@phnx-labs/agents-cli 1.22.23 → 1.22.25

package/dist/lib/daemon.js

@@ -24,7 +24,9 @@ import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { redactSecrets } from './redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from './cli-entry.js';
-import { isSchedulerEnabled, assertSchedulerEnabled } from './device-config.js';
+import { getConfigValue, isSchedulerEnabled, assertSchedulerEnabled } from './device-config.js';
+import { reapTerminalRoutineProcesses } from './routine-process-cleanup.js';
+import { runWatchdogPass } from './watchdog/service.js';
 const PID_FILE = 'daemon.pid';
 const LOCK_FILE = 'daemon.lock';
 const LOG_FILE = 'logs.jsonl';
@@ -34,6 +36,7 @@ const LOG_ROTATE_COUNT = 3;
 const PLIST_NAME = 'com.phnx-labs.agents-daemon';
 const SYSTEMD_UNIT = 'agents-daemon.service';
 const MONITOR_TICK_MS = 60_000;
+const WATCHDOG_TICK_MS = 3 * 60_000;
 /**
  * How often to re-scan for missed fires. Deliberately slower than the monitor
  * tick: detection walks a week of cron occurrences per routine
@@ -572,6 +575,24 @@ export async function runDaemon() {
     }
     if (schedulerEnabledAtBoot)
         bootScheduler();
+    let watchdogInFlight = false;
+    const runDaemonWatchdog = async () => {
+        if (watchdogInFlight || getConfigValue('watchdog.enabled').value !== true)
+            return;
+        watchdogInFlight = true;
+        try {
+            const result = await runWatchdogPass({ nudge: true });
+            log('INFO', `watchdog: ${result.counts.total} live, ${result.counts.stalled} stalled, ${result.counts.nudged} nudged`);
+        }
+        catch (err) {
+            log('ERROR', `watchdog tick failed: ${err.message}`);
+        }
+        finally {
+            watchdogInFlight = false;
+        }
+    };
+    const watchdogInterval = setInterval(() => { void runDaemonWatchdog(); }, WATCHDOG_TICK_MS);
+    const watchdogKickoff = setTimeout(() => { void runDaemonWatchdog(); }, 30_000);
     // Monitor engine: event-triggered watchers, beside the cron scheduler. Same
     // daemon, same dispatch seam — a monitor is a routine whose trigger is a
     // watched source instead of a clock. Reloads on SIGHUP alongside the scheduler.
@@ -682,6 +703,9 @@ export async function runDaemon() {
     const monitorInterval = setInterval(() => {
         writeHeartbeat();
         monitorRunningJobs();
+        const reaped = reapTerminalRoutineProcesses();
+        if (reaped.length > 0)
+            log('WARN', `Reaped ${reaped.length} terminal routine process group(s): ${reaped.join(', ')}`);
     }, MONITOR_TICK_MS);
     // Resource safety check: heal gaps between what DotAgents repos define and
     // what's actually installed in each agent home — the slow rot that nothing
@@ -1066,6 +1090,8 @@ export async function runDaemon() {
         monitorEngine.stop();
         await browserIPC.stop();
         clearInterval(monitorInterval);
+        clearInterval(watchdogInterval);
+        clearTimeout(watchdogKickoff);
         clearInterval(healInterval);
         clearTimeout(healKickoff);
         clearInterval(autoDispatchInterval);

package/dist/lib/device-config.js

@@ -67,6 +67,13 @@ export const CONFIG_KEYS = [
         type: 'bool',
         description: 'Whether the routines scheduler (daemon) may fire on this device.',
     },
+    {
+        name: 'watchdog.enabled',
+        yamlKey: 'watchdogEnabled',
+        scope: 'device',
+        type: 'bool',
+        description: 'Whether the daemon runs the watchdog pass on this device.',
+    },
     {
         name: 'browser.remote-control',
         yamlKey: 'browserRemoteControl',

package/dist/lib/devices/doctor-findings.d.ts

@@ -10,7 +10,7 @@ export type FindingSeverity = 'critical' | 'warning';
  *  the JSON consumer group by kind. */
 /** Every finding class. Severity is NOT annotated here — {@link FINDING_SEVERITY}
  *  below owns it, and a second copy in these comments is a fourth place to drift. */
-export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "exec-policy", "stale-cli"];
+export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "stale-cli"];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
  * the builders below and asserted against both prose rubrics by
@@ -89,6 +89,12 @@ export interface LocalFindingInputs {
     duplicateHooks?: DuplicateVersionHook[];
     /** Credential-shaped exports found in the user's shell rc files (RUSH-1968). */
     rcSecrets?: RcSecretFinding[];
+    /** True when the file-store master key is live in THIS process's environment.
+     *  Distinct from `rcSecrets`, which scans FILES: a value inherited by a
+     *  long-lived process survives deleting the rc line that set it, so the rc
+     *  scan reports clean while the leak is still in flight (RUSH-1968). Never the
+     *  value — only whether it is set. */
+    masterPassphraseInEnv?: boolean;
     /** The effective PowerShell execution policy and the platform it was read on.
      *  Only `win32` yields a finding — the `agents.ps1` launcher is Windows-only. */
     execPolicy?: {

package/dist/lib/devices/doctor-findings.js

@@ -23,7 +23,7 @@
  *              never-synced · stale · repo-behind · repo-drift · version-skew ·
  *              fleet-resource-gap · orphan · duplicate-hook ·
  *              duplicate-hook-drift · host-cli-missing · host-cli-invalid ·
- *              rc-secret-export · exec-policy · stale-cli.
+ *              rc-secret-export · env-secret-export · exec-policy · stale-cli.
  *   (RUSH-2162 moved never-synced and duplicate-hook-drift to WARNING: both are
  *   stale-sync states one `agents sync` resolves, not "needs you now".)
  *
@@ -94,6 +94,7 @@ export const ALL_FINDING_KINDS = [
     'duplicate-hook', // one hook materialized in several version homes, byte-identical
     'duplicate-hook-drift', // …with differing content, so a stale copy can disagree
     'rc-secret-export', // credential-shaped export in a shell rc file
+    'env-secret-export', // the file-store master key live in THIS process's env
     'exec-policy', // Windows execution policy blocks agents.ps1
     'stale-cli',
 ];
@@ -133,6 +134,7 @@ export const FINDING_SEVERITY = {
     'host-cli-missing': 'warning',
     'host-cli-invalid': 'warning',
     'rc-secret-export': 'warning',
+    'env-secret-export': 'warning',
     'exec-policy': 'warning',
     'stale-cli': 'warning',
 };
@@ -240,6 +242,11 @@ export function remediationFor(finding) {
             return 'fix the manifest';
         case 'rc-secret-export':
             return 'agents secrets add';
+        case 'env-secret-export':
+            // Not just "restart the shell": the value is in every long-lived parent
+            // that inherited it — an editor, a tmux server, the agents daemon — and
+            // each keeps handing it to new children until IT restarts.
+            return 'unset at the source, then restart every process that inherited it (shells, editor, tmux, agents daemon)';
         case 'exec-policy':
             return 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned';
         case 'stale-cli':
@@ -450,6 +457,10 @@ export function buildLocalFindings(input) {
     // into `agents secrets`.
     for (const f of rcSecretFindings(device, input.rcSecrets ?? []))
         out.push(f);
+    // The same key, live in this process's environment rather than in a file.
+    const envFinding = envSecretFinding(device, input.masterPassphraseInEnv ?? false);
+    if (envFinding)
+        out.push(envFinding);
     // Windows execution policy blocking the generated agents.ps1 launcher.
     const policyFinding = execPolicyFinding(device, input.execPolicy);
     if (policyFinding)
@@ -572,6 +583,32 @@ function rcSecretFindings(device, rc) {
  * policy itself. Returns null off Windows or on a permissive policy — pure, so
  * both branches are testable without invoking PowerShell.
  */
+/**
+ * The file-store master key sitting in THIS process's environment.
+ *
+ * `rc-hygiene.ts` scans FILES, which leaves a real hole: a value inherited by a
+ * long-lived process outlives the rc line that set it, so an operator who
+ * deletes `~/.zshenv:8` gets a clean `rc-secret-export` while every shell,
+ * editor and agent started before the edit still carries the key — and hands it
+ * to everything they spawn. Verified on a box with no rc export whose live
+ * environment still held the value, hashing identical to its key file.
+ *
+ * Warning, not critical: on the release home base the export is deliberate and
+ * scoped (`headless-sign-context.sh`), so the message names that exception
+ * rather than the check trying to detect it.
+ */
+function envSecretFinding(device, present) {
+    if (!present)
+        return null;
+    return finding({
+        severity: FINDING_SEVERITY['env-secret-export'], kind: 'env-secret-export', device,
+        // Never the value — only that it is set.
+        message: 'AGENTS_SECRETS_PASSPHRASE is set in this process environment — every '
+            + 'child inherits it and any same-user process can read it from /proc/<pid>/environ. '
+            + 'It outlives the shell rc line that set it, so deleting that line is not enough. '
+            + '(Expected inside a release sign context, which sets it deliberately.)',
+    });
+}
 function execPolicyFinding(device, execPolicy) {
     if (!execPolicy || execPolicy.platform !== 'win32')
         return null;
@@ -881,6 +918,8 @@ function warningSubject(f) {
         return 'orphans';
     if (f.kind === 'rc-secret-export')
         return 'shell rc';
+    if (f.kind === 'env-secret-export')
+        return 'environment';
     if (f.kind === 'exec-policy')
         return 'PowerShell';
     if (f.kind === 'fleet-resource-gap')

package/dist/lib/doctor-diff.d.ts

@@ -22,6 +22,7 @@
 import type { AgentId } from './types.js';
 import type { DiscoveredPlugin } from './types.js';
 import { type HookWiringReport } from './hooks.js';
+import { type ResourceInventory } from './resource-inventory.js';
 export type DoctorKind = 'commands' | 'skills' | 'hooks' | 'rules' | 'mcp' | 'permissions' | 'subagents' | 'plugins' | 'promptcuts';
 export type DiffStatus = 'ok' | 'diff' | 'missing' | 'extra';
 export type SourceLayer = 'project' | 'user' | 'system' | 'extra';
@@ -75,6 +76,8 @@ export interface VersionResourceReport {
     /** Wiring inspection for the version's native settings.json (claude/droid).
      *  Populated only when the `hooks` kind is in scope. */
     hookWiring?: HookWiringReport;
+    /** Harness-scoped hook state from the shared inventory engine. */
+    hookInventory?: ResourceInventory;
     /** Source layers behind their upstream. Filled by the doctor command (a git
      *  probe), not the pure diff — undefined when uncomputed. */
     sourceBehind?: SourceLayerBehind[];

package/dist/lib/doctor-diff.js

@@ -33,7 +33,8 @@ import { shouldInstallCommandAsSkill, commandSkillMatches, commandSkillName } fr
 import { gooseCommandMatches, gooseCommandsDir } from './goose-commands.js';
 import { supports } from './capabilities.js';
 import { listSkillsInVersionHome, getVersionSkillsDir } from './skills.js';
-import { listHooksInVersionHome, listHookEntriesFromDir, checkVersionHookWiring } from './hooks.js';
+import { listHookEntriesFromDir } from './hooks.js';
+import { getResourceInventory } from './resource-inventory.js';
 const RULES_DOC_FILENAME = 'README.md';
 const ALL_KINDS = [
     'commands',
@@ -300,11 +301,10 @@ function diffSkills(agent, version, cwd, excludeProject = false) {
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }
 // ─── hooks ────────────────────────────────────────────────────────────────────
-function diffHooks(agent, version, cwd) {
+function diffHooks(agent, version, cwd, inventory) {
     if (!AGENTS[agent].supportsHooks)
         return [];
-    const installedEntries = listHooksInVersionHome(agent, version);
-    const installedByName = new Map(installedEntries.map((e) => [e.name, e]));
+    const installedByName = new Map(inventory.onDisk.map((e) => [e.name, e]));
     // Sync intentionally excludes project/.agents/hooks/ — mirror that.
     const layerBases = buildLayerBases(cwd, 'hooks', { excludeProject: true });
     // Group source files the same way the hook installer does (basename across
@@ -329,14 +329,14 @@ function diffHooks(agent, version, cwd) {
             continue;
         }
         const a = readSafe(src.entry.scriptPath);
-        const b = readSafe(installed.scriptPath);
+        const b = readSafe(installed.path);
         let matches = a != null && b != null && normalize(a) === normalize(b);
-        if (matches && src.entry.dataFile && installed.dataFile) {
+        if (matches && src.entry.dataFile && installed.detail) {
             const ad = readSafe(src.entry.dataFile);
-            const bd = readSafe(installed.dataFile);
+            const bd = readSafe(installed.detail);
             matches = ad != null && bd != null && normalize(ad) === normalize(bd);
         }
-        else if (matches && (!!src.entry.dataFile !== !!installed.dataFile)) {
+        else if (matches && (!!src.entry.dataFile !== !!installed.detail)) {
             matches = false;
         }
         rows.push({
@@ -345,13 +345,13 @@ function diffHooks(agent, version, cwd) {
             status: matches ? 'ok' : 'diff',
             source: src.layer,
             sourcePath: src.entry.scriptPath,
-            homePath: installed.scriptPath,
+            homePath: installed.path,
         });
     }
     for (const [name, installed] of installedByName) {
         if (seen.has(name))
             continue;
-        rows.push({ kind: 'hooks', name, status: 'extra', homePath: installed.scriptPath });
+        rows.push({ kind: 'hooks', name, status: 'extra', homePath: installed.path });
     }
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }
@@ -609,12 +609,13 @@ export function diffVersionResources(agent, version, options = {}) {
         empty.commands = diffCommands(agent, version, cwd, excludeProject);
     if (requested.has('skills'))
         empty.skills = diffSkills(agent, version, cwd, excludeProject);
-    if (requested.has('hooks'))
-        empty.hooks = diffHooks(agent, version, cwd);
+    const hookInventory = requested.has('hooks') ? getResourceInventory(agent, version, 'hooks', { cwd }) : undefined;
+    if (hookInventory)
+        empty.hooks = diffHooks(agent, version, cwd, hookInventory);
     // Wiring check: a hook FILE can be present and byte-identical to source (ok
     // above) yet never referenced in settings.json, so it never fires. Only
     // meaningful when hooks are in scope.
-    const hookWiring = requested.has('hooks') ? checkVersionHookWiring(agent, version) : undefined;
+    const hookWiring = hookInventory?.wiring;
     if (requested.has('rules'))
         empty.rules = diffRules(agent, version, cwd, excludeProject);
     if (requested.has('mcp'))
@@ -654,6 +655,7 @@ export function diffVersionResources(agent, version, options = {}) {
         kinds: empty,
         summary: { ok, diff, missing, extra },
         ...(hookWiring ? { hookWiring } : {}),
+        ...(hookInventory ? { hookInventory } : {}),
     };
 }
 export const DOCTOR_ALL_KINDS = ALL_KINDS;

package/dist/lib/event-stream.d.ts

@@ -36,6 +36,8 @@ export interface UnifiedQuery {
  * Read a unified, newest-first event stream. Operational events come from
  * events.ts `query()`; agent-semantic events from the activity logs, normalized
  * to the same record shape and filtered identically. `limit` caps the merged
- * result (each source is fetched up to `limit`, so the top-N is exact).
+ * result (each source is fetched up to `limit` *after* its primary filters —
+ * eventTypes for activity, eventTypes/module/bundle for ops — so the top-N is
+ * exact for those filters).
  */
 export declare function readUnifiedEvents(q?: UnifiedQuery): EventRecord[];

package/dist/lib/event-stream.js

@@ -46,7 +46,9 @@ function matches(r, q) {
  * Read a unified, newest-first event stream. Operational events come from
  * events.ts `query()`; agent-semantic events from the activity logs, normalized
  * to the same record shape and filtered identically. `limit` caps the merged
- * result (each source is fetched up to `limit`, so the top-N is exact).
+ * result (each source is fetched up to `limit` *after* its primary filters —
+ * eventTypes for activity, eventTypes/module/bundle for ops — so the top-N is
+ * exact for those filters).
  */
 export function readUnifiedEvents(q = {}) {
     // `bundle` is filtered inside query()'s scan (before its limit cutoff) so a
@@ -66,10 +68,21 @@ export function readUnifiedEvents(q = {}) {
     });
     if (q.includeActivity === false)
         return ops;
+    // Activity events always stamp module: 'activity'. A non-activity module
+    // filter can never match them — skip the activity scan entirely.
+    if (q.module != null && q.module !== 'activity')
+        return ops;
+    // Push eventTypes into the activity reader so `limit` is applied AFTER the
+    // event-type filter (readRecentActivity already does this for `events`).
+    // Without this, a rare match older than the newest-`limit` window of routine
+    // churn is silently dropped — the same class of bug as the ops-side bundle
+    // pre-filter above (RUSH-2093). Remaining filters (agent, sessionId, …) still
+    // run via matches() for fields activity.ts does not pre-filter.
     const acts = readActivityAsEventRecords({
         sinceMs: q.startDate?.getTime(),
         limit: q.limit,
         root: q.activityRoot,
+        events: q.eventTypes,
     }).filter((r) => matches(r, q));
     const merged = [...ops, ...acts].sort((a, b) => Date.parse(b.ts) - Date.parse(a.ts));
     return typeof q.limit === 'number' ? merged.slice(0, q.limit) : merged;

package/dist/lib/events.d.ts

@@ -226,6 +226,15 @@ export declare function query(options: {
     bundle?: string;
     limit?: number;
 }): EventRecord[];
+/**
+ * Scan event logs once for a set of session IDs and return browser/computer
+ * usage flags for each. O(files) instead of O(N × files) — safe to call
+ * outside a SQLite write transaction.
+ */
+export declare function queryToolUsageForSessions(sessionIds: ReadonlySet<string>): Map<string, {
+    usedBrowser: boolean;
+    usedComputer: boolean;
+}>;
 /**
  * Get performance stats for a specific label.
  */

package/dist/lib/events.js

@@ -1052,6 +1052,64 @@ export function query(options) {
     }
     return results;
 }
+/**
+ * Scan event logs once for a set of session IDs and return browser/computer
+ * usage flags for each. O(files) instead of O(N × files) — safe to call
+ * outside a SQLite write transaction.
+ */
+export function queryToolUsageForSessions(sessionIds) {
+    const result = new Map();
+    if (sessionIds.size === 0)
+        return result;
+    for (const id of sessionIds) {
+        result.set(id, { usedBrowser: false, usedComputer: false });
+    }
+    const BROWSER_EVENTS = new Set(['browser.navigate', 'browser.screenshot']);
+    const COMPUTER_EVENTS = new Set(['computer.action']);
+    eventsPath();
+    migrateLegacyEventLogs();
+    const files = listEventLogFiles().sort((a, b) => Number(b.currentActive) - Number(a.currentActive) || b.mtimeMs - a.mtimeMs || b.path.localeCompare(a.path));
+    let remaining = sessionIds.size * 2; // each session needs up to 2 flags set
+    for (const file of files) {
+        if (remaining <= 0)
+            break;
+        let content;
+        if (file.gzip) {
+            try {
+                content = gunzipSync(fs.readFileSync(file.path)).toString('utf-8');
+            }
+            catch {
+                continue;
+            }
+        }
+        else {
+            content = fs.readFileSync(file.path, 'utf-8');
+        }
+        for (const line of content.trim().split('\n')) {
+            if (!line)
+                continue;
+            try {
+                const record = JSON.parse(line);
+                const sid = record.sessionId;
+                if (!sid || !result.has(sid))
+                    continue;
+                const entry = result.get(sid);
+                if (BROWSER_EVENTS.has(record.event) && !entry.usedBrowser) {
+                    entry.usedBrowser = true;
+                    remaining--;
+                }
+                else if (COMPUTER_EVENTS.has(record.event) && !entry.usedComputer) {
+                    entry.usedComputer = true;
+                    remaining--;
+                }
+            }
+            catch {
+                // skip malformed lines
+            }
+        }
+    }
+    return result;
+}
 // ─── Stats ────────────────────────────────────────────────────────────────────
 /**
  * Get performance stats for a specific label.

package/dist/lib/exec.d.ts

@@ -42,7 +42,7 @@ export declare function headlessPlanStallCommand(args: {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/cursor/kiro have no plan flag; hard-failing made
+ *   like antigravity/kiro have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -61,8 +61,8 @@ export declare function resolveMode(agent: AgentId, requested: Mode): Mode;
  * `--prompt` + `--plan`, and grok's `--permission-mode plan` silently stalls at
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
- * one-line stderr warning, mirroring the graceful plan→edit degrade cursor and
- * antigravity get for having no plan flag at all. Interactive runs are never
+ * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
+ * and kiro get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */
@@ -389,7 +389,19 @@ export declare function shouldWrapInTmux(ctx: TmuxWrapContext): boolean;
  */
 export declare function buildTmuxAgentCommand(executable: string, args: string[], env: NodeJS.ProcessEnv, opts?: {
     redactEnvValues?: boolean;
+    envFile?: string;
 }): string;
+/**
+ * Serialize the pane env to a shell-sourceable file, created 0600 and exclusively
+ * (`wx`) so it can never adopt a pre-existing file's mode or content.
+ *
+ * EVERY key goes in the file, not a curated "secret-bearing" subset: a denylist
+ * has to be updated for each new credential and is wrong the moment someone
+ * forgets, whereas routing all of it through the file makes the guarantee hold by
+ * construction. Keys are filtered to valid shell identifiers for the same reason
+ * `env` needed it — an exported function (`BASH_FUNC_x%%`) is not assignable.
+ */
+export declare function writeTmuxEnvFile(env: NodeJS.ProcessEnv, filePath: string): void;
 /**
  * Trim a raw `tmux capture-pane` dump to its last `maxLines` non-empty lines
  * (right-stripping each). Used by runInTmux to recap a fast-failed agent's