@phnx-labs/agents-cli 1.22.41 → 1.22.43

package/dist/lib/project-key.js

@@ -58,8 +58,8 @@ export function repoRootForCwd(dir, home = os.homedir()) {
         // Never climb past $HOME: an ancestor of home (/tmp, /, ...) is not part of
         // any project this cwd belongs to, and treating one as the repo root would
         // let unrelated host state (e.g. a stray /tmp/.git) swallow every loose
-        // directory under home. Mirrors the shim's own home boundary — see
-        // shims.ts shimExecTail.
+        // directory under home. Mirrors the shim's own home boundary — see the codex
+        // adapter's shimExecTail (lib/harness/adapters/codex.ts).
         if (current === stop)
             return undefined;
         const parent = path.dirname(current);

package/dist/lib/project-launch.js

@@ -86,7 +86,7 @@ export function runLaunchSync(opts) {
 }
 /**
  * Path of the shim's skip-fast sentinel for this (agent, version, cwd) tuple.
- * Must match the SHIM-SIDE format in src/lib/shims.ts (PROJECT_SLUG derivation),
+ * Must match the SHIM-SIDE format in src/lib/installations/shims.ts (PROJECT_SLUG derivation),
  * which is the canonical `toPortableKey` mapping: drop the Windows drive colon
  * and fold `\`, `/`, and ` ` → `_`. On POSIX this is byte-identical to the old
  * `/` and ` ` → `_` slug; on Windows it yields a legal filename (no `C:\`).

package/dist/lib/refresh.js

@@ -20,8 +20,8 @@ import { readManifest, MANIFEST_FILENAME } from './manifest.js';
 import { getUserAgentsDir } from './state.js';
 import { installVersion, listInstalledVersions, isVersionIsolated, getGlobalDefault, setGlobalDefault, getVersionHomePath, syncResourcesToVersion, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, promptResourceSelection, resolveConfiguredAgentTargets, } from './installations/versions.js';
 import { listCliStatus, installCli, describeMethod, describeCheck, selectInstallMethod, } from './cli-resources.js';
-import { ensureShimCurrent, isShimsInPath, addShimsToPath, getPathSetupInstructions, switchConfigSymlink, switchHomeFileSymlinks, } from './shims.js';
-import { parseHookManifest, registerHooksToSettings } from './hooks.js';
+import { ensureShimCurrent, isShimsInPath, addShimsToPath, getPathSetupInstructions, switchConfigSymlink, switchHomeFileSymlinks, } from './installations/shims.js';
+import { parseHookManifest, registerHooksToSettings } from './hooks/install.js';
 import { isPromptCancelled } from './format.js';
 /**
  * Old repo layout stored promptcuts under claude/promptcuts.yaml (agent-scoped).

package/dist/lib/resource-inventory.d.ts

@@ -18,7 +18,7 @@
  * muse), Grok hooks.json, and Kimi config.toml via checkVersionHookWiring.
  */
 import type { AgentId } from './types.js';
-import { type HookWiringReport } from './hooks.js';
+import { type HookWiringReport } from './hooks/install.js';
 /** Resource kinds the inventory can report. Only 'hooks' is implemented so far
  *  (RUSH-2238); the remaining kinds land with their follow-up tickets. */
 export type InventoryKind = 'hooks' | 'skills' | 'commands' | 'plugins' | 'mcp';

package/dist/lib/resource-inventory.js

@@ -20,7 +20,7 @@
 import { AGENTS } from './agents.js';
 import { supports } from './capabilities.js';
 import { listResources } from './resources.js';
-import { checkVersionHookWiring, listHooksInVersionHome, listInstalledHooksWithScope, } from './hooks.js';
+import { checkVersionHookWiring, listHooksInVersionHome, listInstalledHooksWithScope, } from './hooks/install.js';
 const IMPLEMENTED_KINDS = ['hooks'];
 /**
  * The single inventory API. Harness-scoped (claude/codex/grok/kimi/droid) —

package/dist/lib/rules/rules.js

@@ -10,7 +10,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { AGENTS, ALL_AGENT_IDS, agentConfigDirName } from '../agents.js';
 import { getResolvedRulesDir, getUserRulesDir, getProjectAgentsDir } from '../state.js';
-import { getEffectiveHome } from '../installations/versions.js';
+import { getEffectiveHome } from '../installations/store.js';
 /**
  * Central rules filename constant.
  * All agents map to this file in ~/.agents/rules/, renamed per-agent when synced.

package/dist/lib/sandbox.d.ts

@@ -7,6 +7,14 @@
  * access to explicitly allowed paths.
  */
 import type { JobConfig } from './scheduling/routines.js';
+/**
+ * Absolute path to this host's `gh` config directory (`hosts.yml` + `config.yml`),
+ * or null when the host has never run `gh auth login`. Prefer `GH_CONFIG_DIR` when
+ * the parent already pinned one; otherwise `$XDG_CONFIG_HOME/gh` or `~/.config/gh`.
+ */
+export declare function resolveHostGhConfigDir(): string | null;
+/** True when this host holds usable GitHub CLI auth (hosts.yml or a token env). */
+export declare function hostHasGhAuth(): boolean;
 /** Build a restricted environment for a sandboxed process, setting HOME to the overlay. */
 export declare function buildSpawnEnv(overlayHome: string, extraEnv?: Record<string, string>): Record<string, string>;
 /**
@@ -21,6 +29,22 @@ export declare function buildSpawnEnv(overlayHome: string, extraEnv?: Record<str
 export declare function getJobHomePath(name: string): string;
 /** Create a fresh overlay HOME for a job, including agent config and allowed-dir symlinks. */
 export declare function prepareJobHome(config: JobConfig): string;
+/**
+ * Link this host's `gh` config directory into the disposable overlay so
+ * `$HOME/.config/gh` resolves even when `GH_CONFIG_DIR` is unset. Mirrors
+ * `generateCursorConfig`: same-host credentials, never copied to another box.
+ */
+export declare function linkHostGhConfig(overlayHome: string): void;
+/**
+ * Refuse to launch a sandboxed child when THIS host holds GitHub auth but the
+ * spawn env would hide it. The RUSH-2860 failure mode was silent: the monitor
+ * fire recorded `ok` (spawn succeeded) while every `gh` call inside the child
+ * failed. Prefer forwarding (buildSpawnEnv / linkHostGhConfig); this assert is
+ * the regression tripwire — if forwarding ever regresses, fail loud at spawn
+ * instead of recording a hollow success. No-ops when the host has no gh auth
+ * (jobs that do not need GitHub still run).
+ */
+export declare function assertSandboxForwardsHostGhAuth(spawnEnv: Record<string, string>): void;
 /** Link this host's Cursor login and CLI config into the disposable overlay. */
 export declare function generateCursorConfig(overlayHome: string): void;
 /** Remove a job's overlay HOME directory entirely. */

package/dist/lib/sandbox.js

@@ -43,6 +43,14 @@ const ENV_ALLOWLIST = [
     'VISUAL',
     'NO_COLOR',
     'FORCE_COLOR',
+    // GitHub CLI — same host credentials interactive `agents run` already sees.
+    // Without these, a sandboxed monitor `--run` child has no gh auth even when
+    // the daemon user is logged in (RUSH-2860).
+    'GH_TOKEN',
+    'GH_HOST',
+    'GH_ENTERPRISE_TOKEN',
+    'GITHUB_TOKEN',
+    'GH_CONFIG_DIR',
 ];
 /** Tools safe to grant as wildcards (no filesystem access). */
 const SAFE_TOOLS = {
@@ -57,6 +65,32 @@ function tomlString(value) {
     }
     return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }
+/**
+ * Absolute path to this host's `gh` config directory (`hosts.yml` + `config.yml`),
+ * or null when the host has never run `gh auth login`. Prefer `GH_CONFIG_DIR` when
+ * the parent already pinned one; otherwise `$XDG_CONFIG_HOME/gh` or `~/.config/gh`.
+ */
+export function resolveHostGhConfigDir() {
+    // Honor an explicit pin only when it actually exists; otherwise fall through
+    // to the default locations so a stale/broken GH_CONFIG_DIR cannot hide a
+    // healthy ~/.config/gh (RUSH-2860).
+    if (process.env.GH_CONFIG_DIR && fs.existsSync(process.env.GH_CONFIG_DIR)) {
+        return process.env.GH_CONFIG_DIR;
+    }
+    const configHome = process.env.XDG_CONFIG_HOME || path.join(resolveRealHome(), '.config');
+    const ghDir = path.join(configHome, 'gh');
+    return fs.existsSync(ghDir) ? ghDir : null;
+}
+/** True when this host holds usable GitHub CLI auth (hosts.yml or a token env). */
+export function hostHasGhAuth() {
+    if (process.env.GH_TOKEN || process.env.GH_ENTERPRISE_TOKEN || process.env.GITHUB_TOKEN) {
+        return true;
+    }
+    const dir = resolveHostGhConfigDir();
+    if (!dir)
+        return false;
+    return fs.existsSync(path.join(dir, 'hosts.yml'));
+}
 /** Build a restricted environment for a sandboxed process, setting HOME to the overlay. */
 export function buildSpawnEnv(overlayHome, extraEnv) {
     const env = {
@@ -68,6 +102,18 @@ export function buildSpawnEnv(overlayHome, extraEnv) {
             env[key] = process.env[key];
         }
     }
+    // Pin GH_CONFIG_DIR at the REAL host config so `gh` does not look under the
+    // disposable overlay HOME (which has no hosts.yml). Same posture as linking
+    // Cursor's auth.json — forward the credentials the daemon user already holds
+    // (RUSH-2860). Always prefer resolveHostGhConfigDir over a stale allowlisted
+    // value; an explicit extraEnv GH_CONFIG_DIR still wins below.
+    const hostGh = resolveHostGhConfigDir();
+    if (hostGh) {
+        env.GH_CONFIG_DIR = hostGh;
+    }
+    else {
+        delete env.GH_CONFIG_DIR;
+    }
     if (extraEnv) {
         Object.assign(env, extraEnv);
     }
@@ -101,11 +147,66 @@ export function prepareJobHome(config) {
     else if (config.agent === 'cursor') {
         generateCursorConfig(overlayHome);
     }
+    // Host tool credentials / setup the overlay HOME would otherwise hide.
+    // Cursor already links its own auth above; gh is harness-agnostic and needed
+    // by every sandboxed `--run` that shells out to `gh` (RUSH-2860 — monitor
+    // merge agents saw "not logged into any GitHub hosts" while the daemon user
+    // was fine).
+    //
+    // Deliberately NOT linking the real ~/.agents here. It would put the secrets
+    // master key (.secrets-key) and the encrypted store (.cache/secrets) together
+    // at a predictable path inside the overlay, through a writable symlink, in a
+    // child whose prompt can carry untrusted text from a watched source. The
+    // separate "agents-cli is not set up" defect (state.ts ignores AGENTS_USER_DIR)
+    // gets its own scoped change: RUSH-2954.
+    linkHostGhConfig(overlayHome);
     if (config.allow?.dirs) {
         symlinkAllowedDirs(overlayHome, config.allow.dirs);
     }
     return overlayHome;
 }
+/**
+ * Link this host's `gh` config directory into the disposable overlay so
+ * `$HOME/.config/gh` resolves even when `GH_CONFIG_DIR` is unset. Mirrors
+ * `generateCursorConfig`: same-host credentials, never copied to another box.
+ */
+export function linkHostGhConfig(overlayHome) {
+    const realGhDir = resolveHostGhConfigDir();
+    if (!realGhDir || !fs.existsSync(realGhDir))
+        return;
+    const overlayGhDir = path.join(overlayHome, '.config', 'gh');
+    if (fs.existsSync(overlayGhDir))
+        return;
+    fs.mkdirSync(path.dirname(overlayGhDir), { recursive: true });
+    try {
+        createLink(realGhDir, overlayGhDir);
+    }
+    catch {
+        /* cross-volume or link creation refused: GH_CONFIG_DIR in buildSpawnEnv is the backup */
+    }
+}
+/**
+ * Refuse to launch a sandboxed child when THIS host holds GitHub auth but the
+ * spawn env would hide it. The RUSH-2860 failure mode was silent: the monitor
+ * fire recorded `ok` (spawn succeeded) while every `gh` call inside the child
+ * failed. Prefer forwarding (buildSpawnEnv / linkHostGhConfig); this assert is
+ * the regression tripwire — if forwarding ever regresses, fail loud at spawn
+ * instead of recording a hollow success. No-ops when the host has no gh auth
+ * (jobs that do not need GitHub still run).
+ */
+export function assertSandboxForwardsHostGhAuth(spawnEnv) {
+    if (!hostHasGhAuth())
+        return;
+    if (spawnEnv.GH_TOKEN || spawnEnv.GH_ENTERPRISE_TOKEN || spawnEnv.GITHUB_TOKEN)
+        return;
+    if (spawnEnv.GH_CONFIG_DIR && fs.existsSync(path.join(spawnEnv.GH_CONFIG_DIR, 'hosts.yml')))
+        return;
+    if (spawnEnv.HOME && fs.existsSync(path.join(spawnEnv.HOME, '.config', 'gh', 'hosts.yml')))
+        return;
+    throw new Error("sandbox spawn would hide this host's GitHub auth from the child " +
+        '(no GH_CONFIG_DIR / ~/.config/gh / GH_TOKEN). Refusing to launch — ' +
+        'the agent would record ok then fail every gh call (RUSH-2860).');
+}
 /** Link this host's Cursor login and CLI config into the disposable overlay. */
 export function generateCursorConfig(overlayHome) {
     const realConfigHome = process.env.XDG_CONFIG_HOME || path.join(resolveRealHome(), '.config');

package/dist/lib/scheduling/routines.d.ts

@@ -107,8 +107,14 @@ export interface JobConfig {
     schedule?: string;
     /** Event/webhook fire condition. Optional when `schedule` is set. */
     trigger?: JobTrigger;
-    /** Which agent runs the routine. Optional — omitted for `workflow`/`command` routines. Exactly one of agent/workflow/command must be set. */
-    agent?: AgentId;
+    /**
+     * Which agent runs the routine — a native harness id, or the name of a
+     * custom harness (`agents harness list`), which the runner delegates to
+     * `agents run <name>` the same way workflow jobs are. Optional — omitted
+     * for `workflow`/`command` routines. Exactly one of agent/workflow/command
+     * must be set.
+     */
+    agent?: AgentId | (string & {});
     workflow?: string;
     /**
      * A plain shell command run directly instead of an agent/workflow — no LLM,
@@ -298,16 +304,16 @@ export interface JobConfig {
      * `lib/monitors/config.ts`) — re-gating here was double-gating on the wrong
      * key.
      *
-     * Deliberately narrow: a monitor's `routine` action fires a REAL routine, which
-     * keeps its activation gate, so a routine defined but not activated on this
-     * device is still refused.
+     * Deliberately narrow: a monitor's or webhook handler's `routine` action fires a
+     * REAL routine, which keeps its activation gate, so a routine defined but not
+     * activated on this device is still refused.
      *
      * Runtime-only, enforced at both ends of the schema boundary: `writeJob`
      * strips it, and `readJobFileResult` refuses a definition that carries it
      * (a hand-authored one would otherwise fire on every box regardless of
      * activation, since the daemon's load path never calls `validateJob`).
      */
-    dispatchedBy?: 'monitor';
+    dispatchedBy?: 'monitor' | 'webhook';
 }
 /**
  * Canonical form of a routine's `projects` field: drop non-string and empty
@@ -399,7 +405,7 @@ export declare function resolveJobExecutionContext(config: Pick<JobConfig, 'name
 export interface RunMeta {
     jobName: string;
     runId: string;
-    agent?: AgentId;
+    agent?: AgentId | (string & {});
     /**
      * Resolved agent version this run launched under. Re-pointed to each failover
      * attempt's version as the single-shot chain advances (runner.ts), so it names
@@ -504,10 +510,13 @@ export declare function finalizeRunMeta(meta: RunMeta, status: RunMeta['status']
  * `yosemite-s0` all agree. Every fire path (cron scheduler, webhook,
  * catchup/overdue, manual run) gates on this.
  *
- * A monitor-dispatched job ({@link JobConfig.dispatchedBy} `=== 'monitor'`) skips
+ * A monitor- or webhook-dispatched job ({@link JobConfig.dispatchedBy} set) skips
  * the routine activation manifest: it is not a routine, so its name can never be
  * a member and the lookup could only ever answer "not activated here"
- * (RUSH-2681). Its ownership was already decided by the monitor's `device:` pin.
+ * (RUSH-2681 for monitors; the same hole broke every `run.agent`/`run.workflow`
+ * webhook handler, which the receiver logged as `fired` while the run record read
+ * `skipped` with an empty allowlist). Ownership was already decided upstream — by
+ * the monitor's `device:` pin, or by the one box the webhook was delivered to.
  */
 export declare function jobRunsOnThisDevice(config: Pick<JobConfig, 'name' | 'devices' | 'dispatchedBy'>): boolean;
 /**

package/dist/lib/scheduling/routines.js

@@ -14,6 +14,7 @@ import { getRoutinesDir, getSystemRoutinesDir, getRunsDir, ensureAgentsDir, getP
 import * as os from 'os';
 import { safeJoin, isSafeSegmentName } from '../paths.js';
 import { isSafeProjectName, loadProjectDef, projectBasePath } from '../projects.js';
+import { isCustomHarnessName } from '../profiles.js';
 import { resolveRoutineExecutionContext, } from '../routine-context.js';
 import { atomicWriteFileSync } from '../fs-atomic.js';
 import { ALL_AGENT_IDS, ROUTINE_AGENT_IDS } from '../agents.js';
@@ -25,7 +26,7 @@ import { enabledRoutineNames, devicesWithRoutineEnabled, replaceEnabledRoutines,
 import { humanizeCron, humanizeNextRun } from '../routines-format.js';
 import { discoverProjectRoutines } from '../routines-project.js';
 import { listProjectDefs } from '../projects.js';
-import { monitorRunningJobs } from '../runner.js';
+import { monitorRunningJobs } from '../daemon/runner.js';
 import { JobScheduler } from '../scheduler.js';
 import { detectOverdueJobs } from '../overdue.js';
 export function fireConditionLabel(job) {
@@ -351,13 +352,16 @@ export function finalizeRunMeta(meta, status, exitCode, opts) {
  * `yosemite-s0` all agree. Every fire path (cron scheduler, webhook,
  * catchup/overdue, manual run) gates on this.
  *
- * A monitor-dispatched job ({@link JobConfig.dispatchedBy} `=== 'monitor'`) skips
+ * A monitor- or webhook-dispatched job ({@link JobConfig.dispatchedBy} set) skips
  * the routine activation manifest: it is not a routine, so its name can never be
  * a member and the lookup could only ever answer "not activated here"
- * (RUSH-2681). Its ownership was already decided by the monitor's `device:` pin.
+ * (RUSH-2681 for monitors; the same hole broke every `run.agent`/`run.workflow`
+ * webhook handler, which the receiver logged as `fired` while the run record read
+ * `skipped` with an empty allowlist). Ownership was already decided upstream — by
+ * the monitor's `device:` pin, or by the one box the webhook was delivered to.
  */
 export function jobRunsOnThisDevice(config) {
-    if (config.dispatchedBy !== 'monitor') {
+    if (config.dispatchedBy === undefined) {
         const activated = routineEnabledOnThisDevice(config.name);
         if (activated !== null)
             return activated;
@@ -636,7 +640,7 @@ export function readJobFileResult(filePath) {
     // written back (writeJob deletes it), so its presence here means hand-authored
     // state, not drift.
     if (Object.prototype.hasOwnProperty.call(parsed, 'dispatchedBy')) {
-        return { config: null, problem: '`dispatchedBy:` is a runtime-only monitor marker, not a routine field — routine is inert' };
+        return { config: null, problem: '`dispatchedBy:` is a runtime-only monitor/webhook marker, not a routine field — routine is inert' };
     }
     return {
         config: {
@@ -844,13 +848,17 @@ export function validateJob(config) {
     if (config.command !== undefined && (typeof config.command !== 'string' || config.command.trim() === '')) {
         errors.push('command must be a non-empty shell command string');
     }
-    if (hasAgent && config.agent && !ALL_AGENT_IDS.includes(config.agent)) {
-        errors.push(`agent must be one of: ${ALL_AGENT_IDS.join(', ')}`);
+    if (hasAgent && config.agent && !ALL_AGENT_IDS.includes(config.agent) && !isCustomHarnessName(config.agent)) {
+        errors.push(`agent must be one of: ${ALL_AGENT_IDS.join(', ')}, or a custom harness (agents harness list)`);
     }
     else if (hasAgent && config.agent && strategy === 'local' &&
-        !ROUTINE_AGENT_IDS.includes(config.agent)) {
+        !ROUTINE_AGENT_IDS.includes(config.agent) &&
+        // A custom harness is exempt from the local-daemon command table: the
+        // runner delegates it to `agents run <name>`, the same path workflow
+        // jobs take, so no ROUTINE_AGENT_COMMANDS template is needed.
+        !isCustomHarnessName(config.agent)) {
         // The local daemon only knows how to build a command for the agents in
-        // ROUTINE_AGENT_IDS (runner.ts's AGENT_COMMANDS table) — anything else is a
+        // ROUTINE_AGENT_IDS (baked from AGENT_COMMANDS in runner.ts) — anything else is a
         // real, installable agent (it passed the ALL_AGENT_IDS check above) but one
         // the daemon can't fire itself, so reject it now instead of accepting the
         // routine and failing at fire time (runner.ts buildJobCommand: "Unsupported

package/dist/lib/secrets/agent.js

@@ -36,6 +36,7 @@ import { getCliVersion, getCliVersionFresh } from '../version.js';
 import { getCliLaunch } from '../cli-entry.js';
 import { GLOBAL_HARNESS, bundleScopeChain } from './scope.js';
 import { deleteLeaseSession, rehydrateSessions, pruneSessionsOnSleep } from './session-store.js';
+import { serviceManagerRegistrationAllowed } from '../service-manifest.js';
 import { SYNC_GET_CMD, SYNC_PING_CMD, SYNC_LOCK_CMD } from './sync-commands.js';
 import { MAX_LEASE_MS, MIN_LEASE_MS } from './lease.js';
 import { selectLeasedEnv } from './lease.js';
@@ -316,7 +317,11 @@ export function retireLegacySecretsAgentService() {
     const plist = servicePlistPath();
     // Only the real LaunchAgents dir is launchd-managed; a relocated (test) dir
     // has no bootstrapped job, so skip launchctl and just remove the plist.
-    if (!process.env.AGENTS_SECRETS_LAUNCHAGENTS_DIR) {
+    // Also skip launchctl under a redirected HOME: launchctl is per-user-session
+    // and HOME-independent, so a sandboxed process would still talk to the real
+    // launchd (RUSH-2968).
+    const reg = serviceManagerRegistrationAllowed();
+    if (!process.env.AGENTS_SECRETS_LAUNCHAGENTS_DIR && reg.allowed) {
         const uid = process.getuid?.() ?? 0;
         try {
             execFileSync('launchctl', ['bootout', `gui/${uid}/${SERVICE_LABEL}`], { stdio: ['ignore', 'ignore', 'ignore'] });
@@ -328,6 +333,9 @@ export function retireLegacySecretsAgentService() {
             catch { /* not loaded */ }
         }
     }
+    else if (!reg.allowed) {
+        process.stderr.write(`[agents] ${reg.reason}\n`);
+    }
     try {
         fs.unlinkSync(plist);
     }

package/dist/lib/secrets/index.js

@@ -32,7 +32,7 @@ import { windowsBackend, usesFileFallback as windowsUsesFileFallback, importNati
 import { isHeadlessSecretsContext } from './headless.js';
 import { KEYCHAIN_READ_BACKOFF_TTL_MS, clearKeychainReadBackoff, isKeychainReadBackedOff, noteKeychainReadFailure, } from './read-backoff.js';
 import { getKeychainHelperPath } from './install-helper.js';
-import { deriveShortId } from '../session/short-id.js';
+import { deriveShortId } from '../text/short-id.js';
 const SERVICE_PREFIX = 'agents-cli';
 export const SECRETS_ITEM_PREFIX = `${SERVICE_PREFIX}.secrets.`;
 const BUNDLES_ITEM_PREFIX = `${SERVICE_PREFIX}.bundles.`;

package/dist/lib/secrets/list-filter.js

@@ -21,7 +21,7 @@ import { parseCommaSeparatedList } from '../format.js';
 // From the leaf module, NOT discover.js — the latter imports `../sqlite.js`, so
 // reaching through it for one parser would pull node:sqlite into every `agents
 // secrets` invocation and print Node's SQLite ExperimentalWarning on stderr.
-import { parseTimeFilter } from '../session/relative-time.js';
+import { parseTimeFilter } from '../text/relative-time.js';
 import { describeBundle, bundlePolicy, SECRET_TYPES, } from './bundles.js';
 /** Ref kinds a var's value can have, from `describeBundle`. */
 export const REF_KINDS = ['literal', 'keychain', 'env', 'file', 'exec'];

package/dist/lib/self-heal/checks/hook-runtime.js

@@ -4,7 +4,7 @@
 // or broken — silent breakage. Repair runs at most once per unique path per
 // pass (no retry, no sync recursion); unresolved findings stay needsAttention.
 import { resultOf } from '../types.js';
-import { repairManagedHookRuntimeArtifacts } from '../../hooks.js';
+import { repairManagedHookRuntimeArtifacts } from '../../hooks/install.js';
 export const hookRuntimeCheck = {
     id: 'hook-runtime',
     title: 'Generated hook runtime shims',

package/dist/lib/self-heal/checks/path.js

@@ -6,7 +6,7 @@
 // Caveat: an already-open shell won't pick up the new rc/PATH entry until it reloads
 // — but new shells will, so the recurring prompt stops.
 import { resultOf } from '../types.js';
-import { isShimsInPath, addShimsToPath, listAgentsWithNonIsolatedInstalledVersions } from '../../shims.js';
+import { isShimsInPath, addShimsToPath, listAgentsWithNonIsolatedInstalledVersions } from '../../installations/shims.js';
 export const pathCheck = {
     id: 'path',
     title: 'Shims directory on PATH',

package/dist/lib/self-heal/checks/shadowing.js

@@ -5,7 +5,7 @@
 // and PATH-order problem are POSIX; Windows resolves via the registry PATH).
 import { resultOf } from '../types.js';
 import { AGENTS } from '../../agents.js';
-import { getPathShadowingExecutable, adoptShadowingLauncher, listAgentsWithNonIsolatedInstalledVersions, } from '../../shims.js';
+import { getPathShadowingExecutable, adoptShadowingLauncher, listAgentsWithNonIsolatedInstalledVersions, } from '../../installations/shims.js';
 import { getGlobalDefault } from '../../installations/versions.js';
 export const shadowingCheck = {
     id: 'shadowing',

package/dist/lib/self-heal/checks/shims.js

@@ -4,7 +4,7 @@
 // background so the shim schema settles without user-facing churn.
 import { resultOf } from '../types.js';
 import { AGENTS } from '../../agents.js';
-import { createShim, ensureShimCurrent, ensureVersionedAliasCurrent, isShimCurrent, isVersionedAliasCurrent, removeShim, shimExists, shimPointsAtLiveInstall, removeLegacyUserShim, listAgentsWithInstalledVersions, listAgentsWithNonIsolatedInstalledVersions, listShimFileNames, pruneOrphanedCommandShim, } from '../../shims.js';
+import { createShim, ensureShimCurrent, ensureVersionedAliasCurrent, isShimCurrent, isVersionedAliasCurrent, removeShim, shimExists, shimPointsAtLiveInstall, removeLegacyUserShim, listAgentsWithInstalledVersions, listAgentsWithNonIsolatedInstalledVersions, listShimFileNames, pruneOrphanedCommandShim, } from '../../installations/shims.js';
 import { listInstalledVersions } from '../../installations/versions.js';
 export const shimsCheck = {
     id: 'shims',

package/dist/lib/service-manifest.d.ts

@@ -27,3 +27,23 @@ export declare function serviceManifestHomeEnv(): {
     HOME: string;
     AGENTS_REAL_HOME: string;
 };
+/**
+ * Whether this process may safely register (or tear down) a service with the
+ * user's real service manager.
+ *
+ * `launchctl` and `systemctl --user` are per-user-session and HOME-independent:
+ * a process running under a redirected HOME still talks to the SAME launchd or
+ * systemd instance as a normal login session. service-manifest.ts namespaces the
+ * job label under a redirected HOME, but that only changes the identifier — the
+ * registration still lands in the real service manager. A hermetic test fork (or
+ * any CLI running under a sandbox HOME) must therefore never touch launchd/
+ * systemd unless it has explicitly opted in.
+ *
+ * `AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME=1` is the test seam for the
+ * shim/PATH-based tests that intentionally exercise the registration code path
+ * under a redirected HOME. Production code must never set it.
+ */
+export declare function serviceManagerRegistrationAllowed(): {
+    allowed: boolean;
+    reason: string;
+};

package/dist/lib/service-manifest.js

@@ -78,3 +78,37 @@ export function serviceManifestHomeEnv() {
     const home = process.env.HOME || os.homedir();
     return { HOME: home, AGENTS_REAL_HOME: process.env.AGENTS_REAL_HOME || home };
 }
+/**
+ * Whether this process may safely register (or tear down) a service with the
+ * user's real service manager.
+ *
+ * `launchctl` and `systemctl --user` are per-user-session and HOME-independent:
+ * a process running under a redirected HOME still talks to the SAME launchd or
+ * systemd instance as a normal login session. service-manifest.ts namespaces the
+ * job label under a redirected HOME, but that only changes the identifier — the
+ * registration still lands in the real service manager. A hermetic test fork (or
+ * any CLI running under a sandbox HOME) must therefore never touch launchd/
+ * systemd unless it has explicitly opted in.
+ *
+ * `AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME=1` is the test seam for the
+ * shim/PATH-based tests that intentionally exercise the registration code path
+ * under a redirected HOME. Production code must never set it.
+ */
+export function serviceManagerRegistrationAllowed() {
+    const suffix = isolatedHomeSuffix();
+    if (!suffix) {
+        return { allowed: true, reason: 'production HOME: service-manager registration allowed' };
+    }
+    if (process.env.AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME === '1') {
+        return {
+            allowed: true,
+            reason: `test seam AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME allows registration under sandbox-${suffix}`,
+        };
+    }
+    return {
+        allowed: false,
+        reason: `refusing service-manager registration under redirected HOME (sandbox-${suffix}): ` +
+            `launchctl/systemd are per-user-session and HOME-independent, so a sandboxed process ` +
+            `would register in the real service manager (RUSH-2968)`,
+    };
+}

package/dist/lib/session/cloud.js

@@ -13,7 +13,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import * as yaml from 'yaml';
-import { deriveShortId } from './short-id.js';
+import { deriveShortId } from '../text/short-id.js';
 import { getCacheDir } from '../state.js';
 const PROXY_BASE = process.env.RUSH_PROXY_BASE ?? 'https://api.prix.dev';
 const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');

package/dist/lib/session/db.js

@@ -13,7 +13,7 @@ import { parseSession, sessionFilePathContainer } from './parse.js';
 import { extractRecentDirectoriesTouched, extractTodoProgressFromEvents } from './state.js';
 import { getSessionsDir, getSessionsDbPath } from '../state.js';
 import { query as queryEvents, queryToolUsageForSessions } from '../feed/events.js';
-import { machineForSessionFile } from './origin-machine.js';
+import { machineForSessionFile } from '../origin-machine.js';
 import { loadSessionActorIndex, readSessionActorRecord } from './actor-sidecar.js';
 import { toolCallsFromEvents } from './tool-calls.js';
 import { persistToolCalls, toolEvidenceSourcePath } from './tool-store.js';

package/dist/lib/session/discover.d.ts

@@ -644,6 +644,29 @@ export declare function scanClaudeSessionIncremental(filePath: string, fromOffse
     newOffset: number;
     toolCalls: IndexedToolCall[];
 }>;
+/**
+ * Decide full-vs-incremental for one Claude file and parse it uniformly, always
+ * returning a finalized scan plus the continuation to persist. Both branches run
+ * through the SAME reducer (via {@link scanClaudeSessionIncremental}), so the row
+ * an append produces is identical to a from-scratch full reparse by construction
+ * (the B-1 parity harness proves this at the function level).
+ *
+ * INCREMENTAL when a prior continuation exists AND the file grew past the
+ * persisted offset AND its mtime did not go backwards — an in-place append.
+ * FULL (from byte 0, fresh state) otherwise: cold start (no prior), truncation /
+ * rewrite (size shrank to at or below the offset), or a clock rewind / restore
+ * (mtime older than the last parse). A FULL parse still produces a continuation,
+ * so the file's very next append can go incremental.
+ *
+ * `mode` is returned so the caller (and tests) can confirm which branch ran.
+ */
+export declare function scanClaudeSessionResumable(filePath: string, prior: ClaudeParserState | null, currentFileMtimeMs: number, currentFileSize: number, priorFileMtimeMs?: number): Promise<{
+    scan: ClaudeSessionScan;
+    newState: ClaudeParserState;
+    newOffset: number;
+    toolCalls: IndexedToolCall[];
+    mode: 'full' | 'incremental';
+}>;
 /** Test seam: read the (incremental, full) Claude parse counters. */
 export declare function __claudeScanBranchCountsForTest(): {
     incremental: number;
@@ -776,6 +799,22 @@ export declare function scanCodexSessionIncremental(filePath: string, fromOffset
     newOffset: number;
     toolCalls: IndexedToolCall[];
 }>;
+/**
+ * Decide full-vs-incremental for one Codex rollout and parse it uniformly,
+ * always returning a finalized scan plus the continuation to persist. Both
+ * branches run through the SAME reducer (via {@link scanCodexSessionIncremental}),
+ * so an append produces a row identical to a from-scratch full reparse by
+ * construction. INCREMENTAL when a prior continuation exists AND the file grew
+ * past the persisted offset AND its mtime did not go backwards; FULL (from byte
+ * 0, fresh state) otherwise (cold start, truncation/rewrite, clock rewind).
+ */
+export declare function scanCodexSessionResumable(filePath: string, prior: CodexParserState | null, currentFileMtimeMs: number, currentFileSize: number, priorFileMtimeMs?: number): Promise<{
+    scan: CodexSessionScan;
+    newState: CodexParserState;
+    newOffset: number;
+    toolCalls: IndexedToolCall[];
+    mode: 'full' | 'incremental';
+}>;
 /** Test seam: read the (incremental, full) Codex parse counters. */
 export declare function __codexScanBranchCountsForTest(): {
     incremental: number;

package/dist/lib/session/discover.js

@@ -22,7 +22,7 @@ import { AGENTS, agentConfigDirName, getCliVersion, resolveOpenCodeAccountId } f
 import { walkForFilesWithStat } from '../fs-walk.js';
 import { hasCommand } from '../cli-resources.js';
 import { execFileShellSpec } from '../platform/exec.js';
-import { getConfigSymlinkVersion } from '../shims.js';
+import { getConfigSymlinkVersion } from '../installations/shims.js';
 import { SESSION_AGENTS } from './types.js';
 import { deriveShortId } from './short-id.js';
 import { buildClaudeAccountIndex, resolveClaudeAccount } from './claude-accounts.js';
@@ -3491,7 +3491,7 @@ function freshClaudeParserState() {
  *
  * `mode` is returned so the caller (and tests) can confirm which branch ran.
  */
-async function scanClaudeSessionResumable(filePath, prior, currentFileMtimeMs, currentFileSize, priorFileMtimeMs) {
+export async function scanClaudeSessionResumable(filePath, prior, currentFileMtimeMs, currentFileSize, priorFileMtimeMs) {
     // File size + mtime cannot distinguish an APPEND from an in-place rewrite or a
     // restore that dropped DIFFERENT, larger content at the same path: both grow
     // the file and move mtime forward. Resuming from the stored offset across that
@@ -3977,7 +3977,7 @@ async function codexSessionIdentityAt(filePath, maxBytes = 1_048_576) {
  * past the persisted offset AND its mtime did not go backwards; FULL (from byte
  * 0, fresh state) otherwise (cold start, truncation/rewrite, clock rewind).
  */
-async function scanCodexSessionResumable(filePath, prior, currentFileMtimeMs, currentFileSize, priorFileMtimeMs) {
+export async function scanCodexSessionResumable(filePath, prior, currentFileMtimeMs, currentFileSize, priorFileMtimeMs) {
     // File size + mtime cannot distinguish an APPEND from an in-place rewrite or a
     // restore that dropped a DIFFERENT, larger rollout at the same path: both grow
     // the file and move mtime forward. Resuming from the stored offset across that