@phnx-labs/agents-cli 1.22.24 → 1.22.26

package/CHANGELOG.md

@@ -1,7 +1,356 @@
 # Changelog
 
+## 1.22.26
+
+- Make bare `agents setup` a re-runnable onboarding hub with live capability status and direct access to browser, computer, secrets, fleet, share, watchdog, and preference wizards.
+
+- **`agents apply --provision-secrets` pushes the manifest's declared secrets
+  bundles to each device, instead of only printing a reminder (RUSH-1968).** This
+  gap is a direct cause of the ticket: an operator who needed secrets on a worker
+  box had no supported path — `apply` said "recreate manually" and nothing else —
+  so they hand-exported the file store's master key across the fleet. The
+  provisioning primitive now exists, and `apply` runs it as a fifth reconcile
+  phase, last, because it is the most sensitive mutation `apply` performs.
+
+  It is **off by default** and is a **flag, not a manifest field**: `agents.yaml`
+  is shared, so a file-level default would mean someone else's `apply -y` silently
+  ships credential values. Three gates, and every refusal still prints a
+  `needs-secret` reminder so a skipped device is never silent — the flag must be
+  set, the device must be reachable, and its host key must be **pinned** (the same
+  bar `agents exec --copy-creds` sets, EXEC-34).
+
+  **Backend follows the platform: `file` on Linux, `keychain` on macOS/Windows.**
+  That is the load-bearing default — a headless Linux box has no keychain and its
+  file store auto-provisions its OWN machine-local key, so each device gets an
+  unshared at-rest key and **no passphrase is forwarded**. That is the direct
+  alternative to the fleet-wide shared secret this ticket is about.
+
+  With provisioning on, `apply` runs one extra `agents secrets list --json` per
+  device (metadata only — names and timestamps, never values) and skips a bundle
+  the device already has; without that, every run re-resolves the bundle locally
+  and a resolve can prompt for Touch ID, so a converged fleet would nag on every
+  apply. It compares presence, not content — `--force` re-pushes regardless. The
+  `--plan` matrix gains a `secrets` column, shown only when the manifest declares
+  bundles, and names the flag when the capability is available but off. Source:
+  `apps/cli/src/lib/secrets/push.ts` (extracted from the `export --host` action so
+  a lib no longer needs a command module), `apps/cli/src/lib/fleet/apply.ts`,
+  `apps/cli/src/commands/apply.ts`.
+
+- **`agents teams` auto-scheduling is health-, harness-, and load-aware, and fails loud when no pool device can run the agent (RUSH-2002).** Placing an unpinned teammate onto a `--devices` pool used to be a pure roster count that could land it on an unreachable box, an overloaded one, or one where its agent isn't installed. `teams start` now probes the pool once (reachability + load from the same snapshot `agents devices` shows, plus whether the teammate's agent is installed there) and: excludes unreachable / overloaded (`loaded` headroom) / `agents.max-concurrent`-capped / not-installed devices, then ranks the survivors by agent installed + signed in, then lower load, then fewer running teammates. If no pool device can run a pending teammate's agent, `teams start` fails loud — `No device in the team pool can run claude@2.1.112. Run 'agents devices ping' to see which devices have the agent installed + signed in.` — instead of stranding the teammate or silently falling back to a local run; `--force` downgrades it to a warning. A probe that could not reach the pool does not trigger the failure (no false positives). The pick stays pure and fully unit-tested; `teams add` is unchanged (no probe on the add path). Source: `apps/cli/src/lib/teams/scheduler.ts`, `apps/cli/src/lib/teams/placement-probe.ts`, `apps/cli/src/lib/teams/agents.ts`, `apps/cli/src/commands/teams.ts`.
+
+- **`agents reconnect [session-id]` re-enters a dropped remote agent terminal, and the auto-reconnect no longer dead-ends on a dead pane (RUSH-2085).** When the network dropped during `agents run --device <box>` and the peer's tmux pane was gone by the time the link came back, the reattach ran `agents sessions focus <id> --local --attach-only`, which hard-failed with `No live session matching …` and dropped the user at a bare shell with the id scrolled off screen. Two fixes: the auto-reconnect reattach now runs `agents sessions focus <id> --local` (no `--attach-only`), so a surviving pane is joined and a dead one RESUMES in place instead of dead-ending; and a new `agents reconnect` (also `agents sessions reconnect`) is the manual companion for after the auto-loop gave up or a VS Code terminal tab closed — attach the live pane if it survived, else resume the session. With no id it targets the most recent session started from the current directory (the terminal that most likely just dropped), not the full fleet picker. The exhausted / remote-exit notices now print the exact `agents reconnect <id>` command instead of a raw id and a shell prompt. Source: `apps/cli/src/lib/hosts/reconnect.ts`, `apps/cli/src/commands/reconnect.ts`.
+
+- **`agents routines add` now rejects an agent the local daemon can't fire, at add time (RUSH-2102).** `--agent opencode` (or any real, installable agent outside the daemon's `AGENT_COMMANDS` table — currently `claude`, `codex`, `gemini`, `cursor`, `kimi`, `droid`, `muse`) used to pass `validateJob` because it only checked the agent against the full agent registry, not the daemon-runnable subset — the routine was written to disk and only failed once the scheduler fired it (`Unsupported agent for daemon jobs: opencode`). `validateJob` now rejects it immediately for the default local placement, with an error naming the supported agents. Routines placed with `hostStrategy: host`/`fleet`/`cloud` are unaffected — those dispatch through `agents run`/a cloud provider, not this table, so a wider agent set is legitimately supported there. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/agents.ts`.
+
+- **OpenClaw's capability table no longer claims `hooks: true` with zero hooks
+  ever installed (RUSH-2122).** `registerHooksToSettings` has no `openclaw`
+  branch and silently returned `{ registered: [], errors: [] }` for it, so
+  `agents sync openclaw` reported success while installing nothing, and
+  `agents doctor` treated the agent as hooks-capable with no way to detect the
+  gap. OpenClaw only exposes a fixed set of internal, named hooks (e.g.
+  `boot-md`, which runs `BOOT.md` on gateway restart) — there is no general
+  event->shell-command registration surface an agents-cli `hooks.yaml`
+  manifest could target — so `capabilities.hooks` and `supportsHooks` now read
+  `false`, matching what the CLI can actually do. A new completeness test
+  (`hooks-capability-completeness.test.ts`) pins every `hooks: true` agent to a
+  real branch in `registerHooksToSettings` so a capability flip can never ship
+  again without a registrar behind it. Source: `apps/cli/src/lib/agents.ts`,
+  `apps/cli/src/lib/hooks-capability-completeness.test.ts`.
+
+- **`agents browser stream` keeps one Node process and browser-daemon IPC socket warm across repeated actions (RUSH-2149).** The newline-delimited JSON interface sends every request through the existing browser daemon and its cached CDP connection, so screenshot/click loops no longer need a fresh `agents` process or IPC connection per action. `--task` (or `AGENTS_BROWSER_TASK`) supplies the default task, a `start` response becomes the default for later lines, and malformed input returns an error response without ending the stream. Fleet-remote `start` requests enforce the same device-local `browser remote-control` consent gate as the ordinary command. Source: `apps/cli/src/lib/browser/ipc.ts`, `apps/cli/src/lib/browser/stream.ts`, `apps/cli/src/commands/browser.ts`.
+
+- **`agents sessions backfill tools` reads a growing transcript incrementally, and
+  the search index compacts itself (RUSH-2208).** Incremental discovery already
+  appended tool calls for a Claude/Codex session that grew; the backfill did not.
+  Every `ensureToolIndex` pass re-read the transcript from byte 0 and deleted the
+  session's stored evidence to rewrite it, so a session backfilled N times cost N
+  full parses of an ever-larger file — measured on a 4.5 MiB, 4000-call transcript
+  that grew by 20 calls: 344 ms and 4020 calls re-parsed, now 12 ms and 20 calls.
+  Schema v36 adds a resume point to `tool_scan_ledger` (`parsed_offset`, the byte
+  just past the last complete record consumed, and `parser_state`, the collector
+  snapshot at that offset), so a transcript that only grew is read from where the
+  last pass stopped and merged into what is already stored; the batch byte budget
+  now counts the bytes a pass actually reads rather than the file's size, so one
+  bounded batch covers far more growing sessions. A different extractor version, a
+  mismatched ledger path, a file shorter than what was parsed, or an unreadable
+  snapshot still re-reads the whole file. Two related fixes ride along:
+  `tool_call_text` rows are addressed by the `rowid` of the call they describe
+  instead of the UNINDEXED `call_key`, which made every delete a full scan of the
+  FTS index, and the scan path now runs a bounded, threshold-gated FTS `'merge'`
+  after each batch of writes, so index health no longer depends on someone running
+  `agents sessions optimize` by hand. Source: `apps/cli/src/lib/session/tool-index.ts`,
+  `apps/cli/src/lib/session/tool-store.ts`, `apps/cli/src/lib/session/db.ts`.
+
+- **OpenCode session scans re-index only the sessions that changed (RUSH-2210).** OpenCode
+  keeps every session in one shared `opencode.db`, and the scanner stamped each session
+  with that whole file's mtime/size. Any write to any session therefore invalidated every
+  indexed session, so a single new turn re-emitted up to 1000 sessions — and the indexer
+  re-opened `opencode.db` once per re-emitted session to re-parse a transcript that had
+  not moved. Each session is now stamped with its own newest write time (across its
+  `session` row, its messages, and its parts) and the byte length of its message + part
+  payloads, so an unchanged session is skipped; the file-level stat stays only as the
+  cheap "nothing changed at all" short-circuit, and a scan opens `opencode.db` once
+  instead of once per session. The stamp deliberately does not rely on
+  `session.time_updated` alone, which real databases leave hours behind the session's
+  newest part. A side effect: `sessions.file_size` for an OpenCode row is now that
+  session's payload size instead of the whole database's size, so the tool-backfill byte
+  budget and its 16 MiB in-memory parser cap finally reflect the real cost of parsing
+  that one session. Source: `apps/cli/src/lib/session/discover.ts`.
+
+- **Session query hot path is indexable again (RUSH-2211).** The default `agents
+  sessions` listing sort (`ORDER BY IFNULL(last_activity, timestamp) DESC`)
+  wrapped the sort column in `IFNULL()`, which defeats `idx_sessions_last_activity`
+  and forces a full table sort on every list/resume query; a new migration
+  backfills `last_activity` so it's unconditionally `NOT NULL` and the sort now
+  runs on the bare column (`EXPLAIN QUERY PLAN` confirms `USING INDEX
+  idx_sessions_last_activity`). The post-query existence check now batches
+  `fs.existsSync` per directory instead of one stat syscall per row — real
+  transcript trees put many sessions in one project directory, so this collapses
+  thousands of stats into a handful of `readdirSync` calls with the same result.
+  Interactive label search (`ftsSearch`) no longer runs a leading-wildcard
+  `LOWER(label) LIKE '%q%'` scan of the whole `sessions` table on every keystroke;
+  it now queries the already-indexed FTS5 `label` column. Source:
+  `apps/cli/src/lib/session/db.ts`.
+
+- **The standalone `browser` binary now routes `--host`/`--device` (RUSH-2214).** `browser start --host <box>` dispatches to the remote over SSH, exactly like `agents browser start --host <box>` already did — previously the standalone bin dropped the flag with `unknown option '--host'` because it never entered the top-level router. A self-named or absent host still runs locally. Source: `apps/cli/src/browser.ts`, `apps/cli/src/lib/hosts/passthrough.ts`.
+
+- **`agents run --device` no longer reports a host as unreachable when the SSH probe times out (RUSH-2249).** The ready probe (`readyProbe` in `hosts/ready.ts`) now disables SSH multiplexing so a stale control socket cannot hang the local client, and it checks `r.timedOut` before parsing stdout — a slow login shell (nvm/sdkman init, cold node startup) producing an empty stdout was silently treated as "not reachable". A timeout now surfaces a distinct, actionable error that names the cause and suggests `agents ssh <host> agents view` to confirm manually, rather than the misleading "not reachable over SSH" message. Source: `apps/cli/src/lib/hosts/ready.ts`.
+
+- **`agents teams start` nudges the operator toward feed milestones (RUSH-2250).**
+  After launching teammates, `teams start` now prints a one-line tip — teammates are
+  briefed to post IMPORTANT milestones to the feed (watch them with
+  `agents feed timeline`), and team progress is watched with `agents teams status
+  <team>`. Print-only in both the single-wave and `--watch` paths (suppressed under
+  `--json`); no engine behavior changes. Pairs with the `.agents-system` guidance
+  that instructs teammates to post those milestones. Source:
+  `apps/cli/src/commands/teams.ts`.
+
+- **`secrets list` no longer skips every biometry-ACL'd item, so `hold`/`always`-policy
+  bundles are readable again (RUSH-2251).** A regression first shipped in v1.22.10 added
+  `kSecUseAuthenticationUI: kSecUseAuthenticationUISkip` to the keychain helper's `list`
+  data-protection pass. `UISkip` makes `SecItemCopyMatching` silently omit every item
+  protected by a biometry access control — which is exactly the value items `set` writes —
+  so enumeration returned only the no-ACL metadata and `never`-policy items. Every consumer
+  that builds its keychain read set from that enumeration (`secrets exec`/`get`/`unlock`/
+  `view --reveal`/`export`, `agents run --secrets`, `ssh`, `browser`, `share`) then reported
+  the real secrets as `stored item '…' not found`, and `unlock` could not even warm the
+  broker to work around it. The DP pass is now attributes-only with **no** `kSecUseAuthenticationUI`
+  key: `kSecReturnAttributes` without `kSecReturnData` never evaluates the ACL, so it
+  neither prompts for Touch ID nor filters the ACL'd items out — restoring the design the
+  code comment already described. The RUSH-2233 timeout bound on that pass is unchanged.
+  Source: `apps/cli/src/lib/secrets/keychain-helper.swift`.
+
+- **Hook-cache background refresh recovers from an orphaned single-flight lock (RUSH-2259).**
+  The stale-while-revalidate lock (`<cache>.bg.lck`) was only released by the
+  background refresh's `EXIT` trap, so a hard kill (SIGKILL, OOM, reboot) that
+  skipped the trap orphaned the dir and every future refresh's `mkdir` failed —
+  permanently stalling background refresh while stale cache was served forever.
+  The shim now reclaims a lock older than a 5-minute TTL before acquiring, so a
+  dead lock self-heals on the next fire. Source: `apps/cli/src/lib/hooks/cache.ts`.
+
+- **`agents doctor` now fails loud when this box cannot reach the owner-delivery lane (RUSH-2262).** The feed/notify owner lane (`agents notify`, `agents feed post --level important` / `--blocked`) delivers over the rush-backed owner channel (iMessage), which only works from a context that has `rush` on PATH and can read its keychain-bound session — so a headless Linux fleet box (no rush) or a non-GUI SSH session on a mac (login keychain locked) silently could not escalate a blocked agent, surfacing only as an after-the-fact `owner failed: …` line. `agents doctor` had no signal for it. A new critical finding, `owner-sink-unreachable`, probes the same transport from the same context doctor runs in (`which rush` + `rush whoami`, never `~/.rush/user.yaml`, since the token is a keychain item) and reports `owner → unreachable: rush CLI not on this box's PATH` / `rush has no usable session here` with the fix. It fires only when owner delivery is configured for the fleet, so an un-opted-in box is never flagged; `agents notify --dry-run` is not this check (it short-circuits before the `which rush` preflight and reports success even where rush is absent). Source: `apps/cli/src/lib/channels/owner-sink.ts`, `apps/cli/src/lib/devices/doctor-findings.ts`, `apps/cli/src/commands/doctor.ts`.
+
+- **`agents insights` owns counter mix; `agents trends` is a deprecated alias.** The
+  former top-level `trends` tree (harness/model mix, tools-per-session, token ratios,
+  secrets/browser recipes, raw usage query) now lives under `agents insights mix` and
+  `agents insights <recipe>` / `query` / `recipes`. Bare `agents insights` remains the
+  behavioural report (transcript content, account split). `agents trends` still works
+  but prints one deprecation line and runs the same mix tree — no second implementation.
+  **Why:** two peer "analytics" verbs (`insights` + `trends`) taught agents and humans
+  to guess; one verb, two engines (content vs counters). Latency stays on `agents perf`;
+  quota on `agents usage`; skill/slash popularity on `agents sessions stats`. Source:
+  `apps/cli/src/lib/analytics/mix-commands.ts`, `commands/insights.ts`,
+  `commands/trends.ts`, `docs/06-observability.md`.
+
+- **The keychain reaper no longer kills the auto-lock-on-sleep watcher (RUSH-2232 follow-up).**
+  The reaper (shipped in 1.22.23) classified a process as a reap target purely by the
+  helper binary path, which also matches the broker's deliberately long-lived
+  `watch-lock` watcher — a healthy child of the live daemon that wipes the in-memory
+  secret store on sleep. Its class-(b) rule ("helper child of a live parent, older than
+  90s") therefore killed the watcher on its second sweep (~10 min after the daemon
+  started hosting the broker), silently disabling auto-lock-on-sleep. Reap-eligibility
+  now matches the full command line and excludes the `watch-lock` verb, so only the
+  short-lived keychain reads/writes a wedged `coreauthd` can hang are ever reaped.
+  Source: `apps/cli/src/lib/secrets/reaper.ts` (`isReapableHelperCommand`).
+
+## 1.22.25
+
+---
+issue: 2108
+type: fixed
+---
+
+`agents sessions focus ... --active` now excludes closed and crashed registry rows; explicit lifecycle filters such as `--closed` and `--crashed` still select them. Per-device `latest` / `oldest` selectors also wait for the peer's filtered index result instead of widening to live rows whose version is unknown.
+
+- **`agents doctor` now reports the file-store master key when it is live in the
+  process environment, not just when it is exported from a shell rc file
+  (RUSH-1968).** `rc-hygiene.ts` scans FILES, which leaves a real hole: a value
+  inherited by a long-lived process outlives the rc line that set it, so an operator
+  who deletes `~/.zshenv:8` gets a clean `rc-secret-export` while every shell, editor
+  and agent started before the edit still carries the key and hands it to everything
+  they spawn. Confirmed on `yosemite-s1`, which has zero rc exports and still had the
+  value in its environment. The new `env-secret-export` warning names that state and
+  says the deletion is not sufficient; like every other finding it reports only that
+  the variable is set, never its value. Expected inside a release sign context
+  (`headless-sign-context.sh` sets it deliberately), which the message says so an
+  operator on the home base does not chase it. Source:
+  `apps/cli/src/lib/secrets/rc-hygiene.ts` (`masterPassphraseInEnv`),
+  `apps/cli/src/lib/devices/doctor-findings.ts`, `apps/cli/src/commands/doctor.ts`.
+
+- **`agents doctor --devices` now reports a remote box's secret hygiene, and its
+  inventory probe no longer times out on a slow box (RUSH-1968).** The fan-out ran
+  each remote's own `doctor --json` but parsed only `.fleet`, discarding the
+  `findings` the remote had already computed — so a leaking box read as clean from
+  anywhere but itself. The remote's `rc-secret-export` / `env-secret-export` rows
+  now ride back, but the remote contributes exactly one thing: the **kind**. Severity,
+  message and remediation are generated locally, and `device` is overwritten with the
+  name that was dialled. Each of those matters separately — a remediation is a command
+  a human copies and runs, a message is the one place a secret value could re-enter a
+  readout that otherwise never prints one, a severity decides the CRITICAL section, and
+  a device name decides which box gets blamed. The cost is detail: the fleet row names
+  the box and the kind, and says to run `agents doctor` there for the file and line.
+  Only those two kinds forward — sign-in and divergence rows are recomputed centrally
+  and would otherwise double.
+
+  Separately, the probe's 30s timeout was below the real cost of the command it
+  runs — `doctor --json` measures 57s on `yosemite-m0` and 136s on an idle box — so
+  every slow device silently contributed nothing at all: no inventory, no sign-in,
+  no divergence. Raised to 180s, matching `ChildProcess.doctorTimeout`, which was set
+  to 180 for this same command for this same reason. Source:
+  `apps/cli/src/commands/doctor.ts` (`asRemoteSecretFindings`, `probeFleetInventory`).
+
+- **Feed and menu-bar session counts now use the `agents sessions --active` lifecycle model (RUSH-1993).**
+  Feed outcome headers count distinct mailbox agents in every state, so repeated
+  open blocks from one agent cannot make `needs you` exceed `agents`. Feed rows
+  replace generic `terminal` with a known host app and label routine-spawned
+  sessions as `routine:<name>`. The menu-bar snapshot backfills the same routine
+  metadata as active-session JSON and renders the full canonical status set
+  (`working`, `waiting`, `idle`, `queued`, `orphan`, `crashed`, `closed`,
+  `abandoned`, `unknown`) without reclassifying warm rows from attention files.
+  Source: `apps/cli/src/commands/feed.ts`, `apps/cli/src/commands/sessions.ts`,
+  `apps/cli/src/lib/feed-outcome.ts`, `apps/cli/src/lib/menubar/snapshot.ts`,
+  `apps/cli/menubar/Sources/MenubarHelper/{LocalState,StatusItemController}.swift`.
+
+- **A typo'd command with `--host` said the opposite of the truth (RUSH-2022).** The
+  `--host`/`--device` router runs before commander parses, so `agents session resume
+  --host <box>` (one letter off `sessions`, which *does* accept `--host`) reported
+  ``  `agents session` does not support --host/--device `` — a true statement about a
+  command nobody typed. Unknown names now fall through to `unknown command '<name>'`
+  with a did-you-mean, and the spellcheck can suggest the lazily-registered groups
+  (`sessions`/`teams`/`cloud`/…) it previously could not see. A real command with no
+  remote semantics still gets the flag-support error. Source:
+  `apps/cli/src/lib/hosts/passthrough.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **`agents publish` is in the lazy command table.** `commands/packages.ts` registers it
+  at top level but the registry did not list it, so it only resolved through the
+  unknown-command fallback that loads the whole command tree. Found by the new test
+  that pins the command-name set against the real tree.
+
+- **A mistyped command keeps its `--host`.** The distance-1 auto-correct now re-checks
+  routing after correcting the name, so `agents docto --host <box>` corrects to
+  `doctor` **and actually routes to `<box>`** — previously the corrected command
+  re-parsed locally with a `--host` it silently dropped (a regression caught in review:
+  it used to fail loudly with the wrong message, corrected-but-unrouted made it fail
+  silently instead). `apps/cli/src/index.ts`.
+
+- **Cursor now supports `--mode plan` headless and interactive (RUSH-2101).** The
+  capability registry previously listed only `edit` and `skip`, so `agents run cursor --mode plan`
+  and routine jobs silently degraded to writable `edit`. `cursor-agent` has supported `--plan`
+  since the 2026-01-16 CLI release; the registry, `AGENT_COMMANDS` flag mapping, and the routine
+  runner now forward it correctly. Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/exec.ts`,
+  `apps/cli/src/lib/runner.ts`.
+
+- **`agents sessions resume` picker now filters in-memory on every keystroke instead of re-querying the database (RUSH-2212).** The `filter` callback in the multi-select picker was calling `filterSessionsByQuery`, which runs a full-text search scan against `sessions.db` on every character typed. It now uses the same cheap in-memory substring match (`sessionMatchesQuery`) the session browser already applies, so the picker stays responsive regardless of library size. Source: `apps/cli/src/commands/sessions-resume.ts`.
+
+---
+type: minor
+---
+
+Add Cursor Cloud Agents as a native cloud provider so `agents run cursor --cloud` and `agents cloud run --agent cursor` dispatch through Cursor's v1 REST API, with status, streaming, cancellation, and follow-up runs.
+
+- **A starved `coreauthd` can no longer hang `secrets list` forever (RUSH-2233).**
+  The keychain helper's `list` runs two passes, and the data-protection pass omits
+  `kSecUseAuthenticationUI: …Fail` on purpose (that flag drops every biometry-ACL
+  item even when authentication is healthy). Omitting it means the query still
+  reaches LocalAuthentication/`coreauthd`, which has no deadline of its own — a
+  wedged `coreauthd` left `SecItemCopyMatching` blocked for the life of the
+  process. That is *why* helpers accumulated for the bounded-spawn + reaper work
+  in RUSH-2231/2232 to clean up. The pass now runs on a background thread behind
+  a 3-second wait: on timeout the helper logs one line to stderr, skips the pass,
+  and prints whatever the file-keychain pass produced — the same handling the
+  screen-locked `errSecInteractionNotAllowed` case already got. Set
+  `AGENTS_KEYCHAIN_LIST_TIMEOUT_MS` to override the deadline;
+  `AGENTS_KEYCHAIN_BOUNDED_TEST=1` runs the helper's headless self-test for the
+  bounded wait. Source: `apps/cli/src/lib/secrets/keychain-helper.swift`.
+
+- **Use one three-minute AGI Menu snapshot and one watchdog executor (RUSH-2260).**
+  The menu bar now reads routines, 40 indexed recent sessions, the daemon-warmed
+  active-session cache, and persisted watchdog state in one subprocess every three
+  minutes; `doctor --json` remains independently limited to 15 minutes. The menu no
+  longer executes watchdog ticks. The daemon is the sole automatic watchdog executor,
+  warms active sessions on the same three-minute cadence, is gated by device-local
+  `watchdog.enabled`, and cleans failed/timeout routine process groups that are still
+  alive before they can overlap a replacement run. Source:
+  `apps/cli/src/lib/menubar/snapshot.ts`, `apps/cli/src/lib/daemon.ts`,
+  `apps/cli/src/lib/routine-process-cleanup.ts`.
+
+- **Add Warp Agent CLI (Oz) as a harness (RUSH-2261).** `warp` is now a
+  first-class harness: `agents add warp`, `agents run warp`, `agents teams add
+  <team> warp`, resource sync, and `agents view` all work. The CLI command is
+  `oz` (the shared Warp binary); install is self-updating via
+  `brew install --cask oz` (macOS) / `oz-stable` apt|yum|pacman (Linux), config
+  lives under `~/.warp/`, the rules/context file is `AGENTS.md`, and auth is
+  `oz login` (browser OAuth) or a `WARP_API_KEY` token for headless/CI.
+  Capabilities are truthful and gated by `supports()`: MCP (Claude
+  `.mcp.json` schema at `~/.warp/.mcp.json`, stdio + http with headers) and
+  skills are on; hooks, allowlist, commands, plugins, subagents, workflows, and
+  memory are off (Oz exposes no matching install surface). Sessions are not
+  indexed — Oz stores conversations server-side (retrieved with auth via
+  `oz run conversation get <id>`), so there is no local transcript for
+  `agents sessions`. No usage bar — Oz exposes no usage/limits endpoint.
+  Source: `apps/cli/src/lib/{agents,exec,mcp}.ts`.
+
+`scripts/release.sh` now runs orchestration in a fresh release-owned worktree, so a dirty shared checkout or feature branch no longer blocks or contaminates a release.
+
+- **Plugin discovery warns instead of silently skipping a directory with no
+  `.claude-plugin/plugin.json` (RUSH-2270).** A `plugins/<name>/` directory missing
+  (or with a malformed) manifest was invisible to `agents plugins list`/`info`/`sync`,
+  `agents doctor`, and the marketplace materialize-into-version-homes step, with zero
+  diagnostic anywhere in the chain — no `agents sync`/`agents repo pull` could
+  surface it, since discovery dropped it before any of those ran. Found via a real
+  case: the `work` plugin merged to `phnx-labs/.agents-system` without its manifest
+  and sat invisible for a full merge cycle; the same fix run against this box's own
+  `~/.agents/plugins/duck` found it missing one too. `discoverPluginsInDir` now
+  writes one `agents-cli:` warning to stderr naming the directory and the missing
+  manifest path, matching the existing advisory-not-fatal pattern
+  `syncMarketplaceManifest` already uses for a malformed (as opposed to missing)
+  manifest. Source: `apps/cli/src/lib/plugins.ts`.
+
+- **Muse login is recognized under `providers.meta` (balanced no longer signed_out).**
+  Live `muse login` writes `~/.config/muse/auth.json` as
+  `{ schema_version, providers: { meta: { access_token, user_email, … } } }`.
+  The presence detector only walked one object level, so it never saw the token
+  under `providers.meta` and reported signed-out after a successful OAuth —
+  `agents run muse` under balanced then failed with "excluded: 0.1.0
+  (signed_out)". Detection now recurses into nested provider slots and surfaces
+  `user_email` when present. Source: `apps/cli/src/lib/agents.ts`.
+
+- **File-backed secret resolution now fails on decryption errors instead of treating unreadable ciphertext as an absent value (RUSH-2264).** A wrong `AGENTS_SECRETS_PASSPHRASE` or tampered encrypted value now reports the affected file-store item and stops before launching a consumer with an empty secret such as `HCLOUD_TOKEN`. Source: `apps/cli/src/lib/secrets/filestore.ts`, `apps/cli/src/lib/secrets/bundles.ts`.
+
 ## 1.22.24
 
+- **`agents run --lease` now shares one warm pool across repositories by default (RUSH-2225).** Repo sandbox/CI `profile:` labels no longer split lease reuse into one idle box per repo; a dedicated lease pool is explicit with `.crabbox.yaml` `leaseProfile:`. An empty pool keeps its newly warmed box for later callers. Concurrent runs attach with crabbox `--reclaim` and launch with separate working trees, agent homes, and credential files, so callers share compute without clobbering run state. Switching repos re-syncs the checkout, trading cache latency for lower idle-compute cost. Source: `apps/cli/src/lib/crabbox/config.ts`, `apps/cli/src/lib/crabbox/lease.ts`, `apps/cli/src/commands/exec.ts`.
+
+- **`agents sessions insights` turns multi-harness session history into an action list
+  (RUSH-2280).** The existing `agents insights` command is now also nested under the
+  sessions noun, accepts repeatable `--agent` filters, and reports deterministic offline
+  friction/thrash, owner corrections, automatable repeats, harness split, and ranked
+  rule/skill/automation/product actions with evidence counts and shortened sample session
+  ids. `/sessions-insights` is a thin agent entry over the same CLI implementation;
+  `--narrative` remains opt-in and receives aggregate data only. Source:
+  `apps/cli/src/commands/insights.ts`, `apps/cli/src/lib/session/insights.ts`,
+  `.agents/commands/sessions-insights.md`.
+
 - **`agents sessions focus` recovers dead panes and shares the sessions browser's selectors (GH-2108).** A retained tmux `remain-on-exit` pane is probed through `#{pane_dead}` immediately before attach, so dead or missing panes no longer open a `Pane is dead` screen. `focus` accepts session ids, topic/path searches, `agent@version` selectors (including per-device `latest`/`oldest`), device, project/time, team/routine, skill/plugin, favorites, and the complete live-state union. Focus, resume, attach, and `run --resume` now use one recovery decision on the origin device: a healthy exact origin performs native resume; otherwise balanced selection chooses a healthy version of the same harness and sends `/continue <id>` to read the indexed transcript, including transcripts retained under version trash. Host-dispatched rows persist the dispatch host as their origin, and `attach` routes its detach-record cleanup there before resuming. No usable same-harness version fails with the device, origin version, and account-health reason. Source: `apps/cli/src/commands/focus.ts`, `apps/cli/src/commands/sessions-browser.ts`, `apps/cli/src/lib/session/recovery.ts`.
 
 - **`agents secrets setup` no longer tells you to set `AGENTS_SECRETS_PASSPHRASE`, and
@@ -108,7 +457,7 @@
 
 - **Fix: the keychain-helper reaper never reaped on macOS.** The daemon reaper shelled `ps -o etimes` — a GNU/Linux procps keyword that macOS `ps` rejects with a non-zero exit — so `execFileSync` threw on every tick and `reapOrphanedKeychainProcesses` returned `reaped: 0` on its only supported platform, leaving orphaned/wedged `Agents CLI` helper processes to pile up. Switched to the portable BSD `etime` keyword (`[[dd-]hh:]mm:ss`) with a parser to seconds. This also un-quarantines the darwin integration test that #2153 had to `it.skip` to unblock releases: that test's symlink fixture was correct all along — it read `reaped: 0` only because the reaper's own `ps etimes` call threw before parsing anything. Verified on macOS 15.4.1: 20/20 reaper tests pass, the integration test reaping a real orphaned sleeper. Source: `apps/cli/src/lib/secrets/reaper.ts`, `reaper.test.ts`.
 
-- **`agents modes [agent[@version]]` lists the permission modes a harness accepts.** The modes analog of `agents models`: for Claude / Codex / Cursor / …, shows which `--mode plan|edit|auto|skip` values work, the native CLI flags, the native default (`*`), any configured `run.defaults` mode, and degrade notes (e.g. plan→edit on Cursor). `agents inspect` also prints the mode list next to capabilities, and `agents run --help` / `agents models` point at the new command. Source: `apps/cli/src/commands/modes.ts`, `apps/cli/src/lib/agent-modes.ts`.
+- **`agents modes [agent[@version]]` lists the permission modes a harness accepts.** The modes analog of `agents models`: for Claude / Codex / Cursor / …, shows which `--mode plan|edit|auto|skip` values work, the native CLI flags, the native default (`*`), any configured `run.defaults` mode, and degrade notes (e.g. plan→edit on Antigravity). `agents inspect` also prints the mode list next to capabilities, and `agents run --help` / `agents models` point at the new command. Source: `apps/cli/src/commands/modes.ts`, `apps/cli/src/lib/agent-modes.ts`.
 
 - **`agents insights --all` now works as an alias for `--since all`.** It previously
   exited with `unknown option '--all'` — a hard failure in the middle of a report the

package/README.md

@@ -35,6 +35,8 @@
   <a href="https://dev.meta.ai/docs/muse-code" title="Meta Muse Code"><strong>Muse</strong></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
   <a href="https://omp.sh" title="Oh My Pi"><strong>Pi</strong></a>
+  &nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://docs.warp.dev/reference/cli" title="Warp Agent CLI (Oz)"><strong>Warp</strong></a>
 </p>
 
 https://agents-cli.sh/demo.mp4
@@ -43,11 +45,12 @@ https://agents-cli.sh/demo.mp4
 
 ```bash
 npm install -g @phnx-labs/agents-cli   # or: curl -fsSL agi-cli.sh | sh
-agents setup                           # first-time setup -- config + pick your agents
+agents setup                           # first-time setup, or re-open the capability hub
+agents setup status                    # readiness for browser, computer, fleet, and more
 agents run claude "explain this repo"  # run any agent on your existing subscription
 ```
 
-`agents setup` is interactive and idempotent -- safe to re-run on a new machine. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
+`agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
 
 Already installed? `agents upgrade` updates agents-cli itself to the latest version (`agents upgrade 1.2.3` for a specific version or dist-tag, `-y` to skip the confirm prompt). The command is `upgrade` on every platform -- there is no `agents update` (on macOS, `agents helper update` is a different command that reinstalls the keychain helper, not agents-cli).
 
@@ -147,6 +150,13 @@ agents run antigravity "Write tests for the fixed code"
 
 Each resolves to the project-pinned version with skills, MCP servers, and permissions already synced. Single-typo names auto-correct across every command — `agents view cladue` resolves to `claude`, `agents add codx@latest` to `codex`.
 
+`agents run claude "task" --lease` reuses one shared warm crabbox pool across
+repositories by default. Concurrent runs share the box but execute in isolated
+`~/workspaces/<repo>-<run>` directories with separate agent homes and credential
+files. Add `leaseProfile: private-hot-box` to
+`.crabbox.yaml` only when a repo intentionally needs a dedicated warm pool;
+cross-repo reuse trades re-sync latency for lower idle-compute cost.
+
 ### Rate-limited? Keep working.
 
 ```bash
@@ -286,8 +296,16 @@ agents sessions backfill tools --fleet
 agents sessions stats
 agents sessions stats --zero            # only the never-invoked (dead weight)
 agents sessions backfill resources      # fold historical sessions into the usage index
+
+# Friction, owner corrections, repeated recipes, and ranked actions across harnesses
+agents sessions insights --since 30d
+agents sessions insights --agent claude --agent codex --json
+# Top-level alias
+agents insights --since 7d
 ```
 
+`sessions insights` is deterministic and offline by default. It caches per-session facets, compares harnesses, and emits an actions table with evidence counts plus shortened sample session ids. `--narrative` is opt-in and receives aggregates only, never raw transcripts. The installed `/sessions-insights` slash command invokes the same CLI source of truth.
+
 Interactive picker when you're in a terminal. Structured output (`--json`, `--markdown`, filtered by role or turn count) when piped.
 
 Backed by a SQLite + FTS5 index at `~/.agents/.history/sessions/sessions.db` with incremental scanning -- warm reads in ~100ms. Tool-call evidence is redacted and bounded before it is cached; repeated `--query` clauses must match distinct calls in one session. Tool queries read SQLite only: `agents sessions backfill tools` performs the one-time historical parse, while normal incremental scans index new and changed sessions. The index stores ordered static Bash program sites, so `--count` reports occurrences, containing tool calls, and distinct sessions without reparsing. `--fleet` executes one origin partition per device, so synced mirrors cannot duplicate compact evidence or counts returned over SSH; transcript bodies stay on their origin machine. This uses relational SQLite rows and literal FTS5 only, with no embeddings, vector database, or model calls. External tools can consume `--json` output as a programmatic observability layer; see [docs/05-sessions.md](apps/cli/docs/05-sessions.md) for the schemas and [docs/06-observability.md](apps/cli/docs/06-observability.md) for the consumption patterns.
@@ -405,7 +423,7 @@ agents watchdog --nudge    # actually inject "Continue." into the stalled split
 agents watchdog --watch    # daemon loop: a tick every --interval
 ```
 
-`agents watchdog` detects a stalled session, resolves the *exact* terminal split it lives in (tmux, iTerm, VSCodium, or a raw pty), and injects a nudge -- `Continue.` by default, or set `--text`. It's dry by default; `--nudge` acts on a single tick, and `agents watchdog on|off` enables or disables the built-in routine on this device. `agents setup watchdog` chooses devices. Steer a single run with `agents watchdog policy <id> off | keep | handsoff`.
+`agents watchdog` detects a stalled session, resolves the *exact* terminal split it lives in (tmux, iTerm, VSCodium, or a raw pty), and injects a nudge -- `Continue.` by default, or set `--text`. It's dry by default; `--nudge` acts on a single tick. `agents watchdog on|off` controls the device-local daemon pass, which runs once every three minutes. Steer a single run with `agents watchdog policy <id> off | keep | handsoff`.
 
 A stalled session whose tail shows a hard account limit ("You've hit your weekly limit · resets …") is **rotated in place** instead of nudged: the watchdog gates on the same healthy-account selection `agents run auto` makes (zero healthy → one skip event per cooldown window, terminal untouched), injects the harness's exit sequence, relaunches `agents run auto --interactive --session-id <uuid>` in the *same* tab, then replays the old session's resume once the new TUI is live. Default on; `agents watchdog rotate off` disables it (nudging stays on).
 
@@ -609,10 +627,10 @@ Team state is observable via `agents teams list --json` / `agents teams status -
 
 ## Cloud
 
-Some work shouldn't tie up your laptop. `agents cloud run` hands a task to a managed provider that clones the repo, plans, implements, tests, and opens a PR -- while your terminal stays free. A fifth provider, `host`, dispatches the same way onto machines you own: `agents cloud run "…" --host gpu-box` (tasks track in `agents cloud ps` and `agents hosts ps` alike).
+Some work shouldn't tie up your laptop. `agents cloud run` hands a task to a managed provider that clones the repo, plans, implements, tests, and opens a PR -- while your terminal stays free. The `host` provider dispatches the same way onto machines you own: `agents cloud run "…" --host gpu-box` (tasks track in `agents cloud ps` and `agents hosts ps` alike).
 
 <p align="center">
-  <img src="assets/cloud.svg" alt="agents cloud run dispatches one prompt to a managed provider (Rush, Codex, Factory, or Antigravity) that clones, plans, tests, and opens a pull request while you keep working" width="100%" />
+  <img src="assets/cloud.svg" alt="agents cloud run dispatches one prompt to a managed provider (Rush, Codex, Cursor, Factory, or Antigravity) that runs while you keep working" width="100%" />
 </p>
 
 ```bash
@@ -626,7 +644,7 @@ agents cloud message <id> "also update the changelog"  # steer it mid-run
 agents cloud cancel <id>
 ```
 
-Four managed backends behind one interface (`agents cloud providers`):
+Five managed backends behind one interface (`agents cloud providers`):
 
 | Provider | What runs | Notes |
 |---|---|---|
@@ -634,6 +652,7 @@ Four managed backends behind one interface (`agents cloud providers`):
 | `codex` | A pre-built Codex Cloud environment | Target it with `--env`. |
 | `factory` | `droid exec` on a cloud VM | Computer-use; pick the box with `--computer`. |
 | `antigravity` | Gemini managed agents | Antigravity harness in a remote sandbox. |
+| `cursor` | Cursor Cloud Agents | v1 REST API with repo, status, SSE, cancel, and follow-up runs. |
 
 Auto-routes each `--agent` to its native cloud, or pin the backend with `--provider`. Instead of dispatching now, register a run as an **event trigger** with `--on pull_request` (also `push`, `issue_comment`, `workflow_run`) -- it persists as a trigger-bound routine that fires on the event. `--json` on every subcommand for scripting.
 
@@ -810,6 +829,12 @@ agents browser done                  # Close task's tabs when finished
 
 # Need to address a different task in the same shell? Override per call:
 agents browser screenshot --task other-flow
+
+# Repeated observe/action loops: one Node process and daemon socket stay warm.
+printf '%s\n' \
+  '{"action":"screenshot","path":"/tmp/page.jpg"}' \
+  '{"action":"click","atX":320,"atY":540}' \
+  | agents browser stream --task "$AGENTS_BROWSER_TASK"
 ```
 
 ### Why this works where Playwright fails

package/dist/browser.js

@@ -1,7 +1,17 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import { registerBrowserSubcommands } from './commands/browser.js';
-const program = new Command();
-program.name('browser').description('Browser automation via CDP');
-registerBrowserSubcommands(program);
-program.parse();
+import { maybeRunStandaloneOnHost } from './lib/hosts/passthrough.js';
+async function main() {
+    // `browser … --host <box>` routes to a remote over SSH, exactly like
+    // `agents browser … --host <box>` does through index.ts. Standalone-only:
+    // this binary never enters index.ts, so without this the flag was dropped.
+    if (await maybeRunStandaloneOnHost('browser')) {
+        process.exit(process.exitCode ?? 0);
+    }
+    const program = new Command();
+    program.name('browser').description('Browser automation via CDP');
+    registerBrowserSubcommands(program);
+    program.parse();
+}
+void main();