@phnx-labs/agents-cli 1.22.26 → 1.22.28

package/dist/lib/fleet/remote-login.js

@@ -29,7 +29,7 @@
 import * as http from 'http';
 import { isControlDevice } from '../devices/registry.js';
 import { loadDevices } from '../devices/registry.js';
-import { fleetDialTarget } from '../devices/connect.js';
+import { deviceIdentityArgs, fleetDialTarget } from '../devices/connect.js';
 import { planFleetTargets } from '../devices/fleet.js';
 import { assertValidSshTarget, shellQuote, sshExecAsync } from '../ssh-exec.js';
 import { machineId } from '../session/sync/config.js';
@@ -134,6 +134,7 @@ export function selectLoginTargets(devices, agents, cache, opts = {}) {
                 agent,
                 platform: device.platform,
                 target: fleetDialTarget(device),
+                extraSshArgs: deviceIdentityArgs(device),
                 flow,
                 remotable,
                 reason,
@@ -152,7 +153,7 @@ export function selectLoginTargets(devices, agents, cache, opts = {}) {
  * devices need the askpass shim env, which the PTY env allowlist strips — those
  * are a follow-up (TODO), surfaced as an error rather than silently mis-driven.
  */
-export function buildRemoteLoginSshCommand(target, flow) {
+export function buildRemoteLoginSshCommand(target, flow, extraSshArgs = []) {
     assertValidSshTarget(target);
     // The agent CLIs (kimi/droid/codex/…) are agents-cli shims that live in
     // ~/.agents/.cache/shims and are only on PATH in an interactive/login shell.
@@ -165,6 +166,7 @@ export function buildRemoteLoginSshCommand(target, flow) {
         'ssh', '-tt',
         '-o', 'StrictHostKeyChecking=accept-new',
         '-o', 'ConnectTimeout=10',
+        ...extraSshArgs.map(shellQuote),
         shellQuote(target),
         shellQuote(remoteCmd),
     ].join(' ');
@@ -367,7 +369,7 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
  * in the browser; the caller polls the credential file for completion. Testable
  * against a fake {@link PtyDriver}.
  */
-export async function driveRemoteLogin(target, flow, driver, opts = {}) {
+export async function driveRemoteLogin(target, flow, driver, opts = {}, extraSshArgs = []) {
     const initialDelayMs = opts.initialDelayMs ?? 4000;
     const pollMs = opts.pollMs ?? 1000;
     const timeoutMs = opts.timeoutMs ?? 90000;
@@ -377,7 +379,7 @@ export async function driveRemoteLogin(target, flow, driver, opts = {}) {
     // `ssh -tt` process it drives) leaks until the sidecar's idle reaper. On the
     // normal return paths the caller owns stop() via the returned sessionId.
     try {
-        await driver.exec(id, buildRemoteLoginSshCommand(target, flow));
+        await driver.exec(id, buildRemoteLoginSshCommand(target, flow, extraSshArgs));
         await sleep(initialDelayMs);
         if (flow.deviceCodeSelect) {
             await driver.write(id, flow.deviceCodeSelect);
@@ -431,9 +433,9 @@ export async function detectPending(opts = {}) {
  * bumping after the human completes the browser step. POSIX `stat` only (the
  * device-code agents are all POSIX-fleet).
  */
-export async function remoteFileMtime(target, homeRel) {
+export async function remoteFileMtime(target, homeRel, extraSshArgs = []) {
     const cmd = `stat -c %Y "$HOME/${homeRel}" 2>/dev/null || stat -f %m "$HOME/${homeRel}" 2>/dev/null || echo 0`;
-    const res = await sshExecAsync(target, cmd, { timeoutMs: 15000, multiplex: true }).catch(() => null);
+    const res = await sshExecAsync(target, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs }).catch(() => null);
     if (!res || res.code !== 0)
         return 0;
     const n = parseInt(res.stdout.trim(), 10);
@@ -507,10 +509,10 @@ export async function runFleetLogin(opts = {}) {
         const k = key(p.device, p.agent);
         const st = statuses.get(k);
         st.state = 'driving';
-        const baseMtime = await remoteFileMtime(p.target, p.flow.successFile).catch(() => 0);
+        const baseMtime = await remoteFileMtime(p.target, p.flow.successFile, p.extraSshArgs).catch(() => 0);
         let sessionId;
         try {
-            const r = await driveRemoteLogin(p.target, p.flow, driver, opts.drive);
+            const r = await driveRemoteLogin(p.target, p.flow, driver, opts.drive, p.extraSshArgs);
             sessionId = r.sessionId;
             if (r.url && r.code) {
                 st.url = r.url;
@@ -539,7 +541,7 @@ export async function runFleetLogin(opts = {}) {
                 st.detail = 'device code expired before authorization';
                 break;
             }
-            const mtime = await remoteFileMtime(p.target, p.flow.successFile).catch(() => 0);
+            const mtime = await remoteFileMtime(p.target, p.flow.successFile, p.extraSshArgs).catch(() => 0);
             if (mtime > baseMtime) {
                 st.state = 'authorized';
                 break;

package/dist/lib/gemini-settings.d.ts

@@ -1,4 +1,3 @@
 export declare function readGeminiSettings(settingsPath: string): Record<string, unknown>;
 export declare function writeGeminiSettings(settingsPath: string, settings: Record<string, unknown>): void;
 export declare function updateGeminiSettings(settingsPath: string, mutate: (settings: Record<string, unknown>) => void): Record<string, unknown>;
-export declare function setGeminiAutoUpdateDisabled(settings: Record<string, unknown>): void;

package/dist/lib/gemini-settings.js

@@ -1,3 +1,15 @@
+/**
+ * Generic reader/writer for a `.gemini/…/settings.json`-shaped JSON config.
+ *
+ * Despite the name, this module is no longer gemini-specific: gemini itself
+ * is hard-deprecated and has no live caller left (its own settings writer,
+ * `generateGeminiConfig`, was removed with the RUSH-2202 runner.ts fix — a
+ * gemini routine is rejected before it ever reaches sandbox prep). Antigravity
+ * nests its own `settings.json` under the same `.gemini/antigravity-cli/` tree
+ * and shares this exact shape, so `permissions.ts` reuses `updateGeminiSettings`
+ * for antigravity's live permission writes. Keep the generic helpers; do not
+ * reintroduce gemini-only logic here.
+ */
 import * as fs from 'fs';
 import * as path from 'path';
 function isRecord(value) {
@@ -24,10 +36,3 @@ export function updateGeminiSettings(settingsPath, mutate) {
     writeGeminiSettings(settingsPath, settings);
     return settings;
 }
-export function setGeminiAutoUpdateDisabled(settings) {
-    const general = isRecord(settings.general) ? settings.general : {};
-    settings.general = {
-        ...general,
-        enableAutoUpdate: false,
-    };
-}

package/dist/lib/git.d.ts

@@ -269,9 +269,15 @@ export declare function displayHomePath(dir: string): string;
  * Pull changes in an existing repo.
  * Refuses to pull if the working tree is dirty -- user must commit or discard changes first.
  *
- * Uses `git pull --rebase` (same strategy as {@link syncRepoGit}) so a diverged
- * branch reconciles instead of failing with "Need to specify how to reconcile
- * divergent branches".
+ * Strategy (RUSH-2282):
+ *   1. Fetch, then compare HEAD to the resolved tracking ref.
+ *   2. Clean behind-only (HEAD is an ancestor of tracking) → `merge --ff-only`
+ *      against the tracking ref. Never re-enter `git pull` after a bare fetch —
+ *      multi-entry FETCH_HEAD (concurrent fetch, multi-branch remote) makes
+ *      `git pull --rebase` die with "Cannot rebase onto multiple branches" even
+ *      when the checkout is a pure fast-forward.
+ *   3. Genuinely diverged (local commits not on tracking) → `rebase` onto the
+ *      tracking ref (same outcome as {@link syncRepoGit}, without a second pull).
  */
 export declare function pullRepo(dir: string): Promise<{
     success: boolean;

package/dist/lib/git.js

@@ -867,9 +867,15 @@ export function displayHomePath(dir) {
  * Pull changes in an existing repo.
  * Refuses to pull if the working tree is dirty -- user must commit or discard changes first.
  *
- * Uses `git pull --rebase` (same strategy as {@link syncRepoGit}) so a diverged
- * branch reconciles instead of failing with "Need to specify how to reconcile
- * divergent branches".
+ * Strategy (RUSH-2282):
+ *   1. Fetch, then compare HEAD to the resolved tracking ref.
+ *   2. Clean behind-only (HEAD is an ancestor of tracking) → `merge --ff-only`
+ *      against the tracking ref. Never re-enter `git pull` after a bare fetch —
+ *      multi-entry FETCH_HEAD (concurrent fetch, multi-branch remote) makes
+ *      `git pull --rebase` die with "Cannot rebase onto multiple branches" even
+ *      when the checkout is a pure fast-forward.
+ *   3. Genuinely diverged (local commits not on tracking) → `rebase` onto the
+ *      tracking ref (same outcome as {@link syncRepoGit}, without a second pull).
  */
 export async function pullRepo(dir) {
     try {
@@ -933,16 +939,16 @@ export async function pullRepo(dir) {
                 tracking = `origin/${branch}`;
             }
         }
-        // Split the remote-tracking ref (<remote>/<branch>) into its parts and pull
-        // THOSE. Hardcoding 'origin' while comparing against `tracking` is how a
-        // branch tracking e.g. upstream/main silently 'succeeded': revparse saw a
-        // difference, the pull fetched origin/main (already current), and pullRepo
-        // returned success having moved nothing — the same "reported ok, pulled
-        // nothing" failure this change exists to remove. Branch names may contain
-        // slashes, so split on the FIRST separator only.
+        // Split the remote-tracking ref (<remote>/<branch>) so callers/logs can name
+        // the remote. Branch names may contain slashes, so split on the FIRST
+        // separator only. The integrate step below uses `tracking` directly (not a
+        // second `git pull <remote> <branch>`) so a multi-entry FETCH_HEAD cannot
+        // turn a clean fast-forward into "Cannot rebase onto multiple branches".
         const sep = tracking.indexOf('/');
-        const remoteName = sep > 0 ? tracking.slice(0, sep) : 'origin';
         const remoteBranch = sep > 0 ? tracking.slice(sep + 1) : branch;
+        // Keep branch-name validation on the ref we would have passed to pull —
+        // rejects traversal / flag-smuggling shapes before any integrate command.
+        assertValidBranchName(remoteBranch);
         // Bare fetch: updates every remote, so the revparse below sees a fresh ref
         // whichever one the branch tracks. Deliberately argument-less — simple-git's
         // fetchTask only forwards a remote when BOTH remote and branch are passed,
@@ -962,17 +968,27 @@ export async function pullRepo(dir) {
                 branch,
             };
         }
+        // Behind-only when tracking has commits we lack AND we have none of our own
+        // on top. Use rev-list counts — simple-git does not reject on the exit-1
+        // that `merge-base --is-ancestor` returns for a non-ancestor, so a try/catch
+        // around that call would always report "can ff" (RUSH-2282).
+        const aheadCount = parseInt((await git.raw(['rev-list', '--count', `${tracking}..HEAD`])).trim(), 10);
+        const behindCount = parseInt((await git.raw(['rev-list', '--count', `HEAD..${tracking}`])).trim(), 10);
+        const canFastForward = Number.isFinite(aheadCount) &&
+            Number.isFinite(behindCount) &&
+            aheadCount === 0 &&
+            behindCount > 0;
         try {
-            // Rebase, not --ff-only. Fast-forward refuses ANY divergence, conflict or
-            // not, so a single local commit permanently wedged the pull with nothing
-            // actually in conflict. Matches syncRepoGit (below) and this function's doc.
-            //
-            // Pull the RESOLVED tracking ref, not `branch`: when the local branch has
-            // no tracking config the block above falls back to origin's default head,
-            // which may be named differently (local `main` vs origin `master`). Using
-            // `branch` there asks origin for a ref it does not have.
-            assertValidBranchName(remoteBranch);
-            await git.pull(remoteName, remoteBranch, { '--rebase': 'true' });
+            if (canFastForward) {
+                // Integrate the already-fetched tracking ref. No network, no FETCH_HEAD.
+                await git.raw(['merge', '--ff-only', tracking]);
+            }
+            else {
+                // Diverged (or local-only commits). Rebase onto the tracking tip —
+                // same outcome as `git pull --rebase <remote> <branch>` without
+                // re-fetching or consulting FETCH_HEAD.
+                await git.raw(['rebase', tracking]);
+            }
         }
         catch (err) {
             // Abort so the tree is restored, matching the atomicity --ff-only gave us.
@@ -982,10 +998,11 @@ export async function pullRepo(dir) {
             // the cause. `agents sync` reaches this path unattended across the fleet,
             // so a wedged checkout would be worse than the bug this fixes.
             await git.raw(['rebase', '--abort']).catch(() => { });
+            const verb = canFastForward ? 'Fast-forward' : 'Rebase';
             return {
                 success: false,
                 commit: '',
-                error: `Rebase onto ${tracking} hit a conflict — the pull was rolled back, nothing changed.\n\nResolve the divergence, then pull again:\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}\n\n${err.message}`,
+                error: `${verb} onto ${tracking} failed — the pull was rolled back, nothing changed.\n\nResolve the divergence, then pull again:\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}\n\n${err.message}`,
             };
         }
         installGithooksSymlinks(dir);

package/dist/lib/hooks/profile.d.ts

@@ -10,8 +10,19 @@ export interface HookProfileRow {
     cacheStalePct: number;
     cacheMissPct: number;
     errorCount: number;
-    /** Fraction (0-1) of fires with a nonzero exit code. */
+    /**
+     * Fraction (0-1) of fires with a real crash exit (exit 1 / other nonzero
+     * except intentional PreToolUse deny code 2). Exit 2 is blockRate.
+     */
     errorRate?: number;
+    /**
+     * Count of intentional deny/block exits (PreToolUse exit 2). Deny-by-design
+     * guards (ask-user-question-guard, git-guard, plan-html-reminder) use this
+     * path — not a crash.
+     */
+    blockCount: number;
+    /** Fraction (0-1) of fires with exit code 2 (intentional deny/block). */
+    blockRate?: number;
     /** Fraction (0-1) of fires that hit their configured timeout. */
     timeoutRate?: number;
     /** Project key the row is scoped to (see project-key.ts) — set only when

package/dist/lib/hooks/profile.js

@@ -72,7 +72,10 @@ export function aggregateHookProfile(events) {
         const hits = evs.filter(e => e.cache === 'hit').length;
         const stale = evs.filter(e => e.cache === 'stale-prefetch').length;
         const misses = evs.filter(e => e.cache === 'miss').length;
-        const errors = evs.filter(e => typeof e.exit === 'number' && e.exit !== 0).length;
+        // Exit classes (Claude/Codex PreToolUse convention): 0 allow, 2 deny/block,
+        // 1 / other nonzero = real error. Exit 2 is not a crash.
+        const blocks = evs.filter(e => e.exit === 2).length;
+        const errors = evs.filter(e => typeof e.exit === 'number' && e.exit !== 0 && e.exit !== 2).length;
         rows.push({
             hook,
             n,
@@ -85,7 +88,9 @@ export function aggregateHookProfile(events) {
             cacheStalePct: Math.round((stale / n) * 100),
             cacheMissPct: Math.round((misses / n) * 100),
             errorCount: errors,
+            blockCount: blocks,
             ...(errors > 0 ? { errorRate: Math.round((errors / n) * 1000) / 1000 } : {}),
+            ...(blocks > 0 ? { blockRate: Math.round((blocks / n) * 1000) / 1000 } : {}),
             // timeoutRate is not derivable here: the daily JSONL a shim writes only
             // covers fires that reached their own trailing printf — an externally
             // enforced timeout (the agent harness killing the process) never gets

package/dist/lib/hooks.d.ts

@@ -217,12 +217,15 @@ export declare function listCentralHooks(): HookEntry[];
  *
  * A bare number stays seconds (`timeout: 30` → 30) for backward compatibility.
  * A Go-style duration string is parsed into seconds: `5s`, `2m`, `1h30m`,
- * `90s`, `1h`. This intentionally does NOT reuse {@link parseTimeout} from
- * routines.ts — that one returns milliseconds, has no seconds (`s`) unit, and
- * floors at one minute, none of which fit hook timeouts (typically 5–600s).
+ * `90s`, `1h`. Suffixed durations longer than 24 hours are rejected as likely
+ * typos, while bare seconds stay uncapped for backward compatibility. This
+ * intentionally does NOT reuse {@link parseTimeout} from routines.ts — that one
+ * returns milliseconds, has no seconds (`s`) unit, and floors at one minute,
+ * none of which fit hook timeouts (typically 5–600s).
  *
- * Returns the seconds value, or `null` when the input is not a positive number
- * or a parseable duration string — the caller decides how to surface that.
+ * Returns the seconds value, or `null` when the input is not a positive number,
+ * is not parseable, or is a suffixed duration longer than 24 hours — the caller
+ * decides how to surface that.
  */
 export declare function normalizeHookTimeoutSeconds(value: unknown): number | null;
 /**

package/dist/lib/hooks.js

@@ -1160,17 +1160,21 @@ export function listCentralHooks() {
     }
     return results;
 }
+const MAX_HOOK_DURATION_SECONDS = 24 * 60 * 60;
 /**
  * Normalize a hook `timeout` from agents.yaml into a whole number of seconds.
  *
  * A bare number stays seconds (`timeout: 30` → 30) for backward compatibility.
  * A Go-style duration string is parsed into seconds: `5s`, `2m`, `1h30m`,
- * `90s`, `1h`. This intentionally does NOT reuse {@link parseTimeout} from
- * routines.ts — that one returns milliseconds, has no seconds (`s`) unit, and
- * floors at one minute, none of which fit hook timeouts (typically 5–600s).
+ * `90s`, `1h`. Suffixed durations longer than 24 hours are rejected as likely
+ * typos, while bare seconds stay uncapped for backward compatibility. This
+ * intentionally does NOT reuse {@link parseTimeout} from routines.ts — that one
+ * returns milliseconds, has no seconds (`s`) unit, and floors at one minute,
+ * none of which fit hook timeouts (typically 5–600s).
  *
- * Returns the seconds value, or `null` when the input is not a positive number
- * or a parseable duration string — the caller decides how to surface that.
+ * Returns the seconds value, or `null` when the input is not a positive number,
+ * is not parseable, or is a suffixed duration longer than 24 hours — the caller
+ * decides how to surface that.
  */
 export function normalizeHookTimeoutSeconds(value) {
     if (typeof value === 'number') {
@@ -1194,7 +1198,7 @@ export function normalizeHookTimeoutSeconds(value) {
         const minutes = Number(m[4] || 0);
         const seconds = Number(m[5] || 0);
         const total = ((weeks * 7 + days) * 24 + hours) * 3600 + minutes * 60 + seconds;
-        return total > 0 ? total : null;
+        return total > 0 && total <= MAX_HOOK_DURATION_SECONDS ? total : null;
     }
     return null;
 }
@@ -1606,6 +1610,7 @@ function registerHooksForOpenCode(versionHome, manifest, resolveScript) {
     const pluginSource = `// Generated by agents-cli. Re-run agents sync to update.
 import fs from "node:fs"
 import os from "node:os"
+import path from "node:path"
 
 const directHooks = ${serializedDirect}
 const lifecycleHooks = ${serializedLifecycle}
@@ -1618,7 +1623,9 @@ function recordTimeoutSample(hook, payload) {
   // printf, so a timed-out fire would otherwise leave ZERO trace in the
   // warehouse. Write the sample ourselves from the side that knows it timed out.
   try {
-    fs.mkdirSync(PERF_SPOOL.slice(0, PERF_SPOOL.lastIndexOf("/")), { recursive: true })
+    // path.dirname — not lastIndexOf('/') — so Windows backslash spool paths
+    // still resolve to the parent dir (see #1869).
+    fs.mkdirSync(path.dirname(PERF_SPOOL), { recursive: true })
     const line = JSON.stringify({
       ts_ms: Date.now(),
       kind: "hook.fire",

package/dist/lib/hosts/dispatch.d.ts

@@ -74,6 +74,15 @@ export declare function remoteRunShellPrelude(agent: string): string;
  * reliable whole-tree operation for both normal stops and rollback cleanup.
  */
 export declare function buildDetachedLaunchCommand(inner: string): string;
+/** Build the detached PowerShell launch protocol used by Windows SSH hosts. */
+export declare function buildWindowsDetachedLaunchCommand(opts: {
+    forwardedArgs: string[];
+    remoteCwd?: string;
+    mirrorCwd?: boolean;
+    remoteLog: string;
+    remoteExit: string;
+    env: Record<string, string>;
+}): string;
 export interface DispatchResult {
     task: HostTask;
     /** Exit code when followed; undefined when detached (--no-follow). */
@@ -92,6 +101,7 @@ export declare function terminateDispatchedTask(task: HostTask): void;
  * Exit 1 if the group is still alive after TERM/KILL (can't stop it).
  */
 export declare function buildStopRemoteCommand(pid: number, remoteExit: string): string;
+export declare function buildWindowsStopRemoteCommand(pid: number, remoteExit: string): string;
 /**
  * Stop a running host task from the origin machine (`agents hosts stop <id>`).
  *

package/dist/lib/hosts/dispatch.js

@@ -10,9 +10,9 @@
  */
 import { randomUUID } from 'crypto';
 import { sshExec, sshStream, shellQuote } from '../ssh-exec.js';
-import { sshTargetFor } from './types.js';
+import { hostIdentityArgs, sshTargetFor } from './types.js';
 import { ensureHostReady } from './ready.js';
-import { remoteShellFor, posixEnvExports } from './remote-cmd.js';
+import { encodePowershell, powershellQuote, remoteShellFor, posixEnvExports } from './remote-cmd.js';
 import { resolveRemoteOsSync } from './remote-os.js';
 import { resolveActor, actorEnv } from '../actor.js';
 import { saveTask, updateTask, terminalPatch } from './tasks.js';
@@ -148,15 +148,53 @@ export function buildDetachedLaunchCommand(inner) {
     ].join(' ');
     return `bash -lc ${shellQuote(`node -e ${shellQuote(nodeScript)}`)}`;
 }
+function windowsRemotePath(path) {
+    return path.startsWith('$HOME/')
+        ? `(Join-Path $HOME ${powershellQuote(path.slice('$HOME/'.length))})`
+        : powershellQuote(path);
+}
+/** Build the detached PowerShell launch protocol used by Windows SSH hosts. */
+export function buildWindowsDetachedLaunchCommand(opts) {
+    const log = windowsRemotePath(opts.remoteLog);
+    const exit = windowsRemotePath(opts.remoteExit);
+    const env = Object.entries(opts.env).map(([key, value]) => `$env:${key} = ${powershellQuote(value)}`);
+    const cwd = opts.remoteCwd
+        ? opts.mirrorCwd
+            ? `try { Set-Location -LiteralPath ${powershellQuote(opts.remoteCwd)} } catch { Set-Location -LiteralPath $HOME }`
+            : `Set-Location -LiteralPath ${powershellQuote(opts.remoteCwd)}`
+        : '';
+    const inner = [
+        `$ProgressPreference = 'SilentlyContinue'`,
+        `$PSDefaultParameterValues['Out-File:Encoding'] = 'utf8'`,
+        ...env,
+        cwd,
+        `$log = ${log}`,
+        `$exit = ${exit}`,
+        `$code = 1`,
+        `try { & ${['agents', ...opts.forwardedArgs].map(powershellQuote).join(' ')} *> $log; if ($null -ne $LASTEXITCODE) { $code = $LASTEXITCODE } } catch { $_ | Out-File -LiteralPath $log -Append; $code = 1 } finally { Set-Content -LiteralPath $exit -Value $code -NoNewline -Encoding ascii }`,
+    ].filter(Boolean).join('; ');
+    const encodedInner = encodePowershell(inner);
+    const outer = [
+        `$dir = Join-Path $HOME '.agents/.cache/hosts'`,
+        `New-Item -ItemType Directory -Force -Path $dir | Out-Null`,
+        `Remove-Item -LiteralPath ${exit} -Force -ErrorAction SilentlyContinue`,
+        `$result = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = ${powershellQuote(`powershell.exe -NoProfile -EncodedCommand ${encodedInner}`)} }`,
+        `if ($result.ReturnValue -ne 0) { throw \"Win32_Process.Create failed with code $($result.ReturnValue)\" }`,
+        `Write-Output $result.ProcessId`,
+    ].join('; ');
+    return `powershell -NoProfile -EncodedCommand ${encodePowershell(outer)}`;
+}
 function terminateRemoteLaunch(task) {
     if (!task.pid)
         throw new Error(`Cannot terminate remote task ${task.id}: launch returned no PID.`);
     const pid = task.pid;
-    const command = `if kill -TERM -- -${pid} 2>/dev/null; then ` +
-        `sleep 1; kill -KILL -- -${pid} 2>/dev/null || true; ` +
-        `elif kill -0 -- -${pid} 2>/dev/null; then exit 1; fi; ` +
-        `rm -f ${task.remoteLog} ${task.remoteExit}`;
-    const result = sshExec(task.target, command, { timeoutMs: 10000, multiplex: true });
+    const command = task.remoteShell === 'powershell'
+        ? `powershell -NoProfile -EncodedCommand ${encodePowershell(`Stop-Process -Id ${pid} -Force -ErrorAction SilentlyContinue; Remove-Item -LiteralPath ${windowsRemotePath(task.remoteLog)}, ${windowsRemotePath(task.remoteExit)} -Force -ErrorAction SilentlyContinue`)}`
+        : `if kill -TERM -- -${pid} 2>/dev/null; then ` +
+            `sleep 1; kill -KILL -- -${pid} 2>/dev/null || true; ` +
+            `elif kill -0 -- -${pid} 2>/dev/null; then exit 1; fi; ` +
+            `rm -f ${task.remoteLog} ${task.remoteExit}`;
+    const result = sshExec(task.target, command, { timeoutMs: 10000, multiplex: true, extraSshArgs: task.identityFile ? ['-i', task.identityFile, '-o', 'IdentitiesOnly=yes'] : undefined });
     if (result.code !== 0) {
         throw new Error(`Failed to terminate remote task ${task.id} on ${task.host}: ` +
             `${(result.stderr || result.stdout).trim() || 'ssh error'}`);
@@ -194,6 +232,17 @@ export function buildStopRemoteCommand(pid, remoteExit) {
         `else echo 143 > ${remoteExit}; echo GONE; fi; ` +
         `fi`);
 }
+export function buildWindowsStopRemoteCommand(pid, remoteExit) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        throw new Error(`Invalid remote task pid: ${pid}`);
+    const exit = windowsRemotePath(remoteExit);
+    const script = `$process = Get-Process -Id ${pid} -ErrorAction SilentlyContinue; ` +
+        `function Get-DescendantProcessIds([int]$ParentId) { $children = Get-CimInstance Win32_Process -Filter \"ParentProcessId = $ParentId\"; foreach ($child in $children) { Get-DescendantProcessIds $child.ProcessId; $child.ProcessId } }; ` +
+        `if ($process) { $descendants = @(Get-DescendantProcessIds ${pid}); foreach ($childId in $descendants) { Stop-Process -Id $childId -Force -ErrorAction SilentlyContinue }; Stop-Process -Id ${pid} -Force; Set-Content -LiteralPath ${exit} -Value 143 -NoNewline -Encoding ascii; Write-Output 'SIGNALED' } ` +
+        `elseif (Test-Path -LiteralPath ${exit}) { $code = (Get-Content -LiteralPath ${exit} -Raw).Trim(); if ($code) { Write-Output (\"ALREADY $code\") } else { Set-Content -LiteralPath ${exit} -Value 143 -NoNewline -Encoding ascii; Write-Output 'GONE' } } ` +
+        `else { Set-Content -LiteralPath ${exit} -Value 143 -NoNewline -Encoding ascii; Write-Output 'GONE' }`;
+    return `powershell -NoProfile -EncodedCommand ${encodePowershell(script)}`;
+}
 /**
  * Stop a running host task from the origin machine (`agents hosts stop <id>`).
  *
@@ -209,8 +258,10 @@ export function stopDispatchedTask(task) {
     if (!task.pid) {
         throw new Error(`Cannot stop remote task ${task.id}: launch returned no PID.`);
     }
-    const command = buildStopRemoteCommand(task.pid, task.remoteExit);
-    const result = sshExec(task.target, command, { timeoutMs: 10000, multiplex: true });
+    const command = task.remoteShell === 'powershell'
+        ? buildWindowsStopRemoteCommand(task.pid, task.remoteExit)
+        : buildStopRemoteCommand(task.pid, task.remoteExit);
+    const result = sshExec(task.target, command, { timeoutMs: 10000, multiplex: true, extraSshArgs: task.identityFile ? ['-i', task.identityFile, '-o', 'IdentitiesOnly=yes'] : undefined });
     if (result.code !== 0) {
         throw new Error(`Failed to stop remote task ${task.id} on ${task.host}: ` +
             `${(result.stderr || result.stdout).trim() || 'ssh error'}`);
@@ -230,21 +281,11 @@ export function stopDispatchedTask(task) {
  * and `dispatchAgentsCommand` (teams) build their `forwardedArgs` and call here,
  * so the nohup/exit-file/offset-tail machinery lives in exactly one place.
  *
- * Windows remotes are refused up front: the detached launch is only half the
- * contract — the follow/reconcile layer (`progress.ts`/`reconcile.ts`) offset-
- * tails the log with POSIX `tail -c`/`printf`/`cat`/`stat`, which do not exist
- * in cmd.exe/PowerShell. Shipping the launch alone would leave `run --host
- * <windows>` dispatching but hanging on follow forever, so we fail fast with an
- * actionable message instead. Read-only `--host` commands (view/sessions/…) run
- * a single round-trip with no follow protocol and DO work against Windows.
+ * POSIX hosts use a detached bash process group; Windows hosts use a hidden
+ * detached PowerShell process and the same durable log/exit-file protocol.
  */
 async function launchDetached(host, target, opts) {
-    if (remoteShellFor(resolveRemoteOsSync(host.name)) === 'powershell') {
-        throw new Error(`Detached dispatch to Windows host "${host.name}" is not supported yet — the run ` +
-            `follow/reconcile layer is POSIX-only (offset-tails the remote log with tail/cat/stat). ` +
-            `Read-only --host commands (view, sessions, usage, cost, doctor, list, teams) do work ` +
-            `against Windows.`);
-    }
+    const remoteShell = remoteShellFor(host.os ?? resolveRemoteOsSync(host.name));
     const id = randomUUID().slice(0, 8);
     const remoteLog = `${REMOTE_DIR}/${id}.log`;
     const remoteExit = `${REMOTE_DIR}/${id}.exit`;
@@ -266,11 +307,21 @@ async function launchDetached(host, target, opts) {
     const credHostKeyOpts = opts.copyCreds ? hostKeyCheckingOpts(true) : undefined;
     // Outer: ensure dir, launch the login-shell wrapper as a new process-group
     // leader, and print that leader PID.
-    const launch = `mkdir -p ${REMOTE_DIR}; ${buildDetachedLaunchCommand(inner)}`;
+    const launch = remoteShell === 'powershell'
+        ? buildWindowsDetachedLaunchCommand({
+            forwardedArgs: opts.forwardedArgs,
+            remoteCwd: opts.remoteCwd,
+            mirrorCwd: opts.mirrorCwd,
+            remoteLog,
+            remoteExit,
+            env: withActorEnv(opts.agentLabel === RUN_AUTO_KEYWORD ? { [RUN_AUTO_HOST_RESOLVED_ENV]: '1' } : {}),
+        })
+        : `mkdir -p ${REMOTE_DIR}; ${buildDetachedLaunchCommand(inner)}`;
     const res = sshExec(target, launch, {
         timeoutMs: 30000,
         multiplex: !opts.copyCreds,
         hostKeyOpts: credHostKeyOpts,
+        extraSshArgs: hostIdentityArgs(host),
     });
     if (res.code !== 0) {
         throw new Error(`Failed to launch on "${host.name}": ${(res.stderr || res.stdout).trim() || 'ssh error'}`);
@@ -280,6 +331,8 @@ async function launchDetached(host, target, opts) {
         id,
         host: host.name,
         target,
+        identityFile: host.identityFile,
+        remoteShell,
         agent: opts.agentLabel,
         prompt: opts.promptLabel,
         pid: Number.isFinite(pid) ? pid : undefined,
@@ -311,6 +364,8 @@ async function launchDetached(host, target, opts) {
         taskId: id,
         echo: true,
         timeoutMs: opts.timeoutMs,
+        extraSshArgs: hostIdentityArgs(host),
+        remoteShell,
     });
     // -1 = the follow window closed while the run continues on the host. Leave the
     // record 'running' (do NOT freeze it terminal) so a later `hosts ps`/`logs`
@@ -443,7 +498,9 @@ export function buildInteractiveRunForwardedArgs(opts) {
  */
 export async function runInteractiveOnHost(host, opts) {
     const target = sshTargetFor(host);
-    const { warnings } = ensureHostReady(host, { agent: opts.agent });
+    // Concrete version pins fail loud here (RUSH-2313) so we never open a TTY
+    // to a box that cannot run the pin.
+    const { warnings } = ensureHostReady(host, { agent: opts.agent, version: opts.version });
     for (const w of warnings)
         process.stderr.write(`[hosts] warning: ${w}\n`);
     const invocation = ['agents', ...buildInteractiveRunForwardedArgs(opts)].map(shellQuote).join(' ');
@@ -464,12 +521,15 @@ export async function runInteractiveOnHost(host, opts) {
         tty: process.stdin.isTTY,
         multiplex: !opts.copyCreds,
         hostKeyOpts: credHostKeyOpts,
+        extraSshArgs: hostIdentityArgs(host),
     });
 }
 /** Dispatch an `agents run <agent> "<prompt>"` onto a host (the `run --host` path). */
 export async function dispatchToHost(host, opts) {
     const target = sshTargetFor(host);
-    const { warnings } = ensureHostReady(host, { agent: opts.agent });
+    // Concrete agent@version pins fail loud before we print "Dispatched" and
+    // leave a dead remote log (RUSH-2313). Aliases stay remote-resolved.
+    const { warnings } = ensureHostReady(host, { agent: opts.agent, version: opts.version });
     for (const w of warnings)
         process.stderr.write(`[hosts] warning: ${w}\n`);
     return launchDetached(host, target, {

package/dist/lib/hosts/logs.js

@@ -16,6 +16,7 @@ import { loadTask, localLogPath, updateTask, terminalPatch } from './tasks.js';
 import { followHostTask } from './progress.js';
 import { reconcileTask } from './reconcile.js';
 import { sshExecRaw } from '../ssh-exec.js';
+import { encodePowershell } from './remote-cmd.js';
 /** Lines of raw combined-stdout to show in the concise (non-`full`) view. */
 const HOST_LOG_TAIL_LINES = 40;
 /**
@@ -32,6 +33,8 @@ export async function showHostTaskLog(id, follow, full = false) {
             remoteExit: task.remoteExit,
             taskId: id,
             echo: true,
+            remoteShell: task.remoteShell,
+            extraSshArgs: task.identityFile ? ['-i', task.identityFile, '-o', 'IdentitiesOnly=yes'] : [],
         });
         // -1 = follow window closed; the run continues on the host (not a failure,
         // so exit 0). Any real code is the finished run — persist the terminal
@@ -106,7 +109,14 @@ export function tailLines(text, n) {
  * and progress.ts.
  */
 function fetchAndCacheRemoteLog(task) {
-    const res = sshExecRaw(task.target, `cat ${task.remoteLog} 2>/dev/null`, { timeoutMs: 30000, multiplex: true });
+    const command = task.remoteShell === 'powershell'
+        ? `powershell -NoProfile -EncodedCommand ${encodePowershell(`$path = Join-Path $HOME '${task.remoteLog.replace(/^\$HOME\//, '').replace(/'/g, "''")}'; if (Test-Path -LiteralPath $path) { $bytes = [IO.File]::ReadAllBytes($path); [Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length) }`)}`
+        : `cat ${task.remoteLog} 2>/dev/null`;
+    const res = sshExecRaw(task.target, command, {
+        timeoutMs: 30000,
+        multiplex: true,
+        extraSshArgs: task.identityFile ? ['-i', task.identityFile, '-o', 'IdentitiesOnly=yes'] : undefined,
+    });
     if (res.code !== 0 || res.stdout.length === 0)
         return null;
     // The hosts cache dir already exists (saveTask created it) — write is best-effort.