@phnx-labs/agents-cli 1.22.25 → 1.22.27

package/dist/lib/routine-notify-owner.js

@@ -0,0 +1,232 @@
+/**
+ * Owner phone notification on routine FAILURE (RUSH-2288).
+ *
+ * The desktop lifecycle notifications (routine-notify.ts) never leave the
+ * machine, so a failed scheduled routine on a headless fleet box was invisible
+ * until someone happened to look. The per-routine prompt pattern (a prompt that
+ * ends by shelling `agents notify`) does not close the gap either: when the
+ * routine's OWN agent fails to spawn (`auth_failed`) that prompt never runs, so
+ * the one failure most worth surfacing is the one that goes unheard.
+ *
+ * So the DAEMON delivers on failure, from the SAME owner channel stack `agents
+ * notify` uses (humans.yaml owner channels, or the legacy `notify.owner`),
+ * calling the channel providers IN-PROCESS — no shelling out to `ssh mac-mini
+ * agents notify`. When the primary owner channel cannot deliver from this box it
+ * walks the remaining configured owner channels as fallbacks (OpenClaw, a second
+ * channel, …). Telegram is never used.
+ *
+ * Only failures notify. A green routine of any kind stays silent — this is an
+ * ADDITIONAL failures-only lane, and the desktop thresholds (which still ping a
+ * green agent/workflow finish on the local screen) are unchanged. Delivery is
+ * deduped per job+runId so a run is announced to the owner at most once.
+ *
+ * The message BUILDERS (`routineFinishOwnerText` / `routineStartFailedOwnerText`)
+ * are pure and unit-tested; `notifyOwnerRoutineFinish` /
+ * `notifyOwnerRoutineStartFailed` are the daemon glue that reads config and
+ * delivers.
+ */
+import * as os from 'os';
+import { routineKind } from './routine-notify.js';
+import { readMeta } from './state.js';
+import { getOwnerFromHumans } from './humans.js';
+import { readOwnerDest } from './channels/send.js';
+import { registerBuiltinProviders } from './channels/providers/index.js';
+import { lookupTransport } from './channels/resolve.js';
+/** Transports that are Telegram in any form — never delivered to (owner rule). */
+const TELEGRAM_TRANSPORTS = new Set(['telegram', 'openclaw-telegram']);
+/** Human label for the routine body ("agent claude", "workflow deploy", "command"). */
+function routineLabel(r) {
+    const kind = routineKind(r);
+    if (kind === 'command')
+        return 'command';
+    if (kind === 'workflow')
+        return `workflow ${r.workflow}`;
+    return `agent ${r.agent ?? 'unknown'}`;
+}
+/** The failure reason line for a terminal run: timeout / error message / exit code. */
+function failureReason(meta) {
+    if (meta.status === 'timeout')
+        return 'Timed out';
+    if (meta.errorMessage)
+        return meta.errorMessage;
+    return `Exited with code ${meta.exitCode ?? '?'}`;
+}
+/**
+ * Owner-phone text for a routine FINISH, or null when the run did NOT fail. Only
+ * `failed` and `timeout` are failures worth an owner ping — a `completed` run
+ * (any kind) is silent, and `running`/`missed` never reach this path from the
+ * daemon's finish hook. The text is a short, phone-sized pointer: what failed,
+ * why, and on which box (so the owner knows where to look), well under the
+ * `user-message-guard` length ceiling.
+ */
+export function routineFinishOwnerText(meta, host) {
+    if (meta.status !== 'failed' && meta.status !== 'timeout')
+        return null;
+    return `Routine failed: ${meta.jobName}\n${failureReason(meta)}\n${routineLabel(meta)} · ${host}`;
+}
+/**
+ * Owner-phone text for a routine that failed to even START (the daemon's
+ * pre-spawn catch — `executeJobDetached` threw before a child existed, e.g.
+ * `auth_failed`). Never null: a broken start is always a failure worth the ping,
+ * for every routine kind, and it is exactly the case the per-routine `agents
+ * notify` prompt can never cover because that prompt never ran.
+ */
+export function routineStartFailedOwnerText(config, error, host) {
+    return `Routine failed to start: ${config.name}\n${error}\n${routineLabel(config)} · ${host}`;
+}
+/**
+ * True when a channel would deliver over Telegram. Checks, in order:
+ * 1. the channel id itself (`telegram`);
+ * 2. the humans.yaml `transport` field on the channel entry (when provided);
+ * 3. `notify.transports[id]` remapping (or the id as the default transport name).
+ * Any of those landing on a Telegram-delivering provider is excluded.
+ */
+function isTelegramChannel(channelId, meta, humansTransport) {
+    if (channelId.trim().toLowerCase() === 'telegram')
+        return true;
+    if (humansTransport && TELEGRAM_TRANSPORTS.has(humansTransport.trim().toLowerCase())) {
+        return true;
+    }
+    const transport = meta.notify?.transports?.[channelId] ?? channelId;
+    return TELEGRAM_TRANSPORTS.has(transport.trim().toLowerCase());
+}
+/**
+ * Ordered owner delivery plan for a failure ping: the primary owner destination
+ * (the same one `agents notify` resolves) first, then every other configured
+ * owner channel as a fallback. Deduped by (channel, to). Telegram channels and
+ * intrusive channels (a voice call is too much for a routine failure) are
+ * excluded entirely — so an owner whose ONLY channel is Telegram gets an empty
+ * plan and no ping, which is the intended "silence beats Telegram" outcome.
+ *
+ * The same filters apply to the primary and the fallback list — a policy that
+ * points normal severity at a voice channel must not auto-call the owner on
+ * every routine failure.
+ */
+export function ownerFailureDeliveryPlan(meta) {
+    const plan = [];
+    const seen = new Set();
+    const ownerChannels = getOwnerFromHumans()?.channels ?? [];
+    const byId = new Map(ownerChannels.map((ch) => [ch.id, ch]));
+    const push = (channel, to) => {
+        const c = channel?.trim();
+        const t = to?.trim();
+        if (!c || !t)
+            return;
+        const entry = byId.get(c);
+        if (entry?.intrusive)
+            return;
+        if (isTelegramChannel(c, meta, entry?.transport))
+            return;
+        const key = `${c} ${t}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        plan.push({ channel: c, to: t });
+    };
+    // Primary = the destination `agents notify` would resolve (humans policy →
+    // first addressable → legacy notify.owner). Same filters as the fallbacks.
+    const primary = readOwnerDest(meta);
+    if (primary)
+        push(primary.channel, primary.to);
+    // Fallbacks = the remaining configured owner channels, in declared order.
+    for (const ch of ownerChannels) {
+        push(ch.id, ch.to);
+    }
+    return plan;
+}
+/**
+ * Deliver `text` to the owner over the failure plan, in-process, trying each
+ * channel until one accepts. Uses the non-dying `lookupTransport` (never
+ * `resolveTransport`, which `die()`s the process) so a daemon survives a bad
+ * channel name. Best-effort by contract: the daemon wraps this in try/catch, but
+ * it also never throws for a delivery failure — it returns the attempt log.
+ */
+export async function deliverOwnerFailure(text, meta) {
+    const plan = ownerFailureDeliveryPlan(meta);
+    const attempts = [];
+    if (plan.length === 0)
+        return { delivered: false, attempts };
+    registerBuiltinProviders();
+    for (const dest of plan) {
+        const { provider, error } = lookupTransport(dest.channel, meta);
+        if (!provider) {
+            attempts.push({ channel: dest.channel, ok: false, error });
+            continue;
+        }
+        try {
+            const result = await provider.send(text, {
+                target: dest.to,
+                from: 'routines',
+                ownerScoped: true,
+            });
+            attempts.push({ channel: dest.channel, ok: result.ok, error: result.error });
+            if (result.ok)
+                return { delivered: true, channel: dest.channel, attempts };
+        }
+        catch (err) {
+            attempts.push({ channel: dest.channel, ok: false, error: err.message });
+        }
+    }
+    return { delivered: false, attempts };
+}
+/**
+ * Per-process dedup of failure pings, keyed by job+runId (finishes) or the
+ * synthetic start-failed key. A run is announced to the owner at most once even
+ * if the finish hook fires twice or a later sweep re-finalizes the same record.
+ * Bounded so a long-lived daemon never grows it without limit.
+ */
+const notifiedFailures = new Set();
+const MAX_DEDUP_KEYS = 1000;
+/**
+ * Claim a dedup key for an in-flight delivery. Returns false when this
+ * job+runId was already delivered (or is already in flight). Callers MUST
+ * {@link releaseFailureKey} when delivery fails so a later tick can retry —
+ * claiming before send without a release would suppress permanent failures
+ * forever (RUSH-2288 review).
+ */
+function claimFailureKey(key) {
+    if (notifiedFailures.has(key))
+        return false;
+    if (notifiedFailures.size >= MAX_DEDUP_KEYS)
+        notifiedFailures.clear();
+    notifiedFailures.add(key);
+    return true;
+}
+/** Drop a key so a failed delivery can be retried on the next finish hook. */
+function releaseFailureKey(key) {
+    notifiedFailures.delete(key);
+}
+/** Test-only: reset the dedup set so cases don't leak state into each other. */
+export function __resetOwnerFailureDedup() {
+    notifiedFailures.clear();
+}
+/** A green run / deduped skip attempted no channel. */
+const NO_DELIVERY = { delivered: false, attempts: [] };
+/**
+ * Daemon glue: on a routine FINISH, ping the owner IFF the run failed. Green
+ * runs return early (no ping). Deduped per job+runId — claimed for the
+ * in-flight window so two finish hooks don't double-text, released when no
+ * channel accepted so a later sweep can retry. Best-effort.
+ */
+export async function notifyOwnerRoutineFinish(meta) {
+    const text = routineFinishOwnerText(meta, os.hostname());
+    if (!text)
+        return NO_DELIVERY; // green / non-terminal → silent
+    const key = `${meta.jobName} ${meta.runId}`;
+    if (!claimFailureKey(key))
+        return NO_DELIVERY;
+    const result = await deliverOwnerFailure(text, readMeta());
+    if (!result.delivered)
+        releaseFailureKey(key);
+    return result;
+}
+/**
+ * Daemon glue: on a pre-spawn failure (no run record, so no finish hook and no
+ * runId), ping the owner. Not deduped — a pre-spawn failure is one scheduled
+ * fire on the cron cadence (never a per-second storm), and each such fire is a
+ * distinct failure the owner should hear about. Best-effort.
+ */
+export async function notifyOwnerRoutineStartFailed(config, error) {
+    const text = routineStartFailedOwnerText(config, error, os.hostname());
+    return deliverOwnerFailure(text, readMeta());
+}

package/dist/lib/routines.d.ts

@@ -313,6 +313,16 @@ export interface RunMeta {
     jobName: string;
     runId: string;
     agent?: AgentId;
+    /**
+     * Resolved agent version this run launched under. Re-pointed to each failover
+     * attempt's version as the single-shot chain advances (runner.ts), so it names
+     * the version that actually ran and wrote the transcript. Recorded so
+     * `archiveRoutineTranscripts` can find the transcript in the per-version home a
+     * config-dir-relocating agent (claude/codex) writes to, and so account
+     * attribution can name the home that ran (RUSH-2271). Unset for
+     * command/self-updating runs.
+     */
+    version?: string;
     workflow?: string;
     /** The shell command that ran, for command-mode routines (no agent). */
     command?: string;

package/dist/lib/routines.js

@@ -14,7 +14,7 @@ import { getRoutinesDir, getSystemRoutinesDir, getRunsDir, ensureAgentsDir, getP
 import { safeJoin, isSafeSegmentName } from './paths.js';
 import { isSafeProjectName } from './projects.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
-import { ALL_AGENT_IDS } from './agents.js';
+import { ALL_AGENT_IDS, ROUTINE_AGENT_IDS } from './agents.js';
 import { machineId, normalizeHost } from './machine-id.js';
 import { resolveActor } from './actor.js';
 import { percentile } from './percentile.js';
@@ -600,6 +600,7 @@ export function validateJob(config) {
     const hasAgent = Boolean(config.agent && typeof config.agent === 'string');
     const hasWorkflow = Boolean(config.workflow && typeof config.workflow === 'string');
     const hasCommand = Boolean(config.command && typeof config.command === 'string');
+    const strategy = resolveHostStrategy(config);
     const set = [hasAgent, hasWorkflow, hasCommand].filter(Boolean).length;
     if (set === 0) {
         errors.push('exactly one of agent, workflow, or command is required');
@@ -613,6 +614,18 @@ export function validateJob(config) {
     if (hasAgent && config.agent && !ALL_AGENT_IDS.includes(config.agent)) {
         errors.push(`agent must be one of: ${ALL_AGENT_IDS.join(', ')}`);
     }
+    else if (hasAgent && config.agent && strategy === 'local' &&
+        !ROUTINE_AGENT_IDS.includes(config.agent)) {
+        // The local daemon only knows how to build a command for the agents in
+        // ROUTINE_AGENT_IDS (runner.ts's AGENT_COMMANDS table) — anything else is a
+        // real, installable agent (it passed the ALL_AGENT_IDS check above) but one
+        // the daemon can't fire itself, so reject it now instead of accepting the
+        // routine and failing at fire time (runner.ts buildJobCommand: "Unsupported
+        // agent for daemon jobs"). host/fleet/cloud placement dispatches through
+        // `agents run`/a cloud provider instead of this table, so they're exempt.
+        errors.push(`agent '${config.agent}' is not supported by the local routine daemon; use one of: ` +
+            `${ROUTINE_AGENT_IDS.join(', ')} (or set hostStrategy: host/fleet/cloud to run it elsewhere)`);
+    }
     if (hasWorkflow && config.workflow) {
         if (!/^[a-z0-9][a-z0-9_-]*$/.test(config.workflow)) {
             errors.push('workflow must be a lowercase alphanumeric name (hyphens and underscores allowed, e.g. autodev)');
@@ -662,7 +675,6 @@ export function validateJob(config) {
             errors.push(`hostStrategy must be one of: ${HOST_STRATEGIES.join(', ')}`);
         }
     }
-    const strategy = resolveHostStrategy(config);
     if (config.host !== undefined) {
         if (typeof config.host !== 'string' || config.host.trim() === '') {
             errors.push('host must be a non-empty machine name (a registered host, device, capability tag, or user@host)');

package/dist/lib/runner.d.ts

@@ -26,14 +26,19 @@ export interface RunResult {
 export declare class RoutineAlreadyRunningError extends Error {
     constructor(jobName: string, runId: string);
 }
-/** Agents the daemon can actually run, derived from the command table above
- * so the `--agent` help and any validation can never drift from it. */
-export declare const ROUTINE_AGENT_IDS: readonly string[];
 /** Stable working directory for routine children, independent of the daemon's launch cwd. */
 export declare function routineSpawnCwd(config: Pick<JobConfig, 'repo'>, configuredRoot?: string | undefined): string;
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export declare function buildJobCommand(config: JobConfig, resolvedPrompt: string): string[];
-export declare function archiveRoutineTranscripts(meta: Pick<RunMeta, 'jobName' | 'runId' | 'agent'>, runDir: string, overlayHome?: string): void;
+/**
+ * Record every transcript file already present in the child's transcript dirs BEFORE
+ * the run spawns. When the transcript lands in a shared per-version home, this baseline
+ * is what lets the archiver copy only the file THIS run produced instead of sweeping in
+ * every sibling session that home holds (which would mis-tag them all `origin='routine'`
+ * under this run's name). Called once per run, before spawn.
+ */
+export declare function snapshotRoutineTranscriptBase(meta: Pick<RunMeta, 'jobName' | 'agent' | 'version'>, runDir: string, overlayHome?: string): void;
+export declare function archiveRoutineTranscripts(meta: Pick<RunMeta, 'jobName' | 'runId' | 'agent' | 'version'>, runDir: string, overlayHome?: string): void;
 /** Pre-flight version/account selection for a routine job. */
 export interface RoutineLaunchPlan {
     /** Ordered attempts: primary first, then same-agent failover accounts. */

package/dist/lib/runner.js

@@ -18,7 +18,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import { resolveJobPrompt, parseTimeout, writeRunMeta, listRuns, getJobRunsDir, getRunDir, checkJobDeviceEligibility, finalizeRunMeta, } from './routines.js';
-import { getRunsDir } from './state.js';
+import { getRunsDir, getUserAgentsDir } from './state.js';
+import { shortCodexHome } from './codex-home.js';
 import { prepareJobHome, buildSpawnEnv, getJobHomePath } from './sandbox.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { createTimer, redactPrompt } from './events.js';
@@ -36,7 +37,7 @@ import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, } from './rotate.js';
 import { readAuthHealth, isDeadVerdict } from './auth-health.js';
 import { machineId } from './machine-id.js';
-import { isSelfUpdatingAgent } from './agents.js';
+import { isSelfUpdatingAgent, ROUTINE_AGENT_COMMANDS as AGENT_COMMANDS, ROUTINE_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from './agents.js';
 import { expandLocalHome, getProjectRoot } from './project-root.js';
 export class RoutineAlreadyRunningError extends Error {
     constructor(jobName, runId) {
@@ -98,19 +99,6 @@ function terminateRoutineTree(pid) {
     }
     catch { /* already exited */ }
 }
-/** CLI command templates per agent, with {prompt} as a placeholder. */
-const AGENT_COMMANDS = {
-    claude: ['claude', '-p', '--verbose', '{prompt}', '--output-format', 'stream-json', '--permission-mode', 'plan'],
-    codex: ['codex', 'exec', '{prompt}', '--json'],
-    gemini: ['gemini', '{prompt}', '--output-format', 'stream-json'],
-    cursor: ['cursor-agent', '-p', '{prompt}', '--output-format', 'stream-json'],
-    kimi: ['kimi', '--prompt', '{prompt}', '--output-format', 'stream-json'],
-    droid: ['droid', 'exec', '{prompt}', '-o', 'stream-json'],
-    muse: ['muse', 'exec', '{prompt}', '--json'],
-};
-/** Agents the daemon can actually run, derived from the command table above
- * so the `--agent` help and any validation can never drift from it. */
-export const ROUTINE_AGENT_IDS = Object.freeze(Object.keys(AGENT_COMMANDS));
 /**
  * Where each agent's transcript files live under an overlay HOME, mirroring
  * `SESSION_ROOT_SPECS` (session/discover.ts) — the CLI's own source of truth
@@ -322,6 +310,94 @@ function appendModelAndReasoning(cmd, config) {
 function generateRunId() {
     return new Date().toISOString().replace(/[:.]/g, '-');
 }
+/**
+ * Agents whose config dir `buildExecEnv` relocates OUT of the sandbox overlay HOME
+ * into their per-version home (exec.ts: CLAUDE_CONFIG_DIR / CODEX_HOME). A routine
+ * spawned for one of these writes its transcript under the version home, NOT the overlay
+ * the sandbox generated — so the archiver has to read it there. Both are version-pinned
+ * (never self-updating), so `RunMeta.version` names a real home.
+ *
+ * Scoped to the agents whose archived transcript the DISCOVERY side can already index as
+ * origin='routine' — `readRoutineArchiveMeta` (session/discover.ts) has a branch for
+ * claude and codex but not kimi. Kimi also relocates (KIMI_CODE_HOME) and hits the same
+ * bug, but archiving it here without a discovery branch would only copy files that are
+ * never indexed; adding a kimi reader (its session spans state.json + wire.jsonl under a
+ * `session_<uuid>` dir) is the separate follow-up that lets kimi join this set. Muse
+ * (XDG, self-updating) and copilot (no transcript spec) are likewise out of scope.
+ */
+const CONFIG_DIR_RELOCATED_AGENTS = new Set(['claude', 'codex']);
+/** Whether this run's transcript lands in a SHARED per-version home (accumulating every
+ *  session that version+account ever ran) rather than the run's own disposable overlay. */
+function usesSharedTranscriptHome(agent, version) {
+    return Boolean(version) && CONFIG_DIR_RELOCATED_AGENTS.has(agent);
+}
+/**
+ * The directories the child actually writes a transcript to for one spec — resolved to
+ * match `buildExecEnv` (exec.ts), the single decision-point for where the transcript
+ * lands, so the archiver can never drift from it. For a config-dir-relocated agent that
+ * is the per-version home (`.claude`, `.codex`, …); for everyone else it is the sandbox
+ * overlay HOME. Codex may run from a SUN_LEN-safe short home on macOS (codex-home.ts),
+ * so both candidates are returned and the caller skips whichever does not exist.
+ */
+function routineTranscriptSourceRoots(agent, version, overlayHome, spec) {
+    if (usesSharedTranscriptHome(agent, version)) {
+        const roots = [path.join(getVersionHomePath(agent, version), ...spec.root)];
+        if (agent === 'codex') {
+            roots.push(path.join(shortCodexHome(getUserAgentsDir(), version), ...spec.root.slice(1)));
+        }
+        return roots;
+    }
+    return [path.join(overlayHome, ...spec.root)];
+}
+/** Path of the per-run baseline recorded before spawn (see {@link snapshotRoutineTranscriptBase}). */
+function transcriptBasePath(runDir) {
+    return path.join(runDir, '.transcript-base.json');
+}
+/**
+ * Record every transcript file already present in the child's transcript dirs BEFORE
+ * the run spawns. When the transcript lands in a shared per-version home, this baseline
+ * is what lets the archiver copy only the file THIS run produced instead of sweeping in
+ * every sibling session that home holds (which would mis-tag them all `origin='routine'`
+ * under this run's name). Called once per run, before spawn.
+ */
+export function snapshotRoutineTranscriptBase(meta, runDir, overlayHome) {
+    if (!meta.agent)
+        return;
+    const specs = ROUTINE_TRANSCRIPT_SPECS[meta.agent];
+    if (!specs)
+        return;
+    const home = overlayHome ?? getJobHomePath(meta.jobName);
+    const preexisting = new Set();
+    for (const spec of specs) {
+        for (const root of routineTranscriptSourceRoots(meta.agent, meta.version, home, spec)) {
+            if (!fs.existsSync(root))
+                continue;
+            for (const f of walkForFiles(root, spec.ext, 100_000))
+                preexisting.add(f);
+        }
+    }
+    try {
+        fs.mkdirSync(runDir, { recursive: true });
+        fs.writeFileSync(transcriptBasePath(runDir), JSON.stringify([...preexisting]), { mode: 0o600 });
+    }
+    catch {
+        // Best-effort: a missing baseline is handled conservatively at archive time
+        // (a shared home is skipped rather than bulk-copied).
+    }
+}
+/** Read the pre-spawn baseline. `null` means none was recorded (older run or a failed
+ *  snapshot) — the archiver then refuses to bulk-copy a shared home. */
+function readTranscriptBase(runDir) {
+    try {
+        const arr = JSON.parse(fs.readFileSync(transcriptBasePath(runDir), 'utf-8'));
+        if (Array.isArray(arr))
+            return new Set(arr.filter((x) => typeof x === 'string'));
+    }
+    catch {
+        // No baseline file, or it was unreadable/corrupt.
+    }
+    return null;
+}
 export function archiveRoutineTranscripts(meta, runDir, overlayHome) {
     if (!meta.agent)
         return;
@@ -329,24 +405,35 @@ export function archiveRoutineTranscripts(meta, runDir, overlayHome) {
     if (!specs)
         return;
     const home = overlayHome ?? getJobHomePath(meta.jobName);
+    const shared = usesSharedTranscriptHome(meta.agent, meta.version);
+    const base = readTranscriptBase(runDir);
+    // A shared per-version home holds every session that version+account ran, so without a
+    // per-run baseline we cannot tell this run's transcript from a sibling's — copy nothing
+    // rather than mis-tag them all. A disposable overlay is this run's alone, so copy all.
+    if (shared && base === null)
+        return;
     for (const spec of specs) {
-        const sourceRoot = path.join(home, ...spec.root);
-        if (!fs.existsSync(sourceRoot))
-            continue;
         const destRoot = path.join(runDir, 'sessions', meta.agent, spec.root[spec.root.length - 1]);
-        for (const sourcePath of walkForFiles(sourceRoot, spec.ext, 100_000)) {
-            const rel = path.relative(sourceRoot, sourcePath);
-            if (rel.startsWith('..') || path.isAbsolute(rel))
+        for (const sourceRoot of routineTranscriptSourceRoots(meta.agent, meta.version, home, spec)) {
+            if (!fs.existsSync(sourceRoot))
                 continue;
-            const destPath = path.join(destRoot, rel);
-            fs.mkdirSync(path.dirname(destPath), { recursive: true });
-            try {
-                fs.copyFileSync(sourcePath, destPath);
-                fs.chmodSync(destPath, 0o600);
-            }
-            catch {
-                // The process already reached a terminal state; a concurrently removed
-                // transcript should not rewrite that outcome.
+            for (const sourcePath of walkForFiles(sourceRoot, spec.ext, 100_000)) {
+                // Skip files that predate this run (a sibling session in the shared home).
+                if (base?.has(sourcePath))
+                    continue;
+                const rel = path.relative(sourceRoot, sourcePath);
+                if (rel.startsWith('..') || path.isAbsolute(rel))
+                    continue;
+                const destPath = path.join(destRoot, rel);
+                fs.mkdirSync(path.dirname(destPath), { recursive: true });
+                try {
+                    fs.copyFileSync(sourcePath, destPath);
+                    fs.chmodSync(destPath, 0o600);
+                }
+                catch {
+                    // The process already reached a terminal state; a concurrently removed
+                    // transcript should not rewrite that outcome.
+                }
             }
         }
     }
@@ -680,11 +767,53 @@ function injectRoutineActor(env, config) {
         env.AGENTS_ACTOR = config.actor;
     return env;
 }
+/**
+ * `routines add`/`routines edit` refuse to create a routine pinned to a
+ * hard-deprecated harness (commands/routines.ts), but that check runs only at
+ * CLI-write time. A routine YAML written before the harness was deprecated, or
+ * edited directly on disk / synced from another device, has no equivalent gate
+ * at fire time — the daemon would happily build and spawn `gemini …` against a
+ * backend Google retired. Fail loud here, before any version/account
+ * resolution or sandbox prep, so a legacy routine skips with the same message
+ * every other entry point (`sync`, `exec`, `import`, `run-cloud`, `versions`)
+ * already shows instead of a doomed, confusing spawn failure.
+ */
+function hardDeprecationRunFailure(config, agent) {
+    const runId = generateRunId();
+    const runDir = getRunDir(config.name, runId);
+    fs.mkdirSync(runDir, { recursive: true });
+    const reason = hardDeprecationError(agent);
+    const meta = {
+        jobName: config.name,
+        runId,
+        ...runProvenance(config),
+        agent,
+        pid: null,
+        spawnedAt: Date.now(),
+        status: 'running',
+        startedAt: new Date().toISOString(),
+        completedAt: null,
+        exitCode: null,
+    };
+    writeRunMeta(meta);
+    process.stderr.write(`[agents] routine ${config.name}: ${reason}\n`);
+    finalizeRunMeta(meta, 'failed', 1, { errorMessage: reason });
+    writeRunMeta(meta);
+    return meta;
+}
 export async function executeJob(config, deps) {
     const eligibility = checkJobDeviceEligibility(config);
     if (eligibility) {
         throw new Error(eligibility.message);
     }
+    // Hard-deprecated harness (e.g. gemini): fail loud before placement, version/
+    // account resolution, or sandbox prep — local, host, AND cloud placement all
+    // share this one gate (a hard-deprecated agent has no `cloudProvider` entry,
+    // so cloud placement would otherwise silently fall back to the default
+    // provider instead of refusing). See hardDeprecationRunFailure.
+    if (!config.workflow && config.agent && ROUTINE_AGENT_IDS.includes(config.agent) && isAgentHardDeprecated(config.agent)) {
+        return { meta: hardDeprecationRunFailure(config, config.agent), reportPath: null };
+    }
     // Placement (hostStrategy / bare host:) — body may run on another machine
     // over SSH or in the cloud; local version selection / sandbox / spawn then
     // do not apply. Sync callers (manual `routines run`, catchup) follow the
@@ -737,6 +866,7 @@ export async function executeJob(config, deps) {
         runId,
         ...runProvenance(config),
         agent: effectiveAgent,
+        version: primaryVersion,
         ...(config.workflow ? { workflow: config.workflow } : {}),
         pid: null,
         spawnedAt: Date.now(),
@@ -746,6 +876,9 @@ export async function executeJob(config, deps) {
         exitCode: null,
     };
     writeRunMeta(meta);
+    // Baseline the child's transcript dirs BEFORE spawning so archiveRoutineTranscripts
+    // copies only THIS run's transcript out of a shared per-version home (RUSH-2271).
+    snapshotRoutineTranscriptBase(meta, runDir, overlayHome);
     // Auth preflight: if the last live probe rejected this (agent, version)'s
     // token (verdict `revoked`), the run is guaranteed to fail auth — fail fast
     // before spawning instead of producing a doomed run + poisoned report. Cache-
@@ -821,6 +954,13 @@ export async function executeJob(config, deps) {
         if (i === 0) {
             process.stderr.write(`[agents] routine ${config.name}: running ${label}\n`);
         }
+        // A rate-limit failover spawns the NEXT chain entry, whose version/account has
+        // its own per-version transcript home. Re-point meta.version at the attempt that
+        // is about to run and re-baseline that home, so the archiver reads the transcript
+        // where THIS attempt writes it — not chain[0]'s home (RUSH-2271). The pre-loop
+        // snapshot already covered chain[0]; this makes every later attempt correct too.
+        meta.version = attemptVersion;
+        snapshotRoutineTranscriptBase(meta, runDir, overlayHome);
         const viaAgentsRun = dispatchesViaAgentsRun(config);
         const cmd = viaAgentsRun
             ? baseCmd
@@ -1164,6 +1304,14 @@ export async function executeJobDetached(config, hooks) {
     return withRoutineLaunchClaim(config, () => executeJobDetachedClaimed(config, hooks));
 }
 async function executeJobDetachedClaimed(config, hooks) {
+    // Hard-deprecated harness (e.g. gemini): fail loud before placement, version/
+    // account resolution, or sandbox prep — local, host, AND cloud placement all
+    // share this one gate (a hard-deprecated agent has no `cloudProvider` entry,
+    // so cloud placement would otherwise silently fall back to the default
+    // provider instead of refusing). See hardDeprecationRunFailure.
+    if (!config.workflow && config.agent && ROUTINE_AGENT_IDS.includes(config.agent) && isAgentHardDeprecated(config.agent)) {
+        return hardDeprecationRunFailure(config, config.agent);
+    }
     // Placement (hostStrategy / bare host:) — dispatch off-box and return; the
     // monitor finalizes host: runs, cloud runs stay terminal when dispatch ends.
     // Either way the in-process onFinish hook does not fire for off-box routines
@@ -1236,6 +1384,7 @@ async function executeJobDetachedClaimed(config, hooks) {
         runId,
         ...runProvenance(config),
         agent: effectiveAgent,
+        version,
         ...(config.workflow ? { workflow: config.workflow } : {}),
         pid: null,
         spawnedAt: Date.now(),
@@ -1245,6 +1394,9 @@ async function executeJobDetachedClaimed(config, hooks) {
         completedAt: null,
         exitCode: null,
     };
+    // Baseline the child's transcript dirs BEFORE spawning so archiveRoutineTranscripts
+    // copies only THIS run's transcript out of a shared per-version home (RUSH-2271).
+    snapshotRoutineTranscriptBase(meta, runDir, overlayHome);
     // Auth preflight (mirrors executeJob): with no injected token, a daemon-fired
     // Claude routine authenticates via the pinned account's own CLAUDE_CONFIG_DIR
     // login. If the last live probe rejected that (agent, version)'s token, the run

package/dist/lib/sandbox.d.ts

@@ -31,5 +31,3 @@ export declare function symlinkAllowedDirs(overlayHome: string, dirs: string[]):
 export declare function generateClaudeConfig(overlayHome: string, config: JobConfig): void;
 /** Generate a Codex config.toml in the overlay with model and approval-mode settings. */
 export declare function generateCodexConfig(overlayHome: string, config: JobConfig): void;
-/** Generate a Gemini settings.json in the overlay from the job's config block. */
-export declare function generateGeminiConfig(overlayHome: string, config: JobConfig): void;