@phnx-labs/agents-cli 1.22.24 → 1.22.25

package/dist/lib/devices/doctor-findings.d.ts

@@ -10,7 +10,7 @@ export type FindingSeverity = 'critical' | 'warning';
  *  the JSON consumer group by kind. */
 /** Every finding class. Severity is NOT annotated here — {@link FINDING_SEVERITY}
  *  below owns it, and a second copy in these comments is a fourth place to drift. */
-export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "exec-policy", "stale-cli"];
+export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "stale-cli"];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
  * the builders below and asserted against both prose rubrics by
@@ -89,6 +89,12 @@ export interface LocalFindingInputs {
     duplicateHooks?: DuplicateVersionHook[];
     /** Credential-shaped exports found in the user's shell rc files (RUSH-1968). */
     rcSecrets?: RcSecretFinding[];
+    /** True when the file-store master key is live in THIS process's environment.
+     *  Distinct from `rcSecrets`, which scans FILES: a value inherited by a
+     *  long-lived process survives deleting the rc line that set it, so the rc
+     *  scan reports clean while the leak is still in flight (RUSH-1968). Never the
+     *  value — only whether it is set. */
+    masterPassphraseInEnv?: boolean;
     /** The effective PowerShell execution policy and the platform it was read on.
      *  Only `win32` yields a finding — the `agents.ps1` launcher is Windows-only. */
     execPolicy?: {

package/dist/lib/devices/doctor-findings.js

@@ -23,7 +23,7 @@
  *              never-synced · stale · repo-behind · repo-drift · version-skew ·
  *              fleet-resource-gap · orphan · duplicate-hook ·
  *              duplicate-hook-drift · host-cli-missing · host-cli-invalid ·
- *              rc-secret-export · exec-policy · stale-cli.
+ *              rc-secret-export · env-secret-export · exec-policy · stale-cli.
  *   (RUSH-2162 moved never-synced and duplicate-hook-drift to WARNING: both are
  *   stale-sync states one `agents sync` resolves, not "needs you now".)
  *
@@ -94,6 +94,7 @@ export const ALL_FINDING_KINDS = [
     'duplicate-hook', // one hook materialized in several version homes, byte-identical
     'duplicate-hook-drift', // …with differing content, so a stale copy can disagree
     'rc-secret-export', // credential-shaped export in a shell rc file
+    'env-secret-export', // the file-store master key live in THIS process's env
     'exec-policy', // Windows execution policy blocks agents.ps1
     'stale-cli',
 ];
@@ -133,6 +134,7 @@ export const FINDING_SEVERITY = {
     'host-cli-missing': 'warning',
     'host-cli-invalid': 'warning',
     'rc-secret-export': 'warning',
+    'env-secret-export': 'warning',
     'exec-policy': 'warning',
     'stale-cli': 'warning',
 };
@@ -240,6 +242,11 @@ export function remediationFor(finding) {
             return 'fix the manifest';
         case 'rc-secret-export':
             return 'agents secrets add';
+        case 'env-secret-export':
+            // Not just "restart the shell": the value is in every long-lived parent
+            // that inherited it — an editor, a tmux server, the agents daemon — and
+            // each keeps handing it to new children until IT restarts.
+            return 'unset at the source, then restart every process that inherited it (shells, editor, tmux, agents daemon)';
         case 'exec-policy':
             return 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned';
         case 'stale-cli':
@@ -450,6 +457,10 @@ export function buildLocalFindings(input) {
     // into `agents secrets`.
     for (const f of rcSecretFindings(device, input.rcSecrets ?? []))
         out.push(f);
+    // The same key, live in this process's environment rather than in a file.
+    const envFinding = envSecretFinding(device, input.masterPassphraseInEnv ?? false);
+    if (envFinding)
+        out.push(envFinding);
     // Windows execution policy blocking the generated agents.ps1 launcher.
     const policyFinding = execPolicyFinding(device, input.execPolicy);
     if (policyFinding)
@@ -572,6 +583,32 @@ function rcSecretFindings(device, rc) {
  * policy itself. Returns null off Windows or on a permissive policy — pure, so
  * both branches are testable without invoking PowerShell.
  */
+/**
+ * The file-store master key sitting in THIS process's environment.
+ *
+ * `rc-hygiene.ts` scans FILES, which leaves a real hole: a value inherited by a
+ * long-lived process outlives the rc line that set it, so an operator who
+ * deletes `~/.zshenv:8` gets a clean `rc-secret-export` while every shell,
+ * editor and agent started before the edit still carries the key — and hands it
+ * to everything they spawn. Verified on a box with no rc export whose live
+ * environment still held the value, hashing identical to its key file.
+ *
+ * Warning, not critical: on the release home base the export is deliberate and
+ * scoped (`headless-sign-context.sh`), so the message names that exception
+ * rather than the check trying to detect it.
+ */
+function envSecretFinding(device, present) {
+    if (!present)
+        return null;
+    return finding({
+        severity: FINDING_SEVERITY['env-secret-export'], kind: 'env-secret-export', device,
+        // Never the value — only that it is set.
+        message: 'AGENTS_SECRETS_PASSPHRASE is set in this process environment — every '
+            + 'child inherits it and any same-user process can read it from /proc/<pid>/environ. '
+            + 'It outlives the shell rc line that set it, so deleting that line is not enough. '
+            + '(Expected inside a release sign context, which sets it deliberately.)',
+    });
+}
 function execPolicyFinding(device, execPolicy) {
     if (!execPolicy || execPolicy.platform !== 'win32')
         return null;
@@ -881,6 +918,8 @@ function warningSubject(f) {
         return 'orphans';
     if (f.kind === 'rc-secret-export')
         return 'shell rc';
+    if (f.kind === 'env-secret-export')
+        return 'environment';
     if (f.kind === 'exec-policy')
         return 'PowerShell';
     if (f.kind === 'fleet-resource-gap')

package/dist/lib/events.d.ts

@@ -226,6 +226,15 @@ export declare function query(options: {
     bundle?: string;
     limit?: number;
 }): EventRecord[];
+/**
+ * Scan event logs once for a set of session IDs and return browser/computer
+ * usage flags for each. O(files) instead of O(N × files) — safe to call
+ * outside a SQLite write transaction.
+ */
+export declare function queryToolUsageForSessions(sessionIds: ReadonlySet<string>): Map<string, {
+    usedBrowser: boolean;
+    usedComputer: boolean;
+}>;
 /**
  * Get performance stats for a specific label.
  */

package/dist/lib/events.js

@@ -1052,6 +1052,64 @@ export function query(options) {
     }
     return results;
 }
+/**
+ * Scan event logs once for a set of session IDs and return browser/computer
+ * usage flags for each. O(files) instead of O(N × files) — safe to call
+ * outside a SQLite write transaction.
+ */
+export function queryToolUsageForSessions(sessionIds) {
+    const result = new Map();
+    if (sessionIds.size === 0)
+        return result;
+    for (const id of sessionIds) {
+        result.set(id, { usedBrowser: false, usedComputer: false });
+    }
+    const BROWSER_EVENTS = new Set(['browser.navigate', 'browser.screenshot']);
+    const COMPUTER_EVENTS = new Set(['computer.action']);
+    eventsPath();
+    migrateLegacyEventLogs();
+    const files = listEventLogFiles().sort((a, b) => Number(b.currentActive) - Number(a.currentActive) || b.mtimeMs - a.mtimeMs || b.path.localeCompare(a.path));
+    let remaining = sessionIds.size * 2; // each session needs up to 2 flags set
+    for (const file of files) {
+        if (remaining <= 0)
+            break;
+        let content;
+        if (file.gzip) {
+            try {
+                content = gunzipSync(fs.readFileSync(file.path)).toString('utf-8');
+            }
+            catch {
+                continue;
+            }
+        }
+        else {
+            content = fs.readFileSync(file.path, 'utf-8');
+        }
+        for (const line of content.trim().split('\n')) {
+            if (!line)
+                continue;
+            try {
+                const record = JSON.parse(line);
+                const sid = record.sessionId;
+                if (!sid || !result.has(sid))
+                    continue;
+                const entry = result.get(sid);
+                if (BROWSER_EVENTS.has(record.event) && !entry.usedBrowser) {
+                    entry.usedBrowser = true;
+                    remaining--;
+                }
+                else if (COMPUTER_EVENTS.has(record.event) && !entry.usedComputer) {
+                    entry.usedComputer = true;
+                    remaining--;
+                }
+            }
+            catch {
+                // skip malformed lines
+            }
+        }
+    }
+    return result;
+}
 // ─── Stats ────────────────────────────────────────────────────────────────────
 /**
  * Get performance stats for a specific label.

package/dist/lib/exec.d.ts

@@ -42,7 +42,7 @@ export declare function headlessPlanStallCommand(args: {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/cursor/kiro have no plan flag; hard-failing made
+ *   like antigravity/kiro have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -61,8 +61,8 @@ export declare function resolveMode(agent: AgentId, requested: Mode): Mode;
  * `--prompt` + `--plan`, and grok's `--permission-mode plan` silently stalls at
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
- * one-line stderr warning, mirroring the graceful plan→edit degrade cursor and
- * antigravity get for having no plan flag at all. Interactive runs are never
+ * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
+ * and kiro get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */

package/dist/lib/exec.js

@@ -86,7 +86,7 @@ export function headlessPlanStallCommand(args) {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/cursor/kiro have no plan flag; hard-failing made
+ *   like antigravity/kiro have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -106,7 +106,7 @@ export function resolveMode(agent, requested) {
     }
     if (requested === 'plan') {
         // No read-only mode on this agent. modes[0] is the declared safest mode
-        // (edit for antigravity/cursor/kiro/…). Prefer that over hard-fail so
+        // (edit for antigravity/kiro/…). Prefer that over hard-fail so
         // uniform multi-agent `--mode plan` dispatches still run.
         return supported[0];
     }
@@ -121,8 +121,8 @@ export function resolveMode(agent, requested) {
  * `--prompt` + `--plan`, and grok's `--permission-mode plan` silently stalls at
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
- * one-line stderr warning, mirroring the graceful plan→edit degrade cursor and
- * antigravity get for having no plan flag at all. Interactive runs are never
+ * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
+ * and kiro get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */
@@ -142,12 +142,8 @@ export function resolveHeadlessMode(agent, requested, interactive, warningContex
     if (mode !== requested) {
         const subject = warningContext ? `${warningContext}: ` : '';
         if (requested === 'plan') {
-            const limitation = agent === 'cursor'
-                ? "cursor's read-only plan mode is not enabled in this build"
-                : `${agent} has no read-only 'plan' mode`;
-            warn(`[agents] ${subject}${limitation}; ` +
-                `running '${mode}' (writable) instead${agent === 'cursor' ? ' (RUSH-2101)' : ''}. ` +
-                `Pass --mode ${mode} to silence this.\n`);
+            warn(`[agents] ${subject}${agent} has no read-only 'plan' mode; ` +
+                `running '${mode}' (writable) instead. Pass --mode ${mode} to silence this.\n`);
         }
         else {
             warn(`[agents] ${subject}${agent} has no '${requested}' mode; using '${mode}'.\n`);
@@ -494,6 +490,7 @@ export const AGENT_COMMANDS = {
         base: ['cursor-agent'],
         promptFlag: '-p',
         modeFlags: {
+            plan: ['--plan'],
             edit: [],
             skip: ['-f'],
         },
@@ -687,6 +684,23 @@ export const AGENT_COMMANDS = {
         // `resume` subcommand — special-cased in buildExecCommand.
         resume: { flag: '--session-id' },
     },
+    // Warp Agent CLI (`oz agent run`). Headless is `-p/--prompt "<task>"`; JSON is
+    // the global `--output-format json`. Autonomy comes from the selected agent
+    // profile (`--profile`), not a per-run permission flag, so the single `edit`
+    // mode maps to no flags (mirrors hermes). `--model` overrides the base model
+    // (`oz model list`). No `resume`: Oz's `oz agent run --conversation <id>`
+    // continues a SERVER-SIDE conversation by id, and warp is not session-tracked
+    // (absent from SESSION_AGENTS), so agents-cli has no local id to resume from —
+    // declaring it would make nativeResume(warp) true against an unreachable path.
+    warp: {
+        base: ['oz', 'agent', 'run'],
+        promptFlag: '-p',
+        modeFlags: {
+            edit: [],
+        },
+        jsonFlags: ['--output-format', 'json'],
+        modelFlag: '--model',
+    },
 };
 /**
  * Whether `agent` has a native resume form (Tier 1). Derived solely from the

package/dist/lib/feed-outcome.d.ts

@@ -89,6 +89,9 @@ export interface SessionOutcomeHint {
     worktreeSlug?: string | null;
     branch?: string | null;
     project?: string | null;
+    host?: string | null;
+    origin?: 'cli' | 'routine' | null;
+    routineName?: string | null;
 }
 /**
  * Overlay session meta onto a block when the block itself is missing ticket/PR/

package/dist/lib/feed-outcome.js

@@ -152,21 +152,22 @@ export function groupBlocksByOutcome(blocks) {
     const groups = [];
     for (const { outcome, blocks: members } of byKey.values()) {
         const mailboxes = new Set(members.map((b) => b.mailboxId));
-        let open = 0;
-        let answered = 0;
-        let parked = 0;
+        const states = new Map();
         for (const b of members) {
-            if (b.parkedAt)
-                parked += 1;
-            else if (b.answer || b.defaultedAt || b.continuedAt)
-                answered += 1;
-            else
-                open += 1;
+            const next = b.parkedAt
+                ? 'parked'
+                : b.answer || b.defaultedAt || b.continuedAt ? 'answered' : 'open';
+            const current = states.get(b.mailboxId);
+            // One agent occupies one state. Its most actionable block wins.
+            if (!current || next === 'open' || (next === 'parked' && current === 'answered')) {
+                states.set(b.mailboxId, next);
+            }
         }
+        const count = (state) => [...states.values()].filter((value) => value === state).length;
         groups.push({
             outcome,
             blocks: members,
-            counts: { agents: mailboxes.size, open, answered, parked },
+            counts: { agents: mailboxes.size, open: count('open'), answered: count('answered'), parked: count('parked') },
         });
     }
     groups.sort((a, b) => {
@@ -222,6 +223,13 @@ export function enrichBlockFromSession(block, hint) {
         next.worktreeSlug = hint.worktreeSlug;
     if (!next.project && hint.project)
         next.project = hint.project;
+    if (hint.host && hint.host !== 'terminal' && next.runtime === 'terminal')
+        next.runtime = hint.host;
+    if (hint.origin === 'routine') {
+        next.origin = 'routine';
+        if (hint.routineName)
+            next.routineName = hint.routineName;
+    }
     return next;
 }
 /**

package/dist/lib/feed.d.ts

@@ -36,6 +36,10 @@ export interface OpenBlock {
     mailboxId: string;
     host: string;
     runtime: string;
+    /** Indexed launch origin, added at read time when the live session is known. */
+    origin?: 'cli' | 'routine';
+    /** Routine definition name when origin is `routine`. */
+    routineName?: string;
     /** Project/repo name this block belongs to (derived from cwd, worktree-aware). */
     project?: string;
     ts: string;

package/dist/lib/hosts/passthrough.d.ts

@@ -16,6 +16,7 @@
  * table or, when `--host`/`--device` is present, exits with a clear
  * "not supported" message — never commander's raw `unknown option`.
  */
+import { type Host } from './types.js';
 import { type DeviceProfile, type DeviceRegistry } from '../devices/registry.js';
 import { runLocalCommand, runOnDevice } from '../devices/fleet.js';
 /** Per-command remote behaviour. Absence from this map = not host-routable here. */
@@ -60,4 +61,24 @@ export declare function runFleetPassthrough(command: string, allArgs: string[],
  * @param allArgs `process.argv.slice(2)` — the command name followed by its args.
  */
 export declare function maybeRunOnHost(command: string, allArgs: string[], opts?: FleetPassthroughOptions): Promise<boolean>;
+/**
+ * Run `agents <forwardedArgs>` on `host` over SSH, streaming its output, and
+ * return the exit code. The single place the SSH hop is built, so every remote
+ * `agents` invocation carries identical env semantics.
+ *
+ * Forwards actor provenance (`AGENTS_ACTOR`/`GIT_` vars) across the hop, merged UNDER
+ * `extraEnv` so a caller-supplied PATH still wins — without this the remote
+ * re-resolves the actor from THIS box's SSH_CONNECTION and mis-credits it
+ * (RUSH-2028). Flows to both POSIX (export) and Windows ($env:) dialects.
+ * AGENTS_FLEET_REMOTE marks this as a fleet-dispatched run so the far side can
+ * gate consent-sensitive actions — the browser consent gate
+ * (lib/browser/remote-control.ts) reads it to allow/deny a cross-machine drive.
+ */
+export declare function streamAgentsOnHost(host: Host, forwardedArgs: string[], opts?: {
+    remoteCwd?: string;
+    interactive?: boolean;
+    extraEnv?: Record<string, string>;
+    remoteOs?: string;
+    target?: string;
+}): number;
 export {};

package/dist/lib/hosts/passthrough.js

@@ -29,6 +29,7 @@ import { loadDevices } from '../devices/registry.js';
 import { isSelfHost } from '../devices/self-host.js';
 import { fanOutDevices, planFleetTargets, runLocalCommand, runOnDevice, } from '../devices/fleet.js';
 import { platformGroupLabel } from '../devices/health-report.js';
+import { isKnownTopLevelCommand } from '../startup/command-registry.js';
 /**
  * First-class groups that run transparently on a remote via SSH when
  * `--host`/`--device` is present. Keep both canonical names and aliases
@@ -436,6 +437,15 @@ export async function maybeRunOnHost(command, allArgs, opts) {
         if (!isAll && command !== 'routines')
             return false;
     }
+    // A command that does not exist is an unknown-command error, not a routing
+    // error. The router runs BEFORE commander parses, so without this gate a typo
+    // (`agents session resume --host box`) was answered with "does not support
+    // --host/--device" — a true statement about a command the user never typed,
+    // and the exact opposite of the truth for the `sessions` they meant, which
+    // does support it. Fall through so commander reports `unknown command` (and
+    // its did-you-mean). RUSH-2022.
+    if (!isKnownTopLevelCommand(command))
+        return false;
     const spec = REMOTE_PASSTHROUGH[command];
     if (!spec) {
         // Flag was accepted (no raw commander "unknown option") but this group has
@@ -532,20 +542,37 @@ export async function maybeRunOnHost(command, allArgs, opts) {
     const doctorPath = isDoctorCommand && !/^win/i.test((remoteOs ?? '').trim())
         ? { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' }
         : undefined;
-    // Forward actor provenance (AGENTS_ACTOR*/GIT_*) across the SSH hop, merged
-    // UNDER the doctor PATH so that PATH still wins — without this the remote
-    // re-resolves the actor from THIS box's SSH_CONNECTION and mis-credits it
-    // (RUSH-2028). Flows to both POSIX (export) and Windows ($env:) dialects.
-    // AGENTS_FLEET_REMOTE marks this as a fleet-dispatched `--host` run so the far
-    // side can gate consent-sensitive actions — the browser consent gate
-    // (lib/browser/remote-control.ts) reads it to allow/deny a cross-machine drive.
-    const env = withActorEnv({ ...doctorPath, AGENTS_FLEET_REMOTE: '1' });
-    const remoteCmd = buildRemoteAgentsInvocation(forwarded, remoteCwd, remoteOs, env);
-    const code = sshStream(target, remoteCmd, { tty: interactive, multiplex: true });
+    process.exitCode = streamAgentsOnHost(host, forwarded, {
+        remoteCwd,
+        interactive,
+        extraEnv: doctorPath,
+        remoteOs,
+        target,
+    });
+    return true;
+}
+/**
+ * Run `agents <forwardedArgs>` on `host` over SSH, streaming its output, and
+ * return the exit code. The single place the SSH hop is built, so every remote
+ * `agents` invocation carries identical env semantics.
+ *
+ * Forwards actor provenance (`AGENTS_ACTOR`/`GIT_` vars) across the hop, merged UNDER
+ * `extraEnv` so a caller-supplied PATH still wins — without this the remote
+ * re-resolves the actor from THIS box's SSH_CONNECTION and mis-credits it
+ * (RUSH-2028). Flows to both POSIX (export) and Windows ($env:) dialects.
+ * AGENTS_FLEET_REMOTE marks this as a fleet-dispatched run so the far side can
+ * gate consent-sensitive actions — the browser consent gate
+ * (lib/browser/remote-control.ts) reads it to allow/deny a cross-machine drive.
+ */
+export function streamAgentsOnHost(host, forwardedArgs, opts = {}) {
+    const target = opts.target ?? sshTargetFor(host);
+    const remoteOs = opts.remoteOs ?? resolveRemoteOsSync(host.name);
+    const env = withActorEnv({ ...opts.extraEnv, AGENTS_FLEET_REMOTE: '1' });
+    const remoteCmd = buildRemoteAgentsInvocation(forwardedArgs, opts.remoteCwd, remoteOs, env);
+    const code = sshStream(target, remoteCmd, { tty: !!opts.interactive, multiplex: true });
     if (code === 255) {
         console.error(chalk.red(`${host.name}: unreachable over SSH (asleep, offline, or host key changed?).`) +
             chalk.gray(' Check: agents hosts check ' + host.name));
     }
-    process.exitCode = code;
-    return true;
+    return code;
 }

package/dist/lib/mcp.js

@@ -596,6 +596,7 @@ function writeMcpConfigSupportsAgent(agentId) {
         case 'hermes':
         case 'pi':
         case 'muse':
+        case 'warp':
             return true;
         default:
             return false;
@@ -621,7 +622,10 @@ export function writeMcpConfig(agentId, configPath, servers, mode = 'overwrite')
         // omp reads the same Claude `{ "mcpServers": {...} }` schema from .mcp.json
         // (stdio: command/args/env; http/sse: url/headers — transport inferred from
         // command/url presence).
-        case 'pi': {
+        case 'pi':
+        // Oz reads the same Claude `{ "mcpServers": {...} }` schema from
+        // `.warp/.mcp.json` (stdio + http with headers).
+        case 'warp': {
             let config = {};
             if (fs.existsSync(configPath)) {
                 try {

package/dist/lib/menubar/snapshot.d.ts

@@ -0,0 +1,15 @@
+import type { WatchdogTickResult } from '../watchdog/runner.js';
+export interface MenubarSnapshot {
+    version: 1;
+    capturedAt: string;
+    routines: Record<string, unknown>[];
+    recentSessions: Record<string, unknown>[];
+    activeSessions: Record<string, unknown>[];
+    watchdog: {
+        enabled: boolean;
+        lastTick: Pick<WatchdogTickResult, 'didNudge' | 'counts'> | null;
+    };
+}
+export declare function readLastWatchdogTick(stateDir?: string): WatchdogTickResult | null;
+/** One-process read model for AGI Menu's repeating three-minute refresh. */
+export declare function computeMenubarSnapshot(): Promise<MenubarSnapshot>;

package/dist/lib/menubar/snapshot.js

@@ -0,0 +1,40 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { buildRoutineListJson } from '../../commands/routines.js';
+import { backfillActiveRowsFromIndex, serializeActiveSessionsForJson, serializeSessionsJson } from '../../commands/sessions.js';
+import { getConfigValue } from '../device-config.js';
+import { querySessions } from '../session/db.js';
+import { readActiveSessionsCache } from '../session/session-cache.js';
+import { getRuntimeStateDir } from '../state.js';
+export function readLastWatchdogTick(stateDir = path.join(getRuntimeStateDir(), 'watchdog')) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(stateDir, 'last-tick.json'), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** One-process read model for AGI Menu's repeating three-minute refresh. */
+export async function computeMenubarSnapshot() {
+    const [routines, recent] = await Promise.all([
+        Promise.resolve(buildRoutineListJson()),
+        Promise.resolve(querySessions({ limit: 40, skipExistenceCheck: true })),
+    ]);
+    const active = readActiveSessionsCache('local');
+    const activeSessions = active?.sessions ?? [];
+    backfillActiveRowsFromIndex(activeSessions);
+    return {
+        version: 1,
+        capturedAt: new Date().toISOString(),
+        routines,
+        recentSessions: JSON.parse(serializeSessionsJson(recent)),
+        activeSessions: serializeActiveSessionsForJson(activeSessions),
+        watchdog: {
+            enabled: getConfigValue('watchdog.enabled').value === true,
+            lastTick: (() => {
+                const tick = readLastWatchdogTick();
+                return tick ? { didNudge: tick.didNudge, counts: tick.counts } : null;
+            })(),
+        },
+    };
+}

package/dist/lib/plugins.js

@@ -68,8 +68,20 @@ export function discoverPluginsInDir(pluginsDir, spec = { kind: 'user' }) {
             continue;
         const pluginRoot = path.join(pluginsDir, entry.name);
         const manifest = loadPluginManifest(pluginRoot);
-        if (!manifest)
+        if (!manifest) {
+            // A directory that looks like a plugin root but has no valid manifest is
+            // silently invisible to every downstream command (list/info/sync, and the
+            // materialize-into-version-homes copy) with no other diagnostic anywhere
+            // in the chain — it can sit here indefinitely, on the correct git commit,
+            // and never surface as broken (RUSH-2270: the `work` plugin shipped
+            // without .claude-plugin/plugin.json and nothing noticed for a full merge
+            // cycle). Warn once here, at the one place that decides discoverability,
+            // so the gap is visible the moment `agents sync` runs.
+            const manifestPath = path.join(entry.name, PLUGIN_MANIFEST_DIR, PLUGIN_MANIFEST_FILE);
+            process.stderr.write(`agents-cli: '${entry.name}' in ${pluginsDir} has no valid ${manifestPath} ` +
+                `(missing, malformed JSON, or missing name/version) — skipped, not discovered as a plugin.\n`);
             continue;
+        }
         plugins.push(buildDiscoveredPlugin(pluginRoot, manifest, spec));
     }
     return plugins;

package/dist/lib/resources/mcp.js

@@ -129,6 +129,9 @@ export function getMcpConfigPath(agent, versionHome) {
             return path.join(versionHome, '.omp', 'agent', '.mcp.json');
         case 'muse':
             return path.join(versionHome, '.config', 'muse', 'settings.json');
+        case 'warp':
+            // Oz reads user-scope MCP from ~/.warp/.mcp.json (Claude schema).
+            return path.join(versionHome, '.warp', '.mcp.json');
         default:
             return null;
     }

package/dist/lib/routine-process-cleanup.d.ts

@@ -0,0 +1,9 @@
+import type { RunMeta } from './routines.js';
+export interface RoutineProcessCleanupOptions {
+    runsDir?: string;
+    alive?: (pid: number) => boolean;
+    owns?: (meta: RunMeta) => boolean;
+    terminate?: (pid: number) => void;
+}
+/** Reap process groups whose durable run record is already terminal. */
+export declare function reapTerminalRoutineProcesses(opts?: RoutineProcessCleanupOptions): number[];