@phnx-labs/agents-cli 1.22.24 → 1.22.26

package/dist/lib/crabbox/lease.d.ts

@@ -3,10 +3,11 @@
  *
  * Acquire a box → provision the picked runtime(s) + their credentials → run the
  * agent on the box (via `crabbox run`, which owns the SSH) → tear the box down.
- * Acquisition is reuse-first against the warm profile pool (a ready box carrying
- * the run's profile + netMode labels is reused and kept; `--fresh` opts out and
- * always leases a new, torn-down box). The whole box-side sequence rides a
- * single `--script-stdin` body so the token contents never touch argv.
+ * Acquisition is reuse-first against the shared warm pool (a ready box carrying
+ * the lease profile + netMode labels is reused and kept; `--fresh` opts out and
+ * always leases a new, torn-down box). Concurrent callers run from separate
+ * `~/workspaces/<repo>-<run>` directories on that box. The whole box-side
+ * sequence rides a single `--script-stdin` body so token contents never touch argv.
  *
  * ── Command-layer contract (RUSH-1920/1921/1924) ─────────────────────────────
  * Exports the commands layer (exec.ts / lease.ts / ssh.ts) consumes:
@@ -54,6 +55,8 @@ export interface LeaseRunOptions {
     backend?: string;
     boxClass?: string;
     profile?: string;
+    /** Per-run directory under ~/workspaces; isolates concurrent runs on one box. */
+    workspaceId?: string;
     /** Runtimes to install on the box. */
     runtimes: AgentId[];
     /** Runtime credentials to copy; defaults to `runtimes`. */
@@ -112,6 +115,10 @@ export interface LeaseRunResult {
     exitCode: number | null;
     toreDown: boolean;
 }
+/** Build a shell-safe, collision-resistant workspace id for one lease run. */
+export declare function leaseWorkspaceId(repoRoot: string, startedAtMs?: number, pid?: number): string;
+/** Isolated box-home path for one run, relative to the shared box user's home. */
+export declare function leaseHomeDir(workspaceId: string): string;
 /**
  * Build the single bootstrap script run on the box: ensure agents-cli, install
  * the picked runtime CLIs, write their credentials, run the agent, then shred

package/dist/lib/crabbox/lease.js

@@ -3,10 +3,11 @@
  *
  * Acquire a box → provision the picked runtime(s) + their credentials → run the
  * agent on the box (via `crabbox run`, which owns the SSH) → tear the box down.
- * Acquisition is reuse-first against the warm profile pool (a ready box carrying
- * the run's profile + netMode labels is reused and kept; `--fresh` opts out and
- * always leases a new, torn-down box). The whole box-side sequence rides a
- * single `--script-stdin` body so the token contents never touch argv.
+ * Acquisition is reuse-first against the shared warm pool (a ready box carrying
+ * the lease profile + netMode labels is reused and kept; `--fresh` opts out and
+ * always leases a new, torn-down box). Concurrent callers run from separate
+ * `~/workspaces/<repo>-<run>` directories on that box. The whole box-side
+ * sequence rides a single `--script-stdin` body so token contents never touch argv.
  *
  * ── Command-layer contract (RUSH-1920/1921/1924) ─────────────────────────────
  * Exports the commands layer (exec.ts / lease.ts / ssh.ts) consumes:
@@ -38,6 +39,16 @@ import { DEFAULT_CRABBOX_PROFILE } from './config.js';
 function q(s) {
     return "'" + s.replace(/'/g, "'\\''") + "'";
 }
+/** Build a shell-safe, collision-resistant workspace id for one lease run. */
+export function leaseWorkspaceId(repoRoot, startedAtMs = Date.now(), pid = process.pid) {
+    const repo = repoRoot.split(/[\\/]/).filter(Boolean).pop() ?? 'repo';
+    const safeRepo = repo.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'repo';
+    return `${safeRepo}-${startedAtMs.toString(36)}-${pid.toString(36)}`;
+}
+/** Isolated box-home path for one run, relative to the shared box user's home. */
+export function leaseHomeDir(workspaceId) {
+    return `lease-homes/${workspaceId}`;
+}
 function profileRemotePath(name) {
     return `.agents/profiles/${name}.yml`;
 }
@@ -124,15 +135,35 @@ export function buildBootstrapScript(opts) {
     // them as a structured step stream — they never appear as setup noise.
     const step = (name) => `echo ${q(leasePhaseSentinel(name))}`;
     const copySetup = opts.copySetup !== false; // default TRUE
+    const workspace = opts.workspaceId
+        ? [
+            'BOX_HOME="$HOME"',
+            'REPO_DIR="$(pwd)"',
+            `WORKSPACE_DIR="$BOX_HOME"/${q(`workspaces/${opts.workspaceId}`)}`,
+            'mkdir -p "$WORKSPACE_DIR"',
+            'rsync -a --delete --exclude=node_modules --exclude=.agents/worktrees "$REPO_DIR/" "$WORKSPACE_DIR/"',
+            'cd "$WORKSPACE_DIR"',
+        ].join('\n')
+        : '';
+    const isolatedHome = opts.workspaceId
+        ? [
+            `export HOME="$BOX_HOME"/${q(leaseHomeDir(opts.workspaceId))}`,
+            'mkdir -p "$HOME/.agents"',
+            'ln -sfn "$BOX_HOME/.agents/.system" "$HOME/.agents/.system"',
+            'export PATH="$BOX_HOME/.local/bin:$PATH"',
+        ].join('\n')
+        : '';
     return [
         'set -uo pipefail',
         // crabbox has finished its workspace resync by the time this script runs;
         // the sync sentinel marks the transition out of that (crabbox-driven) phase.
         step('sync'),
+        workspace,
         // Only meaningful on a tailnet lease — the box already joined during warmup.
         opts.netMode === 'tailscale' ? step('joined-tailnet') : '',
         step('install'),
         ENSURE_AGENTS_CLI,
+        isolatedHome,
         step('runtime'),
         installRuntimes,
         step('creds'),
@@ -287,6 +318,7 @@ export async function leaseAndRun(opts) {
                 secretsBundle: opts.secretsBundle,
                 onData: opts.onData,
                 refresh: false,
+                remoteDir: opts.workspaceId ? `${leaseHomeDir(opts.workspaceId)}/.agents/` : undefined,
             });
         }
         catch {
@@ -303,10 +335,10 @@ export async function leaseAndRun(opts) {
         });
     }
     finally {
-        // Always attempt teardown (bounds credential lifetime to the run) unless the
-        // caller explicitly asked to keep the box or the box was reused (an explicit
-        // --box target or a warm pool box — both outlive this run).
-        if (!opts.keep && !reused) {
+        // Normal --lease establishes or reuses the warm pool, so the box outlives
+        // this run; credentials are still shredded inside the script above. Only
+        // --fresh requests the old one-shot lifecycle and tears its new box down.
+        if (!opts.keep && opts.fresh && !reused) {
             opts.onPhase?.({ kind: 'teardown' });
             toreDown = crabboxStop(box.slug, { secretsBundle: opts.secretsBundle });
         }

package/dist/lib/crabbox/setup-copy.d.ts

@@ -31,6 +31,11 @@ export interface CopySetupOptions {
     secretsBundle?: string;
     /** Override the local `~/.agents` dir (defaults to `getUserAgentsDir()`). */
     userAgentsDir?: string;
+    /**
+     * Destination relative to the box user's home. Lease runs set this to their
+     * isolated home; other callers retain the historical `~/.agents/` target.
+     */
+    remoteDir?: string;
     /** Receives combined stdout/stderr of the rsync + refresh, if set. */
     onData?: (chunk: string) => void;
     /**

package/dist/lib/crabbox/setup-copy.js

@@ -109,9 +109,25 @@ export async function copySetupToBox(opts) {
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-setup-copy-'));
     const listPath = path.join(tmp, 'files.lst');
     try {
+        if (opts.remoteDir) {
+            if (!/^[a-zA-Z0-9._/-]+$/.test(opts.remoteDir) || opts.remoteDir.startsWith('/') || opts.remoteDir.split('/').includes('..')) {
+                throw new Error(`remote setup directory must stay under the box home: ${opts.remoteDir}`);
+            }
+            const remoteDir = opts.remoteDir.replace(/\/$/, '');
+            const prepareArgs = [
+                ...sshArgv.slice(1),
+                'bash',
+                '-lc',
+                `mkdir -p "$HOME"/${JSON.stringify(remoteDir)}`,
+            ];
+            const prepareExitCode = await runStreaming('ssh', prepareArgs, env, opts.onData);
+            if (prepareExitCode !== 0) {
+                return { files, pushExitCode: prepareExitCode, refreshExitCode: null };
+            }
+        }
         // NUL-separated list, matching `buildSetupRsyncArgs`'s `--from0`.
         fs.writeFileSync(listPath, files.join('\0'), 'utf-8');
-        const rsyncArgs = buildSetupRsyncArgs({ rsh, host, filesFrom: listPath, source: dir });
+        const rsyncArgs = buildSetupRsyncArgs({ rsh, host, filesFrom: listPath, source: dir, remoteDir: opts.remoteDir });
         const pushExitCode = await runStreaming('rsync', rsyncArgs, env, opts.onData);
         let refreshExitCode = null;
         if (pushExitCode === 0 && opts.refresh !== false) {

package/dist/lib/daemon.js

@@ -24,7 +24,9 @@ import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { redactSecrets } from './redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from './cli-entry.js';
-import { isSchedulerEnabled, assertSchedulerEnabled } from './device-config.js';
+import { getConfigValue, isSchedulerEnabled, assertSchedulerEnabled } from './device-config.js';
+import { reapTerminalRoutineProcesses } from './routine-process-cleanup.js';
+import { runWatchdogPass } from './watchdog/service.js';
 const PID_FILE = 'daemon.pid';
 const LOCK_FILE = 'daemon.lock';
 const LOG_FILE = 'logs.jsonl';
@@ -34,6 +36,7 @@ const LOG_ROTATE_COUNT = 3;
 const PLIST_NAME = 'com.phnx-labs.agents-daemon';
 const SYSTEMD_UNIT = 'agents-daemon.service';
 const MONITOR_TICK_MS = 60_000;
+const WATCHDOG_TICK_MS = 3 * 60_000;
 /**
  * How often to re-scan for missed fires. Deliberately slower than the monitor
  * tick: detection walks a week of cron occurrences per routine
@@ -572,6 +575,24 @@ export async function runDaemon() {
     }
     if (schedulerEnabledAtBoot)
         bootScheduler();
+    let watchdogInFlight = false;
+    const runDaemonWatchdog = async () => {
+        if (watchdogInFlight || getConfigValue('watchdog.enabled').value !== true)
+            return;
+        watchdogInFlight = true;
+        try {
+            const result = await runWatchdogPass({ nudge: true });
+            log('INFO', `watchdog: ${result.counts.total} live, ${result.counts.stalled} stalled, ${result.counts.nudged} nudged`);
+        }
+        catch (err) {
+            log('ERROR', `watchdog tick failed: ${err.message}`);
+        }
+        finally {
+            watchdogInFlight = false;
+        }
+    };
+    const watchdogInterval = setInterval(() => { void runDaemonWatchdog(); }, WATCHDOG_TICK_MS);
+    const watchdogKickoff = setTimeout(() => { void runDaemonWatchdog(); }, 30_000);
     // Monitor engine: event-triggered watchers, beside the cron scheduler. Same
     // daemon, same dispatch seam — a monitor is a routine whose trigger is a
     // watched source instead of a clock. Reloads on SIGHUP alongside the scheduler.
@@ -682,6 +703,9 @@ export async function runDaemon() {
     const monitorInterval = setInterval(() => {
         writeHeartbeat();
         monitorRunningJobs();
+        const reaped = reapTerminalRoutineProcesses();
+        if (reaped.length > 0)
+            log('WARN', `Reaped ${reaped.length} terminal routine process group(s): ${reaped.join(', ')}`);
     }, MONITOR_TICK_MS);
     // Resource safety check: heal gaps between what DotAgents repos define and
     // what's actually installed in each agent home — the slow rot that nothing
@@ -1066,6 +1090,8 @@ export async function runDaemon() {
         monitorEngine.stop();
         await browserIPC.stop();
         clearInterval(monitorInterval);
+        clearInterval(watchdogInterval);
+        clearTimeout(watchdogKickoff);
         clearInterval(healInterval);
         clearTimeout(healKickoff);
         clearInterval(autoDispatchInterval);

package/dist/lib/device-config.js

@@ -67,6 +67,13 @@ export const CONFIG_KEYS = [
         type: 'bool',
         description: 'Whether the routines scheduler (daemon) may fire on this device.',
     },
+    {
+        name: 'watchdog.enabled',
+        yamlKey: 'watchdogEnabled',
+        scope: 'device',
+        type: 'bool',
+        description: 'Whether the daemon runs the watchdog pass on this device.',
+    },
     {
         name: 'browser.remote-control',
         yamlKey: 'browserRemoteControl',

package/dist/lib/devices/doctor-findings.d.ts

@@ -1,6 +1,7 @@
 import type { AgentId } from '../types.js';
 import type { DuplicateVersionHook } from '../hooks.js';
 import type { RcSecretFinding } from '../secrets/rc-hygiene.js';
+import type { OwnerSinkStatus } from '../channels/owner-sink.js';
 import type { SyncStatusRow, OrphanRow } from '../drift.js';
 import type { FetchStatusMarker } from '../auto-pull.js';
 import type { VersionResourceReport } from '../doctor-diff.js';
@@ -10,7 +11,7 @@ export type FindingSeverity = 'critical' | 'warning';
  *  the JSON consumer group by kind. */
 /** Every finding class. Severity is NOT annotated here — {@link FINDING_SEVERITY}
  *  below owns it, and a second copy in these comments is a fourth place to drift. */
-export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "exec-policy", "stale-cli"];
+export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "stale-cli", "owner-sink-unreachable"];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
  * the builders below and asserted against both prose rubrics by
@@ -89,6 +90,12 @@ export interface LocalFindingInputs {
     duplicateHooks?: DuplicateVersionHook[];
     /** Credential-shaped exports found in the user's shell rc files (RUSH-1968). */
     rcSecrets?: RcSecretFinding[];
+    /** True when the file-store master key is live in THIS process's environment.
+     *  Distinct from `rcSecrets`, which scans FILES: a value inherited by a
+     *  long-lived process survives deleting the rc line that set it, so the rc
+     *  scan reports clean while the leak is still in flight (RUSH-1968). Never the
+     *  value — only whether it is set. */
+    masterPassphraseInEnv?: boolean;
     /** The effective PowerShell execution policy and the platform it was read on.
      *  Only `win32` yields a finding — the `agents.ps1` launcher is Windows-only. */
     execPolicy?: {
@@ -100,6 +107,11 @@ export interface LocalFindingInputs {
      *  sweep deliberately skips isolated copies, so a collapsed row would print a
      *  remediation that does not fix them. */
     isolatedVersions?: string[];
+    /** Whether the feed/notify owner-delivery lane can reach the owner from this box
+     *  (RUSH-2262). Collected by `probeOwnerSink` in the command (it spawns the real
+     *  `rush` transport, so it stays out of this pure module). Absent → no probe ran
+     *  → no finding. */
+    ownerSink?: OwnerSinkStatus;
 }
 /**
  * Fold this machine's signals into findings. Missing hooks/plugins and unwired

package/dist/lib/devices/doctor-findings.js

@@ -18,12 +18,13 @@
  * with. Keep this list exhaustive; a kind missing from it is a doc that lies.
  *   CRITICAL — logged-out (provable) · missing-hook · missing-plugin ·
  *              unwired-hook (a hook on disk that settings.json never fires) ·
- *              cli-missing.
+ *              cli-missing · owner-sink-unreachable (the feed/notify owner lane
+ *              cannot reach the owner from this box).
  *   WARNING  — logout-unprovable (hedged) · missing-resource · content-drift ·
  *              never-synced · stale · repo-behind · repo-drift · version-skew ·
  *              fleet-resource-gap · orphan · duplicate-hook ·
  *              duplicate-hook-drift · host-cli-missing · host-cli-invalid ·
- *              rc-secret-export · exec-policy · stale-cli.
+ *              rc-secret-export · env-secret-export · exec-policy · stale-cli.
  *   (RUSH-2162 moved never-synced and duplicate-hook-drift to WARNING: both are
  *   stale-sync states one `agents sync` resolves, not "needs you now".)
  *
@@ -94,8 +95,10 @@ export const ALL_FINDING_KINDS = [
     'duplicate-hook', // one hook materialized in several version homes, byte-identical
     'duplicate-hook-drift', // …with differing content, so a stale copy can disagree
     'rc-secret-export', // credential-shaped export in a shell rc file
+    'env-secret-export', // the file-store master key live in THIS process's env
     'exec-policy', // Windows execution policy blocks agents.ps1
     'stale-cli',
+    'owner-sink-unreachable', // the feed/notify owner-delivery lane can't reach the owner from this box
 ];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
@@ -115,6 +118,9 @@ export const FINDING_SEVERITY = {
     'missing-plugin': 'critical',
     'unwired-hook': 'critical',
     'cli-missing': 'critical',
+    // A factory that cannot escalate a blocked agent to the owner is not healthy,
+    // and the failure is otherwise silent until a block is filed (RUSH-2262/2258).
+    'owner-sink-unreachable': 'critical',
     // Everything else is resolvable by a routine sync/cleanup and does not block
     // the harness right now. RUSH-2162 moved never-synced and duplicate-hook-drift
     // here: both are stale-sync states that one `agents sync` resolves.
@@ -133,6 +139,7 @@ export const FINDING_SEVERITY = {
     'host-cli-missing': 'warning',
     'host-cli-invalid': 'warning',
     'rc-secret-export': 'warning',
+    'env-secret-export': 'warning',
     'exec-policy': 'warning',
     'stale-cli': 'warning',
 };
@@ -240,10 +247,22 @@ export function remediationFor(finding) {
             return 'fix the manifest';
         case 'rc-secret-export':
             return 'agents secrets add';
+        case 'env-secret-export':
+            // Not just "restart the shell": the value is in every long-lived parent
+            // that inherited it — an editor, a tmux server, the agents daemon — and
+            // each keeps handing it to new children until IT restarts.
+            return 'unset at the source, then restart every process that inherited it (shells, editor, tmux, agents daemon)';
         case 'exec-policy':
             return 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned';
         case 'stale-cli':
             return 'upgrade';
+        case 'owner-sink-unreachable':
+            // The lane delivers over the rush-backed owner channel, which needs rush on
+            // PATH AND a usable session in THIS context. Non-interactive shells miss a
+            // ~/.zshrc export (RUSH-2258), and the session is keychain-bound, not in
+            // ~/.rush/user.yaml (RUSH-2262) — so `rush login` here, or the Rush App for
+            // a GUI keychain, is what makes it reachable.
+            return "put rush on PATH for non-interactive shells (~/.zshenv) and run 'rush login'";
     }
 }
 function finding(f) {
@@ -286,6 +305,22 @@ export function buildLocalFindings(input) {
             message: `${agentName(agent)} binary not found`,
         }));
     }
+    // owner-sink-unreachable — the feed/notify owner-delivery lane can't reach the
+    // owner from this box (RUSH-2262). Only when owner delivery is CONFIGURED for the
+    // fleet; an un-opted-in box is not broken. The message names the concrete reason.
+    const sink = input.ownerSink;
+    if (sink?.configured && !sink.reachable) {
+        const chan = sink.channel ?? 'owner';
+        const why = sink.reason === 'rush-not-on-path'
+            ? `rush CLI not on this box's PATH`
+            : sink.reason === 'rush-signed-out'
+                ? 'rush has no usable session here'
+                : 'transport unreachable';
+        out.push(finding({
+            severity: FINDING_SEVERITY['owner-sink-unreachable'], kind: 'owner-sink-unreachable', device,
+            message: `${chan} → owner unreachable: ${why}`,
+        }));
+    }
     // Per-version resource reports → missing hook/plugin (critical), unwired hook
     // (critical), other missing kinds (warning), content drift (warning).
     for (const report of input.reports) {
@@ -450,6 +485,10 @@ export function buildLocalFindings(input) {
     // into `agents secrets`.
     for (const f of rcSecretFindings(device, input.rcSecrets ?? []))
         out.push(f);
+    // The same key, live in this process's environment rather than in a file.
+    const envFinding = envSecretFinding(device, input.masterPassphraseInEnv ?? false);
+    if (envFinding)
+        out.push(envFinding);
     // Windows execution policy blocking the generated agents.ps1 launcher.
     const policyFinding = execPolicyFinding(device, input.execPolicy);
     if (policyFinding)
@@ -572,6 +611,32 @@ function rcSecretFindings(device, rc) {
  * policy itself. Returns null off Windows or on a permissive policy — pure, so
  * both branches are testable without invoking PowerShell.
  */
+/**
+ * The file-store master key sitting in THIS process's environment.
+ *
+ * `rc-hygiene.ts` scans FILES, which leaves a real hole: a value inherited by a
+ * long-lived process outlives the rc line that set it, so an operator who
+ * deletes `~/.zshenv:8` gets a clean `rc-secret-export` while every shell,
+ * editor and agent started before the edit still carries the key — and hands it
+ * to everything they spawn. Verified on a box with no rc export whose live
+ * environment still held the value, hashing identical to its key file.
+ *
+ * Warning, not critical: on the release home base the export is deliberate and
+ * scoped (`headless-sign-context.sh`), so the message names that exception
+ * rather than the check trying to detect it.
+ */
+function envSecretFinding(device, present) {
+    if (!present)
+        return null;
+    return finding({
+        severity: FINDING_SEVERITY['env-secret-export'], kind: 'env-secret-export', device,
+        // Never the value — only that it is set.
+        message: 'AGENTS_SECRETS_PASSPHRASE is set in this process environment — every '
+            + 'child inherits it and any same-user process can read it from /proc/<pid>/environ. '
+            + 'It outlives the shell rc line that set it, so deleting that line is not enough. '
+            + '(Expected inside a release sign context, which sets it deliberately.)',
+    });
+}
 function execPolicyFinding(device, execPolicy) {
     if (!execPolicy || execPolicy.platform !== 'win32')
         return null;
@@ -745,6 +810,10 @@ function subjectLabel(f) {
     return f.version ? `${f.agent} @${f.version}` : f.agent;
 }
 function critLabel(f) {
+    // Machine-level criticals with no agent get a category subject so the left
+    // column is not blank; the owner-sink row reads `owner  …`, not an empty label.
+    if (f.kind === 'owner-sink-unreachable')
+        return { left: 'owner', account: '', message: f.message };
     return {
         left: subjectLabel(f),
         account: f.account ?? '',
@@ -881,6 +950,8 @@ function warningSubject(f) {
         return 'orphans';
     if (f.kind === 'rc-secret-export')
         return 'shell rc';
+    if (f.kind === 'env-secret-export')
+        return 'environment';
     if (f.kind === 'exec-policy')
         return 'PowerShell';
     if (f.kind === 'fleet-resource-gap')

package/dist/lib/events.d.ts

@@ -226,6 +226,15 @@ export declare function query(options: {
     bundle?: string;
     limit?: number;
 }): EventRecord[];
+/**
+ * Scan event logs once for a set of session IDs and return browser/computer
+ * usage flags for each. O(files) instead of O(N × files) — safe to call
+ * outside a SQLite write transaction.
+ */
+export declare function queryToolUsageForSessions(sessionIds: ReadonlySet<string>): Map<string, {
+    usedBrowser: boolean;
+    usedComputer: boolean;
+}>;
 /**
  * Get performance stats for a specific label.
  */

package/dist/lib/events.js

@@ -1052,6 +1052,64 @@ export function query(options) {
     }
     return results;
 }
+/**
+ * Scan event logs once for a set of session IDs and return browser/computer
+ * usage flags for each. O(files) instead of O(N × files) — safe to call
+ * outside a SQLite write transaction.
+ */
+export function queryToolUsageForSessions(sessionIds) {
+    const result = new Map();
+    if (sessionIds.size === 0)
+        return result;
+    for (const id of sessionIds) {
+        result.set(id, { usedBrowser: false, usedComputer: false });
+    }
+    const BROWSER_EVENTS = new Set(['browser.navigate', 'browser.screenshot']);
+    const COMPUTER_EVENTS = new Set(['computer.action']);
+    eventsPath();
+    migrateLegacyEventLogs();
+    const files = listEventLogFiles().sort((a, b) => Number(b.currentActive) - Number(a.currentActive) || b.mtimeMs - a.mtimeMs || b.path.localeCompare(a.path));
+    let remaining = sessionIds.size * 2; // each session needs up to 2 flags set
+    for (const file of files) {
+        if (remaining <= 0)
+            break;
+        let content;
+        if (file.gzip) {
+            try {
+                content = gunzipSync(fs.readFileSync(file.path)).toString('utf-8');
+            }
+            catch {
+                continue;
+            }
+        }
+        else {
+            content = fs.readFileSync(file.path, 'utf-8');
+        }
+        for (const line of content.trim().split('\n')) {
+            if (!line)
+                continue;
+            try {
+                const record = JSON.parse(line);
+                const sid = record.sessionId;
+                if (!sid || !result.has(sid))
+                    continue;
+                const entry = result.get(sid);
+                if (BROWSER_EVENTS.has(record.event) && !entry.usedBrowser) {
+                    entry.usedBrowser = true;
+                    remaining--;
+                }
+                else if (COMPUTER_EVENTS.has(record.event) && !entry.usedComputer) {
+                    entry.usedComputer = true;
+                    remaining--;
+                }
+            }
+            catch {
+                // skip malformed lines
+            }
+        }
+    }
+    return result;
+}
 // ─── Stats ────────────────────────────────────────────────────────────────────
 /**
  * Get performance stats for a specific label.

package/dist/lib/exec.d.ts

@@ -42,7 +42,7 @@ export declare function headlessPlanStallCommand(args: {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/cursor/kiro have no plan flag; hard-failing made
+ *   like antigravity/kiro have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -61,8 +61,8 @@ export declare function resolveMode(agent: AgentId, requested: Mode): Mode;
  * `--prompt` + `--plan`, and grok's `--permission-mode plan` silently stalls at
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
- * one-line stderr warning, mirroring the graceful plan→edit degrade cursor and
- * antigravity get for having no plan flag at all. Interactive runs are never
+ * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
+ * and kiro get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */

package/dist/lib/exec.js

@@ -86,7 +86,7 @@ export function headlessPlanStallCommand(args) {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/cursor/kiro have no plan flag; hard-failing made
+ *   like antigravity/kiro have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -106,7 +106,7 @@ export function resolveMode(agent, requested) {
     }
     if (requested === 'plan') {
         // No read-only mode on this agent. modes[0] is the declared safest mode
-        // (edit for antigravity/cursor/kiro/…). Prefer that over hard-fail so
+        // (edit for antigravity/kiro/…). Prefer that over hard-fail so
         // uniform multi-agent `--mode plan` dispatches still run.
         return supported[0];
     }
@@ -121,8 +121,8 @@ export function resolveMode(agent, requested) {
  * `--prompt` + `--plan`, and grok's `--permission-mode plan` silently stalls at
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
- * one-line stderr warning, mirroring the graceful plan→edit degrade cursor and
- * antigravity get for having no plan flag at all. Interactive runs are never
+ * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
+ * and kiro get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */
@@ -142,12 +142,8 @@ export function resolveHeadlessMode(agent, requested, interactive, warningContex
     if (mode !== requested) {
         const subject = warningContext ? `${warningContext}: ` : '';
         if (requested === 'plan') {
-            const limitation = agent === 'cursor'
-                ? "cursor's read-only plan mode is not enabled in this build"
-                : `${agent} has no read-only 'plan' mode`;
-            warn(`[agents] ${subject}${limitation}; ` +
-                `running '${mode}' (writable) instead${agent === 'cursor' ? ' (RUSH-2101)' : ''}. ` +
-                `Pass --mode ${mode} to silence this.\n`);
+            warn(`[agents] ${subject}${agent} has no read-only 'plan' mode; ` +
+                `running '${mode}' (writable) instead. Pass --mode ${mode} to silence this.\n`);
         }
         else {
             warn(`[agents] ${subject}${agent} has no '${requested}' mode; using '${mode}'.\n`);
@@ -494,6 +490,7 @@ export const AGENT_COMMANDS = {
         base: ['cursor-agent'],
         promptFlag: '-p',
         modeFlags: {
+            plan: ['--plan'],
             edit: [],
             skip: ['-f'],
         },
@@ -687,6 +684,23 @@ export const AGENT_COMMANDS = {
         // `resume` subcommand — special-cased in buildExecCommand.
         resume: { flag: '--session-id' },
     },
+    // Warp Agent CLI (`oz agent run`). Headless is `-p/--prompt "<task>"`; JSON is
+    // the global `--output-format json`. Autonomy comes from the selected agent
+    // profile (`--profile`), not a per-run permission flag, so the single `edit`
+    // mode maps to no flags (mirrors hermes). `--model` overrides the base model
+    // (`oz model list`). No `resume`: Oz's `oz agent run --conversation <id>`
+    // continues a SERVER-SIDE conversation by id, and warp is not session-tracked
+    // (absent from SESSION_AGENTS), so agents-cli has no local id to resume from —
+    // declaring it would make nativeResume(warp) true against an unreachable path.
+    warp: {
+        base: ['oz', 'agent', 'run'],
+        promptFlag: '-p',
+        modeFlags: {
+            edit: [],
+        },
+        jsonFlags: ['--output-format', 'json'],
+        modelFlag: '--model',
+    },
 };
 /**
  * Whether `agent` has a native resume form (Tier 1). Derived solely from the

package/dist/lib/feed-outcome.d.ts

@@ -89,6 +89,9 @@ export interface SessionOutcomeHint {
     worktreeSlug?: string | null;
     branch?: string | null;
     project?: string | null;
+    host?: string | null;
+    origin?: 'cli' | 'routine' | null;
+    routineName?: string | null;
 }
 /**
  * Overlay session meta onto a block when the block itself is missing ticket/PR/