@phnx-labs/agents-cli 1.22.25 → 1.22.27

package/dist/lib/devices/doctor-findings.js

@@ -18,7 +18,8 @@
  * with. Keep this list exhaustive; a kind missing from it is a doc that lies.
  *   CRITICAL — logged-out (provable) · missing-hook · missing-plugin ·
  *              unwired-hook (a hook on disk that settings.json never fires) ·
- *              cli-missing.
+ *              cli-missing · ssh-key-enrollment · owner-sink-unreachable (the feed/notify owner lane
+ *              cannot reach the owner from this box).
  *   WARNING  — logout-unprovable (hedged) · missing-resource · content-drift ·
  *              never-synced · stale · repo-behind · repo-drift · version-skew ·
  *              fleet-resource-gap · orphan · duplicate-hook ·
@@ -39,6 +40,7 @@ import { blocksLocalScripts } from '../platform/winpath.js';
 import { loginHint } from '../signin-badge.js';
 import { CONFIG_ENV_ISOLATED_AGENTS } from '../shims.js';
 import { padToWidth, stringWidth } from '../session/width.js';
+import { windowsSshEnrollmentProblem } from './windows-ssh-enrollment.js';
 const AGENT_NAMES = Object.fromEntries(ALL_AGENT_IDS.map((id) => [id, AGENTS[id].name]));
 /** Agents with NO per-version credential isolation: their login is shared across
  *  every installed version, so a "log into THIS version" remediation would be a
@@ -96,7 +98,9 @@ export const ALL_FINDING_KINDS = [
     'rc-secret-export', // credential-shaped export in a shell rc file
     'env-secret-export', // the file-store master key live in THIS process's env
     'exec-policy', // Windows execution policy blocks agents.ps1
+    'ssh-key-enrollment', // Windows OpenSSH public-key path/content/ACL is invalid
     'stale-cli',
+    'owner-sink-unreachable', // the feed/notify owner-delivery lane can't reach the owner from this box
 ];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
@@ -116,6 +120,9 @@ export const FINDING_SEVERITY = {
     'missing-plugin': 'critical',
     'unwired-hook': 'critical',
     'cli-missing': 'critical',
+    // A factory that cannot escalate a blocked agent to the owner is not healthy,
+    // and the failure is otherwise silent until a block is filed (RUSH-2262/2258).
+    'owner-sink-unreachable': 'critical',
     // Everything else is resolvable by a routine sync/cleanup and does not block
     // the harness right now. RUSH-2162 moved never-synced and duplicate-hook-drift
     // here: both are stale-sync states that one `agents sync` resolves.
@@ -136,6 +143,7 @@ export const FINDING_SEVERITY = {
     'rc-secret-export': 'warning',
     'env-secret-export': 'warning',
     'exec-policy': 'warning',
+    'ssh-key-enrollment': 'critical',
     'stale-cli': 'warning',
 };
 function agentName(agent) {
@@ -249,8 +257,17 @@ export function remediationFor(finding) {
             return 'unset at the source, then restart every process that inherited it (shells, editor, tmux, agents daemon)';
         case 'exec-policy':
             return 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned';
+        case 'ssh-key-enrollment':
+            return 'repair the reported AuthorizedKeysFile, then rerun agents doctor';
         case 'stale-cli':
             return 'upgrade';
+        case 'owner-sink-unreachable':
+            // The lane delivers over the rush-backed owner channel, which needs rush on
+            // PATH AND a usable session in THIS context. Non-interactive shells miss a
+            // ~/.zshrc export (RUSH-2258), and the session is keychain-bound, not in
+            // ~/.rush/user.yaml (RUSH-2262) — so `rush login` here, or the Rush App for
+            // a GUI keychain, is what makes it reachable.
+            return "put rush on PATH for non-interactive shells (~/.zshenv) and run 'rush login'";
     }
 }
 function finding(f) {
@@ -293,6 +310,22 @@ export function buildLocalFindings(input) {
             message: `${agentName(agent)} binary not found`,
         }));
     }
+    // owner-sink-unreachable — the feed/notify owner-delivery lane can't reach the
+    // owner from this box (RUSH-2262). Only when owner delivery is CONFIGURED for the
+    // fleet; an un-opted-in box is not broken. The message names the concrete reason.
+    const sink = input.ownerSink;
+    if (sink?.configured && !sink.reachable) {
+        const chan = sink.channel ?? 'owner';
+        const why = sink.reason === 'rush-not-on-path'
+            ? `rush CLI not on this box's PATH`
+            : sink.reason === 'rush-signed-out'
+                ? 'rush has no usable session here'
+                : 'transport unreachable';
+        out.push(finding({
+            severity: FINDING_SEVERITY['owner-sink-unreachable'], kind: 'owner-sink-unreachable', device,
+            message: `${chan} → owner unreachable: ${why}`,
+        }));
+    }
     // Per-version resource reports → missing hook/plugin (critical), unwired hook
     // (critical), other missing kinds (warning), content drift (warning).
     for (const report of input.reports) {
@@ -465,6 +498,15 @@ export function buildLocalFindings(input) {
     const policyFinding = execPolicyFinding(device, input.execPolicy);
     if (policyFinding)
         out.push(policyFinding);
+    if (input.windowsSshEnrollment) {
+        const problem = windowsSshEnrollmentProblem(input.windowsSshEnrollment);
+        if (problem) {
+            out.push(finding({
+                severity: FINDING_SEVERITY['ssh-key-enrollment'], kind: 'ssh-key-enrollment', device,
+                message: problem,
+            }));
+        }
+    }
     // Per-version sign-in → logged-out (critical, provable) / logout-unprovable
     // (warning). Signed-in versions produce no finding — the accounts line shows
     // them. Agents that can't be inspected never yield a logout finding.
@@ -782,6 +824,10 @@ function subjectLabel(f) {
     return f.version ? `${f.agent} @${f.version}` : f.agent;
 }
 function critLabel(f) {
+    // Machine-level criticals with no agent get a category subject so the left
+    // column is not blank; the owner-sink row reads `owner  …`, not an empty label.
+    if (f.kind === 'owner-sink-unreachable')
+        return { left: 'owner', account: '', message: f.message };
     return {
         left: subjectLabel(f),
         account: f.account ?? '',

package/dist/lib/devices/harness-inventory.d.ts

@@ -0,0 +1,97 @@
+import type { AgentId } from '../types.js';
+import { type UsageSnapshot } from '../usage.js';
+/** An account's usage headroom rolled into one glanceable summary. */
+export interface QuotaSummary {
+    /**
+     * `available` / `rate_limited` from the live usage windows, or `null` when
+     * there is no snapshot at all (no data yet, or the agent has no usage source).
+     */
+    status: 'available' | 'rate_limited' | null;
+    /** Max utilization across blocking windows (0-100, rounded), or null when unknown. */
+    usedPercent: number | null;
+    /** True when the snapshot is a cached `last_seen`, not a fresh `live` read. */
+    stale: boolean;
+}
+/** One installed (agent, version) on a host, fully resolved. */
+export interface HarnessRow {
+    agent: AgentId;
+    version: string;
+    /** Account display label (email / id), or null when signed out or unidentifiable. */
+    account: string | null;
+    signedIn: boolean;
+    quota: QuotaSummary;
+    /** signed in AND not rate-limited — usable for a run right now. */
+    ready: boolean;
+    /** When `!ready`, a short reason ("signed out" / "rate-limited"). */
+    reason?: string;
+}
+/** One host's rows, or the reason it produced none. */
+export interface HostHarnessResult {
+    host: string;
+    rows: HarnessRow[];
+    /** Set when the host failed to probe (offline / error). */
+    error?: string;
+    /** Set when the host was skipped (control / offline). */
+    skipped?: string;
+}
+/** An account collapsed across the installs on one host that share it. */
+export interface AccountGroup {
+    /** Account display label, or null for the signed-out bucket. */
+    account: string | null;
+    /** Distinct agent ids using this account, sorted. */
+    agents: AgentId[];
+    /** How many (agent, version) installs share this account. */
+    installs: number;
+    /** True when at least one install under this account is signed in. */
+    signedIn: boolean;
+    /** Representative quota — an account maps to one provider identity, so its usage is shared. */
+    quota: QuotaSummary;
+    ready: boolean;
+    reason?: string;
+}
+/**
+ * Roll one usage snapshot into a {@link QuotaSummary}. Mirrors the blocking-window
+ * selection of {@link deriveUsageStatusFromSnapshot} (the model-specific
+ * `sonnet_week` sub-limit is excluded so hitting it doesn't read as a throttled
+ * account) and takes the highest utilization across those windows. Pure.
+ */
+export declare function summarizeQuota(snapshot: UsageSnapshot | null | undefined): QuotaSummary;
+/**
+ * "Ready" = signed in AND not rate-limited. A missing quota snapshot does NOT
+ * block readiness: the account is signed in and usable, we just have no live
+ * utilization to show. Pure.
+ */
+export declare function computeReady(signedIn: boolean, quota: QuotaSummary): {
+    ready: boolean;
+    reason?: string;
+};
+/**
+ * Enumerate every installed (agent, version) on THIS host, resolve account +
+ * sign-in + quota + ready, and return the rows. Signed-out installs are kept
+ * (they are the actionable ones), unlike the auth-health probe which drops
+ * `unconfigured`. Quota is cache-only unless `refresh` is set.
+ */
+export declare function collectLocalHarnessInventory(opts?: {
+    agents?: readonly AgentId[];
+    refresh?: boolean;
+}): Promise<HarnessRow[]>;
+/**
+ * Collapse a host's rows into one {@link AccountGroup} per distinct account (the
+ * signed-out installs fall into the `null` bucket). Because an account label maps
+ * to a single provider identity, every install sharing it shares one quota, so
+ * the group's quota is taken from the first row carrying real data (preferring a
+ * `rate_limited` row so a throttle is never hidden). Pure.
+ */
+export declare function groupByAccount(rows: HarnessRow[]): AccountGroup[];
+/** Short human quota cell: "12%", "limited", or "—" when no data. */
+export declare function formatQuota(quota: QuotaSummary): string;
+/**
+ * Render the device × harness table: one block per device, one row per installed
+ * (agent, version) with account / signed-in / quota / ready. Pure.
+ */
+export declare function renderHarnessMatrix(results: HostHarnessResult[]): string[];
+/**
+ * Render the device × account table: one block per device, one row per distinct
+ * account (installs sharing it collapsed), showing which harnesses use it. Pure.
+ */
+export declare function renderAccountsMatrix(results: HostHarnessResult[]): string[];

package/dist/lib/devices/registry.d.ts

@@ -26,6 +26,8 @@ export interface DeviceAddress {
 /** Authentication settings for a device. */
 export interface DeviceAuth {
     method: DeviceAuthMethod;
+    /** Explicit private-key path passed to OpenSSH for key authentication. */
+    identityFile?: string;
     /** Secrets bundle holding the password (when method === 'password'). */
     bundle?: string;
     /** Key within the bundle whose value is the password. Defaults to 'password'. */

package/dist/lib/devices/ssh-config.js

@@ -15,6 +15,9 @@ function renderHost(device) {
     const lines = [`Host ${device.name}`, `    HostName ${hostName}`];
     if (device.user)
         lines.push(`    User ${device.user}`);
+    if (device.auth.method === 'key' && device.auth.identityFile) {
+        lines.push(`    IdentityFile ${device.auth.identityFile}`, '    IdentitiesOnly yes');
+    }
     return lines.join('\n');
 }
 /**

package/dist/lib/devices/windows-ssh-enrollment.d.ts

@@ -0,0 +1,20 @@
+export interface WindowsSshEnrollment {
+    administrator: boolean;
+    expectedPath: string;
+    configuredPaths: string[];
+    fileExists: boolean;
+    hasPublicKey: boolean;
+    owner: string | null;
+    systemFullControl: boolean;
+    administratorsFullControl: boolean;
+    unexpectedAclPrincipals: string[];
+}
+export type WindowsSshEnrollmentAudit = {
+    status: WindowsSshEnrollment;
+} | {
+    error: string;
+};
+export declare function diagnoseWindowsSshFailure(stderr: string, timedOut: boolean): string;
+export declare function parseWindowsSshEnrollment(stdout: string): WindowsSshEnrollment;
+export declare function auditWindowsSshEnrollment(platform?: NodeJS.Platform): WindowsSshEnrollmentAudit | null;
+export declare function windowsSshEnrollmentProblem(audit: WindowsSshEnrollmentAudit): string | null;

package/dist/lib/devices/windows-ssh-enrollment.js

@@ -0,0 +1,98 @@
+import { spawnSync } from 'child_process';
+export function diagnoseWindowsSshFailure(stderr, timedOut) {
+    if (timedOut || /connection timed out|operation timed out/i.test(stderr)) {
+        return 'Windows SSH unreachable: port 22 did not answer before the timeout';
+    }
+    if (/host key verification failed|remote host identification has changed/i.test(stderr)) {
+        return 'Windows OpenSSH host-key verification failed; verify and re-pin the device host key';
+    }
+    if (/permission denied.*publickey|permission denied \(publickey/i.test(stderr)) {
+        return 'port 22 and OpenSSH are reachable, but the public key was rejected; recover through the Windows console or password-auth profile, then run agents doctor on that box to inspect its effective AuthorizedKeysFile and ACL';
+    }
+    if (/connection refused/i.test(stderr)) {
+        return 'Windows host is reachable but OpenSSH is not listening on port 22';
+    }
+    return stderr.trim() || 'Windows SSH probe failed';
+}
+const AUDIT_SCRIPT = String.raw `
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$administratorSid = 'S-1-5-32-544'
+$administrator = @($identity.Groups | Where-Object { $_.Value -eq $administratorSid }).Count -gt 0
+$expected = if ($administrator) { Join-Path $env:ProgramData 'ssh\administrators_authorized_keys' } else { Join-Path $env:USERPROFILE '.ssh\authorized_keys' }
+$sshd = Join-Path $env:WINDIR 'System32\OpenSSH\sshd.exe'
+$effective = (& $sshd -T -C "user=$env:USERNAME,host=$env:COMPUTERNAME,addr=127.0.0.1" 2>$null | Select-String '^authorizedkeysfile ' | Select-Object -First 1).Line
+$configured = if ($effective) { @($effective.Substring('authorizedkeysfile '.Length).Split(' ', [StringSplitOptions]::RemoveEmptyEntries)) } else { @() }
+$exists = Test-Path -LiteralPath $expected -PathType Leaf
+$acl = if ($exists) { Get-Acl -LiteralPath $expected } else { $null }
+$rules = if ($acl) { @($acl.Access | Where-Object AccessControlType -eq Allow) } else { @() }
+$full = [Security.AccessControl.FileSystemRights]::FullControl
+$system = @($rules | Where-Object { $_.IdentityReference.Value -in @('NT AUTHORITY\SYSTEM', 'S-1-5-18') -and ($_.FileSystemRights -band $full) -eq $full }).Count -gt 0
+$admins = @($rules | Where-Object { $_.IdentityReference.Value -in @('BUILTIN\Administrators', 'S-1-5-32-544') -and ($_.FileSystemRights -band $full) -eq $full }).Count -gt 0
+$allowed = @('NT AUTHORITY\SYSTEM', 'S-1-5-18', 'BUILTIN\Administrators', 'S-1-5-32-544')
+$unexpected = if ($administrator) { @($rules | ForEach-Object { $_.IdentityReference.Value } | Where-Object { $_ -notin $allowed } | Sort-Object -Unique) } else { @() }
+$hasKey = $exists -and [bool](Select-String -LiteralPath $expected -Pattern '^\s*(ssh-(rsa|ed25519)|ecdsa-sha2-)' -Quiet)
+[ordered]@{ administrator=$administrator; expectedPath=$expected; configuredPaths=$configured; fileExists=$exists; hasPublicKey=$hasKey; owner=if($acl){$acl.Owner}else{$null}; systemFullControl=$system; administratorsFullControl=$admins; unexpectedAclPrincipals=$unexpected } | ConvertTo-Json -Compress
+`;
+export function parseWindowsSshEnrollment(stdout) {
+    const raw = JSON.parse(stdout.trim());
+    const strings = (value) => Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : typeof value === 'string' ? [value] : [];
+    if (typeof raw.administrator !== 'boolean' || typeof raw.expectedPath !== 'string') {
+        throw new Error('Windows SSH enrollment audit returned an invalid payload');
+    }
+    return {
+        administrator: raw.administrator,
+        expectedPath: raw.expectedPath,
+        configuredPaths: strings(raw.configuredPaths),
+        fileExists: raw.fileExists === true,
+        hasPublicKey: raw.hasPublicKey === true,
+        owner: typeof raw.owner === 'string' ? raw.owner : null,
+        systemFullControl: raw.systemFullControl === true,
+        administratorsFullControl: raw.administratorsFullControl === true,
+        unexpectedAclPrincipals: strings(raw.unexpectedAclPrincipals),
+    };
+}
+export function auditWindowsSshEnrollment(platform = process.platform) {
+    if (platform !== 'win32')
+        return null;
+    const encoded = Buffer.from(AUDIT_SCRIPT, 'utf16le').toString('base64');
+    const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], {
+        encoding: 'utf8',
+        windowsHide: true,
+        timeout: 10_000,
+    });
+    if (result.status !== 0)
+        return { error: (result.stderr || 'audit command failed').trim() };
+    try {
+        return { status: parseWindowsSshEnrollment(result.stdout) };
+    }
+    catch (error) {
+        return { error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export function windowsSshEnrollmentProblem(audit) {
+    if ('error' in audit)
+        return `Windows OpenSSH enrollment audit failed: ${audit.error}`;
+    const status = audit.status;
+    const normalize = (path) => path.replace(/\//g, '\\').toLowerCase();
+    const expected = normalize(status.expectedPath);
+    const effective = status.configuredPaths.map((path) => normalize(path)
+        .replace('__programdata__', normalize(process.env.ProgramData ?? 'C:\\ProgramData'))
+        .replace(/^\.ssh\\/, `${normalize(process.env.USERPROFILE ?? '')}\\.ssh\\`));
+    if (effective.length > 0 && !effective.includes(expected)) {
+        return `OpenSSH AuthorizedKeysFile resolves to ${status.configuredPaths.join(', ')}, not ${status.expectedPath}`;
+    }
+    if (!status.fileExists)
+        return `SSH public-key file missing: ${status.expectedPath}`;
+    if (!status.hasPublicKey)
+        return `no public key enrolled in ${status.expectedPath}`;
+    if (status.administrator && (!status.systemFullControl || !status.administratorsFullControl)) {
+        return `${status.expectedPath} ACL must grant FullControl to SYSTEM and Administrators`;
+    }
+    if (status.administrator && status.unexpectedAclPrincipals.length > 0) {
+        return `${status.expectedPath} ACL grants access to unexpected principals: ${status.unexpectedAclPrincipals.join(', ')}`;
+    }
+    return null;
+}

package/dist/lib/exec.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/exec.bench.js

@@ -0,0 +1,186 @@
+/**
+ * Benchmark for the agent-execution hot path: env construction (buildExecEnv),
+ * argv assembly (buildExecCommand), and process spawn (execAgent -> spawnAgent).
+ *
+ * No mocking. Runs against this machine's REAL ~/.agents layout — the actual
+ * agents.yaml (state.ts:1124 readMeta), the actual installed version homes
+ * under ~/.agents/.history/versions/<agent>/ (versions.ts:1284
+ * listInstalledVersions), and, for the spawn group, the actual installed
+ * `claude` binary. `process.cwd()` during a real `vitest bench` run is this
+ * package's directory inside whatever checkout invoked it (typically several
+ * levels deep under a git worktree), so the project-version directory walk in
+ * versions.ts:2287 getProjectVersion runs its REAL depth here, not a synthetic
+ * shallow stub.
+ *
+ * The dominant, measured cost driver in buildExecEnv turned out to be neither
+ * of the two caches below on their own -- it's claude-account-token.ts:51
+ * resolveClaudeSetupToken(), called from exec.ts:424 for EVERY resolved claude
+ * version (pinned or auto-resolved) whose version home has a signed-in
+ * account. It is entirely uncached: each call re-derives an AES key via
+ * `scryptSync` (secrets/filestore.ts:208-210, invoked from
+ * decryptForFallback at secrets/filestore.ts:230-240) to decrypt the
+ * file-backed `auth` secrets bundle. Measured standalone (a one-off
+ * `performance.now()` probe against the real bundle, not part of this
+ * benchmark file): ~150-170ms per call, first call and every call after —
+ * scrypt is deliberately memory-hard/slow and nothing memoizes the derived
+ * key or the decrypted token across calls. A version home with NO signed-in
+ * account short-circuits at claude-account-token.ts:56-57
+ * (readClaudeAccountEmail returns null) before ever reaching the decrypt, so
+ * the SAME code path costs ~0.07ms or ~150ms purely depending on whether that
+ * specific version is logged in — that split, not warm/cold cache state, is
+ * the headline finding, so it is what this file isolates directly with two
+ * explicit version pins discovered from the real ~/.agents/.history/versions/
+ * layout: `loggedInClaudeVersion` and `loggedOutClaudeVersion`.
+ *
+ * Two cache regimes are ALSO benchmarked, because they cost meaningfully
+ * different amounts on top of the above:
+ *
+ *   - WARM: state.ts:1124 readMeta()'s mtime-keyed cache and actor.ts:163
+ *     resolveActor()'s process-lifetime cache are both hot. This is the
+ *     steady state inside one long-lived orchestrator process that calls
+ *     buildExecEnv many times (loop.ts:214, teams, runner.ts:720).
+ *   - COLD: both caches invalidated before every sample, matching the FIRST
+ *     buildExecEnv call in a freshly spawned `agents run` process -- the
+ *     common case, since every real CLI invocation is its own process.
+ *     Measured here it costs about the same as warm (readMeta's re-parse of a
+ *     ~5KB agents.yaml and a fresh actor resolve are both sub-millisecond) --
+ *     NOT because the invalidation is a no-op, but because this shell's
+ *     process.env already carries `AGENTS_ACTOR=UNRESOLVED@zion` (inherited
+ *     from the agent harness that launched this session), so actor.ts:149
+ *     `inheritedActor(env)` returns immediately and computeActor() never
+ *     reaches the SSH branch. A genuinely fresh interactive terminal (no
+ *     inherited AGENTS_ACTOR) would instead hit actor.ts:152-154 and, on an
+ *     SSH-connected box (SSH_CONNECTION set), pay actor.ts:62 tailscaleWhois()
+ *     — a real `spawnSync('tailscale', ['whois', ...])` subprocess capped at
+ *     2s (actor.ts:53 WHOIS_TIMEOUT_MS) — on that literal first call. That
+ *     cost is real but environment-dependent and not reproduced by this bench
+ *     run; it is called out here rather than silently assumed.
+ *
+ * The execAgent group spawns the REAL installed `claude` binary (real fork+exec,
+ * real buildExecEnv/buildExecCommand output) with `passthroughArgs: ['--version']`
+ * appended. Claude's own arg parsing short-circuits on `--version` before doing
+ * any network/session work (verified: `claude -p "x" --permission-mode plan
+ * --version` exits in ~0.2s printing only the version string) — this measures
+ * exec.ts's own spawn overhead without paying for (or depending on) a real,
+ * non-deterministic, network-bound agent conversation.
+ */
+import { describe, bench } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { buildExecEnv, buildExecCommand, execAgent } from './exec.js';
+import { resetActorCache } from './actor.js';
+import { getUserAgentsDir, getHistoryDir } from './state.js';
+import { listInstalledVersions } from './versions.js';
+function execOpts(over) {
+    return { mode: 'plan', effort: 'auto', cwd: process.cwd(), ...over };
+}
+// Discovered from the REAL version-home layout so this bench runs unmodified
+// on any dev box (or degrades gracefully when nothing is installed, e.g. a
+// bare CI runner -- this file is not wired into `vitest run`, see
+// vitest.config.ts:9, so that only matters for a human running it locally).
+const installedClaudeVersions = listInstalledVersions('claude');
+const installedCodex = listInstalledVersions('codex').at(-1);
+/**
+ * Whether a claude version's home has a resolvable oauth account email
+ * (claude-account-token.ts:29 readClaudeAccountEmail's own check), WITHOUT
+ * going through the secrets bundle at all -- this only reads the plaintext
+ * `.claude.json` account marker, never a secret value, so it is safe to run
+ * as bench setup and never prints anything sensitive.
+ */
+function hasResolvableAccount(version) {
+    const home = path.join(getHistoryDir(), 'versions', 'claude', version, 'home');
+    for (const p of [path.join(home, '.claude', '.claude.json'), path.join(home, '.claude.json')]) {
+        try {
+            const email = JSON.parse(fs.readFileSync(p, 'utf-8')).oauthAccount?.emailAddress;
+            if (typeof email === 'string' && email.trim().length > 0)
+                return true;
+        }
+        catch { /* try the next candidate path */ }
+    }
+    return false;
+}
+const loggedInClaudeVersion = installedClaudeVersions.find(hasResolvableAccount);
+const loggedOutClaudeVersion = installedClaudeVersions.find((v) => !hasResolvableAccount(v));
+const metaFile = path.join(getUserAgentsDir(), 'agents.yaml');
+/**
+ * Force the next buildExecEnv call to pay full cold-start cost: clears the
+ * process-lifetime actor cache (actor.ts:157 `cached`) and bumps agents.yaml's
+ * mtime so state.ts:1130 readMeta()'s stamp check misses and it re-parses --
+ * exactly the "another process touched the file" invalidation path the module
+ * doc at state.ts:1120 describes.
+ *
+ * tinybench's bench-level `setup` hook (the only per-task hook vitest's
+ * `bench(name, fn, options)` actually exposes -- `beforeEach`/`afterEach` are
+ * tinybench's internal per-Task `FnOptions`, not part of the `Options` shape
+ * vitest forwards, and using them here is a type error) fires ONCE before a
+ * task's `run()`, not once per sample. So to measure a genuinely cold call
+ * rather than one cold sample diluted into a mean with many warm ones, every
+ * cold bench() below pairs this `setup` with `{ iterations: 1, time: 1,
+ * warmupIterations: 0, warmupTime: 0 }` -- no warmup, and a near-zero time
+ * budget so the run loop stops as soon as its 1-sample floor is met.
+ */
+function invalidateCaches(_task, mode) {
+    if (mode !== 'run')
+        return;
+    resetActorCache();
+    try {
+        const now = new Date();
+        fs.utimesSync(metaFile, now, now);
+    }
+    catch {
+        // No ~/.agents/agents.yaml on this box -- readMeta() has nothing cached
+        // to invalidate either, so the cold/warm distinction collapses; proceed.
+    }
+}
+/** Bench options for a single, genuinely-cold sample — see invalidateCaches doc. */
+const COLD_SAMPLE_OPTS = { setup: invalidateCaches, iterations: 1, time: 1, warmupIterations: 0, warmupTime: 0 };
+describe.skipIf(!loggedInClaudeVersion || !loggedOutClaudeVersion)('buildExecEnv — resolveClaudeSetupToken cost split (exec.ts:424, claude-account-token.ts:51): same code path, signed-in vs not', () => {
+    bench('pinned version WITH a signed-in account (pays the uncached scrypt decrypt every call)', () => {
+        buildExecEnv(execOpts({ agent: 'claude', version: loggedInClaudeVersion, sessionId: randomUUID() }));
+    });
+    bench('pinned version WITHOUT a signed-in account (readClaudeAccountEmail short-circuits, claude-account-token.ts:56)', () => {
+        buildExecEnv(execOpts({ agent: 'claude', version: loggedOutClaudeVersion, sessionId: randomUUID() }));
+    });
+});
+describe('buildExecEnv — warm cache (steady state: loop.ts/teams/runner calling it repeatedly in one process)', () => {
+    bench('claude, auto-resolved version (resolveVersion + isVersionInstalled + resolveClaudeSetupToken chain)', () => {
+        buildExecEnv(execOpts({ agent: 'claude', sessionId: randomUUID() }));
+    });
+    bench('codex, explicit pinned version (no claude-account-token path at all)', () => {
+        buildExecEnv(execOpts({ agent: 'codex', version: installedCodex ?? '0.146.0', sessionId: randomUUID() }));
+    });
+    bench('codex, auto-resolved version', () => {
+        buildExecEnv(execOpts({ agent: 'codex', sessionId: randomUUID() }));
+    });
+});
+describe('buildExecEnv — cold cache (single sample: the first call in a fresh `agents run` process)', () => {
+    bench('claude, auto-resolved version', () => {
+        buildExecEnv(execOpts({ agent: 'claude', sessionId: randomUUID() }));
+    }, COLD_SAMPLE_OPTS);
+    bench.skipIf(!loggedOutClaudeVersion)('claude, pinned version WITHOUT a signed-in account (isolates readMeta+actor cold cost from the scrypt cost above)', () => {
+        buildExecEnv(execOpts({ agent: 'claude', version: loggedOutClaudeVersion, sessionId: randomUUID() }));
+    }, COLD_SAMPLE_OPTS);
+});
+describe('buildExecCommand — argv assembly (runs immediately before spawn in spawnAgent, exec.ts:1745)', () => {
+    bench('claude headless, explicit pinned version', () => {
+        buildExecCommand(execOpts({
+            agent: 'claude', version: loggedOutClaudeVersion ?? installedClaudeVersions.at(-1) ?? '2.1.221', prompt: 'benchmark prompt', sessionId: randomUUID(),
+        }));
+    });
+    bench('claude headless, auto-resolved version + model tier (re-walks resolveVersion a second time, exec.ts:972)', () => {
+        buildExecCommand(execOpts({
+            agent: 'claude', prompt: 'benchmark prompt', model: 'sonnet', sessionId: randomUUID(),
+        }));
+    });
+});
+describe.skipIf(!loggedOutClaudeVersion)('execAgent — real subprocess spawn (real claude binary; --version passthrough keeps it network-free)', () => {
+    bench('claude headless spawn, pinned version without a signed-in account (isolates spawn overhead from the scrypt cost above)', async () => {
+        await execAgent(execOpts({
+            agent: 'claude',
+            version: loggedOutClaudeVersion,
+            prompt: 'benchmark prompt',
+            passthroughArgs: ['--version'],
+        }));
+    }, { time: 3000, iterations: 15 });
+});

package/dist/lib/exec.js

@@ -31,6 +31,7 @@ import { isTmuxInstalled } from './tmux/binary.js';
 import { shellQuote } from './ssh-exec.js';
 import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
+import { applyActiveRulesPresetAtRun } from './rules/run-sync.js';
 /**
  * Map a raw mode string (CLI flag, YAML field, env var) to the canonical Mode.
  *
@@ -967,6 +968,12 @@ export function buildExecCommand(options) {
             // on the default command is parsed as a project path, not a message.
             cmd.push('--prompt', options.prompt);
         }
+        else if (interactive && options.agent === 'claude') {
+            // Claude's -p is --print, not a prompt-value flag. In an interactive run
+            // the initial prompt is positional; emitting `-p /continue <id>` turns a
+            // focus recovery into a one-shot print process that immediately exits.
+            cmd.push(options.prompt);
+        }
         else if (template.promptFlag === 'positional') {
             cmd.push(options.prompt);
         }
@@ -1285,7 +1292,7 @@ export function formatPaneTail(raw, maxLines = 30) {
  *      (Ctrl-b d) — return 0 and LEAVE the session for `agents focus` to re-attach.
  */
 async function runInTmux(options, executable, args) {
-    const { createSession, hasSession, killSession, paneExitStatus, setSessionHook, slugifyName, agentPaneDiedHook, markSessionHookSchema } = await import('./tmux/session.js');
+    const { createSession, killSession, paneExitStatus, prepareSessionForResume, setSessionHook, slugifyName, agentPaneDiedHook, markSessionHookSchema } = await import('./tmux/session.js');
     const { getDefaultSocketPath } = await import('./tmux/paths.js');
     const { attachTmux, runTmux } = await import('./tmux/binary.js');
     const socket = getDefaultSocketPath();
@@ -1294,15 +1301,11 @@ async function runInTmux(options, executable, args) {
     const name = slugifyName(`ag-${options.agent}-${idSeed}`);
     // A native resume must not create a competing wrapper for a live session.
     // A retained dead pane is reaped before the harness resumes normally.
-    if (options.resume && await hasSession(name, socket)) {
-        const existing = await createSession({ name, cwd, socket, source: 'cli', attachExisting: true });
+    if (options.resume && await prepareSessionForResume(name, socket) === 'attach') {
         if (options.sessionId)
             writeSessionAliasRecord(options.sessionId, name);
-        if (!existing.pane || !(await paneExitStatus(existing.pane, socket)).dead) {
-            await attachTmux({ socket, args: ['attach-session', '-t', name] });
-            return { exitCode: 0, stderr: '', stdout: '' };
-        }
-        await killSession(name, socket);
+        await attachTmux({ socket, args: ['attach-session', '-t', name] });
+        return { exitCode: 0, stderr: '', stdout: '' };
     }
     // SessionStart learns some harness IDs only after launch. Carry the wrapper
     // name into that hook so it can bind both identities durably.
@@ -1980,6 +1983,13 @@ export async function runWithFallback(options) {
     }
     for (let i = 0; i < chain.length; i++) {
         const { agent, version, envOverride } = chain[i];
+        // Every fallback entry can target a different harness/version home. Sync
+        // its active preset immediately before dispatch so entries 2..N cannot
+        // inherit the stale rules file left by the primary entry.
+        const rulesVersion = version ?? resolveVersion(agent);
+        if (rulesVersion) {
+            applyActiveRulesPresetAtRun(agent, rulesVersion, getVersionHomePath(agent, rulesVersion));
+        }
         // Record the entry we're about to attempt so the caller (audit log) sees the
         // agent+version that actually ran, even after a rate-limit handoff.
         if (options.dispatchSink) {