@phnx-labs/agents-cli 1.22.35 → 1.22.37

package/dist/commands/events.js

@@ -1,22 +1,22 @@
 /**
- * `agents events` — read the unified event stream.
+ * `agents events` — read the unified event stream (the one ops/timeline product).
  *
- * One stream over BOTH operational events (`~/.agents/.history/events/YYYY-MM-DD/`: every
- * `agents <module> <cmd>` invocation plus typed events like secrets access,
- * version installs) AND agent-semantic events (the per-session activity logs:
- * plans, PRs, worktrees, sub-agents, artifacts). Each is stamped with who ran
- * it and from where. This is the audit trail for "who accessed a secret /
- * created a team" AND the activity trail for "what did the agents just do".
+ * One stream over BOTH operational events (`~/.agents/.history/events/YYYY-MM-DD/`:
+ * every `agents <module> <cmd>` invocation plus typed events like secrets access,
+ * browser/computer, daemon lifecycle, version installs) AND agent-semantic events
+ * (per-session activity: plans, PRs, worktrees, sub-agents, artifacts). Run-dispatch
+ * outcomes land here as `run.dispatched` (readable via `--include runs`).
  *
- * Filter by `--module` (top-level group, e.g. teams; `activity` for agent
- * events), `--command` (path prefix), `--event` (typed event), `--agent`, and
- * `--since`. `--audit` restricts to operational events only. `--follow` tails
- * today's operational log live.
+ * `agents audit` and `agents logs` are thin aliases of this command.
+ *
+ * Filter with sessions-style `--include` / `--exclude` families (ops, activity,
+ * commands, runs, security) plus field filters (`--module`, `--event`, …).
  */
 import chalk from 'chalk';
 import * as fs from 'fs';
-import { getLogsPath } from '../lib/events.js';
+import { getLogsPath, stats, rotate } from '../lib/events.js';
 import { readUnifiedEvents } from '../lib/event-stream.js';
+import { parseFamilyList, EVENT_FAMILIES } from '../lib/event-families.js';
 import { ingestBatch } from '../lib/events-ingest.js';
 import { setHelpSections } from '../lib/help.js';
 /**
@@ -86,6 +86,15 @@ function detailFor(r) {
         bits.push(`skill=${r.skill}`);
     if (typeof r.version === 'string')
         bits.push(`v=${r.version}`);
+    // run.dispatched (and similar) — mode / outcome / exit / repo are the audit line.
+    if (typeof r.mode === 'string')
+        bits.push(`mode=${r.mode}`);
+    if (typeof r.outcome === 'string')
+        bits.push(`outcome=${r.outcome}`);
+    if (typeof r.exitCode === 'number')
+        bits.push(`exit=${r.exitCode}`);
+    if (typeof r.repo === 'string')
+        bits.push(chalk.gray(r.repo));
     if (typeof r.profile === 'string')
         bits.push(`profile=${r.profile}`);
     if (typeof r.error === 'string')
@@ -187,9 +196,11 @@ function registerEmitSubcommand(events) {
 /** Add the one canonical event-reader option surface to a command or alias. */
 export function addEventsReadOptions(command, includeAuditFlag = true) {
     command
-        .option('--module <name>', 'Only events from this group (e.g. teams, secrets, activity)')
+        .option('--include <families>', `Only these families (comma-sep): ${EVENT_FAMILIES.join(', ')}`)
+        .option('--exclude <families>', `Drop these families (comma-sep): ${EVENT_FAMILIES.join(', ')}`)
+        .option('--module <name>', 'Only events from this group (e.g. teams, secrets, activity, daemon, routine, watchdog, browser)')
         .option('--command <path>', 'Only this command path — prefix match (e.g. "teams create")')
-        .option('--event <type>', 'Only this typed event (repeatable, e.g. secrets.get, secrets.unlocked, pr.opened)', collect, [])
+        .option('--event <type>', 'Only this typed event (repeatable, e.g. secrets.get, run.dispatched, pr.opened)', collect, [])
         .option('--agent <name>', 'Only events tagged with this agent')
         .option('--caller <kind>', 'Only this caller kind (claude-code, codex, gemini, cursor, terminal, script)')
         .option('--level <level>', 'Only this level: audit, warn, info, debug')
@@ -199,11 +210,12 @@ export function addEventsReadOptions(command, includeAuditFlag = true) {
         .option('--limit <n>', 'Max records to show; 0 for no cap (default 50)', '50')
         .option('--json', 'Output raw records as JSON')
         .option('-f, --follow', "Tail today's operational log live");
-    if (includeAuditFlag)
-        command.option('--audit', 'Operational events only (skip agent activity)');
+    if (includeAuditFlag) {
+        command.option('--audit', 'Deprecated: operational events only — prefer --include ops or --exclude activity');
+    }
     return command;
 }
-/** Canonical reader used by both `agents events` and `agents logs audit`. */
+/** Canonical reader used by `agents events`, `agents audit`, and `agents logs`. */
 export async function runEventsCommand(options, forceAudit = false) {
     if (options.follow) {
         await followLog();
@@ -211,15 +223,29 @@ export async function runEventsCommand(options, forceAudit = false) {
     }
     let limit;
     let startDate;
+    let includeFamilies;
+    let excludeFamilies;
     try {
         limit = resolveEventsLimit(options.limit);
         startDate = options.since ? parseSince(options.since) : undefined;
+        if (options.include && options.exclude) {
+            throw new Error('--include and --exclude are mutually exclusive');
+        }
+        if (options.include)
+            includeFamilies = parseFamilyList(options.include, '--include');
+        if (options.exclude)
+            excludeFamilies = parseFamilyList(options.exclude, '--exclude');
     }
     catch (err) {
         console.error(chalk.red(err.message));
         process.exitCode = 2;
         return;
     }
+    // --audit / forceAudit = ops-only when no family flags. Families own the
+    // source selection via applyFamilies — never override includeActivity after.
+    const includeActivity = (includeFamilies !== undefined || excludeFamilies !== undefined)
+        ? true
+        : !(forceAudit || options.audit);
     const fetched = readUnifiedEvents({
         startDate,
         eventTypes: options.event && options.event.length ? options.event : undefined,
@@ -231,7 +257,9 @@ export async function runEventsCommand(options, forceAudit = false) {
         command: options.command,
         module: options.module,
         limit: limit === undefined ? undefined : limit + 1,
-        includeActivity: !(forceAudit || options.audit),
+        includeActivity,
+        includeFamilies,
+        excludeFamilies,
     });
     const { records, truncated } = capRecords(fetched, limit);
     const capNote = `Showing the newest ${limit} — more events matched. Pass --limit 0 for all.`;
@@ -251,29 +279,117 @@ export async function runEventsCommand(options, forceAudit = false) {
     if (truncated)
         console.log(chalk.yellow(capNote));
 }
+function humanBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function levelColor(level) {
+    if (level === 'audit')
+        return chalk.magenta(level);
+    if (level === 'warn')
+        return chalk.yellow(level);
+    if (level === 'debug')
+        return chalk.gray(level);
+    return chalk.blue(level);
+}
+/** Shared by `events stats` and the `logs stats` alias. */
+export async function runEventsStats(opts) {
+    let days = 7;
+    if (opts.since) {
+        try {
+            const d = parseSince(opts.since);
+            days = Math.max(1, Math.ceil((Date.now() - d.getTime()) / 86_400_000));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exitCode = 2;
+            return;
+        }
+    }
+    const s = stats({ days });
+    if (opts.json) {
+        console.log(JSON.stringify(s, null, 2));
+        return;
+    }
+    console.log(chalk.bold(`Event statistics (last ${days} day${days === 1 ? '' : 's'})\n`));
+    console.log(`  Total events:  ${s.totalEvents}`);
+    console.log(`  Log files:     ${s.fileCount} (${humanBytes(s.totalBytes)})`);
+    console.log(`  Log path:      ${chalk.gray(getLogsPath())}`);
+    if (Object.keys(s.byLevel).length) {
+        console.log(chalk.bold('\n  By level:'));
+        for (const [k, v] of Object.entries(s.byLevel).sort((a, b) => b[1] - a[1])) {
+            console.log(`    ${levelColor(k).padEnd(20)} ${v}`);
+        }
+    }
+    if (Object.keys(s.byEvent).length) {
+        console.log(chalk.bold('\n  By event (top 15):'));
+        for (const [k, v] of Object.entries(s.byEvent).sort((a, b) => b[1] - a[1]).slice(0, 15)) {
+            console.log(`    ${chalk.cyan(k).padEnd(30)} ${v}`);
+        }
+    }
+    if (Object.keys(s.byModule).length) {
+        console.log(chalk.bold('\n  By module:'));
+        for (const [k, v] of Object.entries(s.byModule).sort((a, b) => b[1] - a[1])) {
+            console.log(`    ${k.padEnd(20)} ${v}`);
+        }
+    }
+    console.log();
+}
 export function registerEventsCommand(program) {
     const events = addEventsReadOptions(program
         .command('events')
-        .description('Read the unified event stream (operational + agent activity)'))
+        .description('Read the unified event stream (ops + activity + run dispatch)'))
         .addHelpText('after', `
 Examples:
   agents events                          Everything — ops + agent activity
-  agents events --module activity        Agent activity only (plans / PRs / worktrees)
-  agents events --audit                  Operational events only (secrets / teams / ...)
-  agents events --event pr.opened --since 7d
+  agents events --exclude commands       Drop CLI command.start/end noise
+  agents events --include runs           Dispatched-run outcomes (was audit list)
+  agents events --include activity       Agent milestones only
+  agents events --include ops            Operational events only
+  agents events --include security       Audit-level (secrets, command.*, daemon, …)
   agents events --module secrets         Every secret accessed or revealed
   agents events --module secrets --bundle share
-                                         Every read of the share bundle (which agent, which session)
-  agents events --bundle share --session <id>
-                                         Trace one session's reads of a bundle
+  agents events --event pr.opened --since 7d
   agents events -f                       Live tail (operational)
-  agents events --event pr.opened --since 30d --limit 0 --json
-                                         Every match — use --limit 0 whenever you
-                                         aggregate, or you rank only the newest 50`)
+  agents events stats
+  agents events rotate --days 7
+
+  agents audit                           Alias of: events --include runs
+  agents logs                            Alias of: events`)
         .action((_options, command) => runEventsCommand(command.optsWithGlobals()));
     // `events` both reads (its own action, above) and writes (this subcommand) —
     // the same shape as `feed` / `feed post`.
     registerEmitSubcommand(events);
+    events
+        .command('stats')
+        .description('Show aggregate event statistics')
+        .option('--since <time>', 'Window size (e.g. 7d, 30d; default 7d)')
+        .option('--json', 'Output stats as JSON')
+        .action(async (opts) => runEventsStats(opts));
+    events
+        .command('rotate')
+        .description('Apply event retention and the storage ceiling immediately')
+        .option('--days <n>', 'Retention period in days (default 7)', '7')
+        .option('--max-mb <n>', 'Total event storage ceiling in MiB (default 50)', '50')
+        .action((opts) => runEventsRotate(opts));
+}
+/** Shared by `events rotate` and the `logs rotate` alias. */
+export function runEventsRotate(opts) {
+    const days = Math.max(1, parseInt(opts.days ?? '7', 10) || 7);
+    const maxMb = Math.max(1, parseInt(opts.maxMb ?? '50', 10) || 50);
+    const result = rotate(days, maxMb * 1024 * 1024);
+    const removed = result.removedByAge + result.removedBySize;
+    if (removed > 0) {
+        console.log(`Removed ${removed} event file${removed === 1 ? '' : 's'} ` +
+            `(${result.removedByAge} by age, ${result.removedBySize} by size); ` +
+            `reclaimed ${humanBytes(result.bytesReclaimed)}.`);
+    }
+    else {
+        console.log(chalk.gray(`No event files removed (retention ${days} days, ceiling ${maxMb} MiB).`));
+    }
 }
 /** commander repeatable-option collector. */
 function collect(value, previous) {

package/dist/commands/exec.js

@@ -11,12 +11,13 @@ import { isTierToken } from '../lib/model-tiers.js';
 import { RUN_AUTO_KEYWORD } from '../lib/types.js';
 import { setHelpSections } from '../lib/help.js';
 import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
-import { getUserAgentsDir } from '../lib/state.js';
+import { getUserAgentsDir, readMeta } from '../lib/state.js';
 import { parseLoopInterval } from '../lib/loop.js';
 import { AGENTS, resolveAgentName, isAgentHardDeprecated, hardDeprecationError } from '../lib/agents.js';
 import { recordDispatchedRun } from '../lib/audit/log.js';
 import { maybeShowStarNudge } from '../lib/star-nudge.js';
 import { warnUnpushedWork, shouldWarnUnpushed } from '../lib/warn-unpushed.js';
+import { warnOrphanedOpenPr } from '../lib/pr-land-detach.js';
 import { isHostPinned, pinHostKey, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
 import { sshResolve } from '../lib/hosts/ssh-config.js';
 import * as fs from 'fs';
@@ -401,6 +402,13 @@ export async function runWorkflowForEach(spec, opts) {
  * the directory and is mutually exclusive with `--cwd`/`--remote-cwd`; both the
  * main dispatch and the `--terminal` handoff need the same answer, so the rule
  * and its error live here once instead of in two places that can drift.
+ *
+ * A project that binds several directories also contributes the ones it is not
+ * landing in as `--add-dir` grants, so an agent on a multi-repo project can
+ * actually reach the sibling checkouts. Claude / Cursor / Kimi take the native
+ * flag; Codex folds them into workspace_roots; Grok widens its sandbox profile
+ * (and always injects a rules note). Other harnesses have no multi-root surface
+ * and ignore the grants (cwd only).
  */
 async function resolveRunCwd(options, opts) {
     if (!options.project)
@@ -409,9 +417,18 @@ async function resolveRunCwd(options, opts) {
         console.error(chalk.red('Pass --project alone — not with --cwd or --remote-cwd.'));
         process.exit(1);
     }
-    const { resolveProjectRef } = await import('../lib/project-root.js');
+    const { resolveProjectDirs } = await import('../lib/project-root.js');
     try {
-        return await resolveProjectRef(options.project, { forRemote: opts.forRemote });
+        const { cwd, extraDirs } = await resolveProjectDirs(options.project, {
+            forRemote: opts.forRemote,
+        });
+        // Explicit --add-dir values keep their position; a directory the project
+        // already contributes is not passed twice.
+        if (extraDirs.length > 0) {
+            const seen = new Set(options.addDir ?? []);
+            options.addDir = [...(options.addDir ?? []), ...extraDirs.filter((d) => !seen.has(d))];
+        }
+        return cwd;
     }
     catch (err) {
         console.error(chalk.red(err.message));
@@ -527,7 +544,7 @@ export function registerRunCommand(program) {
         .option('--allow-expired', 'Inject secrets even if their expiry date has passed (overrides the pre-run expiry abort).')
         .option('--cwd <dir>', 'Working directory for the agent (defaults to current directory). With --host, the directory ON the host.')
         .option('-P, --project <ref>', 'Project shorthand <slug>[@worktree], resolved against your projects root (auto-inferred, cached). Sets the cwd locally or on --host.')
-        .option('--add-dir <dir>', 'Grant access to an additional directory outside the project (Claude and Codex, repeatable)', (val, prev) => [...prev, val], [])
+        .option('--add-dir <dir>', 'Grant access to an additional directory outside the project (Claude, Codex, Cursor, Kimi, Grok; repeatable)', (val, prev) => [...prev, val], [])
         .option('--json', 'Stream events as JSON lines (for parsing by other tools)')
         .option('--quiet', 'Suppress preamble (rotation banner, "Running:" line). Useful when piping JSON events to a parser.', false)
         .option('--headless', 'Force headless mode. Auto-enabled when a prompt is provided; pass explicitly to stay headless with no prompt (reads the prompt from stdin).', false)
@@ -535,7 +552,7 @@ export function registerRunCommand(program) {
         .option('-i, --interactive', 'Force interactive mode even when a prompt is provided. Mutually exclusive with --headless.')
         .option('--resume [id]', 'Recover a previous conversation on its origin device. The exact healthy origin uses native resume; otherwise a healthy version of the same harness replays via /continue. Pair with a prompt to continue headlessly.')
         .option('--session-id <id>', 'Force a NEW conversation to use this exact session UUID (Claude only). This CREATES a session — to resume an existing one, use --resume.')
-        .option('--name <slug>', 'Name the run — seeds the session label so it shows up as `<name>` in `agents sessions` and resolves by it (and `agents hosts logs <name>` for --host runs) instead of an opaque id. An agent-generated title later refines the label; your name shows until then. Optional.')
+        .option('--name <slug>', 'Name the run — seeds the session label so it shows up as `<name>` in `agents sessions` and resolves by it (and `agents logs <name>` for --host runs) instead of an opaque id. An agent-generated title later refines the label; your name shows until then. Optional.')
         .option('--notify', 'Post a desktop notification when a headless run finishes. Fired by this process on exit, so it survives whatever launched the run (the menu bar dispatching it, a terminal you closed).')
         .option('--terminal [backend]', "Open this run in a real terminal tab instead of here. Without a value the terminal is detected from your live sessions (`agents sessions --active` host), so it lands where you already work — Ghostty for a Ghostty user, iTerm for an iTerm user. Name one to force it: iterm | ghostty | terminal | tmux | vscodium-agent. This is how the menu bar's New Session opens.")
         .option('--verbose', 'Show detailed execution logs')
@@ -546,7 +563,7 @@ export function registerRunCommand(program) {
         .option('--fallback <agents>', 'Comma-separated agents to try on rate-limit failure. Each entry accepts an optional @version pin (e.g., codex@0.116.0,antigravity). The primary runs first; if it exits with a rate-limit error, the next agent picks up via /continue handoff.')
         .option('-b, --balanced', 'Shortcut for --strategy balanced. Ignored when @version is pinned.')
         .option('--strategy <strategy>', 'Version/account selection strategy: pinned | available | balanced. Defaults to run.<agent>.strategy, then balanced (spreads load across healthy accounts and skips any that are rate-limited). (Legacy `rotate` accepted as alias for `balanced`.)')
-        .option('--account <label>', 'Run a healthy installed version currently signed into this named account (never falls back to another identity)')
+        .option('--account <name>', 'Use this durable provider credential for the run')
         .option('--acp', 'Route through the Agent Client Protocol instead of direct exec. Supported for claude via @zed-industries/claude-code-acp adapter. Unified event stream; emits ndjson when --json.')
         .option('-y, --yes', 'Skip the interactive budget-confirm prompt (require_confirm_over). Never skips a hard budget block.', false)
         .option('--loop', 'Re-inject the prompt/entrypoint each iteration until a stop condition (issue #332). Guards (--max-iterations, --budget, --until) are enforced outside the agent. Writes a checkpoint after every iteration for --resume-checkpoint.')
@@ -555,11 +572,11 @@ export function registerRunCommand(program) {
         .option('--budget <tokens>', 'Loop token hard-cap: stop once cumulative tokens reach this (stoppedBy: budget), enforced outside the agent. Loop only.')
         .option('--until <signal>', 'Loop stop condition. `signal` reads <runDir>/loop-signal.json {continue,reason} each iteration; absent or continue:false stops (fail-closed). Loop only.')
         .option('--interval <dur>', 'Loop delay between iterations ("0" back-to-back, "30m" paces). Loop only.')
-        .option('--where <spec>', 'Where this run\'s body executes (one placement door): local | device:<name> | auto | lease[:backend] | cloud[:provider]. Expands to --host/--lease/--cloud. Do not combine with those flags. See docs/00-concepts.md#placement.')
-        .option('--host <name>', 'Offload this run onto another machine over SSH — a device name, registered host, or user@host. Pass "auto" to pick the least-loaded reachable device where the requested agent is installed and signed in, keeping the run local when no remote is better. Same as --where device:<name>. See `agents devices`.')
-        .option('--device <name>', 'Alias of --host. Pass "auto" for affinity-based device pick (same as --where auto).')
+        .option('--where <spec>', 'Where this run\'s body executes (one placement door): local | device:<name> | auto | lease[:backend] | cloud[:provider]. Expands to --host/--lease/--cloud. Do not combine with those flags. See docs/concepts.md#placement.')
+        .option('--host <name>', 'Offload this run onto another machine over SSH — a device name, registered host, or user@host. Pass "auto" to pick the least-loaded reachable device with an eligible account; an unavailable or capped pool fails loud. Same as --where device:<name>. See `agents devices`.')
+        .option('--device <name>', 'Alias of --host. Pass "auto" for live health/account-aware device placement.')
         .option('--remote-cwd <dir>', "Explicit host working directory for --host runs, used VERBATIM (overrides --cwd; usually --cwd suffices — it re-roots a local-home path onto the remote home). Pass a single-quoted '$HOME/…' or a valid remote absolute path; a local ~ expands here and won't exist there (/Users/you vs /home/you).")
-        .option('--no-follow', 'With --host, dispatch detached and return immediately (track via `agents hosts ps/logs`).')
+        .option('--no-follow', 'With --host, dispatch detached and return immediately (track via `agents devices ps` and `agents logs`).')
         .option('--any', 'With --host <cap> (a capability tag), pick any matching host instead of erroring when several match.')
         .option('--copy-creds', 'With --host, copy the picked runtime credentials (and Claude OAuth token) to the host, then shred them after the run. Opt-in per run.')
         .option('--lease [backend]', "Run on a cloud box (via crabbox) and tear it down after — reuses a warm box from the repo's profile pool when one is ready (--fresh forces a new box). Optional backend selects the cloud (hetzner/aws/do). Same as --where lease[:backend]. Unlike --host, no machine is registered.")
@@ -609,6 +626,7 @@ export function registerRunCommand(program) {
       # account headroom, then a balanced account on it
       agents run auto "fix the flaky test" --mode edit
       agents run auto --host yosemite-s0 "fix the flaky test"   # pin the host
+      agents run auto --interactive --device auto --strategy balanced --mode auto
 
       # Placement (one door — where the body runs). Old flags still work.
       agents run claude "…" --where device:yosemite-s0   # = --host yosemite-s0
@@ -741,7 +759,7 @@ export function registerRunCommand(program) {
         }
         // Placement: --where expands into --host / --lease / --cloud before any
         // dispatch. One door for "where does the body run?" — old flags remain
-        // aliases. See lib/placement.ts and docs/00-concepts.md#placement.
+        // aliases. See lib/placement.ts and docs/concepts.md#placement.
         {
             const { placementFromRunFlags, expandPlacementToRunFlags, PlacementError } = await import('../lib/placement.js');
             try {
@@ -862,8 +880,15 @@ export function registerRunCommand(program) {
                 ? { kind: 'resolved', session: injectedSource }
                 : await (await import('./sessions.js')).resolveSessionMetadataValue(selector);
             if (outcome.kind === 'partial') {
-                console.error(chalk.red(`Could not resolve session while these devices were unavailable: ${outcome.failedPeers.join(', ')}`));
-                process.exit(2);
+                // RUSH-2492: an unreachable peer is a warning, not a hard failure. The
+                // resolver already resolves an id found on the reachable fleet (SES-9a),
+                // so reaching here means the session was not found on any device we
+                // COULD reach — it may live on an unreachable peer we could not check.
+                const offline = outcome.failedPeers;
+                console.error(chalk.yellow(`Warning: ${offline.length} device(s) unreachable, not checked: ${offline.join(', ')}`));
+                console.error(chalk.red(`No session matching "${selector}" on any reachable device (${offline.length} unreachable, not checked).`));
+                console.error(chalk.gray('  If it lives on an offline box, wake it (agents devices) or run there: agents ssh <device>'));
+                process.exit(1);
             }
             if (outcome.kind === 'not-found') {
                 console.error(chalk.red(`No session matching "${selector}".`));
@@ -953,7 +978,7 @@ export function registerRunCommand(program) {
         }
         // --device auto / --host auto (and deprecated --smart): live fleet pick.
         // Harness is always the agent the user typed — never auto-picked.
-        // Affinity failure degrades to local (does not kill the run).
+        // Placement failure propagates; an automatic request never becomes local.
         {
             const { applyDeviceAutoToOptions } = await import('../lib/smart-launch.js');
             const result = await applyDeviceAutoToOptions(options, {
@@ -967,9 +992,6 @@ export function registerRunCommand(program) {
             if (!options.quiet && result.deprecationSmart) {
                 process.stderr.write(chalk.yellow('[agents] --smart is deprecated; use --device auto\n'));
             }
-            if (!options.quiet && result.skipped) {
-                process.stderr.write(chalk.yellow(`[agents] device=auto skipped: ${result.skipped} (running local)\n`));
-            }
             if (!options.quiet && result.banner) {
                 const { hostLabel, deviceHint, acctNote } = result.banner;
                 process.stderr.write(chalk.gray(`[agents] device=auto → ${hostLabel}` +
@@ -1014,7 +1036,7 @@ export function registerRunCommand(program) {
                 const { runLeaseSetup } = await import('./lease.js');
                 const ok = await runLeaseSetup({ provider: backend ?? 'hetzner' });
                 if (!ok) {
-                    console.error(chalk.yellow('Leasing needs a cloud provider set up. Run `agents lease setup` and retry.'));
+                    console.error(chalk.yellow('Leasing needs a cloud provider set up. Run `agents devices lease setup` and retry.'));
                     process.exit(1);
                 }
             }
@@ -1108,7 +1130,7 @@ export function registerRunCommand(program) {
                 }
                 if (!hasKey) {
                     console.error(chalk.yellow('Tailscale requested but no auth key is configured — falling back to a public-IP lease.'));
-                    console.error(chalk.gray('Set one up with `agents lease setup` (mint an EPHEMERAL, pre-authorized, tag:crabbox key), or store CRABBOX_TAILSCALE_AUTH_KEY in a secrets bundle.'));
+                    console.error(chalk.gray('Set one up with `agents devices lease setup` (mint an EPHEMERAL, pre-authorized, tag:crabbox key), or store CRABBOX_TAILSCALE_AUTH_KEY in a secrets bundle.'));
                     netMode = 'public';
                 }
             }
@@ -1331,7 +1353,7 @@ export function registerRunCommand(program) {
                         process.stderr.write(chalk.dim(log.join('\n')) + '\n');
                 }
                 const keptAddr = boxAddress(box);
-                console.error(chalk.gray(toreDown ? `Box ${box.slug} destroyed.` : `Box ${box.slug} kept${keptAddr ? ` (${keptAddr})` : ''}. Stop it: agents lease stop ${box.slug}`));
+                console.error(chalk.gray(toreDown ? `Box ${box.slug} destroyed.` : `Box ${box.slug} kept${keptAddr ? ` (${keptAddr})` : ''}. Stop it: agents devices lease stop ${box.slug}`));
                 process.exit(exitCode === null ? 1 : exitCode);
             }
             catch (err) {
@@ -1567,6 +1589,9 @@ export function registerRunCommand(program) {
                     const isRaw = options.raw || options.tmux === false || options.disableTmux === true;
                     const { modeForRemoteDispatch } = await import('../lib/codex-policy.js');
                     const forwardedMode = modeForRemoteDispatch(options.mode, command.getOptionValueSource('mode'));
+                    if (process.env.AGENTS_DISPATCH_DEBUG || options.verbose) {
+                        process.stderr.write(chalk.gray(`[hosts] dispatch interactive ${runAgent}${runVersion ? `@${runVersion}` : ''} -> ${host.name}\n`));
+                    }
                     const exitCode = await runInteractiveOnHost(host, {
                         agent: runAgent,
                         version: resumeId ? undefined : runVersion,
@@ -1655,6 +1680,9 @@ export function registerRunCommand(program) {
                 // registration all live in the shared helper (lib/hosts/run-target.ts).
                 const { modeForRemoteDispatch } = await import('../lib/codex-policy.js');
                 const forwardedMode = modeForRemoteDispatch(options.mode, command.getOptionValueSource('mode'));
+                if (process.env.AGENTS_DISPATCH_DEBUG || options.verbose) {
+                    process.stderr.write(chalk.gray(`[hosts] dispatch headless ${runAgent}${runVersion ? `@${runVersion}` : ''} -> ${host.name}\n`));
+                }
                 const { task, exitCode } = await dispatchPromptToHost(host, {
                     agent: runAgent,
                     version: resumeId ? undefined : runVersion,
@@ -1694,7 +1722,7 @@ export function registerRunCommand(program) {
                     const handle = task.name ?? task.id;
                     console.log(chalk.green(`Dispatched to ${host.name}${task.name ? ` as "${task.name}"` : ''}.`) + '\n' +
                         chalk.gray(`  Status:  agents sessions ${handle}`) + chalk.gray('   (compact digest — use this)') + '\n' +
-                        chalk.gray(`  Raw log: agents hosts logs ${handle} -f`) + chalk.gray('   (heavy, only if needed)'));
+                        chalk.gray(`  Raw log: agents logs ${handle} -f`) + chalk.gray('   (heavy, only if needed)'));
                     process.exit(0);
                 }
                 // -1 = the follow window closed but the run continues on the host (the
@@ -1796,12 +1824,16 @@ export function registerRunCommand(program) {
                 cwd: resumeExec.cwd ?? process.cwd(),
                 exitCode: resumeExit,
             });
-            // A resumed loop is always headless; surface any commits it left unpushed.
-            if (shouldWarnUnpushed(resumeExec.mode ?? 'auto', false))
-                await warnUnpushedWork(resumeExec.cwd ?? process.cwd());
+            // A resumed loop is always headless; surface any commits it left unpushed
+            // and any open PR it left unattended (RUSH-2394).
+            if (shouldWarnUnpushed(resumeExec.mode ?? 'auto', false)) {
+                const resumeCwd = resumeExec.cwd ?? process.cwd();
+                await warnUnpushedWork(resumeCwd);
+                await warnOrphanedOpenPr(resumeCwd);
+            }
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError, signInRecoverableCandidates }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, readProfile, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError, signInRecoverableCandidates }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
@@ -1822,6 +1854,8 @@ export function registerRunCommand(program) {
         let agent;
         let version = rawVersion || undefined;
         let profileEnv;
+        let accountEnv;
+        let profileProvider;
         let fromProfile = false;
         let profileFallbackModel;
         let workflowModel;
@@ -1903,6 +1937,7 @@ export function registerRunCommand(program) {
                 if (!version)
                     version = resolved.version;
                 profileEnv = resolved.env;
+                profileProvider = readProfile(rawAgent).provider;
                 profileFallbackModel = resolved.fallbackModel;
                 fromProfile = true;
                 process.stderr.write(chalk.gray(`Resolved custom harness '${resolved.profileName}' -> ${agent}${version ? `@${version}` : ''}\n`));
@@ -2154,17 +2189,16 @@ export function registerRunCommand(program) {
             }
         }
         version = resolveVersionAlias(agent, version);
-        if (options.account) {
+        const { resolveAccountSelection } = await import('../lib/account-registry.js');
+        const configuredAccount = resolveAccountSelection(options.account, agent, readMeta(), { useDefault: !fromProfile });
+        if (configuredAccount) {
             if (options.cloud || options.provider || options.lease) {
-                console.error(chalk.red('--account selects a local installed identity and cannot be combined with cloud or lease placement.'));
+                console.error(chalk.red('--account selects a device-local credential and cannot be combined with cloud or lease placement.'));
                 process.exit(1);
             }
-            const { resolveAccountLabel } = await import('../lib/account-labels.js');
+            const { resolveCredentialAccount } = await import('../lib/account-registry.js');
             try {
-                const selected = await resolveAccountLabel(agent, options.account);
-                if (version && version !== selected)
-                    throw new Error(`${agent}@${version} is not a healthy match for account '${options.account}'.`);
-                version ??= selected;
+                accountEnv = resolveCredentialAccount(configuredAccount, agent, profileProvider).env;
             }
             catch (err) {
                 console.error(chalk.red(err.message));
@@ -2343,7 +2377,7 @@ export function registerRunCommand(program) {
         // the bare primary still resolves through the strategy — otherwise every
         // `agents run claude --fallback codex` run lands on the pinned default
         // account and account rotation silently stops (the gh-monitor heal bug).
-        if (!accountPickerRequested && !options.account && (strategy !== 'pinned' || options.balanced || explicitStrategy)) {
+        if (!accountPickerRequested && !configuredAccount && (strategy !== 'pinned' || options.balanced || explicitStrategy)) {
             if (version) {
                 process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: version ${version} is pinned\n`));
             }
@@ -2661,14 +2695,14 @@ export function registerRunCommand(program) {
         const autoShareEnv = options.autoSecrets !== false
             ? shareRuntimeEnv()
             : undefined;
-        // Merge order (later wins): profile env < auto share token < secrets bundles < --env K=V.
+        // Merge order (later wins): profile env < selected account < auto share token < secrets bundles < --env K=V.
         // Profile carries provider auth; secrets bundles carry user-defined
         // values; --env is the per-invocation override. The share token is
         // best-effort: if it is not already in env or an unlocked bundle, unrelated
         // runs keep working, and `agents share` itself still fails loudly on use.
-        const hasOverrides = profileEnv || autoShareEnv || options.secrets.length > 0 || userEnv;
+        const hasOverrides = profileEnv || accountEnv || autoShareEnv || options.secrets.length > 0 || userEnv;
         const env = hasOverrides
-            ? { ...(profileEnv ?? {}), ...(autoShareEnv ?? {}), ...secretsEnv, ...(userEnv ?? {}) }
+            ? { ...(profileEnv ?? {}), ...(accountEnv ?? {}), ...(autoShareEnv ?? {}), ...secretsEnv, ...(userEnv ?? {}) }
             : undefined;
         const modelSource = runCmd.getOptionValueSource('model');
         let model = options.model
@@ -2839,9 +2873,12 @@ export function registerRunCommand(program) {
                 // Governance chokepoint (#347): the --acp path exits here, bypassing
                 // the normal finalize below — record its one audit entry.
                 recordDispatchedRun({ agent, version: defaultVersion ?? 'unknown', mode, cwd, exitCode });
-                // ACP headless run always has a prompt; surface any unpushed commits.
-                if (shouldWarnUnpushed(mode, false))
+                // ACP headless run always has a prompt; surface any unpushed commits
+                // and any open PR left unattended (RUSH-2394).
+                if (shouldWarnUnpushed(mode, false)) {
                     await warnUnpushedWork(cwd);
+                    await warnOrphanedOpenPr(cwd);
+                }
                 process.exit(exitCode);
             }
             catch (err) {
@@ -2998,9 +3035,12 @@ export function registerRunCommand(program) {
                 // the normal finalize below — record its one audit entry.
                 const loopExit = loopExitCode(result.stoppedBy);
                 recordDispatchedRun({ agent, version: defaultVersion ?? 'unknown', mode, cwd, exitCode: loopExit });
-                // A loop is always headless; surface any commits it left unpushed.
-                if (shouldWarnUnpushed(mode, false))
+                // A loop is always headless; surface any commits it left unpushed
+                // and any open PR left without a durable lander (RUSH-2394).
+                if (shouldWarnUnpushed(mode, false)) {
                     await warnUnpushedWork(cwd);
+                    await warnOrphanedOpenPr(cwd);
+                }
                 process.exit(loopExit);
             }
             catch (err) {
@@ -3045,11 +3085,14 @@ export function registerRunCommand(program) {
             cleanupWorkflowMcpConfig();
             cleanupWorkflowSubagents();
             // Surface committed-but-unpushed work a headless writable run left
-            // behind, so it isn't silently stranded in a worktree. Advisory only,
+            // behind, so it isn't silently stranded in a worktree. Also warn when
+            // the branch still has an OPEN PR (RUSH-2394) — a background
+            // `gh pr checks --watch` dies with the agent. Advisory only,
             // never throws; skipped for interactive runs (the human sees the shell)
             // and read-only plan mode (can't commit).
             if (shouldWarnUnpushed(mode, resolveInteractive(execOptions))) {
                 await warnUnpushedWork(cwd);
+                await warnOrphanedOpenPr(cwd);
             }
             // Governance chokepoint (#347): every dispatched run finalizes here.
             // ONE tamper-evident audit record per run — non-fatal by contract.
@@ -3067,6 +3110,7 @@ export function registerRunCommand(program) {
             // matters most — warn before exiting the error path too.
             if (shouldWarnUnpushed(mode, resolveInteractive(execOptions))) {
                 await warnUnpushedWork(cwd);
+                await warnOrphanedOpenPr(cwd);
             }
             console.error(chalk.red(`Failed to execute ${agent}: ${err.message}`));
             process.exit(1);

package/dist/commands/feed.d.ts

@@ -20,7 +20,7 @@ import { type OpenBlock } from '../lib/feed.js';
 import { type OutcomeGroup, type SessionOutcomeHint } from '../lib/feed-outcome.js';
 import { filterBlocksForFeed } from '../lib/ask-classifier.js';
 import { type FeedSessionSignal } from '../lib/feed-ranking.js';
-export declare const FEED_POST_HELP = "\nExamples:\n  # Title (subject) + body. Phone broadcasts put title first, body after a\n  # blank line, then a \"Sent from agent/session on host\" footer.\n  agents feed post --title \"CHANGELOG pushed\" \"Watching CI and mac-mini E2E\"\n  agents feed post --title \"Cover ready\" \"render at ./out/cover.png\" --attach ./out/cover.png\n  agents feed post --title \"Ready for review\" \"PR opened, waiting on prix-cloud\" --json\n\n  # Worth interrupting someone over - reaches sinks gated on minLevel: important:\n  agents feed post --title \"npm token expired\" \"Cannot publish the release\" --level important\n\n  # Stuck: opens a needs-you block and always broadcasts at important:\n  agents feed post --title \"Force-push denied\" \"git-guard blocked PR #1749\" --blocked\n  agents feed post --title \"Publish or wait?\" \"npm publish now or after review\" --blocked --option publish --option wait\n  agents feed post --title \"Delete preview env?\" \"stale preview still running\" --blocked --default \"leave it\"\n\n  # Exhaust self-serve FIRST. A block is for what you genuinely cannot do:\n  # a credential only the user holds, a decision only they can make, an\n  # approval only they can give. Not \"should I do the obvious next step?\".\n\n  # Outside a run, pass the session explicitly:\n  agents feed post --title \"Manual note\" \"context for the next agent\" --session 00998b0e-2d15-4d2f-a58b-974a886c9b47\n\nIdentity (session, agent, host, runtime, pid, launchId) is stamped automatically\nand rides the phone footer of feed.broadcast {message}. Domain facts (tickets,\nPRs) are not CLI flags - the ticket is joined from the session index at post\ntime. No em-dashes in title/body - they are scrubbed on the way out.\n\nConfigure where a post is mirrored under feed.broadcast in agents.yaml - see\ndocs/06-observability.md. A milestone is always recorded, but it does not text\nthe owner when the sink has minLevel: important. Add --level important for a\nphone-worthy successful update. Use --blocked only when work cannot continue.\nThe owner destination comes from humans.yaml; do not duplicate it in agents.yaml.\n";
+export declare const FEED_POST_HELP = "\nExamples:\n  # Title (subject) + body. Phone broadcasts put title first, body after a\n  # blank line, then a \"Sent from agent/session on host\" footer.\n  agents feed post --title \"CHANGELOG pushed\" \"Watching CI and mac-mini E2E\"\n  agents feed post --title \"Cover ready\" \"render at ./out/cover.png\" --attach ./out/cover.png\n  agents feed post --title \"Ready for review\" \"PR opened, waiting on prix-cloud\" --json\n\n  # Worth interrupting someone over - reaches sinks gated on minLevel: important:\n  agents feed post --title \"npm token expired\" \"Cannot publish the release\" --level important\n\n  # Also raise a local desktop banner on THIS machine (same notifier as run\n  # --notify), on top of any configured broadcast - useful when you are at the box:\n  agents feed post --title \"Build green\" \"all checks passed\" --notify\n\n  # Stuck: opens a needs-you block and always broadcasts at important:\n  agents feed post --title \"Force-push denied\" \"git-guard blocked PR #1749\" --blocked\n  agents feed post --title \"Publish or wait?\" \"npm publish now or after review\" --blocked --option publish --option wait\n  agents feed post --title \"Delete preview env?\" \"stale preview still running\" --blocked --default \"leave it\"\n\n  # Exhaust self-serve FIRST. A block is for what you genuinely cannot do:\n  # a credential only the user holds, a decision only they can make, an\n  # approval only they can give. Not \"should I do the obvious next step?\".\n\n  # Outside a run, pass the session explicitly:\n  agents feed post --title \"Manual note\" \"context for the next agent\" --session 00998b0e-2d15-4d2f-a58b-974a886c9b47\n\nIdentity (session, agent, host, runtime, pid, launchId) is stamped automatically\nand rides the phone footer of feed.broadcast {message}. Domain facts (tickets,\nPRs) are not CLI flags - the ticket is joined from the session index at post\ntime. No em-dashes in title/body - they are scrubbed on the way out.\n\nConfigure where a post is mirrored under feed.broadcast in agents.yaml - see\ndocs/observability.md. A milestone is always recorded, but it does not text\nthe owner when the sink has minLevel: important. Add --level important for a\nphone-worthy successful update. Use --blocked only when work cannot continue.\nThe owner destination comes from humans.yaml; do not duplicate it in agents.yaml.\n";
 export declare const FEED_NO_FANOUT_ENV = "AGENTS_FEED_LOCAL";
 /** Right-hand masthead summary: `N blocks · M agents`. */
 export declare function formatFeedMastheadRight(blocks: OpenBlock[]): string;