@phnx-labs/agents-cli 1.22.22 → 1.22.24

package/dist/lib/doctor-diff.js

@@ -33,7 +33,8 @@ import { shouldInstallCommandAsSkill, commandSkillMatches, commandSkillName } fr
 import { gooseCommandMatches, gooseCommandsDir } from './goose-commands.js';
 import { supports } from './capabilities.js';
 import { listSkillsInVersionHome, getVersionSkillsDir } from './skills.js';
-import { listHooksInVersionHome, listHookEntriesFromDir, checkVersionHookWiring } from './hooks.js';
+import { listHookEntriesFromDir } from './hooks.js';
+import { getResourceInventory } from './resource-inventory.js';
 const RULES_DOC_FILENAME = 'README.md';
 const ALL_KINDS = [
     'commands',
@@ -300,11 +301,10 @@ function diffSkills(agent, version, cwd, excludeProject = false) {
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }
 // ─── hooks ────────────────────────────────────────────────────────────────────
-function diffHooks(agent, version, cwd) {
+function diffHooks(agent, version, cwd, inventory) {
     if (!AGENTS[agent].supportsHooks)
         return [];
-    const installedEntries = listHooksInVersionHome(agent, version);
-    const installedByName = new Map(installedEntries.map((e) => [e.name, e]));
+    const installedByName = new Map(inventory.onDisk.map((e) => [e.name, e]));
     // Sync intentionally excludes project/.agents/hooks/ — mirror that.
     const layerBases = buildLayerBases(cwd, 'hooks', { excludeProject: true });
     // Group source files the same way the hook installer does (basename across
@@ -329,14 +329,14 @@ function diffHooks(agent, version, cwd) {
             continue;
         }
         const a = readSafe(src.entry.scriptPath);
-        const b = readSafe(installed.scriptPath);
+        const b = readSafe(installed.path);
         let matches = a != null && b != null && normalize(a) === normalize(b);
-        if (matches && src.entry.dataFile && installed.dataFile) {
+        if (matches && src.entry.dataFile && installed.detail) {
             const ad = readSafe(src.entry.dataFile);
-            const bd = readSafe(installed.dataFile);
+            const bd = readSafe(installed.detail);
             matches = ad != null && bd != null && normalize(ad) === normalize(bd);
         }
-        else if (matches && (!!src.entry.dataFile !== !!installed.dataFile)) {
+        else if (matches && (!!src.entry.dataFile !== !!installed.detail)) {
             matches = false;
         }
         rows.push({
@@ -345,13 +345,13 @@ function diffHooks(agent, version, cwd) {
             status: matches ? 'ok' : 'diff',
             source: src.layer,
             sourcePath: src.entry.scriptPath,
-            homePath: installed.scriptPath,
+            homePath: installed.path,
         });
     }
     for (const [name, installed] of installedByName) {
         if (seen.has(name))
             continue;
-        rows.push({ kind: 'hooks', name, status: 'extra', homePath: installed.scriptPath });
+        rows.push({ kind: 'hooks', name, status: 'extra', homePath: installed.path });
     }
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }
@@ -609,12 +609,13 @@ export function diffVersionResources(agent, version, options = {}) {
         empty.commands = diffCommands(agent, version, cwd, excludeProject);
     if (requested.has('skills'))
         empty.skills = diffSkills(agent, version, cwd, excludeProject);
-    if (requested.has('hooks'))
-        empty.hooks = diffHooks(agent, version, cwd);
+    const hookInventory = requested.has('hooks') ? getResourceInventory(agent, version, 'hooks', { cwd }) : undefined;
+    if (hookInventory)
+        empty.hooks = diffHooks(agent, version, cwd, hookInventory);
     // Wiring check: a hook FILE can be present and byte-identical to source (ok
     // above) yet never referenced in settings.json, so it never fires. Only
     // meaningful when hooks are in scope.
-    const hookWiring = requested.has('hooks') ? checkVersionHookWiring(agent, version) : undefined;
+    const hookWiring = hookInventory?.wiring;
     if (requested.has('rules'))
         empty.rules = diffRules(agent, version, cwd, excludeProject);
     if (requested.has('mcp'))
@@ -654,6 +655,7 @@ export function diffVersionResources(agent, version, options = {}) {
         kinds: empty,
         summary: { ok, diff, missing, extra },
         ...(hookWiring ? { hookWiring } : {}),
+        ...(hookInventory ? { hookInventory } : {}),
     };
 }
 export const DOCTOR_ALL_KINDS = ALL_KINDS;

package/dist/lib/event-stream.d.ts

@@ -36,6 +36,8 @@ export interface UnifiedQuery {
  * Read a unified, newest-first event stream. Operational events come from
  * events.ts `query()`; agent-semantic events from the activity logs, normalized
  * to the same record shape and filtered identically. `limit` caps the merged
- * result (each source is fetched up to `limit`, so the top-N is exact).
+ * result (each source is fetched up to `limit` *after* its primary filters —
+ * eventTypes for activity, eventTypes/module/bundle for ops — so the top-N is
+ * exact for those filters).
  */
 export declare function readUnifiedEvents(q?: UnifiedQuery): EventRecord[];

package/dist/lib/event-stream.js

@@ -46,7 +46,9 @@ function matches(r, q) {
  * Read a unified, newest-first event stream. Operational events come from
  * events.ts `query()`; agent-semantic events from the activity logs, normalized
  * to the same record shape and filtered identically. `limit` caps the merged
- * result (each source is fetched up to `limit`, so the top-N is exact).
+ * result (each source is fetched up to `limit` *after* its primary filters —
+ * eventTypes for activity, eventTypes/module/bundle for ops — so the top-N is
+ * exact for those filters).
  */
 export function readUnifiedEvents(q = {}) {
     // `bundle` is filtered inside query()'s scan (before its limit cutoff) so a
@@ -66,10 +68,21 @@ export function readUnifiedEvents(q = {}) {
     });
     if (q.includeActivity === false)
         return ops;
+    // Activity events always stamp module: 'activity'. A non-activity module
+    // filter can never match them — skip the activity scan entirely.
+    if (q.module != null && q.module !== 'activity')
+        return ops;
+    // Push eventTypes into the activity reader so `limit` is applied AFTER the
+    // event-type filter (readRecentActivity already does this for `events`).
+    // Without this, a rare match older than the newest-`limit` window of routine
+    // churn is silently dropped — the same class of bug as the ops-side bundle
+    // pre-filter above (RUSH-2093). Remaining filters (agent, sessionId, …) still
+    // run via matches() for fields activity.ts does not pre-filter.
     const acts = readActivityAsEventRecords({
         sinceMs: q.startDate?.getTime(),
         limit: q.limit,
         root: q.activityRoot,
+        events: q.eventTypes,
     }).filter((r) => matches(r, q));
     const merged = [...ops, ...acts].sort((a, b) => Date.parse(b.ts) - Date.parse(a.ts));
     return typeof q.limit === 'number' ? merged.slice(0, q.limit) : merged;

package/dist/lib/exec.d.ts

@@ -86,6 +86,8 @@ export interface ModeWarningState {
  * also maps an unsupported `'plan'` request onto this same value.
  */
 export declare function defaultModeFor(agent: AgentId): Mode;
+/** Safe mode used when the user did not provide --mode or a configured default. */
+export declare function implicitModeFor(agent: AgentId): ExecMode;
 /** Reasoning effort levels passed to agents that support them. 'auto' defers to the agent's default. */
 export type ExecEffort = 'low' | 'medium' | 'high' | 'xhigh' | 'max' | 'auto';
 /** Options for spawning an agent process. Omitting `prompt` launches the CLI interactively. */
@@ -97,6 +99,8 @@ export interface ExecOptions {
     /** Force interactive mode even when a prompt is provided. Wins over `headless`. */
     interactive?: boolean;
     mode: ExecMode;
+    /** True when the caller omitted --mode; fallback agents resolve their own safe default. */
+    modeWasImplicit?: boolean;
     effort: ExecEffort;
     cwd?: string;
     /** Force headless mode even when no prompt is provided (e.g. piping via stdin). */
@@ -385,7 +389,19 @@ export declare function shouldWrapInTmux(ctx: TmuxWrapContext): boolean;
  */
 export declare function buildTmuxAgentCommand(executable: string, args: string[], env: NodeJS.ProcessEnv, opts?: {
     redactEnvValues?: boolean;
+    envFile?: string;
 }): string;
+/**
+ * Serialize the pane env to a shell-sourceable file, created 0600 and exclusively
+ * (`wx`) so it can never adopt a pre-existing file's mode or content.
+ *
+ * EVERY key goes in the file, not a curated "secret-bearing" subset: a denylist
+ * has to be updated for each new credential and is wrong the moment someone
+ * forgets, whereas routing all of it through the file makes the guarantee hold by
+ * construction. Keys are filtered to valid shell identifiers for the same reason
+ * `env` needed it — an exported function (`BASH_FUNC_x%%`) is not assignable.
+ */
+export declare function writeTmuxEnvFile(env: NodeJS.ProcessEnv, filePath: string): void;
 /**
  * Trim a raw `tmux capture-pane` dump to its last `maxLines` non-empty lines
  * (right-stripping each). Used by runInTmux to recap a fast-failed agent's

package/dist/lib/exec.js

@@ -17,11 +17,11 @@ import { isTierToken, resolveTier } from './model-tiers.js';
 import { createTimer, redactPrompt, redactArgs } from './events.js';
 import { sanitizeProcessEnv } from './secrets/bundles.js';
 import { resolveActor, actorEnv } from './actor.js';
-import { getShimsDir, getHistoryDir, getUserAgentsDir } from './state.js';
+import { getShimsDir, getHistoryDir, getRuntimeStateDir } from './state.js';
 import { resolveCodexHome } from './codex-home.js';
 import { readCodexConfiguredModel } from './shims.js';
 import { writePidSessionEntry, extractSessionIdArg } from './session/pid-registry.js';
-import { writeSessionActorRecord } from './session/actor-sidecar.js';
+import { writeSessionActorRecord, writeSessionAliasRecord } from './session/actor-sidecar.js';
 import { loadHookSessionIndex, resolveHookSessionId } from './session/hook-sessions.js';
 import { sessionIdMarkerLine } from './hosts/session-marker.js';
 import { recordRunName } from './session/run-names.js';
@@ -30,6 +30,7 @@ import { composeWin32CommandLine } from './platform/index.js';
 import { isTmuxInstalled } from './tmux/binary.js';
 import { shellQuote } from './ssh-exec.js';
 import { resolveClaudeSetupToken } from './claude-account-token.js';
+import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
 /**
  * Map a raw mode string (CLI flag, YAML field, env var) to the canonical Mode.
  *
@@ -172,6 +173,10 @@ export function resolveHeadlessMode(agent, requested, interactive, warningContex
 export function defaultModeFor(agent) {
     return AGENTS[agent].capabilities.modes[0];
 }
+/** Safe mode used when the user did not provide --mode or a configured default. */
+export function implicitModeFor(agent) {
+    return agent === 'codex' ? 'edit' : 'plan';
+}
 /**
  * Resolve interactive vs headless. Explicit flags are definitive and win over
  * inference: `--interactive` forces interactive, `--headless` forces headless.
@@ -357,6 +362,28 @@ export function buildExecEnv(options) {
         delete result.CODEX_HOME;
         delete result.COPILOT_HOME;
     }
+    else if (options.agent === 'muse') {
+        // Muse has no MUSE_CONFIG_DIR. Config is XDG-based:
+        //   $XDG_CONFIG_HOME/muse  (settings, skills, hooks, auth)
+        //   $XDG_DATA_HOME/muse    (sessions, plugins)
+        // Pin both into the version home so multi-version isolation matches
+        // Claude's CLAUDE_CONFIG_DIR / Codex's CODEX_HOME, and so Muse never
+        // resolves through the adopt-time ~/.config/muse symlink (SymlinkOrReparse).
+        const cwd = options.cwd || process.cwd();
+        const resolvedVersion = options.version ?? resolveVersion('muse', cwd);
+        const version = options.version
+            ? resolvedVersion
+            : (resolvedVersion && isVersionInstalled('muse', resolvedVersion) ? resolvedVersion : null);
+        if (version) {
+            const versionHome = getVersionHomePath('muse', version);
+            result.XDG_CONFIG_HOME = path.join(versionHome, '.config');
+            result.XDG_DATA_HOME = path.join(versionHome, '.local', 'share');
+        }
+        delete result.CLAUDE_CONFIG_DIR;
+        delete result.CODEX_HOME;
+        delete result.COPILOT_HOME;
+        delete result.KIMI_CODE_HOME;
+    }
     else {
         delete result.CLAUDE_CONFIG_DIR;
         delete result.CODEX_HOME;
@@ -441,11 +468,11 @@ export const AGENT_COMMANDS = {
         promptFlag: 'positional',
         resume: { subcommand: 'resume' },
         modeFlags: {
-            plan: ['--sandbox', 'read-only'],
-            // Sandboxed writes inside the workspace. Network stays on (workspace-write
-            // disables it by default) so edit-mode runs can still use git/gh/package
-            // installs. No approval bypass here — only `skip` drops the guardrails.
-            edit: ['--sandbox', 'workspace-write', '-c', 'sandbox_workspace_write.network_access=true'],
+            // Native Codex modes are assembled by codexPolicyArgs below. Named
+            // permission profiles keep filesystem access and network access
+            // independent; legacy --sandbox flags cannot express that combination.
+            plan: [],
+            edit: [],
             // skip = codex --yolo: drops the sandbox entirely and approves anything.
             skip: ['--dangerously-bypass-approvals-and-sandbox'],
         },
@@ -637,6 +664,29 @@ export const AGENT_COMMANDS = {
         },
         modelFlag: '--model',
     },
+    // Meta Muse Code (`muse exec` headless, `muse` TUI). Flags from
+    // `muse --help` / `muse exec --help` (v0.1.0): prompt is positional;
+    // --model selects muse-spark-*; --reasoning-effort is the effort dial;
+    // --disable-write approximates plan (no non-shell writes); --disable-approval
+    // keeps the sandbox (auto); --yolo drops approval+sandbox and trusts the
+    // workspace (skip). --json emits JSONL on stdout. Interactive resume is
+    // `muse resume <id>`; headless resume is `muse exec --session-id <id>` —
+    // see the muse resume branch in buildExecCommand.
+    muse: {
+        base: ['muse', 'exec'],
+        promptFlag: 'positional',
+        modeFlags: {
+            plan: ['--disable-write'],
+            edit: [],
+            auto: ['--disable-approval'],
+            skip: ['--yolo'],
+        },
+        jsonFlags: ['--json'],
+        modelFlag: '--model',
+        // Flag form covers headless (`--session-id`). Interactive uses the
+        // `resume` subcommand — special-cased in buildExecCommand.
+        resume: { flag: '--session-id' },
+    },
 };
 /**
  * Whether `agent` has a native resume form (Tier 1). Derived solely from the
@@ -665,12 +715,13 @@ export function buildExecCommand(options) {
     const template = AGENT_COMMANDS[options.agent];
     const cmd = [...template.base];
     const interactive = resolveInteractive(options);
-    // For Codex and Droid, 'exec' is the headless subcommand; for OpenCode, 'run'
-    // is. Drop it for interactive mode so we launch the TUI (`codex` / `droid` /
-    // `opencode`, each agent's default command) instead of the one-shot headless
-    // subcommand ('codex exec' / 'droid exec' / 'opencode run').
+    // For Codex, Droid, and Muse, 'exec' is the headless subcommand; for OpenCode,
+    // 'run' is. Drop it for interactive mode so we launch the TUI (`codex` /
+    // `droid` / `muse` / `opencode`) instead of the one-shot headless subcommand
+    // ('codex exec' / 'droid exec' / 'muse exec' / 'opencode run').
     if (interactive) {
-        if ((options.agent === 'codex' || options.agent === 'droid') && cmd[1] === 'exec') {
+        if ((options.agent === 'codex' || options.agent === 'droid' || options.agent === 'muse') &&
+            cmd[1] === 'exec') {
             cmd.splice(1, 1);
         }
         else if (options.agent === 'opencode' && cmd[1] === 'run') {
@@ -682,8 +733,18 @@ export function buildExecCommand(options) {
     // interactive drop above, `codex` -> `codex resume` (TUI). The session id is
     // pushed later as the first positional (before any prompt). `{ flag }` agents
     // (claude) need no base change — the flag is appended with the id below.
+    //
+    // Muse interactive resume is also a subcommand (`muse resume <id>`), but the
+    // session id MUST sit immediately after the verb — mode/model flags come
+    // after. So for interactive muse we push both `resume` and the id here, and
+    // skip the later generic resume flag path.
     const resumeSpec = options.resume ? template.resume : undefined;
-    if (resumeSpec && 'subcommand' in resumeSpec) {
+    let museInteractiveResumeDone = false;
+    if (options.agent === 'muse' && options.resume && interactive && options.sessionId) {
+        cmd.push('resume', options.sessionId);
+        museInteractiveResumeDone = true;
+    }
+    else if (resumeSpec && 'subcommand' in resumeSpec) {
         cmd.push(resumeSpec.subcommand);
     }
     // Use versioned alias if a specific version was requested (e.g., claude@2.1.98).
@@ -764,40 +825,26 @@ export function buildExecCommand(options) {
         // narrower than --yolo/-f, which also bypasses permission checks.
         cmd.push('--trust');
     }
-    // Codex's workspace-write sandbox blocks $HOME (verified against the live CLI
-    // and OpenAI's sandbox docs: writable roots extend scope "without removing the
-    // sandbox entirely"). But the model routinely shells out to `agents ...`, whose
-    // runtime state lives under ~/.agents — the SSH askpass shim
-    // (~/.agents/.cache/devices/askpass.sh), the device/stats cache, secrets,
-    // session writes, config tunings. Without ~/.agents as a writable root those
-    // inner writes fail with EROFS (e.g. `agents ssh` dies before connecting),
-    // which is why a remote `agents run codex` couldn't reach the fleet. Grant it
-    // implicitly whenever codex runs workspace-write — far narrower than --mode skip
-    // (danger-full-access). Fresh runs take --add-dir (below); resume forms reject
-    // --add-dir, so they take the same root via -c writable_roots here.
-    const codexWorkspaceWrite = options.agent === 'codex' && resolvedMode === 'edit';
-    if (resumeSpec && 'subcommand' in resumeSpec) {
+    if (options.agent === 'codex') {
+        const policyMode = resolvedMode === 'plan' || resolvedMode === 'skip' ? resolvedMode : 'edit';
+        const writableRoots = [...codexEditWritableRoots(), ...(options.addDirs ?? [])];
+        cmd.push(...codexPolicyArgs(policyMode, writableRoots));
+    }
+    else if (resumeSpec && 'subcommand' in resumeSpec) {
         if (resolvedMode === 'skip') {
             // skip = yolo on resume too; both `codex resume` (TUI) and
             // `codex exec resume` accept the bypass flag.
             cmd.push('--dangerously-bypass-approvals-and-sandbox');
         }
         else if (interactive) {
-            // `codex resume` (TUI) accepts the same -s/--sandbox flags as a fresh run.
             cmd.push(...modeFlags);
-            if (codexWorkspaceWrite)
-                cmd.push('-c', codexWritableRootsConfig(getUserAgentsDir()));
         }
         else {
             // `codex exec resume` rejects `--sandbox <mode>` (verified against
             // `codex exec resume --help` on 0.142.5), but takes -c config overrides —
             // map the mode through sandbox_mode so a non-skip resume never gets the
             // approval/sandbox bypass.
-            cmd.push('-c', `sandbox_mode=${resolvedMode === 'plan' ? 'read-only' : 'workspace-write'}`);
-            if (resolvedMode !== 'plan') {
-                cmd.push('-c', 'sandbox_workspace_write.network_access=true');
-                cmd.push('-c', codexWritableRootsConfig(getUserAgentsDir()));
-            }
+            cmd.push(...modeFlags);
         }
     }
     else if (options.agent === 'kimi' && !interactive) {
@@ -835,7 +882,7 @@ export function buildExecCommand(options) {
     // agents (codex) already pushed the verb above, so the id is the first
     // positional here — placed before the prompt positional appended later. Without
     // `resume`, the legacy claude-only `--session-id` CREATES a session with that id.
-    if (options.resume && options.sessionId && resumeSpec) {
+    if (options.resume && options.sessionId && resumeSpec && !museInteractiveResumeDone) {
         if ('flag' in resumeSpec) {
             const flag = interactive
                 ? (resumeSpec.interactiveFlag ?? resumeSpec.flag)
@@ -913,21 +960,10 @@ export function buildExecCommand(options) {
             cmd.push(template.promptFlag, options.prompt);
         }
     }
-    // Extra writable dirs. Claude and Codex both take `--add-dir`; for Codex it
-    // widens the workspace-write sandbox (teams relies on this to let teammates
-    // write ~/.agents), so it must actually be forwarded — it used to be
-    // claude-only, silently dropped for codex and masked by edit mode carrying
-    // the approval/sandbox bypass. Codex's resume forms reject --add-dir, so
-    // skip it there (claude's flag-based resume accepts it).
-    //
-    // On top of any user-supplied dirs, a fresh codex workspace-write run
-    // implicitly gets ~/.agents (deduped) so the CLI's own tooling — askpass,
-    // secrets, sessions, tunings — can write from inside the sandbox. Resume forms
-    // get the same root via -c writable_roots above (see codexWorkspaceWrite).
-    const codexImplicitDirs = codexWorkspaceWrite && !options.resume ? [getUserAgentsDir()] : [];
-    const addDirs = [...new Set([...(options.addDirs ?? []), ...codexImplicitDirs])];
-    if (addDirs.length > 0 &&
-        (options.agent === 'claude' || (options.agent === 'codex' && !options.resume))) {
+    // Codex add-dirs are folded into its named edit profile above, including on
+    // resume where the native CLI rejects --add-dir. Claude keeps its native flag.
+    const addDirs = [...new Set(options.addDirs ?? [])];
+    if (addDirs.length > 0 && options.agent === 'claude') {
         for (const dir of addDirs) {
             cmd.push('--add-dir', dir);
         }
@@ -1024,8 +1060,11 @@ export async function execShimPassthrough(agent, rawArgs, cwd, pinnedVersion) {
         if (fs.existsSync(cmdPath))
             binary = cmdPath;
     }
-    // The only flag the bash shim injects (codex); everything else is transparent.
-    const launchArgs = agent === 'codex' ? ['-c', 'check_for_update_on_startup=false'] : [];
+    // Match the POSIX shim: direct Codex launches default to the safe writable
+    // profile, while later user arguments can still override native settings.
+    const launchArgs = agent === 'codex'
+        ? ['-c', 'check_for_update_on_startup=false', ...codexPolicyArgs('edit')]
+        : [];
     // Mint a launch id and export it as AGENT_LAUNCH_ID so the agent's SessionStart
     // hook records the same id — the join key that maps this launch to its exact
     // session even though the recorded pid here is the cmd.exe wrapper (Windows) or
@@ -1150,13 +1189,53 @@ export function shouldWrapInTmux(ctx) {
  * real values; the stored/informational copy uses the redacted form (RUSH-1758).
  */
 export function buildTmuxAgentCommand(executable, args, env, opts = {}) {
+    const agentCmd = [executable, ...args].map(shellQuote).join(' ');
+    // envFile: source the values instead of inlining them, so no VALUE ever lands
+    // in the pane's argv. `exec env K=V …` put every resolved secret into the
+    // process table, readable by any process of this user — on one fleet box six
+    // live processes carried the secrets-store master passphrase, which decrypts
+    // every file-backed bundle including the Claude OAuth tokens (RUSH-2100).
+    // `set -a` exports what the file assigns; the file is unlinked before `exec`,
+    // so it exists only for the sourcing itself. A missing file aborts the pane
+    // rather than silently launching with a half-built env.
+    if (opts.envFile) {
+        const f = shellQuote(opts.envFile);
+        // Remove the file whether or not sourcing succeeds — a bare `. f || exit 1`
+        // strands the plaintext env (incl. the secrets-store master passphrase) on
+        // disk on any source failure, worse than the argv leak this replaces
+        // (RUSH-2100). Capture the source rc, unlink, then honor it.
+        return `set -a; . ${f}; __agents_rc=$?; set +a; rm -f ${f}; [ "$__agents_rc" -eq 0 ] || exit 1; exec ${agentCmd}`;
+    }
     const envPrefix = Object.entries(env)
         .filter(([k, v]) => v !== undefined && EXEC_ENV_KEY_PATTERN.test(k))
         .map(([k, v]) => `${k}=${opts.redactEnvValues ? '<redacted>' : shellQuote(String(v))}`)
         .join(' ');
-    const agentCmd = [executable, ...args].map(shellQuote).join(' ');
     return `exec env ${envPrefix} ${agentCmd}`;
 }
+/**
+ * Serialize the pane env to a shell-sourceable file, created 0600 and exclusively
+ * (`wx`) so it can never adopt a pre-existing file's mode or content.
+ *
+ * EVERY key goes in the file, not a curated "secret-bearing" subset: a denylist
+ * has to be updated for each new credential and is wrong the moment someone
+ * forgets, whereas routing all of it through the file makes the guarantee hold by
+ * construction. Keys are filtered to valid shell identifiers for the same reason
+ * `env` needed it — an exported function (`BASH_FUNC_x%%`) is not assignable.
+ */
+export function writeTmuxEnvFile(env, filePath) {
+    const body = Object.entries(env)
+        .filter(([k, v]) => v !== undefined && EXEC_ENV_KEY_PATTERN.test(k))
+        .map(([k, v]) => `${k}=${shellQuote(String(v))}`)
+        .join('\n');
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const fd = fs.openSync(filePath, 'wx', 0o600);
+    try {
+        fs.writeSync(fd, `${body}\n`);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 /**
  * Trim a raw `tmux capture-pane` dump to its last `maxLines` non-empty lines
  * (right-stripping each). Used by runInTmux to recap a fast-failed agent's
@@ -1192,24 +1271,57 @@ export function formatPaneTail(raw, maxLines = 30) {
  *      (Ctrl-b d) — return 0 and LEAVE the session for `agents focus` to re-attach.
  */
 async function runInTmux(options, executable, args) {
-    const { createSession, killSession, paneExitStatus, setSessionHook, slugifyName, agentPaneDiedHook, markSessionHookSchema } = await import('./tmux/session.js');
+    const { createSession, hasSession, killSession, paneExitStatus, setSessionHook, slugifyName, agentPaneDiedHook, markSessionHookSchema } = await import('./tmux/session.js');
     const { getDefaultSocketPath } = await import('./tmux/paths.js');
     const { attachTmux, runTmux } = await import('./tmux/binary.js');
     const socket = getDefaultSocketPath();
     const cwd = options.cwd || process.cwd();
     const idSeed = (options.sessionId ?? randomUUID()).slice(0, 8);
     const name = slugifyName(`ag-${options.agent}-${idSeed}`);
-    const execEnv = buildExecEnv(options);
-    // Launch with the real env (secret VALUES materialized into the pane); persist
-    // only a value-redacted copy in SessionMeta.cmd so resolved secrets never hit
-    // disk via the informational cmd field (RUSH-1758).
-    const cmd = buildTmuxAgentCommand(executable, args, execEnv);
+    // A native resume must not create a competing wrapper for a live session.
+    // A retained dead pane is reaped before the harness resumes normally.
+    if (options.resume && await hasSession(name, socket)) {
+        const existing = await createSession({ name, cwd, socket, source: 'cli', attachExisting: true });
+        if (options.sessionId)
+            writeSessionAliasRecord(options.sessionId, name);
+        if (!existing.pane || !(await paneExitStatus(existing.pane, socket)).dead) {
+            await attachTmux({ socket, args: ['attach-session', '-t', name] });
+            return { exitCode: 0, stderr: '', stdout: '' };
+        }
+        await killSession(name, socket);
+    }
+    // SessionStart learns some harness IDs only after launch. Carry the wrapper
+    // name into that hook so it can bind both identities durably.
+    const execEnv = { ...buildExecEnv(options), AGENT_TMUX_SESSION_NAME: name };
+    // The pane sources its env from a 0600 file it unlinks before exec, so no
+    // resolved secret VALUE reaches the process table (RUSH-2100). SessionMeta.cmd
+    // keeps the value-redacted inline form — the human-readable record of what ran,
+    // which never carried real values anyway (RUSH-1758).
+    const envFile = path.join(getRuntimeStateDir(), 'tmux-env', `${name}-${randomUUID().slice(0, 8)}.env`);
+    writeTmuxEnvFile(execEnv, envFile);
+    const cmd = buildTmuxAgentCommand(executable, args, execEnv, { envFile });
     const metaCmd = buildTmuxAgentCommand(executable, args, execEnv, { redactEnvValues: true });
     const labels = { agent: options.agent };
     if (options.sessionId)
         labels.sessionId = options.sessionId;
-    const meta = await createSession({ name, cmd, metaCmd, cwd, socket, source: 'cli', labels });
+    // Only a launched pane sources-and-unlinks the env file. If createSession
+    // throws, the pane never runs, so the resolved secrets (incl. the master
+    // passphrase) would linger on disk — remove it on that failure path
+    // (RUSH-2100). On success the detached pane owns the unlink.
+    let meta;
+    try {
+        meta = await createSession({ name, cmd, metaCmd, cwd, socket, source: 'cli', labels });
+    }
+    catch (err) {
+        try {
+            fs.rmSync(envFile, { force: true });
+        }
+        catch { /* best-effort */ }
+        throw err;
+    }
     const pane = meta.pane;
+    if (options.sessionId)
+        writeSessionAliasRecord(options.sessionId, name);
     if (pane) {
         // When the AGENT pane dies, detach the client (don't kill) so the session
         // survives just long enough to read the dead pane's exit status below. The
@@ -1284,7 +1396,7 @@ async function runInTmux(options, executable, args) {
     };
     // The agent could exit before we attach (fast failure). Don't attach to an
     // already-dead pane — surface its output + status directly and tear down.
-    const before = pane ? await paneExitStatus(pane, socket) : { dead: false };
+    const before = pane ? await paneExitStatus(pane, socket) : { found: false, dead: false, status: undefined };
     if (before.dead) {
         // F2 (RUSH-2185 / EXEC-23a): for interactive runs, ALWAYS recap — a clean
         // exit-0 before attach means the harness has no interactive REPL and the
@@ -1310,7 +1422,7 @@ async function runInTmux(options, executable, args) {
             return false;
         }
     };
-    const after = pane ? await paneExitStatus(pane, socket) : { dead: false };
+    const after = pane ? await paneExitStatus(pane, socket) : { found: false, dead: false, status: undefined };
     if (after.dead) {
         // Nonzero exit after attach → the agent crashed rather than the user
         // detaching cleanly (a clean detach leaves the pane ALIVE, handled below).
@@ -1873,6 +1985,7 @@ export async function runWithFallback(options) {
             ...options,
             agent,
             version,
+            mode: options.modeWasImplicit ? implicitModeFor(agent) : options.mode,
             prompt,
             env: envOverride ? { ...(options.env ?? {}), ...envOverride } : options.env,
             sessionId: pinnedSessionId ?? (i === 0 ? options.sessionId : undefined),

package/dist/lib/feed-broadcast.d.ts

@@ -141,26 +141,7 @@ export declare function scrubOutboundDashes(text: string): string;
  * host last. Skip the uninformative default label `agent`.
  */
 export declare function composeBroadcastFooter(ctx: FeedBroadcastContext): string | undefined;
-/**
- * Human-facing body for a messaging sink (`{message}`).
- *
- * ```
- * Title in a few words
- *
- * Body of what happened or the ask.
- * Options: publish / wait          (blocks with choices)
- * Default in 15 min: wait          (blocks with a safe default)
- *
- * Sent from grok/a02da0e2 on mac-mini
- * https://…                        (optional attach URL)
- * ```
- *
- * Title first (scannable subject). Blank line. Body. Then the phone-actionable
- * choices + default (a block that has stopped for the human), then footer
- * provenance. No `agents focus <id>` line: a CLI command is unusable from a phone,
- * so the safe default is the fallback and the message carries it. Prefer `{message}`
- * over bare `{text}` in messaging sinks.
- */
+export declare function truncateBroadcastBody(body: string): string;
 export declare function composeBroadcastMessage(ctx: FeedBroadcastContext): string;
 /**
  * Substitute `{placeholder}` tokens in an argv template. Returns undefined when

package/dist/lib/feed-broadcast.js

@@ -202,9 +202,39 @@ export function composeBroadcastFooter(ctx) {
  * so the safe default is the fallback and the message carries it. Prefer `{message}`
  * over bare `{text}` in messaging sinks.
  */
+/**
+ * The phone copy is a text, not a report. A long body reaches the owner's phone
+ * as an unreadable wall, and the `feed post` forwarding path is where that has to
+ * be shaped: every sink (owner alias, in-process `channel:`, spawned `command:`)
+ * funnels through {@link composeBroadcastMessage}, which is the only seam a shell
+ * hook cannot reach. Keep the title (the scannable headline) and cap the BODY to a
+ * short excerpt, marking the cut with a plain "(full in feed)" — NOT a CLI command
+ * (unusable from a phone, see the note on composeBroadcastMessage). Nothing is
+ * lost: this shapes only the outbound sink text; the full post stays in the feed.
+ */
+const PHONE_BODY_MAX_CHARS = 500;
+const PHONE_BODY_MAX_LINES = 8;
+export function truncateBroadcastBody(body) {
+    if (!body)
+        return body;
+    let out = body;
+    let cut = false;
+    const lines = out.split('\n');
+    if (lines.length > PHONE_BODY_MAX_LINES) {
+        out = lines.slice(0, PHONE_BODY_MAX_LINES).join('\n');
+        cut = true;
+    }
+    if (out.length > PHONE_BODY_MAX_CHARS) {
+        out = out.slice(0, PHONE_BODY_MAX_CHARS);
+        cut = true;
+    }
+    if (!cut)
+        return body;
+    return `${out.trimEnd()}\n… (full in feed)`;
+}
 export function composeBroadcastMessage(ctx) {
     const title = scrubOutboundDashes(ctx.title ?? '');
-    const body = scrubOutboundDashes(ctx.text ?? '');
+    const body = truncateBroadcastBody(scrubOutboundDashes(ctx.text ?? ''));
     // Title preferred; if an older post has no title, body alone still sends.
     const head = title || body;
     const mid = title && body && title !== body ? body : undefined;