@phnx-labs/agents-cli 1.22.26 → 1.22.28

package/dist/lib/teams/remoteWorktree.js

@@ -40,30 +40,30 @@ export function remotePathExpr(p) {
  * downstream remote command (launch `cd`, worktree create, polling) works from an
  * absolute path with no tilde-expansion hazard.
  */
-export function resolveRemoteRepoRoot(target, repoPath) {
+export function resolveRemoteRepoRoot(target, repoPath, opts = {}) {
     assertValidSshTarget(target);
     const cmd = `git -C ${remotePathExpr(repoPath)} rev-parse --show-toplevel 2>/dev/null`;
-    const res = sshExec(target, cmd, { timeoutMs: 15000, multiplex: true });
+    const res = sshExec(target, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     const root = res.stdout.trim();
     return res.code === 0 && root ? root : null;
 }
 /** Run one git command in `repoPath` on the host; throw with stderr on failure. */
-function remoteGit(target, repoPath, args, timeoutMs = 60000) {
+function remoteGit(target, repoPath, args, timeoutMs = 60000, opts = {}) {
     const cmd = ['git', '-C', repoPath, ...args].map(shellQuote).join(' ');
-    const res = sshExec(target, cmd, { timeoutMs, multiplex: true });
+    const res = sshExec(target, cmd, { timeoutMs, multiplex: true, extraSshArgs: opts.extraSshArgs });
     if (res.code !== 0) {
         throw new Error(`remote git failed on ${target} (${args[0]}): ${(res.stderr || res.stdout).trim() || 'ssh error'}`);
     }
     return res.stdout.trim();
 }
 /** True when `repoPath` is a git working tree on the host. */
-export function isRemoteGitRepo(target, repoPath) {
+export function isRemoteGitRepo(target, repoPath, opts = {}) {
     assertValidSshTarget(target);
     // remotePathExpr so a `~`/`$HOME`-relative path (the canonical repos dir) expands
     // on the host — plain shellQuote would single-quote the tilde into a literal,
     // making an existing checkout look absent and forcing a doomed re-clone.
     const cmd = `git -C ${remotePathExpr(repoPath)} rev-parse --git-dir 2>/dev/null`;
-    const res = sshExec(target, cmd, { timeoutMs: 15000, multiplex: true });
+    const res = sshExec(target, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     return res.code === 0;
 }
 /**
@@ -71,12 +71,12 @@ export function isRemoteGitRepo(target, repoPath) {
  * Falls back to `main` when origin/HEAD isn't set, matching the local recipe's
  * `remote set-head` step.
  */
-export function remoteDefaultBranch(target, repoPath) {
+export function remoteDefaultBranch(target, repoPath, opts = {}) {
     assertValidSshTarget(target);
     try {
         // Refresh origin/HEAD first so a repo cloned before the default was set resolves.
-        sshExec(target, ['git', '-C', repoPath, 'remote', 'set-head', 'origin', '--auto'].map(shellQuote).join(' '), { timeoutMs: 20000, multiplex: true });
-        const ref = remoteGit(target, repoPath, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
+        sshExec(target, ['git', '-C', repoPath, 'remote', 'set-head', 'origin', '--auto'].map(shellQuote).join(' '), { timeoutMs: 20000, multiplex: true, extraSshArgs: opts.extraSshArgs });
+        const ref = remoteGit(target, repoPath, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], 60000, opts);
         return ref.replace(/^origin\//, '') || 'main';
     }
     catch {
@@ -91,15 +91,15 @@ export function remoteDefaultBranch(target, repoPath) {
  * `worktree add -b … origin/<default>` so a stale checkout can't fork the
  * teammate off old code.
  */
-export function createRemoteWorktree(target, repoPath, worktreeName) {
+export function createRemoteWorktree(target, repoPath, worktreeName, opts = {}) {
     assertValidSshTarget(target);
     assertName(worktreeName);
-    const gitRoot = remoteGit(target, repoPath, ['rev-parse', '--show-toplevel']);
-    const base = remoteDefaultBranch(target, gitRoot);
+    const gitRoot = remoteGit(target, repoPath, ['rev-parse', '--show-toplevel'], 60000, opts);
+    const base = remoteDefaultBranch(target, gitRoot, opts);
     const worktreePath = `${gitRoot}/.agents/worktrees/${worktreeName}`;
     const branchName = `agents/${worktreeName}`;
-    remoteGit(target, gitRoot, ['fetch', 'origin'], 120000);
-    remoteGit(target, gitRoot, ['worktree', 'add', '-b', branchName, worktreePath, `origin/${base}`], 120000);
+    remoteGit(target, gitRoot, ['fetch', 'origin'], 120000, opts);
+    remoteGit(target, gitRoot, ['worktree', 'add', '-b', branchName, worktreePath, `origin/${base}`], 120000, opts);
     return worktreePath;
 }
 // Team-name → repos-dir slug: same allowlist a worktree name uses, so it lands
@@ -126,24 +126,24 @@ function repoSlug(name) {
  * expands `$HOME` — single-quoting the tilde would defeat expansion, the same
  * hazard dispatch.ts avoids.
  */
-export function ensureRemoteRepo(target, repo, slug) {
+export function ensureRemoteRepo(target, repo, slug, opts = {}) {
     assertValidSshTarget(target);
     const safeSlug = repoSlug(slug);
     const canonical = `~/.agents/repos/${safeSlug}`;
     // 1. Canonical checkout already exists → fetch and reuse.
-    if (isRemoteGitRepo(target, canonical)) {
+    if (isRemoteGitRepo(target, canonical, opts)) {
         // Best-effort refresh; a fetch failure (offline origin) shouldn't block reuse.
-        sshExec(target, `git -C ${remotePathExpr(canonical)} fetch origin`, { timeoutMs: 120000, multiplex: true });
-        const root = resolveRemoteRepoRoot(target, canonical);
+        sshExec(target, `git -C ${remotePathExpr(canonical)} fetch origin`, { timeoutMs: 120000, multiplex: true, extraSshArgs: opts.extraSshArgs });
+        const root = resolveRemoteRepoRoot(target, canonical, opts);
         if (!root)
             throw new Error(`Repo at ${canonical} on ${target} vanished mid-provision.`);
         return root;
     }
     // 2. `repo` is a path that already exists on the host as a git repo → use it.
     if (repo && !looksLikeUrl(repo)) {
-        const existing = resolveRemoteRepoRoot(target, repo);
+        const existing = resolveRemoteRepoRoot(target, repo, opts);
         if (existing) {
-            sshExec(target, `git -C ${remotePathExpr(existing)} fetch origin`, { timeoutMs: 120000, multiplex: true });
+            sshExec(target, `git -C ${remotePathExpr(existing)} fetch origin`, { timeoutMs: 120000, multiplex: true, extraSshArgs: opts.extraSshArgs });
             return existing;
         }
     }
@@ -159,12 +159,12 @@ export function ensureRemoteRepo(target, repo, slug) {
     // blocks *shell* injection and is orthogonal to *git-transport* injection.
     assertSafeGitTransport(repo);
     const clone = sshExec(target, `mkdir -p ${remotePathExpr('~/.agents/repos')} && ` +
-        `git clone -- ${shellQuote(repo)} ${remotePathExpr(canonical)}`, { timeoutMs: 600000, multiplex: true });
+        `git clone -- ${shellQuote(repo)} ${remotePathExpr(canonical)}`, { timeoutMs: 600000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     if (clone.code !== 0) {
         throw new Error(`git clone ${repo} into ${canonical} on ${target} failed: ` +
             `${(clone.stderr || clone.stdout).trim() || 'ssh error'}`);
     }
-    const root = resolveRemoteRepoRoot(target, canonical);
+    const root = resolveRemoteRepoRoot(target, canonical, opts);
     if (!root)
         throw new Error(`Cloned ${repo} into ${canonical} on ${target} but it isn't a git repo.`);
     return root;
@@ -176,10 +176,10 @@ function looksLikeUrl(repo) {
         repo.startsWith('git@'));
 }
 /** True when the host worktree has uncommitted changes (staged or unstaged). */
-export function remoteWorktreeDirty(target, worktreePath) {
+export function remoteWorktreeDirty(target, worktreePath, opts = {}) {
     assertValidSshTarget(target);
     const cmd = ['git', '-C', worktreePath, 'status', '--porcelain'].map(shellQuote).join(' ');
-    const res = sshExec(target, cmd, { timeoutMs: 20000, multiplex: true });
+    const res = sshExec(target, cmd, { timeoutMs: 20000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     if (res.code !== 0)
         return false;
     return res.stdout.trim().length > 0;
@@ -189,17 +189,18 @@ export function remoteWorktreeDirty(target, worktreePath) {
  * "not a working tree" error and ignores a missing branch, matching local
  * `removeWorktree` semantics so cleanup never throws on a half-gone worktree.
  */
-export function removeRemoteWorktree(target, repoPath, worktreeName, deleteBranch = true) {
+export function removeRemoteWorktree(target, repoPath, worktreeName, deleteBranch = true, opts = {}) {
     assertValidSshTarget(target);
     assertName(worktreeName);
-    const gitRoot = remoteGit(target, repoPath, ['rev-parse', '--show-toplevel']);
+    const gitRoot = remoteGit(target, repoPath, ['rev-parse', '--show-toplevel'], 60000, opts);
     const worktreePath = `${gitRoot}/.agents/worktrees/${worktreeName}`;
     const branchName = `agents/${worktreeName}`;
-    const rm = sshExec(target, ['git', '-C', gitRoot, 'worktree', 'remove', '--force', worktreePath].map(shellQuote).join(' '), { timeoutMs: 60000, multiplex: true });
+    const rm = sshExec(target, ['git', '-C', gitRoot, 'worktree', 'remove', '--force', worktreePath].map(shellQuote).join(' '), { timeoutMs: 60000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     if (rm.code !== 0 && /is not a working tree/.test(rm.stderr + rm.stdout)) {
         sshExec(target, ['git', '-C', gitRoot, 'worktree', 'prune'].map(shellQuote).join(' '), {
             timeoutMs: 30000,
             multiplex: true,
+            extraSshArgs: opts.extraSshArgs,
         });
     }
     if (deleteBranch) {
@@ -207,6 +208,7 @@ export function removeRemoteWorktree(target, repoPath, worktreeName, deleteBranc
         sshExec(target, ['git', '-C', gitRoot, 'branch', '-D', branchName].map(shellQuote).join(' '), {
             timeoutMs: 20000,
             multiplex: true,
+            extraSshArgs: opts.extraSshArgs,
         });
     }
 }

package/dist/lib/tmux/session.d.ts

@@ -179,6 +179,14 @@ export declare const AGENT_HOOK_SCHEMA = 5;
 export declare function agentPaneDiedHook(sessionName: string, agentPane: string): string;
 /** Stamp a session's hook-schema marker to the current version. */
 export declare function markSessionHookSchema(name: string, socket?: string): Promise<void>;
+/**
+ * Decide whether a native resume may attach an existing managed tmux session.
+ * Only a positively resolved, living agent pane is reusable. Metadata-less
+ * legacy sessions and stale metadata resolve their real first pane through
+ * tmux before the decision; a dead or unreadable session is reaped so the
+ * caller can create a fresh wrapper for the resumed harness.
+ */
+export declare function prepareSessionForResume(name: string, socket?: string): Promise<'attach' | 'create'>;
 /**
  * Retrofit the current guarded `pane-died` hook onto every managed `agents run`
  * session whose hook predates AGENT_HOOK_SCHEMA. Idempotent and NON-DESTRUCTIVE:

package/dist/lib/tmux/session.js

@@ -359,6 +359,28 @@ async function lowestPaneId(name, socket) {
         return undefined;
     return ids.reduce((lo, id) => (parseInt(id.slice(1), 10) < parseInt(lo.slice(1), 10) ? id : lo));
 }
+/**
+ * Decide whether a native resume may attach an existing managed tmux session.
+ * Only a positively resolved, living agent pane is reusable. Metadata-less
+ * legacy sessions and stale metadata resolve their real first pane through
+ * tmux before the decision; a dead or unreadable session is reaped so the
+ * caller can create a fresh wrapper for the resumed harness.
+ */
+export async function prepareSessionForResume(name, socket) {
+    const sock = socket ?? getDefaultSocketPath();
+    if (!(await hasSession(name, sock)))
+        return 'create';
+    const recordedPane = readSessionMeta(name)?.pane;
+    const recordedState = recordedPane ? await paneExitStatus(recordedPane, sock) : undefined;
+    const pane = recordedPane && recordedState?.found
+        ? recordedPane
+        : await lowestPaneId(name, sock);
+    const state = pane ? await paneExitStatus(pane, sock) : undefined;
+    if (pane && state?.found && !state.dead)
+        return 'attach';
+    await killSession(name, sock);
+    return 'create';
+}
 /**
  * Retrofit the current guarded `pane-died` hook onto every managed `agents run`
  * session whose hook predates AGENT_HOOK_SCHEMA. Idempotent and NON-DESTRUCTIVE:

package/dist/lib/types.d.ts

@@ -1064,6 +1064,8 @@ export interface HostEntry {
     address?: string;
     /** SSH user — inline hosts only. */
     user?: string;
+    /** Explicit private key inherited from a fleet device profile. */
+    identityFile?: string;
     /** Captured at enroll probe. */
     os?: string;
     /** Free-form capability tags for routing (e.g. ['gpu']). */

package/dist/lib/versions.d.ts

@@ -525,6 +525,7 @@ export declare function syncResourcesToVersion(agent: AgentId, version: string,
     projectDir?: string;
     cwd?: string;
     force?: boolean;
+    available?: AvailableResources;
 }): SyncResult;
 /**
  * Get the effective HOME directory for an agent.

package/dist/lib/versions.js

@@ -346,11 +346,21 @@ function skillDirsMatch(src, dest) {
                 return false;
         }
         else {
-            if (!fs.existsSync(destPath))
+            // Stat-first (RUSH-2320 #2): size mismatch = definitive miss, no reads.
+            // Equal mtimes across different trees are accidental — content-compare
+            // whenever sizes match.
+            let srcStat;
+            let destStat;
+            try {
+                srcStat = fs.statSync(srcPath);
+                destStat = fs.statSync(destPath);
+            }
+            catch {
                 return false;
-            const srcContent = fs.readFileSync(srcPath, 'utf-8');
-            const destContent = fs.readFileSync(destPath, 'utf-8');
-            if (srcContent !== destContent)
+            }
+            if (srcStat.size !== destStat.size)
+                return false;
+            if (fs.readFileSync(srcPath, 'utf-8') !== fs.readFileSync(destPath, 'utf-8'))
                 return false;
         }
     }
@@ -2580,7 +2590,28 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
     // Extra DotAgent repos registered via `agents repo add`. Looked up last so
     // project/user/system repos win on name collisions.
     const extraRepos = getEnabledExtraRepos();
-    const available = getAvailableResources(cwd);
+    // Project-layer fan-out always runs — even on the early guard hit — so the
+    // `projectSkipped` contract is preserved for callers (RUSH-2320 #4).
+    if (projectAgentsDir) {
+        result.projectSkipped = syncProjectResourcesToAgent(agent, version, projectAgentsDir).skipped;
+    }
+    // Fast guard BEFORE getAvailableResources / pattern expansion /
+    // ensureVersionResourcePatterns. Guard needs only loadManifest + isStale
+    // (~6 ms); the work that used to sit ahead of it was ~12.5 ms of the 21.5 ms
+    // guard-hit path and is discarded when nothing changed (RUSH-2320 #4).
+    // Behavior note: a valid manifest implies a prior full sync already wrote
+    // version resource patterns, so skipping ensureVersionResourcePatterns on
+    // the hit path is safe in practice but is not byte-identical to the old
+    // order (that call always wrote missing pattern defaults).
+    if (!userPassedSelection && !options.force) {
+        const manifest = loadManifest(agent, version);
+        if (manifest && !isStale(manifest, agent, version, cwd)) {
+            return { ...result };
+        }
+    }
+    // Prefer a caller-supplied inventory (refresh already built one) so multi-
+    // version fan-out does not re-scan resource trees per version (RUSH-2320 #5).
+    const available = options.available ?? getAvailableResources(cwd);
     // Write default resource selection patterns for this version (idempotent —
     // only sets fields that aren't already present, preserving user edits).
     {
@@ -2640,21 +2671,6 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
             }
         }
     }
-    if (projectAgentsDir) {
-        result.projectSkipped = syncProjectResourcesToAgent(agent, version, projectAgentsDir).skipped;
-    }
-    // Fast guard: skip the entire sync when the caller requested a full sync and
-    // nothing has changed since the last full sync. Pattern-derived selections
-    // still count as full syncs because they are the persisted intended scope,
-    // not a one-off caller override.
-    if (!userPassedSelection && !options.force) {
-        const manifest = loadManifest(agent, version);
-        if (manifest && !isStale(manifest, agent, version, cwd)) {
-            // Nothing synced, but the project sync above already ran — carry its
-            // skipped files out so the caller can still report them.
-            return { ...result };
-        }
-    }
     // Helper: remove a path (symlink or real) if it exists
     const removePath = (p) => {
         try {
@@ -3023,9 +3039,11 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
     // launch can skip the slow path. Pattern-derived selections still count as
     // "full" — the agents.yaml patterns describe the intended scope, not a
     // one-off override, so the resulting state matches what the manifest
-    // records as the synced set.
+    // records as the synced set. Carry forward still-fresh fingerprints from
+    // the previous manifest so we do not re-hash an unchanged tree (RUSH-2320 #3).
     if (!userPassedSelection) {
-        const manifest = buildSyncManifest(agent, version, cwd);
+        const previous = loadManifest(agent, version);
+        const manifest = buildSyncManifest(agent, version, cwd, previous);
         manifest.writtenCommands = writtenCommands;
         saveManifest(agent, version, manifest);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.26",
+  "version": "1.22.28",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -54,6 +54,8 @@
     "changelog": "bun scripts/gen-changelog.ts",
     "start": "node dist/index.js",
     "test": "node ./node_modules/vitest/vitest.mjs run",
+    "bench": "node ./node_modules/vitest/vitest.mjs bench --run",
+    "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",
     "test:remote": "scripts/sandbox.sh 'bun install && bun run build && bun run test'",
     "verify-docs": "scripts/verify-docs.sh",
     "test:watch": "node ./node_modules/vitest/vitest.mjs"