@phnx-labs/agents-cli 1.22.24 → 1.22.25

package/CHANGELOG.md

@@ -1,7 +1,173 @@
 # Changelog
 
+## 1.22.25
+
+---
+issue: 2108
+type: fixed
+---
+
+`agents sessions focus ... --active` now excludes closed and crashed registry rows; explicit lifecycle filters such as `--closed` and `--crashed` still select them. Per-device `latest` / `oldest` selectors also wait for the peer's filtered index result instead of widening to live rows whose version is unknown.
+
+- **`agents doctor` now reports the file-store master key when it is live in the
+  process environment, not just when it is exported from a shell rc file
+  (RUSH-1968).** `rc-hygiene.ts` scans FILES, which leaves a real hole: a value
+  inherited by a long-lived process outlives the rc line that set it, so an operator
+  who deletes `~/.zshenv:8` gets a clean `rc-secret-export` while every shell, editor
+  and agent started before the edit still carries the key and hands it to everything
+  they spawn. Confirmed on `yosemite-s1`, which has zero rc exports and still had the
+  value in its environment. The new `env-secret-export` warning names that state and
+  says the deletion is not sufficient; like every other finding it reports only that
+  the variable is set, never its value. Expected inside a release sign context
+  (`headless-sign-context.sh` sets it deliberately), which the message says so an
+  operator on the home base does not chase it. Source:
+  `apps/cli/src/lib/secrets/rc-hygiene.ts` (`masterPassphraseInEnv`),
+  `apps/cli/src/lib/devices/doctor-findings.ts`, `apps/cli/src/commands/doctor.ts`.
+
+- **`agents doctor --devices` now reports a remote box's secret hygiene, and its
+  inventory probe no longer times out on a slow box (RUSH-1968).** The fan-out ran
+  each remote's own `doctor --json` but parsed only `.fleet`, discarding the
+  `findings` the remote had already computed — so a leaking box read as clean from
+  anywhere but itself. The remote's `rc-secret-export` / `env-secret-export` rows
+  now ride back, but the remote contributes exactly one thing: the **kind**. Severity,
+  message and remediation are generated locally, and `device` is overwritten with the
+  name that was dialled. Each of those matters separately — a remediation is a command
+  a human copies and runs, a message is the one place a secret value could re-enter a
+  readout that otherwise never prints one, a severity decides the CRITICAL section, and
+  a device name decides which box gets blamed. The cost is detail: the fleet row names
+  the box and the kind, and says to run `agents doctor` there for the file and line.
+  Only those two kinds forward — sign-in and divergence rows are recomputed centrally
+  and would otherwise double.
+
+  Separately, the probe's 30s timeout was below the real cost of the command it
+  runs — `doctor --json` measures 57s on `yosemite-m0` and 136s on an idle box — so
+  every slow device silently contributed nothing at all: no inventory, no sign-in,
+  no divergence. Raised to 180s, matching `ChildProcess.doctorTimeout`, which was set
+  to 180 for this same command for this same reason. Source:
+  `apps/cli/src/commands/doctor.ts` (`asRemoteSecretFindings`, `probeFleetInventory`).
+
+- **Feed and menu-bar session counts now use the `agents sessions --active` lifecycle model (RUSH-1993).**
+  Feed outcome headers count distinct mailbox agents in every state, so repeated
+  open blocks from one agent cannot make `needs you` exceed `agents`. Feed rows
+  replace generic `terminal` with a known host app and label routine-spawned
+  sessions as `routine:<name>`. The menu-bar snapshot backfills the same routine
+  metadata as active-session JSON and renders the full canonical status set
+  (`working`, `waiting`, `idle`, `queued`, `orphan`, `crashed`, `closed`,
+  `abandoned`, `unknown`) without reclassifying warm rows from attention files.
+  Source: `apps/cli/src/commands/feed.ts`, `apps/cli/src/commands/sessions.ts`,
+  `apps/cli/src/lib/feed-outcome.ts`, `apps/cli/src/lib/menubar/snapshot.ts`,
+  `apps/cli/menubar/Sources/MenubarHelper/{LocalState,StatusItemController}.swift`.
+
+- **A typo'd command with `--host` said the opposite of the truth (RUSH-2022).** The
+  `--host`/`--device` router runs before commander parses, so `agents session resume
+  --host <box>` (one letter off `sessions`, which *does* accept `--host`) reported
+  ``  `agents session` does not support --host/--device `` — a true statement about a
+  command nobody typed. Unknown names now fall through to `unknown command '<name>'`
+  with a did-you-mean, and the spellcheck can suggest the lazily-registered groups
+  (`sessions`/`teams`/`cloud`/…) it previously could not see. A real command with no
+  remote semantics still gets the flag-support error. Source:
+  `apps/cli/src/lib/hosts/passthrough.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **`agents publish` is in the lazy command table.** `commands/packages.ts` registers it
+  at top level but the registry did not list it, so it only resolved through the
+  unknown-command fallback that loads the whole command tree. Found by the new test
+  that pins the command-name set against the real tree.
+
+- **A mistyped command keeps its `--host`.** The distance-1 auto-correct now re-checks
+  routing after correcting the name, so `agents docto --host <box>` corrects to
+  `doctor` **and actually routes to `<box>`** — previously the corrected command
+  re-parsed locally with a `--host` it silently dropped (a regression caught in review:
+  it used to fail loudly with the wrong message, corrected-but-unrouted made it fail
+  silently instead). `apps/cli/src/index.ts`.
+
+- **Cursor now supports `--mode plan` headless and interactive (RUSH-2101).** The
+  capability registry previously listed only `edit` and `skip`, so `agents run cursor --mode plan`
+  and routine jobs silently degraded to writable `edit`. `cursor-agent` has supported `--plan`
+  since the 2026-01-16 CLI release; the registry, `AGENT_COMMANDS` flag mapping, and the routine
+  runner now forward it correctly. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/exec.ts`,
+  `apps/cli/src/lib/runner.ts`.
+
+- **`agents sessions resume` picker now filters in-memory on every keystroke instead of re-querying the database (RUSH-2212).** The `filter` callback in the multi-select picker was calling `filterSessionsByQuery`, which runs a full-text search scan against `sessions.db` on every character typed. It now uses the same cheap in-memory substring match (`sessionMatchesQuery`) the session browser already applies, so the picker stays responsive regardless of library size. Source: `apps/cli/src/commands/sessions-resume.ts`.
+
+---
+type: minor
+---
+
+Add Cursor Cloud Agents as a native cloud provider so `agents run cursor --cloud` and `agents cloud run --agent cursor` dispatch through Cursor's v1 REST API, with status, streaming, cancellation, and follow-up runs.
+
+- **A starved `coreauthd` can no longer hang `secrets list` forever (RUSH-2233).**
+  The keychain helper's `list` runs two passes, and the data-protection pass omits
+  `kSecUseAuthenticationUI: …Fail` on purpose (that flag drops every biometry-ACL
+  item even when authentication is healthy). Omitting it means the query still
+  reaches LocalAuthentication/`coreauthd`, which has no deadline of its own — a
+  wedged `coreauthd` left `SecItemCopyMatching` blocked for the life of the
+  process. That is *why* helpers accumulated for the bounded-spawn + reaper work
+  in RUSH-2231/2232 to clean up. The pass now runs on a background thread behind
+  a 3-second wait: on timeout the helper logs one line to stderr, skips the pass,
+  and prints whatever the file-keychain pass produced — the same handling the
+  screen-locked `errSecInteractionNotAllowed` case already got. Set
+  `AGENTS_KEYCHAIN_LIST_TIMEOUT_MS` to override the deadline;
+  `AGENTS_KEYCHAIN_BOUNDED_TEST=1` runs the helper's headless self-test for the
+  bounded wait. Source: `apps/cli/src/lib/secrets/keychain-helper.swift`.
+
+- **Use one three-minute AGI Menu snapshot and one watchdog executor (RUSH-2260).**
+  The menu bar now reads routines, 40 indexed recent sessions, the daemon-warmed
+  active-session cache, and persisted watchdog state in one subprocess every three
+  minutes; `doctor --json` remains independently limited to 15 minutes. The menu no
+  longer executes watchdog ticks. The daemon is the sole automatic watchdog executor,
+  warms active sessions on the same three-minute cadence, is gated by device-local
+  `watchdog.enabled`, and cleans failed/timeout routine process groups that are still
+  alive before they can overlap a replacement run. Source:
+  `apps/cli/src/lib/menubar/snapshot.ts`, `apps/cli/src/lib/daemon.ts`,
+  `apps/cli/src/lib/routine-process-cleanup.ts`.
+
+- **Add Warp Agent CLI (Oz) as a harness (RUSH-2261).** `warp` is now a
+  first-class harness: `agents add warp`, `agents run warp`, `agents teams add
+  <team> warp`, resource sync, and `agents view` all work. The CLI command is
+  `oz` (the shared Warp binary); install is self-updating via
+  `brew install --cask oz` (macOS) / `oz-stable` apt|yum|pacman (Linux), config
+  lives under `~/.warp/`, the rules/context file is `AGENTS.md`, and auth is
+  `oz login` (browser OAuth) or a `WARP_API_KEY` token for headless/CI.
+  Capabilities are truthful and gated by `supports()`: MCP (Claude
+  `.mcp.json` schema at `~/.warp/.mcp.json`, stdio + http with headers) and
+  skills are on; hooks, allowlist, commands, plugins, subagents, workflows, and
+  memory are off (Oz exposes no matching install surface). Sessions are not
+  indexed — Oz stores conversations server-side (retrieved with auth via
+  `oz run conversation get <id>`), so there is no local transcript for
+  `agents sessions`. No usage bar — Oz exposes no usage/limits endpoint.
+  Source: `apps/cli/src/lib/{agents,exec,mcp}.ts`.
+
+`scripts/release.sh` now runs orchestration in a fresh release-owned worktree, so a dirty shared checkout or feature branch no longer blocks or contaminates a release.
+
+- **Plugin discovery warns instead of silently skipping a directory with no
+  `.claude-plugin/plugin.json` (RUSH-2270).** A `plugins/<name>/` directory missing
+  (or with a malformed) manifest was invisible to `agents plugins list`/`info`/`sync`,
+  `agents doctor`, and the marketplace materialize-into-version-homes step, with zero
+  diagnostic anywhere in the chain — no `agents sync`/`agents repo pull` could
+  surface it, since discovery dropped it before any of those ran. Found via a real
+  case: the `work` plugin merged to `phnx-labs/.agents-system` without its manifest
+  and sat invisible for a full merge cycle; the same fix run against this box's own
+  `~/.agents/plugins/duck` found it missing one too. `discoverPluginsInDir` now
+  writes one `agents-cli:` warning to stderr naming the directory and the missing
+  manifest path, matching the existing advisory-not-fatal pattern
+  `syncMarketplaceManifest` already uses for a malformed (as opposed to missing)
+  manifest. Source: `apps/cli/src/lib/plugins.ts`.
+
+- **Muse login is recognized under `providers.meta` (balanced no longer signed_out).**
+  Live `muse login` writes `~/.config/muse/auth.json` as
+  `{ schema_version, providers: { meta: { access_token, user_email, … } } }`.
+  The presence detector only walked one object level, so it never saw the token
+  under `providers.meta` and reported signed-out after a successful OAuth —
+  `agents run muse` under balanced then failed with "excluded: 0.1.0
+  (signed_out)". Detection now recurses into nested provider slots and surfaces
+  `user_email` when present. Source: `apps/cli/src/lib/agents.ts`.
+
+- **File-backed secret resolution now fails on decryption errors instead of treating unreadable ciphertext as an absent value (RUSH-2264).** A wrong `AGENTS_SECRETS_PASSPHRASE` or tampered encrypted value now reports the affected file-store item and stops before launching a consumer with an empty secret such as `HCLOUD_TOKEN`. Source: `apps/cli/src/lib/secrets/filestore.ts`, `apps/cli/src/lib/secrets/bundles.ts`.
+
 ## 1.22.24
 
+- **`agents run --lease` now shares one warm pool across repositories by default (RUSH-2225).** Repo sandbox/CI `profile:` labels no longer split lease reuse into one idle box per repo; a dedicated lease pool is explicit with `.crabbox.yaml` `leaseProfile:`. An empty pool keeps its newly warmed box for later callers. Concurrent runs attach with crabbox `--reclaim` and launch with separate working trees, agent homes, and credential files, so callers share compute without clobbering run state. Switching repos re-syncs the checkout, trading cache latency for lower idle-compute cost. Source: `apps/cli/src/lib/crabbox/config.ts`, `apps/cli/src/lib/crabbox/lease.ts`, `apps/cli/src/commands/exec.ts`.
+
 - **`agents sessions focus` recovers dead panes and shares the sessions browser's selectors (GH-2108).** A retained tmux `remain-on-exit` pane is probed through `#{pane_dead}` immediately before attach, so dead or missing panes no longer open a `Pane is dead` screen. `focus` accepts session ids, topic/path searches, `agent@version` selectors (including per-device `latest`/`oldest`), device, project/time, team/routine, skill/plugin, favorites, and the complete live-state union. Focus, resume, attach, and `run --resume` now use one recovery decision on the origin device: a healthy exact origin performs native resume; otherwise balanced selection chooses a healthy version of the same harness and sends `/continue <id>` to read the indexed transcript, including transcripts retained under version trash. Host-dispatched rows persist the dispatch host as their origin, and `attach` routes its detach-record cleanup there before resuming. No usable same-harness version fails with the device, origin version, and account-health reason. Source: `apps/cli/src/commands/focus.ts`, `apps/cli/src/commands/sessions-browser.ts`, `apps/cli/src/lib/session/recovery.ts`.
 
 - **`agents secrets setup` no longer tells you to set `AGENTS_SECRETS_PASSPHRASE`, and
@@ -108,7 +274,7 @@
 
 - **Fix: the keychain-helper reaper never reaped on macOS.** The daemon reaper shelled `ps -o etimes` — a GNU/Linux procps keyword that macOS `ps` rejects with a non-zero exit — so `execFileSync` threw on every tick and `reapOrphanedKeychainProcesses` returned `reaped: 0` on its only supported platform, leaving orphaned/wedged `Agents CLI` helper processes to pile up. Switched to the portable BSD `etime` keyword (`[[dd-]hh:]mm:ss`) with a parser to seconds. This also un-quarantines the darwin integration test that #2153 had to `it.skip` to unblock releases: that test's symlink fixture was correct all along — it read `reaped: 0` only because the reaper's own `ps etimes` call threw before parsing anything. Verified on macOS 15.4.1: 20/20 reaper tests pass, the integration test reaping a real orphaned sleeper. Source: `apps/cli/src/lib/secrets/reaper.ts`, `reaper.test.ts`.
 
-- **`agents modes [agent[@version]]` lists the permission modes a harness accepts.** The modes analog of `agents models`: for Claude / Codex / Cursor / …, shows which `--mode plan|edit|auto|skip` values work, the native CLI flags, the native default (`*`), any configured `run.defaults` mode, and degrade notes (e.g. plan→edit on Cursor). `agents inspect` also prints the mode list next to capabilities, and `agents run --help` / `agents models` point at the new command. Source: `apps/cli/src/commands/modes.ts`, `apps/cli/src/lib/agent-modes.ts`.
+- **`agents modes [agent[@version]]` lists the permission modes a harness accepts.** The modes analog of `agents models`: for Claude / Codex / Cursor / …, shows which `--mode plan|edit|auto|skip` values work, the native CLI flags, the native default (`*`), any configured `run.defaults` mode, and degrade notes (e.g. plan→edit on Antigravity). `agents inspect` also prints the mode list next to capabilities, and `agents run --help` / `agents models` point at the new command. Source: `apps/cli/src/commands/modes.ts`, `apps/cli/src/lib/agent-modes.ts`.
 
 - **`agents insights --all` now works as an alias for `--since all`.** It previously
   exited with `unknown option '--all'` — a hard failure in the middle of a report the

package/README.md

@@ -35,6 +35,8 @@
   <a href="https://dev.meta.ai/docs/muse-code" title="Meta Muse Code"><strong>Muse</strong></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
   <a href="https://omp.sh" title="Oh My Pi"><strong>Pi</strong></a>
+  &nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://docs.warp.dev/reference/cli" title="Warp Agent CLI (Oz)"><strong>Warp</strong></a>
 </p>
 
 https://agents-cli.sh/demo.mp4
@@ -147,6 +149,13 @@ agents run antigravity "Write tests for the fixed code"
 
 Each resolves to the project-pinned version with skills, MCP servers, and permissions already synced. Single-typo names auto-correct across every command — `agents view cladue` resolves to `claude`, `agents add codx@latest` to `codex`.
 
+`agents run claude "task" --lease` reuses one shared warm crabbox pool across
+repositories by default. Concurrent runs share the box but execute in isolated
+`~/workspaces/<repo>-<run>` directories with separate agent homes and credential
+files. Add `leaseProfile: private-hot-box` to
+`.crabbox.yaml` only when a repo intentionally needs a dedicated warm pool;
+cross-repo reuse trades re-sync latency for lower idle-compute cost.
+
 ### Rate-limited? Keep working.
 
 ```bash
@@ -405,7 +414,7 @@ agents watchdog --nudge    # actually inject "Continue." into the stalled split
 agents watchdog --watch    # daemon loop: a tick every --interval
 ```
 
-`agents watchdog` detects a stalled session, resolves the *exact* terminal split it lives in (tmux, iTerm, VSCodium, or a raw pty), and injects a nudge -- `Continue.` by default, or set `--text`. It's dry by default; `--nudge` acts on a single tick, and `agents watchdog on|off` enables or disables the built-in routine on this device. `agents setup watchdog` chooses devices. Steer a single run with `agents watchdog policy <id> off | keep | handsoff`.
+`agents watchdog` detects a stalled session, resolves the *exact* terminal split it lives in (tmux, iTerm, VSCodium, or a raw pty), and injects a nudge -- `Continue.` by default, or set `--text`. It's dry by default; `--nudge` acts on a single tick. `agents watchdog on|off` controls the device-local daemon pass, which runs once every three minutes. Steer a single run with `agents watchdog policy <id> off | keep | handsoff`.
 
 A stalled session whose tail shows a hard account limit ("You've hit your weekly limit · resets …") is **rotated in place** instead of nudged: the watchdog gates on the same healthy-account selection `agents run auto` makes (zero healthy → one skip event per cooldown window, terminal untouched), injects the harness's exit sequence, relaunches `agents run auto --interactive --session-id <uuid>` in the *same* tab, then replays the old session's resume once the new TUI is live. Default on; `agents watchdog rotate off` disables it (nudging stays on).
 
@@ -609,10 +618,10 @@ Team state is observable via `agents teams list --json` / `agents teams status -
 
 ## Cloud
 
-Some work shouldn't tie up your laptop. `agents cloud run` hands a task to a managed provider that clones the repo, plans, implements, tests, and opens a PR -- while your terminal stays free. A fifth provider, `host`, dispatches the same way onto machines you own: `agents cloud run "…" --host gpu-box` (tasks track in `agents cloud ps` and `agents hosts ps` alike).
+Some work shouldn't tie up your laptop. `agents cloud run` hands a task to a managed provider that clones the repo, plans, implements, tests, and opens a PR -- while your terminal stays free. The `host` provider dispatches the same way onto machines you own: `agents cloud run "…" --host gpu-box` (tasks track in `agents cloud ps` and `agents hosts ps` alike).
 
 <p align="center">
-  <img src="assets/cloud.svg" alt="agents cloud run dispatches one prompt to a managed provider (Rush, Codex, Factory, or Antigravity) that clones, plans, tests, and opens a pull request while you keep working" width="100%" />
+  <img src="assets/cloud.svg" alt="agents cloud run dispatches one prompt to a managed provider (Rush, Codex, Cursor, Factory, or Antigravity) that runs while you keep working" width="100%" />
 </p>
 
 ```bash
@@ -626,7 +635,7 @@ agents cloud message <id> "also update the changelog"  # steer it mid-run
 agents cloud cancel <id>
 ```
 
-Four managed backends behind one interface (`agents cloud providers`):
+Five managed backends behind one interface (`agents cloud providers`):
 
 | Provider | What runs | Notes |
 |---|---|---|
@@ -634,6 +643,7 @@ Four managed backends behind one interface (`agents cloud providers`):
 | `codex` | A pre-built Codex Cloud environment | Target it with `--env`. |
 | `factory` | `droid exec` on a cloud VM | Computer-use; pick the box with `--computer`. |
 | `antigravity` | Gemini managed agents | Antigravity harness in a remote sandbox. |
+| `cursor` | Cursor Cloud Agents | v1 REST API with repo, status, SSE, cancel, and follow-up runs. |
 
 Auto-routes each `--agent` to its native cloud, or pin the backend with `--provider`. Instead of dispatching now, register a run as an **event trigger** with `--on pull_request` (also `push`, `issue_comment`, `workflow_run`) -- it persists as a trigger-bound routine that fires on the event. `--json` on every subcommand for scripting.
 

package/dist/commands/cloud.js

@@ -25,14 +25,15 @@ export function statusColor(status) {
 export function registerCloudCommands(program) {
     const cloud = program
         .command('cloud', { hidden: true })
-        .description('Dispatch and manage cloud agent tasks across providers (Rush, Codex, Factory, Antigravity).')
+        .description('Dispatch and manage cloud agent tasks across providers (Rush, Codex, Cursor, Factory, Antigravity, Host).')
         .addHelpText('after', `
 Each agent runs in its own cloud. Pass --agent and the provider is auto-selected
-(claude→rush, codex→codex, droid→factory, antigravity→antigravity); --provider overrides.
+(claude→rush, codex→codex, cursor→cursor, droid→factory, antigravity→antigravity); --provider overrides.
 
 Providers:
   rush         Rush Cloud — Claude against a GitHub repo + branch → PR
   codex        Codex Cloud — runs in a pre-built Codex environment (--env)
+  cursor       Cursor Cloud Agents — v1 REST API, with optional GitHub repos
   factory      Factory Droid Computer — droid exec on a cloud VM (--computer)
   antigravity  Gemini Managed Agents — Antigravity harness in a remote sandbox
 
@@ -49,6 +50,9 @@ Examples:
   # Codex Cloud against a saved environment
   agents cloud run "add pytest fixtures for the new billing module" --provider codex --env env_a1b2c3 --agent codex --timeout 30m
 
+  # Cursor Cloud Agents against a GitHub repository
+  agents cloud run "fix the flaky parser test" --agent cursor --repo acme/example
+
   # Factory pod targeting a specific computer (Droid)
   agents cloud run "QA the new onboarding flow end-to-end" --provider factory --computer linux-vm-1 --agent droid
 
@@ -74,9 +78,9 @@ Examples:
     cloud
         .command('run [prompt]')
         .description('Dispatch a task to a cloud agent.')
-        .option('--provider <id>', 'Cloud backend: rush, codex, factory, antigravity, host (overrides agent auto-routing)')
-        .option('--agent <name>', 'Agent to run: claude, codex, droid, antigravity (auto-routes to its native cloud)')
-        .option('--repo <owner/repo>', 'GitHub repository. Repeatable for multi-repo dispatch (Rush Cloud only).', (value, previous) => {
+        .option('--provider <id>', 'Cloud backend: rush, codex, cursor, factory, antigravity, host (overrides agent auto-routing)')
+        .option('--agent <name>', 'Agent to run: claude, codex, cursor, droid, antigravity (auto-routes to its native cloud)')
+        .option('--repo <owner/repo>', 'GitHub repository. Repeatable for multi-repo dispatch (Rush or Cursor Cloud).', (value, previous) => {
         const acc = Array.isArray(previous) ? previous : [];
         acc.push(value);
         return acc;

package/dist/commands/doctor.d.ts

@@ -22,11 +22,35 @@
  * apply pending sync.
  */
 import type { Command } from 'commander';
+import { type DoctorFinding } from '../lib/devices/doctor-findings.js';
 import { type VersionResourceReport } from '../lib/doctor-diff.js';
 import { type DuplicateVersionHook } from '../lib/hooks.js';
 import { type SyncStatusRow, type OrphanRow } from '../lib/drift.js';
 import { type FetchStatusMarker } from '../lib/auto-pull.js';
 export declare function wrapLine(prefix: string, text: string, width?: number): string[];
+export declare function asRemoteSecretFindings(raw: unknown, device: string): DoctorFinding[];
+/**
+ * Fetch a device's harness inventory by running its top-level `agents doctor
+ * --json` (which carries the `fleet` field, RUSH-2027). Separate from
+ * {@link probeFleetTarget} — that forwards `teams doctor --json` for per-agent
+ * readiness, a different payload. Returns the parsed {@link FleetInventory} or
+ * null (unreachable, non-zero exit, unparseable, or an older CLI with no
+ * `fleet` field); a null is skipped by the comparator, never a false gap.
+ */
+/**
+ * How long one remote `doctor --json` probe may take.
+ *
+ * 180s, matching `ChildProcess.doctorTimeout`, which was set to 180 for this
+ * same command for this same reason. The previous 30s sat BELOW the command's
+ * real cost — 56s measured on `yosemite-m0`, 136s on an idle box — so every slow
+ * device silently contributed nothing at all: no inventory, no sign-in, no
+ * divergence, no secret findings. A ceiling under the true cost does not make a
+ * probe cheap, it makes it always fail.
+ *
+ * This does not multiply by device count: `fanOutDevices` is `Promise.all`, so
+ * whole-fleet wall time is bounded near the slowest box, not 180s x N.
+ */
+export declare const FLEET_INVENTORY_TIMEOUT_MS = 180000;
 export type IssueSeverity = 'critical' | 'warning' | 'info';
 /**
  * One triaged health finding. `severity`/`category`/`subject`/`impact`/`fix` are

package/dist/commands/doctor.js

@@ -8,7 +8,7 @@ import { enterDoctorOverviewGate, writeDoctorOverviewCache } from '../lib/device
 import { fleetDialTarget } from '../lib/devices/connect.js';
 import { compareFleetInventories } from '../lib/devices/fleet-divergence.js';
 import { collectLocalFleetInventory } from '../lib/devices/fleet-inventory.js';
-import { buildLocalFindings, fleetDivergenceToFindings, signInToFindings, renderFindings, } from '../lib/devices/doctor-findings.js';
+import { buildLocalFindings, fleetDivergenceToFindings, signInToFindings, renderFindings, remediationFor, FINDING_SEVERITY, } from '../lib/devices/doctor-findings.js';
 import { getCliVersion } from '../lib/version.js';
 import { resolveHost } from '../lib/hosts/registry.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
@@ -31,7 +31,7 @@ import { listCliStatus, listCliStatusAsync } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
 import { heal, healChangedAnything } from '../lib/heal.js';
 import { getEffectiveExecutionPolicy } from '../lib/platform/winpath.js';
-import { scanUserRcFiles } from '../lib/secrets/rc-hygiene.js';
+import { scanUserRcFiles, masterPassphraseInEnv } from '../lib/secrets/rc-hygiene.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
 import { readRepoBehindMarkers } from '../lib/auto-pull.js';
 import * as fs from 'fs';
@@ -80,6 +80,70 @@ function printWrappedLine(prefix, text) {
     for (const line of wrapLine(prefix, text))
         console.log(chalk.gray(line));
 }
+/**
+ * Narrow a remote `findings` array to the secret-hygiene rows, or `[]`.
+ *
+ * Deliberately NOT "forward every remote finding". The aggregator already
+ * rebuilds a remote's sign-in rows from its inventory and its divergence rows
+ * from the comparator, so forwarding wholesale would double them; and pulling a
+ * remote's orphan/drift rows into a fleet readout is a much larger UX change
+ * than this fix. The two secret kinds are the ones that are BOTH unrecomputable
+ * centrally and security-relevant, which is exactly why they were being lost.
+ *
+ * **The remote contributes exactly one thing: the KIND.** Severity, message and
+ * remediation are all generated HERE. That is not defensiveness for its own
+ * sake — the remote runs its own agents-cli, whose version and integrity we do
+ * not control, and each forwarded string is load-bearing in a different way:
+ *
+ *   - `remediation` is a command a human copies and runs. Accepting it from the
+ *     wire is an injection channel, full stop.
+ *   - `message` is the one place a secret VALUE could re-enter a readout that
+ *     otherwise guarantees it never prints one. A local builder cannot leak what
+ *     it never receives.
+ *   - `severity` decides the CRITICAL section, so a remote could otherwise
+ *     promote its own warning and bury real criticals under it.
+ *   - `device` is overwritten with the name we dialled, so no box can pin a
+ *     finding on another.
+ *
+ * The cost is detail: the fleet row says which box and which kind, not which
+ * file and line. Run `agents doctor` on that box for the specifics — the
+ * message says so.
+ */
+const REMOTE_FORWARDED_KINDS = ['rc-secret-export', 'env-secret-export'];
+/** Canonical, locally-authored text for a forwarded kind. Never the remote's. */
+const REMOTE_SECRET_MESSAGE = {
+    'rc-secret-export': 'a credential-shaped export was found in this box\'s shell rc files'
+        + ' — run `agents doctor` there for the file and line',
+    'env-secret-export': 'AGENTS_SECRETS_PASSPHRASE is set in this box\'s process environment'
+        + ' — run `agents doctor` there for detail',
+};
+export function asRemoteSecretFindings(raw, device) {
+    if (!Array.isArray(raw))
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const item of raw) {
+        if (!item || typeof item !== 'object' || Array.isArray(item))
+            continue;
+        const kind = item.kind;
+        if (typeof kind !== 'string')
+            continue;
+        if (!REMOTE_FORWARDED_KINDS.includes(kind))
+            continue;
+        if (seen.has(kind))
+            continue; // one row per kind per box
+        seen.add(kind);
+        const k = kind;
+        const base = {
+            severity: FINDING_SEVERITY[k],
+            kind: k,
+            device,
+            message: REMOTE_SECRET_MESSAGE[k],
+        };
+        out.push({ ...base, remediation: remediationFor({ ...base, remediation: '' }) });
+    }
+    return out;
+}
 async function resolveFleetTargets(opts) {
     const singleName = opts.host || opts.device;
     if (singleName) {
@@ -155,15 +219,32 @@ async function probeFleetTarget(target) {
  * null (unreachable, non-zero exit, unparseable, or an older CLI with no
  * `fleet` field); a null is skipped by the comparator, never a false gap.
  */
+/**
+ * How long one remote `doctor --json` probe may take.
+ *
+ * 180s, matching `ChildProcess.doctorTimeout`, which was set to 180 for this
+ * same command for this same reason. The previous 30s sat BELOW the command's
+ * real cost — 56s measured on `yosemite-m0`, 136s on an idle box — so every slow
+ * device silently contributed nothing at all: no inventory, no sign-in, no
+ * divergence, no secret findings. A ceiling under the true cost does not make a
+ * probe cheap, it makes it always fail.
+ *
+ * This does not multiply by device count: `fanOutDevices` is `Promise.all`, so
+ * whole-fleet wall time is bounded near the slowest box, not 180s x N.
+ */
+export const FLEET_INVENTORY_TIMEOUT_MS = 180_000;
 async function probeFleetInventory(target) {
     const isWin = /^win/i.test((target.os ?? '').trim());
     const remoteCmd = buildRemoteAgentsInvocation(['doctor', '--json'], undefined, isWin ? 'windows' : undefined, isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' });
-    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: 30000, multiplex: true });
+    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: FLEET_INVENTORY_TIMEOUT_MS, multiplex: true });
     if (res.code !== 0)
         return null;
     try {
         const parsed = JSON.parse(res.stdout);
-        return asFleetInventory(parsed.fleet);
+        return {
+            inventory: asFleetInventory(parsed.fleet),
+            secretFindings: asRemoteSecretFindings(parsed.findings, target.name),
+        };
     }
     catch {
         return null;
@@ -252,19 +333,22 @@ async function runDevicesDoctor(opts) {
         fanOutDevices(targets, probeFleetTarget),
         fanOutDevices(targets, probeFleetInventory),
     ]);
-    const inventoryByName = new Map();
+    const payloadByName = new Map();
     for (const r of inventoryResults)
-        inventoryByName.set(r.name, r.status === 'ok' ? (r.value ?? null) : null);
+        payloadByName.set(r.name, r.status === 'ok' ? (r.value ?? null) : null);
     results.push(...remoteResults.map((r) => {
-        const inventory = inventoryByName.get(r.name) ?? undefined;
+        const payload = payloadByName.get(r.name) ?? null;
+        const inventory = payload?.inventory ?? undefined;
+        const secretFindings = payload?.secretFindings;
         if (r.status === 'ok' && r.value)
-            return { ...r.value, inventory: inventory ?? undefined };
+            return { ...r.value, inventory, secretFindings };
         return {
             name: r.name,
             online: false,
             error: r.error ?? String(r.reason ?? 'skipped'),
             agents: {},
-            inventory: inventory ?? undefined,
+            inventory,
+            secretFindings,
         };
     }));
     // Cross-device divergence: compare every device's inventory against the local
@@ -314,6 +398,7 @@ async function runDevicesDoctor(opts) {
                 duplicateHooks: inspectDuplicateVersionHooks(cwd),
                 hostClis: toHostCliInput(listCliStatus(cwd)),
                 rcSecrets: scanUserRcFiles(),
+                masterPassphraseInEnv: masterPassphraseInEnv(),
                 execPolicy: process.platform === 'win32'
                     ? { platform: process.platform, policy: getEffectiveExecutionPolicy() }
                     : undefined,
@@ -335,6 +420,11 @@ async function runDevicesDoctor(opts) {
             });
             continue;
         }
+        // Secret hygiene the aggregator cannot see for itself — the remote's shell
+        // rc files and its process environment. Without this the fleet readout
+        // reports a leaking box as clean (RUSH-1968).
+        if (r.secretFindings?.length)
+            findings.push(...r.secretFindings);
         if (r.inventory?.signIn) {
             findings.push(...signInToFindings(r.name, r.inventory.signIn));
             accounts[r.name] = r.inventory.signIn;
@@ -1389,6 +1479,7 @@ export function registerDoctorCommand(program) {
                 duplicateHooks,
                 hostClis: toHostCliInput(hostClis),
                 rcSecrets: scanUserRcFiles(),
+                masterPassphraseInEnv: masterPassphraseInEnv(),
                 // getEffectiveExecutionPolicy spawns powershell — a doomed process on
                 // POSIX, where the advisory never applies. Probe only on Windows.
                 execPolicy: process.platform === 'win32'

package/dist/commands/exec.js

@@ -568,8 +568,8 @@ export function registerRunCommand(program) {
         .option('--bare', 'With --lease, skip copying your local ~/.agents setup (skills/hooks/commands/MCP) onto the box.')
         .option('--tailscale', 'Lease the box onto your tailnet (reachable only over Tailscale) rather than a public IP.')
         .option('--no-tailscale', 'Force a public-IP lease even when a reuse context would default to Tailscale.')
-        .option('--cloud', 'Vendor cloud placement: dispatch to the agent\'s native cloud (claude→rush, codex→codex, droid→factory, antigravity→antigravity) and stream the result. Same dispatch as `agents cloud run --agent <agent>`; tracked by `agents cloud list/status/logs`. Same as --where cloud. Mutually exclusive with --host/--lease and local-run flags.')
-        .option('--provider <id>', 'With --cloud: override the agent\'s native cloud provider (rush | codex | factory | antigravity | host).')
+        .option('--cloud', 'Vendor cloud placement: dispatch to the agent\'s native cloud (claude→rush, codex→codex, cursor→cursor, droid→factory, antigravity→antigravity) and stream the result. Same dispatch as `agents cloud run --agent <agent>`; tracked by `agents cloud list/status/logs`. Same as --where cloud. Mutually exclusive with --host/--lease and local-run flags.')
+        .option('--provider <id>', 'With --cloud: override the agent\'s native cloud provider (rush | codex | cursor | factory | antigravity | host).')
         .option('--repo <owner/repo>', 'With --cloud: GitHub repository. Repeatable for multi-repo dispatch (Rush Cloud only).', (val, prev) => [...prev, val], [])
         .option('--branch <name>', 'With --cloud: target git branch.')
         .option('--cloud-env <id>', 'With --cloud: Codex Cloud environment ID (run\'s --env is the KEY=VAL passthrough, so the cloud env id gets its own flag).');
@@ -657,8 +657,8 @@ export function registerRunCommand(program) {
         Models (cheap|default|best|ultra): agents models <agent[@version]>
 
       Headless plan support (a prompt makes the run headless):
-        plan works headless on claude, codex, droid, opencode.
-        kimi, grok, cursor, antigravity have no headless plan mode — a headless
+        plan works headless on claude, codex, cursor, droid, opencode.
+        kimi, grok, antigravity have no headless plan mode — a headless
         --mode plan auto-downgrades to --mode auto (with a stderr warning).
         Interactive plan (omit the prompt) works everywhere it is listed.
 
@@ -1019,19 +1019,21 @@ export function registerRunCommand(program) {
             const leaseSecretsBundle = process.env.AGENTS_LEASE_SECRETS_BUNDLE;
             const nowSecs = Math.floor(Date.now() / 1000);
             let reuseSlug = options.box;
-            // The profile this run's pool/box carries: the repo's .crabbox.yaml
-            // `profile:` when declared (what crabbox warmup would label a fresh box
-            // with), else crabbox's default. Passing it to leaseAndRun makes the
-            // pool-reuse match interchangeable with a fresh warmup.
+            // Lease runs share one default warm pool across repositories. The generic
+            // `.crabbox.yaml profile:` remains available to repo sandbox/CI scripts;
+            // `leaseProfile:` is the explicit opt-in for a dedicated lease hot box.
             const repoRoot = gitToplevel(leaseCwd);
-            const { readCrabboxRepoProfile } = await import('../lib/crabbox/config.js');
-            const poolProfile = repoRoot ? readCrabboxRepoProfile(repoRoot) : undefined;
+            const { readCrabboxLeaseProfile } = await import('../lib/crabbox/config.js');
+            const poolProfile = repoRoot ? readCrabboxLeaseProfile(repoRoot) : 'default';
             if (options.lease && !reuseSlug && !options.fresh) {
-                const { crabboxList } = await import('../lib/crabbox/cli.js');
-                const { reusableBoxes, formatBoxRow } = await import('./lease.js');
+                const { crabboxList, poolReusableBoxes } = await import('../lib/crabbox/cli.js');
+                const { formatBoxRow } = await import('./lease.js');
                 let warm = [];
                 try {
-                    warm = reusableBoxes(crabboxList({ secretsBundle: leaseSecretsBundle }), nowSecs);
+                    warm = poolReusableBoxes(crabboxList({ secretsBundle: leaseSecretsBundle }), {
+                        profile: poolProfile,
+                        nowSecs,
+                    });
                 }
                 catch {
                     warm = []; // crabbox unavailable / no creds → the pool check in leaseAndRun decides
@@ -1102,7 +1104,7 @@ export function registerRunCommand(program) {
                 }
             }
             const { detectSignedInRuntimes, resolveClaudeCredentialsBlob, inferLeaseRuntime, profileNeedsBaseRuntimeCredentials } = await import('../lib/crabbox/runtimes.js');
-            const { leaseAndRun } = await import('../lib/crabbox/lease.js');
+            const { leaseAndRun, leaseWorkspaceId } = await import('../lib/crabbox/lease.js');
             const { boxAddress } = await import('./lease.js');
             const { getConfiguredRunStrategy, resolveRunVersion } = await import('../lib/rotate.js');
             const { profileExists, readProfile, resolveProfileEnv } = await import('../lib/profiles.js');
@@ -1197,7 +1199,7 @@ export function registerRunCommand(program) {
                     ? 'the box is kept after the run'
                     : options.fresh
                         ? 'the box is destroyed after the run'
-                        : 'a fresh box is destroyed after the run; a reused pool box is kept';
+                        : 'the shared-pool box is kept after the run';
             console.error(chalk.gray(`${boxLifecycle} · shipping ${whatShips}${credentialRuntimes.length > 0 && leaseEmail ? ` (${leaseEmail})` : ''}; ${boxAfterRun}.`));
             // Read the Claude OAuth token from the local Keychain (silent) so it can be
             // written to ~/.claude/.credentials.json on the box — otherwise Claude boots
@@ -1279,6 +1281,7 @@ export function registerRunCommand(program) {
                     reuseBox: reuseSlug,
                     fresh: options.fresh,
                     profile: poolProfile,
+                    workspaceId: leaseWorkspaceId(repoRoot ?? leaseCwd),
                     copySetup,
                     netMode,
                     onData: (chunk) => router.push(chunk),
@@ -2455,7 +2458,7 @@ export function registerRunCommand(program) {
             process.exit(1);
         }
         // Default CLI mode is the generic 'plan'. Agents without a read-only
-        // mode (antigravity, cursor, kiro, …) degrade via resolveMode to their
+        // mode (antigravity, kiro, …) degrade via resolveMode to their
         // safest native mode (modes[0], typically edit). That covers both the
         // implicit default and an explicit `--mode plan`, so multi-agent
         // scripts can pass a uniform plan flag without per-agent branching.

package/dist/commands/feed.d.ts

@@ -42,6 +42,8 @@ export declare function prepareLocalFeedBlocks(localBlocks: OpenBlock[], opts: {
     dispatch: OpenBlock[];
     filter: ReturnType<typeof filterBlocksForFeed>;
 };
+/** Specific host app + routine provenance for one feed row. */
+export declare function formatFeedRuntime(block: Pick<OpenBlock, 'runtime' | 'origin' | 'routineName'>): string;
 /** Human summary line for one outcome rollup. */
 export declare function formatOutcomeHeader(group: OutcomeGroup): string;
 /** Map active sessions into the lightweight hints outcome enrichment needs. */
@@ -59,6 +61,9 @@ export declare function sessionHintsFromActive(sessions: Array<{
     worktree?: {
         slug?: string;
     };
+    host?: string;
+    origin?: 'cli' | 'routine';
+    routineName?: string;
 }>): SessionOutcomeHint[];
 /**
  * True when a SQLite open/query failed because another writer holds the lock.