@phnx-labs/agents-cli 1.22.26 → 1.22.27

package/dist/lib/devices/ssh-config.js

@@ -15,6 +15,9 @@ function renderHost(device) {
     const lines = [`Host ${device.name}`, `    HostName ${hostName}`];
     if (device.user)
         lines.push(`    User ${device.user}`);
+    if (device.auth.method === 'key' && device.auth.identityFile) {
+        lines.push(`    IdentityFile ${device.auth.identityFile}`, '    IdentitiesOnly yes');
+    }
     return lines.join('\n');
 }
 /**

package/dist/lib/devices/windows-ssh-enrollment.d.ts

@@ -0,0 +1,20 @@
+export interface WindowsSshEnrollment {
+    administrator: boolean;
+    expectedPath: string;
+    configuredPaths: string[];
+    fileExists: boolean;
+    hasPublicKey: boolean;
+    owner: string | null;
+    systemFullControl: boolean;
+    administratorsFullControl: boolean;
+    unexpectedAclPrincipals: string[];
+}
+export type WindowsSshEnrollmentAudit = {
+    status: WindowsSshEnrollment;
+} | {
+    error: string;
+};
+export declare function diagnoseWindowsSshFailure(stderr: string, timedOut: boolean): string;
+export declare function parseWindowsSshEnrollment(stdout: string): WindowsSshEnrollment;
+export declare function auditWindowsSshEnrollment(platform?: NodeJS.Platform): WindowsSshEnrollmentAudit | null;
+export declare function windowsSshEnrollmentProblem(audit: WindowsSshEnrollmentAudit): string | null;

package/dist/lib/devices/windows-ssh-enrollment.js

@@ -0,0 +1,98 @@
+import { spawnSync } from 'child_process';
+export function diagnoseWindowsSshFailure(stderr, timedOut) {
+    if (timedOut || /connection timed out|operation timed out/i.test(stderr)) {
+        return 'Windows SSH unreachable: port 22 did not answer before the timeout';
+    }
+    if (/host key verification failed|remote host identification has changed/i.test(stderr)) {
+        return 'Windows OpenSSH host-key verification failed; verify and re-pin the device host key';
+    }
+    if (/permission denied.*publickey|permission denied \(publickey/i.test(stderr)) {
+        return 'port 22 and OpenSSH are reachable, but the public key was rejected; recover through the Windows console or password-auth profile, then run agents doctor on that box to inspect its effective AuthorizedKeysFile and ACL';
+    }
+    if (/connection refused/i.test(stderr)) {
+        return 'Windows host is reachable but OpenSSH is not listening on port 22';
+    }
+    return stderr.trim() || 'Windows SSH probe failed';
+}
+const AUDIT_SCRIPT = String.raw `
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$administratorSid = 'S-1-5-32-544'
+$administrator = @($identity.Groups | Where-Object { $_.Value -eq $administratorSid }).Count -gt 0
+$expected = if ($administrator) { Join-Path $env:ProgramData 'ssh\administrators_authorized_keys' } else { Join-Path $env:USERPROFILE '.ssh\authorized_keys' }
+$sshd = Join-Path $env:WINDIR 'System32\OpenSSH\sshd.exe'
+$effective = (& $sshd -T -C "user=$env:USERNAME,host=$env:COMPUTERNAME,addr=127.0.0.1" 2>$null | Select-String '^authorizedkeysfile ' | Select-Object -First 1).Line
+$configured = if ($effective) { @($effective.Substring('authorizedkeysfile '.Length).Split(' ', [StringSplitOptions]::RemoveEmptyEntries)) } else { @() }
+$exists = Test-Path -LiteralPath $expected -PathType Leaf
+$acl = if ($exists) { Get-Acl -LiteralPath $expected } else { $null }
+$rules = if ($acl) { @($acl.Access | Where-Object AccessControlType -eq Allow) } else { @() }
+$full = [Security.AccessControl.FileSystemRights]::FullControl
+$system = @($rules | Where-Object { $_.IdentityReference.Value -in @('NT AUTHORITY\SYSTEM', 'S-1-5-18') -and ($_.FileSystemRights -band $full) -eq $full }).Count -gt 0
+$admins = @($rules | Where-Object { $_.IdentityReference.Value -in @('BUILTIN\Administrators', 'S-1-5-32-544') -and ($_.FileSystemRights -band $full) -eq $full }).Count -gt 0
+$allowed = @('NT AUTHORITY\SYSTEM', 'S-1-5-18', 'BUILTIN\Administrators', 'S-1-5-32-544')
+$unexpected = if ($administrator) { @($rules | ForEach-Object { $_.IdentityReference.Value } | Where-Object { $_ -notin $allowed } | Sort-Object -Unique) } else { @() }
+$hasKey = $exists -and [bool](Select-String -LiteralPath $expected -Pattern '^\s*(ssh-(rsa|ed25519)|ecdsa-sha2-)' -Quiet)
+[ordered]@{ administrator=$administrator; expectedPath=$expected; configuredPaths=$configured; fileExists=$exists; hasPublicKey=$hasKey; owner=if($acl){$acl.Owner}else{$null}; systemFullControl=$system; administratorsFullControl=$admins; unexpectedAclPrincipals=$unexpected } | ConvertTo-Json -Compress
+`;
+export function parseWindowsSshEnrollment(stdout) {
+    const raw = JSON.parse(stdout.trim());
+    const strings = (value) => Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : typeof value === 'string' ? [value] : [];
+    if (typeof raw.administrator !== 'boolean' || typeof raw.expectedPath !== 'string') {
+        throw new Error('Windows SSH enrollment audit returned an invalid payload');
+    }
+    return {
+        administrator: raw.administrator,
+        expectedPath: raw.expectedPath,
+        configuredPaths: strings(raw.configuredPaths),
+        fileExists: raw.fileExists === true,
+        hasPublicKey: raw.hasPublicKey === true,
+        owner: typeof raw.owner === 'string' ? raw.owner : null,
+        systemFullControl: raw.systemFullControl === true,
+        administratorsFullControl: raw.administratorsFullControl === true,
+        unexpectedAclPrincipals: strings(raw.unexpectedAclPrincipals),
+    };
+}
+export function auditWindowsSshEnrollment(platform = process.platform) {
+    if (platform !== 'win32')
+        return null;
+    const encoded = Buffer.from(AUDIT_SCRIPT, 'utf16le').toString('base64');
+    const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], {
+        encoding: 'utf8',
+        windowsHide: true,
+        timeout: 10_000,
+    });
+    if (result.status !== 0)
+        return { error: (result.stderr || 'audit command failed').trim() };
+    try {
+        return { status: parseWindowsSshEnrollment(result.stdout) };
+    }
+    catch (error) {
+        return { error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export function windowsSshEnrollmentProblem(audit) {
+    if ('error' in audit)
+        return `Windows OpenSSH enrollment audit failed: ${audit.error}`;
+    const status = audit.status;
+    const normalize = (path) => path.replace(/\//g, '\\').toLowerCase();
+    const expected = normalize(status.expectedPath);
+    const effective = status.configuredPaths.map((path) => normalize(path)
+        .replace('__programdata__', normalize(process.env.ProgramData ?? 'C:\\ProgramData'))
+        .replace(/^\.ssh\\/, `${normalize(process.env.USERPROFILE ?? '')}\\.ssh\\`));
+    if (effective.length > 0 && !effective.includes(expected)) {
+        return `OpenSSH AuthorizedKeysFile resolves to ${status.configuredPaths.join(', ')}, not ${status.expectedPath}`;
+    }
+    if (!status.fileExists)
+        return `SSH public-key file missing: ${status.expectedPath}`;
+    if (!status.hasPublicKey)
+        return `no public key enrolled in ${status.expectedPath}`;
+    if (status.administrator && (!status.systemFullControl || !status.administratorsFullControl)) {
+        return `${status.expectedPath} ACL must grant FullControl to SYSTEM and Administrators`;
+    }
+    if (status.administrator && status.unexpectedAclPrincipals.length > 0) {
+        return `${status.expectedPath} ACL grants access to unexpected principals: ${status.unexpectedAclPrincipals.join(', ')}`;
+    }
+    return null;
+}

package/dist/lib/exec.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/exec.bench.js

@@ -0,0 +1,186 @@
+/**
+ * Benchmark for the agent-execution hot path: env construction (buildExecEnv),
+ * argv assembly (buildExecCommand), and process spawn (execAgent -> spawnAgent).
+ *
+ * No mocking. Runs against this machine's REAL ~/.agents layout — the actual
+ * agents.yaml (state.ts:1124 readMeta), the actual installed version homes
+ * under ~/.agents/.history/versions/<agent>/ (versions.ts:1284
+ * listInstalledVersions), and, for the spawn group, the actual installed
+ * `claude` binary. `process.cwd()` during a real `vitest bench` run is this
+ * package's directory inside whatever checkout invoked it (typically several
+ * levels deep under a git worktree), so the project-version directory walk in
+ * versions.ts:2287 getProjectVersion runs its REAL depth here, not a synthetic
+ * shallow stub.
+ *
+ * The dominant, measured cost driver in buildExecEnv turned out to be neither
+ * of the two caches below on their own -- it's claude-account-token.ts:51
+ * resolveClaudeSetupToken(), called from exec.ts:424 for EVERY resolved claude
+ * version (pinned or auto-resolved) whose version home has a signed-in
+ * account. It is entirely uncached: each call re-derives an AES key via
+ * `scryptSync` (secrets/filestore.ts:208-210, invoked from
+ * decryptForFallback at secrets/filestore.ts:230-240) to decrypt the
+ * file-backed `auth` secrets bundle. Measured standalone (a one-off
+ * `performance.now()` probe against the real bundle, not part of this
+ * benchmark file): ~150-170ms per call, first call and every call after —
+ * scrypt is deliberately memory-hard/slow and nothing memoizes the derived
+ * key or the decrypted token across calls. A version home with NO signed-in
+ * account short-circuits at claude-account-token.ts:56-57
+ * (readClaudeAccountEmail returns null) before ever reaching the decrypt, so
+ * the SAME code path costs ~0.07ms or ~150ms purely depending on whether that
+ * specific version is logged in — that split, not warm/cold cache state, is
+ * the headline finding, so it is what this file isolates directly with two
+ * explicit version pins discovered from the real ~/.agents/.history/versions/
+ * layout: `loggedInClaudeVersion` and `loggedOutClaudeVersion`.
+ *
+ * Two cache regimes are ALSO benchmarked, because they cost meaningfully
+ * different amounts on top of the above:
+ *
+ *   - WARM: state.ts:1124 readMeta()'s mtime-keyed cache and actor.ts:163
+ *     resolveActor()'s process-lifetime cache are both hot. This is the
+ *     steady state inside one long-lived orchestrator process that calls
+ *     buildExecEnv many times (loop.ts:214, teams, runner.ts:720).
+ *   - COLD: both caches invalidated before every sample, matching the FIRST
+ *     buildExecEnv call in a freshly spawned `agents run` process -- the
+ *     common case, since every real CLI invocation is its own process.
+ *     Measured here it costs about the same as warm (readMeta's re-parse of a
+ *     ~5KB agents.yaml and a fresh actor resolve are both sub-millisecond) --
+ *     NOT because the invalidation is a no-op, but because this shell's
+ *     process.env already carries `AGENTS_ACTOR=UNRESOLVED@zion` (inherited
+ *     from the agent harness that launched this session), so actor.ts:149
+ *     `inheritedActor(env)` returns immediately and computeActor() never
+ *     reaches the SSH branch. A genuinely fresh interactive terminal (no
+ *     inherited AGENTS_ACTOR) would instead hit actor.ts:152-154 and, on an
+ *     SSH-connected box (SSH_CONNECTION set), pay actor.ts:62 tailscaleWhois()
+ *     — a real `spawnSync('tailscale', ['whois', ...])` subprocess capped at
+ *     2s (actor.ts:53 WHOIS_TIMEOUT_MS) — on that literal first call. That
+ *     cost is real but environment-dependent and not reproduced by this bench
+ *     run; it is called out here rather than silently assumed.
+ *
+ * The execAgent group spawns the REAL installed `claude` binary (real fork+exec,
+ * real buildExecEnv/buildExecCommand output) with `passthroughArgs: ['--version']`
+ * appended. Claude's own arg parsing short-circuits on `--version` before doing
+ * any network/session work (verified: `claude -p "x" --permission-mode plan
+ * --version` exits in ~0.2s printing only the version string) — this measures
+ * exec.ts's own spawn overhead without paying for (or depending on) a real,
+ * non-deterministic, network-bound agent conversation.
+ */
+import { describe, bench } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { buildExecEnv, buildExecCommand, execAgent } from './exec.js';
+import { resetActorCache } from './actor.js';
+import { getUserAgentsDir, getHistoryDir } from './state.js';
+import { listInstalledVersions } from './versions.js';
+function execOpts(over) {
+    return { mode: 'plan', effort: 'auto', cwd: process.cwd(), ...over };
+}
+// Discovered from the REAL version-home layout so this bench runs unmodified
+// on any dev box (or degrades gracefully when nothing is installed, e.g. a
+// bare CI runner -- this file is not wired into `vitest run`, see
+// vitest.config.ts:9, so that only matters for a human running it locally).
+const installedClaudeVersions = listInstalledVersions('claude');
+const installedCodex = listInstalledVersions('codex').at(-1);
+/**
+ * Whether a claude version's home has a resolvable oauth account email
+ * (claude-account-token.ts:29 readClaudeAccountEmail's own check), WITHOUT
+ * going through the secrets bundle at all -- this only reads the plaintext
+ * `.claude.json` account marker, never a secret value, so it is safe to run
+ * as bench setup and never prints anything sensitive.
+ */
+function hasResolvableAccount(version) {
+    const home = path.join(getHistoryDir(), 'versions', 'claude', version, 'home');
+    for (const p of [path.join(home, '.claude', '.claude.json'), path.join(home, '.claude.json')]) {
+        try {
+            const email = JSON.parse(fs.readFileSync(p, 'utf-8')).oauthAccount?.emailAddress;
+            if (typeof email === 'string' && email.trim().length > 0)
+                return true;
+        }
+        catch { /* try the next candidate path */ }
+    }
+    return false;
+}
+const loggedInClaudeVersion = installedClaudeVersions.find(hasResolvableAccount);
+const loggedOutClaudeVersion = installedClaudeVersions.find((v) => !hasResolvableAccount(v));
+const metaFile = path.join(getUserAgentsDir(), 'agents.yaml');
+/**
+ * Force the next buildExecEnv call to pay full cold-start cost: clears the
+ * process-lifetime actor cache (actor.ts:157 `cached`) and bumps agents.yaml's
+ * mtime so state.ts:1130 readMeta()'s stamp check misses and it re-parses --
+ * exactly the "another process touched the file" invalidation path the module
+ * doc at state.ts:1120 describes.
+ *
+ * tinybench's bench-level `setup` hook (the only per-task hook vitest's
+ * `bench(name, fn, options)` actually exposes -- `beforeEach`/`afterEach` are
+ * tinybench's internal per-Task `FnOptions`, not part of the `Options` shape
+ * vitest forwards, and using them here is a type error) fires ONCE before a
+ * task's `run()`, not once per sample. So to measure a genuinely cold call
+ * rather than one cold sample diluted into a mean with many warm ones, every
+ * cold bench() below pairs this `setup` with `{ iterations: 1, time: 1,
+ * warmupIterations: 0, warmupTime: 0 }` -- no warmup, and a near-zero time
+ * budget so the run loop stops as soon as its 1-sample floor is met.
+ */
+function invalidateCaches(_task, mode) {
+    if (mode !== 'run')
+        return;
+    resetActorCache();
+    try {
+        const now = new Date();
+        fs.utimesSync(metaFile, now, now);
+    }
+    catch {
+        // No ~/.agents/agents.yaml on this box -- readMeta() has nothing cached
+        // to invalidate either, so the cold/warm distinction collapses; proceed.
+    }
+}
+/** Bench options for a single, genuinely-cold sample — see invalidateCaches doc. */
+const COLD_SAMPLE_OPTS = { setup: invalidateCaches, iterations: 1, time: 1, warmupIterations: 0, warmupTime: 0 };
+describe.skipIf(!loggedInClaudeVersion || !loggedOutClaudeVersion)('buildExecEnv — resolveClaudeSetupToken cost split (exec.ts:424, claude-account-token.ts:51): same code path, signed-in vs not', () => {
+    bench('pinned version WITH a signed-in account (pays the uncached scrypt decrypt every call)', () => {
+        buildExecEnv(execOpts({ agent: 'claude', version: loggedInClaudeVersion, sessionId: randomUUID() }));
+    });
+    bench('pinned version WITHOUT a signed-in account (readClaudeAccountEmail short-circuits, claude-account-token.ts:56)', () => {
+        buildExecEnv(execOpts({ agent: 'claude', version: loggedOutClaudeVersion, sessionId: randomUUID() }));
+    });
+});
+describe('buildExecEnv — warm cache (steady state: loop.ts/teams/runner calling it repeatedly in one process)', () => {
+    bench('claude, auto-resolved version (resolveVersion + isVersionInstalled + resolveClaudeSetupToken chain)', () => {
+        buildExecEnv(execOpts({ agent: 'claude', sessionId: randomUUID() }));
+    });
+    bench('codex, explicit pinned version (no claude-account-token path at all)', () => {
+        buildExecEnv(execOpts({ agent: 'codex', version: installedCodex ?? '0.146.0', sessionId: randomUUID() }));
+    });
+    bench('codex, auto-resolved version', () => {
+        buildExecEnv(execOpts({ agent: 'codex', sessionId: randomUUID() }));
+    });
+});
+describe('buildExecEnv — cold cache (single sample: the first call in a fresh `agents run` process)', () => {
+    bench('claude, auto-resolved version', () => {
+        buildExecEnv(execOpts({ agent: 'claude', sessionId: randomUUID() }));
+    }, COLD_SAMPLE_OPTS);
+    bench.skipIf(!loggedOutClaudeVersion)('claude, pinned version WITHOUT a signed-in account (isolates readMeta+actor cold cost from the scrypt cost above)', () => {
+        buildExecEnv(execOpts({ agent: 'claude', version: loggedOutClaudeVersion, sessionId: randomUUID() }));
+    }, COLD_SAMPLE_OPTS);
+});
+describe('buildExecCommand — argv assembly (runs immediately before spawn in spawnAgent, exec.ts:1745)', () => {
+    bench('claude headless, explicit pinned version', () => {
+        buildExecCommand(execOpts({
+            agent: 'claude', version: loggedOutClaudeVersion ?? installedClaudeVersions.at(-1) ?? '2.1.221', prompt: 'benchmark prompt', sessionId: randomUUID(),
+        }));
+    });
+    bench('claude headless, auto-resolved version + model tier (re-walks resolveVersion a second time, exec.ts:972)', () => {
+        buildExecCommand(execOpts({
+            agent: 'claude', prompt: 'benchmark prompt', model: 'sonnet', sessionId: randomUUID(),
+        }));
+    });
+});
+describe.skipIf(!loggedOutClaudeVersion)('execAgent — real subprocess spawn (real claude binary; --version passthrough keeps it network-free)', () => {
+    bench('claude headless spawn, pinned version without a signed-in account (isolates spawn overhead from the scrypt cost above)', async () => {
+        await execAgent(execOpts({
+            agent: 'claude',
+            version: loggedOutClaudeVersion,
+            prompt: 'benchmark prompt',
+            passthroughArgs: ['--version'],
+        }));
+    }, { time: 3000, iterations: 15 });
+});

package/dist/lib/exec.js

@@ -31,6 +31,7 @@ import { isTmuxInstalled } from './tmux/binary.js';
 import { shellQuote } from './ssh-exec.js';
 import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
+import { applyActiveRulesPresetAtRun } from './rules/run-sync.js';
 /**
  * Map a raw mode string (CLI flag, YAML field, env var) to the canonical Mode.
  *
@@ -967,6 +968,12 @@ export function buildExecCommand(options) {
             // on the default command is parsed as a project path, not a message.
             cmd.push('--prompt', options.prompt);
         }
+        else if (interactive && options.agent === 'claude') {
+            // Claude's -p is --print, not a prompt-value flag. In an interactive run
+            // the initial prompt is positional; emitting `-p /continue <id>` turns a
+            // focus recovery into a one-shot print process that immediately exits.
+            cmd.push(options.prompt);
+        }
         else if (template.promptFlag === 'positional') {
             cmd.push(options.prompt);
         }
@@ -1285,7 +1292,7 @@ export function formatPaneTail(raw, maxLines = 30) {
  *      (Ctrl-b d) — return 0 and LEAVE the session for `agents focus` to re-attach.
  */
 async function runInTmux(options, executable, args) {
-    const { createSession, hasSession, killSession, paneExitStatus, setSessionHook, slugifyName, agentPaneDiedHook, markSessionHookSchema } = await import('./tmux/session.js');
+    const { createSession, killSession, paneExitStatus, prepareSessionForResume, setSessionHook, slugifyName, agentPaneDiedHook, markSessionHookSchema } = await import('./tmux/session.js');
     const { getDefaultSocketPath } = await import('./tmux/paths.js');
     const { attachTmux, runTmux } = await import('./tmux/binary.js');
     const socket = getDefaultSocketPath();
@@ -1294,15 +1301,11 @@ async function runInTmux(options, executable, args) {
     const name = slugifyName(`ag-${options.agent}-${idSeed}`);
     // A native resume must not create a competing wrapper for a live session.
     // A retained dead pane is reaped before the harness resumes normally.
-    if (options.resume && await hasSession(name, socket)) {
-        const existing = await createSession({ name, cwd, socket, source: 'cli', attachExisting: true });
+    if (options.resume && await prepareSessionForResume(name, socket) === 'attach') {
         if (options.sessionId)
             writeSessionAliasRecord(options.sessionId, name);
-        if (!existing.pane || !(await paneExitStatus(existing.pane, socket)).dead) {
-            await attachTmux({ socket, args: ['attach-session', '-t', name] });
-            return { exitCode: 0, stderr: '', stdout: '' };
-        }
-        await killSession(name, socket);
+        await attachTmux({ socket, args: ['attach-session', '-t', name] });
+        return { exitCode: 0, stderr: '', stdout: '' };
     }
     // SessionStart learns some harness IDs only after launch. Carry the wrapper
     // name into that hook so it can bind both identities durably.
@@ -1980,6 +1983,13 @@ export async function runWithFallback(options) {
     }
     for (let i = 0; i < chain.length; i++) {
         const { agent, version, envOverride } = chain[i];
+        // Every fallback entry can target a different harness/version home. Sync
+        // its active preset immediately before dispatch so entries 2..N cannot
+        // inherit the stale rules file left by the primary entry.
+        const rulesVersion = version ?? resolveVersion(agent);
+        if (rulesVersion) {
+            applyActiveRulesPresetAtRun(agent, rulesVersion, getVersionHomePath(agent, rulesVersion));
+        }
         // Record the entry we're about to attempt so the caller (audit log) sees the
         // agent+version that actually ran, even after a rate-limit handoff.
         if (options.dispatchSink) {

package/dist/lib/fleet/apply.js

@@ -9,7 +9,7 @@
  */
 import * as os from 'os';
 import { pushBundleToHost } from '../secrets/push.js';
-import { sshTargetFor } from '../devices/connect.js';
+import { deviceIdentityArgs, sshTargetFor } from '../devices/connect.js';
 import { readyProbe, bootstrapAgentsCli } from '../hosts/ready.js';
 import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
 import { sshExec } from '../ssh-exec.js';
@@ -282,13 +282,14 @@ export function probeDevice(device, opts) {
         return { device: device.name, reachable: false, platform: device.platform, installedAgents: [], note: e.message };
     }
     const hint = osHint(device.platform);
-    const ready = readyProbe(target, hint);
+    const extraSshArgs = deviceIdentityArgs(device);
+    const ready = readyProbe(target, hint, extraSshArgs);
     if (!ready.reachable) {
         return { device: device.name, reachable: false, platform: device.platform, installedAgents: [], note: 'unreachable' };
     }
     let installed = [];
     const remoteCmd = buildRemoteAgentsInvocation(['teams', 'doctor', '--json'], undefined, hint, remoteEnv(device.platform));
-    const res = sshExec(target, remoteCmd, { timeoutMs: 30000, multiplex: true });
+    const res = sshExec(target, remoteCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
     if (res.code === 0) {
         try {
             const map = JSON.parse(res.stdout);
@@ -301,7 +302,7 @@ export function probeDevice(device, opts) {
     let installedVersions;
     if (opts?.withVersions) {
         const viewCmd = buildRemoteAgentsInvocation(['view', '--json'], undefined, hint, remoteEnv(device.platform));
-        const vres = sshExec(target, viewCmd, { timeoutMs: 30000, multiplex: true });
+        const vres = sshExec(target, viewCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
         if (vres.code === 0)
             installedVersions = parseInstalledVersions(vres.stdout);
     }
@@ -310,7 +311,7 @@ export function probeDevice(device, opts) {
         // Metadata only — `secrets list --json` returns names + timestamps and never
         // values, which is why this is safe to run across the fleet.
         const listCmd = buildRemoteAgentsInvocation(['secrets', 'list', '--json'], undefined, hint, remoteEnv(device.platform));
-        const lres = sshExec(target, listCmd, { timeoutMs: 30000, multiplex: true });
+        const lres = sshExec(target, listCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
         if (lres.code === 0)
             remoteBundles = parseRemoteBundles(lres.stdout);
     }
@@ -382,12 +383,13 @@ export function reconcileDevice(row, device, ctx) {
     }
     const hint = osHint(device.platform);
     const env = remoteEnv(device.platform);
+    const extraSshArgs = deviceIdentityArgs(device);
     let ok = true;
-    const sshAgents = (args, input) => sshExec(target, buildRemoteAgentsInvocation(args, undefined, hint, env), { timeoutMs: 300000, multiplex: true, input });
+    const sshAgents = (args, input) => sshExec(target, buildRemoteAgentsInvocation(args, undefined, hint, env), { timeoutMs: 300000, multiplex: true, input, extraSshArgs });
     // 1. agents-cli install/upgrade.
     const cliAction = row.actions.find((a) => a.kind === 'install-cli' || a.kind === 'upgrade-cli');
     if (cliAction) {
-        const r = bootstrapAgentsCli(target, ctx.targetCliVersion, hint);
+        const r = bootstrapAgentsCli(target, ctx.targetCliVersion, hint, extraSshArgs);
         steps.push({ kind: cliAction.kind, ok: r.ok, detail: cliAction.detail });
         ok = ok && r.ok;
     }

package/dist/lib/fleet/remote-login.d.ts

@@ -44,6 +44,7 @@ export interface PendingLogin {
     platform?: string;
     /** ssh dial target for the device. */
     target: string;
+    extraSshArgs?: string[];
     flow: LoginFlow;
     /** True when a device-code flow this command can actually drive. */
     remotable: boolean;
@@ -75,7 +76,7 @@ export declare function selectLoginTargets(devices: DeviceProfile[], agents: (Ag
  * devices need the askpass shim env, which the PTY env allowlist strips — those
  * are a follow-up (TODO), surfaced as an error rather than silently mis-driven.
  */
-export declare function buildRemoteLoginSshCommand(target: string, flow: LoginFlow): string;
+export declare function buildRemoteLoginSshCommand(target: string, flow: LoginFlow, extraSshArgs?: string[]): string;
 export type LoginMode = 'bulk' | 'interactive';
 /** Per-pair status shape shared between the driver, the status endpoint, and the page. */
 export type LoginStatusState = 'pending' | 'driving' | 'ready' | 'authorized' | 'error' | 'skipped';
@@ -138,7 +139,7 @@ export interface DriveResult extends ScrapedLogin {
  * in the browser; the caller polls the credential file for completion. Testable
  * against a fake {@link PtyDriver}.
  */
-export declare function driveRemoteLogin(target: string, flow: LoginFlow, driver: PtyDriver, opts?: DriveOptions): Promise<DriveResult>;
+export declare function driveRemoteLogin(target: string, flow: LoginFlow, driver: PtyDriver, opts?: DriveOptions, extraSshArgs?: string[]): Promise<DriveResult>;
 export interface DetectOptions {
     agents?: (AgentId | string)[];
     devices?: string[];
@@ -157,7 +158,7 @@ export declare function detectPending(opts?: DetectOptions): Promise<PendingLogi
  * bumping after the human completes the browser step. POSIX `stat` only (the
  * device-code agents are all POSIX-fleet).
  */
-export declare function remoteFileMtime(target: string, homeRel: string): Promise<number>;
+export declare function remoteFileMtime(target: string, homeRel: string, extraSshArgs?: string[]): Promise<number>;
 export interface RunFleetLoginOptions {
     agents?: (AgentId | string)[];
     devices?: string[];

package/dist/lib/fleet/remote-login.js

@@ -29,7 +29,7 @@
 import * as http from 'http';
 import { isControlDevice } from '../devices/registry.js';
 import { loadDevices } from '../devices/registry.js';
-import { fleetDialTarget } from '../devices/connect.js';
+import { deviceIdentityArgs, fleetDialTarget } from '../devices/connect.js';
 import { planFleetTargets } from '../devices/fleet.js';
 import { assertValidSshTarget, shellQuote, sshExecAsync } from '../ssh-exec.js';
 import { machineId } from '../session/sync/config.js';
@@ -134,6 +134,7 @@ export function selectLoginTargets(devices, agents, cache, opts = {}) {
                 agent,
                 platform: device.platform,
                 target: fleetDialTarget(device),
+                extraSshArgs: deviceIdentityArgs(device),
                 flow,
                 remotable,
                 reason,
@@ -152,7 +153,7 @@ export function selectLoginTargets(devices, agents, cache, opts = {}) {
  * devices need the askpass shim env, which the PTY env allowlist strips — those
  * are a follow-up (TODO), surfaced as an error rather than silently mis-driven.
  */
-export function buildRemoteLoginSshCommand(target, flow) {
+export function buildRemoteLoginSshCommand(target, flow, extraSshArgs = []) {
     assertValidSshTarget(target);
     // The agent CLIs (kimi/droid/codex/…) are agents-cli shims that live in
     // ~/.agents/.cache/shims and are only on PATH in an interactive/login shell.
@@ -165,6 +166,7 @@ export function buildRemoteLoginSshCommand(target, flow) {
         'ssh', '-tt',
         '-o', 'StrictHostKeyChecking=accept-new',
         '-o', 'ConnectTimeout=10',
+        ...extraSshArgs.map(shellQuote),
         shellQuote(target),
         shellQuote(remoteCmd),
     ].join(' ');
@@ -367,7 +369,7 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
  * in the browser; the caller polls the credential file for completion. Testable
  * against a fake {@link PtyDriver}.
  */
-export async function driveRemoteLogin(target, flow, driver, opts = {}) {
+export async function driveRemoteLogin(target, flow, driver, opts = {}, extraSshArgs = []) {
     const initialDelayMs = opts.initialDelayMs ?? 4000;
     const pollMs = opts.pollMs ?? 1000;
     const timeoutMs = opts.timeoutMs ?? 90000;
@@ -377,7 +379,7 @@ export async function driveRemoteLogin(target, flow, driver, opts = {}) {
     // `ssh -tt` process it drives) leaks until the sidecar's idle reaper. On the
     // normal return paths the caller owns stop() via the returned sessionId.
     try {
-        await driver.exec(id, buildRemoteLoginSshCommand(target, flow));
+        await driver.exec(id, buildRemoteLoginSshCommand(target, flow, extraSshArgs));
         await sleep(initialDelayMs);
         if (flow.deviceCodeSelect) {
             await driver.write(id, flow.deviceCodeSelect);
@@ -431,9 +433,9 @@ export async function detectPending(opts = {}) {
  * bumping after the human completes the browser step. POSIX `stat` only (the
  * device-code agents are all POSIX-fleet).
  */
-export async function remoteFileMtime(target, homeRel) {
+export async function remoteFileMtime(target, homeRel, extraSshArgs = []) {
     const cmd = `stat -c %Y "$HOME/${homeRel}" 2>/dev/null || stat -f %m "$HOME/${homeRel}" 2>/dev/null || echo 0`;
-    const res = await sshExecAsync(target, cmd, { timeoutMs: 15000, multiplex: true }).catch(() => null);
+    const res = await sshExecAsync(target, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs }).catch(() => null);
     if (!res || res.code !== 0)
         return 0;
     const n = parseInt(res.stdout.trim(), 10);
@@ -507,10 +509,10 @@ export async function runFleetLogin(opts = {}) {
         const k = key(p.device, p.agent);
         const st = statuses.get(k);
         st.state = 'driving';
-        const baseMtime = await remoteFileMtime(p.target, p.flow.successFile).catch(() => 0);
+        const baseMtime = await remoteFileMtime(p.target, p.flow.successFile, p.extraSshArgs).catch(() => 0);
         let sessionId;
         try {
-            const r = await driveRemoteLogin(p.target, p.flow, driver, opts.drive);
+            const r = await driveRemoteLogin(p.target, p.flow, driver, opts.drive, p.extraSshArgs);
             sessionId = r.sessionId;
             if (r.url && r.code) {
                 st.url = r.url;
@@ -539,7 +541,7 @@ export async function runFleetLogin(opts = {}) {
                 st.detail = 'device code expired before authorization';
                 break;
             }
-            const mtime = await remoteFileMtime(p.target, p.flow.successFile).catch(() => 0);
+            const mtime = await remoteFileMtime(p.target, p.flow.successFile, p.extraSshArgs).catch(() => 0);
             if (mtime > baseMtime) {
                 st.state = 'authorized';
                 break;

package/dist/lib/gemini-settings.d.ts

@@ -1,4 +1,3 @@
 export declare function readGeminiSettings(settingsPath: string): Record<string, unknown>;
 export declare function writeGeminiSettings(settingsPath: string, settings: Record<string, unknown>): void;
 export declare function updateGeminiSettings(settingsPath: string, mutate: (settings: Record<string, unknown>) => void): Record<string, unknown>;
-export declare function setGeminiAutoUpdateDisabled(settings: Record<string, unknown>): void;

package/dist/lib/gemini-settings.js

@@ -1,3 +1,15 @@
+/**
+ * Generic reader/writer for a `.gemini/…/settings.json`-shaped JSON config.
+ *
+ * Despite the name, this module is no longer gemini-specific: gemini itself
+ * is hard-deprecated and has no live caller left (its own settings writer,
+ * `generateGeminiConfig`, was removed with the RUSH-2202 runner.ts fix — a
+ * gemini routine is rejected before it ever reaches sandbox prep). Antigravity
+ * nests its own `settings.json` under the same `.gemini/antigravity-cli/` tree
+ * and shares this exact shape, so `permissions.ts` reuses `updateGeminiSettings`
+ * for antigravity's live permission writes. Keep the generic helpers; do not
+ * reintroduce gemini-only logic here.
+ */
 import * as fs from 'fs';
 import * as path from 'path';
 function isRecord(value) {
@@ -24,10 +36,3 @@ export function updateGeminiSettings(settingsPath, mutate) {
     writeGeminiSettings(settingsPath, settings);
     return settings;
 }
-export function setGeminiAutoUpdateDisabled(settings) {
-    const general = isRecord(settings.general) ? settings.general : {};
-    settings.general = {
-        ...general,
-        enableAutoUpdate: false,
-    };
-}

package/dist/lib/hooks.d.ts

@@ -217,12 +217,15 @@ export declare function listCentralHooks(): HookEntry[];
  *
  * A bare number stays seconds (`timeout: 30` → 30) for backward compatibility.
  * A Go-style duration string is parsed into seconds: `5s`, `2m`, `1h30m`,
- * `90s`, `1h`. This intentionally does NOT reuse {@link parseTimeout} from
- * routines.ts — that one returns milliseconds, has no seconds (`s`) unit, and
- * floors at one minute, none of which fit hook timeouts (typically 5–600s).
+ * `90s`, `1h`. Suffixed durations longer than 24 hours are rejected as likely
+ * typos, while bare seconds stay uncapped for backward compatibility. This
+ * intentionally does NOT reuse {@link parseTimeout} from routines.ts — that one
+ * returns milliseconds, has no seconds (`s`) unit, and floors at one minute,
+ * none of which fit hook timeouts (typically 5–600s).
  *
- * Returns the seconds value, or `null` when the input is not a positive number
- * or a parseable duration string — the caller decides how to surface that.
+ * Returns the seconds value, or `null` when the input is not a positive number,
+ * is not parseable, or is a suffixed duration longer than 24 hours — the caller
+ * decides how to surface that.
  */
 export declare function normalizeHookTimeoutSeconds(value: unknown): number | null;
 /**