@phnx-labs/agents-cli 1.22.26 → 1.22.28

package/dist/lib/project-status.js

@@ -135,6 +135,21 @@ export function liveDeadSplit(byStatus) {
     deadByStatus.sort((a, b) => b.n - a.n || a.status.localeCompare(b.status));
     return { live, dead, deadByStatus };
 }
+/**
+ * The `dead` row body: `41 crashed` when every dead session shares one status,
+ * else `12 finished or lost (8 crashed, 4 closed)`. The generic "finished or
+ * lost" only earns its keep when the statuses actually differ — with a single
+ * status it just hides which one behind a parenthetical that repeats the count.
+ * Pure — chalk styling only; the caller adds the `dead` label. Assumes
+ * `split.dead > 0` (the caller gates on it).
+ */
+export function formatDeadSummary(split) {
+    if (split.deadByStatus.length === 1) {
+        return chalk.yellow(`${split.dead} ${split.deadByStatus[0].status}`);
+    }
+    const detail = split.deadByStatus.map((d) => `${d.n} ${d.status}`).join(', ');
+    return `${chalk.yellow(`${split.dead} finished or lost`)} ${chalk.dim(`(${detail})`)}`;
+}
 /**
  * Display order for the members line: the states a human scans for first
  * (running, then idle, then need-input, then queued), everything else after,

package/dist/lib/redact.js

@@ -13,9 +13,14 @@ const SECRET_PATTERNS = [
     [/\bghp_[A-Za-z0-9]{36}\b/g, '[REDACTED_GITHUB_TOKEN]'],
     [/\bgh[osru]_[A-Za-z0-9]{36}\b/g, '[REDACTED_GITHUB_TOKEN]'],
     [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '[REDACTED_GITHUB_TOKEN]'],
-    // Anthropic keys (sk-ant-api03-…) before the generic sk- rule so the marker
-    // is specific; the generic rule would otherwise swallow it first.
-    [/\bsk-ant-api03-[A-Za-z0-9_-]{20,}\b/g, '[REDACTED_ANTHROPIC_KEY]'],
+    // Anthropic credentials, before the generic sk- rule so the marker is specific
+    // (the generic rule would otherwise swallow them first). Covers every kind of
+    // sk-ant token by matching the kind segment generically: API keys
+    // (sk-ant-api03-…) AND the long-lived OAuth setup-tokens (sk-ant-oat01-…) that
+    // `claude setup-token` mints. The generic sk- rule below CANNOT match an oat01
+    // token — the hyphen after `ant` breaks its [A-Za-z0-9]{20,} run — so without
+    // this an OAuth setup-token leaks verbatim into any log/export (#1767).
+    [/\bsk-ant-[a-z0-9]{3,8}-[A-Za-z0-9_-]{8,}\b/g, '[REDACTED_ANTHROPIC_KEY]'],
     // Stripe live secret / restricted keys.
     [/\b[rs]k_live_[A-Za-z0-9]{20,}\b/g, '[REDACTED_STRIPE_KEY]'],
     [/\bsk-[A-Za-z0-9]{20,}\b/g, '[REDACTED_API_KEY]'],

package/dist/lib/refresh.js

@@ -135,15 +135,24 @@ export async function refresh(options = {}) {
         const versionsToSync = skipPrompts
             ? listInstalledVersions(agentId)
             : [defaultVer];
-        const actuallySynced = getActuallySyncedResources(agentId, defaultVer);
-        const newResources = getNewResources(available, actuallySynced, getProjectOnlyResources());
-        const hasAnySynced = actuallySynced.commands.length > 0 ||
-            actuallySynced.skills.length > 0 ||
-            actuallySynced.hooks.length > 0 ||
-            actuallySynced.memory.length > 0 ||
-            actuallySynced.mcp.length > 0 ||
-            actuallySynced.permissions.length > 0 ||
-            actuallySynced.plugins.length > 0;
+        // Interactive-only: getActuallySyncedResources walks every skill tree with
+        // content compares (~1s/agent on a full install). The unattended path
+        // (`skipPrompts` / `agents sync --yes`) never reads these — it always
+        // force-full-syncs — so skip the scan entirely (RUSH-2320 #1).
+        let actuallySynced;
+        let newResources;
+        let hasAnySynced = false;
+        if (!skipPrompts) {
+            actuallySynced = getActuallySyncedResources(agentId, defaultVer);
+            newResources = getNewResources(available, actuallySynced, getProjectOnlyResources());
+            hasAnySynced = actuallySynced.commands.length > 0 ||
+                actuallySynced.skills.length > 0 ||
+                actuallySynced.hooks.length > 0 ||
+                actuallySynced.memory.length > 0 ||
+                actuallySynced.mcp.length > 0 ||
+                actuallySynced.permissions.length > 0 ||
+                actuallySynced.plugins.length > 0;
+        }
         try {
             let selection;
             let forceFullSync = false;
@@ -156,7 +165,7 @@ export async function refresh(options = {}) {
                 if (userSelection)
                     selection = userSelection;
             }
-            else if (hasNewResources(newResources, agentId, defaultVer)) {
+            else if (newResources && hasNewResources(newResources, agentId, defaultVer)) {
                 log(chalk.cyan(`\n${agentLabel(agentId)}@${defaultVer}:`));
                 const userSelection = await promptNewResourceSelection(agentId, newResources, defaultVer);
                 if (userSelection)
@@ -168,7 +177,9 @@ export async function refresh(options = {}) {
             if (forceFullSync || (selection && Object.keys(selection).length > 0)) {
                 const kinds = new Set();
                 for (const ver of versionsToSync) {
-                    const syncResult = syncResourcesToVersion(agentId, ver, selection, forceFullSync ? { force: true } : undefined);
+                    // Pass the already-built `available` so each version does not re-scan
+                    // resource trees (RUSH-2320 #5).
+                    const syncResult = syncResourcesToVersion(agentId, ver, selection, { available, ...(forceFullSync ? { force: true } : {}) });
                     if (syncResult.commands)
                         kinds.add('commands');
                     if (syncResult.skills)

package/dist/lib/remote-agents-json.d.ts

@@ -34,6 +34,7 @@ export interface RemoteAgentsJsonOptions<T> {
 export type SshCaptureFn = (target: string, remoteCmd: string, opts: {
     timeoutMs: number;
     signal?: AbortSignal;
+    extraSshArgs?: string[];
 }) => Promise<{
     code: number | null;
     stdout: string;
@@ -62,5 +63,36 @@ export declare function parseRemoteAgentsJsonPayload<T>(stdout: string, machine:
 };
 /** Build the command one peer runs, with a guard that prevents recursive fan-out. */
 export declare function remoteAgentsJsonCommand(args: string[], noFanoutEnv: string, os?: string): string;
+/**
+ * The subset of a spawned `ssh` child this capture loop drives. Structural so a
+ * unit test can feed synthetic `data`/`close` events through a fake without a
+ * live SSH connection.
+ */
+export interface CapturableChild {
+    stdout: {
+        on(event: 'data', listener: (chunk: Buffer) => void): unknown;
+    } | null;
+    on(event: 'error' | 'close', listener: (arg?: number | null) => void): unknown;
+    kill(signal?: NodeJS.Signals): unknown;
+}
+/**
+ * Stream one child's stdout into memory under a hard per-peer byte ceiling.
+ *
+ * A cross-machine fan-out awaits every peer's capture under one `Promise.all`,
+ * so an unbounded buffer means a single runaway peer (a corrupt or
+ * pathologically large payload) exhausts the caller's heap and takes the whole
+ * sweep down — RUSH-2065. Once the accumulated bytes would exceed
+ * {@link REMOTE_STDOUT_MAX_BYTES}, the child is SIGKILLed and the capture settles
+ * as `code: null` (unreachable) rather than trust a truncated body. A definitive
+ * early-exit `signal` SIGTERMs the child the same way, and the timer is the
+ * per-peer deadline.
+ */
+export declare function captureBoundedStdout(child: CapturableChild, { timeoutMs, signal }: {
+    timeoutMs: number;
+    signal?: AbortSignal;
+}): Promise<{
+    code: number | null;
+    stdout: string;
+}>;
 /** Query explicit hosts, or every registered online peer when hosts is omitted. */
 export declare function gatherRemoteAgentsJson<T>(options: RemoteAgentsJsonOptions<T>, deps?: GatherRemoteAgentsJsonDeps): Promise<RemoteAgentsJsonResult<T>>;

package/dist/lib/remote-agents-json.js

@@ -9,18 +9,20 @@
 import { spawn } from 'child_process';
 import { setMaxListeners } from 'node:events';
 import chalk from 'chalk';
-import { SSH_OPTS, controlOpts, assertValidSshTarget, shellQuote } from './ssh-exec.js';
-import { sshTargetFor } from './devices/connect.js';
+import { SSH_OPTS, controlOpts, assertValidSshTarget, shellQuote, REMOTE_STDOUT_MAX_BYTES, RemoteUtf8Accumulator, } from './ssh-exec.js';
+import { deviceIdentityArgs, sshTargetFor } from './devices/connect.js';
 import { resolveExplicitTargets } from './devices/resolve-target.js';
 import { loadDevices, isControlDevice, isDialableDevice } from './devices/registry.js';
-import { remoteShellFor, buildWindowsAgentsCommand } from './hosts/remote-cmd.js';
+import { remoteShellFor, buildWindowsAgentsCommand, stripClixml } from './hosts/remote-cmd.js';
 import { machineId, normalizeHost } from './machine-id.js';
 const REMOTE_TIMEOUT_MS = 12_000;
 export function normalizeRemoteAgentsJsonParse(parsed) {
     return Array.isArray(parsed) ? { items: parsed, valid: true } : parsed;
 }
 export function parseRemoteAgentsJsonPayload(stdout, machine, parse) {
-    const parsed = normalizeRemoteAgentsJsonParse(parse(stdout, machine));
+    // A Windows peer can prefix the JSON with a PowerShell CLIXML banner; strip it
+    // before handing stdout to the command-specific parser (RUSH-2286).
+    const parsed = normalizeRemoteAgentsJsonParse(parse(stripClixml(stdout), machine));
     return parsed.valid
         ? { items: parsed.items, parseFailed: false }
         : { items: [], parseFailed: true };
@@ -33,16 +35,22 @@ export function remoteAgentsJsonCommand(args, noFanoutEnv, os) {
     const inner = `${noFanoutEnv}=1 agents ${args.map(shellQuote).join(' ')}`;
     return `bash -lc ${shellQuote(inner)}`;
 }
-const sshCapture = (target, remoteCmd, { timeoutMs, signal }) => {
-    assertValidSshTarget(target);
+/**
+ * Stream one child's stdout into memory under a hard per-peer byte ceiling.
+ *
+ * A cross-machine fan-out awaits every peer's capture under one `Promise.all`,
+ * so an unbounded buffer means a single runaway peer (a corrupt or
+ * pathologically large payload) exhausts the caller's heap and takes the whole
+ * sweep down — RUSH-2065. Once the accumulated bytes would exceed
+ * {@link REMOTE_STDOUT_MAX_BYTES}, the child is SIGKILLed and the capture settles
+ * as `code: null` (unreachable) rather than trust a truncated body. A definitive
+ * early-exit `signal` SIGTERMs the child the same way, and the timer is the
+ * per-peer deadline.
+ */
+export function captureBoundedStdout(child, { timeoutMs, signal }) {
     return new Promise((resolve) => {
-        if (signal?.aborted) {
-            resolve({ code: null, stdout: '' });
-            return;
-        }
-        const args = [...SSH_OPTS, ...controlOpts(), target, remoteCmd];
-        const child = spawn('ssh', args, { stdio: ['ignore', 'pipe', 'ignore'] });
-        let stdout = '';
+        const decoded = new RemoteUtf8Accumulator();
+        let stdoutBytes = 0;
         let settled = false;
         const done = (code) => {
             if (settled)
@@ -50,7 +58,10 @@ const sshCapture = (target, remoteCmd, { timeoutMs, signal }) => {
             settled = true;
             clearTimeout(timer);
             signal?.removeEventListener('abort', onAbort);
-            resolve({ code, stdout });
+            // A killed/aborted capture never cleanly ends its decoder; return what
+            // decoded so far (the caller treats a non-zero code as unreachable and
+            // ignores stdout anyway).
+            resolve({ code, stdout: code === null ? decoded.current() : decoded.end() });
         };
         const timer = setTimeout(() => {
             child.kill('SIGKILL');
@@ -60,10 +71,28 @@ const sshCapture = (target, remoteCmd, { timeoutMs, signal }) => {
         // unreachable peer is not left running to its full timeout.
         const onAbort = () => { child.kill('SIGTERM'); done(null); };
         signal?.addEventListener('abort', onAbort, { once: true });
-        child.stdout.on('data', (data) => { stdout += data.toString(); });
+        child.stdout?.on('data', (data) => {
+            // Over the ceiling, SIGKILL the child and treat it as unreachable rather
+            // than trust a partial payload — the RUSH-2065 OOM guard.
+            if (stdoutBytes + data.byteLength > REMOTE_STDOUT_MAX_BYTES) {
+                child.kill('SIGKILL');
+                done(null);
+                return;
+            }
+            stdoutBytes += data.byteLength;
+            decoded.write(data);
+        });
         child.on('error', () => done(null));
-        child.on('close', (code) => done(code));
+        child.on('close', (code) => done(code ?? null));
     });
+}
+const sshCapture = (target, remoteCmd, { timeoutMs, signal, extraSshArgs }) => {
+    assertValidSshTarget(target);
+    if (signal?.aborted)
+        return Promise.resolve({ code: null, stdout: '' });
+    const args = [...SSH_OPTS, ...controlOpts(), ...(extraSshArgs ?? []), target, remoteCmd];
+    const child = spawn('ssh', args, { stdio: ['ignore', 'pipe', 'ignore'] });
+    return captureBoundedStdout(child, { timeoutMs, signal });
 };
 /** Query explicit hosts, or every registered online peer when hosts is omitted. */
 export async function gatherRemoteAgentsJson(options, deps = {}) {
@@ -102,6 +131,7 @@ export async function gatherRemoteAgentsJson(options, deps = {}) {
                     machine: normalizeHost(device.name),
                     name: device.name,
                     os: device.platform,
+                    extraSshArgs: deviceIdentityArgs(device),
                 });
             }
             catch {
@@ -126,6 +156,7 @@ export async function gatherRemoteAgentsJson(options, deps = {}) {
         const result = await capture(target.target, command, {
             timeoutMs: options.timeoutMs ?? REMOTE_TIMEOUT_MS,
             signal: controller?.signal,
+            extraSshArgs: target.extraSshArgs,
         });
         // A peer we deliberately cancelled is neither a hit nor a failure — it never
         // got to answer, so it must not pollute skipped/parseFailed (which drive the

package/dist/lib/resource-profiles.js

@@ -41,11 +41,10 @@ export function getActiveResourceProfileName() {
     return readMeta().profiles?.active ?? null;
 }
 export function getActiveResourceProfile() {
-    const meta = readMeta();
     const name = getActiveResourceProfileName();
     if (!name)
         return null;
-    const preset = meta.profiles?.presets?.[name];
+    const preset = readMeta().profiles?.presets?.[name];
     return preset ? { name, preset } : null;
 }
 export function upsertResourceProfilePreset(name, preset) {

package/dist/lib/rotate.d.ts

@@ -145,6 +145,28 @@ export type AccountReadiness = {
  * reported while the account is actually serving requests.
  */
 export declare function readinessFromCandidate(candidate: RotateCandidate): AccountReadiness;
+/**
+ * Whether a human sitting at a terminal can clear this exclusion by launching
+ * the agent and signing in. The two unhealthy classes are opposites, and the
+ * zero-healthy callers MUST NOT treat them alike:
+ *
+ * - `signed_out` / `revoked` — recoverable. There is no credential (or the
+ *   server rejected it), and the harness's own TUI is the login surface, so
+ *   launching it is exactly the fix. Refusing to launch strands the user with
+ *   no way to authenticate through agents-cli at all (RUSH-2334).
+ * - `rate_limited` / `out_of_credits` — NOT recoverable. The account is signed
+ *   in and throttled; launching it just hammers an exhausted account, which is
+ *   precisely the loop RUSH-2132's fail-loud guard exists to stop. Only a
+ *   window reset clears these.
+ */
+export declare function isSignInRecoverable(readiness: AccountReadiness): boolean;
+/**
+ * The subset of an `exhausted` set whose exclusion a sign-in would clear, so an
+ * interactive caller can offer the login instead of dead-ending. Empty means
+ * every account is throttled — nothing a human can fix right now, so the caller
+ * keeps failing loud.
+ */
+export declare function signInRecoverableCandidates(candidates: RotateCandidate[]): RotateCandidate[];
 /**
  * Readiness for a specific installed (agent, version). Returns `{ ready: true }`
  * when the version isn't among the collected candidates — absence is the

package/dist/lib/rotate.js

@@ -169,6 +169,32 @@ export function readinessFromCandidate(candidate) {
     const reason = !snapRateLimited && candidate.usageStatus === 'out_of_credits' ? 'out_of_credits' : 'rate_limited';
     return { ready: false, reason, email: candidate.email };
 }
+/**
+ * Whether a human sitting at a terminal can clear this exclusion by launching
+ * the agent and signing in. The two unhealthy classes are opposites, and the
+ * zero-healthy callers MUST NOT treat them alike:
+ *
+ * - `signed_out` / `revoked` — recoverable. There is no credential (or the
+ *   server rejected it), and the harness's own TUI is the login surface, so
+ *   launching it is exactly the fix. Refusing to launch strands the user with
+ *   no way to authenticate through agents-cli at all (RUSH-2334).
+ * - `rate_limited` / `out_of_credits` — NOT recoverable. The account is signed
+ *   in and throttled; launching it just hammers an exhausted account, which is
+ *   precisely the loop RUSH-2132's fail-loud guard exists to stop. Only a
+ *   window reset clears these.
+ */
+export function isSignInRecoverable(readiness) {
+    return !readiness.ready && (readiness.reason === 'signed_out' || readiness.reason === 'revoked');
+}
+/**
+ * The subset of an `exhausted` set whose exclusion a sign-in would clear, so an
+ * interactive caller can offer the login instead of dead-ending. Empty means
+ * every account is throttled — nothing a human can fix right now, so the caller
+ * keeps failing loud.
+ */
+export function signInRecoverableCandidates(candidates) {
+    return candidates.filter((c) => isSignInRecoverable(readinessFromCandidate(c)));
+}
 /**
  * Readiness for a specific installed (agent, version). Returns `{ ready: true }`
  * when the version isn't among the collected candidates — absence is the

package/dist/lib/routine-notify-owner.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Owner phone notification on routine FAILURE (RUSH-2288).
+ *
+ * The desktop lifecycle notifications (routine-notify.ts) never leave the
+ * machine, so a failed scheduled routine on a headless fleet box was invisible
+ * until someone happened to look. The per-routine prompt pattern (a prompt that
+ * ends by shelling `agents notify`) does not close the gap either: when the
+ * routine's OWN agent fails to spawn (`auth_failed`) that prompt never runs, so
+ * the one failure most worth surfacing is the one that goes unheard.
+ *
+ * So the DAEMON delivers on failure, from the SAME owner channel stack `agents
+ * notify` uses (humans.yaml owner channels, or the legacy `notify.owner`),
+ * calling the channel providers IN-PROCESS — no shelling out to `ssh mac-mini
+ * agents notify`. When the primary owner channel cannot deliver from this box it
+ * walks the remaining configured owner channels as fallbacks (OpenClaw, a second
+ * channel, …). Telegram is never used.
+ *
+ * Only failures notify. A green routine of any kind stays silent — this is an
+ * ADDITIONAL failures-only lane, and the desktop thresholds (which still ping a
+ * green agent/workflow finish on the local screen) are unchanged. Delivery is
+ * deduped per job+runId so a run is announced to the owner at most once.
+ *
+ * The message BUILDERS (`routineFinishOwnerText` / `routineStartFailedOwnerText`)
+ * are pure and unit-tested; `notifyOwnerRoutineFinish` /
+ * `notifyOwnerRoutineStartFailed` are the daemon glue that reads config and
+ * delivers.
+ */
+import type { Meta } from './types.js';
+import type { JobConfig, RunMeta } from './routines.js';
+/**
+ * Owner-phone text for a routine FINISH, or null when the run did NOT fail. Only
+ * `failed` and `timeout` are failures worth an owner ping — a `completed` run
+ * (any kind) is silent, and `running`/`missed` never reach this path from the
+ * daemon's finish hook. The text is a short, phone-sized pointer: what failed,
+ * why, and on which box (so the owner knows where to look), well under the
+ * `user-message-guard` length ceiling.
+ */
+export declare function routineFinishOwnerText(meta: Pick<RunMeta, 'jobName' | 'status' | 'exitCode' | 'errorMessage' | 'agent' | 'workflow' | 'command'>, host: string): string | null;
+/**
+ * Owner-phone text for a routine that failed to even START (the daemon's
+ * pre-spawn catch — `executeJobDetached` threw before a child existed, e.g.
+ * `auth_failed`). Never null: a broken start is always a failure worth the ping,
+ * for every routine kind, and it is exactly the case the per-routine `agents
+ * notify` prompt can never cover because that prompt never ran.
+ */
+export declare function routineStartFailedOwnerText(config: Pick<JobConfig, 'name' | 'agent' | 'workflow' | 'command'>, error: string, host: string): string;
+/** One resolved owner destination to attempt, in plan order. */
+export interface OwnerDest {
+    channel: string;
+    to: string;
+}
+/**
+ * Ordered owner delivery plan for a failure ping: the primary owner destination
+ * (the same one `agents notify` resolves) first, then every other configured
+ * owner channel as a fallback. Deduped by (channel, to). Telegram channels and
+ * intrusive channels (a voice call is too much for a routine failure) are
+ * excluded entirely — so an owner whose ONLY channel is Telegram gets an empty
+ * plan and no ping, which is the intended "silence beats Telegram" outcome.
+ *
+ * The same filters apply to the primary and the fallback list — a policy that
+ * points normal severity at a voice channel must not auto-call the owner on
+ * every routine failure.
+ */
+export declare function ownerFailureDeliveryPlan(meta: Meta): OwnerDest[];
+/** Outcome of one delivery attempt, for logging/telemetry. */
+export interface OwnerDeliveryAttempt {
+    channel: string;
+    ok: boolean;
+    error?: string;
+}
+export interface OwnerDeliveryResult {
+    /** True once any channel in the plan accepted the message. */
+    delivered: boolean;
+    /** The channel that delivered, when `delivered`. */
+    channel?: string;
+    /** Every attempt made, in order — empty when no owner channel is configured. */
+    attempts: OwnerDeliveryAttempt[];
+}
+/**
+ * Deliver `text` to the owner over the failure plan, in-process, trying each
+ * channel until one accepts. Uses the non-dying `lookupTransport` (never
+ * `resolveTransport`, which `die()`s the process) so a daemon survives a bad
+ * channel name. Best-effort by contract: the daemon wraps this in try/catch, but
+ * it also never throws for a delivery failure — it returns the attempt log.
+ */
+export declare function deliverOwnerFailure(text: string, meta: Meta): Promise<OwnerDeliveryResult>;
+/** Test-only: reset the dedup set so cases don't leak state into each other. */
+export declare function __resetOwnerFailureDedup(): void;
+/**
+ * Daemon glue: on a routine FINISH, ping the owner IFF the run failed. Green
+ * runs return early (no ping). Deduped per job+runId — claimed for the
+ * in-flight window so two finish hooks don't double-text, released when no
+ * channel accepted so a later sweep can retry. Best-effort.
+ */
+export declare function notifyOwnerRoutineFinish(meta: RunMeta): Promise<OwnerDeliveryResult>;
+/**
+ * Daemon glue: on a pre-spawn failure (no run record, so no finish hook and no
+ * runId), ping the owner. Not deduped — a pre-spawn failure is one scheduled
+ * fire on the cron cadence (never a per-second storm), and each such fire is a
+ * distinct failure the owner should hear about. Best-effort.
+ */
+export declare function notifyOwnerRoutineStartFailed(config: JobConfig, error: string): Promise<OwnerDeliveryResult>;