@phnx-labs/agents-cli 1.22.35 → 1.22.37

package/dist/lib/projects.js

@@ -272,6 +272,83 @@ export function projectBasePath(def, forRemote) {
         return undefined;
     return forRemote ? base : expandLocalHome(base);
 }
+/**
+ * Every directory a project binds, ordered: `primary` first, then each
+ * `repos[]` entry that carries a local `path` (joined with its `subpath`).
+ * Deduped by resolved path, so a repo row pointing at the primary collapses.
+ *
+ * The repos[] walk and the dedupe are shared; the three things the two callers
+ * genuinely disagree on are parameters rather than guesses, because collapsing
+ * them would change one caller's meaning:
+ *
+ * - **primary** — spawning anchors on the cwd an agent lands in
+ *   (`defaultPath ?? root`); probing anchors on `root`, so a monorepo
+ *   subproject still probes its checkout rather than its subdirectory.
+ * - **keepMissing** — probing KEEPS a missing directory, because reporting
+ *   `✗ missing` across the fleet is the whole job. A local spawn drops it: a
+ *   grant for a path that is not on this box is noise the harness rejects.
+ * - **joinSubpath** — a spawn grants the subdirectory the project declares it
+ *   cares about; a probe wants the repo root, since git status is a
+ *   whole-checkout question.
+ */
+function projectDirList(def, opts) {
+    const raw = [
+        opts.primary,
+        ...(def.repos ?? []).map((r) => {
+            if (!r.path)
+                return undefined;
+            if (!opts.joinSubpath || !r.subpath)
+                return r.path;
+            return `${r.path.replace(/\/+$/, '')}/${r.subpath.replace(/^\/+/, '')}`;
+        }),
+    ].filter((p) => typeof p === 'string' && p.length > 0);
+    const seen = new Set();
+    const out = [];
+    for (const p of raw) {
+        // Dedupe on the absolute local path so `~/src/x` and an already-expanded
+        // `/home/me/src/x` in a hand-edited def collapse to one entry.
+        const abs = path.resolve(expandLocalHome(p));
+        if (seen.has(abs))
+            continue;
+        seen.add(abs);
+        if (!opts.keepMissing && !fs.existsSync(abs))
+            continue;
+        out.push(opts.forRemote ? toHomeRelative(abs) : abs);
+    }
+    return out;
+}
+/**
+ * The directories `projects status` probes across the fleet: the repo root plus
+ * every bound checkout, home-relative so each host re-roots them, and including
+ * directories absent here so a peer can still answer `✗ missing` for them.
+ */
+export function projectProbeTargets(def) {
+    return projectDirList(def, {
+        primary: def.root,
+        forRemote: true,
+        keepMissing: true,
+        joinSubpath: false,
+    });
+}
+/**
+ * The directories an agent spawned on this project should reach: the cwd first
+ * (`resolveDefinedProjectPath`, so cwd behavior is unchanged), then every other
+ * bound repo. `forRemote` keeps them `~/…` so the remote shell re-roots them at
+ * its own `$HOME`; locally they are absolute and filtered to what exists.
+ *
+ * Callers pass the resolved primary so a `--project slug@worktree` run grants
+ * the sibling repos alongside the worktree it actually landed in.
+ */
+export function projectDirsAbs(def, opts) {
+    return projectDirList(def, {
+        primary: opts.primary ?? projectBasePath(def, opts.forRemote),
+        forRemote: opts.forRemote,
+        // A remote spawn must not be filtered by THIS box's filesystem: the target
+        // host has its own checkouts, and a dir missing here may well be there.
+        keepMissing: opts.forRemote,
+        joinSubpath: true,
+    });
+}
 function projectRootsAbs(defs) {
     const out = [];
     const push = (name, raw) => {
@@ -329,7 +406,7 @@ function isUnder(child, parent) {
  * with `expandLocalHome` and resolved, so this matches sessions whose cwd shares
  * this machine's home layout. A session recorded on a different-home machine
  * (`/Users/x/…` vs `/home/x/…`) will not match until the fleet-wide,
- * home-relative variant lands (see the deferred item in docs/11-projects.md).
+ * home-relative variant lands (see the deferred item in docs/projects.md).
  */
 export function projectNameForCwd(cwd, defs) {
     if (!cwd)

package/dist/lib/refresh-coordinator.d.ts

@@ -0,0 +1,24 @@
+export declare function setRefreshLockRootForTest(root: string | null): string | null;
+export interface RefreshLeaseOptions<T> {
+    scope: string;
+    key: string;
+    /**
+     * Re-read the shared result after taking the lease. If another process
+     * refreshed it while this caller waited, return that value instead of
+     * repeating the provider request.
+     */
+    readCompleted: () => T | null;
+    isCompleted: (value: T) => boolean;
+    refresh: () => Promise<T>;
+}
+/**
+ * Serialize refresh work across every agents-cli process on this device.
+ *
+ * In-process promise maps only protect one Node process. Factory, the daemon,
+ * `agents view`, and `agents usage` are separate processes, so they need an
+ * OS-visible lease. The result is re-read after lock acquisition: a waiter
+ * consumes the winner's publication and never calls the provider a second
+ * time. `proper-lockfile` supplies heartbeat + stale-owner recovery while an
+ * async provider request is in flight.
+ */
+export declare function withRefreshLease<T>(options: RefreshLeaseOptions<T>): Promise<T>;

package/dist/lib/refresh-coordinator.js

@@ -0,0 +1,52 @@
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import lockfile from 'proper-lockfile';
+import { getCacheDir } from './state.js';
+const REFRESH_LOCK_STALE_MS = 2 * 60_000;
+let refreshLockRootOverride = null;
+export function setRefreshLockRootForTest(root) {
+    const previous = refreshLockRootOverride;
+    refreshLockRootOverride = root;
+    return previous;
+}
+function lockTarget(scope, key) {
+    const digest = createHash('sha256').update(`${scope}\0${key}`).digest('hex');
+    return path.join(refreshLockRootOverride ?? getCacheDir(), 'refresh-locks', scope, `${digest}.lock`);
+}
+/**
+ * Serialize refresh work across every agents-cli process on this device.
+ *
+ * In-process promise maps only protect one Node process. Factory, the daemon,
+ * `agents view`, and `agents usage` are separate processes, so they need an
+ * OS-visible lease. The result is re-read after lock acquisition: a waiter
+ * consumes the winner's publication and never calls the provider a second
+ * time. `proper-lockfile` supplies heartbeat + stale-owner recovery while an
+ * async provider request is in flight.
+ */
+export async function withRefreshLease(options) {
+    const target = lockTarget(options.scope, options.key);
+    await fs.mkdir(path.dirname(target), { recursive: true });
+    try {
+        await fs.writeFile(target, '', { flag: 'wx', mode: 0o600 });
+    }
+    catch (error) {
+        if (error?.code !== 'EEXIST')
+            throw error;
+    }
+    const release = await lockfile.lock(target, {
+        realpath: false,
+        stale: REFRESH_LOCK_STALE_MS,
+        update: REFRESH_LOCK_STALE_MS / 4,
+        retries: { retries: 240, minTimeout: 25, maxTimeout: 500, factor: 1.2 },
+    });
+    try {
+        const completed = options.readCompleted();
+        if (completed !== null && options.isCompleted(completed))
+            return completed;
+        return await options.refresh();
+    }
+    finally {
+        await release();
+    }
+}

package/dist/lib/registry.d.ts

@@ -56,7 +56,7 @@ export interface SkillIndexEntry {
     tags?: string[];
     author?: string;
     installs?: number;
-    /** Lowercase hex sha256 of the skill's SKILL.md — written by `agents publish`. */
+    /** Lowercase hex sha256 of the skill's SKILL.md supplied by the registry index. */
     sha256?: string;
 }
 /** Raw shape of the skill index document served by Hermes and compatible registries. */
@@ -100,7 +100,7 @@ export declare function parseOwnerRepoFromRemote(remoteUrl: string): string | nu
 /**
  * Walk a repo's skills/ and build a flat {@link SkillIndexDocument}. Each entry
  * carries the sha256 of its SKILL.md so install can verify integrity after
- * cloning — this is the artifact `agents publish` commits + pushes.
+ * cloning.
  *
  * `repoSlug` is the 'owner/repo' the skills are published under, written into
  * each entry's `repo` field so {@link skillEntryToGitSource} resolves it to

package/dist/lib/registry.js

@@ -493,7 +493,7 @@ export function parseOwnerRepoFromRemote(remoteUrl) {
 /**
  * Walk a repo's skills/ and build a flat {@link SkillIndexDocument}. Each entry
  * carries the sha256 of its SKILL.md so install can verify integrity after
- * cloning — this is the artifact `agents publish` commits + pushes.
+ * cloning.
  *
  * `repoSlug` is the 'owner/repo' the skills are published under, written into
  * each entry's `repo` field so {@link skillEntryToGitSource} resolves it to

package/dist/lib/resource-aliases.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Normalize a resource's frontmatter `aliases:` value into a clean list.
+ *
+ * A skill (SKILL.md) or command file may declare `aliases:` — alternate names
+ * that {@link resolveResource} matches in addition to the canonical file/dir name
+ * (the canonical name always wins a collision). The value is a YAML list or a
+ * comma/space-separated string, mirroring the command frontmatter `agents:` field.
+ *
+ * This lives in its own leaf module so `skills.ts` and `commands.ts` (which parse
+ * the frontmatter) and `resources.ts` (which resolves by alias) all share one
+ * definition without an import cycle.
+ */
+export declare function normalizeAliases(raw: unknown): string[];

package/dist/lib/resource-aliases.js

@@ -0,0 +1,26 @@
+/**
+ * Normalize a resource's frontmatter `aliases:` value into a clean list.
+ *
+ * A skill (SKILL.md) or command file may declare `aliases:` — alternate names
+ * that {@link resolveResource} matches in addition to the canonical file/dir name
+ * (the canonical name always wins a collision). The value is a YAML list or a
+ * comma/space-separated string, mirroring the command frontmatter `agents:` field.
+ *
+ * This lives in its own leaf module so `skills.ts` and `commands.ts` (which parse
+ * the frontmatter) and `resources.ts` (which resolves by alias) all share one
+ * definition without an import cycle.
+ */
+export function normalizeAliases(raw) {
+    const tokens = Array.isArray(raw)
+        ? raw
+        : typeof raw === 'string'
+            ? raw.split(/[,\s]+/)
+            : [];
+    const out = [];
+    for (const token of tokens) {
+        const name = String(token).trim();
+        if (name && !out.includes(name))
+            out.push(name);
+    }
+    return out;
+}

package/dist/lib/resources/types.d.ts

@@ -9,7 +9,7 @@ import type { AgentId } from '../types.js';
 export type { AgentId };
 /** Resource origin. Precedence (highest first): project > user > plugin > system. */
 export type Layer = 'system' | 'user' | 'project' | 'plugin';
-export type ResourceKind = 'command' | 'hook' | 'skill' | 'rule' | 'mcp' | 'permission' | 'subagent' | 'workflow' | 'memory';
+export type ResourceKind = 'command' | 'hook' | 'skill' | 'rule' | 'mcp' | 'permission' | 'subagent' | 'workflow' | 'memory' | 'plugin';
 /** A resolved resource with its origin layer. */
 export interface ResolvedItem<T> {
     name: string;

package/dist/lib/resources.d.ts

@@ -32,7 +32,23 @@ export interface ResolvedResource {
      * repo (or has no commits).
      */
     readonly snapshotSha: string | undefined;
+    /**
+     * Alternate names this resource declares in its frontmatter `aliases:`, which
+     * {@link resolveResource} matches in addition to the canonical name. Lazily
+     * read from disk on first access and memoized, so listing resources never pays
+     * for it unless a caller inspects an alias. `undefined` when the resource
+     * declares none (or for a kind that doesn't support aliases — only `skills` and
+     * `commands` do), mirroring {@link snapshotSha} so a strict `toEqual` on a
+     * ResolvedResource ignores the absent field.
+     */
+    readonly aliases: string[] | undefined;
 }
+/**
+ * The declared frontmatter `aliases:` of a single resource, or `[]` for a kind
+ * that doesn't support aliases. Only `skills` (SKILL.md) and `commands` carry
+ * them today. `resourcePath` is the skill directory or the command file.
+ */
+export declare function resourceAliases(kind: ResourceKind, resourcePath: string): string[];
 /**
  * True when `rawName` (a filename with its extension already stripped) names a
  * directory doc rather than a resource of `kind`. Exported so every enumerator

package/dist/lib/resources.js

@@ -5,8 +5,8 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { AGENTS, listInstalledMcpsWithScope } from './agents.js';
-import { listInstalledCommandsWithScope } from './commands.js';
-import { listInstalledSkillsWithScope } from './skills.js';
+import { listInstalledCommandsWithScope, parseCommandMetadata } from './commands.js';
+import { listInstalledSkillsWithScope, parseSkillMetadata } from './skills.js';
 import { listOnDiskHooks } from './resource-inventory.js';
 import { listInstalledInstructionsWithScope } from './rules/rules.js';
 import { getEffectiveHome } from './versions.js';
@@ -16,13 +16,37 @@ import { isCapable } from './capabilities.js';
 import { getProjectAgentsDir, getUserAgentsDir, getSystemAgentsDir, getEnabledExtraRepos, } from './state.js';
 import { isNameActiveInResourceProfile } from './resource-profiles.js';
 import { resolveSnapshotSha } from './git.js';
-/** Build a ResolvedResource with a lazy, memoized `snapshotSha` getter. */
-function withProvenance(base) {
+/**
+ * The declared frontmatter `aliases:` of a single resource, or `[]` for a kind
+ * that doesn't support aliases. Only `skills` (SKILL.md) and `commands` carry
+ * them today. `resourcePath` is the skill directory or the command file.
+ */
+export function resourceAliases(kind, resourcePath) {
+    if (kind === 'skills')
+        return parseSkillMetadata(resourcePath)?.aliases ?? [];
+    if (kind === 'commands')
+        return parseCommandMetadata(resourcePath)?.aliases ?? [];
+    return [];
+}
+/** Build a ResolvedResource with lazy, memoized `snapshotSha` and `aliases` getters. */
+function withProvenance(base, kind) {
+    let aliasesComputed = false;
+    let aliasesCache;
     return {
         ...base,
         get snapshotSha() {
             return resolveSnapshotSha(base.repoRoot);
         },
+        get aliases() {
+            if (!aliasesComputed) {
+                const found = resourceAliases(kind, base.path);
+                // Undefined (not []) when none, so a strict toEqual on a ResolvedResource
+                // ignores it — the same convention snapshotSha uses.
+                aliasesCache = found.length > 0 ? found : undefined;
+                aliasesComputed = true;
+            }
+            return aliasesCache;
+        },
     };
 }
 function profiledKind(kind) {
@@ -92,7 +116,7 @@ export function resolveResource(kind, name, cwd) {
         const exactPath = path.join(dir, name);
         if (fs.existsSync(exactPath)) {
             if (resourceIsActive(kind, name, source)) {
-                return withProvenance({ name, path: exactPath, source, repoRoot });
+                return withProvenance({ name, path: exactPath, source, repoRoot }, kind);
             }
             continue;
         }
@@ -104,12 +128,44 @@ export function resolveResource(kind, name, cwd) {
             const withExt = exactPath + ext;
             if (fs.existsSync(withExt)) {
                 if (resourceIsActive(kind, name, source)) {
-                    return withProvenance({ name, path: withExt, source, repoRoot });
+                    return withProvenance({ name, path: withExt, source, repoRoot }, kind);
                 }
                 continue;
             }
         }
     }
+    // Alias fallback (skills/commands only). A resource may declare `aliases:` in
+    // its frontmatter; match `name` against those AFTER every layer's canonical
+    // lookup above has missed, so a canonical resource named `name` always wins a
+    // collision regardless of layer. Layer precedence still applies among aliases,
+    // and entries are sorted so a same-layer alias collision resolves deterministically.
+    if (kind === 'skills' || kind === 'commands') {
+        for (const [dir, source, repoRoot] of candidates) {
+            if (!fs.existsSync(dir))
+                continue;
+            let entries;
+            try {
+                entries = fs.readdirSync(dir, { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const entry of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
+                if (entry.name.startsWith('.'))
+                    continue;
+                const rawName = entry.name.replace(/\.(md|yaml|yml)$/, '');
+                if (isDirectoryDoc(kind, rawName))
+                    continue;
+                const resourcePath = path.join(dir, entry.name);
+                if (!resourceAliases(kind, resourcePath).includes(name))
+                    continue;
+                if (!resourceIsActive(kind, rawName, source))
+                    continue;
+                // Resolve to the canonical resource (its real name), not the alias.
+                return withProvenance({ name: rawName, path: resourcePath, source, repoRoot }, kind);
+            }
+        }
+    }
     return null;
 }
 /**
@@ -190,7 +246,7 @@ export function listResources(kind, cwd) {
                         path: full,
                         source,
                         repoRoot,
-                    }));
+                    }, kind));
                     continue;
                 }
                 if (!stat.isDirectory() || HOOK_GROUP_SKIP.has(name))
@@ -231,7 +287,7 @@ export function listResources(kind, cwd) {
                             path: path.join(full, script),
                             source,
                             repoRoot,
-                        }));
+                        }, kind));
                     }
                 }
                 else {
@@ -246,7 +302,7 @@ export function listResources(kind, cwd) {
                         path: full,
                         source,
                         repoRoot,
-                    }));
+                    }, kind));
                 }
             }
         }
@@ -282,7 +338,7 @@ export function listResources(kind, cwd) {
                 path: path.join(dir, entry.name),
                 source,
                 repoRoot,
-            }));
+            }, kind));
         }
     }
     return results;

package/dist/lib/rotate.d.ts

@@ -106,10 +106,9 @@ export declare function isLaunchableSignedIn(signedIn: boolean, presence: Pick<C
 /**
  * How old a usage snapshot may be and still settle a routing DECISION.
  *
- * Deliberately far tighter than the 24h stale-while-revalidate window the
- * display paths use (`USAGE_CACHE_SWR_MS`): `agents view` rendering a slightly
- * old bar costs nothing, but the router choosing an account from one costs the
- * whole run. Measured case — `yosemite-s1` held snapshots 26h to 2.7 days old
+ * A display may show an older cached bar, but the router choosing an account
+ * from one costs the whole run. Measured case: `yosemite-s1` held snapshots 26
+ * hours to 2.7 days old
  * with a failing refresh, so balanced read `muqsit@getrush.ai` as 48% used and
  * launched into it while the account was actually at its weekly cap.
  */

package/dist/lib/rotate.js

@@ -103,10 +103,9 @@ function isAvailableEligible(candidate) {
 /**
  * How old a usage snapshot may be and still settle a routing DECISION.
  *
- * Deliberately far tighter than the 24h stale-while-revalidate window the
- * display paths use (`USAGE_CACHE_SWR_MS`): `agents view` rendering a slightly
- * old bar costs nothing, but the router choosing an account from one costs the
- * whole run. Measured case — `yosemite-s1` held snapshots 26h to 2.7 days old
+ * A display may show an older cached bar, but the router choosing an account
+ * from one costs the whole run. Measured case: `yosemite-s1` held snapshots 26
+ * hours to 2.7 days old
  * with a failing refresh, so balanced read `muqsit@getrush.ai` as 48% used and
  * launched into it while the account was actually at its weekly cap.
  */
@@ -588,7 +587,7 @@ export async function collectRunCandidates(agent) {
         home,
         cliVersion: version,
         info,
-    })), { readOnly: true });
+    })));
     return rows.map(({ home: _home, info, ...candidate }) => {
         const usageKey = getUsageLookupKey(info);
         const usage = usageKey ? usageByKey.get(usageKey) : undefined;

package/dist/lib/routine-activation.d.ts

@@ -3,8 +3,6 @@ export declare function normalizeRoutineNames(names: Iterable<string>): string[]
 export declare function enabledRoutineNames(): string[] | null;
 export declare function routineEnabledOnThisDevice(name: string): boolean | null;
 export declare function replaceEnabledRoutines(names: Iterable<string>): string[];
-/** Add newly introduced replacements to an already-materialized device manifest. */
-export declare function addEnabledRoutinesOnUpgrade(names: Iterable<string>): boolean;
 /**
  * Add or remove one routine on this machine. `legacyEnabledNames` seeds the
  * manifest the first time an upgraded host changes activation, preserving every
@@ -13,4 +11,26 @@ export declare function addEnabledRoutinesOnUpgrade(names: Iterable<string>): bo
 export declare function setRoutineEnabledOnThisDevice(name: string, enabled: boolean, legacyEnabledNames?: Iterable<string>): string[];
 /** Read-only fleet view from synced device documents. Never writes a peer file. */
 export declare function devicesWithRoutineEnabled(name: string): string[];
+/** Which devices enable which routines, read in one pass. */
+export interface RoutineDeviceIndex {
+    /** Routine name → the devices whose allowlist names it, sorted. */
+    byRoutine: Map<string, string[]>;
+    /**
+     * True when at least one device document declares a `routines:` list. Until
+     * then no routine is "dark" — the fleet simply has not materialized its
+     * activation state yet, and saying "will not fire" would be wrong.
+     */
+    materialized: boolean;
+    /** Device files that could not be read, reported instead of thrown. */
+    errors: string[];
+}
+/**
+ * Build the whole fleet's activation map in one pass over `devices/`.
+ *
+ * `devicesWithRoutineEnabled` answers this for a single routine and throws on a
+ * corrupt peer file — the right contract for a command acting on one routine,
+ * the wrong one for a listing, where a single unreadable device document would
+ * blank out every row (and re-walking `devices/` per routine is quadratic).
+ */
+export declare function routineDeviceIndex(): RoutineDeviceIndex;
 export declare function currentRoutineDevice(): string;

package/dist/lib/routine-activation.js

@@ -26,22 +26,6 @@ export function replaceEnabledRoutines(names) {
     updateMeta((meta) => ({ ...meta, deviceRoutines: normalized }));
     return normalized;
 }
-/** Add newly introduced replacements to an already-materialized device manifest. */
-export function addEnabledRoutinesOnUpgrade(names) {
-    const additions = normalizeRoutineNames(names);
-    let changed = false;
-    updateMeta((meta) => {
-        if (!Array.isArray(meta.deviceRoutines))
-            return meta;
-        const current = normalizeRoutineNames(meta.deviceRoutines);
-        const next = normalizeRoutineNames([...current, ...additions]);
-        if (next.length === current.length && next.every((name, index) => name === current[index]))
-            return meta;
-        changed = true;
-        return { ...meta, deviceRoutines: next };
-    });
-    return changed;
-}
 /**
  * Add or remove one routine on this machine. `legacyEnabledNames` seeds the
  * manifest the first time an upgraded host changes activation, preserving every
@@ -89,6 +73,69 @@ export function devicesWithRoutineEnabled(name) {
     }
     return devices.sort();
 }
+/**
+ * Build the whole fleet's activation map in one pass over `devices/`.
+ *
+ * `devicesWithRoutineEnabled` answers this for a single routine and throws on a
+ * corrupt peer file — the right contract for a command acting on one routine,
+ * the wrong one for a listing, where a single unreadable device document would
+ * blank out every row (and re-walking `devices/` per routine is quadratic).
+ */
+export function routineDeviceIndex() {
+    const byRoutine = new Map();
+    const errors = [];
+    let materialized = false;
+    const devicesDir = path.join(getUserAgentsDir(), 'devices');
+    if (!fs.existsSync(devicesDir))
+        return { byRoutine, materialized, errors };
+    let entries;
+    try {
+        entries = fs.readdirSync(devicesDir, { withFileTypes: true });
+    }
+    catch (err) {
+        return { byRoutine, materialized, errors: [`${devicesDir}: ${err.message}`] };
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const file = path.join(devicesDir, entry.name, 'agents.yaml');
+        if (!fs.existsSync(file))
+            continue;
+        let parsed;
+        try {
+            parsed = yaml.parse(fs.readFileSync(file, 'utf-8'));
+        }
+        catch (err) {
+            errors.push(`${file}: ${err.message.split('\n')[0]}`);
+            continue;
+        }
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            errors.push(`${file}: expected a YAML map`);
+            continue;
+        }
+        const routines = parsed.routines;
+        if (routines === undefined)
+            continue;
+        if (!Array.isArray(routines) || routines.some((routine) => typeof routine !== 'string')) {
+            errors.push(`${file}: routines must be a string list`);
+            continue;
+        }
+        materialized = true;
+        // Same normalization the writers use (`replaceEnabledRoutines`), so a device
+        // that lists a routine twice, or with stray whitespace, cannot make the index
+        // disagree with `enabledRoutineNames` about what that device enables.
+        for (const name of normalizeRoutineNames(routines)) {
+            const devices = byRoutine.get(name);
+            if (devices)
+                devices.push(entry.name);
+            else
+                byRoutine.set(name, [entry.name]);
+        }
+    }
+    for (const devices of byRoutine.values())
+        devices.sort();
+    return { byRoutine, materialized, errors };
+}
 export function currentRoutineDevice() {
     return machineId();
 }

package/dist/lib/routine-context.d.ts

@@ -104,8 +104,15 @@ export interface ResolvedExecutionContext {
 export declare function expandTargetHome(home: string, p: string): string;
 /** Rewrite an absolute path under the target home to its portable `~/…` form; pass others through. */
 export declare function toTargetPortable(home: string, abs: string): string;
-/** True for a bare relative path (not absolute, not home-anchored). */
-export declare function isBareRelative(p: string): boolean;
+/**
+ * True for a bare relative path (not absolute, not home-anchored) ON THE TARGET.
+ *
+ * `isAbsolute` is evaluated in the TARGET's own path flavour (see
+ * {@link targetPath}), not this process's platform — a Windows-shaped absolute
+ * cwd (`C:\Users\x\override`) dispatched from a POSIX daemon must still be
+ * recognized as absolute, or it is misread as project-relative.
+ */
+export declare function isBareRelative(home: string, p: string): boolean;
 /**
  * Resolve the working directory a routine's run lands in and verify its
  * structural + filesystem readiness for the given placement. Pure of global

package/dist/lib/routine-context.js

@@ -70,9 +70,16 @@ export function toTargetPortable(home, abs) {
         return '~/' + rel.split(tp.sep).join('/');
     return abs;
 }
-/** True for a bare relative path (not absolute, not home-anchored). */
-export function isBareRelative(p) {
-    return !path.isAbsolute(p) && !p.startsWith('~') && !p.startsWith('$HOME');
+/**
+ * True for a bare relative path (not absolute, not home-anchored) ON THE TARGET.
+ *
+ * `isAbsolute` is evaluated in the TARGET's own path flavour (see
+ * {@link targetPath}), not this process's platform — a Windows-shaped absolute
+ * cwd (`C:\Users\x\override`) dispatched from a POSIX daemon must still be
+ * recognized as absolute, or it is misread as project-relative.
+ */
+export function isBareRelative(home, p) {
+    return !targetPath(home).isAbsolute(p) && !p.startsWith('~') && !p.startsWith('$HOME');
 }
 /**
  * True when `child` is `base` or strictly beneath it (no `..` escape).
@@ -154,7 +161,7 @@ export function resolveRoutineExecutionContext(input) {
             if (cwd === undefined) {
                 return finalize(projBase, 'project_path_missing');
             }
-            if (isBareRelative(cwd)) {
+            if (isBareRelative(targetHome, cwd)) {
                 const baseAbs = expandTargetHome(targetHome, projBase);
                 // Target-side join: `path.resolve` would use this host's separator and,
                 // for a target home this host does not consider absolute, prepend the
@@ -188,8 +195,16 @@ export function resolveRoutineExecutionContext(input) {
             const abs = expandTargetHome(targetHome, cwd);
             return finalize(toTargetPortable(targetHome, abs), 'cwd_missing');
         }
-        if (path.isAbsolute(cwd)) {
-            const resolved = path.resolve(cwd);
+        // Absolute in EITHER path flavour — a Windows daemon resolving a POSIX
+        // target cwd (or the reverse) must not fall through to bare-relative join.
+        // Do not `path.resolve` on the local platform: on win32 that rewrites
+        // `/home/u/override` to `D:\home\u\override` and falsely flags
+        // cwd_not_portable (Windows CI, cross-platform schedule).
+        const cwdIsAbsolute = targetPath(targetHome).isAbsolute(cwd) ||
+            path.posix.isAbsolute(cwd) ||
+            path.win32.isAbsolute(cwd);
+        if (cwdIsAbsolute) {
+            const resolved = cwd;
             if (isInside(targetHome, resolved)) {
                 // Normalize an absolute-under-home path to its portable form on save.
                 return finalize(toTargetPortable(targetHome, resolved), 'cwd_missing');