@phnx-labs/agents-cli 1.22.26 → 1.22.28

package/dist/commands/doctor.js

@@ -12,7 +12,8 @@ import { buildLocalFindings, fleetDivergenceToFindings, signInToFindings, render
 import { getCliVersion } from '../lib/version.js';
 import { resolveHost } from '../lib/hosts/registry.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
-import { sshTargetFor } from '../lib/hosts/types.js';
+import { hostIdentityArgs, sshTargetFor } from '../lib/hosts/types.js';
+import { deviceIdentityArgs } from '../lib/devices/connect.js';
 import { machineId, normalizeHost } from '../lib/session/sync/config.js';
 import { findAmbiguousDevicePins } from '../lib/routines.js';
 import chalk from 'chalk';
@@ -33,6 +34,7 @@ import { listCliStatus, listCliStatusAsync } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
 import { heal, healChangedAnything } from '../lib/heal.js';
 import { getEffectiveExecutionPolicy } from '../lib/platform/winpath.js';
+import { auditWindowsSshEnrollment, diagnoseWindowsSshFailure } from '../lib/devices/windows-ssh-enrollment.js';
 import { scanUserRcFiles, masterPassphraseInEnv } from '../lib/secrets/rc-hygiene.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
 import { readRepoBehindMarkers } from '../lib/auto-pull.js';
@@ -83,14 +85,14 @@ function printWrappedLine(prefix, text) {
         console.log(chalk.gray(line));
 }
 /**
- * Narrow a remote `findings` array to the secret-hygiene rows, or `[]`.
+ * Narrow a remote `findings` array to rows only that device can observe.
  *
  * Deliberately NOT "forward every remote finding". The aggregator already
  * rebuilds a remote's sign-in rows from its inventory and its divergence rows
  * from the comparator, so forwarding wholesale would double them; and pulling a
  * remote's orphan/drift rows into a fleet readout is a much larger UX change
- * than this fix. The two secret kinds are the ones that are BOTH unrecomputable
- * centrally and security-relevant, which is exactly why they were being lost.
+ * than this fix. These kinds are unrecomputable centrally: shell/process secret
+ * hygiene and the Windows host's effective OpenSSH key path/content/ACL.
  *
  * **The remote contributes exactly one thing: the KIND.** Severity, message and
  * remediation are all generated HERE. That is not defensiveness for its own
@@ -111,13 +113,15 @@ function printWrappedLine(prefix, text) {
  * file and line. Run `agents doctor` on that box for the specifics — the
  * message says so.
  */
-const REMOTE_FORWARDED_KINDS = ['rc-secret-export', 'env-secret-export'];
+const REMOTE_FORWARDED_KINDS = ['rc-secret-export', 'env-secret-export', 'ssh-key-enrollment'];
 /** Canonical, locally-authored text for a forwarded kind. Never the remote's. */
 const REMOTE_SECRET_MESSAGE = {
     'rc-secret-export': 'a credential-shaped export was found in this box\'s shell rc files'
         + ' — run `agents doctor` there for the file and line',
     'env-secret-export': 'AGENTS_SECRETS_PASSPHRASE is set in this box\'s process environment'
         + ' — run `agents doctor` there for detail',
+    'ssh-key-enrollment': 'Windows OpenSSH key enrollment is invalid'
+        + ' — run `agents doctor` on this box for the effective path or ACL failure',
 };
 export function asRemoteSecretFindings(raw, device) {
     if (!Array.isArray(raw))
@@ -158,11 +162,12 @@ async function resolveFleetTargets(opts) {
                     name: deviceProfile.name,
                     sshTarget: deviceProfile.name,
                     os: deviceProfile.platform !== 'unknown' ? deviceProfile.platform : undefined,
+                    extraSshArgs: deviceIdentityArgs(deviceProfile),
                 }];
         }
         const host = await resolveHost(singleName);
         if (host) {
-            return [{ name: singleName, sshTarget: sshTargetFor(host), os: host.os }];
+            return [{ name: singleName, sshTarget: sshTargetFor(host), os: host.os, extraSshArgs: hostIdentityArgs(host) }];
         }
         console.error(chalk.red(`Unknown host or device '${singleName}'.`));
         process.exit(1);
@@ -180,6 +185,7 @@ async function resolveFleetTargets(opts) {
         name: d.name,
         sshTarget: d.name,
         os: d.platform !== 'unknown' ? d.platform : undefined,
+        extraSshArgs: deviceIdentityArgs(d),
     }));
 }
 async function probeFleetTarget(target) {
@@ -190,12 +196,14 @@ async function probeFleetTarget(target) {
     // has it via the install profile, and our single-quote escaping would
     // prevent $HOME expansion there, so skip the bootstrap on Windows.
     isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' });
-    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: 30000, multiplex: true });
+    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs: target.extraSshArgs });
     if (res.code !== 0) {
         return {
             name: target.name,
             online: false,
-            error: res.timedOut ? 'timed out' : (res.stderr || `exit ${res.code ?? 'unknown'}`),
+            error: isWin
+                ? diagnoseWindowsSshFailure(res.stderr, res.timedOut)
+                : res.timedOut ? 'timed out' : (res.stderr || `exit ${res.code ?? 'unknown'}`),
             agents: {},
         };
     }
@@ -238,7 +246,11 @@ export const FLEET_INVENTORY_TIMEOUT_MS = 180_000;
 async function probeFleetInventory(target) {
     const isWin = /^win/i.test((target.os ?? '').trim());
     const remoteCmd = buildRemoteAgentsInvocation(['doctor', '--json'], undefined, isWin ? 'windows' : undefined, isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' });
-    const res = await sshExecAsync(target.sshTarget, remoteCmd, { timeoutMs: FLEET_INVENTORY_TIMEOUT_MS, multiplex: true });
+    const res = await sshExecAsync(target.sshTarget, remoteCmd, {
+        timeoutMs: FLEET_INVENTORY_TIMEOUT_MS,
+        multiplex: true,
+        extraSshArgs: target.extraSshArgs,
+    });
     if (res.code !== 0)
         return null;
     try {
@@ -404,6 +416,7 @@ async function runDevicesDoctor(opts) {
                 execPolicy: process.platform === 'win32'
                     ? { platform: process.platform, policy: getEffectiveExecutionPolicy() }
                     : undefined,
+                windowsSshEnrollment: auditWindowsSshEnrollment(),
                 isolatedVersions: localReports
                     .filter((rep) => isVersionIsolated(rep.agent, rep.version))
                     .map((rep) => `${rep.agent}@${rep.version}`),
@@ -1182,7 +1195,7 @@ function checkPayload(device, drift) {
 async function probeDeviceCheck(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const remoteCmd = buildRemoteAgentsInvocation(['doctor', '--check', '--json'], undefined, isWin ? 'windows' : undefined, isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' });
-    const res = await sshExecAsync(target.dialTarget, remoteCmd, { timeoutMs: 30000, multiplex: true });
+    const res = await sshExecAsync(target.dialTarget, remoteCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs: target.extraSshArgs });
     if (res.code !== 0 && !res.stdout.trim()) {
         throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
     }
@@ -1211,6 +1224,7 @@ async function runDevicesCheck(opts, cwd) {
         platform: t.device.platform,
         skip: t.skip,
         dialTarget: fleetDialTarget(t.device),
+        extraSshArgs: deviceIdentityArgs(t.device),
     }));
     const remote = await fanOutDevices(remoteTargets, probeDeviceCheck);
     const devices = [local];

package/dist/commands/exec.js

@@ -554,7 +554,7 @@ export function registerRunCommand(program) {
         .option('--until <signal>', 'Loop stop condition. `signal` reads <runDir>/loop-signal.json {continue,reason} each iteration; absent or continue:false stops (fail-closed). Loop only.')
         .option('--interval <dur>', 'Loop delay between iterations ("0" back-to-back, "30m" paces). Loop only.')
         .option('--where <spec>', 'Where this run\'s body executes (one placement door): local | device:<name> | auto | lease[:backend] | cloud[:provider]. Expands to --host/--lease/--cloud. Do not combine with those flags. See docs/00-concepts.md#placement.')
-        .option('--host <name>', 'Offload this run onto another machine over SSH — a device name, registered host, or user@host. Pass "auto" to pick from 14d usage affinity (most-used online device has highest probability). Same as --where device:<name>. See `agents devices`.')
+        .option('--host <name>', 'Offload this run onto another machine over SSH — a device name, registered host, or user@host. Pass "auto" to pick the least-loaded reachable device where the requested agent is installed and signed in, keeping the run local when no remote is better. Same as --where device:<name>. See `agents devices`.')
         .option('--device <name>', 'Alias of --host. Pass "auto" for affinity-based device pick (same as --where auto).')
         .option('--remote-cwd <dir>', "Explicit host working directory for --host runs, used VERBATIM (overrides --cwd; usually --cwd suffices — it re-roots a local-home path onto the remote home). Pass a single-quoted '$HOME/…' or a valid remote absolute path; a local ~ expands here and won't exist there (/Users/you vs /home/you).")
         .option('--no-follow', 'With --host, dispatch detached and return immediately (track via `agents hosts ps/logs`).')
@@ -947,13 +947,18 @@ export function registerRunCommand(program) {
             if (!resolvedResumeSource && runAutoDefaultsToAffinity(options))
                 options.device = 'auto';
         }
-        // --device auto / --host auto (and deprecated --smart): affinity-pick host.
+        // --device auto / --host auto (and deprecated --smart): live fleet pick.
         // Harness is always the agent the user typed — never auto-picked.
         // Affinity failure degrades to local (does not kill the run).
         {
             const { applyDeviceAutoToOptions } = await import('../lib/smart-launch.js');
-            const result = applyDeviceAutoToOptions(options, {
+            const result = await applyDeviceAutoToOptions(options, {
                 accountPickerRequested,
+                // `run auto` selects its harness after placement, so do not filter
+                // candidates against an arbitrary proxy harness at this stage.
+                agent: normalizedAgentSpec.split('@')[0] === RUN_AUTO_KEYWORD
+                    ? undefined
+                    : (resolveAgentName(normalizedAgentSpec.split('@')[0]) ?? undefined),
             });
             if (!options.quiet && result.deprecationSmart) {
                 process.stderr.write(chalk.yellow('[agents] --smart is deprecated; use --device auto\n'));
@@ -964,7 +969,7 @@ export function registerRunCommand(program) {
             if (!options.quiet && result.banner) {
                 const { hostLabel, deviceHint, acctNote } = result.banner;
                 process.stderr.write(chalk.gray(`[agents] device=auto → ${hostLabel}` +
-                    (deviceHint ? ` (affinity ${deviceHint})` : '') +
+                    (deviceHint ? ` (load ${deviceHint})` : '') +
                     ` · ${acctNote}\n`));
             }
         }
@@ -1790,7 +1795,7 @@ export function registerRunCommand(program) {
                 await warnUnpushedWork(resumeExec.cwd ?? process.cwd());
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError, signInRecoverableCandidates }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
@@ -2268,22 +2273,18 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             version = resolvedRecoveryTarget.version;
-            const canResumeNatively = resolvedRecoveryTarget.mode === 'native';
-            if (canResumeNatively) {
+            if (resolvedRecoveryTarget.mode === 'native') {
                 version = session.version;
                 resumeNative = true;
                 resumeSessionId = session.id;
-                // Native `--resume` (claude/codex) resolves the transcript relative to the
-                // working directory (projects/<cwd-hash>/). The session may have been started
-                // in a different directory than we're standing in now — most importantly when a
-                // routine daemon fires `agents run --resume` from its own cwd. Spawn from the
-                // session's ORIGIN cwd so the resume actually finds it; otherwise the agent
-                // exits "No conversation found with session ID". Honor an explicit --cwd only if
-                // the caller passed one (they're overriding on purpose).
-                if (!options.cwd && session.cwd)
-                    options.cwd = session.cwd;
+                // The centralized recovery decision proves the transcript belongs to
+                // this exact isolated home and resolves any harness-specific launch cwd.
+                // Claude's indexed `session.cwd` is the first user-turn cwd, which may
+                // differ from the earlier cwd that selected projects/<cwd-key>.
+                if (!options.cwd && resolvedRecoveryTarget.cwd)
+                    options.cwd = resolvedRecoveryTarget.cwd;
                 if (!options.quiet)
-                    process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''}${!options.cwd || options.cwd === session.cwd ? ` in ${session.cwd ?? cwd}` : ''}\n`));
+                    process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''} in ${options.cwd ?? cwd}\n`));
             }
             else {
                 // Tier-2: launch fresh with a /continue <id> first message; the agent
@@ -2301,6 +2302,9 @@ export function registerRunCommand(program) {
         // synthesize a same-agent fallback chain from the other healthy accounts
         // (issue #348). Stays null unless a non-pinned strategy actually rotated.
         let rotationResult = null;
+        // Set when the zero-healthy path already announced a deliberate
+        // launch-to-sign-in, so the login preflight below does not repeat it.
+        let signInLaunch = false;
         if (options.strategy && !explicitStrategy) {
             console.error(chalk.red(`Invalid strategy: ${options.strategy}. Use ${RUN_STRATEGIES.join(', ')}.`));
             process.exit(1);
@@ -2327,15 +2331,53 @@ export function registerRunCommand(program) {
                 try {
                     const resolved = await resolveRunVersion(agent, strategy, cwd);
                     if (resolved.exhausted) {
-                        // Fail loud (RUSH-2132): the old behavior warned "found no
-                        // usable version; falling back to defaults" and launched the
-                        // pinned default anyway — the exact move that loops a rotate
-                        // into an exhausted account. The message text is a contract
-                        // the Factory watchdog tail-detects; do not reword it.
-                        console.error(chalk.red(formatNoHealthyAccountError(agent, strategy, resolved.exhausted)));
-                        process.exit(1);
+                        // Zero healthy accounts splits two ways, and conflating them is what
+                        // stranded a logged-out harness with no way in at all (RUSH-2334):
+                        //
+                        // - THROTTLED (rate_limited / out_of_credits) -> fail loud (RUSH-2132).
+                        //   The old behavior warned "found no usable version; falling back to
+                        //   defaults" and launched the pinned default anyway — the exact move
+                        //   that loops a rotate into an exhausted account. Only a window reset
+                        //   clears it. The message text is a contract the Factory watchdog
+                        //   tail-detects; do not reword it.
+                        // - NEEDS A SIGN-IN (signed_out / revoked) -> launching IS the fix,
+                        //   because the harness's own TUI is the login surface. So on a TTY we
+                        //   carry the user into that login instead of erroring. Exiting here
+                        //   made `agents run <agent>`, `agents run <agent>@`, and `agents use`
+                        //   all dead-end with no reachable way to authenticate.
+                        const recoverable = signInRecoverableCandidates(resolved.exhausted);
+                        const { signInLaunchDecision } = await import('./run-account-picker.js');
+                        const decision = signInLaunchDecision({
+                            recoverable: recoverable.length,
+                            tty: isInteractiveTerminal(),
+                            json: options.json === true,
+                        });
+                        if (decision === 'launch') {
+                            const { pickSignInLaunchVersion } = await import('./run-account-picker.js');
+                            const signInVersion = await pickSignInLaunchVersion(agent, recoverable, !!options.quiet);
+                            // A cancelled prompt launches nothing — same contract as the
+                            // trailing-@ account picker above.
+                            if (!signInVersion)
+                                return;
+                            version = signInVersion;
+                            // We just told the user this account is logged out and why we're
+                            // launching it, so suppress the downstream login preflight — it
+                            // would print a second, near-identical "looks logged out" warning.
+                            signInLaunch = true;
+                        }
+                        else {
+                            console.error(chalk.red(formatNoHealthyAccountError(agent, strategy, resolved.exhausted)));
+                            if (recoverable.length > 0) {
+                                // Off a TTY nobody can complete a login, so we still exit — but
+                                // name the actual fix rather than only offering --strategy pinned,
+                                // which would just pin the same unauthenticated account.
+                                const { loginHint } = await import('../lib/signin-badge.js');
+                                console.error(chalk.gray(`To sign in: ${loginHint(agent)} — or run \`agents run ${agent}\` from a terminal.`));
+                            }
+                            process.exit(1);
+                        }
                     }
-                    if (resolved.version) {
+                    else if (resolved.version) {
                         version = resolved.version;
                         rotationResult = resolved.rotation;
                         if (resolved.rotation && !options.quiet) {
@@ -2427,7 +2469,10 @@ export function registerRunCommand(program) {
                 json: options.json,
                 quiet: options.quiet,
                 authCheckDisabled: options.authCheck === false || process.env.AGENTS_NO_AUTH_CHECK === '1',
-                rotated: !!rotationResult || accountPickerRequested,
+                // `signInLaunch` means the zero-healthy path already reported this exact
+                // account as logged out and named the login command, so re-probing here
+                // only prints a second, near-identical warning.
+                rotated: !!rotationResult || accountPickerRequested || signInLaunch,
             });
             if (preflight) {
                 try {

package/dist/commands/hosts.js

@@ -13,7 +13,7 @@ import { isInteractiveTerminal } from './utils.js';
 import { assertValidSshTarget } from '../lib/ssh-exec.js';
 import { getProvider, listAllHosts, resolveHost } from '../lib/hosts/registry.js';
 import { getDevice } from '../lib/devices/registry.js';
-import { sshTargetFor } from '../lib/hosts/types.js';
+import { hostIdentityArgs, sshTargetFor } from '../lib/hosts/types.js';
 import { listSshConfigHosts, listKnownHosts, isSshConfigHost } from '../lib/hosts/ssh-config.js';
 import { probeHost, remoteAgentsVersion, bootstrapAgentsCli, localCliVersion, } from '../lib/hosts/ready.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
@@ -190,14 +190,15 @@ async function doCheck(name) {
     const target = sshTargetFor(host);
     const os = host.os ?? resolveRemoteOsSync(name);
     process.stdout.write(`Probing ${chalk.cyan(name)} (${target})… `);
-    const probe = probeHost(target, os);
+    const identityArgs = hostIdentityArgs(host);
+    const probe = probeHost(target, os, identityArgs);
     if (!probe.reachable) {
         console.log(chalk.red('unreachable'));
         process.exitCode = 1;
         return;
     }
     console.log(chalk.green('reachable') + chalk.gray(probe.os ? ` · ${probe.os}` : ''));
-    const ver = remoteAgentsVersion(target, probe.os ?? os);
+    const ver = remoteAgentsVersion(target, probe.os ?? os, identityArgs);
     console.log(`  agents-cli: ${ver ? chalk.green(ver) : chalk.yellow('not installed')}`);
 }
 async function doRemove(name) {

package/dist/commands/insights.js

@@ -217,16 +217,27 @@ function renderReport(groups, dim, meta, actions, harnesses) {
         return;
     }
     // Per-group table — the headline, and the thing no sibling command produces.
+    // Includes silent-stall counts so harness/account laziness is visible without --json.
     out.push('');
     out.push(chalk.bold(`By ${dim}`));
-    const labelW = Math.min(Math.max(...groups.map((g) => stringWidth(g.label)), 5), Math.max(20, terminalWidth() - 46));
+    const labelW = Math.min(Math.max(...groups.map((g) => stringWidth(g.label)), 5), Math.max(16, terminalWidth() - 58));
     const sessW = Math.max(...groups.map((g) => String(g.sessions).length), 3);
+    const stallOf = (g) => Object.entries(g.facets.frictionSignals)
+        .filter(([k]) => k.startsWith('silent stall:'))
+        .reduce((n, [, c]) => n + c, 0);
+    const resumeOf = (g) => g.facets.correctionSignals['resume after silent stall'] ?? 0;
+    const stallW = Math.max(...groups.map((g) => String(stallOf(g)).length), 5);
+    out.push(chalk.gray(`  ${padToWidth('', labelW)}  ${''.padStart(sessW)}       ` +
+        `${''.padStart(9)}  ${''.padStart(8)}  ${'stalls'.padStart(stallW)}  resume`));
     for (const g of groups) {
         const cost = g.costUsd > 0 ? formatUsd(g.costUsd) : '—';
         const dur = g.durationMs > 0 ? formatDuration(g.durationMs) : '—';
+        const stalls = stallOf(g);
+        const resumes = resumeOf(g);
         out.push(`  ${padToWidth(truncateToWidth(g.label, labelW), labelW)}  ` +
             `${chalk.gray(String(g.sessions).padStart(sessW))} ${chalk.gray('sess')}  ` +
-            `${chalk.green(padToWidth(cost, 9))}  ${chalk.gray(dur)}`);
+            `${chalk.green(padToWidth(cost, 9))}  ${chalk.gray(padToWidth(dur, 8))}  ` +
+            `${chalk.cyan(String(stalls).padStart(stallW))}  ${chalk.cyan(String(resumes))}`);
     }
     // Everything below is the whole scope folded together; per-group detail is in --json.
     const all = newFacetAccumulator();
@@ -235,16 +246,32 @@ function renderReport(groups, dim, meta, actions, harnesses) {
     renderCounts('Top tools', topEntries(all.toolCounts, 8), out);
     renderCounts('Languages', topEntries(all.languages, 6), out);
     renderCounts('Models', topEntries(all.models, 6), out);
+    renderCounts('Silent stalls by model', topEntries(all.silentStallsByModel ?? {}, 8), out);
     // Friction — the section that earns the command.
     const gaps = all.responseGaps;
+    const silentStalls = Object.entries(all.frictionSignals)
+        .filter(([k]) => k.startsWith('silent stall:'))
+        .reduce((n, [, c]) => n + c, 0);
+    const resumeNudges = all.correctionSignals['resume after silent stall'] ?? 0;
     out.push('');
     out.push(chalk.bold('Friction'));
     out.push(`  ${padToWidth('interruptions', 18)}  ${chalk.cyan(String(all.interruptions))}` +
         chalk.gray('   turns you cut short'));
     out.push(`  ${padToWidth('tool errors', 18)}  ${chalk.cyan(String(all.errorCount))}`);
     if (gaps.length > 0) {
-        out.push(`  ${padToWidth('your reply time', 18)}  ` +
-            chalk.cyan(`p50 ${Math.round(percentile(gaps, 50))}s`) + chalk.gray(` · p90 ${Math.round(percentile(gaps, 90))}s`));
+        // Same timestamps as silent stalls; this line is the distribution. Silent
+        // stalls (below) are the agent-attributed long gaps after the model stopped.
+        out.push(`  ${padToWidth('gap until next msg', 18)}  ` +
+            chalk.cyan(`p50 ${Math.round(percentile(gaps, 50))}s`) + chalk.gray(` · p90 ${Math.round(percentile(gaps, 90))}s`) +
+            chalk.gray('   after assistant last spoke'));
+    }
+    if (silentStalls > 0) {
+        out.push(`  ${padToWidth('silent stalls', 18)}  ${chalk.cyan(String(silentStalls))}` +
+            chalk.gray('   agent idle ≥5m until you resumed (also in By ' + dim + ' table)'));
+    }
+    if (resumeNudges > 0) {
+        out.push(`  ${padToWidth('resume nudges', 18)}  ${chalk.cyan(String(resumeNudges))}` +
+            chalk.gray('   "continue"/"keep going" after a silent stall'));
     }
     const errs = topEntries(all.errorCategories, 6);
     if (errs.length > 0) {
@@ -321,7 +348,7 @@ function renderReport(groups, dim, meta, actions, harnesses) {
         out.push(chalk.yellow(`  ${meta.unreadable} transcripts could not be read; their behaviour is missing from these totals.`));
     }
     if (all.gapsOverCeiling > 0) {
-        out.push(chalk.gray(`  ${all.gapsOverCeiling} reply gaps over an hour excluded from the percentiles.`));
+        out.push(chalk.gray(`  ${all.gapsOverCeiling} gaps over an hour excluded from p50/p90 (still counted as silent stall: 1h+ when the assistant last spoke).`));
     }
     out.push('');
     out.push(chalk.gray('  `agents insights --by project` to see it per repo'));
@@ -341,6 +368,13 @@ async function renderNarrative(payload) {
         '2. What is costing you — split into the assistant\'s fault vs your own workflow.',
         '3. Quick wins — concrete, tied to a number in the data.',
         '4. Worth trying — one more ambitious workflow change.',
+        '',
+        'Silent stalls (required): if frictionSignals contain "silent stall: …" or',
+        'correctionSignals contain "resume after silent stall" / "continue / keep going",',
+        'call that out explicitly in section 2 or 3 with the counts. Those mean the model',
+        'stopped mid-session and sat idle until the human pinged it (timestamps: last',
+        'assistant event → next user message ≥ 5 minutes). Do not reframe them as the',
+        'user being slow unless the data only shows short reply gaps.',
         'Be specific and cite the numbers. No preamble, no flattery, no bullet padding.',
         '',
         JSON.stringify(payload),