@phnx-labs/agents-cli 1.22.23 → 1.22.25

package/dist/commands/doctor.d.ts

@@ -22,11 +22,35 @@
  * apply pending sync.
  */
 import type { Command } from 'commander';
+import { type DoctorFinding } from '../lib/devices/doctor-findings.js';
 import { type VersionResourceReport } from '../lib/doctor-diff.js';
 import { type DuplicateVersionHook } from '../lib/hooks.js';
 import { type SyncStatusRow, type OrphanRow } from '../lib/drift.js';
 import { type FetchStatusMarker } from '../lib/auto-pull.js';
 export declare function wrapLine(prefix: string, text: string, width?: number): string[];
+export declare function asRemoteSecretFindings(raw: unknown, device: string): DoctorFinding[];
+/**
+ * Fetch a device's harness inventory by running its top-level `agents doctor
+ * --json` (which carries the `fleet` field, RUSH-2027). Separate from
+ * {@link probeFleetTarget} — that forwards `teams doctor --json` for per-agent
+ * readiness, a different payload. Returns the parsed {@link FleetInventory} or
+ * null (unreachable, non-zero exit, unparseable, or an older CLI with no
+ * `fleet` field); a null is skipped by the comparator, never a false gap.
+ */
+/**
+ * How long one remote `doctor --json` probe may take.
+ *
+ * 180s, matching `ChildProcess.doctorTimeout`, which was set to 180 for this
+ * same command for this same reason. The previous 30s sat BELOW the command's
+ * real cost — 56s measured on `yosemite-m0`, 136s on an idle box — so every slow
+ * device silently contributed nothing at all: no inventory, no sign-in, no
+ * divergence, no secret findings. A ceiling under the true cost does not make a
+ * probe cheap, it makes it always fail.
+ *
+ * This does not multiply by device count: `fanOutDevices` is `Promise.all`, so
+ * whole-fleet wall time is bounded near the slowest box, not 180s x N.
+ */
+export declare const FLEET_INVENTORY_TIMEOUT_MS = 180000;
 export type IssueSeverity = 'critical' | 'warning' | 'info';
 /**
  * One triaged health finding. `severity`/`category`/`subject`/`impact`/`fix` are

package/dist/commands/doctor.js

@@ -8,7 +8,7 @@ import { enterDoctorOverviewGate, writeDoctorOverviewCache } from '../lib/device
 import { fleetDialTarget } from '../lib/devices/connect.js';
 import { compareFleetInventories } from '../lib/devices/fleet-divergence.js';
 import { collectLocalFleetInventory } from '../lib/devices/fleet-inventory.js';
-import { buildLocalFindings, fleetDivergenceToFindings, signInToFindings, renderFindings, } from '../lib/devices/doctor-findings.js';
+import { buildLocalFindings, fleetDivergenceToFindings, signInToFindings, renderFindings, remediationFor, FINDING_SEVERITY, } from '../lib/devices/doctor-findings.js';
 import { getCliVersion } from '../lib/version.js';
 import { resolveHost } from '../lib/hosts/registry.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
@@ -31,7 +31,7 @@ import { listCliStatus, listCliStatusAsync } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
 import { heal, healChangedAnything } from '../lib/heal.js';
 import { getEffectiveExecutionPolicy } from '../lib/platform/winpath.js';
-import { scanUserRcFiles } from '../lib/secrets/rc-hygiene.js';
+import { scanUserRcFiles, masterPassphraseInEnv } from '../lib/secrets/rc-hygiene.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
 import { readRepoBehindMarkers } from '../lib/auto-pull.js';
 import * as fs from 'fs';
@@ -80,6 +80,70 @@ function printWrappedLine(prefix, text) {
     for (const line of wrapLine(prefix, text))
         console.log(chalk.gray(line));
 }
+/**
+ * Narrow a remote `findings` array to the secret-hygiene rows, or `[]`.
+ *
+ * Deliberately NOT "forward every remote finding". The aggregator already
+ * rebuilds a remote's sign-in rows from its inventory and its divergence rows
+ * from the comparator, so forwarding wholesale would double them; and pulling a
+ * remote's orphan/drift rows into a fleet readout is a much larger UX change
+ * than this fix. The two secret kinds are the ones that are BOTH unrecomputable
+ * centrally and security-relevant, which is exactly why they were being lost.
+ *
+ * **The remote contributes exactly one thing: the KIND.** Severity, message and
+ * remediation are all generated HERE. That is not defensiveness for its own
+ * sake — the remote runs its own agents-cli, whose version and integrity we do
+ * not control, and each forwarded string is load-bearing in a different way:
+ *
+ *   - `remediation` is a command a human copies and runs. Accepting it from the
+ *     wire is an injection channel, full stop.
+ *   - `message` is the one place a secret VALUE could re-enter a readout that
+ *     otherwise guarantees it never prints one. A local builder cannot leak what
+ *     it never receives.
+ *   - `severity` decides the CRITICAL section, so a remote could otherwise
+ *     promote its own warning and bury real criticals under it.
+ *   - `device` is overwritten with the name we dialled, so no box can pin a
+ *     finding on another.
+ *
+ * The cost is detail: the fleet row says which box and which kind, not which
+ * file and line. Run `agents doctor` on that box for the specifics — the
+ * message says so.
+ */
+const REMOTE_FORWARDED_KINDS = ['rc-secret-export', 'env-secret-export'];
+/** Canonical, locally-authored text for a forwarded kind. Never the remote's. */
+const REMOTE_SECRET_MESSAGE = {
+    'rc-secret-export': 'a credential-shaped export was found in this box\'s shell rc files'
+        + ' — run `agents doctor` there for the file and line',
+    'env-secret-export': 'AGENTS_SECRETS_PASSPHRASE is set in this box\'s process environment'
+        + ' — run `agents doctor` there for detail',
+};
+export function asRemoteSecretFindings(raw, device) {
+    if (!Array.isArray(raw))
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const item of raw) {
+        if (!item || typeof item !== 'object' || Array.isArray(item))
+            continue;
+        const kind = item.kind;
+        if (typeof kind !== 'string')
+            continue;
+        if (!REMOTE_FORWARDED_KINDS.includes(kind))
+            continue;
+        if (seen.has(kind))
+            continue; // one row per kind per box
+        seen.add(kind);
+        const k = kind;
+        const base = {
+            severity: FINDING_SEVERITY[k],
+            kind: k,
+            device,
+            message: REMOTE_SECRET_MESSAGE[k],
+        };
+        out.push({ ...base, remediation: remediationFor({ ...base, remediation: '' }) });
+    }
+    return out;
+}
 async function resolveFleetTargets(opts) {
     const singleName = opts.host || opts.device;
     if (singleName) {
@@ -155,15 +219,32 @@ async function probeFleetTarget(target) {
  * null (unreachable, non-zero exit, unparseable, or an older CLI with no
  * `fleet` field); a null is skipped by the comparator, never a false gap.
  */
+/**
+ * How long one remote `doctor --json` probe may take.
+ *
+ * 180s, matching `ChildProcess.doctorTimeout`, which was set to 180 for this
+ * same command for this same reason. The previous 30s sat BELOW the command's
+ * real cost — 56s measured on `yosemite-m0`, 136s on an idle box — so every slow
+ * device silently contributed nothing at all: no inventory, no sign-in, no
+ * divergence, no secret findings. A ceiling under the true cost does not make a
+ * probe cheap, it makes it always fail.
+ *
+ * This does not multiply by device count: `fanOutDevices` is `Promise.all`, so
+ * whole-fleet wall time is bounded near the slowest box, not 180s x N.
+ */
+export const FLEET_INVENTORY_TIMEOUT_MS = 180_000;
 async function probeFleetInventory(target) {
     const isWin = /^win/i.test((target.os ?? '').trim());
     const remoteCmd = buildRemoteAgentsInvocation(['doctor', '--json'], undefined, isWin ? 'windows' : undefined, isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' });
-    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: 30000, multiplex: true });
+    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: FLEET_INVENTORY_TIMEOUT_MS, multiplex: true });
     if (res.code !== 0)
         return null;
     try {
         const parsed = JSON.parse(res.stdout);
-        return asFleetInventory(parsed.fleet);
+        return {
+            inventory: asFleetInventory(parsed.fleet),
+            secretFindings: asRemoteSecretFindings(parsed.findings, target.name),
+        };
     }
     catch {
         return null;
@@ -252,19 +333,22 @@ async function runDevicesDoctor(opts) {
         fanOutDevices(targets, probeFleetTarget),
         fanOutDevices(targets, probeFleetInventory),
     ]);
-    const inventoryByName = new Map();
+    const payloadByName = new Map();
     for (const r of inventoryResults)
-        inventoryByName.set(r.name, r.status === 'ok' ? (r.value ?? null) : null);
+        payloadByName.set(r.name, r.status === 'ok' ? (r.value ?? null) : null);
     results.push(...remoteResults.map((r) => {
-        const inventory = inventoryByName.get(r.name) ?? undefined;
+        const payload = payloadByName.get(r.name) ?? null;
+        const inventory = payload?.inventory ?? undefined;
+        const secretFindings = payload?.secretFindings;
         if (r.status === 'ok' && r.value)
-            return { ...r.value, inventory: inventory ?? undefined };
+            return { ...r.value, inventory, secretFindings };
         return {
             name: r.name,
             online: false,
             error: r.error ?? String(r.reason ?? 'skipped'),
             agents: {},
-            inventory: inventory ?? undefined,
+            inventory,
+            secretFindings,
         };
     }));
     // Cross-device divergence: compare every device's inventory against the local
@@ -314,6 +398,7 @@ async function runDevicesDoctor(opts) {
                 duplicateHooks: inspectDuplicateVersionHooks(cwd),
                 hostClis: toHostCliInput(listCliStatus(cwd)),
                 rcSecrets: scanUserRcFiles(),
+                masterPassphraseInEnv: masterPassphraseInEnv(),
                 execPolicy: process.platform === 'win32'
                     ? { platform: process.platform, policy: getEffectiveExecutionPolicy() }
                     : undefined,
@@ -335,6 +420,11 @@ async function runDevicesDoctor(opts) {
             });
             continue;
         }
+        // Secret hygiene the aggregator cannot see for itself — the remote's shell
+        // rc files and its process environment. Without this the fleet readout
+        // reports a leaking box as clean (RUSH-1968).
+        if (r.secretFindings?.length)
+            findings.push(...r.secretFindings);
         if (r.inventory?.signIn) {
             findings.push(...signInToFindings(r.name, r.inventory.signIn));
             accounts[r.name] = r.inventory.signIn;
@@ -848,6 +938,11 @@ function renderTargetText(report, options) {
         // sees what was checked. options.requestedKinds drives this.
         if (options.requestedKinds && !options.requestedKinds.has(kind))
             continue;
+        if (kind === 'hooks' && report.hookInventory) {
+            const wired = report.hookInventory.wiringSupported ? String(report.hookInventory.wired.length) : 'unknown';
+            const unmanaged = report.hookInventory.unmanaged.length > 0 ? ` · unmanaged ${report.hookInventory.unmanaged.length}` : '';
+            console.log(chalk.gray(`  inventory: capable ${report.hookInventory.capable ? 'yes' : 'no'} · on-disk ${report.hookInventory.onDisk.length} · wired ${wired}${unmanaged}`));
+        }
         renderKindSection(kind, rows, report.layers, options);
         // A hook file can reconcile "ok" above yet be absent from settings.json — a
         // present-but-dead hook. Surface that right under the hooks section.
@@ -1384,6 +1479,7 @@ export function registerDoctorCommand(program) {
                 duplicateHooks,
                 hostClis: toHostCliInput(hostClis),
                 rcSecrets: scanUserRcFiles(),
+                masterPassphraseInEnv: masterPassphraseInEnv(),
                 // getEffectiveExecutionPolicy spawns powershell — a doomed process on
                 // POSIX, where the advisory never applies. Probe only on Windows.
                 execPolicy: process.platform === 'win32'

package/dist/commands/exec.js

@@ -532,7 +532,7 @@ export function registerRunCommand(program) {
         .option('--headless', 'Force headless mode. Auto-enabled when a prompt is provided; pass explicitly to stay headless with no prompt (reads the prompt from stdin).', false)
         .option('--no-auth-check', 'Skip the pre-launch "looks logged out" warning on an interactive run (advisory; never blocks anyway). Also silenced by AGENTS_NO_AUTH_CHECK=1.')
         .option('-i, --interactive', 'Force interactive mode even when a prompt is provided. Mutually exclusive with --headless.')
-        .option('--resume [id]', 'Resume a previous conversation. Full IDs resolve locally first, then fleet-wide. Claude, Codex, Grok, Kimi, Droid, and Cursor use version-gated native resume; other agents replay via /continue. Pair with a prompt to continue headlessly.')
+        .option('--resume [id]', 'Recover a previous conversation on its origin device. The exact healthy origin uses native resume; otherwise a healthy version of the same harness replays via /continue. Pair with a prompt to continue headlessly.')
         .option('--session-id <id>', 'Force a NEW conversation to use this exact session UUID (Claude only). This CREATES a session — to resume an existing one, use --resume.')
         .option('--name <slug>', 'Name the run — seeds the session label so it shows up as `<name>` in `agents sessions` and resolves by it (and `agents hosts logs <name>` for --host runs) instead of an opaque id. An agent-generated title later refines the label; your name shows until then. Optional.')
         .option('--notify', 'Post a desktop notification when a headless run finishes. Fired by this process on exit, so it survives whatever launched the run (the menu bar dispatching it, a terminal you closed).')
@@ -568,8 +568,8 @@ export function registerRunCommand(program) {
         .option('--bare', 'With --lease, skip copying your local ~/.agents setup (skills/hooks/commands/MCP) onto the box.')
         .option('--tailscale', 'Lease the box onto your tailnet (reachable only over Tailscale) rather than a public IP.')
         .option('--no-tailscale', 'Force a public-IP lease even when a reuse context would default to Tailscale.')
-        .option('--cloud', 'Vendor cloud placement: dispatch to the agent\'s native cloud (claude→rush, codex→codex, droid→factory, antigravity→antigravity) and stream the result. Same dispatch as `agents cloud run --agent <agent>`; tracked by `agents cloud list/status/logs`. Same as --where cloud. Mutually exclusive with --host/--lease and local-run flags.')
-        .option('--provider <id>', 'With --cloud: override the agent\'s native cloud provider (rush | codex | factory | antigravity | host).')
+        .option('--cloud', 'Vendor cloud placement: dispatch to the agent\'s native cloud (claude→rush, codex→codex, cursor→cursor, droid→factory, antigravity→antigravity) and stream the result. Same dispatch as `agents cloud run --agent <agent>`; tracked by `agents cloud list/status/logs`. Same as --where cloud. Mutually exclusive with --host/--lease and local-run flags.')
+        .option('--provider <id>', 'With --cloud: override the agent\'s native cloud provider (rush | codex | cursor | factory | antigravity | host).')
         .option('--repo <owner/repo>', 'With --cloud: GitHub repository. Repeatable for multi-repo dispatch (Rush Cloud only).', (val, prev) => [...prev, val], [])
         .option('--branch <name>', 'With --cloud: target git branch.')
         .option('--cloud-env <id>', 'With --cloud: Codex Cloud environment ID (run\'s --env is the KEY=VAL passthrough, so the cloud env id gets its own flag).');
@@ -647,16 +647,18 @@ export function registerRunCommand(program) {
       agents run claude "fix the bug" -- --custom-flag
     `,
         notes: `
-      Modes (not every agent supports every mode — check agents.yaml capabilities):
+      Modes (not every agent supports every mode — run \`agents modes <agent>\`):
         plan  read-only investigation; no writes, no shell side-effects
         edit  may edit files; prompts for shell / risky operations
         auto  smart classifier auto-approves safe ops, prompts for risky (claude, copilot)
         skip  bypass every permission prompt (dangerously-skip-permissions)
         Legacy 'full' is silently rewritten to 'skip'.
+        List per-harness support + native flags: agents modes · agents modes claude
+        Models (cheap|default|best|ultra): agents models <agent[@version]>
 
       Headless plan support (a prompt makes the run headless):
-        plan works headless on claude, codex, droid, opencode.
-        kimi, grok, cursor, antigravity have no headless plan mode — a headless
+        plan works headless on claude, codex, cursor, droid, opencode.
+        kimi, grok, antigravity have no headless plan mode — a headless
         --mode plan auto-downgrades to --mode auto (with a stderr warning).
         Interactive plan (omit the prompt) works everywhere it is listed.
 
@@ -689,7 +691,7 @@ export function registerRunCommand(program) {
         given. --cloud is mutually exclusive with --host/--lease and with
         local-run flags (--loop, --resume, --secrets, --terminal, …).
 
-      Resume: --resume <id> resolves full IDs locally first, then fleet-wide, and restores the source version/device/mode. Claude, Codex, Grok, Kimi, Droid, and Cursor use version-gated native resume; others replay via /continue. agents resume <id> infers the harness too.
+      Resume: --resume <id> resolves full IDs locally first, then fleet-wide, and recovers on the source device with its cwd/mode. The exact healthy origin version uses native resume; otherwise a healthy version of the same harness replays via /continue. agents resume <id> infers the harness too.
 
       Passthrough: everything after -- is forwarded verbatim to the underlying agent CLI.
         agents run kimi -- --plan --some-native-flag value
@@ -835,6 +837,7 @@ export function registerRunCommand(program) {
         }
         let autoHarnessRequested = normalizedAgentSpec === RUN_AUTO_KEYWORD;
         let resolvedResumeSource;
+        let resolvedRecoveryTarget;
         // Concrete resume ids resolve BEFORE placement. Full UUIDs take the local
         // SQLite fast path; only a local miss fans out to the fleet. This lets a
         // command entered on zion discover that the owning version-home is on a
@@ -890,32 +893,40 @@ export function registerRunCommand(program) {
                     process.stderr.write(chalk.yellow(`[agents] session ${resolvedResumeSource.shortId} predates stored launch modes; using --mode ${options.mode}\n`));
             }
             const { machineId } = await import('../lib/machine-id.js');
+            const { sessionRecoveryDestinationMatches, sessionRecoveryPeer, } = await import('../lib/session/recovery.js');
             const sourceMachine = resolvedResumeSource.machine;
+            const sourcePeer = sessionRecoveryPeer(resolvedResumeSource);
             const explicitPlacement = hostTargetGiven(options).length > 0;
-            if (sourceMachine && sourceMachine !== machineId() && !explicitPlacement) {
-                options.host = sourceMachine;
+            if (sourcePeer && !explicitPlacement) {
+                options.host = sourcePeer;
             }
-            else if (!autoHarnessRequested && sourceMachine && sourceMachine !== machineId() && explicitPlacement && !hostTargetGiven(options).includes(sourceMachine)) {
-                console.error(chalk.red(`Strict resume must run on ${sourceMachine}, where session ${resolvedResumeSource.shortId} is owned. ` +
-                    `Use agents run auto --resume ${resolvedResumeSource.id} to hand off elsewhere.`));
+            else if (sourcePeer && explicitPlacement && !hostTargetGiven(options).some((host) => sessionRecoveryDestinationMatches(resolvedResumeSource, host))) {
+                console.error(chalk.red(`Session ${resolvedResumeSource.shortId} must recover on ${sourcePeer}, where its indexed transcript and version history are owned; ` +
+                    `the requested device was ${hostTargetGiven(options).join(', ')}.`));
                 process.exit(1);
             }
-            // On the owning machine, `auto` first asks the existing account router
-            // whether the exact source version is healthy. If it is, native resume
-            // wins. If not, keep `auto` so the normal harness/account router selects
-            // a healthy local target and the later resume block performs /continue.
-            if (autoHarnessRequested && (!sourceMachine || sourceMachine === machineId())) {
-                const sourceAgent = resolvedResumeSource.agent;
-                if (sourceAgent in AGENTS && resolvedResumeSource.version) {
-                    const { resolveRunVersion } = await import('../lib/rotate.js');
-                    const health = await resolveRunVersion(sourceAgent, 'available', resolvedResumeSource.cwd ?? process.cwd());
-                    if (!health.exhausted && health.version === resolvedResumeSource.version) {
-                        normalizedAgentSpec = `${sourceAgent}@${resolvedResumeSource.version}`;
-                        autoHarnessRequested = false;
-                        if (!options.quiet)
-                            process.stderr.write(chalk.gray(`[agents] auto resume → native ${normalizedAgentSpec} on ${sourceMachine ?? machineId()}\n`));
-                    }
+            // Recovery is resolved on the device that owns the transcript. A remote
+            // dispatch is pinned to the source HARNESS (not `run auto`'s cross-harness
+            // picker); the peer repeats this block with the injected SessionMeta and
+            // chooses its own healthy version. Locally, resolve it now.
+            const sourceAgent = resolvedResumeSource.agent;
+            if (!sourcePeer) {
+                try {
+                    const { resolveSessionRecovery } = await import('../lib/session/recovery.js');
+                    resolvedRecoveryTarget = await resolveSessionRecovery(resolvedResumeSource);
+                }
+                catch (err) {
+                    console.error(chalk.red(err.message));
+                    process.exit(1);
                 }
+                normalizedAgentSpec = `${resolvedRecoveryTarget.agent}@${resolvedRecoveryTarget.version}`;
+                autoHarnessRequested = false;
+                if (!options.quiet)
+                    process.stderr.write(chalk.gray(`[agents] session recovery → ${resolvedRecoveryTarget.mode} ${normalizedAgentSpec} on ${sourceMachine ?? machineId()} · ${resolvedRecoveryTarget.reason}\n`));
+            }
+            else if (autoHarnessRequested) {
+                normalizedAgentSpec = sourceAgent;
+                autoHarnessRequested = false;
             }
         }
         if (autoHarnessRequested) {
@@ -1008,19 +1019,21 @@ export function registerRunCommand(program) {
             const leaseSecretsBundle = process.env.AGENTS_LEASE_SECRETS_BUNDLE;
             const nowSecs = Math.floor(Date.now() / 1000);
             let reuseSlug = options.box;
-            // The profile this run's pool/box carries: the repo's .crabbox.yaml
-            // `profile:` when declared (what crabbox warmup would label a fresh box
-            // with), else crabbox's default. Passing it to leaseAndRun makes the
-            // pool-reuse match interchangeable with a fresh warmup.
+            // Lease runs share one default warm pool across repositories. The generic
+            // `.crabbox.yaml profile:` remains available to repo sandbox/CI scripts;
+            // `leaseProfile:` is the explicit opt-in for a dedicated lease hot box.
             const repoRoot = gitToplevel(leaseCwd);
-            const { readCrabboxRepoProfile } = await import('../lib/crabbox/config.js');
-            const poolProfile = repoRoot ? readCrabboxRepoProfile(repoRoot) : undefined;
+            const { readCrabboxLeaseProfile } = await import('../lib/crabbox/config.js');
+            const poolProfile = repoRoot ? readCrabboxLeaseProfile(repoRoot) : 'default';
             if (options.lease && !reuseSlug && !options.fresh) {
-                const { crabboxList } = await import('../lib/crabbox/cli.js');
-                const { reusableBoxes, formatBoxRow } = await import('./lease.js');
+                const { crabboxList, poolReusableBoxes } = await import('../lib/crabbox/cli.js');
+                const { formatBoxRow } = await import('./lease.js');
                 let warm = [];
                 try {
-                    warm = reusableBoxes(crabboxList({ secretsBundle: leaseSecretsBundle }), nowSecs);
+                    warm = poolReusableBoxes(crabboxList({ secretsBundle: leaseSecretsBundle }), {
+                        profile: poolProfile,
+                        nowSecs,
+                    });
                 }
                 catch {
                     warm = []; // crabbox unavailable / no creds → the pool check in leaseAndRun decides
@@ -1091,7 +1104,7 @@ export function registerRunCommand(program) {
                 }
             }
             const { detectSignedInRuntimes, resolveClaudeCredentialsBlob, inferLeaseRuntime, profileNeedsBaseRuntimeCredentials } = await import('../lib/crabbox/runtimes.js');
-            const { leaseAndRun } = await import('../lib/crabbox/lease.js');
+            const { leaseAndRun, leaseWorkspaceId } = await import('../lib/crabbox/lease.js');
             const { boxAddress } = await import('./lease.js');
             const { getConfiguredRunStrategy, resolveRunVersion } = await import('../lib/rotate.js');
             const { profileExists, readProfile, resolveProfileEnv } = await import('../lib/profiles.js');
@@ -1186,7 +1199,7 @@ export function registerRunCommand(program) {
                     ? 'the box is kept after the run'
                     : options.fresh
                         ? 'the box is destroyed after the run'
-                        : 'a fresh box is destroyed after the run; a reused pool box is kept';
+                        : 'the shared-pool box is kept after the run';
             console.error(chalk.gray(`${boxLifecycle} · shipping ${whatShips}${credentialRuntimes.length > 0 && leaseEmail ? ` (${leaseEmail})` : ''}; ${boxAfterRun}.`));
             // Read the Claude OAuth token from the local Keychain (silent) so it can be
             // written to ~/.claude/.credentials.json on the box — otherwise Claude boots
@@ -1268,6 +1281,7 @@ export function registerRunCommand(program) {
                     reuseBox: reuseSlug,
                     fresh: options.fresh,
                     profile: poolProfile,
+                    workspaceId: leaseWorkspaceId(repoRoot ?? leaseCwd),
                     copySetup,
                     netMode,
                     onData: (chunk) => router.push(chunk),
@@ -2217,10 +2231,44 @@ export function registerRunCommand(program) {
                 session = picked.session;
                 forceInteractive = true; // bare resume always lands in the agent's TUI
             }
-            // Native resume is valid only for the source harness + exact isolated
-            // version. `auto` may have selected another healthy harness/account; in
-            // that case keep the target version and hand off through /continue.
-            const canResumeNatively = session.agent === agent && nativeResume(agent, session.version);
+            // Bare `run <harness> --resume` learns the chosen SessionMeta only after
+            // the host-placement phase above. If the picker chose a synced session
+            // from another device, route the recovery command now; resolving local
+            // candidates would otherwise native-resume through this device's
+            // unrelated isolated home.
+            if (!resolvedResumeSource) {
+                const { sessionRecoveryPeer, sessionRecoveryRunArgs, } = await import('../lib/session/recovery.js');
+                const peer = sessionRecoveryPeer(session);
+                if (peer) {
+                    const { runOnPeer } = await import('../lib/session/remote-list.js');
+                    const routed = await runOnPeer(sessionRecoveryRunArgs(session), peer, { tty: true });
+                    if (routed === 'no-target') {
+                        console.error(chalk.red(`Cannot recover session ${session.shortId}: origin device ${peer} is not a registered reachable peer.`));
+                        process.exitCode = 1;
+                    }
+                    return;
+                }
+            }
+            // Bare interactive --resume selects the SessionMeta only down here, so
+            // it has not gone through the early concrete-id resolver. Resolve it now;
+            // concrete ids reuse the exact same target chosen above.
+            if (!resolvedRecoveryTarget) {
+                try {
+                    const { resolveSessionRecovery } = await import('../lib/session/recovery.js');
+                    resolvedRecoveryTarget = await resolveSessionRecovery(session);
+                }
+                catch (err) {
+                    console.error(chalk.red(err.message));
+                    process.exit(1);
+                }
+            }
+            if (resolvedRecoveryTarget.agent !== agent) {
+                console.error(chalk.red(`Session ${session.shortId} belongs to ${resolvedRecoveryTarget.agent}, not ${agent}. ` +
+                    `Use: agents run auto --resume ${session.id}`));
+                process.exit(1);
+            }
+            version = resolvedRecoveryTarget.version;
+            const canResumeNatively = resolvedRecoveryTarget.mode === 'native';
             if (canResumeNatively) {
                 version = session.version;
                 resumeNative = true;
@@ -2330,6 +2378,12 @@ export function registerRunCommand(program) {
                     console.error(chalk.red(`agents: ${agent}@${launchTarget} is not runnable and could not be repaired. Try: ${hint}`));
                     process.exit(1);
                 }
+                if (resolvedRecoveryTarget && healed !== launchTarget) {
+                    console.error(chalk.red(`agents: session recovery target ${agent}@${launchTarget} became unavailable on ` +
+                        `${resolvedResumeSource?.machine ?? 'this device'}; refusing to resume through another version home. ` +
+                        `Retry the command so recovery can select a healthy ${agent} version.`));
+                    process.exit(1);
+                }
                 // Always adopt the healed version explicitly. In the version-undefined
                 // path a fallback re-pins the GLOBAL default, but `resolveVersion`
                 // prefers a PROJECT pin — so leaving `version` undefined would let the
@@ -2404,7 +2458,7 @@ export function registerRunCommand(program) {
             process.exit(1);
         }
         // Default CLI mode is the generic 'plan'. Agents without a read-only
-        // mode (antigravity, cursor, kiro, …) degrade via resolveMode to their
+        // mode (antigravity, kiro, …) degrade via resolveMode to their
         // safest native mode (modes[0], typically edit). That covers both the
         // implicit default and an explicit `--mode plan`, so multi-agent
         // scripts can pass a uniform plan flag without per-agent branching.
@@ -2447,7 +2501,8 @@ export function registerRunCommand(program) {
             console.error(chalk.gray(`Pass --mode plan explicitly if you really want a read-only run.`));
             process.exit(1);
         }
-        const effort = options.effort;
+        const effortSource = runCmd.getOptionValueSource('effort');
+        const effort = (effortSource === 'default' && runDefaults.effort ? runDefaults.effort : options.effort);
         if (!['low', 'medium', 'high', 'xhigh', 'max', 'auto'].includes(effort)) {
             console.error(chalk.red(`Invalid effort: ${effort}. Use 'low', 'medium', 'high', 'xhigh', 'max', or 'auto'`));
             process.exit(1);

package/dist/commands/feed.d.ts

@@ -42,6 +42,8 @@ export declare function prepareLocalFeedBlocks(localBlocks: OpenBlock[], opts: {
     dispatch: OpenBlock[];
     filter: ReturnType<typeof filterBlocksForFeed>;
 };
+/** Specific host app + routine provenance for one feed row. */
+export declare function formatFeedRuntime(block: Pick<OpenBlock, 'runtime' | 'origin' | 'routineName'>): string;
 /** Human summary line for one outcome rollup. */
 export declare function formatOutcomeHeader(group: OutcomeGroup): string;
 /** Map active sessions into the lightweight hints outcome enrichment needs. */
@@ -59,7 +61,28 @@ export declare function sessionHintsFromActive(sessions: Array<{
     worktree?: {
         slug?: string;
     };
+    host?: string;
+    origin?: 'cli' | 'routine';
+    routineName?: string;
 }>): SessionOutcomeHint[];
+/**
+ * True when a SQLite open/query failed because another writer holds the lock.
+ * better-sqlite3 surfaces this as message "database is locked" and/or code
+ * SQLITE_BUSY (RUSH-2006).
+ */
+export declare function isSqliteBusyError(err: unknown): boolean;
+/**
+ * Load session metas for feed outcome enrichment. The sessions index can be
+ * locked by a concurrent scanner/daemon — enrichment is best-effort, so a lock
+ * degrades to an empty list instead of crashing `agents feed` (RUSH-2006).
+ *
+ * `load` is injected so tests can throw a real lock-shaped error without
+ * mocking the session module.
+ */
+export declare function loadSessionMetasForFeedEnrichment<T>(load: () => Promise<T[]>): Promise<{
+    metas: T[];
+    skippedLock: boolean;
+}>;
 export declare function registerFeedCommand(program: Command): void;
 /** Feed view selector (RUSH-2015): decisions, progress, or both. */
 export type FeedFilter = 'needs' | 'updates' | 'all';

package/dist/commands/feed.js

@@ -16,6 +16,7 @@ import { notifyUrgentBlock } from '../lib/notify.js';
 import { gcMailbox } from '../lib/mailbox-gc.js';
 import { isValidMailboxId } from '../lib/mailbox.js';
 import { getActiveSessions } from '../lib/session/active.js';
+import { backfillActiveRowsFromMeta } from './sessions.js';
 import { mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { GLYPH, masthead } from '../lib/comms-render.js';
 import { discoverSessions } from '../lib/session/discover.js';
@@ -154,7 +155,7 @@ export function prepareLocalFeedBlocks(localBlocks, opts) {
 }
 function renderBlock(b, localHost, indent = '') {
     const host = b.host !== localHost ? chalk.yellow(` [${b.host}]`) : '';
-    const runtime = chalk.gray(b.runtime);
+    const runtime = chalk.gray(formatFeedRuntime(b));
     const age = chalk.gray(relTime(b.ts));
     const cls = b.blockClass ? chalk.gray(`(${b.blockClass})`) : '';
     const consequence = b.consequence && b.consequence !== 'normal' ? chalk.red(`[${b.consequence}]`) : '';
@@ -218,6 +219,21 @@ function renderBlock(b, localHost, indent = '') {
     }
     console.log();
 }
+/** Specific host app + routine provenance for one feed row. */
+export function formatFeedRuntime(block) {
+    const host = {
+        ghostty: 'Ghostty',
+        iterm: 'iTerm',
+        terminal: 'terminal',
+        kitty: 'Kitty',
+        codium: 'VSCodium',
+        code: 'VS Code',
+        cursor: 'Cursor',
+    }[block.runtime.toLowerCase()] ?? block.runtime;
+    if (block.origin !== 'routine')
+        return host;
+    return `${host} · routine${block.routineName ? `:${block.routineName}` : ''}`;
+}
 /** Human summary line for one outcome rollup. */
 export function formatOutcomeHeader(group) {
     const { agents, open, answered, parked } = group.counts;
@@ -251,8 +267,44 @@ export function sessionHintsFromActive(sessions) {
         prUrl: s.pr?.url,
         worktreeSlug: s.worktree?.slug,
         project: s.cwd ? projectKeyFromCwd(s.cwd) : undefined,
+        host: s.host,
+        origin: s.origin,
+        routineName: s.routineName,
     }));
 }
+/**
+ * True when a SQLite open/query failed because another writer holds the lock.
+ * better-sqlite3 surfaces this as message "database is locked" and/or code
+ * SQLITE_BUSY (RUSH-2006).
+ */
+export function isSqliteBusyError(err) {
+    if (err == null)
+        return false;
+    const msg = err instanceof Error ? err.message : String(err);
+    const code = typeof err === 'object' && err !== null && 'code' in err
+        ? String(err.code ?? '')
+        : '';
+    return /SQLITE_BUSY|database is locked/i.test(msg) || /SQLITE_BUSY/i.test(code);
+}
+/**
+ * Load session metas for feed outcome enrichment. The sessions index can be
+ * locked by a concurrent scanner/daemon — enrichment is best-effort, so a lock
+ * degrades to an empty list instead of crashing `agents feed` (RUSH-2006).
+ *
+ * `load` is injected so tests can throw a real lock-shaped error without
+ * mocking the session module.
+ */
+export async function loadSessionMetasForFeedEnrichment(load) {
+    try {
+        return { metas: await load(), skippedLock: false };
+    }
+    catch (err) {
+        if (isSqliteBusyError(err)) {
+            return { metas: [], skippedLock: true };
+        }
+        throw err;
+    }
+}
 export function registerFeedCommand(program) {
     const feed = program
         .command('feed')
@@ -446,7 +498,18 @@ export function registerFeedCommand(program) {
         if (includeLocal) {
             sessions = await getActiveSessions();
         }
-        const sessionMetas = includeLocal && sessions.length > 0 ? await discoverSessions({ all: true, limit: 5000 }) : [];
+        // discoverSessions touches sessions.db; under concurrent scan pressure it
+        // can throw SQLITE_BUSY. Outcome enrichment is best-effort — degrade with
+        // a warning rather than crash the whole feed (RUSH-2006).
+        let sessionMetas = [];
+        if (includeLocal && sessions.length > 0) {
+            const loaded = await loadSessionMetasForFeedEnrichment(() => discoverSessions({ all: true, limit: 5000 }));
+            if (loaded.skippedLock) {
+                console.error(chalk.yellow('Feed: session index is locked; skipping local outcome enrichment'));
+            }
+            sessionMetas = loaded.metas;
+            backfillActiveRowsFromMeta(sessions, new Map(sessionMetas.map((meta) => [meta.id, meta])));
+        }
         const localSignals = buildSessionSignals(sessions, sessionMetas);
         if (opts.pause || opts.kill) {
             if (!includeLocal) {