@phnx-labs/agents-cli 1.22.27 → 1.22.28

package/dist/lib/teams/agents.js

@@ -493,6 +493,7 @@ export class AgentProcess {
     // (remotePid/remoteLog/remoteExit) — so the giant constructor stays untouched.
     hostName = null;
     hostTarget = null;
+    hostIdentityFile = null;
     repoPath = null;
     remotePid = null;
     remoteLog = null;
@@ -692,6 +693,7 @@ export class AgentProcess {
         const delta = pullRemoteLogDelta(this.hostTarget, {
             remoteLog: this.remoteLog,
             offset: this.remoteLogOffset,
+            extraSshArgs: this.hostIdentityFile ? ['-i', this.hostIdentityFile, '-o', 'IdentitiesOnly=yes'] : [],
         });
         if (delta && delta.bytes.length > 0) {
             const stdoutPath = await this.getStdoutPath();
@@ -717,6 +719,7 @@ export class AgentProcess {
             const res = sshExec(this.hostTarget, `cat ${this.remoteExit} 2>/dev/null`, {
                 timeoutMs: 8000,
                 multiplex: true,
+                extraSshArgs: this.hostIdentityFile ? ['-i', this.hostIdentityFile, '-o', 'IdentitiesOnly=yes'] : [],
             });
             exit = res.code === 0 && res.stdout.trim() !== '' ? res.stdout.trim() : null;
         }
@@ -898,6 +901,7 @@ export class AgentProcess {
             worktree_path: this.worktreePath,
             host_name: this.hostName,
             host_target: this.hostTarget,
+            host_identity_file: this.hostIdentityFile,
             repo_path: this.repoPath,
             remote_pid: this.remotePid,
             remote_log: this.remoteLog,
@@ -952,6 +956,7 @@ export class AgentProcess {
             // constructor signature stays fixed. Null on every pre-existing teammate.
             agent.hostName = meta.host_name || null;
             agent.hostTarget = meta.host_target || null;
+            agent.hostIdentityFile = meta.host_identity_file || null;
             agent.repoPath = meta.repo_path || null;
             agent.remotePid = typeof meta.remote_pid === 'number' ? meta.remote_pid : null;
             agent.remoteLog = meta.remote_log || null;
@@ -980,7 +985,11 @@ export class AgentProcess {
             // interpolate UNQUOTED so `$HOME` expands (shellQuote would defeat it).
             const probe = `test -f ${this.remoteExit} && echo DEAD || ` +
                 `(kill -0 ${this.remotePid} 2>/dev/null && echo ALIVE || echo DEAD)`;
-            const res = sshExec(this.hostTarget, probe, { timeoutMs: 8000, multiplex: true });
+            const res = sshExec(this.hostTarget, probe, {
+                timeoutMs: 8000,
+                multiplex: true,
+                extraSshArgs: this.hostIdentityFile ? ['-i', this.hostIdentityFile, '-o', 'IdentitiesOnly=yes'] : [],
+            });
             if (res.code === null)
                 return true; // transient ssh failure — don't reap early
             return res.stdout.trim().endsWith('ALIVE');
@@ -1640,10 +1649,16 @@ export class AgentManager {
         if (!host) {
             throw new Error(`Cannot launch remote teammate ${agent.agentId}: device "${agent.hostName}" no longer resolves.`);
         }
-        // Ensure agents-cli is present + version-matched on the host; surface (not
-        // fail on) an agent-not-installed warning like dispatch.ts does.
+        agent.hostIdentityFile = host.identityFile ?? null;
+        // Ensure agents-cli is present + the pin is installed on the host. A bare
+        // agent name still warns (like dispatch.ts); a concrete agent.version pin
+        // fails loud so the teammate never reports launched against a missing pin
+        // (RUSH-2313).
         try {
-            const { warnings } = ensureHostReady(host, { agent: agent.agentType });
+            const { warnings } = ensureHostReady(host, {
+                agent: agent.agentType,
+                version: agent.version ?? undefined,
+            });
             for (const w of warnings)
                 process.stderr.write(`[teams] warning: ${w}\n`);
         }
@@ -1661,7 +1676,9 @@ export class AgentManager {
                 remoteCwd = agent.worktreePath;
             }
             else {
-                const worktreePath = createRemoteWorktree(agent.hostTarget, agent.repoPath, agent.worktreeName);
+                const worktreePath = createRemoteWorktree(agent.hostTarget, agent.repoPath, agent.worktreeName, {
+                    extraSshArgs: agent.hostIdentityFile ? ['-i', agent.hostIdentityFile, '-o', 'IdentitiesOnly=yes'] : [],
+                });
                 agent.worktreePath = worktreePath;
                 remoteCwd = worktreePath;
             }
@@ -1743,9 +1760,12 @@ export class AgentManager {
         }
         const target = sshTargetFor(host);
         const teamMeta = await getTeam(taskName);
-        const repoRoot = ensureRemoteRepo(target, teamMeta?.repo ?? '', taskName);
+        const repoRoot = ensureRemoteRepo(target, teamMeta?.repo ?? '', taskName, {
+            extraSshArgs: host.identityFile ? ['-i', host.identityFile, '-o', 'IdentitiesOnly=yes'] : [],
+        });
         agent.hostName = host.name;
         agent.hostTarget = target;
+        agent.hostIdentityFile = host.identityFile ?? null;
         agent.repoPath = repoRoot;
         await agent.saveMeta();
     }
@@ -1864,11 +1884,12 @@ export class AgentManager {
             return;
         const byTarget = new Map();
         for (const a of teammates) {
-            const arr = byTarget.get(a.hostTarget) || [];
-            arr.push(a);
-            byTarget.set(a.hostTarget, arr);
+            const key = `${a.hostTarget}\0${a.hostIdentityFile ?? ''}`;
+            const group = byTarget.get(key) || { target: a.hostTarget, agents: [] };
+            group.agents.push(a);
+            byTarget.set(key, group);
         }
-        for (const [target, agents] of byTarget) {
+        for (const { target, agents } of byTarget.values()) {
             // Emit one line per teammate: "<agentId> ALIVE|DEAD <exitOrEmpty>". A single
             // round-trip over the multiplexed socket, regardless of teammate count.
             const parts = agents.map((a) => {
@@ -1883,7 +1904,12 @@ export class AgentManager {
                     `elif kill -0 ${a.remotePid} 2>/dev/null; then printf 'ALIVE\\n'; ` +
                     `else printf 'DEAD\\n'; fi`);
             });
-            const res = sshExec(target, parts.join('; '), { timeoutMs: 12000, multiplex: true });
+            const identityFile = agents[0]?.hostIdentityFile;
+            const res = sshExec(target, parts.join('; '), {
+                timeoutMs: 12000,
+                multiplex: true,
+                extraSshArgs: identityFile ? ['-i', identityFile, '-o', 'IdentitiesOnly=yes'] : [],
+            });
             if (res.code === null)
                 continue; // transient ssh failure — skip this wave, no snapshot
             const snapshots = new Map();
@@ -2155,6 +2181,7 @@ export class AgentManager {
                     sshExec(agent.hostTarget, `kill -TERM -- -${agent.remotePid} 2>/dev/null`, {
                         timeoutMs: 10000,
                         multiplex: true,
+                        extraSshArgs: agent.hostIdentityFile ? ['-i', agent.hostIdentityFile, '-o', 'IdentitiesOnly=yes'] : [],
                     });
                 }
                 catch {

package/dist/lib/teams/remoteWorktree.d.ts

@@ -1,3 +1,6 @@
+interface RemoteSshOptions {
+    extraSshArgs?: string[];
+}
 /**
  * Render a path for safe interpolation into a REMOTE shell, expanding a leading
  * `~`/`~/` to `"$HOME"` so it resolves on the host. A plain `shellQuote('~/x')`
@@ -13,15 +16,15 @@ export declare function remotePathExpr(p: string): string;
  * downstream remote command (launch `cd`, worktree create, polling) works from an
  * absolute path with no tilde-expansion hazard.
  */
-export declare function resolveRemoteRepoRoot(target: string, repoPath: string): string | null;
+export declare function resolveRemoteRepoRoot(target: string, repoPath: string, opts?: RemoteSshOptions): string | null;
 /** True when `repoPath` is a git working tree on the host. */
-export declare function isRemoteGitRepo(target: string, repoPath: string): boolean;
+export declare function isRemoteGitRepo(target: string, repoPath: string, opts?: RemoteSshOptions): boolean;
 /**
  * Resolve the host repo's default branch name (origin/HEAD → `main`/`master`/…).
  * Falls back to `main` when origin/HEAD isn't set, matching the local recipe's
  * `remote set-head` step.
  */
-export declare function remoteDefaultBranch(target: string, repoPath: string): string;
+export declare function remoteDefaultBranch(target: string, repoPath: string, opts?: RemoteSshOptions): string;
 /**
  * Create a worktree on the host for a teammate, branched off the freshly-fetched
  * default branch. Returns the absolute worktree path on the host.
@@ -30,7 +33,7 @@ export declare function remoteDefaultBranch(target: string, repoPath: string): s
  * `worktree add -b … origin/<default>` so a stale checkout can't fork the
  * teammate off old code.
  */
-export declare function createRemoteWorktree(target: string, repoPath: string, worktreeName: string): string;
+export declare function createRemoteWorktree(target: string, repoPath: string, worktreeName: string, opts?: RemoteSshOptions): string;
 /**
  * Ensure the team's repo is present on the host and return its absolute git
  * root. The canonical location is `~/.agents/repos/<slug>` (slug = sanitized
@@ -45,12 +48,13 @@ export declare function createRemoteWorktree(target: string, repoPath: string, w
  * expands `$HOME` — single-quoting the tilde would defeat expansion, the same
  * hazard dispatch.ts avoids.
  */
-export declare function ensureRemoteRepo(target: string, repo: string, slug: string): string;
+export declare function ensureRemoteRepo(target: string, repo: string, slug: string, opts?: RemoteSshOptions): string;
 /** True when the host worktree has uncommitted changes (staged or unstaged). */
-export declare function remoteWorktreeDirty(target: string, worktreePath: string): boolean;
+export declare function remoteWorktreeDirty(target: string, worktreePath: string, opts?: RemoteSshOptions): boolean;
 /**
  * Remove a host worktree and (optionally) its branch. Best-effort: prunes on a
  * "not a working tree" error and ignores a missing branch, matching local
  * `removeWorktree` semantics so cleanup never throws on a half-gone worktree.
  */
-export declare function removeRemoteWorktree(target: string, repoPath: string, worktreeName: string, deleteBranch?: boolean): void;
+export declare function removeRemoteWorktree(target: string, repoPath: string, worktreeName: string, deleteBranch?: boolean, opts?: RemoteSshOptions): void;
+export {};

package/dist/lib/teams/remoteWorktree.js

@@ -40,30 +40,30 @@ export function remotePathExpr(p) {
  * downstream remote command (launch `cd`, worktree create, polling) works from an
  * absolute path with no tilde-expansion hazard.
  */
-export function resolveRemoteRepoRoot(target, repoPath) {
+export function resolveRemoteRepoRoot(target, repoPath, opts = {}) {
     assertValidSshTarget(target);
     const cmd = `git -C ${remotePathExpr(repoPath)} rev-parse --show-toplevel 2>/dev/null`;
-    const res = sshExec(target, cmd, { timeoutMs: 15000, multiplex: true });
+    const res = sshExec(target, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     const root = res.stdout.trim();
     return res.code === 0 && root ? root : null;
 }
 /** Run one git command in `repoPath` on the host; throw with stderr on failure. */
-function remoteGit(target, repoPath, args, timeoutMs = 60000) {
+function remoteGit(target, repoPath, args, timeoutMs = 60000, opts = {}) {
     const cmd = ['git', '-C', repoPath, ...args].map(shellQuote).join(' ');
-    const res = sshExec(target, cmd, { timeoutMs, multiplex: true });
+    const res = sshExec(target, cmd, { timeoutMs, multiplex: true, extraSshArgs: opts.extraSshArgs });
     if (res.code !== 0) {
         throw new Error(`remote git failed on ${target} (${args[0]}): ${(res.stderr || res.stdout).trim() || 'ssh error'}`);
     }
     return res.stdout.trim();
 }
 /** True when `repoPath` is a git working tree on the host. */
-export function isRemoteGitRepo(target, repoPath) {
+export function isRemoteGitRepo(target, repoPath, opts = {}) {
     assertValidSshTarget(target);
     // remotePathExpr so a `~`/`$HOME`-relative path (the canonical repos dir) expands
     // on the host — plain shellQuote would single-quote the tilde into a literal,
     // making an existing checkout look absent and forcing a doomed re-clone.
     const cmd = `git -C ${remotePathExpr(repoPath)} rev-parse --git-dir 2>/dev/null`;
-    const res = sshExec(target, cmd, { timeoutMs: 15000, multiplex: true });
+    const res = sshExec(target, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     return res.code === 0;
 }
 /**
@@ -71,12 +71,12 @@ export function isRemoteGitRepo(target, repoPath) {
  * Falls back to `main` when origin/HEAD isn't set, matching the local recipe's
  * `remote set-head` step.
  */
-export function remoteDefaultBranch(target, repoPath) {
+export function remoteDefaultBranch(target, repoPath, opts = {}) {
     assertValidSshTarget(target);
     try {
         // Refresh origin/HEAD first so a repo cloned before the default was set resolves.
-        sshExec(target, ['git', '-C', repoPath, 'remote', 'set-head', 'origin', '--auto'].map(shellQuote).join(' '), { timeoutMs: 20000, multiplex: true });
-        const ref = remoteGit(target, repoPath, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
+        sshExec(target, ['git', '-C', repoPath, 'remote', 'set-head', 'origin', '--auto'].map(shellQuote).join(' '), { timeoutMs: 20000, multiplex: true, extraSshArgs: opts.extraSshArgs });
+        const ref = remoteGit(target, repoPath, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], 60000, opts);
         return ref.replace(/^origin\//, '') || 'main';
     }
     catch {
@@ -91,15 +91,15 @@ export function remoteDefaultBranch(target, repoPath) {
  * `worktree add -b … origin/<default>` so a stale checkout can't fork the
  * teammate off old code.
  */
-export function createRemoteWorktree(target, repoPath, worktreeName) {
+export function createRemoteWorktree(target, repoPath, worktreeName, opts = {}) {
     assertValidSshTarget(target);
     assertName(worktreeName);
-    const gitRoot = remoteGit(target, repoPath, ['rev-parse', '--show-toplevel']);
-    const base = remoteDefaultBranch(target, gitRoot);
+    const gitRoot = remoteGit(target, repoPath, ['rev-parse', '--show-toplevel'], 60000, opts);
+    const base = remoteDefaultBranch(target, gitRoot, opts);
     const worktreePath = `${gitRoot}/.agents/worktrees/${worktreeName}`;
     const branchName = `agents/${worktreeName}`;
-    remoteGit(target, gitRoot, ['fetch', 'origin'], 120000);
-    remoteGit(target, gitRoot, ['worktree', 'add', '-b', branchName, worktreePath, `origin/${base}`], 120000);
+    remoteGit(target, gitRoot, ['fetch', 'origin'], 120000, opts);
+    remoteGit(target, gitRoot, ['worktree', 'add', '-b', branchName, worktreePath, `origin/${base}`], 120000, opts);
     return worktreePath;
 }
 // Team-name → repos-dir slug: same allowlist a worktree name uses, so it lands
@@ -126,24 +126,24 @@ function repoSlug(name) {
  * expands `$HOME` — single-quoting the tilde would defeat expansion, the same
  * hazard dispatch.ts avoids.
  */
-export function ensureRemoteRepo(target, repo, slug) {
+export function ensureRemoteRepo(target, repo, slug, opts = {}) {
     assertValidSshTarget(target);
     const safeSlug = repoSlug(slug);
     const canonical = `~/.agents/repos/${safeSlug}`;
     // 1. Canonical checkout already exists → fetch and reuse.
-    if (isRemoteGitRepo(target, canonical)) {
+    if (isRemoteGitRepo(target, canonical, opts)) {
         // Best-effort refresh; a fetch failure (offline origin) shouldn't block reuse.
-        sshExec(target, `git -C ${remotePathExpr(canonical)} fetch origin`, { timeoutMs: 120000, multiplex: true });
-        const root = resolveRemoteRepoRoot(target, canonical);
+        sshExec(target, `git -C ${remotePathExpr(canonical)} fetch origin`, { timeoutMs: 120000, multiplex: true, extraSshArgs: opts.extraSshArgs });
+        const root = resolveRemoteRepoRoot(target, canonical, opts);
         if (!root)
             throw new Error(`Repo at ${canonical} on ${target} vanished mid-provision.`);
         return root;
     }
     // 2. `repo` is a path that already exists on the host as a git repo → use it.
     if (repo && !looksLikeUrl(repo)) {
-        const existing = resolveRemoteRepoRoot(target, repo);
+        const existing = resolveRemoteRepoRoot(target, repo, opts);
         if (existing) {
-            sshExec(target, `git -C ${remotePathExpr(existing)} fetch origin`, { timeoutMs: 120000, multiplex: true });
+            sshExec(target, `git -C ${remotePathExpr(existing)} fetch origin`, { timeoutMs: 120000, multiplex: true, extraSshArgs: opts.extraSshArgs });
             return existing;
         }
     }
@@ -159,12 +159,12 @@ export function ensureRemoteRepo(target, repo, slug) {
     // blocks *shell* injection and is orthogonal to *git-transport* injection.
     assertSafeGitTransport(repo);
     const clone = sshExec(target, `mkdir -p ${remotePathExpr('~/.agents/repos')} && ` +
-        `git clone -- ${shellQuote(repo)} ${remotePathExpr(canonical)}`, { timeoutMs: 600000, multiplex: true });
+        `git clone -- ${shellQuote(repo)} ${remotePathExpr(canonical)}`, { timeoutMs: 600000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     if (clone.code !== 0) {
         throw new Error(`git clone ${repo} into ${canonical} on ${target} failed: ` +
             `${(clone.stderr || clone.stdout).trim() || 'ssh error'}`);
     }
-    const root = resolveRemoteRepoRoot(target, canonical);
+    const root = resolveRemoteRepoRoot(target, canonical, opts);
     if (!root)
         throw new Error(`Cloned ${repo} into ${canonical} on ${target} but it isn't a git repo.`);
     return root;
@@ -176,10 +176,10 @@ function looksLikeUrl(repo) {
         repo.startsWith('git@'));
 }
 /** True when the host worktree has uncommitted changes (staged or unstaged). */
-export function remoteWorktreeDirty(target, worktreePath) {
+export function remoteWorktreeDirty(target, worktreePath, opts = {}) {
     assertValidSshTarget(target);
     const cmd = ['git', '-C', worktreePath, 'status', '--porcelain'].map(shellQuote).join(' ');
-    const res = sshExec(target, cmd, { timeoutMs: 20000, multiplex: true });
+    const res = sshExec(target, cmd, { timeoutMs: 20000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     if (res.code !== 0)
         return false;
     return res.stdout.trim().length > 0;
@@ -189,17 +189,18 @@ export function remoteWorktreeDirty(target, worktreePath) {
  * "not a working tree" error and ignores a missing branch, matching local
  * `removeWorktree` semantics so cleanup never throws on a half-gone worktree.
  */
-export function removeRemoteWorktree(target, repoPath, worktreeName, deleteBranch = true) {
+export function removeRemoteWorktree(target, repoPath, worktreeName, deleteBranch = true, opts = {}) {
     assertValidSshTarget(target);
     assertName(worktreeName);
-    const gitRoot = remoteGit(target, repoPath, ['rev-parse', '--show-toplevel']);
+    const gitRoot = remoteGit(target, repoPath, ['rev-parse', '--show-toplevel'], 60000, opts);
     const worktreePath = `${gitRoot}/.agents/worktrees/${worktreeName}`;
     const branchName = `agents/${worktreeName}`;
-    const rm = sshExec(target, ['git', '-C', gitRoot, 'worktree', 'remove', '--force', worktreePath].map(shellQuote).join(' '), { timeoutMs: 60000, multiplex: true });
+    const rm = sshExec(target, ['git', '-C', gitRoot, 'worktree', 'remove', '--force', worktreePath].map(shellQuote).join(' '), { timeoutMs: 60000, multiplex: true, extraSshArgs: opts.extraSshArgs });
     if (rm.code !== 0 && /is not a working tree/.test(rm.stderr + rm.stdout)) {
         sshExec(target, ['git', '-C', gitRoot, 'worktree', 'prune'].map(shellQuote).join(' '), {
             timeoutMs: 30000,
             multiplex: true,
+            extraSshArgs: opts.extraSshArgs,
         });
     }
     if (deleteBranch) {
@@ -207,6 +208,7 @@ export function removeRemoteWorktree(target, repoPath, worktreeName, deleteBranc
         sshExec(target, ['git', '-C', gitRoot, 'branch', '-D', branchName].map(shellQuote).join(' '), {
             timeoutMs: 20000,
             multiplex: true,
+            extraSshArgs: opts.extraSshArgs,
         });
     }
 }

package/dist/lib/versions.d.ts

@@ -525,6 +525,7 @@ export declare function syncResourcesToVersion(agent: AgentId, version: string,
     projectDir?: string;
     cwd?: string;
     force?: boolean;
+    available?: AvailableResources;
 }): SyncResult;
 /**
  * Get the effective HOME directory for an agent.

package/dist/lib/versions.js

@@ -346,11 +346,21 @@ function skillDirsMatch(src, dest) {
                 return false;
         }
         else {
-            if (!fs.existsSync(destPath))
+            // Stat-first (RUSH-2320 #2): size mismatch = definitive miss, no reads.
+            // Equal mtimes across different trees are accidental — content-compare
+            // whenever sizes match.
+            let srcStat;
+            let destStat;
+            try {
+                srcStat = fs.statSync(srcPath);
+                destStat = fs.statSync(destPath);
+            }
+            catch {
                 return false;
-            const srcContent = fs.readFileSync(srcPath, 'utf-8');
-            const destContent = fs.readFileSync(destPath, 'utf-8');
-            if (srcContent !== destContent)
+            }
+            if (srcStat.size !== destStat.size)
+                return false;
+            if (fs.readFileSync(srcPath, 'utf-8') !== fs.readFileSync(destPath, 'utf-8'))
                 return false;
         }
     }
@@ -2580,7 +2590,28 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
     // Extra DotAgent repos registered via `agents repo add`. Looked up last so
     // project/user/system repos win on name collisions.
     const extraRepos = getEnabledExtraRepos();
-    const available = getAvailableResources(cwd);
+    // Project-layer fan-out always runs — even on the early guard hit — so the
+    // `projectSkipped` contract is preserved for callers (RUSH-2320 #4).
+    if (projectAgentsDir) {
+        result.projectSkipped = syncProjectResourcesToAgent(agent, version, projectAgentsDir).skipped;
+    }
+    // Fast guard BEFORE getAvailableResources / pattern expansion /
+    // ensureVersionResourcePatterns. Guard needs only loadManifest + isStale
+    // (~6 ms); the work that used to sit ahead of it was ~12.5 ms of the 21.5 ms
+    // guard-hit path and is discarded when nothing changed (RUSH-2320 #4).
+    // Behavior note: a valid manifest implies a prior full sync already wrote
+    // version resource patterns, so skipping ensureVersionResourcePatterns on
+    // the hit path is safe in practice but is not byte-identical to the old
+    // order (that call always wrote missing pattern defaults).
+    if (!userPassedSelection && !options.force) {
+        const manifest = loadManifest(agent, version);
+        if (manifest && !isStale(manifest, agent, version, cwd)) {
+            return { ...result };
+        }
+    }
+    // Prefer a caller-supplied inventory (refresh already built one) so multi-
+    // version fan-out does not re-scan resource trees per version (RUSH-2320 #5).
+    const available = options.available ?? getAvailableResources(cwd);
     // Write default resource selection patterns for this version (idempotent —
     // only sets fields that aren't already present, preserving user edits).
     {
@@ -2640,21 +2671,6 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
             }
         }
     }
-    if (projectAgentsDir) {
-        result.projectSkipped = syncProjectResourcesToAgent(agent, version, projectAgentsDir).skipped;
-    }
-    // Fast guard: skip the entire sync when the caller requested a full sync and
-    // nothing has changed since the last full sync. Pattern-derived selections
-    // still count as full syncs because they are the persisted intended scope,
-    // not a one-off caller override.
-    if (!userPassedSelection && !options.force) {
-        const manifest = loadManifest(agent, version);
-        if (manifest && !isStale(manifest, agent, version, cwd)) {
-            // Nothing synced, but the project sync above already ran — carry its
-            // skipped files out so the caller can still report them.
-            return { ...result };
-        }
-    }
     // Helper: remove a path (symlink or real) if it exists
     const removePath = (p) => {
         try {
@@ -3023,9 +3039,11 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
     // launch can skip the slow path. Pattern-derived selections still count as
     // "full" — the agents.yaml patterns describe the intended scope, not a
     // one-off override, so the resulting state matches what the manifest
-    // records as the synced set.
+    // records as the synced set. Carry forward still-fresh fingerprints from
+    // the previous manifest so we do not re-hash an unchanged tree (RUSH-2320 #3).
     if (!userPassedSelection) {
-        const manifest = buildSyncManifest(agent, version, cwd);
+        const previous = loadManifest(agent, version);
+        const manifest = buildSyncManifest(agent, version, cwd, previous);
         manifest.writtenCommands = writtenCommands;
         saveManifest(agent, version, manifest);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.27",
+  "version": "1.22.28",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -54,6 +54,8 @@
     "changelog": "bun scripts/gen-changelog.ts",
     "start": "node dist/index.js",
     "test": "node ./node_modules/vitest/vitest.mjs run",
+    "bench": "node ./node_modules/vitest/vitest.mjs bench --run",
+    "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",
     "test:remote": "scripts/sandbox.sh 'bun install && bun run build && bun run test'",
     "verify-docs": "scripts/verify-docs.sh",
     "test:watch": "node ./node_modules/vitest/vitest.mjs"

package/dist/lib/exec.bench.d.ts

@@ -1 +0,0 @@
-export {};