@phnx-labs/agents-cli 1.22.40 → 1.22.42

package/dist/commands/sessions-picker-factory.d.ts

@@ -0,0 +1,40 @@
+/** Flag subset both twins share for the interactive-routing gate. */
+export interface SessionsPickerGateOpts {
+    interactive?: boolean;
+    json?: boolean;
+    /** Present only on the browser twin; computer never sets it. */
+    open?: string | boolean;
+}
+export interface SessionsPickerCommandSpec<TRow, TOpts extends SessionsPickerGateOpts> {
+    /**
+     * Browser requires `opts.open === undefined` so `--open` (bare or with a
+     * selector) falls through to the flat printer. Computer has no `--open`.
+     */
+    requireOpenUndefined?: boolean;
+    runFlat: (opts: TOpts) => void;
+    buildRows: (opts: TOpts) => TRow[];
+    emptyMessage: (opts: TOpts) => string;
+    message: string;
+    matches: (row: TRow, query: string) => boolean;
+    labelFor: (row: TRow) => string;
+    buildPreview: (row: TRow) => string;
+    emptyFilterMessage: string;
+    enterHint: string;
+    onOpen: (row: TRow) => void | Promise<void>;
+}
+export interface SessionsPickerCommand<TOpts extends SessionsPickerGateOpts> {
+    shouldOpen: (opts: TOpts, isTTY: boolean) => boolean;
+    run: (opts: TOpts) => Promise<void>;
+}
+export declare function shouldOpenInteractiveSessions(opts: SessionsPickerGateOpts, isTTY: boolean, requireOpenUndefined?: boolean): boolean;
+export declare function browseSessionsUntilQuit<TRow>(spec: {
+    message: string;
+    rows: TRow[];
+    matches: (row: TRow, query: string) => boolean;
+    labelFor: (row: TRow) => string;
+    buildPreview: (row: TRow) => string;
+    emptyFilterMessage: string;
+    enterHint: string;
+    onOpen: (row: TRow) => void | Promise<void>;
+}): Promise<void>;
+export declare function createSessionsPickerCommand<TRow, TOpts extends SessionsPickerGateOpts>(spec: SessionsPickerCommandSpec<TRow, TOpts>): SessionsPickerCommand<TOpts>;

package/dist/commands/sessions-picker-factory.js

@@ -0,0 +1,67 @@
+/**
+ * Shared interactive-routing + browse loop for the task-first session
+ * pickers (`browser-sessions-picker.ts`, `computer-sessions-picker.ts`).
+ *
+ * Each twin keeps its own row formatter, matcher, and enter-handler; this
+ * factory owns the TTY/`--json`/`--no-interactive` (and optional `--open`)
+ * gate, the empty-list message, and the cancel-aware `itemPicker` loop.
+ */
+import { itemPicker } from '../lib/picker.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+export function shouldOpenInteractiveSessions(opts, isTTY, requireOpenUndefined = false) {
+    return (opts.interactive !== false &&
+        !opts.json &&
+        (!requireOpenUndefined || opts.open === undefined) &&
+        isTTY);
+}
+export async function browseSessionsUntilQuit(spec) {
+    for (;;) {
+        let picked;
+        try {
+            picked = await itemPicker({
+                message: spec.message,
+                items: spec.rows,
+                filter: (query) => (query.trim() ? spec.rows.filter((r) => spec.matches(r, query)) : spec.rows),
+                labelFor: spec.labelFor,
+                buildPreview: spec.buildPreview,
+                emptyMessage: spec.emptyFilterMessage,
+                enterHint: spec.enterHint,
+            });
+        }
+        catch (err) {
+            if (isPromptCancelled(err))
+                return;
+            throw err;
+        }
+        if (!picked)
+            return;
+        await spec.onOpen(picked.item);
+    }
+}
+export function createSessionsPickerCommand(spec) {
+    const shouldOpen = (opts, isTTY) => shouldOpenInteractiveSessions(opts, isTTY, spec.requireOpenUndefined === true);
+    return {
+        shouldOpen,
+        run: async (opts) => {
+            if (!shouldOpen(opts, isInteractiveTerminal())) {
+                spec.runFlat(opts);
+                return;
+            }
+            const rows = spec.buildRows(opts);
+            if (rows.length === 0) {
+                console.log(spec.emptyMessage(opts));
+                return;
+            }
+            await browseSessionsUntilQuit({
+                message: spec.message,
+                rows,
+                matches: spec.matches,
+                labelFor: spec.labelFor,
+                buildPreview: spec.buildPreview,
+                emptyFilterMessage: spec.emptyFilterMessage,
+                enterHint: spec.enterHint,
+                onOpen: spec.onOpen,
+            });
+        },
+    };
+}

package/dist/commands/sessions-picker.d.ts

@@ -119,5 +119,6 @@ export declare function buildSessionPreviewDigest(events: SessionEvent[], sessio
 export declare function directoriesTouched(session: SessionMeta, events: SessionEvent[], changes: ReturnType<typeof classifyFileChanges>): string[];
 /** Relativize a file path to its parent dir, short enough for one preview line. */
 export declare function relativizeDir(filePath: string, cwd?: string): string | undefined;
+export declare function renderLastResponse(content: string, maxLines?: number, width?: number): string[];
 /** Show an interactive session picker and return the selected session with its action (resume or view). */
 export declare function sessionPicker(config: SessionPickerConfig): Promise<PickedSession | null>;

package/dist/commands/sessions-picker.js

@@ -17,6 +17,8 @@ import { linkPath, linkUrl, relativeToCwd, shortenModel } from '../lib/session/r
 import { linearIssueUrl } from '../lib/session/linear.js';
 import { extractTodoProgress, WORKTREE_RE } from '../lib/session/state.js';
 import { renderMarkdown } from '../lib/markdown.js';
+import { wrapToWidth } from '../lib/wrap.js';
+import { terminalWidth, stringWidth } from '../lib/session/width.js';
 import { itemPicker } from '../lib/picker.js';
 import { createMemoryCache } from '../lib/memory-cache.js';
 import { classifyFileChanges, changeCounts, toolHistogram, detectTestResult } from '../lib/session/digest.js';
@@ -435,8 +437,6 @@ function formatHeader(session, events) {
     if (totalTokens !== undefined) {
         line3.push(chalk.bold.white(formatTokens(totalTokens)) + chalk.gray(' tokens'));
     }
-    if (session.label)
-        line3.push(chalk.white(session.label));
     if (session.filePath)
         line3.push(chalk.gray(linkPath(session.filePath, session.id)));
     else
@@ -452,7 +452,19 @@ function formatHeader(session, events) {
         const label = session.prNumber ? `PR#${session.prNumber}` : 'PR';
         line4.push(chalk.blue(linkUrl(session.prUrl, label)));
     }
+    // Lead with the session's human title: `session.label` — an agent-generated
+    // name / `/rename`, else the `--name` launch handle. NOT `session.topic`: the
+    // topic is the derived first-prompt, already shown on the `Prompt:` line, so
+    // using it here too would print the same text twice. Unlabelled sessions keep
+    // that `Prompt:` line as their topic indicator and simply lead with the agent
+    // line. Wrapped to the pane (the header sits at column 0, full terminal width);
+    // nothing renders when there is no label.
+    const title = (session.label || '').trim();
+    const titleLines = title
+        ? wrapToWidth(title, terminalWidth()).map(l => chalk.bold.white(l))
+        : [];
     return [
+        ...titleLines,
         line1.join(DOT),
         line2.join(DOT),
         line3.join(DOT),
@@ -821,7 +833,9 @@ function formatCompactPreview(digest, session) {
     }
     if (lastAssistant) {
         const maxLines = todosRendered.length > 0 || compact ? LAST_RESPONSE_MAX_LINES_WITH_TODOS : LAST_RESPONSE_MAX_LINES;
-        const rendered = renderLastResponse(lastAssistant, maxLines);
+        // Content sits at column 4 (outer body indent + the '  ' prefix below), so
+        // wrap it to the pane minus that indent.
+        const rendered = renderLastResponse(lastAssistant, maxLines, terminalWidth() - 4);
         if (rendered.length > 0) {
             lines.push('');
             lines.push(chalk.cyan('Last response:'));
@@ -999,7 +1013,7 @@ export function relativizeDir(filePath, cwd) {
         dir = parts.slice(-3).join('/');
     return dir || undefined;
 }
-function renderLastResponse(content, maxLines = LAST_RESPONSE_MAX_LINES) {
+export function renderLastResponse(content, maxLines = LAST_RESPONSE_MAX_LINES, width = terminalWidth()) {
     const cleaned = stripTags(content).trim();
     if (!cleaned)
         return [];
@@ -1010,7 +1024,15 @@ function renderLastResponse(content, maxLines = LAST_RESPONSE_MAX_LINES) {
     catch {
         rendered = cleaned;
     }
-    const all = rendered.replace(/\s+$/, '').split('\n');
+    // `marked-terminal` runs with `reflowText` off, so a paragraph with no hard
+    // breaks renders as one long line that overflows the pane. Wrap any line whose
+    // VISIBLE width exceeds the budget; leave lines that already fit untouched so
+    // rendered-markdown indentation (lists, code blocks) is preserved. The text is
+    // ANSI-coloured, so width is measured with `stringWidth`, never `String.length`.
+    const all = rendered
+        .replace(/\s+$/, '')
+        .split('\n')
+        .flatMap(line => (stringWidth(line) <= width ? [line] : wrapToWidth(line, width)));
     // Drop leading/trailing empty lines
     while (all.length && !all[0].trim())
         all.shift();

package/dist/commands/sessions-share.d.ts

@@ -0,0 +1,25 @@
+import type { Command } from 'commander';
+import type { SessionMeta } from '../lib/session/types.js';
+import { type PublishOptions } from '../lib/share/publish.js';
+interface ShareOptions {
+    public?: boolean;
+    slug?: string;
+    label?: string;
+    expire?: string;
+    reasoning: string;
+    force?: boolean;
+    cover?: boolean;
+}
+/** `session-<shortId>` — stable per session, so re-sharing updates the same URL. */
+export declare function defaultSessionSlug(session: SessionMeta): string;
+/**
+ * Map the command's flags onto {@link PublishOptions}.
+ *
+ * Extracted so the defaults are testable directly. `unlisted` in particular is the
+ * security-relevant one — it inverts the parent command's public-by-default
+ * behavior, and a test that re-implements this mapping would still pass with it
+ * flipped.
+ */
+export declare function buildSharePublishOptions(session: SessionMeta, options: Pick<ShareOptions, 'public' | 'slug' | 'label' | 'expire' | 'force' | 'cover'>): PublishOptions;
+export declare function registerSessionsShareCommand(sessionsCmd: Command): void;
+export {};

package/dist/commands/sessions-share.js

@@ -0,0 +1,166 @@
+/**
+ * `agents sessions share <id>` — publish one session transcript as a link.
+ *
+ * Composes three pieces that already existed but were never wired together:
+ * `renderSessionMarkdownDocument()` (redacted transcript),
+ * `renderSessionHtmlDocument()` (self-contained branded page), and
+ * `publishFile()` (the R2-backed share Worker). Before this, sharing a session
+ * meant three commands and a detour through the external artifacts-cli.
+ *
+ * Unlisted by default, unlike `agents artifacts share`. A transcript carries file
+ * paths, command output, error text, and whatever a tool printed — strictly more
+ * than a plan does — so it does not belong in the public `/<user>` gallery unless
+ * the operator asks for it with `--public`. The URL itself stays world-readable:
+ * unlisted is a capability URL, not a secret.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import chalk from 'chalk';
+import { setHelpSections } from '../lib/help.js';
+import { knownSecretValuesFromEnv } from '../lib/redact.js';
+import { discoverSessions } from '../lib/session/discover.js';
+import { renderSessionHtmlDocument } from '../lib/session/share-html.js';
+import { publishFile, redactEmails } from '../lib/share/publish.js';
+import { renderSessionMarkdownDocument } from './sessions-render.js';
+import { selectSessions } from './sessions-export.js';
+import { parseAgentFilter } from './sessions.js';
+function parseReasoning(value) {
+    if (value === 'omit' || value === 'fold' || value === 'include')
+        return value;
+    throw new Error(`Unknown reasoning mode "${value}". Expected omit, fold, or include.`);
+}
+/** `session-<shortId>` — stable per session, so re-sharing updates the same URL. */
+export function defaultSessionSlug(session) {
+    return `session-${session.shortId || session.id}`;
+}
+/**
+ * Map the command's flags onto {@link PublishOptions}.
+ *
+ * Extracted so the defaults are testable directly. `unlisted` in particular is the
+ * security-relevant one — it inverts the parent command's public-by-default
+ * behavior, and a test that re-implements this mapping would still pass with it
+ * flipped.
+ */
+export function buildSharePublishOptions(session, options) {
+    return {
+        slug: options.slug ?? defaultSessionSlug(session),
+        unlisted: options.public !== true,
+        expire: options.expire,
+        force: options.force === true,
+        cover: options.cover !== false,
+        label: options.label,
+        meta: { kind: 'session' },
+    };
+}
+export function registerSessionsShareCommand(sessionsCmd) {
+    const cmd = sessionsCmd
+        .command('share <session>')
+        .description('Publish one session as a redacted, self-contained web page and print the link.')
+        .option('--public', 'List the page in your public share gallery (default: unlisted capability URL)')
+        .option('--slug <slug>', 'URL slug under your namespace (default: session-<shortId>)')
+        .option('--label <text>', 'Display title in the gallery and `agents artifacts share list`')
+        .option('--expire <spec>', 'Auto-expire window: 30d, 12h, a date, or never (default: 30d)')
+        .option('--reasoning <mode>', 'Reasoning visibility: omit, fold, or include', 'omit')
+        .option('--force', 'Publish despite the sensitive-content scan flagging the transcript')
+        .option('--no-cover', 'Skip generating the Open Graph preview image');
+    setHelpSections(cmd, {
+        examples: `# Share a session — prints an unlisted, redacted link
+agents sessions share a1b2c3d4
+
+# Put it in your public gallery at share.agents-cli.sh/<you>
+agents sessions share a1b2c3d4 --public --label "How the retry bug got fixed"
+
+# Keep the model's reasoning in collapsible sections
+agents sessions share a1b2c3d4 --reasoning fold
+
+# A link that does not decay
+agents sessions share a1b2c3d4 --expire never`,
+        notes: `Requires a share endpoint: 'agents artifacts share status' shows it, 'agents artifacts setup'
+provisions one, 'agents artifacts share join <baseUrl>' uses an existing one.
+
+Unlisted by default — the URL is world-readable but the page stays out of your public
+gallery and out of 'agents artifacts share list'. Pass --public to list it.
+
+Secrets are redacted and the same pre-publish scan as 'agents artifacts share' runs on the
+page, so a transcript carrying emails or credential-shaped strings is refused
+unless you pass --force. --no-redact (the sessions-level flag) disables redaction
+and is a bad idea for anything you publish.
+
+Re-running with the same session updates the same URL and keeps the prior version
+as a revision ('agents artifacts share revisions <slug>').
+
+Manage published sessions with 'agents artifacts share list' and
+'agents artifacts share delete <slug>'.`,
+    });
+    cmd.action(async (selector, options, command) => {
+        const globals = command.optsWithGlobals();
+        const reasoning = parseReasoning(options.reasoning);
+        const limit = Math.max(1, Number.parseInt(globals.limit || '100', 10) || 100);
+        const agent = parseAgentFilter(globals.agent).agent;
+        const sessions = selectSessions(await discoverSessions({
+            all: globals.all !== false,
+            since: globals.since,
+            limit,
+            agent: agent ?? undefined,
+        }), [selector]);
+        if (sessions.length === 0) {
+            process.stderr.write(chalk.yellow(`No session matched "${selector}".\n`));
+            process.exitCode = 1;
+            return;
+        }
+        // One link per share: several sessions in one page would give the reader no
+        // way to reference just the one that matters, and the slug could only name one.
+        if (sessions.length > 1) {
+            process.stderr.write(chalk.yellow(`"${selector}" matched ${sessions.length} sessions. Share one at a time — pass a full or unique session id.\n`));
+            process.exitCode = 1;
+            return;
+        }
+        const session = sessions[0];
+        const redact = globals.redact !== false;
+        const markdown = renderSessionMarkdownDocument(session, {
+            redact,
+            reasoning,
+            knownSecrets: redact ? knownSecretValuesFromEnv() : undefined,
+        });
+        // Emails on top of what the renderer masks. Almost every real transcript
+        // carries a few — git author addresses, `gh api user`, a pasted log — and
+        // publishToEndpoint refuses a body containing any (RUSH-2428). Masking them
+        // means the published page genuinely does not carry them; the alternative,
+        // telling people to pass --force, would train everyone to bypass the gate
+        // that also catches real credentials.
+        //
+        // Applied to the RENDERED PAGE, not the Markdown, so the text that is masked
+        // is exactly the text `scanShareContent` will scan. Markdown escaping stands
+        // between the two: `foo\@example.com` hides from the pattern in the Markdown
+        // and reappears as a live address once marked drops the backslash.
+        const page = renderSessionHtmlDocument(session, markdown, { redacted: redact });
+        const html = redact ? redactEmails(page) : page;
+        // A real file on disk is what publishFile() takes, and the OG capturer opens
+        // it in a browser. 0600 + a per-run directory keeps the intermediate off a
+        // world-readable /tmp path while it exists.
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-session-share-'));
+        const file = path.join(dir, `${defaultSessionSlug(session)}.html`);
+        try {
+            fs.writeFileSync(file, html, { mode: 0o600 });
+            const result = await publishFile(file, buildSharePublishOptions(session, options));
+            if (globals.json) {
+                process.stdout.write(JSON.stringify({
+                    session: session.id,
+                    agent: session.agent,
+                    redacted: redact,
+                    ...result,
+                }, null, 2) + '\n');
+                return;
+            }
+            process.stdout.write(`${result.url}\n`);
+            const bits = [result.unlisted ? 'unlisted' : 'public', redact ? 'redacted' : chalk.red('NOT redacted')];
+            if (result.expiresAt)
+                bits.push(`expires ${result.expiresAt.slice(0, 10)}`);
+            process.stderr.write(chalk.dim(`${bits.join(' · ')}\n`));
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+}

package/dist/commands/sessions.js

@@ -70,6 +70,7 @@ import { registerAttachCommand } from './attach.js';
 import { registerSessionsInjectCommand } from './sessions-inject.js';
 import { registerSessionsExportCommand } from './sessions-export.js';
 import { registerSessionsRenderCommand } from './sessions-render.js';
+import { registerSessionsShareCommand } from './sessions-share.js';
 import { registerSessionsImportCommand } from './sessions-import.js';
 import { registerSessionsMigrateCommand, registerSessionsMigrationsCommand } from './sessions-migrate.js';
 import { registerSessionsBackfillCommand } from './sessions-backfill.js';
@@ -5173,6 +5174,7 @@ export function registerSessionsCommands(program) {
     registerSessionsInjectCommand(sessionsCmd);
     registerSessionsExportCommand(sessionsCmd);
     registerSessionsRenderCommand(sessionsCmd);
+    registerSessionsShareCommand(sessionsCmd);
     registerSessionsImportCommand(sessionsCmd);
     registerSessionsMigrateCommand(sessionsCmd);
     registerSessionsMigrationsCommand(sessionsCmd);

package/dist/commands/setup-browser.js

@@ -10,11 +10,11 @@
 import chalk from 'chalk';
 import { setConfigValue } from '../lib/device-config.js';
 import { findFirstInstalledBrowser, listInstalledBrowsers } from '../lib/browser/chrome.js';
-import { DEFAULT_BROWSER_PROFILE_NAME, createProfile, findFreeProfilePort, getConfiguredDefaultProfileName, getProfile, } from '../lib/browser/profiles.js';
+import { DEFAULT_BROWSER_PROFILE_NAME, getAutoDetectedProfile, createProfile, findFreeProfilePort, getConfiguredDefaultProfileName, } from '../lib/browser/profiles.js';
 import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { defaultBrowserChoice } from './setup-preferences.js';
-const INSTALL_HINT = 'Install one of: Google Chrome, Brave, Microsoft Edge, Chromium, or Comet, then re-run `agents setup browser`.\n' +
+const INSTALL_HINT = 'Install one of: Google Chrome, Brave, Microsoft Edge, Chromium, Comet, or Arc, then re-run `agents setup browser`.\n' +
     '(Safari and Firefox are not supported — agents browser drives over the Chrome DevTools Protocol.)';
 /**
  * Interactive browser setup. Returns true if a usable default profile exists
@@ -29,9 +29,9 @@ export async function runBrowserWizard() {
             console.error(chalk.red('No supported browser found.\n') + chalk.dim(INSTALL_HINT));
             return false;
         }
-        const existing = await getProfile(DEFAULT_BROWSER_PROFILE_NAME);
+        const existing = await getAutoDetectedProfile();
         if (existing) {
-            console.log(chalk.dim(`Browser profile "${DEFAULT_BROWSER_PROFILE_NAME}" already exists.`));
+            console.log(chalk.dim(`Browser profile "${existing.name}" already exists.`));
             return true;
         }
         const created = await createAutoDefault();
@@ -46,7 +46,7 @@ export async function runBrowserWizard() {
     }
     const { confirm, select } = await import('@inquirer/prompts');
     // If a default profile already exists, this is a reconfigure.
-    const existing = await getProfile(DEFAULT_BROWSER_PROFILE_NAME);
+    const existing = await getAutoDetectedProfile();
     if (existing) {
         console.log(chalk.dim(`Browser profile "${existing.name}" already exists (${existing.browser}${existing.binary ? ` · ${existing.binary}` : ''}).`));
         const change = await confirm({ message: 'Re-create it (e.g. to pin a different browser)?', default: false });

package/dist/commands/setup-mine.js

@@ -11,7 +11,7 @@
 import chalk from 'chalk';
 import { initBrand, registerMineManageCommands } from './mine.js';
 import { validateBrandName, getBrandConfig } from '../lib/brand.js';
-import { isShimsInPath } from '../lib/shims.js';
+import { isShimsInPath } from '../lib/installations/shims.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 /**
  * Optional/heavier top-level commands a brand commonly turns off. Kept short so

package/dist/commands/setup-preferences.js

@@ -14,7 +14,7 @@
  */
 import chalk from 'chalk';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
-import { DEFAULT_BROWSER_PROFILE_NAME, createProfile, findFreeProfilePort, getConfiguredDefaultProfileName, getProfile, } from '../lib/browser/profiles.js';
+import { DEFAULT_BROWSER_PROFILE_NAME, getAutoDetectedProfile, createProfile, findFreeProfilePort, getConfiguredDefaultProfileName, } from '../lib/browser/profiles.js';
 import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
 import { getConfigValue, setConfigValue } from '../lib/device-config.js';
 import { loadDevices } from '../lib/devices/registry.js';
@@ -88,7 +88,7 @@ export async function maybePickBrowserProfile() {
         return false;
     if (getConfiguredDefaultProfileName())
         return false;
-    if (await getProfile(DEFAULT_BROWSER_PROFILE_NAME))
+    if (await getAutoDetectedProfile())
         return false;
     const installed = listInstalledBrowsers();
     if (installed.length === 0)
@@ -115,10 +115,10 @@ export async function maybePickBrowserProfile() {
         viewport: { width: DEFAULT_VIEWPORT.width, height: DEFAULT_VIEWPORT.height },
     };
     await createProfile(profile);
-    // The same key `agents browser profiles set-default` writes (device-local).
+    // The same key `agents browser use` writes (device-local).
     setConfigValue('browser.profile', profile.name);
     console.log(chalk.green(`Browser: '${chosen.browserType}'`) +
-        chalk.dim(` — profile "${profile.name}" is this machine's default (agents browser profiles set-default to change).`));
+        chalk.dim(` — profile "${profile.name}" is this machine's default (agents browser use to change).`));
     return true;
 }
 /**

package/dist/commands/setup.js

@@ -16,7 +16,7 @@ import { isGitRepo, cloneIntoExisting, pullRepo } from '../lib/git.js';
 import { isPromptCancelled, isInteractiveTerminal } from './utils.js';
 import { AGENTS, agentConfigDirName, getUnmanagedAgentInstalls, countSessionFiles, agentLabel } from '../lib/agents.js';
 import { setGlobalDefault } from '../lib/installations/versions.js';
-import { ensureShimCurrent, switchHomeFileSymlinks, isShimsInPath, addShimsToPath, getPathSetupInstructions, assertIsolationBoundary } from '../lib/shims.js';
+import { ensureShimCurrent, switchHomeFileSymlinks, isShimsInPath, addShimsToPath, getPathSetupInstructions, assertIsolationBoundary } from '../lib/installations/shims.js';
 import { setHelpSections } from '../lib/help.js';
 import { registerSetupBrowserCommand, runBrowserWizard } from './setup-browser.js';
 import { registerSetupComputerCommand, runComputerWizard } from './setup-computer.js';
@@ -26,7 +26,7 @@ import { registerSetupSecretsCommand } from './setup-secrets.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
 import { registerSetupWatchdogCommand, runWatchdogSetupWizard } from './setup-watchdog.js';
 import { runPreferencesStep } from './setup-preferences.js';
-import { getConfiguredDefaultProfileName, getProfile, isProfileLaunchableHere, DEFAULT_BROWSER_PROFILE_NAME } from '../lib/browser/profiles.js';
+import { getConfiguredDefaultProfileName, getProfile, getAutoDetectedProfile, isProfileLaunchableHere } from '../lib/browser/profiles.js';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
 import { probeComputerTrust } from './computer.js';
 import { readShareConfig } from '../lib/share/config.js';
@@ -265,7 +265,9 @@ export async function ensureInitialized(program) {
 }
 export async function getSetupStatus() {
     const configuredBrowserProfile = getConfiguredDefaultProfileName();
-    const browserProfile = await getProfile(configuredBrowserProfile ?? DEFAULT_BROWSER_PROFILE_NAME);
+    const browserProfile = configuredBrowserProfile
+        ? await getProfile(configuredBrowserProfile)
+        : await getAutoDetectedProfile();
     const browserReady = browserProfile !== null && isProfileLaunchableHere(browserProfile);
     const installedBrowsers = listInstalledBrowsers();
     const computerState = process.platform === 'darwin' ? (await probeComputerTrust() ? 'ready' : 'missing') : 'n/a';

package/dist/commands/sync.js

@@ -36,7 +36,7 @@ import { resolveSyncPassphraseFromEnv } from '../lib/secrets/sync-passphrase.js'
 import { agentLabel, resolveAgentName, MANAGED_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../lib/agents.js';
 import { isVersionInstalled, syncResourcesToVersion, parseAgentSpec, resolveVersion, resolveVersionAlias, listInstalledVersions, getAvailableResources, getActuallySyncedResources, getProjectOnlyResources, getNewResources, hasNewResources, promptResourceSelection, promptNewResourceSelection, buildSelection, mergeRepoScopedSelections, listRepoNames, getVersionHomePath, } from '../lib/installations/versions.js';
 import { capableAgents } from '../lib/capabilities.js';
-import { parseHookManifest, registerHooksToSettings } from '../lib/hooks.js';
+import { parseHookManifest, registerHooksToSettings } from '../lib/hooks/install.js';
 import { compileRulesForProject } from '../lib/rules/compile.js';
 import { runLaunchSync } from '../lib/project-launch.js';
 import { formatKeptProjectResources } from '../lib/project-resources.js';

package/dist/commands/versions.js

@@ -11,7 +11,7 @@ import { resolveConfiguredModel, formatAgentIdentity } from '../lib/models.js';
 import { readManifest, writeManifest, createDefaultManifest } from '../lib/manifest.js';
 import { installVersion, removeVersion, listInstalledVersions, isVersionInstalled, isLatestInstalled, isOldestInstalled, getGlobalDefault, setGlobalDefault, markVersionIsolated, setIsolatedDefault, isVersionIsolated, getVersionHomePath, getVersionDir, syncResourcesToVersion, parseAgentSpec, promptResourceSelection, promptNewResourceSelection, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, printTrashFooter, } from '../lib/installations/versions.js';
 import { carryForwardSettings } from '../lib/settings-manifest.js';
-import { createShim, createVersionedAlias, supportsIsolatedInstall, isIsolationProtected, CONFIG_ENV_ISOLATED_AGENTS, removeShim, shimExists, getShimsDir, getShimPath, getPathShadowingExecutable, isShimsInPath, getPathSetupInstructions, addShimsToPath, switchConfigSymlink, switchHomeFileSymlinks, } from '../lib/shims.js';
+import { createShim, createVersionedAlias, supportsIsolatedInstall, isIsolationProtected, CONFIG_ENV_ISOLATED_AGENTS, removeShim, shimExists, getShimsDir, getShimPath, getPathShadowingExecutable, isShimsInPath, getPathSetupInstructions, addShimsToPath, switchConfigSymlink, switchHomeFileSymlinks, } from '../lib/installations/shims.js';
 import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
 import { tryAutoPull } from '../lib/git.js';
 import { getAgentsDir, getTrashVersionsDir } from '../lib/state.js';

package/dist/commands/view.js

@@ -11,7 +11,7 @@ import { authCacheKey, formatCheckedAge, readAuthHealthCache } from '../lib/auth
 import { agentReportsUsage, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, isUsageHeadlessScopeError, } from '../lib/accounting/usage.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, isVersionIsolated, getIsolatedDefault, } from '../lib/installations/versions.js';
-import { ensureVersionedAliasCurrent, removeShim, } from '../lib/shims.js';
+import { ensureVersionedAliasCurrent, removeShim, } from '../lib/installations/shims.js';
 import { getAgentResources } from '../lib/resources.js';
 import { renderMergedResources } from '../lib/merged-resources.js';
 import { resolveVersionFilter, AgentSpecError } from '../lib/agent-spec/index.js';

package/dist/commands/webhook.js

@@ -25,8 +25,10 @@ function readWebhookSecrets(bundleName) {
         secrets.github = env.GITHUB_WEBHOOK_SECRET;
     if (env.LINEAR_WEBHOOK_SECRET)
         secrets.linear = env.LINEAR_WEBHOOK_SECRET;
-    if (!secrets.github && !secrets.linear) {
-        throw new Error(`Bundle '${bundleName}' must contain GITHUB_WEBHOOK_SECRET or LINEAR_WEBHOOK_SECRET.`);
+    if (env.SLACK_SIGNING_SECRET)
+        secrets.slack = env.SLACK_SIGNING_SECRET;
+    if (!secrets.github && !secrets.linear && !secrets.slack) {
+        throw new Error(`Bundle '${bundleName}' must contain GITHUB_WEBHOOK_SECRET, LINEAR_WEBHOOK_SECRET, or SLACK_SIGNING_SECRET.`);
     }
     return secrets;
 }
@@ -36,8 +38,8 @@ export function registerWebhooksCommand(program) {
         .description('Run a localhost signed webhook receiver for routine triggers.');
     webhooks
         .command('serve')
-        .description('Receive signed GitHub/Linear webhooks on /hooks/<source> and fire matching routines.')
-        .requiredOption('--secrets-bundle <name>', 'agents secrets bundle containing GITHUB_WEBHOOK_SECRET and/or LINEAR_WEBHOOK_SECRET')
+        .description('Receive signed GitHub/Linear/Slack webhooks on /hooks/<source> and fire matching routines and handlers.')
+        .requiredOption('--secrets-bundle <name>', 'agents secrets bundle containing GITHUB_WEBHOOK_SECRET, LINEAR_WEBHOOK_SECRET, and/or SLACK_SIGNING_SECRET')
         .option('--bind <addr>', `Bind address (default ${DEFAULT_HOST})`, DEFAULT_HOST)
         .option('-p, --port <n>', `Local port (default ${DEFAULT_PORT})`, String(DEFAULT_PORT))
         .option('--rate-limit <n>', 'Accepted deliveries per source per minute', '60')
@@ -61,12 +63,15 @@ export function registerWebhooksCommand(program) {
                 // Durable delivery dedup: replays survive a receiver restart (an
                 // in-memory store would forget every seen delivery on restart).
                 deliveryStore: createFileDeliveryStore(path.join(getRuntimeStateDir(), 'webhook', 'deliveries.json')),
-                onDelivery: (webhook, fired, handlers) => {
+                // Logged at MATCH time, before dispatch — a `run.command` handler can
+                // block on a shelled-out agent run for minutes, and that must never
+                // delay the log that says a delivery fired (RUSH-2722).
+                onMatch: (webhook, matchedJobNames, matchedHandlerNames) => {
                     const parts = [];
-                    if (fired.length)
-                        parts.push(`routines ${fired.map((f) => f.jobName).join(', ')}`);
-                    if (handlers.length)
-                        parts.push(`handlers ${handlers.map((h) => h.handlerName).join(', ')}`);
+                    if (matchedJobNames.length)
+                        parts.push(`routines ${matchedJobNames.join(', ')}`);
+                    if (matchedHandlerNames.length)
+                        parts.push(`handlers ${matchedHandlerNames.join(', ')}`);
                     console.log(`${new Date().toISOString()} ${webhook.source}:${webhook.event} ` +
                         (parts.length ? `fired ${parts.join('; ')}` : 'no match'));
                 },

package/dist/lib/account-capabilities.d.ts

@@ -24,6 +24,16 @@ export declare const NATIVE_ACCOUNT_CAPABILITIES: Record<AgentId, NativeAccountC
 export declare function nativeAccountCapability(agent: AgentId): NativeAccountCapability;
 /** Whether a harness's native login can be named/attached (supported or conditional). */
 export declare function nativeAccountNameable(agent: AgentId): boolean;
+/** Harnesses whose native login is fully nameable/attachable today. */
+export declare function supportedNativeHarnesses(): AgentId[];
+/**
+ * Named reason to refuse native name/attach, or null when the harness is
+ * nameable. Provider-credential `accounts add` is a different path and MUST
+ * not consult this — that surface is supported for every registered provider.
+ */
+export declare function nativeAccountNamingRefusal(agent: AgentId): string | null;
+/** Fail loud on the native name/attach path for an unsupported harness. */
+export declare function assertNativeAccountNameable(agent: AgentId): void;
 /**
  * The single identity key used at `accounts name`, attach, exec validation,
  * view, and inventory. Prefer the harness's stable `accountKey`. For an