@phnx-labs/agents-cli 1.22.24 → 1.22.26

package/dist/commands/apply.js

@@ -15,6 +15,7 @@ import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
+import { isHostPinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired } from '../lib/fleet/manifest.js';
 import { snapshotAuth, materializeAuth, parseAuthBundle, KEYCHAIN_BOUND_ON_MAC, isCredentialSafeToPropagate } from '../lib/fleet/auth-sync.js';
@@ -82,7 +83,10 @@ function renderPlan(plan) {
         }
         return chalk.cyan('↑ ' + acts.map((a) => a.agent ?? a.kind.replace('-cli', '')).join(','));
     };
-    const header = `  ${'device'.padEnd(nameWidth)}   ${'agents-cli'.padEnd(12)}${'agents'.padEnd(20)}${'config'.padEnd(10)}login`;
+    // Only show the secrets column when the manifest declares any — an all-`-`
+    // column on every fleet that uses no bundles is noise.
+    const anySecrets = rows.some((r) => r.actions.some((a) => a.kind === 'push-secret' || a.kind === 'needs-secret'));
+    const header = `  ${'device'.padEnd(nameWidth)}   ${'agents-cli'.padEnd(12)}${'agents'.padEnd(20)}${'config'.padEnd(10)}${anySecrets ? 'login'.padEnd(18) + 'secrets' : 'login'}`;
     console.log(chalk.gray(header));
     for (const row of rows) {
         const cli = row.probe.reachable
@@ -100,10 +104,33 @@ function renderPlan(plan) {
             ? (row.actions.some((a) => a.kind === 'sync-config') ? chalk.cyan('↑ sync') : chalk.green('ok'))
             : chalk.gray('-');
         const loginCell = cell(row, ['push-login', 'needs-login'], `${row.desired.agents.length}/${row.desired.agents.length}`);
-        console.log(`  ${row.device.padEnd(nameWidth)}   ${stripPad(cli, 12)}${stripPad(agentsCell, 20)}${stripPad(configCell, 10)}${loginCell}`);
+        const secretsCell = (() => {
+            if (!anySecrets)
+                return '';
+            if (!row.probe.reachable)
+                return chalk.gray('- offline');
+            const push = row.actions.filter((a) => a.kind === 'push-secret').length;
+            const blocked = row.actions.filter((a) => a.kind === 'needs-secret').length;
+            if (push === 0 && blocked === 0)
+                return chalk.green('ok');
+            if (push > 0 && blocked === 0)
+                return chalk.cyan(`↑ push ${push}`);
+            if (push === 0)
+                return chalk.yellow(`blocked ${blocked}`);
+            return chalk.yellow(`↑ push ${push} · blocked ${blocked}`);
+        })();
+        const loginPart = anySecrets ? stripPad(loginCell, 18) + secretsCell : loginCell;
+        console.log(`  ${row.device.padEnd(nameWidth)}   ${stripPad(cli, 12)}${stripPad(agentsCell, 20)}${stripPad(configCell, 10)}${loginPart}`);
     }
     console.log();
     console.log(chalk.gray(`  ${plan.actions.length} action(s) across ${rows.filter((r) => r.probe.reachable).length} reachable device(s)`));
+    // The capability is opt-in, so when it is OFF and the manifest declares
+    // bundles, say that it exists. Otherwise an operator reads "manual recreate"
+    // and concludes there is no supported path — which is exactly the conclusion
+    // that led to a master key being hand-exported across the fleet (RUSH-1968).
+    if (anySecrets && !rows.some((r) => r.actions.some((a) => a.kind === 'push-secret'))) {
+        console.log(chalk.gray('  secrets: not pushed. `--provision-secrets` pushes declared bundles to devices whose host key is pinned.'));
+    }
     // Distinguish *why* a login can't be propagated: macOS keychain-bound,
     // single-use rotating refresh token (never copied), or the source simply not
     // being signed in to that agent (no portable file).
@@ -130,14 +157,15 @@ function renderPlan(plan) {
     if (noToken.length > 0) {
         console.log(chalk.yellow(`  manual login needed (no portable token on source): ${noToken.join(', ')}`));
     }
-    // Secrets bundles are declared once for the fleet; surface the distinct set to
-    // recreate on any device missing them (values are keychain-local, never pushed).
+    // Secrets bundles are declared once for the fleet; surface the distinct set the
+    // gate did NOT push, so a refusal is never silent. "never pushed" used to be
+    // literally true here and no longer is — `--provision-secrets` pushes them.
     const bundles = [...new Set(rows.flatMap((r) => r.secretsNeeded))];
     if (bundles.length > 0) {
         const shown = bundles.slice(0, 12);
         const more = bundles.length - shown.length;
         const list = shown.join(', ') + (more > 0 ? `, +${more} more` : '');
-        console.log(chalk.yellow(`  ${bundles.length} secrets bundle(s) to recreate where missing (keychain-local, never pushed): ${list}`));
+        console.log(chalk.yellow(`  ${bundles.length} secrets bundle(s) not pushed — recreate where missing: ${list}`));
     }
 }
 /** padEnd on the visible width, ignoring chalk color codes. Exported for tests. */
@@ -218,11 +246,24 @@ async function runApply(opts) {
     // Probe every target device in parallel.
     const nameToProfile = new Map(desired.map((d) => [d.device, registry[d.device]]));
     const withVersions = rosterNeedsVersions(desired);
+    // One extra `secrets list --json` per device, and only when it can change the
+    // plan: the manifest declares bundles AND provisioning is on. Same cost
+    // discipline as `withVersions` — a fleet that uses no bundles never pays it.
+    const withSecrets = opts.provisionSecrets === true && (manifest.secrets?.bundles?.length ?? 0) > 0;
     console.log(chalk.gray(`Probing ${desired.length} device(s)…`));
-    const probeList = await pool(desired, 6, async (d) => probeDevice(nameToProfile.get(d.device), { withVersions }));
+    const probeList = await pool(desired, 6, async (d) => probeDevice(nameToProfile.get(d.device), { withVersions, withSecrets }));
     const probes = new Map(probeList.map((p) => [p.device, p]));
     const targetCliVersion = localCliVersion();
-    let plan = diffFleet(desired, probes, { targetCliVersion, sourceAuth, secretsBundles: manifest.secrets?.bundles });
+    let plan = diffFleet(desired, probes, {
+        targetCliVersion,
+        sourceAuth,
+        secretsBundles: manifest.secrets?.bundles,
+        provisionSecrets: opts.provisionSecrets === true,
+        forceSecrets: opts.force === true,
+        // Same bar as `exec --copy-creds` (EXEC-34): credential values only ever go
+        // to a host whose key we already pinned.
+        isHostPinned: (device) => isHostPinned(device, managedKnownHostsPath()),
+    });
     // --only filter.
     if (opts.only) {
         const keep = new Set();
@@ -242,7 +283,8 @@ async function runApply(opts) {
         return;
     // `needs-login`/`needs-secret` are surfaced manual reminders, not executable
     // mutations — exclude them so an otherwise-converged fleet still says "nothing
-    // to do" instead of looping forever on un-actionable surfacing.
+    // to do" instead of looping forever on un-actionable surfacing. `push-secret`
+    // IS executable and deliberately stays counted.
     if (plan.actions.filter((a) => a.kind !== 'needs-login' && a.kind !== 'needs-secret').length === 0) {
         console.log(chalk.green('\nNothing to do — fleet already matches the profile.'));
         return;
@@ -301,6 +343,8 @@ export function configureApplyCommand(cmd) {
         .option('--agent <specs...>', 'Override the roster for targeted device(s): install these specs instead of the manifest\'s. Use `claude@all` to replicate every version installed on this machine.')
         .option('--only <dims>', 'Limit to dimensions: comma list of agents,config,login')
         .option('--no-login', 'Do not propagate logins')
+        .option('--provision-secrets', "Push the manifest's declared secrets bundles to each device (OFF by default; moves credential values over SSH, and only to a device whose host key is already pinned)")
+        .option('--force', 'With --provision-secrets: re-push a bundle the device already has')
         .addOption(new Option('--recv-auth', 'internal: receive an auth bundle on stdin').hideHelp())
         .action(async (opts) => {
         try {

package/dist/commands/browser.js

@@ -20,6 +20,7 @@ import { isInteractiveTerminal } from './utils.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
 import { buildHar } from '../lib/browser/har.js';
 import { getCliVersion } from '../lib/version.js';
+import { runBrowserIPCStream } from '../lib/browser/stream.js';
 /**
  * Resolve which browser task a command targets. Order:
  *   1. `--task <name>` flag (explicit per-command override)
@@ -48,6 +49,7 @@ const TASK_OPTION_DESC = 'Task name (defaults to $AGENTS_BROWSER_TASK)';
 // trailing "Other commands" section automatically.
 const BROWSER_HELP_GROUPS = [
     { title: 'Session lifecycle', names: ['start', 'done', 'status'] },
+    { title: 'Fast action loop', names: ['stream'] },
     {
         title: 'Drive the page',
         names: ['navigate', 'tabs', 'screenshot', 'evaluate', 'click', 'type', 'press', 'wait'],
@@ -79,6 +81,9 @@ export function registerBrowserCommand(program) {
       agents browser navigate https://example.com
       agents browser screenshot
 
+      # Keep one process and daemon socket warm for repeated actions
+      agents browser stream --task "$AGENTS_BROWSER_TASK"
+
       # Drive another machine's browser (needs its consent — see remote-control)
       agents browser start --host zion
 
@@ -654,6 +659,36 @@ function registerTaskCommands(browser) {
             ? 'Other fleet machines can now drive this browser via `browser --host <this-device>`.'
             : 'Cross-machine `browser --host` drives to this machine are refused.');
     });
+    const stream = browser
+        .command('stream')
+        .description('Keep one process and daemon IPC socket open; read NDJSON requests from stdin and write NDJSON responses')
+        .option(TASK_OPTION_FLAG, 'Default task for requests that omit `task` (defaults to $AGENTS_BROWSER_TASK)')
+        .action(async (opts) => {
+        await runBrowserIPCStream({
+            input: process.stdin,
+            output: process.stdout,
+            task: opts.task ?? process.env.AGENTS_BROWSER_TASK,
+            actor: resolveActor().id,
+            launchId: process.env.AGENT_LAUNCH_ID,
+        });
+    });
+    setHelpSections(stream, {
+        examples: `
+      # Batch two warm actions through one process and one daemon connection
+      printf '%s\\n' \\
+        '{"action":"screenshot","path":"/tmp/page.jpg"}' \\
+        '{"action":"click","atX":320,"atY":540}' \\
+        | agents browser stream --task "$AGENTS_BROWSER_TASK"
+
+      # Keep the command open and send one JSON object per line from a long-lived shell
+      agents browser stream --task "$AGENTS_BROWSER_TASK"
+    `,
+        notes: `
+      stdout is protocol-only: one compact JSON response for each non-empty input line.
+      Malformed JSON returns an error response without closing the stream.
+      The first start response becomes the default task for later lines in the same stream.
+    `,
+    });
     browser
         .command('start')
         .description('Start a browser task. Pass --profile <name>; omit to use your configured default (`agents browser profiles set-default`), else auto-pick an installed Chromium-family browser.')

package/dist/commands/cloud.js

@@ -25,14 +25,15 @@ export function statusColor(status) {
 export function registerCloudCommands(program) {
     const cloud = program
         .command('cloud', { hidden: true })
-        .description('Dispatch and manage cloud agent tasks across providers (Rush, Codex, Factory, Antigravity).')
+        .description('Dispatch and manage cloud agent tasks across providers (Rush, Codex, Cursor, Factory, Antigravity, Host).')
         .addHelpText('after', `
 Each agent runs in its own cloud. Pass --agent and the provider is auto-selected
-(claude→rush, codex→codex, droid→factory, antigravity→antigravity); --provider overrides.
+(claude→rush, codex→codex, cursor→cursor, droid→factory, antigravity→antigravity); --provider overrides.
 
 Providers:
   rush         Rush Cloud — Claude against a GitHub repo + branch → PR
   codex        Codex Cloud — runs in a pre-built Codex environment (--env)
+  cursor       Cursor Cloud Agents — v1 REST API, with optional GitHub repos
   factory      Factory Droid Computer — droid exec on a cloud VM (--computer)
   antigravity  Gemini Managed Agents — Antigravity harness in a remote sandbox
 
@@ -49,6 +50,9 @@ Examples:
   # Codex Cloud against a saved environment
   agents cloud run "add pytest fixtures for the new billing module" --provider codex --env env_a1b2c3 --agent codex --timeout 30m
 
+  # Cursor Cloud Agents against a GitHub repository
+  agents cloud run "fix the flaky parser test" --agent cursor --repo acme/example
+
   # Factory pod targeting a specific computer (Droid)
   agents cloud run "QA the new onboarding flow end-to-end" --provider factory --computer linux-vm-1 --agent droid
 
@@ -74,9 +78,9 @@ Examples:
     cloud
         .command('run [prompt]')
         .description('Dispatch a task to a cloud agent.')
-        .option('--provider <id>', 'Cloud backend: rush, codex, factory, antigravity, host (overrides agent auto-routing)')
-        .option('--agent <name>', 'Agent to run: claude, codex, droid, antigravity (auto-routes to its native cloud)')
-        .option('--repo <owner/repo>', 'GitHub repository. Repeatable for multi-repo dispatch (Rush Cloud only).', (value, previous) => {
+        .option('--provider <id>', 'Cloud backend: rush, codex, cursor, factory, antigravity, host (overrides agent auto-routing)')
+        .option('--agent <name>', 'Agent to run: claude, codex, cursor, droid, antigravity (auto-routes to its native cloud)')
+        .option('--repo <owner/repo>', 'GitHub repository. Repeatable for multi-repo dispatch (Rush or Cursor Cloud).', (value, previous) => {
         const acc = Array.isArray(previous) ? previous : [];
         acc.push(value);
         return acc;

package/dist/commands/doctor.d.ts

@@ -22,11 +22,35 @@
  * apply pending sync.
  */
 import type { Command } from 'commander';
+import { type DoctorFinding } from '../lib/devices/doctor-findings.js';
 import { type VersionResourceReport } from '../lib/doctor-diff.js';
 import { type DuplicateVersionHook } from '../lib/hooks.js';
 import { type SyncStatusRow, type OrphanRow } from '../lib/drift.js';
 import { type FetchStatusMarker } from '../lib/auto-pull.js';
 export declare function wrapLine(prefix: string, text: string, width?: number): string[];
+export declare function asRemoteSecretFindings(raw: unknown, device: string): DoctorFinding[];
+/**
+ * Fetch a device's harness inventory by running its top-level `agents doctor
+ * --json` (which carries the `fleet` field, RUSH-2027). Separate from
+ * {@link probeFleetTarget} — that forwards `teams doctor --json` for per-agent
+ * readiness, a different payload. Returns the parsed {@link FleetInventory} or
+ * null (unreachable, non-zero exit, unparseable, or an older CLI with no
+ * `fleet` field); a null is skipped by the comparator, never a false gap.
+ */
+/**
+ * How long one remote `doctor --json` probe may take.
+ *
+ * 180s, matching `ChildProcess.doctorTimeout`, which was set to 180 for this
+ * same command for this same reason. The previous 30s sat BELOW the command's
+ * real cost — 56s measured on `yosemite-m0`, 136s on an idle box — so every slow
+ * device silently contributed nothing at all: no inventory, no sign-in, no
+ * divergence, no secret findings. A ceiling under the true cost does not make a
+ * probe cheap, it makes it always fail.
+ *
+ * This does not multiply by device count: `fanOutDevices` is `Promise.all`, so
+ * whole-fleet wall time is bounded near the slowest box, not 180s x N.
+ */
+export declare const FLEET_INVENTORY_TIMEOUT_MS = 180000;
 export type IssueSeverity = 'critical' | 'warning' | 'info';
 /**
  * One triaged health finding. `severity`/`category`/`subject`/`impact`/`fix` are

package/dist/commands/doctor.js

@@ -8,7 +8,7 @@ import { enterDoctorOverviewGate, writeDoctorOverviewCache } from '../lib/device
 import { fleetDialTarget } from '../lib/devices/connect.js';
 import { compareFleetInventories } from '../lib/devices/fleet-divergence.js';
 import { collectLocalFleetInventory } from '../lib/devices/fleet-inventory.js';
-import { buildLocalFindings, fleetDivergenceToFindings, signInToFindings, renderFindings, } from '../lib/devices/doctor-findings.js';
+import { buildLocalFindings, fleetDivergenceToFindings, signInToFindings, renderFindings, remediationFor, FINDING_SEVERITY, } from '../lib/devices/doctor-findings.js';
 import { getCliVersion } from '../lib/version.js';
 import { resolveHost } from '../lib/hosts/registry.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
@@ -26,12 +26,14 @@ import { checkVersionHookWiring, inspectDuplicateVersionHooks, registerHooksToSe
 import { isVersionIsolated } from '../lib/versions.js';
 import { computeDrift, checkSyncStatus, countOrphans, computeSourceBehind } from '../lib/drift.js';
 import { readAuthHealthCache, summarizeHostAuth } from '../lib/auth-health.js';
+import { readMeta } from '../lib/state.js';
+import { probeOwnerSink } from '../lib/channels/owner-sink.js';
 import { unifiedDiff, colorizeUnifiedDiff } from '../lib/diff-text.js';
 import { listCliStatus, listCliStatusAsync } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
 import { heal, healChangedAnything } from '../lib/heal.js';
 import { getEffectiveExecutionPolicy } from '../lib/platform/winpath.js';
-import { scanUserRcFiles } from '../lib/secrets/rc-hygiene.js';
+import { scanUserRcFiles, masterPassphraseInEnv } from '../lib/secrets/rc-hygiene.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
 import { readRepoBehindMarkers } from '../lib/auto-pull.js';
 import * as fs from 'fs';
@@ -80,6 +82,70 @@ function printWrappedLine(prefix, text) {
     for (const line of wrapLine(prefix, text))
         console.log(chalk.gray(line));
 }
+/**
+ * Narrow a remote `findings` array to the secret-hygiene rows, or `[]`.
+ *
+ * Deliberately NOT "forward every remote finding". The aggregator already
+ * rebuilds a remote's sign-in rows from its inventory and its divergence rows
+ * from the comparator, so forwarding wholesale would double them; and pulling a
+ * remote's orphan/drift rows into a fleet readout is a much larger UX change
+ * than this fix. The two secret kinds are the ones that are BOTH unrecomputable
+ * centrally and security-relevant, which is exactly why they were being lost.
+ *
+ * **The remote contributes exactly one thing: the KIND.** Severity, message and
+ * remediation are all generated HERE. That is not defensiveness for its own
+ * sake — the remote runs its own agents-cli, whose version and integrity we do
+ * not control, and each forwarded string is load-bearing in a different way:
+ *
+ *   - `remediation` is a command a human copies and runs. Accepting it from the
+ *     wire is an injection channel, full stop.
+ *   - `message` is the one place a secret VALUE could re-enter a readout that
+ *     otherwise guarantees it never prints one. A local builder cannot leak what
+ *     it never receives.
+ *   - `severity` decides the CRITICAL section, so a remote could otherwise
+ *     promote its own warning and bury real criticals under it.
+ *   - `device` is overwritten with the name we dialled, so no box can pin a
+ *     finding on another.
+ *
+ * The cost is detail: the fleet row says which box and which kind, not which
+ * file and line. Run `agents doctor` on that box for the specifics — the
+ * message says so.
+ */
+const REMOTE_FORWARDED_KINDS = ['rc-secret-export', 'env-secret-export'];
+/** Canonical, locally-authored text for a forwarded kind. Never the remote's. */
+const REMOTE_SECRET_MESSAGE = {
+    'rc-secret-export': 'a credential-shaped export was found in this box\'s shell rc files'
+        + ' — run `agents doctor` there for the file and line',
+    'env-secret-export': 'AGENTS_SECRETS_PASSPHRASE is set in this box\'s process environment'
+        + ' — run `agents doctor` there for detail',
+};
+export function asRemoteSecretFindings(raw, device) {
+    if (!Array.isArray(raw))
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const item of raw) {
+        if (!item || typeof item !== 'object' || Array.isArray(item))
+            continue;
+        const kind = item.kind;
+        if (typeof kind !== 'string')
+            continue;
+        if (!REMOTE_FORWARDED_KINDS.includes(kind))
+            continue;
+        if (seen.has(kind))
+            continue; // one row per kind per box
+        seen.add(kind);
+        const k = kind;
+        const base = {
+            severity: FINDING_SEVERITY[k],
+            kind: k,
+            device,
+            message: REMOTE_SECRET_MESSAGE[k],
+        };
+        out.push({ ...base, remediation: remediationFor({ ...base, remediation: '' }) });
+    }
+    return out;
+}
 async function resolveFleetTargets(opts) {
     const singleName = opts.host || opts.device;
     if (singleName) {
@@ -155,15 +221,32 @@ async function probeFleetTarget(target) {
  * null (unreachable, non-zero exit, unparseable, or an older CLI with no
  * `fleet` field); a null is skipped by the comparator, never a false gap.
  */
+/**
+ * How long one remote `doctor --json` probe may take.
+ *
+ * 180s, matching `ChildProcess.doctorTimeout`, which was set to 180 for this
+ * same command for this same reason. The previous 30s sat BELOW the command's
+ * real cost — 56s measured on `yosemite-m0`, 136s on an idle box — so every slow
+ * device silently contributed nothing at all: no inventory, no sign-in, no
+ * divergence, no secret findings. A ceiling under the true cost does not make a
+ * probe cheap, it makes it always fail.
+ *
+ * This does not multiply by device count: `fanOutDevices` is `Promise.all`, so
+ * whole-fleet wall time is bounded near the slowest box, not 180s x N.
+ */
+export const FLEET_INVENTORY_TIMEOUT_MS = 180_000;
 async function probeFleetInventory(target) {
     const isWin = /^win/i.test((target.os ?? '').trim());
     const remoteCmd = buildRemoteAgentsInvocation(['doctor', '--json'], undefined, isWin ? 'windows' : undefined, isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' });
-    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: 30000, multiplex: true });
+    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: FLEET_INVENTORY_TIMEOUT_MS, multiplex: true });
     if (res.code !== 0)
         return null;
     try {
         const parsed = JSON.parse(res.stdout);
-        return asFleetInventory(parsed.fleet);
+        return {
+            inventory: asFleetInventory(parsed.fleet),
+            secretFindings: asRemoteSecretFindings(parsed.findings, target.name),
+        };
     }
     catch {
         return null;
@@ -252,19 +335,22 @@ async function runDevicesDoctor(opts) {
         fanOutDevices(targets, probeFleetTarget),
         fanOutDevices(targets, probeFleetInventory),
     ]);
-    const inventoryByName = new Map();
+    const payloadByName = new Map();
     for (const r of inventoryResults)
-        inventoryByName.set(r.name, r.status === 'ok' ? (r.value ?? null) : null);
+        payloadByName.set(r.name, r.status === 'ok' ? (r.value ?? null) : null);
     results.push(...remoteResults.map((r) => {
-        const inventory = inventoryByName.get(r.name) ?? undefined;
+        const payload = payloadByName.get(r.name) ?? null;
+        const inventory = payload?.inventory ?? undefined;
+        const secretFindings = payload?.secretFindings;
         if (r.status === 'ok' && r.value)
-            return { ...r.value, inventory: inventory ?? undefined };
+            return { ...r.value, inventory, secretFindings };
         return {
             name: r.name,
             online: false,
             error: r.error ?? String(r.reason ?? 'skipped'),
             agents: {},
-            inventory: inventory ?? undefined,
+            inventory,
+            secretFindings,
         };
     }));
     // Cross-device divergence: compare every device's inventory against the local
@@ -314,12 +400,16 @@ async function runDevicesDoctor(opts) {
                 duplicateHooks: inspectDuplicateVersionHooks(cwd),
                 hostClis: toHostCliInput(listCliStatus(cwd)),
                 rcSecrets: scanUserRcFiles(),
+                masterPassphraseInEnv: masterPassphraseInEnv(),
                 execPolicy: process.platform === 'win32'
                     ? { platform: process.platform, policy: getEffectiveExecutionPolicy() }
                     : undefined,
                 isolatedVersions: localReports
                     .filter((rep) => isVersionIsolated(rep.agent, rep.version))
                     .map((rep) => `${rep.agent}@${rep.version}`),
+                // Can the owner-delivery lane escalate a block from THIS box? Local only —
+                // remote boxes self-report it in their own `agents doctor --json`.
+                ownerSink: await probeOwnerSink(readMeta()),
             }));
             accounts[localName] = r.inventory?.signIn ?? {};
             continue;
@@ -335,6 +425,11 @@ async function runDevicesDoctor(opts) {
             });
             continue;
         }
+        // Secret hygiene the aggregator cannot see for itself — the remote's shell
+        // rc files and its process environment. Without this the fleet readout
+        // reports a leaking box as clean (RUSH-1968).
+        if (r.secretFindings?.length)
+            findings.push(...r.secretFindings);
         if (r.inventory?.signIn) {
             findings.push(...signInToFindings(r.name, r.inventory.signIn));
             accounts[r.name] = r.inventory.signIn;
@@ -1389,12 +1484,16 @@ export function registerDoctorCommand(program) {
                 duplicateHooks,
                 hostClis: toHostCliInput(hostClis),
                 rcSecrets: scanUserRcFiles(),
+                masterPassphraseInEnv: masterPassphraseInEnv(),
                 // getEffectiveExecutionPolicy spawns powershell — a doomed process on
                 // POSIX, where the advisory never applies. Probe only on Windows.
                 execPolicy: process.platform === 'win32'
                     ? { platform: process.platform, policy: getEffectiveExecutionPolicy() }
                     : undefined,
                 isolatedVersions,
+                // Can the owner-delivery lane (feed/notify) escalate a block from this
+                // box? A factory that cannot escalate is not healthy (RUSH-2262).
+                ownerSink: await probeOwnerSink(readMeta()),
             });
             if (opts.json) {
                 const overviewPayload = {

package/dist/commands/exec.js

@@ -568,8 +568,8 @@ export function registerRunCommand(program) {
         .option('--bare', 'With --lease, skip copying your local ~/.agents setup (skills/hooks/commands/MCP) onto the box.')
         .option('--tailscale', 'Lease the box onto your tailnet (reachable only over Tailscale) rather than a public IP.')
         .option('--no-tailscale', 'Force a public-IP lease even when a reuse context would default to Tailscale.')
-        .option('--cloud', 'Vendor cloud placement: dispatch to the agent\'s native cloud (claude→rush, codex→codex, droid→factory, antigravity→antigravity) and stream the result. Same dispatch as `agents cloud run --agent <agent>`; tracked by `agents cloud list/status/logs`. Same as --where cloud. Mutually exclusive with --host/--lease and local-run flags.')
-        .option('--provider <id>', 'With --cloud: override the agent\'s native cloud provider (rush | codex | factory | antigravity | host).')
+        .option('--cloud', 'Vendor cloud placement: dispatch to the agent\'s native cloud (claude→rush, codex→codex, cursor→cursor, droid→factory, antigravity→antigravity) and stream the result. Same dispatch as `agents cloud run --agent <agent>`; tracked by `agents cloud list/status/logs`. Same as --where cloud. Mutually exclusive with --host/--lease and local-run flags.')
+        .option('--provider <id>', 'With --cloud: override the agent\'s native cloud provider (rush | codex | cursor | factory | antigravity | host).')
         .option('--repo <owner/repo>', 'With --cloud: GitHub repository. Repeatable for multi-repo dispatch (Rush Cloud only).', (val, prev) => [...prev, val], [])
         .option('--branch <name>', 'With --cloud: target git branch.')
         .option('--cloud-env <id>', 'With --cloud: Codex Cloud environment ID (run\'s --env is the KEY=VAL passthrough, so the cloud env id gets its own flag).');
@@ -657,8 +657,8 @@ export function registerRunCommand(program) {
         Models (cheap|default|best|ultra): agents models <agent[@version]>
 
       Headless plan support (a prompt makes the run headless):
-        plan works headless on claude, codex, droid, opencode.
-        kimi, grok, cursor, antigravity have no headless plan mode — a headless
+        plan works headless on claude, codex, cursor, droid, opencode.
+        kimi, grok, antigravity have no headless plan mode — a headless
         --mode plan auto-downgrades to --mode auto (with a stderr warning).
         Interactive plan (omit the prompt) works everywhere it is listed.
 
@@ -1019,19 +1019,21 @@ export function registerRunCommand(program) {
             const leaseSecretsBundle = process.env.AGENTS_LEASE_SECRETS_BUNDLE;
             const nowSecs = Math.floor(Date.now() / 1000);
             let reuseSlug = options.box;
-            // The profile this run's pool/box carries: the repo's .crabbox.yaml
-            // `profile:` when declared (what crabbox warmup would label a fresh box
-            // with), else crabbox's default. Passing it to leaseAndRun makes the
-            // pool-reuse match interchangeable with a fresh warmup.
+            // Lease runs share one default warm pool across repositories. The generic
+            // `.crabbox.yaml profile:` remains available to repo sandbox/CI scripts;
+            // `leaseProfile:` is the explicit opt-in for a dedicated lease hot box.
             const repoRoot = gitToplevel(leaseCwd);
-            const { readCrabboxRepoProfile } = await import('../lib/crabbox/config.js');
-            const poolProfile = repoRoot ? readCrabboxRepoProfile(repoRoot) : undefined;
+            const { readCrabboxLeaseProfile } = await import('../lib/crabbox/config.js');
+            const poolProfile = repoRoot ? readCrabboxLeaseProfile(repoRoot) : 'default';
             if (options.lease && !reuseSlug && !options.fresh) {
-                const { crabboxList } = await import('../lib/crabbox/cli.js');
-                const { reusableBoxes, formatBoxRow } = await import('./lease.js');
+                const { crabboxList, poolReusableBoxes } = await import('../lib/crabbox/cli.js');
+                const { formatBoxRow } = await import('./lease.js');
                 let warm = [];
                 try {
-                    warm = reusableBoxes(crabboxList({ secretsBundle: leaseSecretsBundle }), nowSecs);
+                    warm = poolReusableBoxes(crabboxList({ secretsBundle: leaseSecretsBundle }), {
+                        profile: poolProfile,
+                        nowSecs,
+                    });
                 }
                 catch {
                     warm = []; // crabbox unavailable / no creds → the pool check in leaseAndRun decides
@@ -1102,7 +1104,7 @@ export function registerRunCommand(program) {
                 }
             }
             const { detectSignedInRuntimes, resolveClaudeCredentialsBlob, inferLeaseRuntime, profileNeedsBaseRuntimeCredentials } = await import('../lib/crabbox/runtimes.js');
-            const { leaseAndRun } = await import('../lib/crabbox/lease.js');
+            const { leaseAndRun, leaseWorkspaceId } = await import('../lib/crabbox/lease.js');
             const { boxAddress } = await import('./lease.js');
             const { getConfiguredRunStrategy, resolveRunVersion } = await import('../lib/rotate.js');
             const { profileExists, readProfile, resolveProfileEnv } = await import('../lib/profiles.js');
@@ -1197,7 +1199,7 @@ export function registerRunCommand(program) {
                     ? 'the box is kept after the run'
                     : options.fresh
                         ? 'the box is destroyed after the run'
-                        : 'a fresh box is destroyed after the run; a reused pool box is kept';
+                        : 'the shared-pool box is kept after the run';
             console.error(chalk.gray(`${boxLifecycle} · shipping ${whatShips}${credentialRuntimes.length > 0 && leaseEmail ? ` (${leaseEmail})` : ''}; ${boxAfterRun}.`));
             // Read the Claude OAuth token from the local Keychain (silent) so it can be
             // written to ~/.claude/.credentials.json on the box — otherwise Claude boots
@@ -1279,6 +1281,7 @@ export function registerRunCommand(program) {
                     reuseBox: reuseSlug,
                     fresh: options.fresh,
                     profile: poolProfile,
+                    workspaceId: leaseWorkspaceId(repoRoot ?? leaseCwd),
                     copySetup,
                     netMode,
                     onData: (chunk) => router.push(chunk),
@@ -2455,7 +2458,7 @@ export function registerRunCommand(program) {
             process.exit(1);
         }
         // Default CLI mode is the generic 'plan'. Agents without a read-only
-        // mode (antigravity, cursor, kiro, …) degrade via resolveMode to their
+        // mode (antigravity, kiro, …) degrade via resolveMode to their
         // safest native mode (modes[0], typically edit). That covers both the
         // implicit default and an explicit `--mode plan`, so multi-agent
         // scripts can pass a uniform plan flag without per-agent branching.

package/dist/commands/feed.d.ts

@@ -42,6 +42,8 @@ export declare function prepareLocalFeedBlocks(localBlocks: OpenBlock[], opts: {
     dispatch: OpenBlock[];
     filter: ReturnType<typeof filterBlocksForFeed>;
 };
+/** Specific host app + routine provenance for one feed row. */
+export declare function formatFeedRuntime(block: Pick<OpenBlock, 'runtime' | 'origin' | 'routineName'>): string;
 /** Human summary line for one outcome rollup. */
 export declare function formatOutcomeHeader(group: OutcomeGroup): string;
 /** Map active sessions into the lightweight hints outcome enrichment needs. */
@@ -59,6 +61,9 @@ export declare function sessionHintsFromActive(sessions: Array<{
     worktree?: {
         slug?: string;
     };
+    host?: string;
+    origin?: 'cli' | 'routine';
+    routineName?: string;
 }>): SessionOutcomeHint[];
 /**
  * True when a SQLite open/query failed because another writer holds the lock.

package/dist/commands/feed.js

@@ -16,6 +16,7 @@ import { notifyUrgentBlock } from '../lib/notify.js';
 import { gcMailbox } from '../lib/mailbox-gc.js';
 import { isValidMailboxId } from '../lib/mailbox.js';
 import { getActiveSessions } from '../lib/session/active.js';
+import { backfillActiveRowsFromMeta } from './sessions.js';
 import { mailboxIdForActiveSession } from '../lib/mailbox-target.js';
 import { GLYPH, masthead } from '../lib/comms-render.js';
 import { discoverSessions } from '../lib/session/discover.js';
@@ -154,7 +155,7 @@ export function prepareLocalFeedBlocks(localBlocks, opts) {
 }
 function renderBlock(b, localHost, indent = '') {
     const host = b.host !== localHost ? chalk.yellow(` [${b.host}]`) : '';
-    const runtime = chalk.gray(b.runtime);
+    const runtime = chalk.gray(formatFeedRuntime(b));
     const age = chalk.gray(relTime(b.ts));
     const cls = b.blockClass ? chalk.gray(`(${b.blockClass})`) : '';
     const consequence = b.consequence && b.consequence !== 'normal' ? chalk.red(`[${b.consequence}]`) : '';
@@ -218,6 +219,21 @@ function renderBlock(b, localHost, indent = '') {
     }
     console.log();
 }
+/** Specific host app + routine provenance for one feed row. */
+export function formatFeedRuntime(block) {
+    const host = {
+        ghostty: 'Ghostty',
+        iterm: 'iTerm',
+        terminal: 'terminal',
+        kitty: 'Kitty',
+        codium: 'VSCodium',
+        code: 'VS Code',
+        cursor: 'Cursor',
+    }[block.runtime.toLowerCase()] ?? block.runtime;
+    if (block.origin !== 'routine')
+        return host;
+    return `${host} · routine${block.routineName ? `:${block.routineName}` : ''}`;
+}
 /** Human summary line for one outcome rollup. */
 export function formatOutcomeHeader(group) {
     const { agents, open, answered, parked } = group.counts;
@@ -251,6 +267,9 @@ export function sessionHintsFromActive(sessions) {
         prUrl: s.pr?.url,
         worktreeSlug: s.worktree?.slug,
         project: s.cwd ? projectKeyFromCwd(s.cwd) : undefined,
+        host: s.host,
+        origin: s.origin,
+        routineName: s.routineName,
     }));
 }
 /**
@@ -489,6 +508,7 @@ export function registerFeedCommand(program) {
                 console.error(chalk.yellow('Feed: session index is locked; skipping local outcome enrichment'));
             }
             sessionMetas = loaded.metas;
+            backfillActiveRowsFromMeta(sessions, new Map(sessionMetas.map((meta) => [meta.id, meta])));
         }
         const localSignals = buildSessionSignals(sessions, sessionMetas);
         if (opts.pause || opts.kill) {