@phnx-labs/agents-cli 1.22.25 → 1.22.26

package/CHANGELOG.md

@@ -1,5 +1,178 @@
 # Changelog
 
+## 1.22.26
+
+- Make bare `agents setup` a re-runnable onboarding hub with live capability status and direct access to browser, computer, secrets, fleet, share, watchdog, and preference wizards.
+
+- **`agents apply --provision-secrets` pushes the manifest's declared secrets
+  bundles to each device, instead of only printing a reminder (RUSH-1968).** This
+  gap is a direct cause of the ticket: an operator who needed secrets on a worker
+  box had no supported path — `apply` said "recreate manually" and nothing else —
+  so they hand-exported the file store's master key across the fleet. The
+  provisioning primitive now exists, and `apply` runs it as a fifth reconcile
+  phase, last, because it is the most sensitive mutation `apply` performs.
+
+  It is **off by default** and is a **flag, not a manifest field**: `agents.yaml`
+  is shared, so a file-level default would mean someone else's `apply -y` silently
+  ships credential values. Three gates, and every refusal still prints a
+  `needs-secret` reminder so a skipped device is never silent — the flag must be
+  set, the device must be reachable, and its host key must be **pinned** (the same
+  bar `agents exec --copy-creds` sets, EXEC-34).
+
+  **Backend follows the platform: `file` on Linux, `keychain` on macOS/Windows.**
+  That is the load-bearing default — a headless Linux box has no keychain and its
+  file store auto-provisions its OWN machine-local key, so each device gets an
+  unshared at-rest key and **no passphrase is forwarded**. That is the direct
+  alternative to the fleet-wide shared secret this ticket is about.
+
+  With provisioning on, `apply` runs one extra `agents secrets list --json` per
+  device (metadata only — names and timestamps, never values) and skips a bundle
+  the device already has; without that, every run re-resolves the bundle locally
+  and a resolve can prompt for Touch ID, so a converged fleet would nag on every
+  apply. It compares presence, not content — `--force` re-pushes regardless. The
+  `--plan` matrix gains a `secrets` column, shown only when the manifest declares
+  bundles, and names the flag when the capability is available but off. Source:
+  `apps/cli/src/lib/secrets/push.ts` (extracted from the `export --host` action so
+  a lib no longer needs a command module), `apps/cli/src/lib/fleet/apply.ts`,
+  `apps/cli/src/commands/apply.ts`.
+
+- **`agents teams` auto-scheduling is health-, harness-, and load-aware, and fails loud when no pool device can run the agent (RUSH-2002).** Placing an unpinned teammate onto a `--devices` pool used to be a pure roster count that could land it on an unreachable box, an overloaded one, or one where its agent isn't installed. `teams start` now probes the pool once (reachability + load from the same snapshot `agents devices` shows, plus whether the teammate's agent is installed there) and: excludes unreachable / overloaded (`loaded` headroom) / `agents.max-concurrent`-capped / not-installed devices, then ranks the survivors by agent installed + signed in, then lower load, then fewer running teammates. If no pool device can run a pending teammate's agent, `teams start` fails loud — `No device in the team pool can run claude@2.1.112. Run 'agents devices ping' to see which devices have the agent installed + signed in.` — instead of stranding the teammate or silently falling back to a local run; `--force` downgrades it to a warning. A probe that could not reach the pool does not trigger the failure (no false positives). The pick stays pure and fully unit-tested; `teams add` is unchanged (no probe on the add path). Source: `apps/cli/src/lib/teams/scheduler.ts`, `apps/cli/src/lib/teams/placement-probe.ts`, `apps/cli/src/lib/teams/agents.ts`, `apps/cli/src/commands/teams.ts`.
+
+- **`agents reconnect [session-id]` re-enters a dropped remote agent terminal, and the auto-reconnect no longer dead-ends on a dead pane (RUSH-2085).** When the network dropped during `agents run --device <box>` and the peer's tmux pane was gone by the time the link came back, the reattach ran `agents sessions focus <id> --local --attach-only`, which hard-failed with `No live session matching …` and dropped the user at a bare shell with the id scrolled off screen. Two fixes: the auto-reconnect reattach now runs `agents sessions focus <id> --local` (no `--attach-only`), so a surviving pane is joined and a dead one RESUMES in place instead of dead-ending; and a new `agents reconnect` (also `agents sessions reconnect`) is the manual companion for after the auto-loop gave up or a VS Code terminal tab closed — attach the live pane if it survived, else resume the session. With no id it targets the most recent session started from the current directory (the terminal that most likely just dropped), not the full fleet picker. The exhausted / remote-exit notices now print the exact `agents reconnect <id>` command instead of a raw id and a shell prompt. Source: `apps/cli/src/lib/hosts/reconnect.ts`, `apps/cli/src/commands/reconnect.ts`.
+
+- **`agents routines add` now rejects an agent the local daemon can't fire, at add time (RUSH-2102).** `--agent opencode` (or any real, installable agent outside the daemon's `AGENT_COMMANDS` table — currently `claude`, `codex`, `gemini`, `cursor`, `kimi`, `droid`, `muse`) used to pass `validateJob` because it only checked the agent against the full agent registry, not the daemon-runnable subset — the routine was written to disk and only failed once the scheduler fired it (`Unsupported agent for daemon jobs: opencode`). `validateJob` now rejects it immediately for the default local placement, with an error naming the supported agents. Routines placed with `hostStrategy: host`/`fleet`/`cloud` are unaffected — those dispatch through `agents run`/a cloud provider, not this table, so a wider agent set is legitimately supported there. Source: `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/agents.ts`.
+
+- **OpenClaw's capability table no longer claims `hooks: true` with zero hooks
+  ever installed (RUSH-2122).** `registerHooksToSettings` has no `openclaw`
+  branch and silently returned `{ registered: [], errors: [] }` for it, so
+  `agents sync openclaw` reported success while installing nothing, and
+  `agents doctor` treated the agent as hooks-capable with no way to detect the
+  gap. OpenClaw only exposes a fixed set of internal, named hooks (e.g.
+  `boot-md`, which runs `BOOT.md` on gateway restart) — there is no general
+  event->shell-command registration surface an agents-cli `hooks.yaml`
+  manifest could target — so `capabilities.hooks` and `supportsHooks` now read
+  `false`, matching what the CLI can actually do. A new completeness test
+  (`hooks-capability-completeness.test.ts`) pins every `hooks: true` agent to a
+  real branch in `registerHooksToSettings` so a capability flip can never ship
+  again without a registrar behind it. Source: `apps/cli/src/lib/agents.ts`,
+  `apps/cli/src/lib/hooks-capability-completeness.test.ts`.
+
+- **`agents browser stream` keeps one Node process and browser-daemon IPC socket warm across repeated actions (RUSH-2149).** The newline-delimited JSON interface sends every request through the existing browser daemon and its cached CDP connection, so screenshot/click loops no longer need a fresh `agents` process or IPC connection per action. `--task` (or `AGENTS_BROWSER_TASK`) supplies the default task, a `start` response becomes the default for later lines, and malformed input returns an error response without ending the stream. Fleet-remote `start` requests enforce the same device-local `browser remote-control` consent gate as the ordinary command. Source: `apps/cli/src/lib/browser/ipc.ts`, `apps/cli/src/lib/browser/stream.ts`, `apps/cli/src/commands/browser.ts`.
+
+- **`agents sessions backfill tools` reads a growing transcript incrementally, and
+  the search index compacts itself (RUSH-2208).** Incremental discovery already
+  appended tool calls for a Claude/Codex session that grew; the backfill did not.
+  Every `ensureToolIndex` pass re-read the transcript from byte 0 and deleted the
+  session's stored evidence to rewrite it, so a session backfilled N times cost N
+  full parses of an ever-larger file — measured on a 4.5 MiB, 4000-call transcript
+  that grew by 20 calls: 344 ms and 4020 calls re-parsed, now 12 ms and 20 calls.
+  Schema v36 adds a resume point to `tool_scan_ledger` (`parsed_offset`, the byte
+  just past the last complete record consumed, and `parser_state`, the collector
+  snapshot at that offset), so a transcript that only grew is read from where the
+  last pass stopped and merged into what is already stored; the batch byte budget
+  now counts the bytes a pass actually reads rather than the file's size, so one
+  bounded batch covers far more growing sessions. A different extractor version, a
+  mismatched ledger path, a file shorter than what was parsed, or an unreadable
+  snapshot still re-reads the whole file. Two related fixes ride along:
+  `tool_call_text` rows are addressed by the `rowid` of the call they describe
+  instead of the UNINDEXED `call_key`, which made every delete a full scan of the
+  FTS index, and the scan path now runs a bounded, threshold-gated FTS `'merge'`
+  after each batch of writes, so index health no longer depends on someone running
+  `agents sessions optimize` by hand. Source: `apps/cli/src/lib/session/tool-index.ts`,
+  `apps/cli/src/lib/session/tool-store.ts`, `apps/cli/src/lib/session/db.ts`.
+
+- **OpenCode session scans re-index only the sessions that changed (RUSH-2210).** OpenCode
+  keeps every session in one shared `opencode.db`, and the scanner stamped each session
+  with that whole file's mtime/size. Any write to any session therefore invalidated every
+  indexed session, so a single new turn re-emitted up to 1000 sessions — and the indexer
+  re-opened `opencode.db` once per re-emitted session to re-parse a transcript that had
+  not moved. Each session is now stamped with its own newest write time (across its
+  `session` row, its messages, and its parts) and the byte length of its message + part
+  payloads, so an unchanged session is skipped; the file-level stat stays only as the
+  cheap "nothing changed at all" short-circuit, and a scan opens `opencode.db` once
+  instead of once per session. The stamp deliberately does not rely on
+  `session.time_updated` alone, which real databases leave hours behind the session's
+  newest part. A side effect: `sessions.file_size` for an OpenCode row is now that
+  session's payload size instead of the whole database's size, so the tool-backfill byte
+  budget and its 16 MiB in-memory parser cap finally reflect the real cost of parsing
+  that one session. Source: `apps/cli/src/lib/session/discover.ts`.
+
+- **Session query hot path is indexable again (RUSH-2211).** The default `agents
+  sessions` listing sort (`ORDER BY IFNULL(last_activity, timestamp) DESC`)
+  wrapped the sort column in `IFNULL()`, which defeats `idx_sessions_last_activity`
+  and forces a full table sort on every list/resume query; a new migration
+  backfills `last_activity` so it's unconditionally `NOT NULL` and the sort now
+  runs on the bare column (`EXPLAIN QUERY PLAN` confirms `USING INDEX
+  idx_sessions_last_activity`). The post-query existence check now batches
+  `fs.existsSync` per directory instead of one stat syscall per row — real
+  transcript trees put many sessions in one project directory, so this collapses
+  thousands of stats into a handful of `readdirSync` calls with the same result.
+  Interactive label search (`ftsSearch`) no longer runs a leading-wildcard
+  `LOWER(label) LIKE '%q%'` scan of the whole `sessions` table on every keystroke;
+  it now queries the already-indexed FTS5 `label` column. Source:
+  `apps/cli/src/lib/session/db.ts`.
+
+- **The standalone `browser` binary now routes `--host`/`--device` (RUSH-2214).** `browser start --host <box>` dispatches to the remote over SSH, exactly like `agents browser start --host <box>` already did — previously the standalone bin dropped the flag with `unknown option '--host'` because it never entered the top-level router. A self-named or absent host still runs locally. Source: `apps/cli/src/browser.ts`, `apps/cli/src/lib/hosts/passthrough.ts`.
+
+- **`agents run --device` no longer reports a host as unreachable when the SSH probe times out (RUSH-2249).** The ready probe (`readyProbe` in `hosts/ready.ts`) now disables SSH multiplexing so a stale control socket cannot hang the local client, and it checks `r.timedOut` before parsing stdout — a slow login shell (nvm/sdkman init, cold node startup) producing an empty stdout was silently treated as "not reachable". A timeout now surfaces a distinct, actionable error that names the cause and suggests `agents ssh <host> agents view` to confirm manually, rather than the misleading "not reachable over SSH" message. Source: `apps/cli/src/lib/hosts/ready.ts`.
+
+- **`agents teams start` nudges the operator toward feed milestones (RUSH-2250).**
+  After launching teammates, `teams start` now prints a one-line tip — teammates are
+  briefed to post IMPORTANT milestones to the feed (watch them with
+  `agents feed timeline`), and team progress is watched with `agents teams status
+  <team>`. Print-only in both the single-wave and `--watch` paths (suppressed under
+  `--json`); no engine behavior changes. Pairs with the `.agents-system` guidance
+  that instructs teammates to post those milestones. Source:
+  `apps/cli/src/commands/teams.ts`.
+
+- **`secrets list` no longer skips every biometry-ACL'd item, so `hold`/`always`-policy
+  bundles are readable again (RUSH-2251).** A regression first shipped in v1.22.10 added
+  `kSecUseAuthenticationUI: kSecUseAuthenticationUISkip` to the keychain helper's `list`
+  data-protection pass. `UISkip` makes `SecItemCopyMatching` silently omit every item
+  protected by a biometry access control — which is exactly the value items `set` writes —
+  so enumeration returned only the no-ACL metadata and `never`-policy items. Every consumer
+  that builds its keychain read set from that enumeration (`secrets exec`/`get`/`unlock`/
+  `view --reveal`/`export`, `agents run --secrets`, `ssh`, `browser`, `share`) then reported
+  the real secrets as `stored item '…' not found`, and `unlock` could not even warm the
+  broker to work around it. The DP pass is now attributes-only with **no** `kSecUseAuthenticationUI`
+  key: `kSecReturnAttributes` without `kSecReturnData` never evaluates the ACL, so it
+  neither prompts for Touch ID nor filters the ACL'd items out — restoring the design the
+  code comment already described. The RUSH-2233 timeout bound on that pass is unchanged.
+  Source: `apps/cli/src/lib/secrets/keychain-helper.swift`.
+
+- **Hook-cache background refresh recovers from an orphaned single-flight lock (RUSH-2259).**
+  The stale-while-revalidate lock (`<cache>.bg.lck`) was only released by the
+  background refresh's `EXIT` trap, so a hard kill (SIGKILL, OOM, reboot) that
+  skipped the trap orphaned the dir and every future refresh's `mkdir` failed —
+  permanently stalling background refresh while stale cache was served forever.
+  The shim now reclaims a lock older than a 5-minute TTL before acquiring, so a
+  dead lock self-heals on the next fire. Source: `apps/cli/src/lib/hooks/cache.ts`.
+
+- **`agents doctor` now fails loud when this box cannot reach the owner-delivery lane (RUSH-2262).** The feed/notify owner lane (`agents notify`, `agents feed post --level important` / `--blocked`) delivers over the rush-backed owner channel (iMessage), which only works from a context that has `rush` on PATH and can read its keychain-bound session — so a headless Linux fleet box (no rush) or a non-GUI SSH session on a mac (login keychain locked) silently could not escalate a blocked agent, surfacing only as an after-the-fact `owner failed: …` line. `agents doctor` had no signal for it. A new critical finding, `owner-sink-unreachable`, probes the same transport from the same context doctor runs in (`which rush` + `rush whoami`, never `~/.rush/user.yaml`, since the token is a keychain item) and reports `owner → unreachable: rush CLI not on this box's PATH` / `rush has no usable session here` with the fix. It fires only when owner delivery is configured for the fleet, so an un-opted-in box is never flagged; `agents notify --dry-run` is not this check (it short-circuits before the `which rush` preflight and reports success even where rush is absent). Source: `apps/cli/src/lib/channels/owner-sink.ts`, `apps/cli/src/lib/devices/doctor-findings.ts`, `apps/cli/src/commands/doctor.ts`.
+
+- **`agents insights` owns counter mix; `agents trends` is a deprecated alias.** The
+  former top-level `trends` tree (harness/model mix, tools-per-session, token ratios,
+  secrets/browser recipes, raw usage query) now lives under `agents insights mix` and
+  `agents insights <recipe>` / `query` / `recipes`. Bare `agents insights` remains the
+  behavioural report (transcript content, account split). `agents trends` still works
+  but prints one deprecation line and runs the same mix tree — no second implementation.
+  **Why:** two peer "analytics" verbs (`insights` + `trends`) taught agents and humans
+  to guess; one verb, two engines (content vs counters). Latency stays on `agents perf`;
+  quota on `agents usage`; skill/slash popularity on `agents sessions stats`. Source:
+  `apps/cli/src/lib/analytics/mix-commands.ts`, `commands/insights.ts`,
+  `commands/trends.ts`, `docs/06-observability.md`.
+
+- **The keychain reaper no longer kills the auto-lock-on-sleep watcher (RUSH-2232 follow-up).**
+  The reaper (shipped in 1.22.23) classified a process as a reap target purely by the
+  helper binary path, which also matches the broker's deliberately long-lived
+  `watch-lock` watcher — a healthy child of the live daemon that wipes the in-memory
+  secret store on sleep. Its class-(b) rule ("helper child of a live parent, older than
+  90s") therefore killed the watcher on its second sweep (~10 min after the daemon
+  started hosting the broker), silently disabling auto-lock-on-sleep. Reap-eligibility
+  now matches the full command line and excludes the `watch-lock` verb, so only the
+  short-lived keychain reads/writes a wedged `coreauthd` can hang are ever reaped.
+  Source: `apps/cli/src/lib/secrets/reaper.ts` (`isReapableHelperCommand`).
+
 ## 1.22.25
 
 ---
@@ -168,6 +341,16 @@ Add Cursor Cloud Agents as a native cloud provider so `agents run cursor --cloud
 
 - **`agents run --lease` now shares one warm pool across repositories by default (RUSH-2225).** Repo sandbox/CI `profile:` labels no longer split lease reuse into one idle box per repo; a dedicated lease pool is explicit with `.crabbox.yaml` `leaseProfile:`. An empty pool keeps its newly warmed box for later callers. Concurrent runs attach with crabbox `--reclaim` and launch with separate working trees, agent homes, and credential files, so callers share compute without clobbering run state. Switching repos re-syncs the checkout, trading cache latency for lower idle-compute cost. Source: `apps/cli/src/lib/crabbox/config.ts`, `apps/cli/src/lib/crabbox/lease.ts`, `apps/cli/src/commands/exec.ts`.
 
+- **`agents sessions insights` turns multi-harness session history into an action list
+  (RUSH-2280).** The existing `agents insights` command is now also nested under the
+  sessions noun, accepts repeatable `--agent` filters, and reports deterministic offline
+  friction/thrash, owner corrections, automatable repeats, harness split, and ranked
+  rule/skill/automation/product actions with evidence counts and shortened sample session
+  ids. `/sessions-insights` is a thin agent entry over the same CLI implementation;
+  `--narrative` remains opt-in and receives aggregate data only. Source:
+  `apps/cli/src/commands/insights.ts`, `apps/cli/src/lib/session/insights.ts`,
+  `.agents/commands/sessions-insights.md`.
+
 - **`agents sessions focus` recovers dead panes and shares the sessions browser's selectors (GH-2108).** A retained tmux `remain-on-exit` pane is probed through `#{pane_dead}` immediately before attach, so dead or missing panes no longer open a `Pane is dead` screen. `focus` accepts session ids, topic/path searches, `agent@version` selectors (including per-device `latest`/`oldest`), device, project/time, team/routine, skill/plugin, favorites, and the complete live-state union. Focus, resume, attach, and `run --resume` now use one recovery decision on the origin device: a healthy exact origin performs native resume; otherwise balanced selection chooses a healthy version of the same harness and sends `/continue <id>` to read the indexed transcript, including transcripts retained under version trash. Host-dispatched rows persist the dispatch host as their origin, and `attach` routes its detach-record cleanup there before resuming. No usable same-harness version fails with the device, origin version, and account-health reason. Source: `apps/cli/src/commands/focus.ts`, `apps/cli/src/commands/sessions-browser.ts`, `apps/cli/src/lib/session/recovery.ts`.
 
 - **`agents secrets setup` no longer tells you to set `AGENTS_SECRETS_PASSPHRASE`, and

package/README.md

@@ -45,11 +45,12 @@ https://agents-cli.sh/demo.mp4
 
 ```bash
 npm install -g @phnx-labs/agents-cli   # or: curl -fsSL agi-cli.sh | sh
-agents setup                           # first-time setup -- config + pick your agents
+agents setup                           # first-time setup, or re-open the capability hub
+agents setup status                    # readiness for browser, computer, fleet, and more
 agents run claude "explain this repo"  # run any agent on your existing subscription
 ```
 
-`agents setup` is interactive and idempotent -- safe to re-run on a new machine. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
+`agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
 
 Already installed? `agents upgrade` updates agents-cli itself to the latest version (`agents upgrade 1.2.3` for a specific version or dist-tag, `-y` to skip the confirm prompt). The command is `upgrade` on every platform -- there is no `agents update` (on macOS, `agents helper update` is a different command that reinstalls the keychain helper, not agents-cli).
 
@@ -295,8 +296,16 @@ agents sessions backfill tools --fleet
 agents sessions stats
 agents sessions stats --zero            # only the never-invoked (dead weight)
 agents sessions backfill resources      # fold historical sessions into the usage index
+
+# Friction, owner corrections, repeated recipes, and ranked actions across harnesses
+agents sessions insights --since 30d
+agents sessions insights --agent claude --agent codex --json
+# Top-level alias
+agents insights --since 7d
 ```
 
+`sessions insights` is deterministic and offline by default. It caches per-session facets, compares harnesses, and emits an actions table with evidence counts plus shortened sample session ids. `--narrative` is opt-in and receives aggregates only, never raw transcripts. The installed `/sessions-insights` slash command invokes the same CLI source of truth.
+
 Interactive picker when you're in a terminal. Structured output (`--json`, `--markdown`, filtered by role or turn count) when piped.
 
 Backed by a SQLite + FTS5 index at `~/.agents/.history/sessions/sessions.db` with incremental scanning -- warm reads in ~100ms. Tool-call evidence is redacted and bounded before it is cached; repeated `--query` clauses must match distinct calls in one session. Tool queries read SQLite only: `agents sessions backfill tools` performs the one-time historical parse, while normal incremental scans index new and changed sessions. The index stores ordered static Bash program sites, so `--count` reports occurrences, containing tool calls, and distinct sessions without reparsing. `--fleet` executes one origin partition per device, so synced mirrors cannot duplicate compact evidence or counts returned over SSH; transcript bodies stay on their origin machine. This uses relational SQLite rows and literal FTS5 only, with no embeddings, vector database, or model calls. External tools can consume `--json` output as a programmatic observability layer; see [docs/05-sessions.md](apps/cli/docs/05-sessions.md) for the schemas and [docs/06-observability.md](apps/cli/docs/06-observability.md) for the consumption patterns.
@@ -820,6 +829,12 @@ agents browser done                  # Close task's tabs when finished
 
 # Need to address a different task in the same shell? Override per call:
 agents browser screenshot --task other-flow
+
+# Repeated observe/action loops: one Node process and daemon socket stay warm.
+printf '%s\n' \
+  '{"action":"screenshot","path":"/tmp/page.jpg"}' \
+  '{"action":"click","atX":320,"atY":540}' \
+  | agents browser stream --task "$AGENTS_BROWSER_TASK"
 ```
 
 ### Why this works where Playwright fails

package/dist/browser.js

@@ -1,7 +1,17 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import { registerBrowserSubcommands } from './commands/browser.js';
-const program = new Command();
-program.name('browser').description('Browser automation via CDP');
-registerBrowserSubcommands(program);
-program.parse();
+import { maybeRunStandaloneOnHost } from './lib/hosts/passthrough.js';
+async function main() {
+    // `browser … --host <box>` routes to a remote over SSH, exactly like
+    // `agents browser … --host <box>` does through index.ts. Standalone-only:
+    // this binary never enters index.ts, so without this the flag was dropped.
+    if (await maybeRunStandaloneOnHost('browser')) {
+        process.exit(process.exitCode ?? 0);
+    }
+    const program = new Command();
+    program.name('browser').description('Browser automation via CDP');
+    registerBrowserSubcommands(program);
+    program.parse();
+}
+void main();

package/dist/commands/apply.js

@@ -15,6 +15,7 @@ import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
+import { isHostPinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired } from '../lib/fleet/manifest.js';
 import { snapshotAuth, materializeAuth, parseAuthBundle, KEYCHAIN_BOUND_ON_MAC, isCredentialSafeToPropagate } from '../lib/fleet/auth-sync.js';
@@ -82,7 +83,10 @@ function renderPlan(plan) {
         }
         return chalk.cyan('↑ ' + acts.map((a) => a.agent ?? a.kind.replace('-cli', '')).join(','));
     };
-    const header = `  ${'device'.padEnd(nameWidth)}   ${'agents-cli'.padEnd(12)}${'agents'.padEnd(20)}${'config'.padEnd(10)}login`;
+    // Only show the secrets column when the manifest declares any — an all-`-`
+    // column on every fleet that uses no bundles is noise.
+    const anySecrets = rows.some((r) => r.actions.some((a) => a.kind === 'push-secret' || a.kind === 'needs-secret'));
+    const header = `  ${'device'.padEnd(nameWidth)}   ${'agents-cli'.padEnd(12)}${'agents'.padEnd(20)}${'config'.padEnd(10)}${anySecrets ? 'login'.padEnd(18) + 'secrets' : 'login'}`;
     console.log(chalk.gray(header));
     for (const row of rows) {
         const cli = row.probe.reachable
@@ -100,10 +104,33 @@ function renderPlan(plan) {
             ? (row.actions.some((a) => a.kind === 'sync-config') ? chalk.cyan('↑ sync') : chalk.green('ok'))
             : chalk.gray('-');
         const loginCell = cell(row, ['push-login', 'needs-login'], `${row.desired.agents.length}/${row.desired.agents.length}`);
-        console.log(`  ${row.device.padEnd(nameWidth)}   ${stripPad(cli, 12)}${stripPad(agentsCell, 20)}${stripPad(configCell, 10)}${loginCell}`);
+        const secretsCell = (() => {
+            if (!anySecrets)
+                return '';
+            if (!row.probe.reachable)
+                return chalk.gray('- offline');
+            const push = row.actions.filter((a) => a.kind === 'push-secret').length;
+            const blocked = row.actions.filter((a) => a.kind === 'needs-secret').length;
+            if (push === 0 && blocked === 0)
+                return chalk.green('ok');
+            if (push > 0 && blocked === 0)
+                return chalk.cyan(`↑ push ${push}`);
+            if (push === 0)
+                return chalk.yellow(`blocked ${blocked}`);
+            return chalk.yellow(`↑ push ${push} · blocked ${blocked}`);
+        })();
+        const loginPart = anySecrets ? stripPad(loginCell, 18) + secretsCell : loginCell;
+        console.log(`  ${row.device.padEnd(nameWidth)}   ${stripPad(cli, 12)}${stripPad(agentsCell, 20)}${stripPad(configCell, 10)}${loginPart}`);
     }
     console.log();
     console.log(chalk.gray(`  ${plan.actions.length} action(s) across ${rows.filter((r) => r.probe.reachable).length} reachable device(s)`));
+    // The capability is opt-in, so when it is OFF and the manifest declares
+    // bundles, say that it exists. Otherwise an operator reads "manual recreate"
+    // and concludes there is no supported path — which is exactly the conclusion
+    // that led to a master key being hand-exported across the fleet (RUSH-1968).
+    if (anySecrets && !rows.some((r) => r.actions.some((a) => a.kind === 'push-secret'))) {
+        console.log(chalk.gray('  secrets: not pushed. `--provision-secrets` pushes declared bundles to devices whose host key is pinned.'));
+    }
     // Distinguish *why* a login can't be propagated: macOS keychain-bound,
     // single-use rotating refresh token (never copied), or the source simply not
     // being signed in to that agent (no portable file).
@@ -130,14 +157,15 @@ function renderPlan(plan) {
     if (noToken.length > 0) {
         console.log(chalk.yellow(`  manual login needed (no portable token on source): ${noToken.join(', ')}`));
     }
-    // Secrets bundles are declared once for the fleet; surface the distinct set to
-    // recreate on any device missing them (values are keychain-local, never pushed).
+    // Secrets bundles are declared once for the fleet; surface the distinct set the
+    // gate did NOT push, so a refusal is never silent. "never pushed" used to be
+    // literally true here and no longer is — `--provision-secrets` pushes them.
     const bundles = [...new Set(rows.flatMap((r) => r.secretsNeeded))];
     if (bundles.length > 0) {
         const shown = bundles.slice(0, 12);
         const more = bundles.length - shown.length;
         const list = shown.join(', ') + (more > 0 ? `, +${more} more` : '');
-        console.log(chalk.yellow(`  ${bundles.length} secrets bundle(s) to recreate where missing (keychain-local, never pushed): ${list}`));
+        console.log(chalk.yellow(`  ${bundles.length} secrets bundle(s) not pushed — recreate where missing: ${list}`));
     }
 }
 /** padEnd on the visible width, ignoring chalk color codes. Exported for tests. */
@@ -218,11 +246,24 @@ async function runApply(opts) {
     // Probe every target device in parallel.
     const nameToProfile = new Map(desired.map((d) => [d.device, registry[d.device]]));
     const withVersions = rosterNeedsVersions(desired);
+    // One extra `secrets list --json` per device, and only when it can change the
+    // plan: the manifest declares bundles AND provisioning is on. Same cost
+    // discipline as `withVersions` — a fleet that uses no bundles never pays it.
+    const withSecrets = opts.provisionSecrets === true && (manifest.secrets?.bundles?.length ?? 0) > 0;
     console.log(chalk.gray(`Probing ${desired.length} device(s)…`));
-    const probeList = await pool(desired, 6, async (d) => probeDevice(nameToProfile.get(d.device), { withVersions }));
+    const probeList = await pool(desired, 6, async (d) => probeDevice(nameToProfile.get(d.device), { withVersions, withSecrets }));
     const probes = new Map(probeList.map((p) => [p.device, p]));
     const targetCliVersion = localCliVersion();
-    let plan = diffFleet(desired, probes, { targetCliVersion, sourceAuth, secretsBundles: manifest.secrets?.bundles });
+    let plan = diffFleet(desired, probes, {
+        targetCliVersion,
+        sourceAuth,
+        secretsBundles: manifest.secrets?.bundles,
+        provisionSecrets: opts.provisionSecrets === true,
+        forceSecrets: opts.force === true,
+        // Same bar as `exec --copy-creds` (EXEC-34): credential values only ever go
+        // to a host whose key we already pinned.
+        isHostPinned: (device) => isHostPinned(device, managedKnownHostsPath()),
+    });
     // --only filter.
     if (opts.only) {
         const keep = new Set();
@@ -242,7 +283,8 @@ async function runApply(opts) {
         return;
     // `needs-login`/`needs-secret` are surfaced manual reminders, not executable
     // mutations — exclude them so an otherwise-converged fleet still says "nothing
-    // to do" instead of looping forever on un-actionable surfacing.
+    // to do" instead of looping forever on un-actionable surfacing. `push-secret`
+    // IS executable and deliberately stays counted.
     if (plan.actions.filter((a) => a.kind !== 'needs-login' && a.kind !== 'needs-secret').length === 0) {
         console.log(chalk.green('\nNothing to do — fleet already matches the profile.'));
         return;
@@ -301,6 +343,8 @@ export function configureApplyCommand(cmd) {
         .option('--agent <specs...>', 'Override the roster for targeted device(s): install these specs instead of the manifest\'s. Use `claude@all` to replicate every version installed on this machine.')
         .option('--only <dims>', 'Limit to dimensions: comma list of agents,config,login')
         .option('--no-login', 'Do not propagate logins')
+        .option('--provision-secrets', "Push the manifest's declared secrets bundles to each device (OFF by default; moves credential values over SSH, and only to a device whose host key is already pinned)")
+        .option('--force', 'With --provision-secrets: re-push a bundle the device already has')
         .addOption(new Option('--recv-auth', 'internal: receive an auth bundle on stdin').hideHelp())
         .action(async (opts) => {
         try {

package/dist/commands/browser.js

@@ -20,6 +20,7 @@ import { isInteractiveTerminal } from './utils.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
 import { buildHar } from '../lib/browser/har.js';
 import { getCliVersion } from '../lib/version.js';
+import { runBrowserIPCStream } from '../lib/browser/stream.js';
 /**
  * Resolve which browser task a command targets. Order:
  *   1. `--task <name>` flag (explicit per-command override)
@@ -48,6 +49,7 @@ const TASK_OPTION_DESC = 'Task name (defaults to $AGENTS_BROWSER_TASK)';
 // trailing "Other commands" section automatically.
 const BROWSER_HELP_GROUPS = [
     { title: 'Session lifecycle', names: ['start', 'done', 'status'] },
+    { title: 'Fast action loop', names: ['stream'] },
     {
         title: 'Drive the page',
         names: ['navigate', 'tabs', 'screenshot', 'evaluate', 'click', 'type', 'press', 'wait'],
@@ -79,6 +81,9 @@ export function registerBrowserCommand(program) {
       agents browser navigate https://example.com
       agents browser screenshot
 
+      # Keep one process and daemon socket warm for repeated actions
+      agents browser stream --task "$AGENTS_BROWSER_TASK"
+
       # Drive another machine's browser (needs its consent — see remote-control)
       agents browser start --host zion
 
@@ -654,6 +659,36 @@ function registerTaskCommands(browser) {
             ? 'Other fleet machines can now drive this browser via `browser --host <this-device>`.'
             : 'Cross-machine `browser --host` drives to this machine are refused.');
     });
+    const stream = browser
+        .command('stream')
+        .description('Keep one process and daemon IPC socket open; read NDJSON requests from stdin and write NDJSON responses')
+        .option(TASK_OPTION_FLAG, 'Default task for requests that omit `task` (defaults to $AGENTS_BROWSER_TASK)')
+        .action(async (opts) => {
+        await runBrowserIPCStream({
+            input: process.stdin,
+            output: process.stdout,
+            task: opts.task ?? process.env.AGENTS_BROWSER_TASK,
+            actor: resolveActor().id,
+            launchId: process.env.AGENT_LAUNCH_ID,
+        });
+    });
+    setHelpSections(stream, {
+        examples: `
+      # Batch two warm actions through one process and one daemon connection
+      printf '%s\\n' \\
+        '{"action":"screenshot","path":"/tmp/page.jpg"}' \\
+        '{"action":"click","atX":320,"atY":540}' \\
+        | agents browser stream --task "$AGENTS_BROWSER_TASK"
+
+      # Keep the command open and send one JSON object per line from a long-lived shell
+      agents browser stream --task "$AGENTS_BROWSER_TASK"
+    `,
+        notes: `
+      stdout is protocol-only: one compact JSON response for each non-empty input line.
+      Malformed JSON returns an error response without closing the stream.
+      The first start response becomes the default task for later lines in the same stream.
+    `,
+    });
     browser
         .command('start')
         .description('Start a browser task. Pass --profile <name>; omit to use your configured default (`agents browser profiles set-default`), else auto-pick an installed Chromium-family browser.')

package/dist/commands/doctor.js

@@ -26,6 +26,8 @@ import { checkVersionHookWiring, inspectDuplicateVersionHooks, registerHooksToSe
 import { isVersionIsolated } from '../lib/versions.js';
 import { computeDrift, checkSyncStatus, countOrphans, computeSourceBehind } from '../lib/drift.js';
 import { readAuthHealthCache, summarizeHostAuth } from '../lib/auth-health.js';
+import { readMeta } from '../lib/state.js';
+import { probeOwnerSink } from '../lib/channels/owner-sink.js';
 import { unifiedDiff, colorizeUnifiedDiff } from '../lib/diff-text.js';
 import { listCliStatus, listCliStatusAsync } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
@@ -405,6 +407,9 @@ async function runDevicesDoctor(opts) {
                 isolatedVersions: localReports
                     .filter((rep) => isVersionIsolated(rep.agent, rep.version))
                     .map((rep) => `${rep.agent}@${rep.version}`),
+                // Can the owner-delivery lane escalate a block from THIS box? Local only —
+                // remote boxes self-report it in their own `agents doctor --json`.
+                ownerSink: await probeOwnerSink(readMeta()),
             }));
             accounts[localName] = r.inventory?.signIn ?? {};
             continue;
@@ -1486,6 +1491,9 @@ export function registerDoctorCommand(program) {
                     ? { platform: process.platform, policy: getEffectiveExecutionPolicy() }
                     : undefined,
                 isolatedVersions,
+                // Can the owner-delivery lane (feed/notify) escalate a block from this
+                // box? A factory that cannot escalate is not healthy (RUSH-2262).
+                ownerSink: await probeOwnerSink(readMeta()),
             });
             if (opts.json) {
                 const overviewPayload = {

package/dist/commands/insights.d.ts

@@ -1,23 +1,26 @@
 /**
- * Insights command — how you actually work, split by the account that did the work.
- *
- * The behavioural sibling of the existing rollups, and deliberately not a duplicate of
- * any of them:
- *
- *   agents cost      what you spent            ($ and duration)
- *   agents output    what shipped              (burn vs PRs and commits)
- *   agents usage     live quota headroom       (rate-limit windows, right now)
- *   agents trends    aggregate distributions   (harness mix, tools-per-session, token ratios)
- *   agents sessions  browse individual work    (search, resume, render)
- *   agents insights  HOW you work              (tools, friction, rhythm, per account)
- *
- * The closest neighbour is `agents trends`, and the boundary is the data path: trends
- * reads counters — `tool_scan_ledger` call counts and the analytics warehouse — to
- * produce distributions ("how many tool calls per session, by harness"). This reads
- * transcript CONTENT through `parseSession` to produce behaviour ("which tools, which
- * languages, where it went wrong, when you were working"), and splits all of it by
- * account, a dimension trends does not have. They overlap in spirit on tool and model
- * mix; they do not read the same store or answer the same question.
+ * Insights command — one observe verb for "how work looks".
+ *
+ * Two data paths under one name (do not re-split into peer top-level commands):
+ *
+ *   agents insights              HOW you work (transcript content: tools, friction,
+ *                                rhythm, edits) — split by Claude account by default
+ *   agents insights mix          COUNTERS (sessions index + usage.db recipes:
+ *                                harness/model mix, token ratios, secrets, browser)
+ *   agents insights <recipe>     One baked mix recipe (harness-mix, tools-per-session, …)
+ *   agents insights query        Raw usage.db rows
+ *
+ * Sibling observe verbs (stay separate — different questions):
+ *
+ *   agents cost       what you spent ($ and duration)
+ *   agents output     what shipped (burn vs PRs and commits)
+ *   agents usage      live quota headroom
+ *   agents perf       latency (hooks, CLI commands, agent.run) — not popularity
+ *   agents sessions stats  which skills/slash-commands were explicitly invoked
+ *
+ * Why mix lives here (not a second top-level `trends`): two abstract "analytics"
+ * nouns taught agents and humans to guess. One verb, two engines — cheap SQL mix
+ * vs transcript facets. Latency stays on `perf` so it is never confused with mix.
  *
  * Modelled on Claude Code's `/insights`, with the difference that motivated it: that
  * command reads one account's directory, while `balanced` rotation sprays sessions
@@ -27,6 +30,9 @@
  * The deterministic report makes zero network calls. `--narrative` is opt-in and adds
  * the coaching prose by piping the AGGREGATE (never raw transcripts) through a headless
  * `claude -p`.
+ *
+ * `agents trends` is a thin deprecated alias of the mix tree only (see commands/trends.ts).
  */
 import type { Command } from 'commander';
 export declare function registerInsightsCommand(program: Command): void;
+export declare function registerSessionsInsightsCommand(sessions: Command): void;