPerToken": 0.000000075
+            "inputPerToken": 3e-07,
+            "outputPerToken": 2.5e-06,
+            "cacheReadPerToken": 7.5e-08
         },
         "gemini-2.5-flash-lite": {
-            "inputPerToken": 0.0000001,
-            "outputPerToken": 0.0000004,
-            "cacheReadPerToken": 0.000000025
+            "inputPerToken": 1e-07,
+            "outputPerToken": 4e-07,
+            "cacheReadPerToken": 2.5e-08
         },
         "gemini-1.5-pro": {
-            "inputPerToken": 0.00000125,
-            "outputPerToken": 0.000005,
-            "cacheReadPerToken": 0.0000003125
+            "inputPerToken": 1.25e-06,
+            "outputPerToken": 5e-06,
+            "cacheReadPerToken": 3.125e-07
         },
         "gemini-1.5-flash": {
-            "inputPerToken": 0.000000075,
-            "outputPerToken": 0.0000003,
-            "cacheReadPerToken": 0.00000001875
+            "inputPerToken": 7.5e-08,
+            "outputPerToken": 3e-07,
+            "cacheReadPerToken": 1.875e-08
+        },
+        "muse-spark-1.2": {
+            "inputPerToken": 1.25e-06,
+            "outputPerToken": 4.25e-06,
+            "cacheReadPerToken": 1.5e-07
+        },
+        "muse-spark-1.1": {
+            "inputPerToken": 1.25e-06,
+            "outputPerToken": 4.25e-06,
+            "cacheReadPerToken": 1.5e-07
+        },
+        "muse-spark-1.2-contributor": {
+            "inputPerToken": 1e-07,
+            "outputPerToken": 2e-07,
+            "cacheReadPerToken": 2e-09
         }
     }
 }

package/dist/lib/pricing/table.js

@@ -5,6 +5,19 @@
  * and is imported with a `type: json` attribute so it survives `tsc` emit AND
  * Node ESM's import-attribute requirement at runtime (the package is ESM).
  *
+ * ## Keeping it current
+ *
+ * A model missing from `prices.json` prices to NOTHING — `getModelPricing` returns
+ * null and the session contributes $0, silently. That is how 478 `claude-opus-5`
+ * sessions read as free: matching is dash-bounded, so `claude-opus-5` cannot fall back
+ * to the `claude-opus-4` entry. When a new model ships, add it here in the same change.
+ *
+ * **Dated rate: Claude Sonnet 5 is priced at its introductory $2/$10 per MTok, which
+ * ends 2026-08-31.** From 2026-09-01 the standard rate is $3/$15 (cache write $3.75,
+ * cache read $0.30). This table has no notion of an effective date — every row is a
+ * single current rate — so that entry MUST be updated then, or Sonnet 5 spend will
+ * read ~33% low. Source: https://platform.claude.com/docs/en/about-claude/pricing
+ *
  * `getModelPricing` is prefix/suffix-tolerant: real model identifiers carry
  * vendor prefixes (`us.anthropic.`), version dashes (`claude-opus-4-8`), and
  * date suffixes (`-20250514`), none of which appear in the canonical keys. We

package/dist/lib/remote-agents-json.d.ts

@@ -12,6 +12,34 @@ export interface RemoteAgentsJsonOptions<T> {
     quiet?: boolean;
     /** Per-peer deadline. Long-running maintenance commands override 12 seconds. */
     timeoutMs?: number;
+    /**
+     * Opt-in early-exit for a globally-unique lookup (a full session UUID). When a
+     * peer returns an item that satisfies {@link isDefinitive}, the fan-out
+     * resolves immediately and SIGTERMs every still-outstanding peer instead of
+     * waiting for the slowest one to hit {@link REMOTE_TIMEOUT_MS}.
+     *
+     * OMITTED BY DEFAULT — tool-search, program-count, and the default session
+     * listing keep the all-settle behavior (ambiguity, or a label/prefix conflict,
+     * is only known once every peer has answered). Only the full-UUID resolve path
+     * opts in, since only a UUID guarantees the first hit is the only hit.
+     */
+    earlyExit?: {
+        isDefinitive: (item: T, machine: string) => boolean;
+    };
+}
+/**
+ * The SSH boundary as a swappable dependency so the fan-out logic is testable
+ * without a live tailnet. Production wires this to the real {@link sshCapture}.
+ */
+export type SshCaptureFn = (target: string, remoteCmd: string, opts: {
+    timeoutMs: number;
+    signal?: AbortSignal;
+}) => Promise<{
+    code: number | null;
+    stdout: string;
+}>;
+export interface GatherRemoteAgentsJsonDeps {
+    capture?: SshCaptureFn;
 }
 export interface RemoteAgentsJsonParseResult<T> {
     items: T[];
@@ -35,4 +63,4 @@ export declare function parseRemoteAgentsJsonPayload<T>(stdout: string, machine:
 /** Build the command one peer runs, with a guard that prevents recursive fan-out. */
 export declare function remoteAgentsJsonCommand(args: string[], noFanoutEnv: string, os?: string): string;
 /** Query explicit hosts, or every registered online peer when hosts is omitted. */
-export declare function gatherRemoteAgentsJson<T>(options: RemoteAgentsJsonOptions<T>): Promise<RemoteAgentsJsonResult<T>>;
+export declare function gatherRemoteAgentsJson<T>(options: RemoteAgentsJsonOptions<T>, deps?: GatherRemoteAgentsJsonDeps): Promise<RemoteAgentsJsonResult<T>>;

package/dist/lib/remote-agents-json.js

@@ -7,6 +7,7 @@
  * healthy results from the rest of the fleet.
  */
 import { spawn } from 'child_process';
+import { setMaxListeners } from 'node:events';
 import chalk from 'chalk';
 import { SSH_OPTS, controlOpts, assertValidSshTarget, shellQuote } from './ssh-exec.js';
 import { sshTargetFor } from './devices/connect.js';
@@ -32,9 +33,13 @@ export function remoteAgentsJsonCommand(args, noFanoutEnv, os) {
     const inner = `${noFanoutEnv}=1 agents ${args.map(shellQuote).join(' ')}`;
     return `bash -lc ${shellQuote(inner)}`;
 }
-function sshCapture(target, remoteCmd, timeoutMs) {
+const sshCapture = (target, remoteCmd, { timeoutMs, signal }) => {
     assertValidSshTarget(target);
     return new Promise((resolve) => {
+        if (signal?.aborted) {
+            resolve({ code: null, stdout: '' });
+            return;
+        }
         const args = [...SSH_OPTS, ...controlOpts(), target, remoteCmd];
         const child = spawn('ssh', args, { stdio: ['ignore', 'pipe', 'ignore'] });
         let stdout = '';
@@ -44,19 +49,25 @@ function sshCapture(target, remoteCmd, timeoutMs) {
                 return;
             settled = true;
             clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
             resolve({ code, stdout });
         };
         const timer = setTimeout(() => {
             child.kill('SIGKILL');
             done(null);
         }, timeoutMs);
+        // A definitive hit on a fast peer cancels the rest: SIGTERM the child so an
+        // unreachable peer is not left running to its full timeout.
+        const onAbort = () => { child.kill('SIGTERM'); done(null); };
+        signal?.addEventListener('abort', onAbort, { once: true });
         child.stdout.on('data', (data) => { stdout += data.toString(); });
         child.on('error', () => done(null));
         child.on('close', (code) => done(code));
     });
-}
+};
 /** Query explicit hosts, or every registered online peer when hosts is omitted. */
-export async function gatherRemoteAgentsJson(options) {
+export async function gatherRemoteAgentsJson(options, deps = {}) {
+    const capture = deps.capture ?? sshCapture;
     const self = machineId();
     const targets = [];
     if (options.hosts && options.hosts.length > 0) {
@@ -100,24 +111,50 @@ export async function gatherRemoteAgentsJson(options) {
     }
     const skipped = [];
     const parseFailed = [];
+    // The controller exists ONLY for early-exit: the first definitive hit aborts
+    // every still-outstanding peer. When earlyExit is not requested there is no
+    // controller and no per-peer abort listener, so the default path is a plain
+    // all-settle Promise.all, byte-identical to before (tool-search, program-count).
+    const controller = options.earlyExit ? new AbortController() : undefined;
+    // A fleet can hold more peers than Node's default 10-listener cap; each peer's
+    // capture adds one abort listener, so lift the cap to avoid a spurious warning.
+    if (controller)
+        setMaxListeners(targets.length + 1, controller.signal);
+    let earlyResolved = false;
     const results = await Promise.all(targets.map(async (target) => {
         const command = remoteAgentsJsonCommand(options.args, options.noFanoutEnv, target.os);
-        const result = await sshCapture(target.target, command, options.timeoutMs ?? REMOTE_TIMEOUT_MS);
+        const result = await capture(target.target, command, {
+            timeoutMs: options.timeoutMs ?? REMOTE_TIMEOUT_MS,
+            signal: controller?.signal,
+        });
+        // A peer we deliberately cancelled is neither a hit nor a failure — it never
+        // got to answer, so it must not pollute skipped/parseFailed (which drive the
+        // "unreachable" listing and the fail-closed partial-resolution gate).
+        const cancelled = controller?.signal.aborted ?? false;
         if (result.code !== 0) {
-            skipped.push(target.name);
-            if (!options.quiet) {
-                process.stderr.write(chalk.gray(`  ${target.name}: unreachable or no agents CLI — skipped\n`));
+            if (!cancelled) {
+                skipped.push(target.name);
+                if (!options.quiet) {
+                    process.stderr.write(chalk.gray(`  ${target.name}: unreachable or no agents CLI — skipped\n`));
+                }
             }
             return [];
         }
         const parsed = parseRemoteAgentsJsonPayload(result.stdout, target.machine, options.parse);
         if (parsed.parseFailed) {
-            parseFailed.push(target.name);
-            if (!options.quiet) {
-                process.stderr.write(chalk.gray(`  ${target.name}: unreachable or no agents CLI — skipped\n`));
+            if (!cancelled) {
+                parseFailed.push(target.name);
+                if (!options.quiet) {
+                    process.stderr.write(chalk.gray(`  ${target.name}: unreachable or no agents CLI — skipped\n`));
+                }
             }
             return [];
         }
+        if (controller && options.earlyExit && !earlyResolved
+            && parsed.items.some((item) => options.earlyExit.isDefinitive(item, target.machine))) {
+            earlyResolved = true;
+            controller.abort(); // SIGTERM the remaining peers; they settle fast below.
+        }
         return parsed.items;
     }));
     return { items: results.flat(), deviceCount: targets.length, skipped, parseFailed, discoveryFailed: false };

package/dist/lib/resources/mcp.js

@@ -127,6 +127,8 @@ export function getMcpConfigPath(agent, versionHome) {
         case 'pi':
             // omp reads user-scope MCP from ~/.omp/agent/.mcp.json (Claude schema).
             return path.join(versionHome, '.omp', 'agent', '.mcp.json');
+        case 'muse':
+            return path.join(versionHome, '.config', 'muse', 'settings.json');
         default:
             return null;
     }

package/dist/lib/resources/permissions.js

@@ -81,6 +81,9 @@ function getAgentConfigPath(agent, versionHome) {
             return path.join(versionHome, '.hermes', 'config.yaml');
         case 'goose':
             return path.join(versionHome, '.config', 'goose', 'permission.yaml');
+        case 'muse':
+            // Muse approval defaults live in settings.json; no separate permissions file.
+            return path.join(versionHome, '.config', 'muse', 'settings.json');
         default:
             return null;
     }

package/dist/lib/resources/types.d.ts

@@ -5,7 +5,8 @@
  * - Union: All resources from all layers are combined
  * - Override on name conflict: Higher layer wins (project > user > system)
  */
-export type AgentId = 'claude' | 'codex' | 'gemini' | 'cursor' | 'opencode' | 'openclaw' | 'copilot' | 'kiro' | 'goose' | 'antigravity' | 'grok' | 'kimi' | 'droid' | 'hermes' | 'pi';
+import type { AgentId } from '../types.js';
+export type { AgentId };
 /** Resource origin. Precedence (highest first): project > user > plugin > system. */
 export type Layer = 'system' | 'user' | 'project' | 'plugin';
 export type ResourceKind = 'command' | 'hook' | 'skill' | 'rule' | 'mcp' | 'permission' | 'subagent' | 'workflow' | 'memory';

package/dist/lib/runner.js

@@ -22,6 +22,7 @@ import { getRunsDir } from './state.js';
 import { prepareJobHome, buildSpawnEnv, getJobHomePath } from './sandbox.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { createTimer, redactPrompt } from './events.js';
+import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
 import { normalizeMode, resolveHeadlessMode, buildExecEnv, detectRateLimit, detectAuthFailure, isAuthFailureFromLog, authFailureReason, } from './exec.js';
 import { resolveActor } from './actor.js';
 import { loadTask as loadHostTask } from './hosts/tasks.js';
@@ -99,11 +100,12 @@ function terminateRoutineTree(pid) {
 /** CLI command templates per agent, with {prompt} as a placeholder. */
 const AGENT_COMMANDS = {
     claude: ['claude', '-p', '--verbose', '{prompt}', '--output-format', 'stream-json', '--permission-mode', 'plan'],
-    codex: ['codex', 'exec', '--sandbox', 'workspace-write', '{prompt}', '--json'],
+    codex: ['codex', 'exec', '{prompt}', '--json'],
     gemini: ['gemini', '{prompt}', '--output-format', 'stream-json'],
     cursor: ['cursor-agent', '-p', '{prompt}', '--output-format', 'stream-json'],
     kimi: ['kimi', '--prompt', '{prompt}', '--output-format', 'stream-json'],
     droid: ['droid', 'exec', '{prompt}', '-o', 'stream-json'],
+    muse: ['muse', 'exec', '{prompt}', '--json'],
 };
 /** Agents the daemon can actually run, derived from the command table above
  * so the `--agent` help and any validation can never drift from it. */
@@ -137,6 +139,8 @@ const ROUTINE_TRANSCRIPT_SPECS = {
         { root: ['.kimi-code', 'sessions'], ext: '.jsonl' },
     ],
     grok: [{ root: ['.grok', 'sessions'], ext: '.json' }],
+    // Muse: ~/.local/share/muse/sessions/YYYY/MM/DD/<uuid>/session.jsonl
+    muse: [{ root: ['.local', 'share', 'muse', 'sessions'], ext: '.jsonl' }],
 };
 /** Stable working directory for routine children, independent of the daemon's launch cwd. */
 export function routineSpawnCwd(config, configuredRoot = getProjectRoot()) {
@@ -210,24 +214,14 @@ export function buildJobCommand(config, resolvedPrompt) {
         appendModelAndReasoning(cmd, config);
     }
     if (config.agent === 'codex') {
-        if (mode === 'plan') {
-            // The template defaults to workspace-write; plan means read-only.
-            const sbIndex = cmd.indexOf('--sandbox');
-            if (sbIndex !== -1)
-                cmd[sbIndex + 1] = 'read-only';
-        }
-        else if (mode === 'edit' || mode === 'auto') {
-            // Keep the workspace-write sandbox — no approval bypass; only skip drops
-            // the guardrails. Re-enable network, which workspace-write turns off.
-            cmd.push('-c', 'sandbox_workspace_write.network_access=true');
-        }
-        else if (mode === 'skip') {
-            // Remove sandbox restriction, just --dangerously-bypass-approvals-and-sandbox
-            const sbIndex = cmd.indexOf('--sandbox');
-            if (sbIndex !== -1)
-                cmd.splice(sbIndex, 2);
-            cmd.push('--dangerously-bypass-approvals-and-sandbox');
-        }
+        const policyMode = mode === 'plan' || mode === 'skip' ? mode : 'edit';
+        const routineRoots = (config.allow?.dirs ?? []).map((dir) => {
+            if (dir.startsWith('-')) {
+                throw new Error(`allow.dirs entries must not start with '-': ${JSON.stringify(dir)}`);
+            }
+            return dir.replace(/^~/, os.homedir());
+        });
+        cmd.push(...codexPolicyArgs(policyMode, [...codexEditWritableRoots(), ...routineRoots]));
         appendModelAndReasoning(cmd, config);
     }
     if (config.agent === 'gemini') {
@@ -277,6 +271,21 @@ export function buildJobCommand(config, resolvedPrompt) {
         }
         appendModelAndReasoning(cmd, config);
     }
+    if (config.agent === 'muse') {
+        // muse exec: plan ≈ no non-shell writes; auto skips approval prompts but
+        // keeps the OS sandbox; skip is --yolo (no approval, no sandbox, trust).
+        if (mode === 'plan') {
+            cmd.push('--disable-write');
+        }
+        else if (mode === 'auto') {
+            cmd.push('--disable-approval');
+        }
+        else if (mode === 'skip') {
+            cmd.push('--yolo');
+        }
+        // edit: default on-request approval + sandbox
+        appendModelAndReasoning(cmd, config);
+    }
     return cmd;
 }
 /**

package/dist/lib/secrets/Agents CLI.app/Contents/Info.plist

@@ -8,8 +8,6 @@
   <string>Agents CLI</string>
   <key>CFBundleDisplayName</key>
   <string>Agents CLI</string>
-  <key>CFBundleIconFile</key>
-  <string>AppIcon</string>
   <key>CFBundleExecutable</key>
   <string>Agents CLI</string>
   <key>CFBundlePackageType</key>

package/dist/lib/secrets/Agents CLI.app/Contents/_CodeSignature/CodeResources

@@ -3,21 +3,9 @@
 <plist version="1.0">
 <dict>
 	<key>files</key>
-	<dict>
-		<key>Resources/AppIcon.icns</key>
-		<data>
-		DFq5H08EkhgWIC3UvGMR9B58BZw=
-		</data>
-	</dict>
+	<dict/>
 	<key>files2</key>
 	<dict>
-		<key>Resources/AppIcon.icns</key>
-		<dict>
-			<key>hash2</key>
-			<data>
-			mBSjM6jlvN7J1jQowsvqTl7CHM0pur0e6qsHMuzk5k0=
-			</data>
-		</dict>
 		<key>embedded.provisionprofile</key>
 		<dict>
 			<key>hash2</key>

package/dist/lib/secrets/index.d.ts

@@ -22,10 +22,24 @@
  * through the explicit export/import flow in src/lib/secrets/sync.ts
  * rather than the system's cloud-keychain path.
  */
-import { type SpawnSyncOptions } from 'child_process';
+import { type SpawnSyncOptions, type SpawnSyncReturns } from 'child_process';
 import type { NativeImportReport } from './fallback.js';
 export type { NativeImportReport, NativeImportResult, NativeImportStatus } from './fallback.js';
 export declare const SECRETS_ITEM_PREFIX = "agents-cli.secrets.";
+/**
+ * Thrown when a keychain helper / security spawnSync is killed because it
+ * exceeded its timeout. A wedged coreauthd / LocalAuthentication dialog can hang
+ * the parent forever; this makes the failure explicit and arms the read back-off.
+ */
+export declare class KeychainHelperTimeoutError extends Error {
+    readonly bin: string;
+    readonly args: string[];
+    constructor(bin: string, args: string[]);
+}
+/** Test seam: suppress the side-effect daemon boot in unit tests. */
+export declare function setKeychainDaemonBootForTest(enabled: boolean): void;
+/** Test seam: exercise the timeout wrapper with an arbitrary binary. */
+export declare function spawnKeychainHelperForTest(bin: string, args: string[], opts: SpawnSyncOptions, timeoutMs: number): SpawnSyncReturns<Buffer>;
 /** Supported secret resolution backends. */
 export type SecretProvider = 'keychain' | 'env' | 'file' | 'exec';
 /** A typed reference to a secret, consisting of a provider and a provider-specific value. */