@phnx-labs/agents-cli 1.22.35 → 1.22.38

package/dist/lib/routines.js

@@ -373,15 +373,14 @@ function overlayUserRoutineDevices(job, userJob) {
 /**
  * List all job configs, scanning project > user > system routine dirs.
  * Higher layers shadow lower ones of the same name (first-seen wins): a project
- * routine shadows a user routine, and a user routine shadows a built-in system
- * routine (`~/.agents/.system/routines/`, shipped via gh:phnx-labs/.agents-system).
+ * routine shadows a user routine, and a user routine shadows a system routine
+ * (`~/.agents/.system/routines/`, shipped via gh:phnx-labs/.agents-system).
  * When a same-name project routine wins for inspection, the user-layer
  * `devices` allowlist is overlaid only if the project routine does not declare
  * its own allowlist, so CWD project discovery cannot hide an operational fleet
  * pin or erase a project-authored one.
  * Project discovery is opt-in via `cwd`; the daemon (which calls `listJobs()`
- * with no argument) sees user + system routines, so a built-in routine fires for
- * every install unless the user overrides or disables it by name.
+ * with no argument) sees user + system routines.
  */
 export function listJobs(cwd) {
     ensureAgentsDir();
@@ -421,8 +420,7 @@ export function listJobs(cwd) {
  * the project routine does not declare its own allowlist, for the same reason
  * as listJobs().
  * Project discovery is opt-in via `cwd`; daemon callers pass no argument and
- * resolve user + system routines (a user routine of the same name shadows a
- * built-in system routine).
+ * resolve user + system routines.
  */
 export function readJob(name, cwd) {
     ensureAgentsDir();
@@ -458,29 +456,51 @@ function readJobFromDir(dir, name) {
     }
     return null;
 }
-function readJobFile(filePath) {
+/**
+ * Read one routine file, preserving WHY it failed.
+ *
+ * `readJobFile` collapses all four fail-closed paths to `null`, which is right
+ * for the loaders (an inert routine must not run) but leaves a broken routine
+ * invisible in every view — the one routine an operator most needs to see. Same
+ * reading, reason kept, for diagnostic surfaces like `agents inspect --routines`.
+ */
+export function readJobFileResult(filePath) {
+    let content;
     try {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        const parsed = yaml.parse(content);
-        if (!parsed || typeof parsed !== 'object')
-            return null;
-        // Fail closed on the legacy singular `device` key. A routine that still
-        // carries it after v12 startup migration is unmigrated state and must be
-        // treated as unavailable/inert rather than unrestricted.
-        if (Object.prototype.hasOwnProperty.call(parsed, 'device'))
-            return null;
-        // Fail closed on a malformed `devices` too. Ownership treats a non-array as
-        // "no pin", and the daemon's load path never calls validateJob — so a YAML
-        // typo (`devices: yosemite-s0` instead of a list) would silently promote the
-        // routine to fleet-wide and fire it on EVERY box. Inert-and-loud beats
-        // unrestricted-and-silent.
-        if (Object.prototype.hasOwnProperty.call(parsed, 'devices')
-            && parsed.devices !== undefined
-            && parsed.devices !== null
-            && !Array.isArray(parsed.devices)) {
-            return null;
-        }
-        return {
+        content = fs.readFileSync(filePath, 'utf-8');
+    }
+    catch (err) {
+        return { config: null, problem: `unreadable: ${err.message}` };
+    }
+    let parsed;
+    try {
+        parsed = yaml.parse(content);
+    }
+    catch (err) {
+        return { config: null, problem: `invalid YAML: ${err.message.split('\n')[0]}` };
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        return { config: null, problem: 'not a YAML map' };
+    }
+    // Fail closed on the legacy singular `device` key. A routine that still
+    // carries it after v12 startup migration is unmigrated state and must be
+    // treated as unavailable/inert rather than unrestricted.
+    if (Object.prototype.hasOwnProperty.call(parsed, 'device')) {
+        return { config: null, problem: 'legacy `device:` key — inert until migrated to `devices:`' };
+    }
+    // Fail closed on a malformed `devices` too. Ownership treats a non-array as
+    // "no pin", and the daemon's load path never calls validateJob — so a YAML
+    // typo (`devices: yosemite-s0` instead of a list) would silently promote the
+    // routine to fleet-wide and fire it on EVERY box. Inert-and-loud beats
+    // unrestricted-and-silent.
+    if (Object.prototype.hasOwnProperty.call(parsed, 'devices')
+        && parsed.devices !== undefined
+        && parsed.devices !== null
+        && !Array.isArray(parsed.devices)) {
+        return { config: null, problem: '`devices:` must be a list — routine is inert' };
+    }
+    return {
+        config: {
             ...JOB_DEFAULTS,
             ...parsed,
             name: parsed.name || path.basename(filePath).replace(/\.ya?ml$/, ''),
@@ -488,11 +508,12 @@ function readJobFile(filePath) {
             // A new built-in definition with no `enabled:` field stays opt-in until
             // setup materializes this host's routines list.
             enabled: Object.prototype.hasOwnProperty.call(parsed, 'enabled') ? parsed.enabled !== false : false,
-        };
-    }
-    catch {
-        return null;
-    }
+        },
+        problem: null,
+    };
+}
+function readJobFile(filePath) {
+    return readJobFileResult(filePath).config;
 }
 /** Write a job config to disk, omitting fields that match defaults.
  *
@@ -589,7 +610,12 @@ export function serializeJob(output, existingText) {
         if (!(key in output))
             doc.delete(key);
     }
-    return doc.toString();
+    // `flowCollectionPadding: false` keeps a re-serialized flow sequence in the
+    // committed no-padding form (`[a, b]`, not `[ a, b ]`). Routine YAML lives in
+    // the same git-backed `~/.agents` repo as agents.yaml, so the same emitter
+    // padding would leave the tracked file dirty and block `agents repo pull`
+    // fleet-wide (RUSH-2505). Node styles are otherwise preserved.
+    return doc.toString({ flowCollectionPadding: false });
 }
 /** Delete a job config file by name. Returns true if the file existed. */
 export function deleteJob(name) {
@@ -617,6 +643,9 @@ export function setJobEnabled(name, enabled) {
 export function migrateLegacyRoutineActivation() {
     if (enabledRoutineNames() !== null)
         return false;
+    // Legacy activation migration preserves FILE-BACKED routines' old
+    // `enabled:`/`devices:` state into the device manifest. A box with zero
+    // routines never grows a manifest here (nothing enabled or pinned to seed).
     const jobs = listJobs();
     if (!jobs.some((job) => job.enabled || Array.isArray(job.devices)))
         return false;
@@ -1290,6 +1319,35 @@ export function discoverJobsFromRepo(repoPath) {
 export function jobExists(name) {
     return readJob(name) !== null;
 }
+/**
+ * True when `sourcePath` already IS the canonical user-layer file for `name`.
+ *
+ * `agents routines add <file>` copies a definition into the routines dir, but
+ * users routinely point it at the file that already lives there — the release
+ * train's own `~/.agents/routines/release-train.yml`. `writeJob` would then
+ * re-serialize that file in place and, per {@link serializeJob}, delete every
+ * key absent from the canonical output — silently dropping the legacy
+ * `devices:` pin from config tracked in the git-backed `~/.agents` repo
+ * (RUSH-2517). Callers use this to skip the write when there is nothing to
+ * copy.
+ *
+ * Compares real paths so a symlinked `~/.agents` (the normal layout) still
+ * matches, and falls back to a resolved-path compare when either side cannot be
+ * realpath'd.
+ */
+export function isCanonicalRoutineSource(sourcePath, name) {
+    const jobsDir = getRoutinesDir();
+    const real = (p) => {
+        try {
+            return fs.realpathSync(p);
+        }
+        catch {
+            return path.resolve(p);
+        }
+    };
+    const source = real(sourcePath);
+    return ['.yml', '.yaml'].some((ext) => real(safeJoin(jobsDir, name + ext)) === source);
+}
 /** Get the filesystem path of a job's YAML config file, or null if not found. */
 export function getJobPath(name) {
     const jobsDir = getRoutinesDir();

package/dist/lib/run-defaults.d.ts

@@ -12,6 +12,7 @@
  *         mode: plan
  */
 import type { AgentId, Mode, RunConfig, RunDefaults } from './types.js';
+export declare const VERSION_RE: RegExp;
 export interface ParsedRunDefaultSelector {
     agent: AgentId;
     version: string;
@@ -42,4 +43,8 @@ export declare function formatRunDefaultEntry(entry: RunDefaultEntry): string;
 export declare function listRunDefaults(): RunDefaultEntry[];
 export declare function setRunDefault(selectorInput: string, defaultsInput: RunDefaultsInput): RunDefaultEntry;
 export declare function unsetRunDefault(selectorInput: string): boolean;
+/** Convenience setters used by `agents config` for single-field updates. */
+export declare function setRunDefaultModel(selectorInput: string, model: string): RunDefaultEntry;
+export declare function setRunDefaultMode(selectorInput: string, mode: string): RunDefaultEntry;
+export declare function setRunDefaultEffort(selectorInput: string, effort: string): RunDefaultEntry;
 export {};

package/dist/lib/run-defaults.js

@@ -16,7 +16,7 @@ import { AGENTS } from './agents.js';
 import { readMeta, updateMeta } from './state.js';
 import { getProjectRunConfigs } from './run-config.js';
 import chalk from 'chalk';
-const VERSION_RE = /^(?:\*|latest|(?!.*\.\.)[A-Za-z0-9._+-]{1,64})$/;
+export const VERSION_RE = /^(?:\*|latest|(?!.*\.\.)[A-Za-z0-9._+-]{1,64})$/;
 const RUN_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max', 'auto'];
 function isAgentId(value) {
     return value in AGENTS;
@@ -208,3 +208,13 @@ export function unsetRunDefault(selectorInput) {
     });
     return removed;
 }
+/** Convenience setters used by `agents config` for single-field updates. */
+export function setRunDefaultModel(selectorInput, model) {
+    return setRunDefault(selectorInput, { model });
+}
+export function setRunDefaultMode(selectorInput, mode) {
+    return setRunDefault(selectorInput, { mode });
+}
+export function setRunDefaultEffort(selectorInput, effort) {
+    return setRunDefault(selectorInput, { effort });
+}

package/dist/lib/runner.d.ts

@@ -14,10 +14,11 @@
  * fires once with the pre-flight pick).
  */
 import type { JobConfig, RunMeta } from './routines.js';
+import { readMeta } from './state.js';
 import type { AgentId } from './types.js';
 import { type FallbackEntry } from './exec.js';
 import type { LoopDeps } from './loop.js';
-import { resolveRunVersion, type RotateResult } from './rotate.js';
+import { resolveRunVersion, resolveAccountVersion, type RotateResult } from './rotate.js';
 /** Result of a completed job execution, including metadata and optional report. */
 export interface RunResult {
     meta: RunMeta;
@@ -43,7 +44,7 @@ export interface RoutineTrigger {
  */
 export declare function routineSpawnCwd(config: Pick<JobConfig, 'name' | 'project' | 'cwd' | 'agent' | 'workflow' | 'command'>): string;
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
-export declare function buildJobCommand(config: JobConfig, resolvedPrompt: string): string[];
+export declare function buildJobCommand(config: JobConfig, resolvedPrompt: string, forwardAccount?: boolean): string[];
 /**
  * Record every transcript file already present in the child's transcript dirs BEFORE
  * the run spawns. When the transcript lands in a shared per-version home, this baseline
@@ -61,6 +62,8 @@ export interface RoutineLaunchPlan {
     rotation: RotateResult | null;
     /** True when `config.version` pinned the target (no rotation). */
     pinned: boolean;
+    /** False when `account` names a harness-native login rather than a durable credential. */
+    forwardAccount?: boolean;
 }
 /**
  * Resolve the version/account chain for a routine the same way `agents run`
@@ -73,13 +76,12 @@ export interface RoutineLaunchPlan {
  */
 export declare function resolveRoutineLaunch(config: JobConfig, cwd?: string, deps?: {
     resolveRunVersion?: typeof resolveRunVersion;
-    readAccountLabels?: () => {
-        labels: Record<string, {
-            agent: AgentId;
-            fingerprint: string;
-        }>;
+    resolveAccountVersion?: typeof resolveAccountVersion;
+    findCredentialAccount?: (name: string) => boolean;
+    readMeta?: typeof readMeta;
+    resolveCredentialAccount?: (name: string, host: AgentId) => {
+        env: Record<string, string>;
     };
-    resolveAccountLabel?: (agent: AgentId, label: string) => Promise<string>;
 }): Promise<RoutineLaunchPlan>;
 /**
  * Rewrite `cmd[0]` to the absolute binary for `agent@version` when installed.

package/dist/lib/runner.js

@@ -17,13 +17,15 @@ import { spawn, execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { getCliLaunch, getAgentsBinDir } from './cli-entry.js';
 import { resolveJobPrompt, parseTimeout, writeRunMeta, listRuns, getJobRunsDir, getRunDir, checkJobDeviceEligibility, finalizeRunMeta, resolveJobExecutionContext, slotRunId, claimRunSlot, readRunMeta, resolveHostStrategy, } from './routines.js';
-import { getRunsDir, getUserAgentsDir } from './state.js';
+import { getRunsDir, getUserAgentsDir, readMeta } from './state.js';
 import { shortCodexHome } from './codex-home.js';
 import { prepareJobHome, buildSpawnEnv, getJobHomePath } from './sandbox.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
-import { createTimer, redactPrompt } from './events.js';
+import { createTimer, redactPrompt, emitRoutineEnd } from './events.js';
 import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
+import { applyAddDirs } from './add-dir.js';
 import { normalizeMode, resolveHeadlessMode, buildExecEnv, detectRateLimit, detectAuthFailure, isAuthFailureFromLog, authFailureReason, } from './exec.js';
 import { resolveActor } from './actor.js';
 import { loadTask as loadHostTask } from './hosts/tasks.js';
@@ -369,13 +371,15 @@ export function routineSpawnCwd(config) {
     return ctx.absoluteCwd ?? os.homedir();
 }
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
-export function buildJobCommand(config, resolvedPrompt) {
+export function buildJobCommand(config, resolvedPrompt, forwardAccount = true) {
     // Workflow branch: delegate to `agents run <workflow>` which handles subagent
     // injection, WORKFLOW.md orchestration, and model selection via frontmatter.
     // appendModelAndReasoning is intentionally skipped — the workflow frontmatter
     // owns model selection. No --timeout flag: the runner enforces its own SIGTERM/SIGKILL.
     if (config.workflow) {
         const cmd = ['agents', 'run', config.workflow, resolvedPrompt, '--mode', config.mode];
+        if (config.account && forwardAccount)
+            cmd.push('--account', config.account);
         return cmd;
     }
     // Past the workflow branch this is an agent (or resume) job — command jobs never
@@ -387,7 +391,10 @@ export function buildJobCommand(config, resolvedPrompt) {
     // so a self-scheduled wake (e.g. /hibernate) is handled by the session that scheduled
     // it, not a fresh, context-less agent that would refuse an "opaque" instruction.
     if (config.resume) {
-        return ['agents', 'run', agent, '--resume', config.resume, resolvedPrompt, '--mode', config.mode];
+        const cmd = ['agents', 'run', agent, '--resume', config.resume, resolvedPrompt, '--mode', config.mode];
+        if (config.account && forwardAccount)
+            cmd.push('--account', config.account);
+        return cmd;
     }
     const template = AGENT_COMMANDS[agent];
     if (!template) {
@@ -413,18 +420,6 @@ export function buildJobCommand(config, resolvedPrompt) {
             if (pmIndex !== -1)
                 cmd.splice(pmIndex, 2, '--dangerously-skip-permissions');
         }
-        if (config.allow?.dirs) {
-            for (const dir of config.allow.dirs) {
-                // Reject leading '-' so a routine YAML can't smuggle an argv flag like
-                // `--dangerously-skip-permissions` past the sandbox by hiding it as an
-                // allow.dirs entry.
-                if (dir.startsWith('-')) {
-                    throw new Error(`allow.dirs entries must not start with '-': ${JSON.stringify(dir)}`);
-                }
-                const resolved = dir.replace(/^~/, os.homedir());
-                cmd.push('--add-dir', resolved);
-            }
-        }
         appendModelAndReasoning(cmd, config);
     }
     if (config.agent === 'codex') {
@@ -500,6 +495,20 @@ export function buildJobCommand(config, resolvedPrompt) {
         // edit: default on-request approval + sandbox
         appendModelAndReasoning(cmd, config);
     }
+    // allow.dirs → harness-specific grants. Codex is handled in its branch above
+    // (workspace_roots). Claude / Kimi / Cursor take --add-dir; Grok gets rules
+    // (+ sandbox widen when GROK_SANDBOX is on). Reject leading '-' so a routine
+    // YAML can't smuggle an argv flag past the sandbox as an allow.dirs entry.
+    if (config.allow?.dirs?.length && agent !== 'codex') {
+        for (const dir of config.allow.dirs) {
+            if (dir.startsWith('-')) {
+                throw new Error(`allow.dirs entries must not start with '-': ${JSON.stringify(dir)}`);
+            }
+        }
+        applyAddDirs(agent, cmd, config.allow.dirs, {
+            cwd: routineSpawnCwd(config),
+        });
+    }
     return cmd;
 }
 /**
@@ -676,17 +685,59 @@ function buildShellCommand(command) {
  * Real (un-sandboxed) environment for a command routine. Command routines do
  * `npm i -g` / `git pull` and need the actual $HOME / $PATH, not the sandbox
  * overlay. Only TZ is injected when the routine pins a timezone.
+ *
+ * The current binary's directory is prepended to PATH so bare `agents` invocations
+ * resolve to the same install on Windows (where shell-function injection is not
+ * available) and as a fallback on POSIX for invocations like `command agents`.
  */
 function commandSpawnEnv(config) {
     const env = { ...process.env };
     if (config.timezone)
         env.TZ = config.timezone;
+    const sep = process.platform === 'win32' ? ';' : ':';
+    const binDir = getAgentsBinDir();
+    const existing = env.PATH ?? '';
+    if (!existing.split(sep).includes(binDir)) {
+        env.PATH = existing ? `${binDir}${sep}${existing}` : binDir;
+    }
     return env;
 }
 /** POSIX single-quote a string so it is safe to embed in a `/bin/sh -c` script. */
 function shSingleQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
 }
+/**
+ * Build a POSIX shell function that forwards `agents <sub...>` to the SAME binary
+ * currently running. Command routines shell out to the bare name `agents`
+ * (e.g. `agents repo pull system`); without this, the routine resolves `agents`
+ * through its inherited PATH, which can pick up a stale install in an nvm/system
+ * Node prefix that shadows the current binary (RUSH-2431).
+ *
+ * Uses getCliLaunch so the relaunch is correct for both JS installs
+ * (`node <entry> <sub...>`) and compiled standalone binaries (`<bin> <sub...>`).
+ */
+function agentsShellFunction() {
+    const launch = getCliLaunch(['__ac_placeholder__']);
+    const parts = [launch.command];
+    // JS installs: getCliLaunch returns [node, entryScript, placeholder].
+    // Standalone: it returns [binary, placeholder].
+    if (launch.args.length > 0 && launch.args[0] !== '__ac_placeholder__' && fs.existsSync(launch.args[0])) {
+        parts.push(launch.args[0]);
+    }
+    const invocation = parts.map(shSingleQuote).join(' ');
+    return `agents() { ${invocation} "$@"; }`;
+}
+/**
+ * Wrap a command-routine shell string so any bare `agents` invocation resolves
+ * to the current binary. On POSIX this injects an `agents` shell function; on
+ * Windows it is left unchanged and commandSpawnEnv prepends the current binary's
+ * directory to PATH instead.
+ */
+function wrapCommandRoutine(command) {
+    if (process.platform === 'win32')
+        return command;
+    return `${agentsShellFunction()}\n${command}`;
+}
 /**
  * Detached command routines write their own exit code to `<runDir>/exit-code`
  * (see the wrapper in executeCommandJobDetached). `monitorRunningJobs` reads it
@@ -721,6 +772,31 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
     // resolveRoutineLaunch is only called for agent jobs (workflow returns above;
     // command jobs branch out of execute*Job before reaching this).
     const agent = config.agent;
+    const { findAccount, resolveAccountSelection, resolveCredentialAccount } = await import('./account-registry.js');
+    const explicitCredential = config.account
+        ? (deps.findCredentialAccount?.(config.account) ?? (deps.resolveCredentialAccount !== undefined || findAccount(config.account) !== null))
+        : false;
+    const selectedCredential = config.account
+        ? (explicitCredential ? config.account : undefined)
+        : resolveAccountSelection(undefined, agent, (deps.readMeta ?? readMeta)());
+    if (selectedCredential) {
+        (deps.resolveCredentialAccount ?? resolveCredentialAccount)(selectedCredential, agent);
+    }
+    if (config.account && !explicitCredential) {
+        const accountVersion = await (deps.resolveAccountVersion ?? resolveAccountVersion)(agent, config.account);
+        if (accountVersion) {
+            if (config.version && config.version !== accountVersion) {
+                throw new Error(`Routine '${config.name}' account '${config.account}' is signed in at ${agent}@${accountVersion}, not pinned ${agent}@${config.version}.`);
+            }
+            return {
+                chain: [{ agent, version: config.version ?? accountVersion }],
+                rotation: null,
+                pinned: true,
+                forwardAccount: false,
+            };
+        }
+        throw new Error(`Routine '${config.name}' account '${config.account}' is not signed in for ${agent}; refusing to rotate to another account.`);
+    }
     if (config.version) {
         const version = config.version;
         if (!isVersionInstalled(agent, version)) {
@@ -730,26 +806,9 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
             chain: [{ agent, version }],
             rotation: null,
             pinned: true,
+            ...(config.account ? { forwardAccount: explicitCredential } : {}),
         };
     }
-    // Account pin: resolve the login identity to the version slot that holds it and
-    // run pinned — no rotation, no failover onto other accounts — so concurrent
-    // unattended routines never share (and mutually revoke) one single-use OAuth
-    // credential (RUSH-1957). Falls through to the strategy only when the account
-    // is not signed in on this box, with a loud warning rather than a silent stall.
-    if (config.account) {
-        const { readAccountLabels, resolveAccountLabel } = await import('./account-labels.js');
-        if ((deps.readAccountLabels ?? readAccountLabels)().labels[config.account]) {
-            const version = await (deps.resolveAccountLabel ?? resolveAccountLabel)(agent, config.account);
-            return { chain: [{ agent, version }], rotation: null, pinned: true };
-        }
-        const version = await resolveAccountVersion(agent, config.account);
-        if (version) {
-            return { chain: [{ agent, version }], rotation: null, pinned: true };
-        }
-        process.stderr.write(`[agents] routine ${config.name}: account '${config.account}' is not signed in for ${agent}; ` +
-            `falling back to strategy — pin a signed-in account to stop OAuth-rotation revocation\n`);
-    }
     const strategy = getConfiguredRunStrategy(agent, cwd);
     let version;
     let rotation = null;
@@ -1051,6 +1110,14 @@ async function executeJobPlaced(config, deps, attempt) {
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
     // (command jobs branched out earlier, so config.agent is set on the non-workflow path.)
     const effectiveAgent = config.workflow ? 'claude' : config.agent;
+    if (!dispatchesViaAgentsRun(config)) {
+        const { findAccount, resolveAccountSelection, resolveCredentialAccount } = await import('./account-registry.js');
+        const selectedAccount = config.account && !findAccount(config.account)
+            ? undefined
+            : resolveAccountSelection(config.account, effectiveAgent, readMeta());
+        if (selectedAccount)
+            Object.assign(baseEnv, resolveCredentialAccount(selectedAccount, effectiveAgent).env);
+    }
     const meta = {
         jobName: config.name,
         runId,
@@ -1129,7 +1196,7 @@ async function executeJobPlaced(config, deps, attempt) {
     }
     // Single-shot path: build the command once, then walk the launch chain on
     // rate/usage-limit failures (same detectRateLimit patterns as agents run).
-    const baseCmd = buildJobCommand(config, resolvedPrompt);
+    const baseCmd = buildJobCommand(config, resolvedPrompt, launch.forwardAccount !== false);
     const stdoutPath = path.join(runDir, 'stdout.log');
     // Truncate the log for a clean run; failover attempts append.
     fs.writeFileSync(stdoutPath, '', { mode: 0o600 });
@@ -1425,7 +1492,7 @@ async function executeCommandJobForeground(config, attempt) {
     };
     writeRunMeta(meta);
     const timeoutMs = parseTimeout(config.timeout) || 10 * 60 * 1000;
-    const cmd = buildShellCommand(config.command);
+    const cmd = buildShellCommand(wrapCommandRoutine(config.command));
     const env = commandSpawnEnv(config);
     process.stderr.write(`[agents] routine ${config.name}: running command\n`);
     const result = await new Promise((resolve) => {
@@ -1508,10 +1575,14 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
         const target = resolvePlacementTarget(config);
         if (target.mode === 'host') {
             const { meta } = await executeJobOnHost({ ...config, host: target.host }, { detached: true }, attempt);
+            if (meta.status !== 'running')
+                emitRoutineEnd(meta);
             return meta;
         }
         if (target.mode === 'cloud') {
             const { meta } = await executeJobOnCloud(config, { detached: true }, attempt);
+            if (meta.status !== 'running')
+                emitRoutineEnd(meta);
             return meta;
         }
     }
@@ -1535,7 +1606,7 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
         schedule: config.schedule,
     });
     const resolvedPrompt = resolveJobPrompt(config);
-    let cmd = buildJobCommand(config, resolvedPrompt);
+    let cmd = buildJobCommand(config, resolvedPrompt, launch.forwardAccount !== false);
     // workflow AND resume dispatch through `agents run` — never binary-pin them (pinning
     // rewrites cmd[0] to the agent binary → broken `<binary> run …`).
     if (!dispatchesViaAgentsRun(config) && version && config.agent) {
@@ -1555,6 +1626,14 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
     const baseEnv = injectRoutineActor(useSandbox
         ? buildSpawnEnv(overlayHome, config.env)
         : { ...process.env }, config);
+    if (!dispatchesViaAgentsRun(config)) {
+        const { findAccount, resolveAccountSelection, resolveCredentialAccount } = await import('./account-registry.js');
+        const selectedAccount = config.account && !findAccount(config.account)
+            ? undefined
+            : resolveAccountSelection(config.account, config.agent, readMeta());
+        if (selectedAccount)
+            Object.assign(baseEnv, resolveCredentialAccount(selectedAccount, config.agent).env);
+    }
     const spawnEnv = dispatchesViaAgentsRun(config)
         ? (() => {
             const e = { ...baseEnv };
@@ -1701,10 +1780,11 @@ function executeCommandJobDetached(config, attempt, hooks) {
     const exitCodePath = path.join(runDir, 'exit-code');
     // Run the command in a SUBSHELL `( … )` so that if it calls `exit`, only the
     // subshell exits — the outer shell still captures `$?` and writes the file.
+    const wrappedCommand = wrapCommandRoutine(config.command);
     const cmd = process.platform === 'win32'
-        ? buildShellCommand(config.command)
+        ? buildShellCommand(wrappedCommand)
         : ['/bin/sh', '-c',
-            `(\n${config.command}\n)\n__ac_rc=$?; printf '%s' "$__ac_rc" > ${shSingleQuote(exitCodePath)} 2>/dev/null; exit $__ac_rc`];
+            `(\n${wrappedCommand}\n)\n__ac_rc=$?; printf '%s' "$__ac_rc" > ${shSingleQuote(exitCodePath)} 2>/dev/null; exit $__ac_rc`];
     const env = commandSpawnEnv(config);
     const meta = {
         jobName: config.name,
@@ -1905,6 +1985,7 @@ function finalizeHostRun(meta) {
             return;
         finalizeRunMeta(meta, healed.status, healed.exitCode ?? (healed.status === 'completed' ? 0 : 1), { completedAt: healed.finishedAt ?? undefined });
         writeRunMeta(meta);
+        emitRoutineEnd(meta);
     }
     catch { /* unreachable host or unreadable sidecar — retry next sweep */ }
 }
@@ -2004,6 +2085,7 @@ export function monitorRunningJobs() {
                     terminateRoutineTree(meta.pid);
                     finalizeRunMeta(meta, 'timeout', null, { errorMessage: 'exceeded configured timeout' });
                     writeRunMeta(meta);
+                    emitRoutineEnd(meta);
                     if (!isCommandRun) {
                         extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
                         archiveRoutineTranscripts(meta, runDirPath);
@@ -2030,6 +2112,7 @@ export function monitorRunningJobs() {
                         }
                     }
                     writeRunMeta(meta);
+                    emitRoutineEnd(meta);
                     if (!isCommandRun) {
                         extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
                         archiveRoutineTranscripts(meta, runDirPath);

package/dist/lib/secrets/agent.d.ts

@@ -30,6 +30,12 @@ import { type SecretLease } from './lease.js';
 export { GLOBAL_HARNESS, bundleScopeChain };
 /** Default lifetime of an unlocked bundle when `--ttl` is not given. */
 export declare const DEFAULT_TTL_MS: number;
+/**
+ * Whether the secrets broker service is enabled in the daemon service config.
+ * Off-darwin this is irrelevant (the broker is never used), but the helper is
+ * kept synchronous and safe everywhere so callers can fail loud without a prompt.
+ */
+export declare function isSecretsBrokerEnabled(): boolean;
 /**
  * Reserved store-key prefix for the `secrets list` metadata snapshot cache.
  * The broker holds the resolved bundle-metadata array (names/policy/timestamps,
@@ -144,6 +150,7 @@ export type Request = {
     ttlMs: number;
     lease?: SecretLease;
     token?: string;
+    snapshotAt?: number;
 } | {
     cmd: 'lock';
     name?: string;
@@ -206,7 +213,7 @@ export type Response = {
  */
 export declare function realBundleCount(store: Map<string, StoredBundle>): number;
 export declare function scopedBundleKey(name: string, harness: string): string;
-export declare function handleAgentRequest(store: Map<string, StoredBundle>, req: Request, now?: number): Response;
+export declare function handleAgentRequest(store: Map<string, StoredBundle>, req: Request, now?: number, evictedAt?: Map<string, number>): Response;
 /**
  * Decide whether a `watch-lock` helper line should wipe the in-memory store.
  * The helper emits `LOCK` on screen-lock / screensaver and `SLEEP` on system
@@ -451,7 +458,7 @@ export declare function clampHoldMs(v: unknown): number;
  * The worker reuses the robust `ensureAgentRunning` path (spawn-then-ping) rather
  * than a tight inline retry loop. Best-effort; never throws. macOS only.
  */
-export declare function agentAutoLoadSync(name: string, bundle: SecretsBundle, env: Record<string, string>, ttlMs: number, harness?: string, lease?: SecretLease): void;
+export declare function agentAutoLoadSync(name: string, bundle: SecretsBundle, env: Record<string, string>, ttlMs: number, harness?: string, lease?: SecretLease, snapshotAt?: number): void;
 /**
  * Body of the hidden `secrets _agent-load` worker. Reads one `{name, bundle,
  * env, ttlMs}` payload from stdin, ensures the broker is up (robust, generous
@@ -466,7 +473,7 @@ export declare function agentAutoLoadSync(name: string, bundle: SecretsBundle, e
  */
 export declare function runAgentLoadFromStdin(): Promise<void>;
 /** Store a resolved bundle in the broker. Returns false on transport failure. */
-export declare function agentLoad(name: string, bundle: SecretsBundle, env: Record<string, string>, ttlMs: number, harness?: string, lease?: SecretLease): Promise<boolean>;
+export declare function agentLoad(name: string, bundle: SecretsBundle, env: Record<string, string>, ttlMs: number, harness?: string, lease?: SecretLease, snapshotAt?: number): Promise<boolean>;
 /** Wipe one bundle (or all if name omitted) from the broker. Returns the count
  * wiped, or 0 when no broker is running. */
 export declare function agentLock(name?: string): Promise<number>;