@phnx-labs/agents-cli 1.22.34 → 1.22.37

package/CHANGELOG.md

@@ -1,5 +1,675 @@
 # Changelog
 
+## 1.22.37
+
+- **`agents.yaml`'s five writers now emit identical bytes, closing the rest of the sync-blocking drift (RUSH-2505).**
+  Unpadding flow sequences fixed one half of this; the other half was that the five in-place writers of
+  `agents.yaml` disagreed on collection style. `state.ts` and `manifest.ts` pass `collectionStyle: 'block'`,
+  while `feed.ts`, `activity.ts` and the `notify.owner` migration in `migrate.ts` did not — so an empty map
+  rendered as `mcp:` with an indented `{}` from one group and `mcp: {}` from the other, and the two rewrote
+  each other forever. Measured against the real committed `~/.agents/agents.yaml`, the block group
+  round-tripped and the other group did not. All five now serialize through one `stringifyDoc()` helper that
+  pins the committed shape, so a write produces no diff regardless of which command ran. `routines.ts` keeps
+  its padding-only form: it writes routine YAML, which has no second writer to disagree with.
+  Source: `apps/cli/src/lib/yaml-io.ts`.
+
+- `agents routines add <file>` no longer rewrites the file you hand it. When the source is already the canonical routine YAML — the normal case for a definition tracked in `~/.agents` — the definition is left byte-for-byte alone instead of being re-serialized with its `devices:` pin stripped. A source from anywhere else is still copied in.
+- A `devices:` pin now says it applies to this box only and names `agents routines devices <name> --set`, instead of silently reading as `Devices: all` on every peer.
+- `agents routines edit <name> --cwd <path>` and `--project-anchor <name>` apply and save without opening `$EDITOR`, so the repair the readiness gate prints is one an agent can actually run.
+- A paused routine now names `agents routines resume <name>` as the follow-up.
+
+- **Agent helper processes are reaped when the agent exits (RUSH-2521).** An interactive
+  agent runs as the leaf of a detached tmux pane, and tearing that pane down only SIGHUPs
+  its foreground process group — so an MCP server or a harness background daemon that had
+  moved out of that group survived its session and kept its memory indefinitely. Measured
+  on the fleet: one pane holding 2.5 GB of Claude Code background daemons 22 days after
+  its session ended, and 34 orphaned `cgraph-mcp --daemon` processes on one worker.
+  `agents sessions reap` and the routines daemon's 5-minute sweep now terminate those
+  helpers as well as the dead panes, and `killSession` collects a session's helpers as it
+  tears the session down. A helper is attributed to its session (tier 1) through the
+  `AGENT_TMUX_SESSION_NAME` the pane exports and every descendant inherits — the one
+  handle that survives reparenting — and is killed only when that session is gone, or has
+  no attached client AND its agent process has exited; a tmux query that never actually
+  answered (missing/unsupported tmux, a spawn failure, a timed-out server) disables tier 1
+  for that sweep entirely rather than being treated as "no sessions", and
+  `agents sessions reap --json`'s `warnings` array (plus a daemon log line) says when that
+  happens. Tier 1 needs another process's environment, which is a plain `/proc` read on
+  Linux; on macOS, modern `ps -E` no longer exposes it at all, so tier 1 safely finds
+  nothing there today (known gap, not a regression — only tier 2 reaps on macOS). A
+  harness that detaches its daemons from the environment (Claude Code's `daemon run`) is
+  matched instead (tier 2) on the spawner pid it declares in its own argv, anchored on the
+  process's real executable rather than a substring match anywhere in its command line,
+  and excludes anything still owned by a live/attached pane — checked two independent
+  ways, tmux's own live pane-pid data (expanded to that pane leaf's current process-tree
+  descendants, so it protects a live agent's own subprocesses too, and works even with no
+  env marker readable anywhere in that tree, covering macOS and any `claude` started
+  outside an agents-cli pane) and the env marker when one is present — so a
+  `grep`/`cat`/pager, or an agent's own prompt (or a subprocess it spawns) quoting this
+  exact pattern, can never become a kill seed. A process that has genuinely reparented
+  away from every live pane leaf remains reapable. Reaped
+  only once the declared spawner pid is dead. `agents sessions reap --dry-run` lists what
+  would be collected without killing anything. Source:
+  `apps/cli/src/lib/tmux/orphan-reap.ts`, `apps/cli/src/lib/tmux/session.ts`,
+  `apps/cli/src/commands/sessions-reap.ts`.
+- **`sessions migrate --host` stops leaving `remain-on-exit` on server-wide, and lands the
+  migrated session where its reaper can see it (RUSH-2521).** The remote launch set the
+  tmux server default to `on` and never put it back, so every later pane on that box —
+  user splits included — retained a dead corpse when its command finished; it now keeps
+  the option on the migrated agent's own pane (which the liveness probe reads) and
+  restores the server default to `off`, matching `createSession`. Separately, the remote
+  session was created on tmux's bare default OS socket instead of the target's agents
+  socket, so the reaper above never found it and killed the just-migrated, still-live
+  agent as `tmux-session-gone` on its next tick — it now targets the same agents socket the
+  reaper queries. Source: `apps/cli/src/commands/sessions-migrate.ts`.
+
+- **`release.sh` fails fast when the `--device` home base cannot sign, instead of merging + tagging and then dying at publish.** The privileged phase (build + sign + notarize + npm publish) runs only at the very end, after the release PR is merged and the tag pushed. A `--device <box>` fallback that was never provisioned as a signing home base -- the documented "mac-mini is down, use `--device zion`" path on a box that has a Developer ID cert only in its *login* keychain, no headless-unlockable `rush-signing.keychain-db`, and no `apple.com`/`npmjs.com` secrets bundles -- failed there, *after* both irreversible acts, leaving a tagged-but-**unpublished** release (RUSH-2535: npm stuck at 1.22.35 with `v1.22.36` tagged). A new preflight runs a read-only readiness probe (`scripts/signing-home-base-probe.sh`) ON the resolved home base, over the same `agents ssh` hop the publish uses, BEFORE the crabbox/PR/merge/tag phases; an unprovisioned box aborts at the preflight naming the exact missing piece. Provisioning a new signing home base remains RUSH-2541. Source: `apps/cli/scripts/release.sh`, `apps/cli/scripts/signing-home-base-probe.sh`, `apps/cli/scripts/signing-home-base-probe.test.ts`.
+
+- **Collapse routine enablement to one enabled/disabled flag; remove `enable-project` (RUSH-2540).** A routine now has exactly one state — enabled or disabled — owned by this device (`meta.deviceRoutines`). `agents routines enable <name>` materialises a project routine (from the current project or a registered one) and turns it on in one step; `agents routines disable <name>` turns it off. The separate project opt-in (`agents routines enable-project` / `disable-project` / `projects` and the `meta.routines.projects` allowlist) is gone, and `agents routines resume`/`pause` remain as hidden aliases. `agents routines list` now shows discoverable project routines from your registered projects as disabled rows. Safety is unchanged: a cloned repo's `.agents/routines/*.yml` can never auto-fire — enablement lives in user-owned local state and a project YAML's own `enabled:` is never trusted for firing, and `sync` only refreshes definitions, never enablement. Source: `apps/cli/src/lib/routines-project.ts`, `apps/cli/src/commands/routines.ts`, `apps/cli/src/lib/types.ts`, `apps/cli/src/lib/state.ts`.
+
+- **Project / `--add-dir` grants reach Claude, Codex, Cursor, Kimi, and Grok — not just Claude and Codex.** Multi-repo projects already attached sibling checkouts as grants on `agents run --project` / `agents teams --project`; only Claude (`--add-dir`) and Codex (`workspace_roots`) consumed them, so a Cursor / Kimi / Grok agent on the same project saw the primary cwd alone. Now: Cursor and Kimi take the native `--add-dir` flag (same as Claude); Grok always gets a short `--rules` note naming the siblings, and when a non-off OS sandbox is active (`GROK_SANDBOX` / `--sandbox`) writes a project-local `.grok/sandbox.toml` profile (`agents-project`) with those paths as `read_write` and selects it. Codex is unchanged. Harnesses with no multi-root surface (OpenCode, Droid, …) still ignore the grants — that is a harness limitation, stated in the capability map (`lib/add-dir.ts`) rather than papered over. Source: `apps/cli/src/lib/add-dir.ts`, `apps/cli/src/lib/exec.ts`, `apps/cli/docs/projects.md`, `apps/cli/docs/teams.md`.
+
+- **Writing `agents.yaml` no longer pads flow sequences, so `~/.agents` keeps syncing fleet-wide.** The YAML emitter defaults to padded flow output (`[ a, b ]`), but the committed `agents.yaml` uses `[a, b]`. Installing the feed / activity-log hooks (`ensureFeedPublishHook`, `ensureActivityLogHook` — run back-to-back on `agents feed`) re-serialized the whole document, flipping any committed flow node — e.g. a notify hook's `command: [agents, notify, "{message}"]` — to the padded form. That left the git-backed `~/.agents` working tree permanently dirty on that one file, so `agents repo pull` refused and seven fleet boxes silently fell 37-52 commits behind, receiving no new project definitions, routines, or rules (RUSH-2505). All the writers that round-trip committed `agents.yaml`/routine YAML now pass `flowCollectionPadding: false`, matching the committed formatting exactly so a write produces no diff: `feed.ts`, `activity.ts`, the `notify.owner` migration in `migrate.ts`, and the routine-definition writer `serializeJob` (same synced repo).
+
+- **The generated HTML command reference is now browsable, not search-only.** `docs/command-reference.html` gains a sticky sidebar tree covering all 104 command groups and every subcommand — collapsed by default, one entry per card, so the surface can be explored without knowing what to type. Search filters the tree alongside the cards and auto-expands the groups holding matches; clicking a group scrolls to it, expands it, and highlights it, and the active entry follows as you scroll. The root `agents` card is anchorable at `#agents` instead of shipping an empty `id=""`. Still one self-contained file with no external assets. Source: `apps/cli/scripts/gen-command-index.ts`, `apps/cli/scripts/gen-command-index.test.ts`.
+
+- **`agents daemon services` exposes every hosted responsibility as an independent, toggleable service.** The daemon previously ran all of its hosted subsystems together — secrets broker, browser IPC, scheduler, monitors, watchdog, device probe, self-heal, keychain reap, account-state refresh, and state-dir checks — with only coarse `daemon.enabled` and `scheduler.enabled` kill switches. Now each responsibility is listed under `agents daemon services`, and `agents daemon services enable|disable <id>` persists per-service state in `~/.agents/daemon/services.yaml`. Missing keys default to enabled, so upgrades are no-ops. The running daemon reads the catalog at startup and gates each timer or hosted process by its toggle; a few services (scheduler, monitor engine) also re-evaluate on `SIGHUP` reload. Source: `apps/cli/src/lib/daemon-services.ts`, `apps/cli/src/commands/daemon.ts`, `apps/cli/src/lib/daemon.ts`.
+
+- **A disabled secrets broker fails loud instead of falling back to per-request Touch ID.** When `secrets-broker` is disabled, `agents secrets unlock/status/start` report the disabled state up front, and any keychain-backed bundle read throws a clear error naming the `agents daemon services enable secrets-broker` recovery step. This closes the path where disabling the daemon's broker silently turned every secret read into a fresh biometric prompt. Direct keychain reads remain available when explicitly opted in via `AGENTS_SECRETS_NO_AGENT=1`. Source: `apps/cli/src/lib/secrets/agent.ts`, `apps/cli/src/lib/secrets/bundles.ts`, `apps/cli/src/commands/secrets.ts`.
+
+- **One event engine: `events` is the source of truth; `audit` and `logs` are aliases.** The unified event stream already covered ops + agent activity; run-dispatch outcomes now land there too as `run.dispatched` (written from the same exec chokepoint that used to append the separate hash-chained `~/.agents/.history/audit/log.jsonl`). New CLI surface:
+  - `agents events --include` / `--exclude` families: `ops`, `activity`, `commands`, `runs`, `security` (sessions-style, mutually exclusive).
+  - `agents events --exclude commands` drops high-churn `command.start`/`command.end` noise.
+  - `agents events --include runs` lists dispatched-run outcomes (what `audit list` used to show).
+  - `agents events stats` / `agents events rotate` own housekeeping (moved off the logs tree as the canonical home).
+  - `agents audit` ≡ `events --include runs`; `agents audit list` same; `agents audit verify` still walks a *legacy* hash-chain file if present, else reports clean and points at the events stream.
+  - `agents logs` ≡ `events`; `logs audit` ≡ `events --include ops`; `logs stats`/`rotate` re-dispatch. A bare `logs <id>` redirects to `sessions` / `hosts logs` for content.
+  - Coverage: secrets/keychain (`secrets.*`), browser, computer, daemon lifecycle (`daemon.start`/`stop`/`error`/`info` mirrored from the daemon log), plus every module already covered by the CLI `command.start`/`command.end` choke point. Source: `apps/cli/src/lib/event-families.ts`, `event-stream.ts`, `events.ts`, `audit/log.ts`, `daemon.ts`, `commands/events.ts`, `commands/audit.ts`, `commands/logs.ts`.
+
+- **Nest disposable leases under devices.** Manage crabbox leases with `agents devices lease setup|list|stop|gc`; the removed top-level `agents lease` command now fails as unknown, while `agents run --lease` and `--box` keep their existing behavior. Source: `apps/cli/src/commands/lease.ts`.
+
+- **Nest Funnel management under the daemon command.** Use `agents daemon funnel status|up|down` for webhook ingress; the former top-level `agents funnel` command has been removed. Source: `apps/cli/src/commands/daemon.ts`.
+
+### Fixed
+
+- **Menu bar NEW DEVICES no longer lists already-registered or ignored boxes.**
+  The daemon's pending-device sentinel writer (`reconcilePendingSentinels`) now
+  re-subtracts the registered roster as well as the ignore-list, so a hermetic
+  run that empties the registry view while writing the live `devices-pending/`
+  dir cannot surface every fleet box as "new". Soft-fail probe ticks (no
+  tailscale) still prune dismissed sentinels, and the probe fires once on
+  daemon start so leftover pollution clears without waiting for the 3-minute
+  interval.
+
+- **`release.sh` no longer deadlocks when the stuck release is one nothing can finish.** Two guards could each name the other as the way out, leaving no version publishable: the stuck-tag guard refused to bump past an unpublished `v<main-version>` ("finish that release first"), while the catch-up guard refused that same version ("no complete merged release PR ... cut the next patch through the normal release PR flow"). Hit on 2026-08-10 with npm at 1.22.35 and `v1.22.36` tagged: 1.22.36 could not be finished at all, because its CI-tested tree predates the prepack version-gate fix (`1dffc78bc`) and so its own `npm publish` rejects a correct binary. `scripts/stuck-release.sh` now takes the resolved bump kind and main's version, and exempts exactly one case — `patch-from-main` stepping over main's own version, which is precisely what `validate-bump.sh` documents that bump kind for. Every other stuck version still blocks, and every other bump kind still blocks on this one, so a genuine died-between-tag-and-publish jam is reported exactly as before. Source: `apps/cli/scripts/stuck-release.sh`, `apps/cli/scripts/release.sh`, `apps/cli/scripts/stuck-release.test.ts`.
+
+---
+type: breaking
+---
+
+Remove the top-level `agents wallet` command and its payment-card storage implementation. Payment-card management will return under `agents secrets` in RUSH-2532.
+
+Removed the top-level `agents whoami` command. Use `agents login` and `agents logout` to manage synced-secrets access.
+
+---
+type: breaking
+---
+
+Remove the top-level `agents worktree` command. Team worktree isolation remains available through `agents teams --worktree` and `--enable-worktrees`.
+
+- Remove the top-level `agents defaults` and `agents export` commands. Configure run defaults and the projects root through `agents config`; isolated installs are removed with `agents remove <agent>@<version> --isolated`.
+
+- **Removed the top-level `agents hosts` command group.** `agents devices` is now
+  the sole user-facing fleet registry. The registry subcommands map to devices:
+  `agents hosts list|add|remove` → `agents devices list|add|rm`. The per-host
+  `agents hosts check <name>` probe has no standalone replacement — fleet health
+  is `agents devices status` (a rollup over every registered device, no per-host
+  argument), and the per-host readiness probe still runs internally via
+  `ensureHostReady` at dispatch time. The
+  two dispatched-task commands with no devices equivalent moved under devices:
+  `agents hosts ps` → `agents devices ps` (list tasks dispatched with
+  `agents run --device <name> --no-follow`; reconciles running records; `--json`),
+  and `agents hosts stop <id>` → `agents devices stop <id>` (alias `kill`).
+  `agents hosts logs <id>` is dropped because `agents logs <id>` already views and
+  follows host-dispatch task logs. The dispatch fabric is unchanged: `agents run
+  --host/--device`, teams remote, and cloud `--provider host` all still work.
+  Source: `apps/cli/src/commands/ssh.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **Removed the top-level `agents lock` and `agents helper` commands.** `agents lock` (the `agents.lock` SHA-256 resource manifest, generation + `--frozen` verification) and `agents helper` (the macOS Keychain `.app` install/status/where surface) are gone, along with `src/lib/lock.ts` and its tests. The signed Keychain helper still installs and repairs itself automatically — the postinstall installs it, and `getKeychainHelperPath()`'s lazy staleness check reinstalls it on the next `agents secrets` use (or when you reinstall agents-cli) — so no user action replaces `agents helper install`. Verify: `agents lock` and `agents helper` now print an unknown-command error.
+
+- **Removed the top-level `agents publish` command.** Skill registry search and install remain available for existing indexes, but generating and pushing an index is no longer a built-in agents-cli surface.
+
+- **Remove the resource-profile command tree.** `agents profile` and the resource-profile aliases `agents profiles use/status` no longer register; `agents profiles` remains the provider/host profile surface for Kimi, DeepSeek, and other custom harnesses. Source: `apps/cli/src/commands/profiles.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **Remove top-level pull and push commands.** `agents pull` and `agents push` are no longer registered; use `agents repo pull <alias>` and `agents repo push <alias>` instead. Source: `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **`agents sessions watch --json` is the canonical incremental session-state stream for AGI EXT and other long-lived consumers (RUSH-2484).** It reads one startup snapshot, then tails the canonical publisher's row-delta journal rather than re-running live-session or fleet gathers. Versioned NDJSON `reset`, `upsert`, `remove`, device-scope availability, and heartbeat envelopes carry opaque row keys and monotonic per-stream sequence numbers. Rows include CLI-owned recovery metadata, and unavailable device scopes retain their last rows. `--local` disables fleet aggregation.
+
+- **Fleet readiness now comes from the existing device/account JSON contracts (RUSH-2484).** `agents devices list --json` includes effective config and resource health; `agents devices status --json` includes each row's effective profile/config; and `agents devices accounts --json` exposes quota verdict, capture/reset timestamps, and an explicit unavailable reason. `agents run auto --interactive --device auto --strategy balanced --mode auto` excludes unreachable, overloaded, signed-out, rate-limited, and out-of-credits choices and fails loud when no eligible placement exists.
+
+- **`agents tickets list --json` is the canonical Linear/GitHub backlog read for UI consumers (RUSH-2484).** It returns one stable task shape, cycle metadata, and independent availability/error state for each tracker so one failed source does not erase another source's rows.
+
+- **Skills and commands can declare `aliases:` in their frontmatter.** Resource
+  resolution now matches a declared alias in addition to the canonical file/dir
+  name, so `resolveResource('skills', 'browser')` finds a skill that lists
+  `browser` among its `aliases:`. The canonical name always wins a collision — a
+  real resource named `browser` beats any resource that merely aliases it, in any
+  layer — and layer precedence (project > user > system) still applies among
+  aliases. `listResources` surfaces each resource's `aliases`. This is the
+  prerequisite for housing a resource under a plugin namespace (e.g. `agi:browser`)
+  while a bare name keeps resolving. (RUSH-2504)
+
+- **Credential pushes now ride a hardened SSH posture: pinned host keys + no
+  connection reuse (RUSH-2527).** Every `agents secrets` operation that moves
+  credential bytes across the fleet — `agents accounts sync <name> --device`,
+  `agents secrets export <bundle> --host`, `agents fleet apply
+  --provision-secrets`, and a remote bundle resolve (`run --secrets b@host` /
+  `secrets exec --host`) — now verifies the destination against the CLI-managed
+  known_hosts store (a **changed** host key is refused) and never leaves a reusable
+  60s SSH `ControlMaster` socket behind that an unrelated later `agents` invocation
+  could silently reuse. This matches the posture the `--copy-creds` dispatch
+  already used, extended to the explicit provider-account and secrets-export
+  transports. Read-only browse calls (`secrets list --host`) are unaffected and
+  keep the fast multiplexed baseline. Source:
+  `apps/cli/src/lib/secrets/remote.ts` (`credentialTransportSshOpts`),
+  `apps/cli/src/lib/secrets/push.ts`.
+
+- **Daemon routines and watchdog emit first-class events.** Scheduler fires write `routine.start` / `routine.end` (including spawn failures, host-monitor finalization, and terminal cloud dispatch) and each watchdog pass writes `watchdog.action` with live/stalled/nudged counts onto the unified stream — filterable via `agents events --module routine|watchdog` or `--event routine.start`. Daemon process lifecycle remains the existing log mirror (`daemon.start`/`stop`/`error`/`info`). Source: `apps/cli/src/lib/daemon.ts`, `runner.ts`, `events.ts`.
+
+- **One verb gets you back into a session.** Getting back in used to mean choosing among seven commands, where the right one depended on internal state you could not see — `sessions focus`, `sessions attach`, `sessions reconnect`, `sessions resume`, `sessions go`, top-level `agents resume`, and raw `agents tmux attach`. `agents sessions resume <id-or-alias>` now detects the state instead: it attaches a **live tmux pane**, brings a **headless** session to the foreground, or **recovers** an ended one on its owning device. It accepts a full id, an id prefix, or an `ag-<agent>-<shortid>` tmux alias, and takes `--attach-only` (attach one living process or refuse, never fork a copy). Bare `agents sessions resume` keeps the multi-select history picker. `agents sessions --help` drops from 21 commands to 16.
+- **Retired, hidden but still working for one release** — each prints the replacement on stderr: `agents sessions attach <id>` and `agents reconnect [id]` → `agents sessions resume`; `agents sessions go <id>` → `agents sessions resume <id> --attach-only`. `agents sessions focus` is hidden and becomes the internal lifecycle dispatcher (`resume` delegates to it), so it is deliberately not warned. **One behaviour is deliberately dropped:** bare `agents reconnect` (no id) auto-attached the most recent session started in the current directory with no prompt; bare `agents sessions resume` opens the picker instead, so that zero-typing path goes away when `reconnect` is deleted after its deprecation window (tracked on RUSH-2498). **Kept:** `agents sessions detach` (the genuine inverse — it stops the interactive process and respawns the agent headless, which nothing else does), `fork`, `migrate`, and the raw `agents tmux attach <name>` escape hatch.
+- **A live tmux alias now attaches instead of being keyword-searched.** `agents sessions resume ag-kimi-632c1fbc` attached nothing before: the alias fell through to a keyword query and returned unrelated text matches while the pane was alive and attachable. The alias's hex is the *launch* id, not the harness session id, and a harness that writes no `state/sessions/<pid>.json` record cannot be mapped back to a session at all — so such a pane had no working selector and raw `tmux -S … attach` was the only way in. The pane name is now a sufficient handle. `#{pane_dead}` is still queried at attach time, so a dead pane routes to recovery rather than attaching a corpse.
+- **A full UUID is one session, not an ambiguity.** `agents sessions focus <full-uuid>` could answer `"…" is ambiguous (2 sessions). Use more of the id.` with no longer id to give: a transcript that had synced to a second machine counted twice, and one copy had no transcript file left. Synced copies sharing one full id now count as one logical session (SES-IF-2a). A genuine prefix collision between *different* ids still reports both.
+- **`agents sessions reap` is removed** (it shipped in 1.22.36 alongside the dead-pane reaper). The 5-minute daemon sweep stays — it is the part that matters, and it only kills sessions where *all* panes are dead. The daemon calls the reaper directly, and `agents tmux kill <name>` (idempotent) already covers the manual case.
+
+Source: `apps/cli/src/commands/sessions-resume.ts`, `apps/cli/src/commands/focus.ts`, `apps/cli/src/commands/{attach,reconnect,go}.ts`, `apps/cli/src/lib/session/types.ts`.
+
+- **A tmux-wrapped run killed mid-work no longer reports success (EXEC-23b).** `agents run` wraps an interactive run in tmux and reads the agent's exit status back off the pane. On the three paths where tmux could not report one — the pane unreadable because the server or session went away, or dead with no `#{pane_dead_status}` — it returned `0`. So an interactive run whose tmux server died under it (`[server exited unexpectedly]`, the agent stranded at an approval prompt) printed a failure banner reading `exit 1` and handed its caller `0`: anything scripting `agents run` counted a killed run as a clean finish. Those cases now resolve `1` and print an explicit "outcome unknown" banner, matching the rule the `--host` follow path already used ("the remote's own exit code, or 1 if unknown"). Exit `0` is reserved for an outcome tmux actually reported: a confirmed-alive pane (a clean `Ctrl-b d` detach) or a dead pane whose status tmux read as `0`. One helper, `tmuxRunExitCode(pane, knownAlive)`, is now the single decision behind **every** `runInTmux` return path, so the banner and the returned code cannot disagree. That includes the native-resume attach (`agents run <agent> --resume`), which previously returned a hardcoded `0` without ever querying tmux — `prepareSessionForResume` now returns the pane it resolved so the resumed run can be asked about too. Known cost, accepted deliberately: the daemon's 5-minute dead-pane reap can remove a cleanly-exited session in the moment between its pane dying and the status read, so such a run reports `1`; once the pane is gone there is no other evidence, and a false unknown beats a false success. Source: `apps/cli/src/lib/exec.ts`, `apps/cli/src/lib/tmux/session.ts`, `apps/cli/docs/specifications.md`.
+
+- **`agents sessions --browser` / `--computer` now name the agent session that drove the task (RUSH-2549).** Every browser row used to read `unlinked` with `last known owner: UNRESOLVED@<host>`, because task identity lived only in the browser daemon's `tasks.json` — a file `saveTaskState` rewrites from the LIVE task map, so `agents browser stop` erased the link and a daemon restart emptied it. Observed on a real machine: a profile's `tasks.json` was `{}` while its `sessions/` dir held dozens of task dirs full of captures. Identity is now written once at task start to a durable `browser_sessions` row and is **never deleted**, so a finished task still resolves its session. The link also keys on `AGENT_SESSION_ID` — carried by every agent, measured on 5 of 5 live agent processes — in addition to `AGENT_LAUNCH_ID`, which was on only 2 of 5 and was previously the sole join key. Computer-use invocations get the same durable `computer_sessions` row: they already resolved identity correctly (`stampProvenance` reads the session env) but recorded it only in the event ledger, which prunes at 7 days / 50 MiB, so a run vanished on day 8; the row keeps it listed with identity, timing and a total action count (rendered as `N actions (per-verb detail pruned from the event log)`), and never reconstructs the pruned per-verb detail. The table carries its own long retention (`TOOL_SESSION_MAX_AGE_DAYS`, swept from the listing path) so it cannot grow without bound, and reads are limit-bounded. Both tables are **metadata only** — screenshots, PDFs and recordings stay on disk under `.cache/browser/<profile>/sessions/<task>/`, referenced by path; nothing copies bytes into SQLite. Identity is resolved in the calling CLI process, never daemon-side (the shared daemon would attribute every task to itself). Schema v39, additive. Forward-only: captures taken before this cannot be linked retroactively, because their identity was already discarded — those rows read `unlinked` honestly. Known gap: `agents browser start --host <device>` still records no session, because the SSH dispatch forwards `AGENTS_ACTOR*` / `AGENT_TERMINAL_ID` but not `AGENT_SESSION_ID` (`lib/hosts/dispatch.ts` `withActorEnv`); tracked on RUSH-2549, not fixed here. Source: `apps/cli/src/lib/session/db.ts`, `apps/cli/src/lib/browser/service.ts`, `apps/cli/src/lib/browser/sessions-list.ts`, `apps/cli/src/lib/computer/sessions-list.ts`, `apps/cli/src/commands/browser.ts`, `apps/cli/src/commands/computer-actions.ts`, `apps/cli/docs/browser.md`, `apps/cli/docs/computer.md`.
+
+---
+type: feature
+---
+
+Add `usage.primary-host`, a user-scope `agents config` key that pins the device authoritative for fleet usage while falling back to `interactive.host` when unset.
+
+- **Fleet usage primary runtime.** When `usage.primary-host` (or `interactive.host`) is set, only that device runs frequent live usage API refreshes; peers pull a token-free snapshot. Standalone mode keeps per-host refresh when no pin is set.
+
+- **VSCodium agent tabs get the right chip on focus/resume (#2478).** The
+  `vscodium-agent` spawn URI now carries `agent` / `sessionId` / `title` from
+  `sessions focus` and `sessions resume`, so remote `ssh … tmux attach` tabs open
+  with the harness icon and status bar instead of a generic shell. The terminal
+  engine's `SurfaceItem` / `LaunchRequest` plumb the optional identity through;
+  other backends ignore it.
+
+- Rename the top-level webhook receiver command to `agents webhooks`. The singular spelling is no longer registered; use `agents webhooks serve`.
+
+## 1.22.36
+
+- **`agents cp <src> <dst>` — first-class fleet file transfer (RUSH-2297).** New
+  top-level command that copies files and directories between fleet hosts
+  (local-to-remote, remote-to-local, and remote-to-remote) using the same
+  SSH/device fabric as `agents ssh`. Either endpoint is `host:path` (remote) or
+  an absolute local path. Remote `~` and literal `$HOME` in a path are resolved
+  **on the remote host** before transfer — never in the caller's shell —
+  preventing the silent-failure class where a shell variable expands to the
+  local user's home directory instead of the remote one. Unknown devices fail
+  loudly with a human-readable error before any SSH connection is attempted.
+  Recursive directory copies use `-r`; two-remote transfers route through the
+  local machine (`-3`) so no direct SSH trust between fleet boxes is required.
+  Source: `apps/cli/src/commands/cp.ts`.
+
+- **Faster warm CLI bootstrap: skip redundant sync spawn + multi-install PATH scan (RUSH-2324).** Ordinary (non-`--help`/`--version`) invocations no longer fork the detached auto-pull worker when a cycle finished in the last five minutes (parent inspects the `.last-sync` stamp and fresh `*.lock` mtimes under the fetch cache), and the multi-install install-root scan is memoized beside `.update-check` for the same window. Saves the measured ~7.3ms spawn + ~1ms PATH walk on the warm path without changing sync semantics. Source: `apps/cli/src/lib/auto-pull.ts`, `apps/cli/src/lib/auto-pull-worker.ts`, `apps/cli/src/lib/self-update.ts`, `apps/cli/src/bootstrap.ts`.
+
+- **Unknown / typo'd top-level commands no longer load every command module (RUSH-2329).**
+  A misspelled name used to call `registerAllEagerCommands` (and the lazy
+  sessions/teams/cloud tree) solely to build the "did you mean" candidate list —
+  ~250–330ms of dynamic import on cold start. Spellcheck now walks the
+  plain-string `KNOWN_TOP_LEVEL_COMMANDS` set (same first-seen order for
+  tie-breaks) and registers only the auto-corrected command before reparse.
+  Distance-1 auto-correct and `--host` re-routing after correction are
+  unchanged. Source: `apps/cli/src/index.ts`, `apps/cli/src/lib/startup/spellcheck.ts`.
+
+- **CLI bootstrap no longer loads `versions.ts` via the brand edge (RUSH-2331).**
+  Every `agents` invocation statically imports `brand.js` for `resolveBrandName` /
+  `disabledCommandsForActiveBrand`. That module used to import `agents.js` solely
+  for `reservedBrandNames()` / `validateBrandName()` (mine/setup only), and
+  `agents.js` pulls the full `versions.ts` graph — ~90ms of module evaluation on
+  the `--version` / secrets-broker / bare-help path. `brand.ts` now reads the
+  zero-dep `agent-cli-commands` leaf (pinned equal to `AGENTS[*].cliCommand` by
+  test); the self-update → primitives redirect from the same ticket remains.
+  Source: `apps/cli/src/lib/brand.ts`, `apps/cli/src/lib/agent-cli-commands.ts`.
+
+- **Synchronous secrets-broker reads no longer pay ~140ms of CLI bootstrap (RUSH-2335).** `dist/index.js` is now a slim shell that statically imports only the leaf `lib/secrets/sync-commands.js` and dispatches `__secrets-get` / `__secrets-ping` / `__secrets-lock` (plus `__vault-age-helper`, `__shim`, `__daemon-run`, `__daemon-tick`) before loading the full commander graph. Everything else arrives via `await import('./bootstrap.js')`. Cold `node dist/index.js __secrets-ping` was measured at ~160–180ms against a ~22ms bare-node floor; the leaf-only path evaluates in roughly one bare-node spawn plus the agent handler. Source: `apps/cli/src/index.ts`, `apps/cli/src/bootstrap.ts`.
+
+- **`agents --help` / `--version` no longer run the macOS menu-bar self-heal (RUSH-2346).** On darwin the startup self-heal (`installMenubarLaunchAgentOnUpgrade()`) ran on every invocation, including the pure documentation paths, dynamically importing `lib/menubar/install-menubar.js` and doing its filesystem checks before deciding to no-op. It now carries the same `helpOrVersionRequested` gate the update check, background sync, and `ensureInitialized` already use, so help and version skip the self-heal's filesystem work and its `installMenubarLaunchAgentOnUpgrade()` call. (On the default path the `lib/menubar/install-menubar.js` module is still pulled into the import graph via the static `migrate.ts` → routine-readiness → hosts chain; shedding that residual import cost is tracked separately.) Source: `apps/cli/src/index.ts`.
+
+- **1Password import now captures each item's notes as a description (RUSH-2348).** `agents secrets import --from 1password:<vault>` previously read only an item's credential value and dropped its `notesPlain` notes entirely. The importer now extracts a NOTES-purpose field (1Password's `notesPlain`, or a field labelled notes) as descriptive metadata on the imported secret, while the CONCEALED credential remains the value — notes are never selected as the secret itself. Source: `apps/cli/src/lib/onepassword.ts`.
+
+- **`buildExecEnv` strips an ambient `CLAUDE_CODE_OAUTH_TOKEN` on non-interactive Claude runs when no per-account setup-token resolves (RUSH-2360).** A run dispatched on a provisioned box inherits the launcher's shared, rotating `CLAUDE_CODE_OAUTH_TOKEN` through `sanitizeProcessEnv(process.env)`. When the reserved `auth` bundle carried this version home's own setup-token it was injected over that ambient value, but when NONE resolved the ambient token was left in place — so `agents run claude "<prompt>"` could silently authenticate as the shared token, the RUSH-1822 fleet-wide-logout hazard. The non-interactive path now mirrors the routines path (`runner.ts:1017-1021`) unconditionally: inject the resolved setup-token, else delete the ambient one, so a missing login fails loud (401) against this home's own credential rather than borrowing another's. The strip also runs when no version resolves (`version === null`), matching the routines guard. Interactive runs are unchanged — they still keep a deliberately-exported token and drop only an inherited copy of their own setup-token by value (#2383). Source: `apps/cli/src/lib/exec.ts` (`buildExecEnv`).
+
+- **Add DeepInfra profiles, accounts, and usage (RUSH-2362).** `agents accounts add deepinfra --provider deepinfra --auth api-key` stores the API key in the existing prompt-free account bundle, and `agents profiles add deepinfra --account deepinfra` configures Codex for `https://api.deepinfra.com/v1/openai` with `deepseek-ai/DeepSeek-V3`. The daemon-owned BYOK refresh path reads DeepInfra's documented `/payment/checklist` endpoint so `agents view` can show current usage and prepaid credit without raising a credential prompt. Source: `apps/cli/src/lib/profiles-presets.ts`, `apps/cli/src/lib/account-provider-registry.ts`, `apps/cli/src/lib/byok-usage.ts`.
+
+- **Faster CLI bootstrap: skip `--host` passthrough module graph when no routing flag (RUSH-2374).** Ordinary named invocations (`agents view`, `agents sync`, …) no longer dynamically import `lib/hosts/passthrough.js` (~187ms cold module graph measured on yosemite-s1) just for `maybeRunOnHost` to return false. Bootstrap now gates that import on a leaf `hasHostRoutingFlag` scan of `--host`/`-H`/`--device`/`--hosts`/`--devices` (~0.001ms). Also import `machineId` from the leaf `machine-id.js` instead of the `session/sync/config.js` re-export on the routed path. Source: `apps/cli/src/bootstrap.ts`, `apps/cli/src/lib/hosts/routing-flag.ts`, `apps/cli/src/lib/hosts/passthrough.ts`.
+
+- **`agents teams status` shows `PR OPEN` instead of bare `COMPLETED` when a
+  teammate finished with an unmerged PR (RUSH-2380).** Process-exit success was
+  reported as COMPLETED even when the PR was still open, so orchestrators
+  composed on top of unlanded work (3/3 edit-mode teammates one day). Delivery
+  is now a separate postcondition (`delivery: pr_open | pr_merged | no_pr | …`)
+  on status JSON; the human status label is `PR OPEN` (magenta) when process
+  status is completed and a PR URL is present without a known merge. Process
+  status still drives the DAG (`--after`); only the display/JSON delivery
+  signal changed. Source: `apps/cli/src/lib/teams/delivery.ts`,
+  `apps/cli/src/lib/teams/api.ts`, `apps/cli/src/commands/teams.ts`.
+
+- **Live agents no longer leave the active set (and become unreachable by `agents message`) when the by-pid registry is empty (RUSH-2384).** A mid-run headless/teams process can keep working with `--session-id` on its argv while `~/.agents/.cache/terminals/by-pid/` has zero files (wrapper pid exited and was pruned, or the launch never recorded one). The headless scan only consulted the registry / SessionStart hook / newest-jsonl heuristic, so foldSubordinateAgents could collapse that process into a parent and drop its id from `agents sessions --active` — and `agents message <id>` resolved purely from that set, so the only recovery was kill-and-redispatch. The scan now reads `--session-id` from the live process argv (Linux `/proc/<pid>/cmdline`, Darwin `ps`), treats argv identity as "own session" so those children are not folded away, and `agents message` falls back to the same process-table proof before reporting no match. Source: `apps/cli/src/lib/session/pid-registry.ts`, `apps/cli/src/lib/session/active.ts`, `apps/cli/src/commands/message.ts`.
+
+- **`agents view` names the setup-token usage-scope gap instead of painting healthy headless Claude accounts as broken (RUSH-2392).** `claude setup-token` mints `user:inference` only; Anthropic's usage endpoint requires `user:profile` and returns HTTP 403. The probe and live usage read previously treated that 403 like any other rejection — auth-health mapped it to `revoked`, and `formatUsageSummary` stamped cached bars `unverified`. The accounts best provisioned for unattended work therefore looked the least healthy. The Claude usage path now detects the known scope-denial body (`user:profile` / "scope requirement"), surfaces `usage unavailable (headless)`, and auth-health classifies `reason: usage_scope` as `unverified` (benign) rather than `revoked`. Minting another setup-token cannot fix bars; interactive login (or device-role strategy, RUSH-2395) is the only path to usage meters. Source: `apps/cli/src/lib/usage.ts`, `apps/cli/src/lib/auth-health.ts`, `apps/cli/src/commands/view.ts`, `apps/cli/src/commands/versions.ts`.
+
+- **A headless run that exits with its branch on an OPEN PR now says so (RUSH-2394).** A headless `agents run` that backgrounds `gh pr checks --watch` and exits strands its own PR: that watcher is a child of the agent process tree and dies with it, so nothing merges on green and the PR sits open with nobody watching. A headless writable run that exits (or crashes) with the branch still on an OPEN pull request now prints a loud stderr warning naming the PR. Advisory only — it never throws and never blocks the run's exit. Source: `apps/cli/src/lib/pr-land-detach.ts`, `apps/cli/src/commands/exec.ts`.
+
+## Breaking
+
+- Replace version-bound account labels with durable credential accounts. Create API-key, Claude setup-token, or bearer-token accounts with `agents accounts add`; native OAuth logins remain harness-managed.
+
+## New
+
+- Reuse one named provider credential across compatible native and custom harnesses with `agents run --account <name>` or a harness `account:` default, and rotate it without changing the account id.
+
+- **The daemon can no longer crash-loop unbounded (RUSH-2418).** Crash-loop prevention existed only as the OS supervisor's retry, uncapped: the launchd plist set `KeepAlive` with no `ThrottleInterval`, so a daemon dying during startup was relaunched on launchd's ~10s default — six times a minute, forever — and the systemd unit's `Restart=always` had no `StartLimitIntervalSec`/`StartLimitBurst` to ever give up. Three layers now bound it. The plist carries a `ThrottleInterval` (the same fix the menu-bar helper already ships), the unit carries `StartLimitIntervalSec`/`StartLimitBurst` in `[Unit]` (where systemd 229+ actually reads them) with `RestartSec` paced so the bursts fit inside the window, and `agents __daemon-run` installs top-level `uncaughtException`/`unhandledRejection` handlers — there were none anywhere in the CLI — that route the failure into the daemon's own `logs.jsonl` and exit non-zero deterministically instead of dying on Node's default handler with a raw stack. Separately, `daemon-health.ts`'s `consecutiveFailures` was write-only telemetry; a new `daemon-start` record now drives an auto-start circuit breaker. Starts are counted up front and cleared only by a daemon that finishes booting, because the crash loop is invisible from the launcher's side — a daemon that spawns and then dies returns a perfectly real pid, so there is no error to observe. After 5 consecutive starts that never report healthy, the implicit auto-start (`ensureDaemonStarted`, reached from `secrets unlock`, `browser start`, the watchdog) refuses instead of relaunching a broken daemon on every foreground command, and `agents daemon doctor` reports the streak and its recorded cause. An already-running daemon is still reported, and the explicit `agents daemon start` override is never gated. Source: `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/daemon-health.ts`, `apps/cli/src/commands/daemon.ts`, `apps/cli/src/index.ts`.
+
+- **`agents daemon stop` now proves the daemon's state files were released, not just its sockets (RUSH-2421).** The stop postcondition checked the daemon process and the two sockets (browser IPC, secrets broker) but not the three files a graceful shutdown removes: the lifetime marker, the heartbeat, and the daemon's instance-registry entry. Those are cleaned up in `handleShutdown`, which never runs on the escalated `killTree` path or on Windows — so a wedged daemon that had to be killed left all three behind while the stop reported `ok: true`. That is not cosmetic: a leftover heartbeat is what `resolveLiveDaemonPid` consults to re-adopt a daemon whose pid file is gone, so a dead daemon could read as running, and a leftover registry entry is what the stray-daemon reaper enumerates. Each is now checked and reclaimed the same way the sockets are, and reported in `released`/`surviving` — with the same ownership rule the broker socket already used: a marker naming a pid that is alive and is not the daemon just stopped belongs to a live successor and is left untouched. Separately, `BrowserIPCServer.stop()` called `net.Server.close()` without awaiting its `'close'` event, so it resolved while the socket was still bound; since the daemon awaits it before exiting and a successor treats that exit as proof the predecessor's resources are free (SING-11), the proof was false. It now waits for the real release — ending held client connections so the binding is freed immediately, with a 1.5s backstop kept well below the daemon's SIGTERM grace window so a slow close can never be what gets the daemon killed. Source: `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/browser/ipc.ts`.
+
+- **A graceful `agents daemon stop` no longer escalates to a kill when a browser client is attached (RUSH-2421 follow-up).** The awaited-close fix shipped with its timeout set to 5s — exactly the daemon's own SIGTERM grace window. `net.Server.close()` does not complete while any connection is open, and browser clients hold one open on purpose (the socket stays warm between actions), so `handleShutdown` was still inside `browserIPC.stop()` when `stopDaemon` gave up waiting and ran `killTree`. Measured: 5512ms for a stop that should take milliseconds. `stop()` now ends the tracked client connections instead of waiting for them, so the binding is released immediately; the timeout is a backstop only, cut to 1.5s so a slow close can never be what gets the daemon killed. `stop()` is also idempotent now — a second SIGTERM awaits the same close rather than racing past it because the server handle was already cleared. Separately, the stop's registry-entry check treated its own pid as residue unconditionally, so a daemon that survived the kill lost the record `findSurvivingStateDirDaemons` reads and the *next* stop would report `ok: true` with it still running; ownership is now decided by the stop's own survivor scan rather than `isAlive`, which also fixes the zombie case (a SIGKILLed daemon stays signalable until reaped, so `kill(pid, 0)` reports it alive). Source: `apps/cli/src/lib/browser/ipc.ts`, `apps/cli/src/lib/daemon.ts`.
+
+- **Repeated SIGTERMs during daemon shutdown now run the shutdown once (RUSH-2423).** `handleShutdown` is reachable from SIGTERM, SIGINT, and the state-dir self-check, and two can arrive together — a service manager SIGTERMing a daemon whose state dir was just removed. It was safe only because every step inside happens to be idempotent, which is a property each newly added step would silently have to re-earn; single-shot is now a property of the function. Alongside it, three internals cleanups with no behaviour change: the daemon's log path is exported as `getDaemonLogPath()` and the two commands that rebuilt it from a hardcoded `'logs.jsonl'` literal (`agents daemon logs`, `agents routines`) now call it, so renaming the file cannot silently point them at nothing; the background-tick cadences that were inline literals at their `setInterval` are named beside the existing tick constants, each with why that cadence and not another; and the comments settle on one term, "state dir", replacing a daemon-dir/state-dir/state-tree mix. Source: `apps/cli/src/lib/daemon.ts`, `apps/cli/src/commands/daemon.ts`, `apps/cli/src/commands/routines.ts`.
+
+- **A torn `meta.json` write no longer permanently disables orphan-worktree cleanup for every worktree name in every team (RUSH-2429).** `saveMeta()` wrote with a bare `fs.writeFile` — no tmp file, no rename — so a process killed mid-write left a truncated, unparseable `meta.json`. `loadFromDisk()` returned `null` for that file from a bare catch, indistinguishable from the file never having existed, so `loadExistingAgents()`/`rescanFromDisk()` silently skipped it forever and `isWorktreeClaimed()` (which reads `meta.json` directly, not through the cache) then failed CLOSED on it globally: it scans every record and answers "claimed" the first time it can't read one, so one corrupt record permanently blocked `teams add`'s orphan-worktree teardown for every name in every team. `saveMeta()` now writes to a sibling tmp file and `fs.rename`s it into place — atomic on POSIX, so a killed write leaves either the previous valid record or the new one, never a torn one. `loadFromDisk()` now quarantines a record whose *content* is corrupt — a torn or unparseable `meta.json`, the case that actually breaks cleanup — by renaming it to `meta.json.corrupt` with a warning, so it stops masquerading as "no record" and a subsequent `isWorktreeClaimed()` scan sees real absence for that entry instead of failing closed on it forever. A transient read error (EACCES/EIO/EMFILE) is NOT corruption: the file is intact and simply could not be read that moment, so `loadFromDisk()` returns `null` without renaming it — renaming a valid record away would itself be the fail-open this fix exists to prevent. `isWorktreeClaimed()`'s fail-closed behavior for a record that is genuinely present-but-unreadable at decision time is unchanged — a spurious "unclaimed" would run `git worktree remove --force` over a live teammate's checkout, so the guard stays as strict as before; only a corrupt record's *permanence* is fixed. Source: `apps/cli/src/lib/teams/agents.ts`.
+
+- **Daemon routines can no longer resolve a stale `agents` binary from the Node prefix (RUSH-2431).** The daemon service manifest now puts the directory containing the running `agents` launcher first on `PATH`, ahead of the Node bin directory. This stops scheduled routines from shadowing the current binary with an older `agents` installed inside the same Node prefix. As a runtime backstop for already-running daemons, `command` routines also inject a shell-function guard (and a `PATH` prepend fallback) so bare `agents` invocations use the same binary that launched the routine. `agents doctor` now reports a `binary-shadow` warning when another `agents` binary on `PATH` or in a well-known install directory could preempt the running one. Source: `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/runner.ts`, `apps/cli/src/lib/cli-entry.ts`, `apps/cli/src/lib/binary-shadow.ts`, `apps/cli/src/lib/devices/doctor-findings.ts`, `apps/cli/src/commands/doctor.ts`.
+
+- **`agents computer sessions` / `agents sessions --computer` is task-first, grouped by run (RUSH-2432).** The computer counterpart of `agents browser sessions` (RUSH-2407): every `computer.action` event (already written by every `agents computer <verb>` and the embedded `run --task` loop) is read back from the durable event ledger and grouped by a unique CLI invocation identity — one row per invocation without conflating later OS pid reuse. Each row shows machine, target app/window when known, per-verb action counts, and — when the run's `sessionId`/`launchId` resolves — the owning agent session's canonical digest. A run with an unindexable identity shows unresolved; one with no agent-session identity at all shows unlinked. On a TTY the picker is interactive with search and an action-list drill-down (no artifact to open, unlike browser); `--no-interactive`/`--json` print the flat table. The `agents sessions --computer` alias also preserves `--limit`, `--host`, and `--device`. Nothing sensitive is added to the ledger: typed text stays length-only, and a `--task` description is bounded to 200 characters before it is ever written. Source: `apps/cli/src/lib/computer/sessions-list.ts`, `apps/cli/src/commands/computer-sessions-picker.ts`, `apps/cli/src/commands/computer.ts`.
+
+- **A session no longer vanishes when its transcript file is deleted — the local DB is authoritative for its user turns (RUSH-2436).** Session history was a file-anchored index: delete the `.jsonl` (via `agents remove`'s trash, a manual `rm`, a `.history` version-home rotation, or a box reimage) and the session silently disappeared from every `agents sessions` listing and could not render, even though a DB row and its user-turn text still existed. The user-turn content for every harness is already stored durably in the `session_text` FTS `content` column, so `querySessions`/`topSessionsByCost` now KEEP a file-gone session whose content survives — flagged `archived` — instead of dropping it, `agents sessions <id> --include user` renders those user turns from the DB (with an `archived — transcript file removed` banner) instead of a bare metadata dump, and the picker preview does the same. A row whose file is gone and whose content is empty (a phantom — a stale/moved `file_path`) stays suppressed. Merely listing a file-gone session also no longer PURGES its redacted tool-call evidence: that destructive purge-on-read (`purgeToolCalls` from the `querySessions` missing-file branch) is removed. A row whose file returns (a recoverable-trash restore) is un-archived on the next listing. A new persisted `archived_at` column (schema v38) stamps the first confirmation that a scanned file went missing. Source: `apps/cli/src/lib/session/db.ts`, `apps/cli/src/lib/session/tool-store.ts`, `apps/cli/src/commands/sessions.ts`, `apps/cli/src/commands/sessions-picker.ts`.
+
+- **Optional off-box session backup to Cloudflare R2 (`agents sessions export --to-r2` / `import --from-r2`).** A durable, on-demand backup target for session transcripts — protection against losing the whole box, not just a file on it. `export --to-r2` uploads each selected session as its own encrypted object under `sessions/<machine>/<agent>/<session>` in the `r2.backups` bucket; `import --from-r2` downloads and restores them through the normal placement (deduped, local-always-wins). Bodies are sealed client-side with AES-256-GCM under the shared `R2_SYNC_ENC_KEY` (zero-knowledge — Cloudflare only ever stores ciphertext); credentials come only from the `r2.backups` secrets bundle (keychain, never env/disk). It is a pure backup target: on-demand only, no daemon cycle, and not the retired multi-writer sync. A missing/locked `r2.backups` bundle fails loud with an actionable message, never a silent no-op. Source: `apps/cli/src/lib/session/sync/r2.ts`, `apps/cli/src/commands/sessions-export.ts`, `apps/cli/src/commands/sessions-import.ts`.
+
+- **`agents sync` now prunes resources removed from source, instead of only ever adding (RUSH-2438).** A command or skill deleted from a DotAgent repo used to linger in every installed version home forever — observed: 8 removed commands stayed live in the `/` menu of all 7 Claude homes, and `--force` did not clear them. The gap was that the repo-scope reconcile forms (`agents sync <agent>@all system`, `agents sync <agent> system --force`) pass a selection, which turned off the full-sync orphan sweeps; those forms now reconcile deletions too. The prune is **manifest-bounded** so it never over-deletes: the removal set is `(names the last full sync recorded) − (names still present in source across ALL layers)`, intersected with what is actually in the home. Three guarantees follow — a file you hand-authored into `~/.claude/…` was never recorded so is never touched; a system command removed while a same-named **user** command still exists is kept (still provided by a layer); and with no sync manifest yet the reconcile prints a one-line notice and prunes **nothing** rather than guessing. Every harness prunes through the same writer that installed the resource — a native command file (Claude/Grok/Cursor), a command-as-skill dir (Codex ≥ 0.117, Kimi), a Goose recipe. Removals are shown under a `Pruned from <agent>@<version>` block and carried in the `--json` payload as `pruned: { commands, skills }`. **Hooks are out of scope here** — pruning a hook must also GC its `settings.json`/`hooks.json` registration, a Windows-portable-path surface; tracked in **RUSH-2456**. Hook files stay reconciled by the existing in-write orphan sweep. Source: `apps/cli/src/lib/staleness/prune.ts`, `apps/cli/src/lib/staleness/writers/{commands,skills}.ts`, `apps/cli/src/lib/versions.ts`, `apps/cli/src/commands/sync.ts`.
+
+- **Stop `agents run` from triggering a broad Keychain scan (RUSH-2440).** Agent-only bundle reads now resolve exact items from bundle metadata instead of enumerating the macOS Keychain, preventing unrelated biometry-protected secrets from raising a Touch ID sheet on every launch. Interactive reads retain the existing enumeration-plus-declared-item union. Source: `apps/cli/src/lib/secrets/bundles.ts`.
+
+- **Restore the stale-ACL'd `hmackey` heal on the hot read path (RUSH-2441).** v1.22.7 moved the once-per-machine no-ACL re-store of `agents-cli.hmackey` onto `readHmacKeyRecord` so every hashed keychain lookup (including the SessionStart `agents devices list` stats probe) converged a biometry-ACL'd key to silent. v1.22.10 (`bf79dc885` / #1995) put the heal back inside `maybeAutoRekey`, which is bypassed for the hmackey and hashed-name lookups themselves (`prepareServiceName` returns early for `HMAC_KEY_ITEM`), so an already-migrated machine prompted forever again — and the 1.22.7 changelog still claimed the read-path guarantee. The heal is back on `readHmacKeyRecord`: first hashed lookup re-stores no-ACL once (guarded by `healedNoAcl`), silent forever after. Source: `apps/cli/src/lib/secrets/index.ts`.
+
+- **`scripts/install.sh` restarts a running routines daemon after a dev install (RUSH-2442).** The dev install strips the npm `postinstall` hook (so it doesn't nudge PATH for a side-by-side prefix), which was also the only place that bounced the daemon onto the just-staged code. A long-lived daemon kept hosting a secrets broker built from the previous install; version skew then wiped held bundles and re-armed Touch ID on the next secrets read. After linking bins, `install.sh` now reloads a *running* daemon onto the just-linked binary (best-effort, skipped in CI / `AGENTS_NO_HEAL=1`, never starts a daemon that wasn't already up). Source: `apps/cli/scripts/install.sh`.
+
+- **`agents share` gains `--unlisted`/`--private`, a 30-day default expiry, and a pre-publish sensitive-content scan (RUSH-2443).** Root cause of the RUSH-2428 incident: every publish was world-readable with no private option, no default expiry, and no content gate. Unflagged publishes now expire in 30 days (`--expire never` for permanent). `--unlisted` (alias `--private`) stores `visibility=unlisted` so the public gallery and `agents share list` omit the page while the direct URL still works (capability URL — unlisted, not secret). Before upload the CLI refuses files that contain email addresses or credential-shaped strings (`ghp_…`, `sk-…`, `AKIA…`, `Bearer …`) unless `--force`. Requires `agents share update` on already-provisioned endpoints so the Worker filters unlisted objects. Source: `apps/cli/src/lib/share/{publish,worker-template}.ts`, `apps/cli/src/commands/share.ts`.
+
+- **`agents share list` shows what you've published (RUSH-2444).** There was no way to ask the CLI which pages are live under your share namespace — during the RUSH-2428 incident the only way to answer "is anything else of mine public?" was to fetch the gallery HTML and grep it. The Worker now exposes a machine-readable listing at `GET /<user>?format=json` (a `?format=json` discriminator on the existing single-segment gallery path, gated on the SAME "does `<user>/` hold objects" check the gallery uses — so the HTML gallery is untouched AND a legacy flat slug with `?format=json` still serves its real page rather than a fake empty listing), and `agents share list` reads it: a human table newest-first by default, or the raw listing with `--json` (each object carries `slug`, `url`, `size`, `contentType`, `publishedAt`, and `expiresAt`). It lists the ACTIVE pages only — expired links and the sibling `<slug>.png` OG covers are omitted, mirroring the public gallery. An empty namespace 404s at the Worker, which `list` reads as "nothing published" (via the template-hash signal) and reports cleanly. Because this adds a route to `worker-template.ts`, the feature only reaches an endpoint after `agents share update` (RUSH-2449) deploys the current template; an endpoint that predates the route makes `list` fail loud with a "run `agents share update`" hint (reusing the `agents share status` template-hash signal, and detecting a live 404 on an unknown-template endpoint / a non-JSON gallery body) rather than returning a wrong or empty result. Source: `apps/cli/src/lib/share/worker-template.ts`, `apps/cli/src/commands/share.ts`.
+
+- **`agents fleet update` now verifies each box actually runs the new version, instead of trusting `exit 0` (RUSH-2446).** The rollout ran `agents upgrade --yes` per device and called a box `ok` on the exit code alone. That exit code only says the npm global moved — it says nothing about which copy `agents` resolves to on that box, and on any dev box `scripts/install.sh` puts a side-by-side build at `~/.local/agents-cli-dev` with `~/.local/bin/agents` pointing at it, earlier on PATH than the npm global. So the rollout reported a clean sweep while those boxes kept running old code, and nothing in the fleet surfaces answered "which boxes actually run the shipped version?" — `agents fleet status` reports version skew as a separate glance, and the local multi-install banner is advisory stderr on the box itself that never crosses the SSH hop. After each successful upgrade the rollout now asks the box what `agents` resolves to (symlinks followed) and what version that copy reports. A box on the target reads `ok  runs <version>`; a box whose resolved `agents` is a dev build reads `stale  NOT upgraded — agents resolves to a dev build (0.0.0-dev.<sha>) at <path>, shadowing the upgraded <version> global`; a box on some other released version reads `stale` with both versions and its resolved path. Those boxes are counted in a new `N not upgraded` tally, excluded from the `ok` count, and make the command exit non-zero. A box whose probe cannot answer — no POSIX shell, or `agents` unresolvable — reads `unverified` and is likewise not counted as a success, because "we could not check" and "it is upgraded" are different answers. A `failed` or `skipped` box is not re-probed, so one fault still produces one row. With no explicit version argument the target is derived as the highest released version any probed box reports; dev stamps are never elected as the target, so a fleet of dev builds cannot declare itself upgraded. Source: `apps/cli/src/lib/devices/rollout-verify.ts`, `apps/cli/src/commands/ssh.ts`, `apps/cli/src/lib/startup/dev-build.ts`.
+
+- **`agents share update` — push a `worker-template.ts` change out to an already-provisioned
+  endpoint (RUSH-2449).** `agents share setup` only ever wrote the Worker script during first
+  provisioning, so every endpoint was pinned to whatever template it got on day one — there was
+  no way to ship a Worker-side fix or feature (private publishing, `share list`, access logging)
+  to someone who already ran setup. `agents share update` re-deploys the current template to the
+  existing account/worker/bucket with no re-provisioning (no bucket creation, no route/domain
+  changes) and never regenerates `WRITE_TOKEN`: Cloudflare's script-upload endpoint replaces a
+  Worker's bindings/secrets wholesale on every upload, so the existing token is re-applied via the
+  Secrets API immediately after the script upload. Idempotent — re-running it when the deployed
+  template already matches is a no-op (`--force` to redeploy anyway). `ShareConfig` now records a
+  `templateHash`, and `agents share status` reports `current` / `outdated` / `unknown` (a config
+  from before this field existed reads as `unknown`, never as stale). `agents setup share`, run
+  against an already-configured endpoint, now offers "update the deployed Worker" alongside
+  "keep" and "reconfigure from scratch". Source: `apps/cli/src/lib/share/provision.ts`
+  (`hashWorkerScript`, `updateWorker`), `apps/cli/src/commands/share.ts` (`runShareUpdate`,
+  `shareTemplateStatus`), `apps/cli/src/commands/setup-share.ts`.
+
+- **`teams disband` is terminal — PENDING teammates cannot resurrect or re-start (RUSH-2450).** Disband deleted log dirs and the registry entry but left the in-memory `AgentManager` cache intact; a concurrent `teams start --watch` supervisor then re-persisted those records via `saveMeta`, so a second disband still found N logs to clear and `teams start` could re-launch already-merged work. Disband now drops the registry entry first (writing a durable disband tombstone), then purges every teammate record from disk **and** the manager cache (`AgentManager.purgeByTask`). `saveMeta` refuses to re-persist a teammate whose team carries a disband tombstone. A second disband is a clean no-op; `teams start` on a disbanded name fails loud. Source: `apps/cli/src/lib/teams/agents.ts`, `apps/cli/src/lib/teams/registry.ts`, `apps/cli/src/commands/teams.ts`.
+
+- **Usage and authentication refresh now have one device-level owner (RUSH-2451).** The daemon maintains shared per-account usage snapshots and auth-health metadata; `agents run`, `view`, `versions`, teams, device inventory, and Factory remain cache-only readers. `agents usage <agent> --refresh` and other explicit refresh paths enter the same cross-process lease, so simultaneous CLI processes reuse one provider request or local-log scan. BYOK budget reads use the same persisted, atomic cache model. OAuth stays harness-managed and per-device; only safe health/account metadata is shared, while named API keys, setup tokens, and bearer tokens continue to use device-local credential storage. Source: `apps/cli/src/lib/account-state-service.ts`, `apps/cli/src/lib/refresh-coordinator.ts`, `apps/cli/src/lib/usage.ts`, `apps/cli/src/lib/byok-usage.ts`, `apps/cli/src/lib/auth-health.ts`, `apps/cli/src/lib/fleet-status.ts`, `apps/cli/src/commands/usage.ts`.
+
+- **`agents share update` names the partial-failure window when the write token fails to re-apply (RUSH-2453).** Cloudflare's script upload clears Worker secrets; `update` re-applies `WRITE_TOKEN` immediately after. If that second call fails (network blip, expired API token, rate limit), the live endpoint has no write token and every publish/delete 401s. The error now says so and tells you to re-run `agents share update`. Config is only rewritten after both steps succeed, so a re-run does not short-circuit on a matching hash — a test pins that self-heal property. Source: `apps/cli/src/lib/share/provision.ts`, `apps/cli/src/commands/share.ts`.
+
+- **`agents --help` / `--version` no longer load the migration graph (RUSH-2454).** Follow-up from RUSH-2346: the menu-bar self-heal was already gated, but `foldLegacySystemRepo()` and the v19 `runMigration()` hop still ran on pure documentation paths and dynamically imported `lib/migrate.js` — whose static imports pull the hosts/routine/teams/daemon/menubar graph (~287 modules). Both hops now share the same `helpOrVersionRequested` gate. The always-on fold itself moved to a leaf `lib/migrate-fold.ts` (fs + `createLink` only), and the full `migrate.js` import is deferred until a missing/stale v19 sentinel actually requires `runMigration()`. Source: `apps/cli/src/index.ts`, `apps/cli/src/lib/migrate-fold.ts`, `apps/cli/src/lib/migrate.ts`.
+
+- **Grok's binary resolver could silently launch a different agent's binary (RUSH-2459).** When no `grok-*` filename in a version-home's `.grok/downloads` carried the pinned version string — which happens routinely, since grok self-updates its binary in place — the dispatcher shim, the direct `grok@<version>` alias, and `getBinaryPath` all fell back to whatever a plain directory listing returned first, with no validation that the candidate was actually a grok binary. On one machine a stale, unrelated 99-byte wrapper script (`exec cursor-agent "$@"`) sorted before the real ~127MB self-updated binary and was launched instead, so `agents run grok` and Factory's "New Grok" silently ran Cursor. A second, compounding bug made the shim's "exact version match" a no-op for the versioned home: it grepped `ls`'s full path output, and the version-home's own path always contains the version string, so it matched every candidate unconditionally. Both are fixed: the exact-match check now scopes to each candidate's filename, and when no filename genuinely carries the version, the fallback rejects any candidate under 1MB (real grok binaries are ~100MB+) and prefers the most recently modified survivor — never guessing among untrusted artifacts. Source: `apps/cli/src/lib/versions.ts`, `apps/cli/src/lib/shims.ts`.
+
+- **`agents add warp` installs the new Warp Agent CLI (curl installer), not the removed `oz` brew cask (RUSH-2461).** `agents add warp@latest` failed with `Error: Cask 'oz' is unavailable: No Cask with this name exists.` — the registry modeled Warp's older `oz` platform runner via `brew install --cask oz`, a cask that only lives in the `warpdotdev/warp` tap, not homebrew-core. The `warp` entry now points at Warp's current standalone agent CLI (docs.warp.dev/cli): install via the official cross-platform `curl -fsSL https://app.warp.dev/download/agent-cli | bash`, binary `warp` at `~/.local/bin/warp` (self-updating, like droid/muse). It is an interactive TUI — bare `warp` opens the agent and there is no headless one-shot form (the documented flags are `--api-key`/`--auto-approve`/`--resume <token>`/`--version`, with no `-p`/`--model`/JSON output), so `agents run warp` launches the TUI and the exec spec drops the stale `oz agent run -p --output-format json` mapping. The oz→warp binary rename is propagated across version detection (`findInPath('warp')`), the runtime + generated shims, the reserved-brand list, and the sign-in hint (bare `warp` opens browser sign-in, or set `WARP_API_KEY`). Source: `apps/cli/src/lib/agents.ts`, `apps/cli/src/lib/exec.ts`, `apps/cli/src/lib/versions.ts`, `apps/cli/src/lib/shims.ts`, `apps/cli/src/lib/agent-cli-commands.ts`, `apps/cli/src/lib/signin-badge.ts`.
+
+- **The 8 daemon-housekeeping routines are now daemon-owned built-ins instead of `.agents-system` config-repo files (RUSH-2465).** `usage-refresh`, `fleet-cache-warm`, `session-cache-warm`, `device-probe`, `auto-dispatch`, `watchdog`, `tmux-reconcile`, and `launch-health` were shipped as `routines/*.yml` in `gh:phnx-labs/.agents-system` (RUSH-2353, to gain declaration, run history, pause, and device pin over the old hardcoded `setInterval`s). A daemon's own housekeeping does not belong in the config repo every install pulls, so the definitions now live in daemon code (`lib/builtin-routines.ts`) and are injected as the **lowest** layer of `listJobs()` — below project > user > system. The same pid-claimed `JobScheduler` schedules and fires them via `agents __daemon-tick <name>` (`lib/daemon-ticks.ts`) exactly as before, so scheduling, run-tracking, pausability (`agents routines pause <name>`), and device pinning (`agents routines devices <name> --set`) are unchanged — the singularity guarantees (auto-dispatch's owner-pin, the cache-warms' publish-own/read-union, usage-refresh's per-account cadence/backoff) are preserved because they were never properties of the definition file. Because built-ins are the lowest layer, a same-named `~/.agents/routines/` file still overrides one, and a still-shipped `.agents-system` YAML shadows it during the removal transition (so exactly one definition ever fires). `agents routines list` tags each with `(built-in)` and the `--json` output carries `builtin: true`. `.agents-system` keeps only `check-updates.yml`; its removal PR (`phnx-labs/.agents-system#272`) merges only **after** this ships, or fleet/session/usage caches, the watchdog, and auto-dispatch would stop fleet-wide. Source: `apps/cli/src/lib/builtin-routines.ts`, `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/daemon.ts`, `apps/cli/src/lib/daemon-ticks.ts`, `apps/cli/src/commands/routines.ts`.
+
+- **Use one secret bundle as an account across compatible agents.** `agents accounts` now keeps provider, authentication type, optional URL, stable identity, and API key or long-term setup token in the account's own `agents secrets` bundle. Account bundles are permanently prompt-free (`policy: never`), can be selected explicitly or as a per-harness default, and can be explicitly synced to a worker with `agents accounts sync <name> --device <device>`. Harness-native auth remains owned by each harness and is never copied. Existing v2 `accounts.yaml` entries migrate transactionally into bundles and retain their stable IDs. Source: RUSH-2470.
+
+- **`scripts/release.sh` takes `--device <name>` to pick the release Mac, instead of a hardcoded `mac-mini`.** The build/sign/notarize/npm-publish phase still needs a Mac (codesign/notarytool + the signed binaries in the tarball), but which Mac is no longer welded into the script: it defaults to `mac-mini` and `--device zion` (alias `--host`) routes the privileged phase to any capable Mac at the same tagged commit — so a release is no longer stuck when mac-mini is offline. The git/PR/merge/tag orchestration still runs on whatever box invoked it, and the origin-side lease still guarantees a single releaser. `scripts/remote-sign-mac.sh` gained the same flag. Source: `apps/cli/scripts/release.sh`, `apps/cli/scripts/remote-sign-mac.sh`, `apps/cli/scripts/release.test.ts`.
+
+- **`agents sessions --active --device <box>` lists only sessions actually running on that box, and an offloaded session previews again (RUSH-2479).** A run dispatched with `agents run --device <peer>` leaves a live shim process on the *dispatching* machine carrying the remote run's session id, and nothing attributed that row to the peer — so `--device zion` listed sessions executing on `yosemite-s0`, tagged `[host/yosemite-s0]`, and every one of them rendered an empty preview ("Live session — full transcript not indexed here") because the transcript lives on the peer. Three things changed. `machine` is now the **execution** host: `foldExecutionMachine` folds the machine the dispatch already recorded in the session index back onto the live row before it leaves the box, and the cross-machine fan-out no longer overwrites a peer-reported machine that names a third box. A host scope is then enforced on that field — `--host`/`--device` means *where the session runs*, not which box answered — applied inside the single gather so the interactive browser and `--active --json` cannot disagree. And because the dispatcher's shim and the executing machine's own row now share a dedupe key, the merged fleet view keeps the row that owns the transcript instead of the `[host/<peer>]` placeholder. A peer's own self-report still outranks this box's index copy, so a genuinely remote row is never re-tagged. New field `offloadedFrom` on `ActiveSession` / `--active --json` marks the dispatcher's shim row. Contract: `docs/specifications.md` SES-23a; narrows SES-GAP-5. Source: `apps/cli/src/lib/session/active.ts`, `apps/cli/src/lib/session/remote-active.ts`, `apps/cli/src/commands/sessions.ts`.
+
+- **Monitors record a per-poll liveness heartbeat, so a watcher that never fires is no longer indistinguishable from one that never ran (RUSH-2485).** Change-detection state (`lastValue`/`lastFiredAt`) was written only when a monitor fired or set a baseline, so a `--match` monitor that polled steadily but never matched left `state.json` empty — and `agents monitors view <name>` showed `state: null`, exactly what a monitor the engine never touched looks like. A monitor added as the durable lander for a PR read healthy (enabled, daemon active, `test` evaluating on demand) while doing nothing for ~40 minutes. The engine now writes a liveness record on **every** poll — `lastCheckedAt`, `checkCount`, `lastError`, `consecutiveErrors` — kept in its own `liveness.json` so it never perturbs the baseline logic. `agents monitors list` and `view` surface it: `never polled` (yellow), `checked Nx · no match yet`, `STALLED — last poll <ago>` (red, when an enabled+owned monitor's last poll falls >3 intervals behind), and per-poll errors. `--json` on both gains `lastCheckedAt`, `checkCount`, `lastError`, `consecutiveErrors`, and `stalled`. `agents monitors add` now asserts the postcondition — it waits for the engine's first poll and reports whether the monitor was actually picked up, instead of reporting success on config acceptance. And after 5 consecutive failed checks (a source that errors every poll, or an action that fails every fire), the engine notifies the owner once that the monitor is doing nothing. Source: `apps/cli/src/lib/monitors/state.ts`, `apps/cli/src/lib/monitors/engine.ts`, `apps/cli/src/commands/monitors.ts`.
+
+- **`agents sessions` attributes offloaded work to the box it runs on, consistently.** Resuming a live host-dispatched run by id (`agents sessions <id>` for an `agents run --device <peer>` session) no longer fails with "ambiguous (2 sessions)": `queryIndexedSessions` kept the machine derived from the transcript path for every row, and an empty file path (a remote transcript) fell back to *this* box — re-attributing the dispatcher's own pool row to itself so it no longer deduped against the executing peer's fan-out row. It now keeps the execution host the dispatch recorded on that row. And a remote teams teammate (`agents teams add … --device <peer>`) is now attributed to its execution host too: `listTeamsActive` folds the teammate's `hostName` into `machine`/`offloadedFrom` the same way `agents run --device` rows are folded, so `agents sessions --active --device <orchestrator>` no longer lists a teammate that is executing on a peer (RUSH-2486, closing SES-GAP-10; the residual of RUSH-2479). Source: `apps/cli/src/lib/session/discover.ts`, `apps/cli/src/lib/session/active.ts`.
+
+- **A project is now a set of directories, and every spawn path reaches all of them (RUSH-2489).**
+  `ProjectDef.repos[]` could already name additional checkouts, but nothing wrote it and nothing
+  that started an agent read it: `agents run --project rush` landed in `defaultPath ?? root` and
+  every other repo the project bound was invisible to the agent. Work spanning a CLI, its website,
+  and the DotAgents repo it ships into needed three agents or a hand-passed `--add-dir`.
+
+  **Writing.** `agents projects add` gains a repeatable `--dir <path...>`; `agents projects set`
+  gains repeatable `--add-dir <path>` / `--rm-dir <path>` plus `--slug <owner/repo>`. Each value
+  names a **local directory** and the slug is read from **that directory's own `origin` remote**,
+  never inferred from its path — a checkout at `~/src/github.com/muqsitnawaz/agents-cli` whose
+  origin is `phnx-labs/agents-cli` records what it actually pushes to. `--slug` covers a directory
+  with no origin and applies to a single `--add-dir`. Removals apply before additions, so
+  `--rm-dir old --add-dir new` re-points a directory in one command. Binding a directory twice,
+  unbinding one that is not bound, and naming a path that does not exist are all refused with the
+  fix named.
+
+  **Spawning.** `agents run --project` keeps returning the primary directory as cwd — unchanged —
+  and merges the project's other directories into `--add-dir`, deduped against anything passed
+  explicitly, locally and over `--host` (forwarded `~/…`, which the receiving `agents run` expands
+  against the host's own `$HOME`).
+  `agents teams create` gains `--project <slug>`: it is validated at create time rather than at the
+  first `teams add`, the project's primary directory becomes a local teammate's base cwd, and the
+  sibling directories are attached as grants. The teammate record stores the project **name**, not
+  a frozen list of directories, and the grants resolve per launch — an unpinned teammate on a
+  `--devices` pool only learns its host from the scheduler at launch time, so add-time resolution
+  would have handed it this box's absolute paths (and already dropped any directory that exists
+  only on the host it landed on). The team cwd precedence is now
+  `worktree → --cwd → project directory → process.cwd()`, so an explicit `--cwd` still wins; the
+  grants are attached either way, since the siblings are what the project binds rather than where
+  the teammate sits. A `--project slug@worktree` run keeps the worktree as cwd and grants the main
+  checkout alongside the siblings. A teammate staged behind `--after` resolves its grants when the
+  supervisor finally launches it, so a restart in between changes nothing.
+
+  **Two honest limits, stated rather than papered over.** Only Claude and Codex consume
+  `--add-dir` (Claude takes the native flag, Codex folds the paths into `workspace_roots`); every
+  other harness ignores the grants and sees the cwd alone. And a bound directory that is absent
+  from the current box is skipped for a local spawn rather than erroring — but is **kept** for a
+  `--host` run, because the target machine has its own checkouts and this box's filesystem must not
+  decide what exists there.
+
+  **`--add-dir` values are now `~`-expanded at the consumer** (`buildExecCommand`, for both the
+  Claude flag and Codex's `workspace_roots`). Nothing was doing it: a forwarded grant crosses the
+  SSH boundary single-quoted, so the remote login shell left `~/…` literal and the harness resolved
+  it as a directory actually named `~` — a silent no-op. This also fixes the pre-existing case of a
+  user typing `--add-dir '~/x'` on a `--host` run.
+
+  The `repos[]` walk is now one function shared by the spawn path and the fleet workspace probe
+  (`projects status`), which previously had its own copy. The probe keeps its own primary (`root`,
+  not `defaultPath`, so a monorepo subproject still probes its checkout) and keeps missing
+  directories so it can still report `✗ missing`. Also corrects the `agents projects` help note,
+  which still told users to sync definitions with the long-removed `agents push/pull` instead of
+  `agents repo push user`. Source: `apps/cli/src/lib/projects.ts` (`projectDirsAbs`,
+  `projectProbeTargets`), `apps/cli/src/lib/project-root.ts` (`resolveProjectDirs`),
+  `apps/cli/src/commands/projects.ts` (`projectRepoFromDir`), `apps/cli/src/commands/exec.ts`,
+  `apps/cli/src/commands/teams.ts`, `apps/cli/src/lib/teams/{registry,agents,api}.ts`,
+  `apps/cli/docs/projects.md`.
+
+- **`agents daemon status` now reports a daemon running code that has been deleted (RUSH-2493).** A daemon keeps running from memory after its entry file is removed — so it answers every probe, `systemctl --user is-active` reads `active`, and the status command reported healthy, while the process cannot restart and is executing whatever was loaded before the delete. Observed on a dev box: a daemon ran 4h14m from a worktree that had been deleted, silently holding a second routine scheduler (the double-fire class the one-scheduler-one-executor rule exists to prevent), and nothing anywhere named it. `status` now carries a `Stale code` section listing each such pid with its missing entry, marks the `Binary:` line `(MISSING from disk)` when it is this device's own daemon, and `daemon doctor` raises it as a problem with the right remediation — `agents daemon restart` for your own, `kill <pid>` for a stray this install owns. `--json` gains `binaryMissing` and `staleBinaries`, each stale row carrying `actionable` so a machine caller can tell a ghost it may act on from one that is merely visible.
+
+  **Detection and accusation are scoped separately.** Anything actionable — a `doctor` problem, a non-zero exit, a `kill` instruction — is limited to this device's daemon plus this install's instance registry, the scope RUSH-2368 established after a leaked test fixture was reported as a stray to `kill`. Merely *showing* a stale daemon extends to any process running as the same uid, because the incident that motivated this was neither the tracked pid nor registered: it ran from an ephemeral `/tmp` cwd, which `lib/daemon.ts` documents as invisible to the registry by design, so registry-gating the display would have left the command silent on the exact case it exists for. A different uid is never named at all — its entry cannot be reliably stat'd and could not be signalled anyway.
+
+  Three further limits keep it from accusing a healthy daemon: it reports only a **provable `ENOENT`** (`statSync` with `throwIfNoEntry`, since `existsSync` also returns false on a permission error — a root-owned daemon under an unreadable parent would otherwise be named); it considers **absolute entry paths only**, so `node -e '<code>' __daemon-run` is never mistaken for deleted code; and that last guard also exempts entry paths containing spaces, which `ps` renders unquoted — a healthy daemon on such a path is never accused, at the cost of not detecting a genuinely deleted one. Source: `apps/cli/src/commands/daemon.ts`, `apps/cli/src/commands/daemon.test.ts`.
+
+- **Fixed a Windows-only CI failure in the binary-shadow test.** `detectAgentsBinaryShadows`
+  was already comparing files by identity, but its test still compared two path
+  spellings through `fs.realpathSync`. On Windows `realpathSync` does not expand an
+  8.3 short name, so a `where`-resolved path and one built from `os.tmpdir()` compare
+  unequal even when they name the same file — which is why every PR touching
+  `apps/cli` saw `windows` fail on a GitHub runner (`C:\Users\RUNNER~1\...` vs
+  `C:\Users\runneradmin\...`). The test now identifies the file by basename plus
+  contents, which is spelling-independent and asserts the stronger property.
+
+- **The auto-detected browser `default` profile no longer churns the fleet-shared
+  `agents.yaml`.** `ensureDefaultBrowserProfile` regenerates that profile on every
+  `agents browser start` without `--profile`, writing an absolute `binary:` path
+  and a port chosen by probing the local machine. Because it lived in the synced
+  file, a macOS box wrote `/Applications/Google Chrome.app/...`, a Linux box found
+  that unlaunchable and rewrote `/usr/bin/chromium-browser`, and the two flipped
+  the tracked file back and forth forever — the single largest source of churn on
+  it. The auto `default` now lives in that box's own
+  `~/.agents/devices/<machine>/agents.yaml`, which is gitignored. **User-created
+  named profiles stay central and still sync**; reads merge both maps, with the
+  machine-local copy winning a name collision (it was written by this box, for
+  this box). Source: `apps/cli/src/lib/browser/profiles.ts`,
+  `apps/cli/src/lib/state.ts`.
+- **`projectRoot` is machine-local too.** `ensureProjectRoot` infers it from
+  whatever directory the CLI happened to run in, so it is machine state rather
+  than fleet policy; it was being cached into the file every machine syncs.
+  Source: `apps/cli/src/lib/state.ts`.
+- **Browser profile writes no longer clobber a concurrent write.**
+  `createProfile` / `updateProfile` / `deleteProfile` did an unlocked `readMeta()`,
+  mutated, then `writeMeta(meta)` — persisting a snapshot taken before the lock, so
+  a newer write from another process was silently lost. They now go through
+  `updateMeta`, which re-reads under the lock.
+  Source: `apps/cli/src/lib/browser/profiles.ts`.
+
+- **A config read no longer rewrites the fleet-shared `agents.yaml`.** The legacy
+  device-config fold hung off `getConfigValue` / `setConfigValue` /
+  `unsetConfigValue`, so an ordinary `agents config get` could rewrite
+  `~/.agents/agents.yaml` — a file every machine in the fleet tracks and syncs.
+  With 13 machines each dirtying one shared path on nearly every command, boxes
+  stopped being able to pull at all (`yosemite-s0` sat 4 commits behind, unable to
+  fast-forward past its own local rewrite). The fold now runs only from a
+  lifecycle entry point (daemon boot, `runMigration`), never from a read or write.
+  Source: `apps/cli/src/lib/device-config.ts`.
+- **The device-config migration is additive instead of destructive.** It used to
+  `fs.rmSync` the per-device `devices/<host>/agents.yaml` and `fs.rmdirSync` its
+  directory after folding. Deleting the source mid-rollout meant a box still on the
+  previous CLI lost the config it was still reading, and a box that re-created the
+  doc got stripped again on its next command. The fold now leaves every legacy
+  store in place; the redundant copy is pruned later by one explicit operator
+  command rather than by each machine independently.
+  Source: `apps/cli/src/lib/devices/config-migration.ts`.
+- **`agents devices capture` no longer erases a peer's config.** `captureFleet`
+  rebuilt `fleet.devices` from the captured roster alone, so a device the capturing
+  box had not seen was dropped along with its `config:` block — observed for real,
+  a capture on `yosemite-s0` deleted `zion`'s entire config from the shared file. A
+  dropped device now carries its `config:` forward; the roster fields still reflect
+  live state.
+  Source: `apps/cli/src/lib/fleet/capture.ts`.
+- **Clearing the last model-tier override no longer leaves `model: {tiers: {}}`.**
+  The emptied container was written back to the shared `agents.yaml`, showing up as
+  a spurious local change on whichever box ran the command. It now drops the key,
+  matching how an emptied `hosts:` is already handled.
+  Source: `apps/cli/src/lib/model-tier-overrides.ts`.
+
+- **The agents daemon starts at install/upgrade and on first `agents setup` / `setup --force`, not only after `routines add`.** `scripts/postinstall.js` `healLongRunningProcesses` calls `startDaemon` on darwin and linux when `daemon.enabled` is not false (bounce when already running so upgrades load the new binary; cold start writes the LaunchAgent/systemd unit so KeepAlive/Restart=always apply). If the daemon was running under `daemon.enabled=false`, postinstall stops it and leaves it down. First-run / `--force` `agents setup` calls `startDaemon()` after the system repo is ready (hub re-entry without `--force` does not). The CLI hot path is unchanged — no per-invoke ensure. Companion: [phnx-labs/.agents-system#291](https://github.com/phnx-labs/.agents-system/pull/291) (`check-updates` daily + `agents repo sync system` + `agents sync --local -y` when HEAD moved). Source: `apps/cli/scripts/postinstall.js`, `apps/cli/src/commands/setup.ts`.
+
+- **A dev build no longer takes over the installed `agents` command.** `scripts/install.sh` published its side-by-side build into `~/.local/bin` under the production names `agents`, `ag`, and `browser`, so which code ran was decided by PATH order rather than by what you typed — and once the dev prefix was cleaned, those links dangled and the production command failed with `no such file or directory`. The dev build is now exposed as **`agents-dev`** (and `ag-dev`); the script never creates or overwrites `agents`, `ag`, or `browser`, and on each run it removes any such shadow link an earlier revision of itself left pointing into the dev prefix — including a dangling one, which `[[ -e ]]` cannot see. `browser` leaves the dev link set entirely: `agents-dev browser …` reaches the same code. The restart of the **shared** routines daemon (secrets broker, browser IPC, scheduler) is now opt-in behind `--bounce-daemon` instead of automatic, because pinning that daemon to a working-tree build changes what the everyday `agents` talks to while `agents` itself still looks untouched. The PATH-precedence warning is gone — a distinct name makes ordering irrelevant. Root `AGENTS.md` now states the rule for agents working in this repo: never `npm i -g` from the working tree, and never claim the production bin names. This supersedes the dev-build shadow described in the RUSH-2446 entry above — that rollout probe stays as the general backstop for any other install that takes the `agents` name. If removing the shadow leaves `agents` unresolvable (npm skipped its own `~/.local/bin` link because the shadow already answered the probe), the install says so and prints the one command that restores it, instead of claiming `agents` is untouched. Source: `apps/cli/scripts/install.sh`, `apps/cli/scripts/install.test.ts`, `AGENTS.md`, `apps/cli/AGENTS.md`.
+
+- **`agents devices config <name> [key] [value]` is the one settings surface for a device.** Bare opens an interactive settings menu on a TTY (and prints the resolved config when piped or given `--json`); `key` reads a value back, `key value` sets it with validation (booleans take on/off/true/false), `key --unset` restores the default, and `notes <text>` appends an operator note. Device-scope settings — the existing `agents.max-concurrent` / `scheduler.enabled` / `daemon.enabled` / `watchdog.enabled` / `browser.remote-control` / `browser.profile` / `notes`, plus new `ssh.user`, `ssh.auth`, `ssh.bundle`, `ssh.bundle-key`, `ssh.identity-file`, `platform`, `auto-launch.enabled`, and `auto-launch.preferred` keys — now live centrally in `~/.agents/agents.yaml` under `fleet.devices.<name>.config` (synced and backed up with the repo; a `fleet.devices: all` declaration upgrades to an explicit roster map on the first write). The `ssh.*` / `platform` / user values overlay the registry's discovery record at dial time, so `agents ssh`, the ssh_config render, host dispatch, and `devices list` all honor them. The retired subcommands (`configure`, `note`, `set`, `set-interactive`, `enable`/`disable`/`prefer`/`unprefer`) keep working as hidden tombstones that print a deprecation notice on stderr and forward into `devices config`. Existing per-device config (`devices/<name>/agents.yaml` config, `defaultBrowserProfile`) and `.history/devices/auto-launch.json` fold into the central block via a one-time migration (first config read/write, daemon boot, or `runMigration`); device docs keep their agent pins. Source: `apps/cli/src/commands/ssh.ts`, `apps/cli/src/lib/device-config.ts`, `apps/cli/src/lib/devices/resolve-profile.ts`, `apps/cli/src/lib/devices/config-migration.ts`.
+
+- **`agents devices --help` is an intent-based menu instead of a flat 27-command list.** The subcommands are grouped by what the operator is trying to do — Discover & register, Inspect, Configure a device, Factory auto-launch, Fleet operations — via the existing `registerCommandGroups` formatter (the same pattern `browser`, `computer`, and `secrets` already use), and the "Typical workflow" block moves from the bottom of the help (`.addHelpText('after', …)`) into a workflow-first `Examples:` section right under the description via `setHelpSections`. No commands, flags, or behavior change. Source: `apps/cli/src/commands/ssh.ts`, `apps/cli/src/lib/help.test.ts`.
+
+- **The VS Code extension is now AGI EXT; its dashboard is Fleet.** `apps/factory`
+  moved to `apps/ext` — the component is a thin UI wrapper over the CLI, not a
+  factory. The webview tab and navbar read **AGI EXT**, and the agent-status
+  dashboard formerly called "Factory Floor" is now **Fleet**. A dashboard tab
+  restored from a pre-rename build is reclaimed rather than left beside the new
+  one. Marketplace identity is unchanged (publisher `swarmify`, name `swarm-ext`),
+  so installs and the `swarm-ext://` URI keep working. Unrelated systems that share
+  the word keep every identifier, path, and env var they had — Factory.ai/droid
+  (`~/.factory`, `FACTORY_API_KEY`, the `factory` cloud provider), the beta-gated
+  `agents factory` Software Factory command (`FACTORY_FLOOR_URL`,
+  `~/.agents/factory.yml`), and Rush Cloud's own Factory Floor. Their comments and
+  their user-facing labels still name them — `agents teams --task-type` remains a
+  "Factory label" because it configures the Software Factory worker, not this
+  dashboard.
+
+- **`agents feed post --notify` raises a local desktop banner on top of any configured broadcast.**
+  A feed post already forwards outward through `feed.broadcast` sinks (a Linear comment, an
+  owner-channel iMessage), but reaching the local desktop meant hand-declaring a `channel: desktop`
+  sink in `agents.yaml`. `--notify` is the per-post, config-free equivalent — the same
+  `notifyDesktop` banner `agents run --notify` fires — added **on top of** whatever delivery is
+  already configured, never replacing it. It routes through the real `desktop` channel provider like
+  every other `channel:` sink, so it appears in the post's broadcast outcomes and the `--json`
+  payload rather than a side path. Two properties follow: it carries no `minLevel`, so a routine
+  milestone post can raise a local heads-up without an `important`-gated phone sink buzzing the
+  phone; and the banner is local (it reaches whoever is at the machine the post was authored on, a
+  no-op with a stated reason where no notifier exists), so a headless post never mis-fires at the
+  operator's Mac — reaching a phone stays the job of an `important`-level owner/broadcast sink.
+  Source: `apps/cli/src/lib/feed-broadcast.ts` (`withDesktopNotify`), `apps/cli/src/commands/feed.ts`.
+
+- **`agents subagents list` no longer reports every Codex target as `missing` while the `.toml` files are present (#2399).** Codex custom agents are flat TOML (`name` / `description` / `developer_instructions`) under `~/.codex/agents/`, but the registry reader used the markdown YAML-frontmatter parser, which returns null on TOML and dropped every entry from the rich listing. Codex still loaded the files at runtime — only the listing surface was wrong. The Codex target now uses a TOML metadata reader (same escape hatch as Kiro JSON / Goose YAML). Source: `apps/cli/src/lib/subagents-registry.ts`.
+
+- **`agents sessions focus <id>` reaches a session on another device without `--device`.** Focus resolves an id/identity selector across the reachable fleet (the same resolver `resume` and `preview` use), but it then required the resolved session to ALSO appear in its filtered candidate pool — which is scoped by project, time window, and device — so a peer-owned, older, or other-project session was found and then rejected with `Session <id> does not match the selected focus filters` unless you passed `--device <host>` to pull it into the pool. Focus now uses the fleet-resolved session directly (`focusTargetForResolved`), hopping to the owning device via the existing recovery path; the display filters scope the browsable picker, not an exact id lookup. `resume` already resolved fleet-wide and is unchanged. Source: `apps/cli/src/commands/focus.ts`.
+
+# Grok usage bars ignore expired / missing last-seen billing
+
+`agents view grok` reads weekly usage from each machine's local
+`.grok/logs/unified.jsonl` (`network: false`). Two bugs made the bars disagree
+across devices and lie after a weekly reset:
+
+1. A billing line with no `creditUsagePercent` was coerced to **0%**, so a fresh
+   period looked empty instead of unknown.
+2. An **expired** period (e.g. last week's 100%) was still rendered, so one box
+   showed `rate-limited` after the window had already reset.
+
+Expired windows are dropped via the same freshness check used for the Claude
+usage cache; missing percents no longer invent a bar. Live cross-device parity
+still requires a Grok session on that box to write a new billing line — there is
+no network usage probe for Grok yet.
+
+- **`agents inspect --<kind>` now uses the same interactive picker + live preview as `agents skills list`.** The drill-down listings were the last ones printing a bespoke two-line-per-entry dump with a `[source]` tag repeated on every row — 13 of 80 columns spent on one bit of information — and a description truncated mid-`Triggers on:` boilerplate, which is what 15 of the 20 skills in `.system` append to theirs. Rows are now one line (`Name · Size · Description`) showing the description's first sentence, and the preview pane below refreshes as the selection moves, carrying the full text plus per-kind metadata: a hook shows what fires it and whether it is wired (previously the drill-down showed only a size, less than the summary view printed); a skill shows its frontmatter triggers, model and tools; a plugin lists its bundled skills and commands one per line. The piped path keeps its plain table plus each plugin's bundled skills and commands, and the picker only appears on a TTY. `--json` keeps its shape (one `description` value changes, per the next entry). Also fixes the overview's resource preview cutting its own `…(+16)` tail at any terminal width, `1 files`, and the Hooks section leading with `*_test` scaffolding instead of registered hooks. Source: `apps/cli/src/commands/inspect.ts`, `apps/cli/src/commands/resource-view.ts`.
+- **`agents inspect --hooks` no longer shows a line of shell as each hook's description.** All 53 hooks in `.system` rendered `!/usr/bin/env bash` — the "first prose line" fallback is a Markdown heuristic, and on a script it returned the shebang with its `#` stripped. Skipping that line only promoted the next one (`set -euo pipefail`, a Python docstring), so the agent path now reports a hook as having no description at all — matching what the repo path already did — and the column shows the hook's firing events instead, which is the information that view is for. Descriptions read from the first line of non-Markdown resources (an `mcp` `.yaml`, a `.toml`) are unaffected. Source: `apps/cli/src/commands/inspect.ts`.
+- **`agents inspect --hooks` now shows what fires each hook, in the column that was blank.** The Description column for a hook was either code or nothing; it now carries the same event summary the overview prints (`PreToolUse(Bash)`, `SessionStart`), and a hook the manifest does not register shows a blank events cell, with the preview pane spelling out `not registered`. A repo target resolves those events from that repo's own `agents.yaml` rather than whatever is installed centrally. Source: `apps/cli/src/commands/inspect.ts`.
+
+- **`agents inspect <repo> --routines` shows what a DotAgents repo schedules, and whether it actually fires.** `inspect` could drill into eight resource kinds but not routines, so the one kind carrying live operational state was the one you could not inspect — `agents inspect . --routines` errored with `unknown option`. `--routines` lists every routine the repo declares with its schedule, what it runs, the devices whose allowlist enables it, and how it last ran; `--routine <name>` drills into one; and the plain overview gains a `Routines` section beside Hooks/Plugins/MCP. The listing folds in live state deliberately, because the YAML alone is misleading: a routine's own `devices:` pin does **not** enable it — membership in a device's `routines:` allowlist does (`applyDeviceActivation` → `routineEnabledOnThisDevice`) — so a definition-only view reports `git-review → zion` for a routine that has not fired in days. When routines sit on no device's allowlist the section says so outright and names the `agents routines devices <name> --set <device>` fix; `--json` reports `devices` (the YAML pin) beside `enabledDevices` (the live fleet answer), reusing `agents routines list --json` field names where they overlap so one script consumes both. Rows sort broken-first (inert config, then fires-nowhere, then disabled, then failing) because the overview section shows only the first six — with 24 routines the sort *is* the section. Three supporting fixes: a config that fails closed (unparseable YAML, a legacy `device:` key, a non-list `devices:`) is now listed **with the reason** instead of silently vanishing (`readJobFileResult`, extracted from the private `readJobFile`); a corrupt peer device file is collected and reported rather than thrown, so one bad file cannot blank the whole listing (`routineDeviceIndex`, a non-throwing single-pass sibling of `devicesWithRoutineEnabled`); and `ResourceItem.extra` now reaches `--json` for every kind, not just plugins, so the detail view and its own preview pane cannot disagree. The collector reads `*.yml` files only — `routines/` also holds `<name>/home/` sandbox overlay HOMEs, and a flat readdir counted 49 routines where the repo declares 24. A bare `routines/` directory is deliberately **not** a DotAgents marker: shipping example routines is a normal pattern (this repo's own `apps/cli/routines/`), and counting it made `agents inspect apps/cli` resolve a source tree as a repo. Source: `apps/cli/src/commands/inspect.ts`, `apps/cli/src/lib/routines.ts`, `apps/cli/src/lib/routine-activation.ts`.
+
+- **Kimi subagents are written in the format kimi-code actually reads, and gated at 0.29.0.** The
+  integration emitted a `<name>.yaml` + `<name>.system.md` pair plus a managed `_agents-cli.yaml`
+  parent index, targeting the `version: 1` / `agent:` agentspec of the older, separate `kimi-cli`
+  product. `@moonshot-ai/kimi-code` has no loader for that schema — `system_prompt_path` appears
+  nowhere in its bundle — so every synced Kimi subagent was written to disk and never loaded by any
+  session. Kimi now gets one Claude-shaped `<name>.md` (frontmatter `name`/`description` + body),
+  which kimi-code discovers from its brand home's `agents/` dir. Discovery landed in kimi-code
+  0.29.0; 0.28.x and earlier compile their four agent profiles into the bundle with no filesystem
+  loader, so the `subagents` capability is now `>= 0.29.0` and older installs skip with a stated
+  reason instead of writing files nothing reads. Verified against a real kimi 0.29.0:
+  `--agent no-such-agent` reports `Available profiles: plan, agent, coder, explore, code-reviewer`.
+  Source: `apps/cli/src/lib/subagents-registry.ts`, `apps/cli/src/lib/agents.ts`.
+
+  Homes synced before this fix carry stale `<name>.yaml`, `<name>.system.md`, and
+  `_agents-cli.yaml` files in `~/.kimi-code/agents/`. A one-shot migration
+  (`migrateKimiSubagentsToMarkdown`, migration schema `v19`) removes them from every kimi
+  version home on the first run after upgrading —
+  not `agents prune cleanup`, which could never reach the two `.yaml` files because they match
+  no subagent enumerator. Without it the leftover `<name>.system.md` would be listed as a
+  phantom subagent named `<name>.system` and warned about by kimi-code once per session, since
+  it ends in `.md` and carries no frontmatter. A legacy pair is matched by its signature (a
+  `<name>.yaml` with a sibling `<name>.system.md`), so a subagent you named `<x>.system`
+  yourself is left alone.
+
+- **Per-machine config no longer lives in the fleet-shared `agents.yaml`.** Every
+  device-scope config key now declares `visibility`, which asks who READS it.
+  `shared` keys stay in the synced `fleet.devices.<name>.config` because a peer
+  resolves them — the ssh fields and `platform` are needed to dial a box before it
+  is reachable, `agents.max-concurrent` drives teams placement, `auto-launch.*`
+  and `notes` feed fleet views. `machine` keys — `browser.profile`,
+  `browser.remote-control`, `scheduler.enabled`, `daemon.enabled` — move to that
+  box's own `~/.agents/devices/<machine>/agents.yaml`, which is gitignored. That
+  is what stops 13 machines writing one tracked path.
+  Source: `apps/cli/src/lib/device-config.ts`, `apps/cli/src/lib/state.ts`.
+- **`browser.remote-control` was a consent leak.** It gates whether OTHER machines
+  may drive this box's browser, and its own help text promised "device-local,
+  never synced" — but it was stored in the file the fleet syncs, so one box's
+  opt-in propagated to the rest on pull. It is now machine-local, and setting or
+  reading a machine-local key for a peer is refused outright with the
+  `agents ssh <device>` form to use instead.
+  Source: `apps/cli/src/lib/device-config.ts`.
+- **A new config key cannot silently pick the wrong home.** `ConfigKeySpec` is a
+  discriminated union, so omitting `visibility` on a device-scope key is a COMPILE
+  error — the same discipline `META_KEY_SCOPE` already applies to `Meta`. The
+  migration no longer folds machine-local keys at all: they already sit where the
+  new read path looks, and copying a peer's would spread that consent flag
+  fleet-wide. Values an older CLI wrote centrally are still honored until
+  overwritten, so a mixed-version fleet keeps working.
+  Source: `apps/cli/src/lib/config-machine-keys.ts`,
+  `apps/cli/src/lib/devices/config-migration.ts`.
+
+- **Monitor `condition: { mode: every }` no longer fires on an empty observation (RUSH-2488).** `every`
+  previously returned `fire: true` for every tick regardless of the observation, so a poll whose
+  command produced no rows still dispatched the action with an empty `{event}`. It now stays silent on
+  an empty or whitespace-only observation and fires on every tick that carries real output. This gives
+  a poll-driven monitor the "re-fire while the watched set is non-empty" semantics that a
+  silently-failed action dispatch needs to be retried — an action failure leaves the same non-empty
+  observation next tick, so `every` re-fires (bounded by `rateLimit`), where `match`/`on-change` would
+  dedupe and never retry. No shipped monitor used `every`, so there is no behavior change to an existing
+  monitor. Source: `apps/cli/src/lib/monitors/engine.ts`, `apps/cli/src/lib/monitors/engine.test.ts`.
+
+- **`agents monitors add` refuses a monitor that duplicates one you already have.** A monitor's NAME was not its identity: `writeMonitor` overwrites by name and nothing compared arguments, so two watchers polling the same source on the same interval and firing the same action were one trigger fired twice — under different names, with no warning. One real box accumulated `open-pr-watch`, `pr-ci-fail`, three stale `pr2222-*` watchers and an agent-added lander all polling the same PR queue. `add` now refuses a same-name collision (which would silently overwrite) and a same-behavior collision — **checked across the fleet, not just this box**, because the case that actually bites is two agents on two different machines creating a watcher for the same work item with the same arguments, and neither can see the other's monitors dir. The check reuses the cross-machine fan-out `sessions --active` already runs, names the device and monitor it clashed with, and when a peer is unreachable says so explicitly rather than treating "could not ask" as "no duplicate"; `--force` proceeds anyway. Identity is a fingerprint over source + condition + action, deliberately excluding name, description, `enabled`, and placement (`device`/`devices`/`runOn`) — placement is who executes, not what runs, and hashing it would let the same watcher be re-added by varying only the owner. Different arguments still coexist — a watcher for PR #2517 and one for #2600 are two monitors, not a clash; that is the common case. Also documents the split the subsystem already had but never stated: a **durable** monitor is config, an agent's **per-work-item** watcher is running state, and runtime (last-seen value, fires, rate-limit counters) lives under `~/.agents/.history/monitors/`. Source: `apps/cli/src/lib/monitors/fingerprint.ts`, `apps/cli/src/lib/monitors/remote.ts`, `apps/cli/src/commands/monitors.ts`, `apps/cli/docs/10-monitors.md`.
+
+- **`agents sessions focus`/`attach`/`resume`/`preview`, the bare `agents sessions <id>`,
+  `run --resume`, and `sessions --resolve` no longer hard-fail when a fleet device is
+  offline.** Resolving a session id used to abort the moment any registered device was
+  unreachable — even when the session lived on a box that WAS reachable — printing
+  `Could not resolve session while these devices were unavailable`. Now an unreachable
+  peer is a one-line warning: the session resolves against the reachable fleet and
+  attaches, and the command fails only when the id is found on no reachable device
+  (worded so the offline, unchecked peers are named, not blamed). The exit code for
+  that offline-peer resolution failure changes from `2` to `1` (an ordinary not-found
+  failure, no longer a distinct "could not decide" code) across every resolver
+  consumer — `focus.ts`, `attach.ts`, `resume.ts`, `exec.ts`, and all three
+  `resolveSessionMetadataValue` call sites in `sessions.ts`.
+  (RUSH-2492)
+
+- **Dead tmux sessions are now reaped automatically every 5 minutes.** Sessions
+  stay open after their process exits because `remain-on-exit on` is set so the
+  harness can inspect the exit status. Previously they accumulated indefinitely —
+  127 tmux sessions with 48 dead (~38%) observed on a production fleet machine.
+  The daemon now cleans them up on a 5-minute timer (same cadence as the keychain
+  reaper) and immediately on startup to clear the backlog. Safety invariant: only
+  sessions where **all** panes are dead (`pane_dead=1`) are killed; any session
+  with a live pane is never touched. On-demand cleanup is also available:
+  `agents sessions reap [--json] [--socket <path>]`. Source: `apps/cli/src/lib/tmux/session.ts`, `apps/cli/src/lib/daemon.ts`, `apps/cli/src/commands/sessions-reap.ts`.
+
+- **`agents sessions --active` now attributes cursor/grok/kimi/droid sessions.**
+  The ps-scan identity path fell back to `loadHookSessionIndex()`, which scans
+  `terminals/sessions/` — a directory populated only by the `@agents/session-tracker`
+  package, which is not deployed on most fleet machines. The SessionStart hook that
+  IS deployed writes `state/sessions/<pid>.json` instead. The ps-scan path now also
+  tries `readStateSessionRecord(pid)` after the index lookup finds nothing, so
+  non-Claude harnesses that carry no `--session-id` argv can be attributed from the
+  deployed hook's state file. Source: `apps/cli/src/lib/session/active.ts`.
+
+- **`agents routines` is now an interactive browser.** On a terminal, the bare
+  command opens a filterable, grouped picker (reusing the same picker primitive
+  behind `agents sessions`) instead of printing nothing but help. The project /
+  device group headers show as inline dividers, and selecting a routine drills into
+  four blocks — Definition, Next fire, Recent runs, Stats. `agents routines --json`
+  and any non-interactive shell keep the exact `agents routines list` output, so
+  pipes and the menu bar are unaffected. (RUSH-2503)
+
+- **`agents secrets export --host` raises Touch ID at a terminal instead of demanding a prior `agents secrets unlock`.** Pushing a locked keychain-backed bundle to another machine failed with *"Secrets bundle '<name>' is not unlocked in the secrets agent"* even for a human typing the command at a TTY — `resolveBundleForPush` passed `agentOnly: true` unconditionally, while its sibling reads (`view --reveal`, `exec`) already decided this per-invocation with `isHeadlessSecretsContext() || !isInteractiveTerminal()`. The push is strictly less exposed than the `view --reveal` that already prompts: it prints a key count, never a value, and nothing captures its stdout, so the prior-unlock requirement was an inconsistency rather than a boundary. An agent launch, a piped/CI run, and `pushBundleToHost` (fleet apply) are unchanged — they stay broker-only and still fail fast with the unlock hint, which is what keeps the RUSH-2440 keychain-enumeration prompt storm off the agent path. `export --plaintext` / `--to-file` / `--to-1password` are also unchanged: they emit values into a pipeline or onto the screen, so they remain unconditional automation primitives. Spec updated in lockstep (SEC-13b and the §4.2 materialization table). Source: `apps/cli/src/lib/secrets/push.ts`, `apps/cli/src/commands/secrets.ts`, `apps/cli/docs/secrets.md`, `apps/cli/docs/specifications.md`.
+
+- **A short session id resolves even when a fleet peer is offline.** `agents sessions preview <shortid>`, `agents resume <shortid>`, `agents sessions attach`, and `sessions --resolve --json` previously refused to resolve whenever any registered device failed to answer the fan-out — printing `Partial session resolution: <peers> did not answer` and rendering nothing, even though exactly one session on the reachable fleet matched — so on a fleet carrying any permanently offline device, every short-id lookup was voided. Once the sweep is over, a selector that is a complete id or at least 8 hex characters wide (the printed `shortId` width) now resolves from a single reachable match. **Deliberately unchanged:** a keyword-shaped query still fails closed even when it is all hex characters (`facade`, `decade` — searches, not identifiers); a **label** still fails closed at any length, because labels are free-form and collide by design; a prefix collision between peers that *did* answer still never resolves — it fails closed while a peer is missing, and surfaces as an ambiguity listing both machines once every peer has answered; and RUSH-2203's mid-sweep early-exit stays full-UUID-only. This amends the normative **SES-9a** requirement, which previously mandated fail-closed for every short prefix; the accepted collision risk is stated there, including that a time-ordered UUIDv7/ULID prefix collides far more readily than a random UUIDv4 one and the residual exposure is a collision hiding on the peer that did not answer. Source: `apps/cli/src/commands/sessions.ts` (`isUniqueEnoughSelector`, `metadataResolveOutcome`, `renderSessionPreview`), `apps/cli/docs/specifications.md` §SES-9a / §SES-IF-2a, `apps/cli/docs/sessions.md`.
+
+- **`agents teams add` warns and blocks when the base checkout is behind
+  `origin/main`, requiring `--confirm` to proceed.** Pointing a team at a stale
+  repo (local cwd, or the repo provisioned on a `--device` host) meant teammates
+  reasoned and built against code that had already moved on — the real incident
+  was a 71-commit-stale checkout on another box that nobody had fetched. `teams
+  add` now fetches origin, counts how far behind `origin/<default>` the base is,
+  and refuses with a sync command (`git … merge --ff-only origin/main`) unless you
+  pass `--confirm`; with `--confirm` it prints a one-line advisory and continues.
+  An offline/unreachable/non-git base can't be assessed and never blocks. Cloud
+  teammates clone fresh in the provider and are skipped. Source:
+  `apps/cli/src/commands/teams.ts`, `apps/cli/src/lib/teams/worktree.ts`,
+  `apps/cli/src/lib/teams/remoteWorktree.ts`.
+
+- **Webhook handlers (`~/.agents/webhooks/*.yml`) can now anchor a dispatched agent in a project.** A handler's `run.agent`/`run.workflow` action previously always ran at the target box's `$HOME` with no repo checkout and a hard-coded `auto` mode, so an inbound GitHub/Linear event could not fire an agent that actually edits a repo without routing through a routine. Handlers gain three top-level fields mirroring a routine's job config: `project` (named `agents projects` execution anchor — the run lands in that project's base directory), `cwd` (portable execution directory, resolved under `project` or `$HOME`), and `mode` (`plan`/`edit`/`auto`/`skip`/`full`, default `auto`). They thread into the dispatched `JobConfig` for the `run.agent`/`run.workflow` path and override the `routine:` delegate; `run.command` is unaffected (use a `cd` in the command). Source: `apps/cli/src/lib/triggers/handlers.ts`.
+
+## 1.22.35
+
+- **`agents doctor --fix` and `agents upgrade` purge stale multi-install agents-cli copies instead of only warning (RUSH-2415).** Pre-1.22.30 installs (and "unsafe legacy helper installer" / npx-cache trees) re-introduce the Touch ID storm + usage-API revocation class fixed in v1.22.30. Detection already existed (`findAgentsCliInstalls` / multi-install warning) but left remediation to the user. Bare `agents doctor --fix` and a successful `agents upgrade` now delete npx-cache installs, non-atomic helper installs, and pre-1.22.30 package roots when a fixed peer already exists on the box — never the running copy, never a lone pre-fixed install that would strand the machine. The multi-install warning points at `agents doctor --fix`. Source: `apps/cli/src/lib/self-update.ts`, `apps/cli/src/commands/doctor.ts`, `apps/cli/src/index.ts`.
+
+- **`agents share delete` (alias `agents unshare`) takes down a published page (RUSH-2428).** `agents share` publishes to a public URL with no way to take one down — the Cloudflare Worker already implements an authed `DELETE`, the CLI just never exposed it. The new command accepts a full share URL, `<user>/<slug>`, or a bare `<slug>` (resolved against your own namespace exactly as publish does), takes several targets at once, and by default also deletes the sibling `<slug>.png` OG cover (`--keep-cover` opts out) — without it, republishing over a slug replaced the page but left the old cover screenshot publicly readable, which is what made a real takedown slow. `{"ok":true}` from the Worker is not treated as proof: a follow-up check must resolve 404 before the command reports success, and it errors loudly (non-zero) instead of if it can't verify the object is actually gone. An already-missing target is an error by default; `--if-exists` treats it as a no-op success. Source: `apps/cli/src/lib/share/delete.ts`, `apps/cli/src/commands/share.ts`.
+
+- **Codex `edit` runs can write under the repo's `.agents/` again.** Codex's `workspace-write` sandbox hardcodes any `.agents/` (and `.codex/`) directory as read-only, but agents-cli keeps every git worktree at `<repo>/.agents/worktrees/<slug>` — so a Codex session whose cwd was the repo root hit `EROFS: read-only file system` on any write into a worktree (a build's `dist/`, generated files) and then had to prompt for per-command approval to escalate. Every interactive, headless, and direct-launch Codex path now makes the run's `<repo-root>/.agents` writable: `agents run codex` (and the Windows shim delegate) add it to the `agents-edit` profile's `workspace_roots`, and the adopted POSIX `codex` shim resolves the repo's `.agents` from `$PWD` at run time (worktree-aware) and passes it via Codex's own `--add-dir`. (Routines use a separate overlay-HOME sandbox with their own `allow.dirs` and are unchanged.) Naming the `.agents` directory itself is the only override Codex honors — a nested sub-path makes bwrap refuse the mount. Only an existing `.agents` is added; out-of-workspace and `~/.config` writes stay gated, network unchanged. Source: `apps/cli/src/lib/codex-policy.ts`, `apps/cli/src/lib/project-key.ts`, `apps/cli/src/lib/exec.ts`, `apps/cli/src/lib/shims.ts`.
+
 ## 1.22.34
 
 - **A failed `agents teams add` no longer strands an `agents/<name>` branch that breaks every retry (RUSH-2356).** The worktree was created before the teammate record was persisted and nothing removed it when the add failed, so the next `teams add` with the same `--worktree` name died on `fatal: a branch named 'agents/<name>' already exists` — observed 2026-08-07, forcing three renames before a teammate could be created. Two guarantees now hold. Name uniqueness and the `--after` dependency graph are validated **before** `createWorktree` runs (`AgentManager.validateAddPreconditions`), so a duplicate name, unknown dependency, or cycle never creates a branch at all. A failure **after** the worktree exists — a missing harness CLI, a launch error, a cloud dispatch failure — removes the worktree and its branch before the command exits non-zero, and prints the exact `git worktree remove` / `git branch -D` pair if that teardown itself fails. Teardown is scoped twice over, because deleting a live teammate's worktree would destroy real work: only a worktree that same add created is a candidate, and only when no live teammate claims it (`AgentManager.isWorktreeClaimed`, a raw meta.json scan across every team, counting only non-terminal records). That second check matters because the add can fail *after* the record is durably saved — `spawn()` saves a staged teammate and only then runs the retention pass, which refreshes every sibling and can throw on a distributed one — so a teammate already recorded and waiting on an `--after` dependency keeps its worktree. If we can't prove a worktree is an orphan, it is left in place with the manual removal printed — the claim check **fails closed**, so an unreadable or half-written record answers "claimed" rather than "free": only a genuinely absent record (ENOENT) proves nothing claims the worktree, because the alternative error deletes a running teammate's uncommitted work. The pr-watch fixer path (`reactWithTeammate`) and a partially-failed `createWorktree` (branch ref created, checkout not) run the same guarded teardown — the fixer path matters because it stages its teammate with `--after` when it follows a source teammate, so it can reach the failure branch with a live, durably-recorded, merely-pending teammate already owning the worktree.
@@ -199,7 +869,7 @@
 
 - **`agents run <agent>` now says the harness is not installed instead of exiting 127 (RUSH-2339).** On a machine without that harness the launch used to exec the bare CLI name and die with `sh: 1: exec: cursor-agent: not found`, behind a `⚠ <agent> looks logged out` banner that was also wrong. `agents run` now probes the executable it is about to spawn and exits `1` with `agents: <agent> is not installed on this machine.` plus the `agents add <agent>` fix, before any spawn. The probe is existence-based, so a harness you installed yourself (Homebrew, a vendor `curl | sh`, a distro package) with no agents-cli version home still launches, and a machine with managed versions but no pinned default still gets the shim's own `agents use <agent> <version>` guidance rather than a wrong "not installed".
 
-- **The Claude usage/auth-health probe no longer reads your interactive Claude Code login — the fix for repeated Anthropic logouts.** The daemon's usage (~60s) and auth-health (~3min) warms authenticated with a file-based setup-token when one was provisioned, but otherwise fell through to reading Claude Code's interactive OAuth token from the keychain / `.credentials.json` and firing it at `api.anthropic.com/api/oauth/usage`. Anthropic sees an interactive login used programmatically from a background loop and revokes it (the fleet-wide-logout class, RUSH-1822). `loadClaudeOauth`'s read-only `accessTokenCache` path now returns nothing when no setup-token is provisioned — it never reads the interactive login, in the keychain or in a file — matching the "interactive/rotating login is untouchable" invariant in docs/design/credential-management.md. The now-obsolete no-ACL access-token cache is removed with it. An account without a minted setup-token shows "usage pending" in `agents view` (seed one via the mint-auth path) but still runs normally; account rotation is unaffected. Source: `apps/cli/src/lib/usage.ts`.
+- **The Claude usage/auth-health probe no longer reads your interactive Claude Code login — the fix for repeated Anthropic logouts.** The daemon's usage (~60s) and auth-health (~3min) warms authenticated with a file-based setup-token when one was provisioned, but otherwise fell through to reading Claude Code's interactive OAuth token from the keychain / `.credentials.json` and firing it at `api.anthropic.com/api/oauth/usage`. Anthropic sees an interactive login used programmatically from a background loop and revokes it (the fleet-wide-logout class, RUSH-1822). `loadClaudeOauth`'s read-only `accessTokenCache` path now returns nothing when no setup-token is provisioned — it never reads the interactive login, in the keychain or in a file — matching the "interactive/rotating login is untouchable" invariant in docs/credential-management.md. The now-obsolete no-ACL access-token cache is removed with it. An account without a minted setup-token shows "usage pending" in `agents view` (seed one via the mint-auth path) but still runs normally; account rotation is unaffected. Source: `apps/cli/src/lib/usage.ts`.
 
 - **Sort `agents view <agent>` accounts by email after the default.** Managed installs previously followed semantic-version order after the default, forcing users with several Claude, Codex, or other harness accounts to scan a shuffled email column. Rows without an email remain deterministic in version-descending order, and `--json` keeps its existing default-then-version order for automation compatibility. Source: `apps/cli/src/commands/view.ts`.
 
@@ -4276,7 +4946,7 @@ Add Cursor Cloud Agents as a native cloud provider so `agents run cursor --cloud
   refresh token) is unchanged, and an account with no provisioned setup-token still
   falls through to the keychain for now. Keyed strictly per-account (never a bare
   shared key) so one account's token can't be misapplied to another. Source:
-  `apps/cli/src/lib/usage.ts`; design: `docs/design/credential-management.md`.
+  `apps/cli/src/lib/usage.ts`; design: `docs/credential-management.md`.
 
 ## 1.20.78