@phnx-labs/agents-cli 1.22.24 → 1.22.26

package/dist/lib/hosts/ready.js

@@ -121,7 +121,11 @@ export function buildReadyProbeCommand(os) {
     return `bash -lc ${shellQuote(script)}`;
 }
 export function readyProbe(target, os) {
-    const r = sshExec(target, buildReadyProbeCommand(os), { timeoutMs: 20000 });
+    // Disable multiplexing: a stale control socket can hang the local ssh client
+    // until the timeout fires, just like sshExecAsync does for the same reason.
+    const r = sshExec(target, buildReadyProbeCommand(os), { timeoutMs: 20000, multiplex: false });
+    if (r.timedOut)
+        return { reachable: false, version: null, view: '', timedOut: true };
     return parseReadyProbe(r.stdout);
 }
 /** Pure parser for `readyProbe` output (unit-tested without ssh). */
@@ -146,6 +150,11 @@ export function viewHasAgent(view, agent) {
 export function ensureHostReady(host, opts) {
     const target = sshTargetFor(host);
     const probe = readyProbe(target, host.os ?? resolveRemoteOsSync(host.name));
+    if (probe.timedOut) {
+        throw new Error(`Host "${host.name}" (${target}) did not respond in time — the SSH probe timed out after 20 seconds. ` +
+            `The host may be slow to start a login shell (nvm/sdkman init, cold node startup). ` +
+            `Retry, or run \`agents ssh ${host.name} agents view\` to confirm manually.`);
+    }
     if (!probe.reachable) {
         throw new Error(`Host "${host.name}" (${target}) is not reachable over SSH. Check it's online and key auth works.`);
     }

package/dist/lib/hosts/reconnect.d.ts

@@ -48,7 +48,8 @@ export declare function backoffMs(attempt: number): number;
 export declare function reconnectStep(state: ReconnectState, outcome: ReconnectOutcome): ReconnectDecision;
 /** Human-readable notice shown before each reconnect wait. "13 seconds", not "12.8s". */
 export declare function reconnectNotice(sessionId: string, host: string, attempt: number, waitMs: number): string;
-/** Notice shown once the retry budget is spent. */
+/** Notice shown once the retry budget is spent. Hands back the one verb that
+ *  re-enters the terminal — attach the live pane if it survived, else resume. */
 export declare function exhaustedNotice(sessionId: string, host: string): string;
 /** Notice shown when a reattach stops on a remapped remote-side exit
  *  ({@link REMOTE_EXIT_255_REMAPPED} — a would-be-255 the remote command decided
@@ -75,13 +76,14 @@ export declare function remoteExitNotice(sessionId: string, host: string): strin
  */
 export declare function wrapRemoteExitCode(cmd: string): string;
 /**
- * The remote command a reattach runs — the peer's own reconnect verb
- * (`agents sessions focus <id> --local --attach-only`), wrapped by
- * {@link wrapRemoteExitCode} so a stray remote-origin 255 (from this command,
- * whatever produces it — see the file header) can never masquerade as a
- * network drop. Split out from {@link reattachRemoteSession} so it is
- * unit-tested without SSH — mirrors `remoteAgentsJsonCommand` in
- * lib/remote-agents-json.ts.
+ * The remote command a reattach runs — the peer's own recovery verb
+ * (`agents sessions focus <id> --local`), wrapped by {@link wrapRemoteExitCode}
+ * so a stray remote-origin 255 (from this command, whatever produces it — see the
+ * file header) can never masquerade as a network drop. No `--attach-only`: focus
+ * joins the live pane when it survived, else RESUMES the session in place, so a
+ * reattach landing after the pane died recovers the agent instead of dead-ending
+ * (RUSH-2085). Split out from {@link reattachRemoteSession} so it is unit-tested
+ * without SSH — mirrors `remoteAgentsJsonCommand` in lib/remote-agents-json.ts.
  */
 export declare function reattachRemoteCommand(sessionId: string): string;
 /**
@@ -89,10 +91,10 @@ export declare function reattachRemoteCommand(sessionId: string): string;
  * `agents sessions focus`. A fast, un-multiplexed preflight probe (`ssh … true`)
  * first establishes whether the host is actually reachable this attempt — that
  * `connected` bit, not the call duration, is what the retry policy keys on. Only on
- * a reachable host do we run the interactive attach (which carries no credentials —
- * the agent already runs on the peer — so it rides the normal transport). Returns
- * the ssh exit code (255 = dropped again / unreachable; 0 = clean detach; other =
- * session ended) plus whether this attempt connected.
+ * a reachable host do we run the interactive attach-or-resume (which carries no
+ * credentials — the agent already runs on the peer — so it rides the normal
+ * transport). Returns the ssh exit code (255 = dropped again / unreachable; 0 =
+ * clean detach; other = session ended) plus whether this attempt connected.
  */
 export declare function reattachRemoteSession(host: Host, sessionId: string): ReconnectOutcome;
 export interface ReconnectLoopOpts {

package/dist/lib/hosts/reconnect.js

@@ -11,9 +11,13 @@
  * SSH automatically, with bounded backoff, until the user detaches cleanly (the
  * remote returns 0) or the agent exits (the tmux session is gone; a non-255 code).
  *
- * The re-attach reuses the peer's OWN reconnect verb — `agents sessions focus <id>
- * --local --attach-only` joins the live local tmux pane there (no fork, no resumed
- * copy) — so there is no second re-attach implementation to keep in sync.
+ * The re-attach reuses the peer's OWN recovery verb — `agents sessions focus <id>
+ * --local` — which JOINS the live local tmux pane there (a second client, no fork)
+ * when it still exists, and RESUMES the session in place when the pane is already
+ * gone. Dropping `--attach-only` is deliberate: a reattach that lands after the
+ * remote pane died must not dead-end at a bare shell (the RUSH-2085 bug), it must
+ * fall through to resume so the user is put back into the agent. There is one
+ * re-attach implementation (the peer's focus) to keep in sync.
  *
  * **Why the budget refills on `connected`, not on call duration.** ssh returns 255
  * for BOTH "couldn't connect at all" and "connected, then the link dropped." A
@@ -31,29 +35,24 @@
  *
  * **255 from the REMOTE side should never be trusted as "the link dropped."**
  * `reattachRemoteSession`'s `connected` flag is set as soon as the fast preflight
- * probe succeeds — it says nothing about whether the interactive attach that
- * follows actually reattached a live pane. If the REMOTE command (`agents
- * sessions focus <id> --local --attach-only`) itself ever happened to exit 255
- * for a reason that has nothing to do with the ssh transport, `sshStream` would
- * return that same 255, `reconnectStep` couldn't tell it apart from a genuine
- * drop, and `connected: true` would refill the retry budget forever — "attempt
- * 1/N" printed on every single cycle, the terminal filling with aborted-TTY
- * escape-code garbage, `MAX_ATTEMPTS` never actually bounding anything.
+ * probe succeeds — it says nothing about whether the interactive attach/resume
+ * that follows actually put the user back into the agent. If the REMOTE command
+ * (`agents sessions focus <id> --local`) itself ever happened to exit 255 for a
+ * reason that has nothing to do with the ssh transport, `sshStream` would return
+ * that same 255, `reconnectStep` couldn't tell it apart from a genuine drop, and
+ * `connected: true` would refill the retry budget forever — "attempt 1/N" printed
+ * on every single cycle, the terminal filling with aborted-TTY escape-code
+ * garbage, `MAX_ATTEMPTS` never actually bounding anything.
  *
- * Two candidate producers of that scenario were investigated —
- * `refuseFallback`'s login-shell fallback (commands/go.ts) and `jumpTo`'s
- * nested remote-tmux hop — and both turned out to be UNREACHABLE through this
- * exact remote command: under `--local`, `gatherLiveTargets` never sets a
- * foreign `.machine` (go.ts:61), so `remote` is always `undefined` in both,
- * and neither branch can fire (the same reasoning that made an earlier,
- * narrower fix here dead code — see git history). So this fix does not close
- * a confirmed incident cause; what it closes is the underlying channel-level
- * flaw that would make *any* future remote-side 255 producer — reachable today
- * or not — indistinguishable from a real drop. {@link wrapRemoteExitCode} wraps
- * the entire remote command so that whatever exit code it decides on, a 255 is
- * remapped to {@link REMOTE_EXIT_255_REMAPPED} before `sshStream` ever sees it,
- * regardless of which internal branch produced it and regardless of the peer's
- * `agents` version (the remap happens in the shell wrapper THIS process sends).
+ * The resume fall-through only widens that surface — the peer's focus now runs a
+ * full recovery path (`resumeSessionInPlace` / `runOnPeer`) on a dead pane, any
+ * step of which could in principle exit 255 for its own reasons. So the channel-
+ * level defense is what matters, not an audit of which branch can fire:
+ * {@link wrapRemoteExitCode} wraps the entire remote command so that whatever exit
+ * code it decides on, a 255 is remapped to {@link REMOTE_EXIT_255_REMAPPED} before
+ * `sshStream` ever sees it, regardless of which internal branch produced it and
+ * regardless of the peer's `agents` version (the remap happens in the shell
+ * wrapper THIS process sends).
  *
  * This does NOT close every way `reconnectStep` can loop on a real transport
  * 255: a genuinely recurring LOCAL ssh failure (a fast-flapping link, an
@@ -111,9 +110,10 @@ export function reconnectNotice(sessionId, host, attempt, waitMs) {
     const when = secs <= 1 ? 'now' : `in ${secs} seconds`;
     return `\nConnection to ${host} dropped — the agent is still running there. Reconnecting to ${sessionId.slice(0, 8)} ${when} (attempt ${attempt}/${MAX_ATTEMPTS})…\n`;
 }
-/** Notice shown once the retry budget is spent. */
+/** Notice shown once the retry budget is spent. Hands back the one verb that
+ *  re-enters the terminal — attach the live pane if it survived, else resume. */
 export function exhaustedNotice(sessionId, host) {
-    return `\nCouldn't reconnect to ${host} after ${MAX_ATTEMPTS} attempts. The agent may still be running — reattach when the network is back:\n  agents sessions focus ${sessionId.slice(0, 8)}\n`;
+    return `\nCouldn't reconnect to ${host} after ${MAX_ATTEMPTS} attempts. The agent may still be running — get back in when the network is back:\n  agents reconnect ${sessionId.slice(0, 8)}\n`;
 }
 /** Notice shown when a reattach stops on a remapped remote-side exit
  *  ({@link REMOTE_EXIT_255_REMAPPED} — a would-be-255 the remote command decided
@@ -121,7 +121,7 @@ export function exhaustedNotice(sessionId, host) {
  *  {@link wrapRemoteExitCode}). Distinct from {@link exhaustedNotice}, which is
  *  only for a genuinely spent retry budget. */
 export function remoteExitNotice(sessionId, host) {
-    return `\nReattach to ${sessionId.slice(0, 8)} on ${host} ended (not a network drop) — check whether it's still live:\n  agents sessions ${sessionId.slice(0, 8)}\n`;
+    return `\nReattach to ${sessionId.slice(0, 8)} on ${host} ended (not a network drop) — get back in, or check whether it's still live:\n  agents reconnect ${sessionId.slice(0, 8)}\n`;
 }
 /**
  * Wrap `cmd` in `bash -lc` (the login-shell pattern `buildRemoteAgentsInvocation`
@@ -145,16 +145,17 @@ export function wrapRemoteExitCode(cmd) {
     return `bash -lc ${shellQuote(guarded)}`;
 }
 /**
- * The remote command a reattach runs — the peer's own reconnect verb
- * (`agents sessions focus <id> --local --attach-only`), wrapped by
- * {@link wrapRemoteExitCode} so a stray remote-origin 255 (from this command,
- * whatever produces it — see the file header) can never masquerade as a
- * network drop. Split out from {@link reattachRemoteSession} so it is
- * unit-tested without SSH — mirrors `remoteAgentsJsonCommand` in
- * lib/remote-agents-json.ts.
+ * The remote command a reattach runs — the peer's own recovery verb
+ * (`agents sessions focus <id> --local`), wrapped by {@link wrapRemoteExitCode}
+ * so a stray remote-origin 255 (from this command, whatever produces it — see the
+ * file header) can never masquerade as a network drop. No `--attach-only`: focus
+ * joins the live pane when it survived, else RESUMES the session in place, so a
+ * reattach landing after the pane died recovers the agent instead of dead-ending
+ * (RUSH-2085). Split out from {@link reattachRemoteSession} so it is unit-tested
+ * without SSH — mirrors `remoteAgentsJsonCommand` in lib/remote-agents-json.ts.
  */
 export function reattachRemoteCommand(sessionId) {
-    const inner = ['agents', 'sessions', 'focus', sessionId, '--local', '--attach-only']
+    const inner = ['agents', 'sessions', 'focus', sessionId, '--local']
         .map(shellQuote)
         .join(' ');
     return wrapRemoteExitCode(inner);
@@ -164,10 +165,10 @@ export function reattachRemoteCommand(sessionId) {
  * `agents sessions focus`. A fast, un-multiplexed preflight probe (`ssh … true`)
  * first establishes whether the host is actually reachable this attempt — that
  * `connected` bit, not the call duration, is what the retry policy keys on. Only on
- * a reachable host do we run the interactive attach (which carries no credentials —
- * the agent already runs on the peer — so it rides the normal transport). Returns
- * the ssh exit code (255 = dropped again / unreachable; 0 = clean detach; other =
- * session ended) plus whether this attempt connected.
+ * a reachable host do we run the interactive attach-or-resume (which carries no
+ * credentials — the agent already runs on the peer — so it rides the normal
+ * transport). Returns the ssh exit code (255 = dropped again / unreachable; 0 =
+ * clean detach; other = session ended) plus whether this attempt connected.
  */
 export function reattachRemoteSession(host, sessionId) {
     const target = sshTargetFor(host);

package/dist/lib/mcp.js

@@ -596,6 +596,7 @@ function writeMcpConfigSupportsAgent(agentId) {
         case 'hermes':
         case 'pi':
         case 'muse':
+        case 'warp':
             return true;
         default:
             return false;
@@ -621,7 +622,10 @@ export function writeMcpConfig(agentId, configPath, servers, mode = 'overwrite')
         // omp reads the same Claude `{ "mcpServers": {...} }` schema from .mcp.json
         // (stdio: command/args/env; http/sse: url/headers — transport inferred from
         // command/url presence).
-        case 'pi': {
+        case 'pi':
+        // Oz reads the same Claude `{ "mcpServers": {...} }` schema from
+        // `.warp/.mcp.json` (stdio + http with headers).
+        case 'warp': {
             let config = {};
             if (fs.existsSync(configPath)) {
                 try {

package/dist/lib/menubar/snapshot.d.ts

@@ -0,0 +1,15 @@
+import type { WatchdogTickResult } from '../watchdog/runner.js';
+export interface MenubarSnapshot {
+    version: 1;
+    capturedAt: string;
+    routines: Record<string, unknown>[];
+    recentSessions: Record<string, unknown>[];
+    activeSessions: Record<string, unknown>[];
+    watchdog: {
+        enabled: boolean;
+        lastTick: Pick<WatchdogTickResult, 'didNudge' | 'counts'> | null;
+    };
+}
+export declare function readLastWatchdogTick(stateDir?: string): WatchdogTickResult | null;
+/** One-process read model for AGI Menu's repeating three-minute refresh. */
+export declare function computeMenubarSnapshot(): Promise<MenubarSnapshot>;

package/dist/lib/menubar/snapshot.js

@@ -0,0 +1,40 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { buildRoutineListJson } from '../../commands/routines.js';
+import { backfillActiveRowsFromIndex, serializeActiveSessionsForJson, serializeSessionsJson } from '../../commands/sessions.js';
+import { getConfigValue } from '../device-config.js';
+import { querySessions } from '../session/db.js';
+import { readActiveSessionsCache } from '../session/session-cache.js';
+import { getRuntimeStateDir } from '../state.js';
+export function readLastWatchdogTick(stateDir = path.join(getRuntimeStateDir(), 'watchdog')) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(stateDir, 'last-tick.json'), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** One-process read model for AGI Menu's repeating three-minute refresh. */
+export async function computeMenubarSnapshot() {
+    const [routines, recent] = await Promise.all([
+        Promise.resolve(buildRoutineListJson()),
+        Promise.resolve(querySessions({ limit: 40, skipExistenceCheck: true })),
+    ]);
+    const active = readActiveSessionsCache('local');
+    const activeSessions = active?.sessions ?? [];
+    backfillActiveRowsFromIndex(activeSessions);
+    return {
+        version: 1,
+        capturedAt: new Date().toISOString(),
+        routines,
+        recentSessions: JSON.parse(serializeSessionsJson(recent)),
+        activeSessions: serializeActiveSessionsForJson(activeSessions),
+        watchdog: {
+            enabled: getConfigValue('watchdog.enabled').value === true,
+            lastTick: (() => {
+                const tick = readLastWatchdogTick();
+                return tick ? { didNudge: tick.didNudge, counts: tick.counts } : null;
+            })(),
+        },
+    };
+}

package/dist/lib/plugins.js

@@ -68,8 +68,20 @@ export function discoverPluginsInDir(pluginsDir, spec = { kind: 'user' }) {
             continue;
         const pluginRoot = path.join(pluginsDir, entry.name);
         const manifest = loadPluginManifest(pluginRoot);
-        if (!manifest)
+        if (!manifest) {
+            // A directory that looks like a plugin root but has no valid manifest is
+            // silently invisible to every downstream command (list/info/sync, and the
+            // materialize-into-version-homes copy) with no other diagnostic anywhere
+            // in the chain — it can sit here indefinitely, on the correct git commit,
+            // and never surface as broken (RUSH-2270: the `work` plugin shipped
+            // without .claude-plugin/plugin.json and nothing noticed for a full merge
+            // cycle). Warn once here, at the one place that decides discoverability,
+            // so the gap is visible the moment `agents sync` runs.
+            const manifestPath = path.join(entry.name, PLUGIN_MANIFEST_DIR, PLUGIN_MANIFEST_FILE);
+            process.stderr.write(`agents-cli: '${entry.name}' in ${pluginsDir} has no valid ${manifestPath} ` +
+                `(missing, malformed JSON, or missing name/version) — skipped, not discovered as a plugin.\n`);
             continue;
+        }
         plugins.push(buildDiscoveredPlugin(pluginRoot, manifest, spec));
     }
     return plugins;

package/dist/lib/resources/mcp.js

@@ -129,6 +129,9 @@ export function getMcpConfigPath(agent, versionHome) {
             return path.join(versionHome, '.omp', 'agent', '.mcp.json');
         case 'muse':
             return path.join(versionHome, '.config', 'muse', 'settings.json');
+        case 'warp':
+            // Oz reads user-scope MCP from ~/.warp/.mcp.json (Claude schema).
+            return path.join(versionHome, '.warp', '.mcp.json');
         default:
             return null;
     }

package/dist/lib/routine-process-cleanup.d.ts

@@ -0,0 +1,9 @@
+import type { RunMeta } from './routines.js';
+export interface RoutineProcessCleanupOptions {
+    runsDir?: string;
+    alive?: (pid: number) => boolean;
+    owns?: (meta: RunMeta) => boolean;
+    terminate?: (pid: number) => void;
+}
+/** Reap process groups whose durable run record is already terminal. */
+export declare function reapTerminalRoutineProcesses(opts?: RoutineProcessCleanupOptions): number[];

package/dist/lib/routine-process-cleanup.js

@@ -0,0 +1,73 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { execFileSync } from 'child_process';
+import { isAlive, killTree } from './platform/index.js';
+import { getRunsDir } from './state.js';
+function processMatchesRun(meta) {
+    if (!meta.pid || !meta.spawnedAt)
+        return false;
+    try {
+        if (process.platform === 'win32') {
+            const startedAt = execFileSync('powershell.exe', [
+                '-NoProfile',
+                '-NonInteractive',
+                '-Command',
+                `(Get-Process -Id ${meta.pid} -ErrorAction Stop).StartTime.ToUniversalTime().ToString("o")`,
+            ], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }).trim();
+            const processStart = Date.parse(startedAt);
+            return Number.isFinite(processStart) && Math.abs(processStart - meta.spawnedAt) < 30_000;
+        }
+        const elapsed = execFileSync('ps', ['-p', String(meta.pid), '-o', 'etime='], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        if (!elapsed)
+            return false;
+        const fields = elapsed.replace(/-/g, ':').split(':').reverse();
+        const seconds = Number(fields[0] ?? 0)
+            + Number(fields[1] ?? 0) * 60
+            + Number(fields[2] ?? 0) * 3600
+            + Number(fields[3] ?? 0) * 86400;
+        return Math.abs((Date.now() - seconds * 1000) - meta.spawnedAt) < 30_000;
+    }
+    catch {
+        return false;
+    }
+}
+/** Reap process groups whose durable run record is already terminal. */
+export function reapTerminalRoutineProcesses(opts = {}) {
+    const runsDir = opts.runsDir ?? getRunsDir();
+    const alive = opts.alive ?? isAlive;
+    const owns = opts.owns ?? processMatchesRun;
+    const terminate = opts.terminate ?? ((pid) => killTree(process.platform === 'win32' ? pid : -pid));
+    if (!fs.existsSync(runsDir))
+        return [];
+    const reaped = [];
+    for (const job of fs.readdirSync(runsDir, { withFileTypes: true })) {
+        if (!job.isDirectory())
+            continue;
+        const jobDir = path.join(runsDir, job.name);
+        for (const run of fs.readdirSync(jobDir, { withFileTypes: true })) {
+            if (!run.isDirectory())
+                continue;
+            try {
+                const meta = JSON.parse(fs.readFileSync(path.join(jobDir, run.name, 'meta.json'), 'utf-8'));
+                if (!['failed', 'timeout'].includes(meta.status) || !meta.pid || meta.hostTaskId || meta.cloudTaskId)
+                    continue;
+                const completedAt = Date.parse(meta.completedAt ?? '');
+                if (!Number.isFinite(completedAt) || Date.now() - completedAt < 5_000)
+                    continue;
+                if (!alive(meta.pid))
+                    continue;
+                if (!owns(meta))
+                    continue;
+                terminate(meta.pid);
+                reaped.push(meta.pid);
+            }
+            catch {
+                // Corrupt or concurrently-replaced records are left untouched.
+            }
+        }
+    }
+    return reaped;
+}

package/dist/lib/routines.js

@@ -14,7 +14,7 @@ import { getRoutinesDir, getSystemRoutinesDir, getRunsDir, ensureAgentsDir, getP
 import { safeJoin, isSafeSegmentName } from './paths.js';
 import { isSafeProjectName } from './projects.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
-import { ALL_AGENT_IDS } from './agents.js';
+import { ALL_AGENT_IDS, ROUTINE_AGENT_IDS } from './agents.js';
 import { machineId, normalizeHost } from './machine-id.js';
 import { resolveActor } from './actor.js';
 import { percentile } from './percentile.js';
@@ -600,6 +600,7 @@ export function validateJob(config) {
     const hasAgent = Boolean(config.agent && typeof config.agent === 'string');
     const hasWorkflow = Boolean(config.workflow && typeof config.workflow === 'string');
     const hasCommand = Boolean(config.command && typeof config.command === 'string');
+    const strategy = resolveHostStrategy(config);
     const set = [hasAgent, hasWorkflow, hasCommand].filter(Boolean).length;
     if (set === 0) {
         errors.push('exactly one of agent, workflow, or command is required');
@@ -613,6 +614,18 @@ export function validateJob(config) {
     if (hasAgent && config.agent && !ALL_AGENT_IDS.includes(config.agent)) {
         errors.push(`agent must be one of: ${ALL_AGENT_IDS.join(', ')}`);
     }
+    else if (hasAgent && config.agent && strategy === 'local' &&
+        !ROUTINE_AGENT_IDS.includes(config.agent)) {
+        // The local daemon only knows how to build a command for the agents in
+        // ROUTINE_AGENT_IDS (runner.ts's AGENT_COMMANDS table) — anything else is a
+        // real, installable agent (it passed the ALL_AGENT_IDS check above) but one
+        // the daemon can't fire itself, so reject it now instead of accepting the
+        // routine and failing at fire time (runner.ts buildJobCommand: "Unsupported
+        // agent for daemon jobs"). host/fleet/cloud placement dispatches through
+        // `agents run`/a cloud provider instead of this table, so they're exempt.
+        errors.push(`agent '${config.agent}' is not supported by the local routine daemon; use one of: ` +
+            `${ROUTINE_AGENT_IDS.join(', ')} (or set hostStrategy: host/fleet/cloud to run it elsewhere)`);
+    }
     if (hasWorkflow && config.workflow) {
         if (!/^[a-z0-9][a-z0-9_-]*$/.test(config.workflow)) {
             errors.push('workflow must be a lowercase alphanumeric name (hyphens and underscores allowed, e.g. autodev)');
@@ -662,7 +675,6 @@ export function validateJob(config) {
             errors.push(`hostStrategy must be one of: ${HOST_STRATEGIES.join(', ')}`);
         }
     }
-    const strategy = resolveHostStrategy(config);
     if (config.host !== undefined) {
         if (typeof config.host !== 'string' || config.host.trim() === '') {
             errors.push('host must be a non-empty machine name (a registered host, device, capability tag, or user@host)');

package/dist/lib/runner.d.ts

@@ -26,9 +26,6 @@ export interface RunResult {
 export declare class RoutineAlreadyRunningError extends Error {
     constructor(jobName: string, runId: string);
 }
-/** Agents the daemon can actually run, derived from the command table above
- * so the `--agent` help and any validation can never drift from it. */
-export declare const ROUTINE_AGENT_IDS: readonly string[];
 /** Stable working directory for routine children, independent of the daemon's launch cwd. */
 export declare function routineSpawnCwd(config: Pick<JobConfig, 'repo'>, configuredRoot?: string | undefined): string;
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */

package/dist/lib/runner.js

@@ -36,7 +36,7 @@ import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, } from './rotate.js';
 import { readAuthHealth, isDeadVerdict } from './auth-health.js';
 import { machineId } from './machine-id.js';
-import { isSelfUpdatingAgent } from './agents.js';
+import { isSelfUpdatingAgent, ROUTINE_AGENT_COMMANDS as AGENT_COMMANDS } from './agents.js';
 import { expandLocalHome, getProjectRoot } from './project-root.js';
 export class RoutineAlreadyRunningError extends Error {
     constructor(jobName, runId) {
@@ -52,7 +52,7 @@ function activeRoutineRun(config) {
     const runs = listRuns(config.name);
     for (let i = runs.length - 1; i >= 0; i--) {
         const run = runs[i];
-        if (run.status !== 'running')
+        if (!['running', 'failed', 'timeout'].includes(run.status))
             continue;
         if (run.pid && isPidOurs(run.pid, run.spawnedAt))
             return run;
@@ -98,19 +98,6 @@ function terminateRoutineTree(pid) {
     }
     catch { /* already exited */ }
 }
-/** CLI command templates per agent, with {prompt} as a placeholder. */
-const AGENT_COMMANDS = {
-    claude: ['claude', '-p', '--verbose', '{prompt}', '--output-format', 'stream-json', '--permission-mode', 'plan'],
-    codex: ['codex', 'exec', '{prompt}', '--json'],
-    gemini: ['gemini', '{prompt}', '--output-format', 'stream-json'],
-    cursor: ['cursor-agent', '-p', '{prompt}', '--output-format', 'stream-json'],
-    kimi: ['kimi', '--prompt', '{prompt}', '--output-format', 'stream-json'],
-    droid: ['droid', 'exec', '{prompt}', '-o', 'stream-json'],
-    muse: ['muse', 'exec', '{prompt}', '--json'],
-};
-/** Agents the daemon can actually run, derived from the command table above
- * so the `--agent` help and any validation can never drift from it. */
-export const ROUTINE_AGENT_IDS = Object.freeze(Object.keys(AGENT_COMMANDS));
 /**
  * Where each agent's transcript files live under an overlay HOME, mirroring
  * `SESSION_ROOT_SPECS` (session/discover.ts) — the CLI's own source of truth
@@ -235,10 +222,10 @@ export function buildJobCommand(config, resolvedPrompt) {
         appendModelAndReasoning(cmd, config);
     }
     if (config.agent === 'cursor') {
-        // cursor-agent supports --plan, but the capability registry has not been
-        // upgraded yet. RUSH-2101 tracks adding that read-only mode after PR #1721.
-        const cursorMode = resolveHeadlessMode('cursor', mode, false, `routine ${config.name}`);
-        if (cursorMode === 'skip') {
+        if (mode === 'plan') {
+            cmd.push('--plan');
+        }
+        else if (mode === 'skip') {
             cmd.push('-f');
         }
         else {

package/dist/lib/secrets/bundles.js

@@ -55,19 +55,7 @@ const keychainStore = {
 const fileItemStore = {
     has: (item) => fileStore.has(item),
     get: (item) => fileStore.get(item),
-    getBatch: (items) => {
-        const out = new Map();
-        for (const item of items) {
-            try {
-                out.set(item, fileStore.get(item));
-            }
-            catch {
-                // Missing/undecryptable item — absent from the map, mirroring
-                // getKeychainTokens (caller decides whether that's an error).
-            }
-        }
-        return out;
-    },
+    getBatch: (items) => fileStore.getBatch(items),
     set: (item, value) => fileStore.set(item, value),
     setBatch: (items) => {
         for (const [item, value] of items) {
@@ -1340,13 +1328,6 @@ export function readAndResolveBundleEnv(name, opts = {}) {
         : store.getBatch([...new Set([metaItem, ...secretItems])]);
     const json = fetched.get(metaItem);
     if (json === undefined) {
-        // For a file-backed bundle the metadata item is on disk (that's how
-        // bundleBackend resolved to 'file'); a missing decrypt means the wrong
-        // passphrase, not a missing bundle. getBatch swallowed the decrypt error,
-        // so distinguish here rather than report a misleading "not found".
-        if (backend === 'file' && fileStore.has(metaItem)) {
-            throw new Error(`Bundle '${name}': failed to decrypt — wrong AGENTS_SECRETS_PASSPHRASE or tampered file store.`);
-        }
         if (vaultExists() && !getVaultSession().loggedIn) {
             throw new Error(`Synced secrets are locked. Run: agents login`);
         }

package/dist/lib/secrets/filestore.d.ts

@@ -53,6 +53,7 @@ export declare function encryptForFallback(plaintext: string, passphrase: string
 export declare function decryptForFallback(enc: EncFile, passphrase: string): string;
 declare function fileHas(item: string): boolean;
 declare function fileGet(item: string): string;
+declare function fileGetBatch(items: string[]): Map<string, string>;
 declare function fileSet(item: string, value: string): void;
 declare function fileDelete(item: string): boolean;
 declare function fileList(prefix: string): string[];
@@ -63,6 +64,7 @@ export declare function fileStoreHasItems(): boolean;
 export declare const fileStore: {
     has: typeof fileHas;
     get: typeof fileGet;
+    getBatch: typeof fileGetBatch;
     set: typeof fileSet;
     delete: typeof fileDelete;
     list: typeof fileList;

package/dist/lib/secrets/filestore.js

@@ -237,6 +237,18 @@ function fileGet(item) {
         throw new Error(`Failed to decrypt '${item}'. Wrong AGENTS_SECRETS_PASSPHRASE or tampered file.`);
     }
 }
+function fileGetBatch(items) {
+    const out = new Map();
+    for (const item of items) {
+        // A missing file is an absent item. Any error reading an existing file,
+        // especially an AES-GCM authentication failure, is a broken store and must
+        // stop the caller rather than silently produce an incomplete environment.
+        if (!fileHas(item))
+            continue;
+        out.set(item, fileGet(item));
+    }
+    return out;
+}
 function fileSet(item, value) {
     ensureFileDir();
     // Under the store lock: a write must not interleave with a rotation's swap.
@@ -283,6 +295,7 @@ export function fileStoreHasItems() {
 export const fileStore = {
     has: fileHas,
     get: fileGet,
+    getBatch: fileGetBatch,
     set: fileSet,
     delete: fileDelete,
     list: fileList,