@phnx-labs/agents-cli 1.22.27 → 1.22.29

package/dist/lib/activity.js

@@ -26,6 +26,7 @@ import { getActivityDir, getUserAgentsDir } from './state.js';
 import { normalizeHost } from './machine-id.js';
 import { projectKeyFromCwd } from './project-key.js';
 import { stampProvenance } from './event-provenance.js';
+import { pythonToolRegistryLiteral, pythonValueFlagsLiteral, } from './session/bash-command.js';
 /** The set of milestone events, for tier classification and ordering. */
 export const MILESTONE_EVENTS = [
     'plan.created',
@@ -730,115 +731,30 @@ def first_line(text, limit=140):
     return ""
 
 
-# Canonical command taxonomy for Bash tool calls. Mirrors the TypeScript
-# registry in lib/session/bash-command.ts; keep them in sync.
+# Canonical command taxonomy for Bash tool calls, generated from the single
+# source of truth in lib/session/bash-command.ts's TOOL_REGISTRY (#1889) so the
+# two can no longer drift — this hook runs standalone under python3 and can't
+# import that module, so the literal below is generated, not hand-duplicated.
 BASH_TOOL_REGISTRY = {
-    "git": {"category": "vcs", "action": "working in git"},
-    "gh": {"category": "vcs", "action": "using GitHub CLI"},
-    "bun": {"category": "build-test", "action": "running bun"},
-    "npm": {"category": "build-test", "action": "running npm"},
-    "pnpm": {"category": "build-test", "action": "running pnpm"},
-    "yarn": {"category": "build-test", "action": "running yarn"},
-    "vitest": {"category": "build-test", "action": "running vitest"},
-    "jest": {"category": "build-test", "action": "running jest"},
-    "mocha": {"category": "build-test", "action": "running mocha"},
-    "pytest": {"category": "build-test", "action": "running pytest"},
-    "cargo": {"category": "build-test", "action": "running cargo"},
-    "go": {"category": "build-test", "action": "running go"},
-    "tsc": {"category": "build-test", "action": "running tsc"},
-    "tsx": {"category": "build-test", "action": "running tsx"},
-    "node": {"category": "build-test", "action": "running node"},
-    "python": {"category": "build-test", "action": "running python"},
-    "python3": {"category": "build-test", "action": "running python"},
-    "make": {"category": "build-test", "action": "running make"},
-    "brew": {"category": "install", "action": "installing with brew"},
-    "pip": {"category": "install", "action": "installing with pip"},
-    "pip3": {"category": "install", "action": "installing with pip"},
-    "apt": {"category": "install", "action": "installing with apt"},
-    "apk": {"category": "install", "action": "installing with apk"},
-    "ssh": {"category": "remote", "action": "using ssh"},
-    "scp": {"category": "remote", "action": "using scp"},
-    "rsync": {"category": "remote", "action": "using rsync"},
-    "curl": {"category": "http", "action": "fetching with curl"},
-    "wget": {"category": "http", "action": "fetching with wget"},
-    "ffmpeg": {"category": "media", "action": "using ffmpeg"},
-    "ffprobe": {"category": "media", "action": "probing media"},
-    "magick": {"category": "media", "action": "using ImageMagick"},
-    "convert": {"category": "media", "action": "converting images"},
-    "composite": {"category": "media", "action": "compositing images"},
-    "montage": {"category": "media", "action": "montaging images"},
-    "identify": {"category": "media", "action": "identifying images"},
-    "realesrgan": {"category": "upscaling", "action": "upscaling with realesrgan"},
-    "realesrgan-ncnn-vulkan": {"category": "upscaling", "action": "upscaling with realesrgan"},
-    "waifu2x": {"category": "upscaling", "action": "upscaling with waifu2x"},
-    "waifu2x-caffe": {"category": "upscaling", "action": "upscaling with waifu2x"},
-    "waifu2x-converter-cpp": {"category": "upscaling", "action": "upscaling with waifu2x"},
-    "swin2sr": {"category": "upscaling", "action": "upscaling with swin2sr"},
-    "resdet": {"category": "upscaling", "action": "detecting upscale"},
-    "id3v2": {"category": "metadata", "action": "editing id3 tags"},
-    "exiftool": {"category": "metadata", "action": "editing exif metadata"},
-    "metaflac": {"category": "metadata", "action": "editing flac metadata"},
-    "vorbiscomment": {"category": "metadata", "action": "editing vorbis comments"},
-    # Shell
-    "rm": {"category": "shell", "action": "removing files"},
-    "mv": {"category": "shell", "action": "moving files"},
-    "cp": {"category": "shell", "action": "copying files"},
-    "mkdir": {"category": "shell", "action": "making directories"},
-    "touch": {"category": "shell", "action": "touching files"},
-    "echo": {"category": "shell", "action": "echoing"},
-    "printf": {"category": "shell", "action": "printing"},
-    "chmod": {"category": "shell", "action": "changing permissions"},
-    "ln": {"category": "shell", "action": "linking files"},
-    "awk": {"category": "shell", "action": "running awk"},
-    "sed": {"category": "shell", "action": "running sed"},
-    "tee": {"category": "shell", "action": "teeing output"},
-    "xargs": {"category": "shell", "action": "running xargs"},
-    # Probes
-    "ls": {"category": "probe", "action": "listing files"},
-    "cat": {"category": "probe", "action": "reading files"},
-    "head": {"category": "probe", "action": "reading files"},
-    "tail": {"category": "probe", "action": "reading files"},
-    "wc": {"category": "probe", "action": "counting"},
-    "stat": {"category": "probe", "action": "statting files"},
-    "file": {"category": "probe", "action": "inspecting files"},
-    "which": {"category": "probe", "action": "locating binaries"},
-    "tree": {"category": "probe", "action": "listing files"},
-    "pwd": {"category": "probe", "action": "printing pwd"},
-    # Search
-    "grep": {"category": "search", "action": "searching"},
-    "rg": {"category": "search", "action": "searching with ripgrep"},
-    "ag": {"category": "search", "action": "searching with the silver searcher"},
-    "fd": {"category": "search", "action": "searching files"},
-    "find": {"category": "search", "action": "finding files"},
-    # Wait
-    "sleep": {"category": "wait", "action": "sleeping"},
-    "wait": {"category": "wait", "action": "waiting"},
+${pythonToolRegistryLiteral()}
 }
 
 # Two-level tools mapped to the flags that consume the following token as their
-# value, per tool; the subcommand scan skips both. Missing a value flag mis-reads
-# the value as the subcommand; over-listing only drops the subcommand (safe). A
-# tool with no such leading flags maps to an empty set. Mirrors VALUE_FLAGS in
-# lib/session/bash-command.ts; TWO_LEVEL_TOOLS is derived from its keys.
+# value, per tool; the subcommand scan skips both. Generated from VALUE_FLAGS in
+# lib/session/bash-command.ts (#1889) — TWO_LEVEL_TOOLS is derived from its keys.
 VALUE_FLAGS = {
-    "git": {"-C", "-c", "--git-dir", "--work-tree"},
-    "gh": {"-R", "--repo"},
-    "bun": {"--cwd"},
-    "npm": {"--prefix", "-w", "--workspace"},
-    "pnpm": {"--filter", "-C", "--dir"},
-    "yarn": {"--cwd"},
-    "cargo": {"--manifest-path"},
-    "docker": {"-H", "--host", "-c", "--context", "--config", "-l", "--log-level"},
-    "kubectl": {"-n", "--namespace", "--kubeconfig", "--context", "--cluster", "--user", "-s", "--server", "--as", "--token", "--cache-dir", "--request-timeout"},
-    "rush": set(),
-    "openclaw": set(),
+${pythonValueFlagsLiteral()}
 }
 
 TWO_LEVEL_TOOLS = set(VALUE_FLAGS.keys())
 
 
 def _unwrap_command(cmd):
-    """Strip wrapper prefixes so the real executable is classified."""
+    """Strip wrapper prefixes so the real executable is classified.
+
+    Mirrors unwrapCommand() in lib/session/bash-command.ts — keep the shapes
+    aligned when extending either side (#1889).
+    """
     s = (cmd or "").strip()
     ssh = re.match(r'^ssh\s+\S+\s+["\']?(.+?)["\']?\s*(?:\|.*)?$', s)
     if ssh:
@@ -847,16 +763,46 @@ def _unwrap_command(cmd):
     env = re.match(r'^([A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|' + r"'[^']*'" + r'|\S+)\s+)+(.+)$', s)
     if env:
         return _unwrap_command(env.group(2))
+    # export VAR=value && command / export A=1 B=2; command
+    export_prefix = re.match(
+        r'^export\s+(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|' + r"'[^']*'" + r'|\S+)\s+)*'
+        r'[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|' + r"'[^']*'" + r'|\S+)\s*(?:&&|;|\n)\s*([\s\S]+)$',
+        s,
+    )
+    if export_prefix:
+        return _unwrap_command(export_prefix.group(1))
     # sudo / time prefix (value-taking flags such as -u user consume their argument)
     prefix = re.match(r'^(?:sudo|time)(?:\s+(?:-[uUgGhpCrtDR]\s+\S+|-\S+))*\s+(.+)$', s)
     if prefix:
         return _unwrap_command(prefix.group(1))
-    cd = re.match(r'^cd\s+\S+\s*&&\s*(.+)$', s)
+    # set -euo pipefail && command / set -x; command
+    set_prefix = re.match(r'^set\s+[^&;\n]+?(?:&&|;|\n)\s*([\s\S]+)$', s)
+    if set_prefix:
+        return _unwrap_command(set_prefix.group(1))
+    # cd foo && command  (also ; and newline separators)
+    cd = re.match(r'^cd\s+\S+\s*(?:&&|;|\n)\s*([\s\S]+)$', s)
     if cd:
         return _unwrap_command(cd.group(1))
     npx = re.match(r'^(?:npx|bunx)\s+(?:-\S+\s+)*(.+)$', s)
     if npx:
         return _unwrap_command(npx.group(1))
+    for_loop = re.match(r'^for\s+[\s\S]+?\bdo\b\s*([\s\S]+?)\s*;?\s*done\b[\s\S]*$', s)
+    if for_loop:
+        return _unwrap_command(for_loop.group(1))
+    until_loop = re.match(r'^until\s+[\s\S]+?\bdo\b\s*([\s\S]+?)\s*;?\s*done\b[\s\S]*$', s)
+    if until_loop:
+        return _unwrap_command(until_loop.group(1))
+    if_cond = re.match(
+        r'^if\s+[\s\S]+?\bthen\b\s*([\s\S]+?)\s*;?\s*(?:elif\b|else\b|fi\b)[\s\S]*$',
+        s,
+    )
+    if if_cond:
+        return _unwrap_command(if_cond.group(1))
+    subshell = re.match(r'^\(\s*([\s\S]+?)\s*\)\s*(?:&&|;|\|\|)[\s\S]*$', s) or re.match(
+        r'^\(\s*([\s\S]+?)\s*\)\s*$', s
+    )
+    if subshell:
+        return _unwrap_command(subshell.group(1))
     return s
 
 

package/dist/lib/claude-account-token.js

@@ -2,6 +2,8 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { bundleBackend, bundleExists, readAndResolveBundleEnv } from './secrets/bundles.js';
+import { fileStoreItemPath } from './secrets/filestore.js';
+import { secretsKeychainItem } from './secrets/index.js';
 /**
  * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
  * setup-tokens. Usage/probe reads authenticate with these instead of Claude
@@ -25,6 +27,17 @@ const AUTH_BUNDLE = 'auth';
  * where a corrupt bundle entry must be caught before it reaches the auth header.
  */
 const SETUP_TOKEN_RE = /^sk-ant-oat01-[A-Za-z0-9_-]+$/;
+/** Process-local only: plaintext setup-tokens are never written to another cache. */
+const setupTokenCache = new Map();
+function credentialFingerprint(credentialPath) {
+    try {
+        const stat = fs.statSync(credentialPath, { bigint: true });
+        return `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.mtimeNs}:${stat.size}`;
+    }
+    catch {
+        return 'missing';
+    }
+}
 /** True only for a clean, single-line `sk-ant-oat01-…` token — see {@link SETUP_TOKEN_RE}. */
 export function isValidClaudeSetupToken(value) {
     return SETUP_TOKEN_RE.test(value);
@@ -71,17 +84,31 @@ export function resolveClaudeSetupToken(home) {
             return null;
         if (!bundleExists(AUTH_BUNDLE) || bundleBackend(AUTH_BUNDLE) !== 'file')
             return null;
-        const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
-        const v = (env[claudeAccountTokenKey(email)] ?? '').trim();
-        if (v.length === 0)
-            return null;
-        // Reject a malformed stored value (e.g. a captured setup-token TTY blob, #1767)
-        // rather than let it become an `Authorization: Bearer <blob>` header that
-        // Anthropic rejects and crashes the run. A corrupt entry is treated as no
-        // usable file-based token, so the caller falls back to the normal login.
-        if (!isValidClaudeSetupToken(v))
-            return null;
-        return v;
+        const cacheKey = home ?? os.homedir();
+        const item = secretsKeychainItem(AUTH_BUNDLE, claudeAccountTokenKey(email));
+        const credentialPath = fileStoreItemPath(item);
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const before = credentialFingerprint(credentialPath);
+            const cached = setupTokenCache.get(cacheKey);
+            if (cached?.credentialPath === credentialPath && cached.fingerprint === before) {
+                return cached.token;
+            }
+            if (before === 'missing') {
+                setupTokenCache.set(cacheKey, { credentialPath, fingerprint: before, token: null });
+                return null;
+            }
+            const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
+            const v = (env[claudeAccountTokenKey(email)] ?? '').trim();
+            const token = v.length > 0 && isValidClaudeSetupToken(v) ? v : null;
+            const after = credentialFingerprint(credentialPath);
+            if (before === after) {
+                setupTokenCache.set(cacheKey, { credentialPath, fingerprint: after, token });
+                return token;
+            }
+        }
+        // The credential changed during both decrypt attempts. Fail closed rather
+        // than return a token whose current file fingerprint was never observed.
+        return null;
     }
     catch {
         return null;

package/dist/lib/cloud/host.js

@@ -153,6 +153,7 @@ export class HostCloudProvider {
                 remoteExit: task.remoteExit,
                 taskId: task.id,
                 offset,
+                extraSshArgs: task.identityFile ? ['-i', task.identityFile, '-o', 'IdentitiesOnly=yes'] : [],
             });
             if (fetched) {
                 if (fetched.logChunk.length > 0) {

package/dist/lib/devices/resolve-target.d.ts

@@ -8,6 +8,7 @@ export interface ResolvedSshTarget {
     machine: string;
     name: string;
     os?: string;
+    extraSshArgs?: string[];
 }
 export interface ResolvedExplicitTargetSet {
     targets: ResolvedSshTarget[];

package/dist/lib/devices/resolve-target.js

@@ -18,7 +18,7 @@
  * `user@host` all resolve identically no matter which subcommand called.
  */
 import chalk from 'chalk';
-import { sshTargetFor } from '../hosts/types.js';
+import { hostIdentityArgs, sshTargetFor } from '../hosts/types.js';
 import { matchHost, splitUserHost } from '../hosts/registry.js';
 import { normalizeHost } from '../machine-id.js';
 import { resolveRemoteOsSync } from '../hosts/remote-os.js';
@@ -61,7 +61,14 @@ async function toResolvedTarget(token) {
     }
     const hostPart = host.device ? host.device.name : splitUserHost(host.name).host;
     const name = host.device ? host.device.name : host.name;
-    return { target, machine: normalizeHost(hostPart), name, os: host.os ?? resolveRemoteOsSync(name) };
+    const extraSshArgs = hostIdentityArgs(host);
+    return {
+        target,
+        machine: normalizeHost(hostPart),
+        name,
+        os: host.os ?? resolveRemoteOsSync(name),
+        ...(extraSshArgs.length > 0 ? { extraSshArgs } : {}),
+    };
 }
 /**
  * Resolve a target token to a full {@link DeviceProfile} for `agents ssh`. Same

package/dist/lib/events.d.ts

@@ -13,7 +13,7 @@
  */
 import type { ActorKind } from './actor.js';
 export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
 /** Every known event kind. Derived from {@link EVENT_TYPE_TABLE}, never hand-listed. */
 export declare const EVENT_TYPES: readonly EventType[];
 /** Runtime guard for an event kind arriving from outside this process. */

package/dist/lib/events.js

@@ -113,7 +113,7 @@ const EVENT_TYPE_TABLE = {
     'skill.install': true, 'skill.remove': true,
     'browser.launch': true, 'browser.close': true, 'browser.navigate': true, 'browser.screenshot': true,
     'computer.action': true,
-    'secrets.get': true, 'secrets.unlocked': true, 'secrets.create': true, 'secrets.import': true, 'secrets.export': true, 'secrets.view': true, 'secrets.set': true, 'secrets.delete': true, 'secrets.rename': true,
+    'secrets.get': true, 'secrets.unlocked': true, 'secrets.create': true, 'secrets.import': true, 'secrets.export': true, 'secrets.view': true, 'secrets.lease-denied': true, 'secrets.lease-expire': true, 'secrets.set': true, 'secrets.delete': true, 'secrets.rename': true,
     'cloud.dispatch': true, 'cloud.complete': true, 'cloud.cancel': true, 'cloud.message': true,
     'teams.create': true, 'teams.add': true, 'teams.start': true, 'teams.complete': true, 'teams.disband': true,
     'hook.fire': true, 'hook.complete': true, 'hook.error': true,
@@ -141,7 +141,7 @@ export function isEventType(value) {
 }
 const AUDIT_EVENTS = new Set([
     'command.start', 'command.end',
-    'secrets.get', 'secrets.unlocked', 'secrets.create', 'secrets.import', 'secrets.export', 'secrets.view',
+    'secrets.get', 'secrets.unlocked', 'secrets.create', 'secrets.import', 'secrets.export', 'secrets.view', 'secrets.lease-denied', 'secrets.lease-expire',
     'secrets.set', 'secrets.delete', 'secrets.rename',
     'teams.create', 'teams.add', 'teams.start', 'teams.complete', 'teams.disband',
     'cloud.dispatch', 'cloud.complete', 'cloud.cancel', 'cloud.message',

package/dist/lib/git.d.ts

@@ -269,9 +269,15 @@ export declare function displayHomePath(dir: string): string;
  * Pull changes in an existing repo.
  * Refuses to pull if the working tree is dirty -- user must commit or discard changes first.
  *
- * Uses `git pull --rebase` (same strategy as {@link syncRepoGit}) so a diverged
- * branch reconciles instead of failing with "Need to specify how to reconcile
- * divergent branches".
+ * Strategy (RUSH-2282):
+ *   1. Fetch, then compare HEAD to the resolved tracking ref.
+ *   2. Clean behind-only (HEAD is an ancestor of tracking) → `merge --ff-only`
+ *      against the tracking ref. Never re-enter `git pull` after a bare fetch —
+ *      multi-entry FETCH_HEAD (concurrent fetch, multi-branch remote) makes
+ *      `git pull --rebase` die with "Cannot rebase onto multiple branches" even
+ *      when the checkout is a pure fast-forward.
+ *   3. Genuinely diverged (local commits not on tracking) → `rebase` onto the
+ *      tracking ref (same outcome as {@link syncRepoGit}, without a second pull).
  */
 export declare function pullRepo(dir: string): Promise<{
     success: boolean;

package/dist/lib/git.js

@@ -867,9 +867,15 @@ export function displayHomePath(dir) {
  * Pull changes in an existing repo.
  * Refuses to pull if the working tree is dirty -- user must commit or discard changes first.
  *
- * Uses `git pull --rebase` (same strategy as {@link syncRepoGit}) so a diverged
- * branch reconciles instead of failing with "Need to specify how to reconcile
- * divergent branches".
+ * Strategy (RUSH-2282):
+ *   1. Fetch, then compare HEAD to the resolved tracking ref.
+ *   2. Clean behind-only (HEAD is an ancestor of tracking) → `merge --ff-only`
+ *      against the tracking ref. Never re-enter `git pull` after a bare fetch —
+ *      multi-entry FETCH_HEAD (concurrent fetch, multi-branch remote) makes
+ *      `git pull --rebase` die with "Cannot rebase onto multiple branches" even
+ *      when the checkout is a pure fast-forward.
+ *   3. Genuinely diverged (local commits not on tracking) → `rebase` onto the
+ *      tracking ref (same outcome as {@link syncRepoGit}, without a second pull).
  */
 export async function pullRepo(dir) {
     try {
@@ -933,16 +939,16 @@ export async function pullRepo(dir) {
                 tracking = `origin/${branch}`;
             }
         }
-        // Split the remote-tracking ref (<remote>/<branch>) into its parts and pull
-        // THOSE. Hardcoding 'origin' while comparing against `tracking` is how a
-        // branch tracking e.g. upstream/main silently 'succeeded': revparse saw a
-        // difference, the pull fetched origin/main (already current), and pullRepo
-        // returned success having moved nothing — the same "reported ok, pulled
-        // nothing" failure this change exists to remove. Branch names may contain
-        // slashes, so split on the FIRST separator only.
+        // Split the remote-tracking ref (<remote>/<branch>) so callers/logs can name
+        // the remote. Branch names may contain slashes, so split on the FIRST
+        // separator only. The integrate step below uses `tracking` directly (not a
+        // second `git pull <remote> <branch>`) so a multi-entry FETCH_HEAD cannot
+        // turn a clean fast-forward into "Cannot rebase onto multiple branches".
         const sep = tracking.indexOf('/');
-        const remoteName = sep > 0 ? tracking.slice(0, sep) : 'origin';
         const remoteBranch = sep > 0 ? tracking.slice(sep + 1) : branch;
+        // Keep branch-name validation on the ref we would have passed to pull —
+        // rejects traversal / flag-smuggling shapes before any integrate command.
+        assertValidBranchName(remoteBranch);
         // Bare fetch: updates every remote, so the revparse below sees a fresh ref
         // whichever one the branch tracks. Deliberately argument-less — simple-git's
         // fetchTask only forwards a remote when BOTH remote and branch are passed,
@@ -962,17 +968,27 @@ export async function pullRepo(dir) {
                 branch,
             };
         }
+        // Behind-only when tracking has commits we lack AND we have none of our own
+        // on top. Use rev-list counts — simple-git does not reject on the exit-1
+        // that `merge-base --is-ancestor` returns for a non-ancestor, so a try/catch
+        // around that call would always report "can ff" (RUSH-2282).
+        const aheadCount = parseInt((await git.raw(['rev-list', '--count', `${tracking}..HEAD`])).trim(), 10);
+        const behindCount = parseInt((await git.raw(['rev-list', '--count', `HEAD..${tracking}`])).trim(), 10);
+        const canFastForward = Number.isFinite(aheadCount) &&
+            Number.isFinite(behindCount) &&
+            aheadCount === 0 &&
+            behindCount > 0;
         try {
-            // Rebase, not --ff-only. Fast-forward refuses ANY divergence, conflict or
-            // not, so a single local commit permanently wedged the pull with nothing
-            // actually in conflict. Matches syncRepoGit (below) and this function's doc.
-            //
-            // Pull the RESOLVED tracking ref, not `branch`: when the local branch has
-            // no tracking config the block above falls back to origin's default head,
-            // which may be named differently (local `main` vs origin `master`). Using
-            // `branch` there asks origin for a ref it does not have.
-            assertValidBranchName(remoteBranch);
-            await git.pull(remoteName, remoteBranch, { '--rebase': 'true' });
+            if (canFastForward) {
+                // Integrate the already-fetched tracking ref. No network, no FETCH_HEAD.
+                await git.raw(['merge', '--ff-only', tracking]);
+            }
+            else {
+                // Diverged (or local-only commits). Rebase onto the tracking tip —
+                // same outcome as `git pull --rebase <remote> <branch>` without
+                // re-fetching or consulting FETCH_HEAD.
+                await git.raw(['rebase', tracking]);
+            }
         }
         catch (err) {
             // Abort so the tree is restored, matching the atomicity --ff-only gave us.
@@ -982,10 +998,11 @@ export async function pullRepo(dir) {
             // the cause. `agents sync` reaches this path unattended across the fleet,
             // so a wedged checkout would be worse than the bug this fixes.
             await git.raw(['rebase', '--abort']).catch(() => { });
+            const verb = canFastForward ? 'Fast-forward' : 'Rebase';
             return {
                 success: false,
                 commit: '',
-                error: `Rebase onto ${tracking} hit a conflict — the pull was rolled back, nothing changed.\n\nResolve the divergence, then pull again:\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}\n\n${err.message}`,
+                error: `${verb} onto ${tracking} failed — the pull was rolled back, nothing changed.\n\nResolve the divergence, then pull again:\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}\n\n${err.message}`,
             };
         }
         installGithooksSymlinks(dir);

package/dist/lib/hooks/profile.d.ts

@@ -10,8 +10,19 @@ export interface HookProfileRow {
     cacheStalePct: number;
     cacheMissPct: number;
     errorCount: number;
-    /** Fraction (0-1) of fires with a nonzero exit code. */
+    /**
+     * Fraction (0-1) of fires with a real crash exit (exit 1 / other nonzero
+     * except intentional PreToolUse deny code 2). Exit 2 is blockRate.
+     */
     errorRate?: number;
+    /**
+     * Count of intentional deny/block exits (PreToolUse exit 2). Deny-by-design
+     * guards (ask-user-question-guard, git-guard, plan-html-reminder) use this
+     * path — not a crash.
+     */
+    blockCount: number;
+    /** Fraction (0-1) of fires with exit code 2 (intentional deny/block). */
+    blockRate?: number;
     /** Fraction (0-1) of fires that hit their configured timeout. */
     timeoutRate?: number;
     /** Project key the row is scoped to (see project-key.ts) — set only when

package/dist/lib/hooks/profile.js

@@ -72,7 +72,10 @@ export function aggregateHookProfile(events) {
         const hits = evs.filter(e => e.cache === 'hit').length;
         const stale = evs.filter(e => e.cache === 'stale-prefetch').length;
         const misses = evs.filter(e => e.cache === 'miss').length;
-        const errors = evs.filter(e => typeof e.exit === 'number' && e.exit !== 0).length;
+        // Exit classes (Claude/Codex PreToolUse convention): 0 allow, 2 deny/block,
+        // 1 / other nonzero = real error. Exit 2 is not a crash.
+        const blocks = evs.filter(e => e.exit === 2).length;
+        const errors = evs.filter(e => typeof e.exit === 'number' && e.exit !== 0 && e.exit !== 2).length;
         rows.push({
             hook,
             n,
@@ -85,7 +88,9 @@ export function aggregateHookProfile(events) {
             cacheStalePct: Math.round((stale / n) * 100),
             cacheMissPct: Math.round((misses / n) * 100),
             errorCount: errors,
+            blockCount: blocks,
             ...(errors > 0 ? { errorRate: Math.round((errors / n) * 1000) / 1000 } : {}),
+            ...(blocks > 0 ? { blockRate: Math.round((blocks / n) * 1000) / 1000 } : {}),
             // timeoutRate is not derivable here: the daily JSONL a shim writes only
             // covers fires that reached their own trailing printf — an externally
             // enforced timeout (the agent harness killing the process) never gets

package/dist/lib/hooks.js

@@ -1610,6 +1610,7 @@ function registerHooksForOpenCode(versionHome, manifest, resolveScript) {
     const pluginSource = `// Generated by agents-cli. Re-run agents sync to update.
 import fs from "node:fs"
 import os from "node:os"
+import path from "node:path"
 
 const directHooks = ${serializedDirect}
 const lifecycleHooks = ${serializedLifecycle}
@@ -1622,7 +1623,9 @@ function recordTimeoutSample(hook, payload) {
   // printf, so a timed-out fire would otherwise leave ZERO trace in the
   // warehouse. Write the sample ourselves from the side that knows it timed out.
   try {
-    fs.mkdirSync(PERF_SPOOL.slice(0, PERF_SPOOL.lastIndexOf("/")), { recursive: true })
+    // path.dirname — not lastIndexOf('/') — so Windows backslash spool paths
+    // still resolve to the parent dir (see #1869).
+    fs.mkdirSync(path.dirname(PERF_SPOOL), { recursive: true })
     const line = JSON.stringify({
       ts_ms: Date.now(),
       kind: "hook.fire",

package/dist/lib/hosts/dispatch.d.ts

@@ -74,6 +74,15 @@ export declare function remoteRunShellPrelude(agent: string): string;
  * reliable whole-tree operation for both normal stops and rollback cleanup.
  */
 export declare function buildDetachedLaunchCommand(inner: string): string;
+/** Build the detached PowerShell launch protocol used by Windows SSH hosts. */
+export declare function buildWindowsDetachedLaunchCommand(opts: {
+    forwardedArgs: string[];
+    remoteCwd?: string;
+    mirrorCwd?: boolean;
+    remoteLog: string;
+    remoteExit: string;
+    env: Record<string, string>;
+}): string;
 export interface DispatchResult {
     task: HostTask;
     /** Exit code when followed; undefined when detached (--no-follow). */
@@ -92,6 +101,7 @@ export declare function terminateDispatchedTask(task: HostTask): void;
  * Exit 1 if the group is still alive after TERM/KILL (can't stop it).
  */
 export declare function buildStopRemoteCommand(pid: number, remoteExit: string): string;
+export declare function buildWindowsStopRemoteCommand(pid: number, remoteExit: string): string;
 /**
  * Stop a running host task from the origin machine (`agents hosts stop <id>`).
  *