@phnx-labs/agents-cli 1.22.26 → 1.22.27

package/dist/lib/models.js

@@ -112,51 +112,8 @@ export function locateModelSource(agent, version) {
         }
         return null;
     }
-    if (agent === 'gemini') {
-        // <=0.41 shipped a clean ES module at @google/gemini-cli-core/dist/src/config/models.js.
-        // 0.42+ inlines the same constants into a minified chunk under @google/gemini-cli/bundle/.
-        const modelsJs = path.join(versionDir, 'node_modules', '@google', 'gemini-cli-core', 'dist', 'src', 'config', 'models.js');
-        if (fs.existsSync(modelsJs))
-            return { path: modelsJs, kind: 'js' };
-        const bundleDir = path.join(versionDir, 'node_modules', '@google', 'gemini-cli', 'bundle');
-        if (fs.existsSync(bundleDir)) {
-            try {
-                const entries = fs.readdirSync(bundleDir);
-                // The model constants live in a single chunk; pick the first .js file
-                // whose contents contain VALID_GEMINI_MODELS. Skip subdirectories.
-                for (const name of entries) {
-                    if (!name.endsWith('.js'))
-                        continue;
-                    const full = path.join(bundleDir, name);
-                    let stat;
-                    try {
-                        stat = fs.statSync(full);
-                    }
-                    catch {
-                        continue;
-                    }
-                    if (!stat.isFile())
-                        continue;
-                    // Most chunks just re-export the constants; only the defining chunk
-                    // actually has `var VALID_GEMINI_MODELS = ... new Set(`. Match that
-                    // shape so we pick the chunk that the extractor can parse.
-                    let body;
-                    try {
-                        body = fs.readFileSync(full, 'utf-8');
-                    }
-                    catch {
-                        continue;
-                    }
-                    if (/var\s+VALID_GEMINI_MODELS\s*=[^\n]*new\s+Set/.test(body) &&
-                        /var\s+DEFAULT_GEMINI_MODEL\s*=/.test(body)) {
-                        return { path: full, kind: 'js' };
-                    }
-                }
-            }
-            catch { /* unreadable bundle dir */ }
-        }
-        return null;
-    }
+    // gemini is hard-deprecated (no launch path left to validate a model
+    // against), so its bundle is deliberately not parsed for a catalog here.
     if (agent === 'opencode') {
         // The `opencode` shim under node_modules/.bin dispatches to a platform-
         // specific native binary. We don't parse the 100MB binary; we let the CLI
@@ -345,6 +302,45 @@ export function dropBareLegacyIds(ids) {
         return !(bareMajor && ids.some((o) => o !== id && o.startsWith(`${id}-`)));
     });
 }
+/**
+ * Scan raw binary/bundle text for canonical Claude model ids, then drop bare
+ * legacy prefixes (issue #1892). Two independent guards keep non-model strings
+ * out of the catalog:
+ *
+ *  - **Word-boundary anchors on the id regex.** The id must not be glued to a
+ *    surrounding identifier character, and must not be the truncated prefix of a
+ *    longer *version* token. `(?<![A-Za-z0-9_])` rejects a glued prefix;
+ *    `(?![A-Za-z0-9])` rejects a glued alnum suffix; `(?!\.\d)` rejects a
+ *    dotted-version continuation — so the bare-major prefix of the binary's own
+ *    "Typo in model ID" troubleshooting string `claude-sonnet-4.6` is not
+ *    scraped as `claude-sonnet-4`, while a real id followed by an unrelated `.`
+ *    suffix (`claude-fable-5.md`) still matches. Dash-separated segments only:
+ *    the dotted form never appears in a genuine id.
+ *
+ *    The id body is captured inside a lookahead (`(?=(...))\1`) so the greedy
+ *    `-\d+` run matches **atomically**: without it, a suffix-glued token like
+ *    `claude-opus-4-1x` would fail the trailing anchor on the full match, then
+ *    backtrack a segment and re-emit the bare `claude-opus-4` — the exact 404-able
+ *    id this scan exists to suppress (two packed strings can end up glued with no
+ *    separator in the extracted binary text). The atomic match fails outright
+ *    instead of degrading to the bare form.
+ *  - **`dropBareLegacyIds`.** A standalone `.includes("claude-opus-4")` prefix
+ *    check is a fully delimited string the anchors cannot tell apart from a real
+ *    bare id, so a bare `claude-<family>-<major>` is dropped only when a
+ *    more-specific sibling (`claude-opus-4-8`) is also present; a genuinely bare
+ *    current id with no sibling (`claude-sonnet-5`) is kept.
+ */
+export function scanClaudeCatalogIds(text) {
+    const idRe = /(?<![A-Za-z0-9_])(?=(claude-(?:opus|sonnet|haiku|fable|mythos)-\d+(?:-\d+)*(?:-(?:fast|v\d+))?))\1(?![A-Za-z0-9])(?!\.\d)/g;
+    const scanned = new Set();
+    let sm;
+    while ((sm = idRe.exec(text)) !== null) {
+        scanned.add(sm[0]);
+        if (sm.index === idRe.lastIndex)
+            idRe.lastIndex++;
+    }
+    return dropBareLegacyIds([...scanned]);
+}
 function extractClaudeCatalog(text) {
     const aliases = {};
     const aliasMapMatch = text.match(/\{opus:"(claude-[^"]+)",sonnet:"(claude-[^"]+)",haiku:"(claude-[^"]+)"\}/);
@@ -406,16 +402,7 @@ function extractClaudeCatalog(text) {
     // catalog while a newer one still gets a real catalog (incl. fable/mythos and
     // the opus-5/sonnet-5 line) rather than an empty or single-model one.
     if (models.length < 2) {
-        const scanned = new Set();
-        // Dash-separated segments only. Real ids are `claude-sonnet-4-6`; the dotted
-        // form `claude-sonnet-4.6` appears only inside the binary's own "Typo in
-        // model ID" troubleshooting text, so a `.`-permitting pattern would scrape a
-        // non-model string as if it were real.
-        const idRe = /claude-(?:opus|sonnet|haiku|fable|mythos)-\d+(?:-\d+)*(?:-(?:fast|v\d+))?/g;
-        let sm;
-        while ((sm = idRe.exec(text)) !== null)
-            scanned.add(sm[0]);
-        const filtered = dropBareLegacyIds([...scanned]);
+        const filtered = scanClaudeCatalogIds(text);
         if (filtered.length >= 2)
             models = build(filtered);
     }
@@ -460,85 +447,6 @@ function extractCodexCatalog(text) {
     }
     return { models, aliases: {} };
 }
-/**
- * Extract Gemini's model catalog from `@google/gemini-cli-core/.../config/models.js`.
- *
- * The module exports a set of named constants (e.g. `DEFAULT_GEMINI_MODEL`,
- * `PREVIEW_GEMINI_FLASH_MODEL`) plus a `VALID_GEMINI_MODELS` Set and a handful
- * of `GEMINI_MODEL_ALIAS_*` strings. We parse it with regex (a JS-module import
- * would pollute the runtime and ES-module interop is awkward from a CJS build).
- */
-function extractGeminiCatalog(text) {
-    // Old (<=0.41) layout used `export const FOO = 'bar';` in models.js.
-    // New (0.42+) bundle inlines the same constants as `var FOO = "bar";`.
-    const constRe = /(?:export\s+const|var)\s+([A-Z0-9_]+)\s*=\s*['"]([^'"]+)['"]/g;
-    const constants = new Map();
-    let m;
-    while ((m = constRe.exec(text)) !== null) {
-        constants.set(m[1], m[2]);
-    }
-    // The set of ids the CLI accepts as "valid model names". Names (not values)
-    // are listed inside `new Set([...])`, so we expand them via the constants map.
-    const validIds = new Set();
-    const setBlock = text.match(/VALID_GEMINI_MODELS\s*=\s*(?:\/\*[^*]*\*\/\s*)?new\s+Set\(\[([\s\S]*?)\]\)/);
-    if (setBlock) {
-        const nameRe = /([A-Z0-9_]+)/g;
-        let nm;
-        while ((nm = nameRe.exec(setBlock[1])) !== null) {
-            const id = constants.get(nm[1]);
-            if (id)
-                validIds.add(id);
-        }
-    }
-    // Fall back to any gemini-shaped id we saw in the constants map -- useful
-    // when the Set shape changes across gemini versions.
-    if (validIds.size === 0) {
-        for (const [name, value] of constants) {
-            if (/^(DEFAULT_|PREVIEW_)/.test(name) && /^gemini-/.test(value)) {
-                validIds.add(value);
-            }
-        }
-    }
-    // Aliases are exported as `GEMINI_MODEL_ALIAS_FLASH = 'flash'` etc. The alias
-    // is the *value*; the target model is resolved at runtime by `resolveModel()`.
-    // We replicate that logic here so callers get a concrete id per alias.
-    const defaultId = constants.get('DEFAULT_GEMINI_MODEL');
-    const previewPro = constants.get('PREVIEW_GEMINI_MODEL');
-    const previewFlash = constants.get('PREVIEW_GEMINI_FLASH_MODEL');
-    const flashLite = constants.get('DEFAULT_GEMINI_FLASH_LITE_MODEL');
-    const aliases = {};
-    if (previewPro) {
-        aliases.auto = previewPro;
-        aliases.pro = previewPro;
-    }
-    if (previewFlash)
-        aliases.flash = previewFlash;
-    if (flashLite)
-        aliases['flash-lite'] = flashLite;
-    const aliasReverse = {};
-    for (const [alias, id] of Object.entries(aliases)) {
-        (aliasReverse[id] ||= []).push(alias);
-    }
-    const defaults = new Set();
-    if (defaultId)
-        defaults.add(defaultId);
-    if (previewPro)
-        defaults.add(previewPro); // auto/pro alias resolves here
-    const displayNameFor = (id) => {
-        // Gemini has a `getDisplayString` for some aliases but the canonical id
-        // is human-readable enough ("gemini-3-pro-preview") -- no separate map.
-        return undefined;
-    };
-    const models = Array.from(validIds)
-        .sort()
-        .map((id) => ({
-        id,
-        displayName: displayNameFor(id),
-        alias: aliasReverse[id]?.[0],
-        isDefault: defaults.has(id),
-    }));
-    return { models, aliases };
-}
 /**
  * Extract OpenCode's catalog by invoking `opencode models --verbose`. The
  * output is a sequence of `<provider>/<id>\n{json}` blocks -- we parse every
@@ -1042,16 +950,6 @@ export function getModelCatalog(agent, version) {
                 : agent === 'codex' ? extractCodexCatalog(text)
                     : { models: [], aliases: {} });
     }
-    else if (src.kind === 'js') {
-        try {
-            const text = fs.readFileSync(src.path, 'utf-8');
-            if (agent === 'gemini')
-                ({ models, aliases } = extractGeminiCatalog(text));
-        }
-        catch {
-            /* unreadable */
-        }
-    }
     else if (src.kind === 'cli') {
         if (agent === 'opencode')
             ({ models, aliases } = extractOpenCodeCatalog(src.path));

package/dist/lib/pricing/cost.d.ts

@@ -14,6 +14,15 @@ export interface TokenUsage {
  * convention for models that don't publish a separate cache price).
  */
 export declare function costOfUsage(u: TokenUsage): number;
+/**
+ * USD cost of one usage record priced as if caching were OFF: cache-read and
+ * cache-write tokens are billed at the model's full INPUT rate rather than their
+ * discounted cache rates. This is the "what would this have cost with no prompt
+ * caching?" scenario that `agents output --pricing no-cache` models. Output and
+ * uncached input are unchanged — only the cache tokens are repriced. Returns 0
+ * for a missing/unpriced model, exactly like {@link costOfUsage}.
+ */
+export declare function costOfUsageNoCache(u: TokenUsage): number;
 /** Sum the USD cost of every usage record in a session. */
 export declare function costOfSession(usages: TokenUsage[]): number;
 /**

package/dist/lib/pricing/cost.js

@@ -31,6 +31,30 @@ export function costOfUsage(u) {
         cacheRead * cacheReadRate +
         cacheWrite * cacheWriteRate);
 }
+/**
+ * USD cost of one usage record priced as if caching were OFF: cache-read and
+ * cache-write tokens are billed at the model's full INPUT rate rather than their
+ * discounted cache rates. This is the "what would this have cost with no prompt
+ * caching?" scenario that `agents output --pricing no-cache` models. Output and
+ * uncached input are unchanged — only the cache tokens are repriced. Returns 0
+ * for a missing/unpriced model, exactly like {@link costOfUsage}.
+ */
+export function costOfUsageNoCache(u) {
+    if (!u.model)
+        return 0;
+    const pricing = getModelPricing(u.model);
+    if (!pricing)
+        return 0;
+    const input = u.inputTokens ?? 0;
+    const output = u.outputTokens ?? 0;
+    const cacheRead = u.cacheReadTokens ?? 0;
+    const cacheWrite = u.cacheCreationTokens ?? 0;
+    // Cache tokens repriced at the input rate — no caching discount applied.
+    return (input * pricing.inputPerToken +
+        output * pricing.outputPerToken +
+        cacheRead * pricing.inputPerToken +
+        cacheWrite * pricing.inputPerToken);
+}
 /** Sum the USD cost of every usage record in a session. */
 export function costOfSession(usages) {
     let total = 0;

package/dist/lib/pricing/index.d.ts

@@ -5,4 +5,4 @@
  * enforcement) imports against — keep it stable.
  */
 export { type ModelPricing, PRICING_VERSION, getModelPricing, listPricedModels, } from './table.js';
-export { type TokenUsage, costOfUsage, costOfSession, formatUsd, estimateCost, actualCost, isModelPriced, } from './cost.js';
+export { type TokenUsage, costOfUsage, costOfUsageNoCache, costOfSession, formatUsd, estimateCost, actualCost, isModelPriced, } from './cost.js';

package/dist/lib/pricing/index.js

@@ -5,4 +5,4 @@
  * enforcement) imports against — keep it stable.
  */
 export { PRICING_VERSION, getModelPricing, listPricedModels, } from './table.js';
-export { costOfUsage, costOfSession, formatUsd, estimateCost, actualCost, isModelPriced, } from './cost.js';
+export { costOfUsage, costOfUsageNoCache, costOfSession, formatUsd, estimateCost, actualCost, isModelPriced, } from './cost.js';

package/dist/lib/redact.js

@@ -13,9 +13,14 @@ const SECRET_PATTERNS = [
     [/\bghp_[A-Za-z0-9]{36}\b/g, '[REDACTED_GITHUB_TOKEN]'],
     [/\bgh[osru]_[A-Za-z0-9]{36}\b/g, '[REDACTED_GITHUB_TOKEN]'],
     [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[REDACTED_GITHUB_TOKEN]'],
-    // Anthropic keys (sk-ant-api03-…) before the generic sk- rule so the marker
-    // is specific; the generic rule would otherwise swallow it first.
-    [/\bsk-ant-api03-[A-Za-z0-9_-]{20,}\b/g, '[REDACTED_ANTHROPIC_KEY]'],
+    // Anthropic credentials, before the generic sk- rule so the marker is specific
+    // (the generic rule would otherwise swallow them first). Covers every kind of
+    // sk-ant token by matching the kind segment generically: API keys
+    // (sk-ant-api03-…) AND the long-lived OAuth setup-tokens (sk-ant-oat01-…) that
+    // `claude setup-token` mints. The generic sk- rule below CANNOT match an oat01
+    // token — the hyphen after `ant` breaks its [A-Za-z0-9]{20,} run — so without
+    // this an OAuth setup-token leaks verbatim into any log/export (#1767).
+    [/\bsk-ant-[a-z0-9]{3,8}-[A-Za-z0-9_-]{8,}\b/g, '[REDACTED_ANTHROPIC_KEY]'],
     // Stripe live secret / restricted keys.
     [/\b[rs]k_live_[A-Za-z0-9]{20,}\b/g, '[REDACTED_STRIPE_KEY]'],
     [/\bsk-[A-Za-z0-9]{20,}\b/g, '[REDACTED_API_KEY]'],

package/dist/lib/remote-agents-json.d.ts

@@ -34,6 +34,7 @@ export interface RemoteAgentsJsonOptions<T> {
 export type SshCaptureFn = (target: string, remoteCmd: string, opts: {
     timeoutMs: number;
     signal?: AbortSignal;
+    extraSshArgs?: string[];
 }) => Promise<{
     code: number | null;
     stdout: string;
@@ -62,5 +63,36 @@ export declare function parseRemoteAgentsJsonPayload<T>(stdout: string, machine:
 };
 /** Build the command one peer runs, with a guard that prevents recursive fan-out. */
 export declare function remoteAgentsJsonCommand(args: string[], noFanoutEnv: string, os?: string): string;
+/**
+ * The subset of a spawned `ssh` child this capture loop drives. Structural so a
+ * unit test can feed synthetic `data`/`close` events through a fake without a
+ * live SSH connection.
+ */
+export interface CapturableChild {
+    stdout: {
+        on(event: 'data', listener: (chunk: Buffer) => void): unknown;
+    } | null;
+    on(event: 'error' | 'close', listener: (arg?: number | null) => void): unknown;
+    kill(signal?: NodeJS.Signals): unknown;
+}
+/**
+ * Stream one child's stdout into memory under a hard per-peer byte ceiling.
+ *
+ * A cross-machine fan-out awaits every peer's capture under one `Promise.all`,
+ * so an unbounded buffer means a single runaway peer (a corrupt or
+ * pathologically large payload) exhausts the caller's heap and takes the whole
+ * sweep down — RUSH-2065. Once the accumulated bytes would exceed
+ * {@link REMOTE_STDOUT_MAX_BYTES}, the child is SIGKILLed and the capture settles
+ * as `code: null` (unreachable) rather than trust a truncated body. A definitive
+ * early-exit `signal` SIGTERMs the child the same way, and the timer is the
+ * per-peer deadline.
+ */
+export declare function captureBoundedStdout(child: CapturableChild, { timeoutMs, signal }: {
+    timeoutMs: number;
+    signal?: AbortSignal;
+}): Promise<{
+    code: number | null;
+    stdout: string;
+}>;
 /** Query explicit hosts, or every registered online peer when hosts is omitted. */
 export declare function gatherRemoteAgentsJson<T>(options: RemoteAgentsJsonOptions<T>, deps?: GatherRemoteAgentsJsonDeps): Promise<RemoteAgentsJsonResult<T>>;

package/dist/lib/remote-agents-json.js

@@ -9,18 +9,20 @@
 import { spawn } from 'child_process';
 import { setMaxListeners } from 'node:events';
 import chalk from 'chalk';
-import { SSH_OPTS, controlOpts, assertValidSshTarget, shellQuote } from './ssh-exec.js';
-import { sshTargetFor } from './devices/connect.js';
+import { SSH_OPTS, controlOpts, assertValidSshTarget, shellQuote, REMOTE_STDOUT_MAX_BYTES, RemoteUtf8Accumulator, } from './ssh-exec.js';
+import { deviceIdentityArgs, sshTargetFor } from './devices/connect.js';
 import { resolveExplicitTargets } from './devices/resolve-target.js';
 import { loadDevices, isControlDevice, isDialableDevice } from './devices/registry.js';
-import { remoteShellFor, buildWindowsAgentsCommand } from './hosts/remote-cmd.js';
+import { remoteShellFor, buildWindowsAgentsCommand, stripClixml } from './hosts/remote-cmd.js';
 import { machineId, normalizeHost } from './machine-id.js';
 const REMOTE_TIMEOUT_MS = 12_000;
 export function normalizeRemoteAgentsJsonParse(parsed) {
     return Array.isArray(parsed) ? { items: parsed, valid: true } : parsed;
 }
 export function parseRemoteAgentsJsonPayload(stdout, machine, parse) {
-    const parsed = normalizeRemoteAgentsJsonParse(parse(stdout, machine));
+    // A Windows peer can prefix the JSON with a PowerShell CLIXML banner; strip it
+    // before handing stdout to the command-specific parser (RUSH-2286).
+    const parsed = normalizeRemoteAgentsJsonParse(parse(stripClixml(stdout), machine));
     return parsed.valid
         ? { items: parsed.items, parseFailed: false }
         : { items: [], parseFailed: true };
@@ -33,16 +35,22 @@ export function remoteAgentsJsonCommand(args, noFanoutEnv, os) {
     const inner = `${noFanoutEnv}=1 agents ${args.map(shellQuote).join(' ')}`;
     return `bash -lc ${shellQuote(inner)}`;
 }
-const sshCapture = (target, remoteCmd, { timeoutMs, signal }) => {
-    assertValidSshTarget(target);
+/**
+ * Stream one child's stdout into memory under a hard per-peer byte ceiling.
+ *
+ * A cross-machine fan-out awaits every peer's capture under one `Promise.all`,
+ * so an unbounded buffer means a single runaway peer (a corrupt or
+ * pathologically large payload) exhausts the caller's heap and takes the whole
+ * sweep down — RUSH-2065. Once the accumulated bytes would exceed
+ * {@link REMOTE_STDOUT_MAX_BYTES}, the child is SIGKILLed and the capture settles
+ * as `code: null` (unreachable) rather than trust a truncated body. A definitive
+ * early-exit `signal` SIGTERMs the child the same way, and the timer is the
+ * per-peer deadline.
+ */
+export function captureBoundedStdout(child, { timeoutMs, signal }) {
     return new Promise((resolve) => {
-        if (signal?.aborted) {
-            resolve({ code: null, stdout: '' });
-            return;
-        }
-        const args = [...SSH_OPTS, ...controlOpts(), target, remoteCmd];
-        const child = spawn('ssh', args, { stdio: ['ignore', 'pipe', 'ignore'] });
-        let stdout = '';
+        const decoded = new RemoteUtf8Accumulator();
+        let stdoutBytes = 0;
         let settled = false;
         const done = (code) => {
             if (settled)
@@ -50,7 +58,10 @@ const sshCapture = (target, remoteCmd, { timeoutMs, signal }) => {
             settled = true;
             clearTimeout(timer);
             signal?.removeEventListener('abort', onAbort);
-            resolve({ code, stdout });
+            // A killed/aborted capture never cleanly ends its decoder; return what
+            // decoded so far (the caller treats a non-zero code as unreachable and
+            // ignores stdout anyway).
+            resolve({ code, stdout: code === null ? decoded.current() : decoded.end() });
         };
         const timer = setTimeout(() => {
             child.kill('SIGKILL');
@@ -60,10 +71,28 @@ const sshCapture = (target, remoteCmd, { timeoutMs, signal }) => {
         // unreachable peer is not left running to its full timeout.
         const onAbort = () => { child.kill('SIGTERM'); done(null); };
         signal?.addEventListener('abort', onAbort, { once: true });
-        child.stdout.on('data', (data) => { stdout += data.toString(); });
+        child.stdout?.on('data', (data) => {
+            // Over the ceiling, SIGKILL the child and treat it as unreachable rather
+            // than trust a partial payload — the RUSH-2065 OOM guard.
+            if (stdoutBytes + data.byteLength > REMOTE_STDOUT_MAX_BYTES) {
+                child.kill('SIGKILL');
+                done(null);
+                return;
+            }
+            stdoutBytes += data.byteLength;
+            decoded.write(data);
+        });
         child.on('error', () => done(null));
-        child.on('close', (code) => done(code));
+        child.on('close', (code) => done(code ?? null));
     });
+}
+const sshCapture = (target, remoteCmd, { timeoutMs, signal, extraSshArgs }) => {
+    assertValidSshTarget(target);
+    if (signal?.aborted)
+        return Promise.resolve({ code: null, stdout: '' });
+    const args = [...SSH_OPTS, ...controlOpts(), ...(extraSshArgs ?? []), target, remoteCmd];
+    const child = spawn('ssh', args, { stdio: ['ignore', 'pipe', 'ignore'] });
+    return captureBoundedStdout(child, { timeoutMs, signal });
 };
 /** Query explicit hosts, or every registered online peer when hosts is omitted. */
 export async function gatherRemoteAgentsJson(options, deps = {}) {
@@ -102,6 +131,7 @@ export async function gatherRemoteAgentsJson(options, deps = {}) {
                     machine: normalizeHost(device.name),
                     name: device.name,
                     os: device.platform,
+                    extraSshArgs: deviceIdentityArgs(device),
                 });
             }
             catch {
@@ -126,6 +156,7 @@ export async function gatherRemoteAgentsJson(options, deps = {}) {
         const result = await capture(target.target, command, {
             timeoutMs: options.timeoutMs ?? REMOTE_TIMEOUT_MS,
             signal: controller?.signal,
+            extraSshArgs: target.extraSshArgs,
         });
         // A peer we deliberately cancelled is neither a hit nor a failure — it never
         // got to answer, so it must not pollute skipped/parseFailed (which drive the

package/dist/lib/resource-profiles.js

@@ -41,11 +41,10 @@ export function getActiveResourceProfileName() {
     return readMeta().profiles?.active ?? null;
 }
 export function getActiveResourceProfile() {
-    const meta = readMeta();
     const name = getActiveResourceProfileName();
     if (!name)
         return null;
-    const preset = meta.profiles?.presets?.[name];
+    const preset = readMeta().profiles?.presets?.[name];
     return preset ? { name, preset } : null;
 }
 export function upsertResourceProfilePreset(name, preset) {

package/dist/lib/routine-notify-owner.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Owner phone notification on routine FAILURE (RUSH-2288).
+ *
+ * The desktop lifecycle notifications (routine-notify.ts) never leave the
+ * machine, so a failed scheduled routine on a headless fleet box was invisible
+ * until someone happened to look. The per-routine prompt pattern (a prompt that
+ * ends by shelling `agents notify`) does not close the gap either: when the
+ * routine's OWN agent fails to spawn (`auth_failed`) that prompt never runs, so
+ * the one failure most worth surfacing is the one that goes unheard.
+ *
+ * So the DAEMON delivers on failure, from the SAME owner channel stack `agents
+ * notify` uses (humans.yaml owner channels, or the legacy `notify.owner`),
+ * calling the channel providers IN-PROCESS — no shelling out to `ssh mac-mini
+ * agents notify`. When the primary owner channel cannot deliver from this box it
+ * walks the remaining configured owner channels as fallbacks (OpenClaw, a second
+ * channel, …). Telegram is never used.
+ *
+ * Only failures notify. A green routine of any kind stays silent — this is an
+ * ADDITIONAL failures-only lane, and the desktop thresholds (which still ping a
+ * green agent/workflow finish on the local screen) are unchanged. Delivery is
+ * deduped per job+runId so a run is announced to the owner at most once.
+ *
+ * The message BUILDERS (`routineFinishOwnerText` / `routineStartFailedOwnerText`)
+ * are pure and unit-tested; `notifyOwnerRoutineFinish` /
+ * `notifyOwnerRoutineStartFailed` are the daemon glue that reads config and
+ * delivers.
+ */
+import type { Meta } from './types.js';
+import type { JobConfig, RunMeta } from './routines.js';
+/**
+ * Owner-phone text for a routine FINISH, or null when the run did NOT fail. Only
+ * `failed` and `timeout` are failures worth an owner ping — a `completed` run
+ * (any kind) is silent, and `running`/`missed` never reach this path from the
+ * daemon's finish hook. The text is a short, phone-sized pointer: what failed,
+ * why, and on which box (so the owner knows where to look), well under the
+ * `user-message-guard` length ceiling.
+ */
+export declare function routineFinishOwnerText(meta: Pick<RunMeta, 'jobName' | 'status' | 'exitCode' | 'errorMessage' | 'agent' | 'workflow' | 'command'>, host: string): string | null;
+/**
+ * Owner-phone text for a routine that failed to even START (the daemon's
+ * pre-spawn catch — `executeJobDetached` threw before a child existed, e.g.
+ * `auth_failed`). Never null: a broken start is always a failure worth the ping,
+ * for every routine kind, and it is exactly the case the per-routine `agents
+ * notify` prompt can never cover because that prompt never ran.
+ */
+export declare function routineStartFailedOwnerText(config: Pick<JobConfig, 'name' | 'agent' | 'workflow' | 'command'>, error: string, host: string): string;
+/** One resolved owner destination to attempt, in plan order. */
+export interface OwnerDest {
+    channel: string;
+    to: string;
+}
+/**
+ * Ordered owner delivery plan for a failure ping: the primary owner destination
+ * (the same one `agents notify` resolves) first, then every other configured
+ * owner channel as a fallback. Deduped by (channel, to). Telegram channels and
+ * intrusive channels (a voice call is too much for a routine failure) are
+ * excluded entirely — so an owner whose ONLY channel is Telegram gets an empty
+ * plan and no ping, which is the intended "silence beats Telegram" outcome.
+ *
+ * The same filters apply to the primary and the fallback list — a policy that
+ * points normal severity at a voice channel must not auto-call the owner on
+ * every routine failure.
+ */
+export declare function ownerFailureDeliveryPlan(meta: Meta): OwnerDest[];
+/** Outcome of one delivery attempt, for logging/telemetry. */
+export interface OwnerDeliveryAttempt {
+    channel: string;
+    ok: boolean;
+    error?: string;
+}
+export interface OwnerDeliveryResult {
+    /** True once any channel in the plan accepted the message. */
+    delivered: boolean;
+    /** The channel that delivered, when `delivered`. */
+    channel?: string;
+    /** Every attempt made, in order — empty when no owner channel is configured. */
+    attempts: OwnerDeliveryAttempt[];
+}
+/**
+ * Deliver `text` to the owner over the failure plan, in-process, trying each
+ * channel until one accepts. Uses the non-dying `lookupTransport` (never
+ * `resolveTransport`, which `die()`s the process) so a daemon survives a bad
+ * channel name. Best-effort by contract: the daemon wraps this in try/catch, but
+ * it also never throws for a delivery failure — it returns the attempt log.
+ */
+export declare function deliverOwnerFailure(text: string, meta: Meta): Promise<OwnerDeliveryResult>;
+/** Test-only: reset the dedup set so cases don't leak state into each other. */
+export declare function __resetOwnerFailureDedup(): void;
+/**
+ * Daemon glue: on a routine FINISH, ping the owner IFF the run failed. Green
+ * runs return early (no ping). Deduped per job+runId — claimed for the
+ * in-flight window so two finish hooks don't double-text, released when no
+ * channel accepted so a later sweep can retry. Best-effort.
+ */
+export declare function notifyOwnerRoutineFinish(meta: RunMeta): Promise<OwnerDeliveryResult>;
+/**
+ * Daemon glue: on a pre-spawn failure (no run record, so no finish hook and no
+ * runId), ping the owner. Not deduped — a pre-spawn failure is one scheduled
+ * fire on the cron cadence (never a per-second storm), and each such fire is a
+ * distinct failure the owner should hear about. Best-effort.
+ */
+export declare function notifyOwnerRoutineStartFailed(config: JobConfig, error: string): Promise<OwnerDeliveryResult>;