@phnx-labs/agents-cli 1.22.26 → 1.22.28

package/dist/lib/daemon.js

@@ -20,6 +20,7 @@ import { executeJobDetached, monitorRunningJobs } from './runner.js';
 import { detectOverdueJobs, notifyOverdue } from './overdue.js';
 import { runCatchup } from './catchup.js';
 import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from './routine-notify.js';
+import { notifyOwnerRoutineFinish, notifyOwnerRoutineStartFailed } from './routine-notify-owner.js';
 import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { redactSecrets } from './redact.js';
@@ -516,6 +517,16 @@ export async function runDaemon() {
                         notifyRoutineFinish(final);
                     }
                     catch { /* best-effort */ }
+                    // RUSH-2288: a failed/timed-out routine also reaches the OWNER's phone
+                    // (in-process owner channel stack), not just the local desktop. Green
+                    // runs are silent — the builder returns early. Async + swallowed so a
+                    // delivery hiccup never blocks the finish path.
+                    void notifyOwnerRoutineFinish(final)
+                        .then((r) => {
+                        if (r.attempts.length && !r.delivered)
+                            log('WARN', `Owner failure-notify for '${config.name}' reached no channel (tried: ${r.attempts.map((a) => a.channel).join(', ')})`);
+                    })
+                        .catch(() => { });
                 },
             });
             log('INFO', `Job '${config.name}' spawned (run: ${meta.runId}, PID: ${meta.pid})`);
@@ -531,6 +542,15 @@ export async function runDaemon() {
                 notifyRoutineStartFailed(config, message);
             }
             catch { /* best-effort */ }
+            // RUSH-2288: the pre-spawn failure (e.g. auth_failed) is exactly the one the
+            // per-routine `agents notify` prompt can never send — its agent never ran —
+            // so the daemon reaches the owner directly.
+            void notifyOwnerRoutineStartFailed(config, message)
+                .then((r) => {
+                if (r.attempts.length && !r.delivered)
+                    log('WARN', `Owner start-failure notify for '${config.name}' reached no channel (tried: ${r.attempts.map((a) => a.channel).join(', ')})`);
+            })
+                .catch(() => { });
         }
     };
     let scheduler = null;

package/dist/lib/devices/connect.d.ts

@@ -50,6 +50,8 @@ export interface SshHostKeyOptions {
     /** Managed known_hosts path override (tests). Defaults to the CLI-managed store. */
     knownHostsFile?: string;
 }
+/** OpenSSH argv that makes an explicit device key authoritative. */
+export declare function deviceIdentityArgs(device: DeviceProfile): string[];
 /**
  * Build the argv (after the `ssh` program name) and the environment overlay
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at

package/dist/lib/devices/connect.js

@@ -82,6 +82,12 @@ export function wrapRemoteCommand(device, cmd) {
     }
     return joined;
 }
+/** OpenSSH argv that makes an explicit device key authoritative. */
+export function deviceIdentityArgs(device) {
+    return device.auth?.method === 'key' && device.auth.identityFile
+        ? ['-i', device.auth.identityFile, '-o', 'IdentitiesOnly=yes']
+        : [];
+}
 /**
  * Build the argv (after the `ssh` program name) and the environment overlay
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at
@@ -118,6 +124,7 @@ export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, o
     }
     else {
         args.push('-o', 'BatchMode=yes');
+        args.push(...deviceIdentityArgs(device));
     }
     // An interactive login (no remote command) needs a real tty.
     if (!remote)

package/dist/lib/devices/doctor-findings.d.ts

@@ -2,6 +2,7 @@ import type { AgentId } from '../types.js';
 import type { DuplicateVersionHook } from '../hooks.js';
 import type { RcSecretFinding } from '../secrets/rc-hygiene.js';
 import type { OwnerSinkStatus } from '../channels/owner-sink.js';
+import { type WindowsSshEnrollmentAudit } from './windows-ssh-enrollment.js';
 import type { SyncStatusRow, OrphanRow } from '../drift.js';
 import type { FetchStatusMarker } from '../auto-pull.js';
 import type { VersionResourceReport } from '../doctor-diff.js';
@@ -11,7 +12,7 @@ export type FindingSeverity = 'critical' | 'warning';
  *  the JSON consumer group by kind. */
 /** Every finding class. Severity is NOT annotated here — {@link FINDING_SEVERITY}
  *  below owns it, and a second copy in these comments is a fourth place to drift. */
-export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "stale-cli", "owner-sink-unreachable"];
+export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "ssh-key-enrollment", "stale-cli", "owner-sink-unreachable"];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
  * the builders below and asserted against both prose rubrics by
@@ -102,6 +103,8 @@ export interface LocalFindingInputs {
         platform: NodeJS.Platform;
         policy: string | null;
     };
+    /** Read-only Windows OpenSSH AuthorizedKeysFile/content/ACL audit. */
+    windowsSshEnrollment?: WindowsSshEnrollmentAudit | null;
     /** `<agent>@<version>` keys whose home is an isolated copy. Their findings are
      *  never collapsed across versions: the agent-wide `agents doctor <agent> --fix`
      *  sweep deliberately skips isolated copies, so a collapsed row would print a

package/dist/lib/devices/doctor-findings.js

@@ -18,7 +18,7 @@
  * with. Keep this list exhaustive; a kind missing from it is a doc that lies.
  *   CRITICAL — logged-out (provable) · missing-hook · missing-plugin ·
  *              unwired-hook (a hook on disk that settings.json never fires) ·
- *              cli-missing · owner-sink-unreachable (the feed/notify owner lane
+ *              cli-missing · ssh-key-enrollment · owner-sink-unreachable (the feed/notify owner lane
  *              cannot reach the owner from this box).
  *   WARNING  — logout-unprovable (hedged) · missing-resource · content-drift ·
  *              never-synced · stale · repo-behind · repo-drift · version-skew ·
@@ -40,6 +40,7 @@ import { blocksLocalScripts } from '../platform/winpath.js';
 import { loginHint } from '../signin-badge.js';
 import { CONFIG_ENV_ISOLATED_AGENTS } from '../shims.js';
 import { padToWidth, stringWidth } from '../session/width.js';
+import { windowsSshEnrollmentProblem } from './windows-ssh-enrollment.js';
 const AGENT_NAMES = Object.fromEntries(ALL_AGENT_IDS.map((id) => [id, AGENTS[id].name]));
 /** Agents with NO per-version credential isolation: their login is shared across
  *  every installed version, so a "log into THIS version" remediation would be a
@@ -97,6 +98,7 @@ export const ALL_FINDING_KINDS = [
     'rc-secret-export', // credential-shaped export in a shell rc file
     'env-secret-export', // the file-store master key live in THIS process's env
     'exec-policy', // Windows execution policy blocks agents.ps1
+    'ssh-key-enrollment', // Windows OpenSSH public-key path/content/ACL is invalid
     'stale-cli',
     'owner-sink-unreachable', // the feed/notify owner-delivery lane can't reach the owner from this box
 ];
@@ -141,6 +143,7 @@ export const FINDING_SEVERITY = {
     'rc-secret-export': 'warning',
     'env-secret-export': 'warning',
     'exec-policy': 'warning',
+    'ssh-key-enrollment': 'critical',
     'stale-cli': 'warning',
 };
 function agentName(agent) {
@@ -254,6 +257,8 @@ export function remediationFor(finding) {
             return 'unset at the source, then restart every process that inherited it (shells, editor, tmux, agents daemon)';
         case 'exec-policy':
             return 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned';
+        case 'ssh-key-enrollment':
+            return 'repair the reported AuthorizedKeysFile, then rerun agents doctor';
         case 'stale-cli':
             return 'upgrade';
         case 'owner-sink-unreachable':
@@ -493,6 +498,15 @@ export function buildLocalFindings(input) {
     const policyFinding = execPolicyFinding(device, input.execPolicy);
     if (policyFinding)
         out.push(policyFinding);
+    if (input.windowsSshEnrollment) {
+        const problem = windowsSshEnrollmentProblem(input.windowsSshEnrollment);
+        if (problem) {
+            out.push(finding({
+                severity: FINDING_SEVERITY['ssh-key-enrollment'], kind: 'ssh-key-enrollment', device,
+                message: problem,
+            }));
+        }
+    }
     // Per-version sign-in → logged-out (critical, provable) / logout-unprovable
     // (warning). Signed-in versions produce no finding — the accounts line shows
     // them. Agents that can't be inspected never yield a logout finding.

package/dist/lib/devices/harness-inventory.d.ts

@@ -0,0 +1,97 @@
+import type { AgentId } from '../types.js';
+import { type UsageSnapshot } from '../usage.js';
+/** An account's usage headroom rolled into one glanceable summary. */
+export interface QuotaSummary {
+    /**
+     * `available` / `rate_limited` from the live usage windows, or `null` when
+     * there is no snapshot at all (no data yet, or the agent has no usage source).
+     */
+    status: 'available' | 'rate_limited' | null;
+    /** Max utilization across blocking windows (0-100, rounded), or null when unknown. */
+    usedPercent: number | null;
+    /** True when the snapshot is a cached `last_seen`, not a fresh `live` read. */
+    stale: boolean;
+}
+/** One installed (agent, version) on a host, fully resolved. */
+export interface HarnessRow {
+    agent: AgentId;
+    version: string;
+    /** Account display label (email / id), or null when signed out or unidentifiable. */
+    account: string | null;
+    signedIn: boolean;
+    quota: QuotaSummary;
+    /** signed in AND not rate-limited — usable for a run right now. */
+    ready: boolean;
+    /** When `!ready`, a short reason ("signed out" / "rate-limited"). */
+    reason?: string;
+}
+/** One host's rows, or the reason it produced none. */
+export interface HostHarnessResult {
+    host: string;
+    rows: HarnessRow[];
+    /** Set when the host failed to probe (offline / error). */
+    error?: string;
+    /** Set when the host was skipped (control / offline). */
+    skipped?: string;
+}
+/** An account collapsed across the installs on one host that share it. */
+export interface AccountGroup {
+    /** Account display label, or null for the signed-out bucket. */
+    account: string | null;
+    /** Distinct agent ids using this account, sorted. */
+    agents: AgentId[];
+    /** How many (agent, version) installs share this account. */
+    installs: number;
+    /** True when at least one install under this account is signed in. */
+    signedIn: boolean;
+    /** Representative quota — an account maps to one provider identity, so its usage is shared. */
+    quota: QuotaSummary;
+    ready: boolean;
+    reason?: string;
+}
+/**
+ * Roll one usage snapshot into a {@link QuotaSummary}. Mirrors the blocking-window
+ * selection of {@link deriveUsageStatusFromSnapshot} (the model-specific
+ * `sonnet_week` sub-limit is excluded so hitting it doesn't read as a throttled
+ * account) and takes the highest utilization across those windows. Pure.
+ */
+export declare function summarizeQuota(snapshot: UsageSnapshot | null | undefined): QuotaSummary;
+/**
+ * "Ready" = signed in AND not rate-limited. A missing quota snapshot does NOT
+ * block readiness: the account is signed in and usable, we just have no live
+ * utilization to show. Pure.
+ */
+export declare function computeReady(signedIn: boolean, quota: QuotaSummary): {
+    ready: boolean;
+    reason?: string;
+};
+/**
+ * Enumerate every installed (agent, version) on THIS host, resolve account +
+ * sign-in + quota + ready, and return the rows. Signed-out installs are kept
+ * (they are the actionable ones), unlike the auth-health probe which drops
+ * `unconfigured`. Quota is cache-only unless `refresh` is set.
+ */
+export declare function collectLocalHarnessInventory(opts?: {
+    agents?: readonly AgentId[];
+    refresh?: boolean;
+}): Promise<HarnessRow[]>;
+/**
+ * Collapse a host's rows into one {@link AccountGroup} per distinct account (the
+ * signed-out installs fall into the `null` bucket). Because an account label maps
+ * to a single provider identity, every install sharing it shares one quota, so
+ * the group's quota is taken from the first row carrying real data (preferring a
+ * `rate_limited` row so a throttle is never hidden). Pure.
+ */
+export declare function groupByAccount(rows: HarnessRow[]): AccountGroup[];
+/** Short human quota cell: "12%", "limited", or "—" when no data. */
+export declare function formatQuota(quota: QuotaSummary): string;
+/**
+ * Render the device × harness table: one block per device, one row per installed
+ * (agent, version) with account / signed-in / quota / ready. Pure.
+ */
+export declare function renderHarnessMatrix(results: HostHarnessResult[]): string[];
+/**
+ * Render the device × account table: one block per device, one row per distinct
+ * account (installs sharing it collapsed), showing which harnesses use it. Pure.
+ */
+export declare function renderAccountsMatrix(results: HostHarnessResult[]): string[];

package/dist/lib/devices/registry.d.ts

@@ -26,6 +26,8 @@ export interface DeviceAddress {
 /** Authentication settings for a device. */
 export interface DeviceAuth {
     method: DeviceAuthMethod;
+    /** Explicit private-key path passed to OpenSSH for key authentication. */
+    identityFile?: string;
     /** Secrets bundle holding the password (when method === 'password'). */
     bundle?: string;
     /** Key within the bundle whose value is the password. Defaults to 'password'. */

package/dist/lib/devices/resolve-target.d.ts

@@ -8,6 +8,7 @@ export interface ResolvedSshTarget {
     machine: string;
     name: string;
     os?: string;
+    extraSshArgs?: string[];
 }
 export interface ResolvedExplicitTargetSet {
     targets: ResolvedSshTarget[];

package/dist/lib/devices/resolve-target.js

@@ -18,7 +18,7 @@
  * `user@host` all resolve identically no matter which subcommand called.
  */
 import chalk from 'chalk';
-import { sshTargetFor } from '../hosts/types.js';
+import { hostIdentityArgs, sshTargetFor } from '../hosts/types.js';
 import { matchHost, splitUserHost } from '../hosts/registry.js';
 import { normalizeHost } from '../machine-id.js';
 import { resolveRemoteOsSync } from '../hosts/remote-os.js';
@@ -61,7 +61,14 @@ async function toResolvedTarget(token) {
     }
     const hostPart = host.device ? host.device.name : splitUserHost(host.name).host;
     const name = host.device ? host.device.name : host.name;
-    return { target, machine: normalizeHost(hostPart), name, os: host.os ?? resolveRemoteOsSync(name) };
+    const extraSshArgs = hostIdentityArgs(host);
+    return {
+        target,
+        machine: normalizeHost(hostPart),
+        name,
+        os: host.os ?? resolveRemoteOsSync(name),
+        ...(extraSshArgs.length > 0 ? { extraSshArgs } : {}),
+    };
 }
 /**
  * Resolve a target token to a full {@link DeviceProfile} for `agents ssh`. Same

package/dist/lib/devices/ssh-config.js

@@ -15,6 +15,9 @@ function renderHost(device) {
     const lines = [`Host ${device.name}`, `    HostName ${hostName}`];
     if (device.user)
         lines.push(`    User ${device.user}`);
+    if (device.auth.method === 'key' && device.auth.identityFile) {
+        lines.push(`    IdentityFile ${device.auth.identityFile}`, '    IdentitiesOnly yes');
+    }
     return lines.join('\n');
 }
 /**

package/dist/lib/devices/windows-ssh-enrollment.d.ts

@@ -0,0 +1,20 @@
+export interface WindowsSshEnrollment {
+    administrator: boolean;
+    expectedPath: string;
+    configuredPaths: string[];
+    fileExists: boolean;
+    hasPublicKey: boolean;
+    owner: string | null;
+    systemFullControl: boolean;
+    administratorsFullControl: boolean;
+    unexpectedAclPrincipals: string[];
+}
+export type WindowsSshEnrollmentAudit = {
+    status: WindowsSshEnrollment;
+} | {
+    error: string;
+};
+export declare function diagnoseWindowsSshFailure(stderr: string, timedOut: boolean): string;
+export declare function parseWindowsSshEnrollment(stdout: string): WindowsSshEnrollment;
+export declare function auditWindowsSshEnrollment(platform?: NodeJS.Platform): WindowsSshEnrollmentAudit | null;
+export declare function windowsSshEnrollmentProblem(audit: WindowsSshEnrollmentAudit): string | null;

package/dist/lib/devices/windows-ssh-enrollment.js

@@ -0,0 +1,98 @@
+import { spawnSync } from 'child_process';
+export function diagnoseWindowsSshFailure(stderr, timedOut) {
+    if (timedOut || /connection timed out|operation timed out/i.test(stderr)) {
+        return 'Windows SSH unreachable: port 22 did not answer before the timeout';
+    }
+    if (/host key verification failed|remote host identification has changed/i.test(stderr)) {
+        return 'Windows OpenSSH host-key verification failed; verify and re-pin the device host key';
+    }
+    if (/permission denied.*publickey|permission denied \(publickey/i.test(stderr)) {
+        return 'port 22 and OpenSSH are reachable, but the public key was rejected; recover through the Windows console or password-auth profile, then run agents doctor on that box to inspect its effective AuthorizedKeysFile and ACL';
+    }
+    if (/connection refused/i.test(stderr)) {
+        return 'Windows host is reachable but OpenSSH is not listening on port 22';
+    }
+    return stderr.trim() || 'Windows SSH probe failed';
+}
+const AUDIT_SCRIPT = String.raw `
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$administratorSid = 'S-1-5-32-544'
+$administrator = @($identity.Groups | Where-Object { $_.Value -eq $administratorSid }).Count -gt 0
+$expected = if ($administrator) { Join-Path $env:ProgramData 'ssh\administrators_authorized_keys' } else { Join-Path $env:USERPROFILE '.ssh\authorized_keys' }
+$sshd = Join-Path $env:WINDIR 'System32\OpenSSH\sshd.exe'
+$effective = (& $sshd -T -C "user=$env:USERNAME,host=$env:COMPUTERNAME,addr=127.0.0.1" 2>$null | Select-String '^authorizedkeysfile ' | Select-Object -First 1).Line
+$configured = if ($effective) { @($effective.Substring('authorizedkeysfile '.Length).Split(' ', [StringSplitOptions]::RemoveEmptyEntries)) } else { @() }
+$exists = Test-Path -LiteralPath $expected -PathType Leaf
+$acl = if ($exists) { Get-Acl -LiteralPath $expected } else { $null }
+$rules = if ($acl) { @($acl.Access | Where-Object AccessControlType -eq Allow) } else { @() }
+$full = [Security.AccessControl.FileSystemRights]::FullControl
+$system = @($rules | Where-Object { $_.IdentityReference.Value -in @('NT AUTHORITY\SYSTEM', 'S-1-5-18') -and ($_.FileSystemRights -band $full) -eq $full }).Count -gt 0
+$admins = @($rules | Where-Object { $_.IdentityReference.Value -in @('BUILTIN\Administrators', 'S-1-5-32-544') -and ($_.FileSystemRights -band $full) -eq $full }).Count -gt 0
+$allowed = @('NT AUTHORITY\SYSTEM', 'S-1-5-18', 'BUILTIN\Administrators', 'S-1-5-32-544')
+$unexpected = if ($administrator) { @($rules | ForEach-Object { $_.IdentityReference.Value } | Where-Object { $_ -notin $allowed } | Sort-Object -Unique) } else { @() }
+$hasKey = $exists -and [bool](Select-String -LiteralPath $expected -Pattern '^\s*(ssh-(rsa|ed25519)|ecdsa-sha2-)' -Quiet)
+[ordered]@{ administrator=$administrator; expectedPath=$expected; configuredPaths=$configured; fileExists=$exists; hasPublicKey=$hasKey; owner=if($acl){$acl.Owner}else{$null}; systemFullControl=$system; administratorsFullControl=$admins; unexpectedAclPrincipals=$unexpected } | ConvertTo-Json -Compress
+`;
+export function parseWindowsSshEnrollment(stdout) {
+    const raw = JSON.parse(stdout.trim());
+    const strings = (value) => Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : typeof value === 'string' ? [value] : [];
+    if (typeof raw.administrator !== 'boolean' || typeof raw.expectedPath !== 'string') {
+        throw new Error('Windows SSH enrollment audit returned an invalid payload');
+    }
+    return {
+        administrator: raw.administrator,
+        expectedPath: raw.expectedPath,
+        configuredPaths: strings(raw.configuredPaths),
+        fileExists: raw.fileExists === true,
+        hasPublicKey: raw.hasPublicKey === true,
+        owner: typeof raw.owner === 'string' ? raw.owner : null,
+        systemFullControl: raw.systemFullControl === true,
+        administratorsFullControl: raw.administratorsFullControl === true,
+        unexpectedAclPrincipals: strings(raw.unexpectedAclPrincipals),
+    };
+}
+export function auditWindowsSshEnrollment(platform = process.platform) {
+    if (platform !== 'win32')
+        return null;
+    const encoded = Buffer.from(AUDIT_SCRIPT, 'utf16le').toString('base64');
+    const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], {
+        encoding: 'utf8',
+        windowsHide: true,
+        timeout: 10_000,
+    });
+    if (result.status !== 0)
+        return { error: (result.stderr || 'audit command failed').trim() };
+    try {
+        return { status: parseWindowsSshEnrollment(result.stdout) };
+    }
+    catch (error) {
+        return { error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export function windowsSshEnrollmentProblem(audit) {
+    if ('error' in audit)
+        return `Windows OpenSSH enrollment audit failed: ${audit.error}`;
+    const status = audit.status;
+    const normalize = (path) => path.replace(/\//g, '\\').toLowerCase();
+    const expected = normalize(status.expectedPath);
+    const effective = status.configuredPaths.map((path) => normalize(path)
+        .replace('__programdata__', normalize(process.env.ProgramData ?? 'C:\\ProgramData'))
+        .replace(/^\.ssh\\/, `${normalize(process.env.USERPROFILE ?? '')}\\.ssh\\`));
+    if (effective.length > 0 && !effective.includes(expected)) {
+        return `OpenSSH AuthorizedKeysFile resolves to ${status.configuredPaths.join(', ')}, not ${status.expectedPath}`;
+    }
+    if (!status.fileExists)
+        return `SSH public-key file missing: ${status.expectedPath}`;
+    if (!status.hasPublicKey)
+        return `no public key enrolled in ${status.expectedPath}`;
+    if (status.administrator && (!status.systemFullControl || !status.administratorsFullControl)) {
+        return `${status.expectedPath} ACL must grant FullControl to SYSTEM and Administrators`;
+    }
+    if (status.administrator && status.unexpectedAclPrincipals.length > 0) {
+        return `${status.expectedPath} ACL grants access to unexpected principals: ${status.unexpectedAclPrincipals.join(', ')}`;
+    }
+    return null;
+}

package/dist/lib/events.d.ts

@@ -13,7 +13,7 @@
  */
 import type { ActorKind } from './actor.js';
 export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
 /** Every known event kind. Derived from {@link EVENT_TYPE_TABLE}, never hand-listed. */
 export declare const EVENT_TYPES: readonly EventType[];
 /** Runtime guard for an event kind arriving from outside this process. */

package/dist/lib/events.js

@@ -113,7 +113,7 @@ const EVENT_TYPE_TABLE = {
     'skill.install': true, 'skill.remove': true,
     'browser.launch': true, 'browser.close': true, 'browser.navigate': true, 'browser.screenshot': true,
     'computer.action': true,
-    'secrets.get': true, 'secrets.unlocked': true, 'secrets.create': true, 'secrets.import': true, 'secrets.export': true, 'secrets.view': true, 'secrets.set': true, 'secrets.delete': true, 'secrets.rename': true,
+    'secrets.get': true, 'secrets.unlocked': true, 'secrets.create': true, 'secrets.import': true, 'secrets.export': true, 'secrets.view': true, 'secrets.lease-denied': true, 'secrets.lease-expire': true, 'secrets.set': true, 'secrets.delete': true, 'secrets.rename': true,
     'cloud.dispatch': true, 'cloud.complete': true, 'cloud.cancel': true, 'cloud.message': true,
     'teams.create': true, 'teams.add': true, 'teams.start': true, 'teams.complete': true, 'teams.disband': true,
     'hook.fire': true, 'hook.complete': true, 'hook.error': true,
@@ -141,7 +141,7 @@ export function isEventType(value) {
 }
 const AUDIT_EVENTS = new Set([
     'command.start', 'command.end',
-    'secrets.get', 'secrets.unlocked', 'secrets.create', 'secrets.import', 'secrets.export', 'secrets.view',
+    'secrets.get', 'secrets.unlocked', 'secrets.create', 'secrets.import', 'secrets.export', 'secrets.view', 'secrets.lease-denied', 'secrets.lease-expire',
     'secrets.set', 'secrets.delete', 'secrets.rename',
     'teams.create', 'teams.add', 'teams.start', 'teams.complete', 'teams.disband',
     'cloud.dispatch', 'cloud.complete', 'cloud.cancel', 'cloud.message',

package/dist/lib/exec.js

@@ -31,6 +31,7 @@ import { isTmuxInstalled } from './tmux/binary.js';
 import { shellQuote } from './ssh-exec.js';
 import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
+import { applyActiveRulesPresetAtRun } from './rules/run-sync.js';
 /**
  * Map a raw mode string (CLI flag, YAML field, env var) to the canonical Mode.
  *
@@ -967,6 +968,12 @@ export function buildExecCommand(options) {
             // on the default command is parsed as a project path, not a message.
             cmd.push('--prompt', options.prompt);
         }
+        else if (interactive && options.agent === 'claude') {
+            // Claude's -p is --print, not a prompt-value flag. In an interactive run
+            // the initial prompt is positional; emitting `-p /continue <id>` turns a
+            // focus recovery into a one-shot print process that immediately exits.
+            cmd.push(options.prompt);
+        }
         else if (template.promptFlag === 'positional') {
             cmd.push(options.prompt);
         }
@@ -1285,7 +1292,7 @@ export function formatPaneTail(raw, maxLines = 30) {
  *      (Ctrl-b d) — return 0 and LEAVE the session for `agents focus` to re-attach.
  */
 async function runInTmux(options, executable, args) {
-    const { createSession, hasSession, killSession, paneExitStatus, setSessionHook, slugifyName, agentPaneDiedHook, markSessionHookSchema } = await import('./tmux/session.js');
+    const { createSession, killSession, paneExitStatus, prepareSessionForResume, setSessionHook, slugifyName, agentPaneDiedHook, markSessionHookSchema } = await import('./tmux/session.js');
     const { getDefaultSocketPath } = await import('./tmux/paths.js');
     const { attachTmux, runTmux } = await import('./tmux/binary.js');
     const socket = getDefaultSocketPath();
@@ -1294,15 +1301,11 @@ async function runInTmux(options, executable, args) {
     const name = slugifyName(`ag-${options.agent}-${idSeed}`);
     // A native resume must not create a competing wrapper for a live session.
     // A retained dead pane is reaped before the harness resumes normally.
-    if (options.resume && await hasSession(name, socket)) {
-        const existing = await createSession({ name, cwd, socket, source: 'cli', attachExisting: true });
+    if (options.resume && await prepareSessionForResume(name, socket) === 'attach') {
         if (options.sessionId)
             writeSessionAliasRecord(options.sessionId, name);
-        if (!existing.pane || !(await paneExitStatus(existing.pane, socket)).dead) {
-            await attachTmux({ socket, args: ['attach-session', '-t', name] });
-            return { exitCode: 0, stderr: '', stdout: '' };
-        }
-        await killSession(name, socket);
+        await attachTmux({ socket, args: ['attach-session', '-t', name] });
+        return { exitCode: 0, stderr: '', stdout: '' };
     }
     // SessionStart learns some harness IDs only after launch. Carry the wrapper
     // name into that hook so it can bind both identities durably.
@@ -1980,6 +1983,13 @@ export async function runWithFallback(options) {
     }
     for (let i = 0; i < chain.length; i++) {
         const { agent, version, envOverride } = chain[i];
+        // Every fallback entry can target a different harness/version home. Sync
+        // its active preset immediately before dispatch so entries 2..N cannot
+        // inherit the stale rules file left by the primary entry.
+        const rulesVersion = version ?? resolveVersion(agent);
+        if (rulesVersion) {
+            applyActiveRulesPresetAtRun(agent, rulesVersion, getVersionHomePath(agent, rulesVersion));
+        }
         // Record the entry we're about to attempt so the caller (audit log) sees the
         // agent+version that actually ran, even after a rate-limit handoff.
         if (options.dispatchSink) {

package/dist/lib/fleet/apply.js

@@ -9,7 +9,7 @@
  */
 import * as os from 'os';
 import { pushBundleToHost } from '../secrets/push.js';
-import { sshTargetFor } from '../devices/connect.js';
+import { deviceIdentityArgs, sshTargetFor } from '../devices/connect.js';
 import { readyProbe, bootstrapAgentsCli } from '../hosts/ready.js';
 import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
 import { sshExec } from '../ssh-exec.js';
@@ -282,13 +282,14 @@ export function probeDevice(device, opts) {
         return { device: device.name, reachable: false, platform: device.platform, installedAgents: [], note: e.message };
     }
     const hint = osHint(device.platform);
-    const ready = readyProbe(target, hint);
+    const extraSshArgs = deviceIdentityArgs(device);
+    const ready = readyProbe(target, hint, extraSshArgs);
     if (!ready.reachable) {
         return { device: device.name, reachable: false, platform: device.platform, installedAgents: [], note: 'unreachable' };
     }
     let installed = [];
     const remoteCmd = buildRemoteAgentsInvocation(['teams', 'doctor', '--json'], undefined, hint, remoteEnv(device.platform));
-    const res = sshExec(target, remoteCmd, { timeoutMs: 30000, multiplex: true });
+    const res = sshExec(target, remoteCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
     if (res.code === 0) {
         try {
             const map = JSON.parse(res.stdout);
@@ -301,7 +302,7 @@ export function probeDevice(device, opts) {
     let installedVersions;
     if (opts?.withVersions) {
         const viewCmd = buildRemoteAgentsInvocation(['view', '--json'], undefined, hint, remoteEnv(device.platform));
-        const vres = sshExec(target, viewCmd, { timeoutMs: 30000, multiplex: true });
+        const vres = sshExec(target, viewCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
         if (vres.code === 0)
             installedVersions = parseInstalledVersions(vres.stdout);
     }
@@ -310,7 +311,7 @@ export function probeDevice(device, opts) {
         // Metadata only — `secrets list --json` returns names + timestamps and never
         // values, which is why this is safe to run across the fleet.
         const listCmd = buildRemoteAgentsInvocation(['secrets', 'list', '--json'], undefined, hint, remoteEnv(device.platform));
-        const lres = sshExec(target, listCmd, { timeoutMs: 30000, multiplex: true });
+        const lres = sshExec(target, listCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
         if (lres.code === 0)
             remoteBundles = parseRemoteBundles(lres.stdout);
     }
@@ -382,12 +383,13 @@ export function reconcileDevice(row, device, ctx) {
     }
     const hint = osHint(device.platform);
     const env = remoteEnv(device.platform);
+    const extraSshArgs = deviceIdentityArgs(device);
     let ok = true;
-    const sshAgents = (args, input) => sshExec(target, buildRemoteAgentsInvocation(args, undefined, hint, env), { timeoutMs: 300000, multiplex: true, input });
+    const sshAgents = (args, input) => sshExec(target, buildRemoteAgentsInvocation(args, undefined, hint, env), { timeoutMs: 300000, multiplex: true, input, extraSshArgs });
     // 1. agents-cli install/upgrade.
     const cliAction = row.actions.find((a) => a.kind === 'install-cli' || a.kind === 'upgrade-cli');
     if (cliAction) {
-        const r = bootstrapAgentsCli(target, ctx.targetCliVersion, hint);
+        const r = bootstrapAgentsCli(target, ctx.targetCliVersion, hint, extraSshArgs);
         steps.push({ kind: cliAction.kind, ok: r.ok, detail: cliAction.detail });
         ok = ok && r.ok;
     }

package/dist/lib/fleet/remote-login.d.ts

@@ -44,6 +44,7 @@ export interface PendingLogin {
     platform?: string;
     /** ssh dial target for the device. */
     target: string;
+    extraSshArgs?: string[];
     flow: LoginFlow;
     /** True when a device-code flow this command can actually drive. */
     remotable: boolean;
@@ -75,7 +76,7 @@ export declare function selectLoginTargets(devices: DeviceProfile[], agents: (Ag
  * devices need the askpass shim env, which the PTY env allowlist strips — those
  * are a follow-up (TODO), surfaced as an error rather than silently mis-driven.
  */
-export declare function buildRemoteLoginSshCommand(target: string, flow: LoginFlow): string;
+export declare function buildRemoteLoginSshCommand(target: string, flow: LoginFlow, extraSshArgs?: string[]): string;
 export type LoginMode = 'bulk' | 'interactive';
 /** Per-pair status shape shared between the driver, the status endpoint, and the page. */
 export type LoginStatusState = 'pending' | 'driving' | 'ready' | 'authorized' | 'error' | 'skipped';
@@ -138,7 +139,7 @@ export interface DriveResult extends ScrapedLogin {
  * in the browser; the caller polls the credential file for completion. Testable
  * against a fake {@link PtyDriver}.
  */
-export declare function driveRemoteLogin(target: string, flow: LoginFlow, driver: PtyDriver, opts?: DriveOptions): Promise<DriveResult>;
+export declare function driveRemoteLogin(target: string, flow: LoginFlow, driver: PtyDriver, opts?: DriveOptions, extraSshArgs?: string[]): Promise<DriveResult>;
 export interface DetectOptions {
     agents?: (AgentId | string)[];
     devices?: string[];
@@ -157,7 +158,7 @@ export declare function detectPending(opts?: DetectOptions): Promise<PendingLogi
  * bumping after the human completes the browser step. POSIX `stat` only (the
  * device-code agents are all POSIX-fleet).
  */
-export declare function remoteFileMtime(target: string, homeRel: string): Promise<number>;
+export declare function remoteFileMtime(target: string, homeRel: string, extraSshArgs?: string[]): Promise<number>;
 export interface RunFleetLoginOptions {
     agents?: (AgentId | string)[];
     devices?: string[];