@phnx-labs/agents-cli 1.22.42 → 1.22.43

package/dist/lib/cloud/rush.d.ts

@@ -25,21 +25,6 @@ export interface AccountManifest {
     fp: string;
     versions: AccountManifestEntry[];
 }
-/**
- * Read the raw OAuth credentials for one Claude version. On Mac, prefer the
- * Keychain blob (canonical). On Linux/CI, fall back to `.claude/.credentials.json`
- * inside the version home (where the Linux Claude CLI stores its OAuth).
- *
- * Returns null when no credentials are findable — caller treats as "version
- * is installed but not signed in" and skips it from the manifest.
- *
- * NOTE: the darwin branch returns the UNWRAPPED oauth sub-object (what the Rush
- * server re-wraps). It is NOT the shape Claude Code reads back from
- * `.credentials.json`. The lease exporter (crabbox/runtimes.ts) therefore only
- * reuses the Linux `.credentials.json` branch here and reads the wrapped raw
- * Keychain payload itself on darwin.
- */
-export declare function readClaudeCredentialsBlob(home: string): Promise<string | null>;
 /**
  * Build a manifest of the user's local Claude installations to send on every
  * cloud dispatch. The manifest is the contract the server uses to detect when

package/dist/lib/cloud/rush.js

@@ -13,7 +13,6 @@ import { resolveDispatchRepos, normalizeProviderStatus, MAX_IMAGES_PER_DISPATCH
 import { parseSSE } from './stream.js';
 import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
 import { getAccountInfo } from '../agents.js';
-import { loadClaudeOauth } from '../accounting/usage.js';
 import { selectBalancedVersion } from '../accounting/rotate.js';
 const PROXY_BASE = process.env.RUSH_PROXY_BASE ?? 'https://api.prix.dev';
 const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
@@ -112,40 +111,6 @@ function parsePromptCode(body) {
         return null;
     }
 }
-/**
- * Read the raw OAuth credentials for one Claude version. On Mac, prefer the
- * Keychain blob (canonical). On Linux/CI, fall back to `.claude/.credentials.json`
- * inside the version home (where the Linux Claude CLI stores its OAuth).
- *
- * Returns null when no credentials are findable — caller treats as "version
- * is installed but not signed in" and skips it from the manifest.
- *
- * NOTE: the darwin branch returns the UNWRAPPED oauth sub-object (what the Rush
- * server re-wraps). It is NOT the shape Claude Code reads back from
- * `.credentials.json`. The lease exporter (crabbox/runtimes.ts) therefore only
- * reuses the Linux `.credentials.json` branch here and reads the wrapped raw
- * Keychain payload itself on darwin.
- */
-export async function readClaudeCredentialsBlob(home) {
-    if (process.platform === 'darwin') {
-        const oauth = await loadClaudeOauth(home);
-        if (oauth && oauth.accessToken) {
-            return JSON.stringify(oauth);
-        }
-    }
-    const credsPath = path.join(home, '.claude', '.credentials.json');
-    try {
-        if (fs.existsSync(credsPath)) {
-            const raw = fs.readFileSync(credsPath, 'utf-8').trim();
-            if (raw)
-                return raw;
-        }
-    }
-    catch {
-        // fall through to null
-    }
-    return null;
-}
 /**
  * Build a manifest of the user's local Claude installations to send on every
  * cloud dispatch. The manifest is the contract the server uses to detect when

package/dist/lib/crabbox/runtimes.d.ts

@@ -85,8 +85,12 @@ export declare const CLAUDE_TOKEN_REMOTE = ".claude/.credentials.json";
  * versioned home) uses a hash-suffixed service, so we try the bare service first,
  * then enumerate installed version homes (preferring the account whose email
  * matches `preferEmail`, so the token matches the `.claude.json` config we copy).
- * Off macOS the local Claude CLI stores the token in `.credentials.json` already —
- * reuse the rush.ts Linux branch verbatim.
+ * Off macOS the local Claude CLI stores the wrapped rotating blob in
+ * `.credentials.json` already. Read that file here with a shape check
+ * (`claudeAiOauth.accessToken`). Do not reintroduce a shared helper that
+ * also serves Rush Cloud dispatch — dispatch is email-only (SING-1b) and
+ * the old `readClaudeCredentialsBlob` path was the #1767 TTY-banner leak
+ * (RUSH-2359).
  *
  * The reader/service/version helpers are injected so unit tests never touch the
  * real Keychain.

package/dist/lib/crabbox/runtimes.js

@@ -19,7 +19,6 @@ import { getAccountInfo } from '../agents.js';
 import { getKeychainToken } from '../secrets/index.js';
 import { getClaudeKeychainService } from '../accounting/usage.js';
 import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
-import { readClaudeCredentialsBlob } from '../cloud/rush.js';
 export const LEASE_RUNTIMES = [
     { id: 'claude', label: 'Claude Code', localCandidates: ['.claude/.claude.json', '.claude.json'], remote: '.claude.json' },
     { id: 'codex', label: 'Codex CLI', localCandidates: ['.codex/auth.json'], remote: '.codex/auth.json' },
@@ -193,8 +192,12 @@ function isClaudeCredentialsBlob(s) {
  * versioned home) uses a hash-suffixed service, so we try the bare service first,
  * then enumerate installed version homes (preferring the account whose email
  * matches `preferEmail`, so the token matches the `.claude.json` config we copy).
- * Off macOS the local Claude CLI stores the token in `.credentials.json` already —
- * reuse the rush.ts Linux branch verbatim.
+ * Off macOS the local Claude CLI stores the wrapped rotating blob in
+ * `.credentials.json` already. Read that file here with a shape check
+ * (`claudeAiOauth.accessToken`). Do not reintroduce a shared helper that
+ * also serves Rush Cloud dispatch — dispatch is email-only (SING-1b) and
+ * the old `readClaudeCredentialsBlob` path was the #1767 TTY-banner leak
+ * (RUSH-2359).
  *
  * The reader/service/version helpers are injected so unit tests never touch the
  * real Keychain.
@@ -248,9 +251,22 @@ export async function resolveClaudeCredentialsBlob(opts) {
         }
         return null;
     }
-    // Off darwin: the local Claude CLI already stores the wrapped blob on disk.
+    // Off darwin: the local Claude CLI stores the wrapped rotating blob on disk.
+    // Read it directly so a file-based setup-token (Rush Cloud dispatch) is not
+    // mistaken for a native OAuth login that SING-1b must refuse to copy.
     const home = process.env.AGENTS_REAL_HOME || os.homedir();
-    return readClaudeCredentialsBlob(home);
+    const credsPath = path.join(home, '.claude', '.credentials.json');
+    try {
+        if (fs.existsSync(credsPath)) {
+            const raw = fs.readFileSync(credsPath, 'utf-8').trim();
+            if (raw && isClaudeCredentialsBlob(raw))
+                return raw;
+        }
+    }
+    catch {
+        /* no readable credentials file */
+    }
+    return null;
 }
 /**
  * The credential-provisioning snippet for a `--lease` box.

package/dist/lib/daemon/daemon.js

@@ -11,7 +11,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import { getDaemonDir } from '../state.js';
-import { isolatedHomeSuffix, namespacedServiceLabel, serviceManifestHomeEnv } from '../service-manifest.js';
+import { isolatedHomeSuffix, namespacedServiceLabel, serviceManifestHomeEnv, serviceManagerRegistrationAllowed } from '../service-manifest.js';
 import { isAlive, killTree, backgroundSpawnOptions, waitForExit } from '../platform/index.js';
 import { listJobs as listAllJobs } from '../scheduling/routines.js';
 import { syncAllProjectRoutines } from '../routines-project.js';
@@ -1763,6 +1763,9 @@ export { getAgentsBinPath };
  * in fact up. Returns null when the service isn't running or the query fails.
  */
 function readServiceManagerPid(platform = os.platform()) {
+    const reg = serviceManagerRegistrationAllowed();
+    if (!reg.allowed)
+        return null;
     try {
         if (platform === 'linux') {
             const out = execFileSync('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', daemonSystemdUnitName()], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
@@ -1912,61 +1915,72 @@ function startDaemonLocked(agentsBin, releaseLock) {
         releaseLock();
         return startDetached({ agentsBin });
     };
+    const reg = serviceManagerRegistrationAllowed();
     if (platform === 'darwin') {
-        try {
-            const plistPath = getLaunchdPlistPath();
-            const plistDir = path.dirname(plistPath);
-            if (!fs.existsSync(plistDir)) {
-                fs.mkdirSync(plistDir, { recursive: true });
-            }
-            // The plist carries no credential (RUSH-1759 — the daemon reads the OAuth
-            // token itself at startup); still create owner-only atomically to match the
-            // detached path and keep the log/PATH surface owner-private.
-            writeOwnerOnlyServiceManifest(plistPath, generateLaunchdPlist(agentsBin));
+        if (reg.allowed) {
             try {
-                execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+                const plistPath = getLaunchdPlistPath();
+                const plistDir = path.dirname(plistPath);
+                if (!fs.existsSync(plistDir)) {
+                    fs.mkdirSync(plistDir, { recursive: true });
+                }
+                // The plist carries no credential (RUSH-1759 — the daemon reads the OAuth
+                // token itself at startup); still create owner-only atomically to match the
+                // detached path and keep the log/PATH surface owner-private.
+                writeOwnerOnlyServiceManifest(plistPath, generateLaunchdPlist(agentsBin));
+                try {
+                    execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+                }
+                catch { /* not loaded, expected */ }
+                // launchctl prints `Load failed:` and exits 0 when the label is in a
+                // stuck state from a prior session — so a zero exit code isn't proof
+                // of success. If no pid materializes within the window, give up on
+                // launchd and fall through to a plain detached spawn.
+                execFileSync('launchctl', ['load', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
+                // Launch issued — the child needs this lock to claim (RUSH-2417).
+                releaseLock();
+                const pid = waitForPid(3000) ?? readServiceManagerPid();
+                if (pid)
+                    return { pid, method: 'launchd' };
+                // launchctl claimed success but nothing ran. Fall through.
+            }
+            catch {
+                // load threw — fall through to detached spawn
             }
-            catch { /* not loaded, expected */ }
-            // launchctl prints `Load failed:` and exits 0 when the label is in a
-            // stuck state from a prior session — so a zero exit code isn't proof
-            // of success. If no pid materializes within the window, give up on
-            // launchd and fall through to a plain detached spawn.
-            execFileSync('launchctl', ['load', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-            // Launch issued — the child needs this lock to claim (RUSH-2417).
-            releaseLock();
-            const pid = waitForPid(3000) ?? readServiceManagerPid();
-            if (pid)
-                return { pid, method: 'launchd' };
-            // launchctl claimed success but nothing ran. Fall through.
         }
-        catch {
-            // load threw — fall through to detached spawn
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         return detachedFallback();
     }
     if (platform === 'linux') {
-        try {
-            const unitPath = getSystemdUnitPath();
-            const unitDir = path.dirname(unitPath);
-            if (!fs.existsSync(unitDir)) {
-                fs.mkdirSync(unitDir, { recursive: true });
+        if (reg.allowed) {
+            try {
+                const unitPath = getSystemdUnitPath();
+                const unitDir = path.dirname(unitPath);
+                if (!fs.existsSync(unitDir)) {
+                    fs.mkdirSync(unitDir, { recursive: true });
+                }
+                // Carries no credential (RUSH-1759 — the daemon reads the OAuth token
+                // itself at startup); owner-only to keep the PATH/log surface private.
+                writeOwnerOnlyServiceManifest(unitPath, generateSystemdUnit(agentsBin));
+                execFileSync('systemctl', ['--user', 'daemon-reload'], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'enable', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'start', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                // Launch issued — the child needs this lock to claim (RUSH-2417).
+                releaseLock();
+                const pid = waitForPid(3000) ?? readServiceManagerPid();
+                if (pid)
+                    return { pid, method: 'systemd' };
+                // systemctl returned success but no PID surfaced — fall through to a
+                // plain detached spawn rather than reporting a null PID.
+            }
+            catch {
+                // start threw — fall through to detached spawn
             }
-            // Carries no credential (RUSH-1759 — the daemon reads the OAuth token
-            // itself at startup); owner-only to keep the PATH/log surface private.
-            writeOwnerOnlyServiceManifest(unitPath, generateSystemdUnit(agentsBin));
-            execFileSync('systemctl', ['--user', 'daemon-reload'], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'enable', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'start', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            // Launch issued — the child needs this lock to claim (RUSH-2417).
-            releaseLock();
-            const pid = waitForPid(3000) ?? readServiceManagerPid();
-            if (pid)
-                return { pid, method: 'systemd' };
-            // systemctl returned success but no PID surfaced — fall through to a
-            // plain detached spawn rather than reporting a null PID.
         }
-        catch {
-            // start threw — fall through to detached spawn
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         return detachedFallback();
     }
@@ -2261,29 +2275,43 @@ export function stopDaemon() {
     const released = [];
     const surviving = [];
     let escalated = false;
+    const reg = serviceManagerRegistrationAllowed();
     if (platform === 'darwin') {
         const plistPath = getLaunchdPlistPath();
         if (fs.existsSync(plistPath)) {
+            if (reg.allowed) {
+                try {
+                    execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8' });
+                }
+                catch (err) {
+                    if (process.env.AGENTS_DEBUG) {
+                        console.error(`[debug] launchctl unload failed: ${err.message}`);
+                    }
+                }
+            }
+            else {
+                process.stderr.write(`[agents] ${reg.reason}\n`);
+            }
             try {
-                execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8' });
                 fs.unlinkSync(plistPath);
             }
+            catch { /* plist already removed */ }
+        }
+    }
+    if (platform === 'linux') {
+        if (reg.allowed) {
+            try {
+                execFileSync('systemctl', ['--user', 'stop', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'disable', daemonSystemdUnitName()], { encoding: 'utf-8' });
+            }
             catch (err) {
                 if (process.env.AGENTS_DEBUG) {
-                    console.error(`[debug] launchctl unload failed: ${err.message}`);
+                    console.error(`[debug] systemctl stop failed: ${err.message}`);
                 }
             }
         }
-    }
-    if (platform === 'linux') {
-        try {
-            execFileSync('systemctl', ['--user', 'stop', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'disable', daemonSystemdUnitName()], { encoding: 'utf-8' });
-        }
-        catch (err) {
-            if (process.env.AGENTS_DEBUG) {
-                console.error(`[debug] systemctl stop failed: ${err.message}`);
-            }
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         const unitPath = getSystemdUnitPath();
         if (fs.existsSync(unitPath)) {

package/dist/lib/daemon/runner.d.ts

@@ -74,6 +74,23 @@ interface RoutineAttempt {
  * but the gate should have paused such a routine before it ever spawned.
  */
 export declare function routineSpawnCwd(config: Pick<JobConfig, 'name' | 'project' | 'cwd' | 'agent' | 'workflow' | 'command'>): string;
+/**
+ * Bake the daemon-job argv skeleton from AGENT_COMMANDS.
+ *
+ * The two tables used to be independent copies of the same launch decision.
+ * Argv now comes from AGENT_COMMANDS.base / promptFlag / jsonFlags / modeFlags.
+ * Two documented exceptions, not a second table:
+ *   - kimi uses `--prompt` (long form). `-p` is the exec alias; combining
+ *     either with --plan/--auto/--yolo aborts, so routineModeArgs emits no
+ *     mode flag. The daemon has always spawned the long form.
+ *   - claude places `--verbose` (from jsonFlags) before the prompt and bakes
+ *     modeFlags.plan so claudeAdapter.routineModeArgs can splice
+ *     plan → acceptEdits / auto / skip.
+ *
+ * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (gemini, grok,
+ * and every other harness the daemon does not fire locally).
+ */
+export declare function bakeRoutineArgv(agent: string): string[] | undefined;
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export declare function buildJobCommand(config: JobConfig, resolvedPrompt: string, forwardAccount?: boolean): string[];
 /**
@@ -161,7 +178,7 @@ export declare function buildHostDispatchOptions(config: JobConfig, ctx: {
     runDir: string;
     detached: boolean;
 }): import('../hosts/run-target.js').HostPromptRun;
-export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow' | 'resume'>): boolean;
+export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow' | 'resume' | 'agent'>): boolean;
 /**
  * Merge sandbox/base env with the canonical per-version exec env
  * (CLAUDE_CONFIG_DIR / CODEX_HOME / …) so routines share account isolation

package/dist/lib/daemon/runner.js

@@ -21,7 +21,7 @@ import { getCliLaunch, getAgentsBinDir } from '../cli-entry.js';
 import { resolveJobPrompt, parseTimeout, writeRunMeta, listRuns, getJobRunsDir, getRunDir, checkJobDeviceEligibility, finalizeRunMeta, resolveJobExecutionContext, slotRunId, claimRunSlot, readRunMeta, resolveHostStrategy, } from '../scheduling/routines.js';
 import { getRunsDir, getUserAgentsDir, readMeta, getDaemonDir } from '../state.js';
 import { shortCodexHome } from '../codex-home.js';
-import { prepareJobHome, buildSpawnEnv, getJobHomePath } from '../sandbox.js';
+import { prepareJobHome, buildSpawnEnv, getJobHomePath, assertSandboxForwardsHostGhAuth } from '../sandbox.js';
 import { resolveModel, buildReasoningFlags } from '../models.js';
 import { createTimer, redactPrompt, emitRoutineEnd } from '../feed/events.js';
 import { resolveHarnessAdapter } from '../harness/index.js';
@@ -39,7 +39,8 @@ import { resolveClaudeSetupToken } from '../claude-account-token.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, } from '../accounting/rotate.js';
 import { readAuthHealth, isDeadVerdict } from '../auth-health.js';
 import { machineId } from '../machine-id.js';
-import { isSelfUpdatingAgent, ROUTINE_AGENT_COMMANDS, isAgentHardDeprecated, hardDeprecationError } from '../agents.js';
+import { isSelfUpdatingAgent, ROUTINE_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../agents.js';
+import { isCustomHarnessName, readProfile } from '../profiles.js';
 export class RoutineAlreadyRunningError extends Error {
     constructor(jobName, runId) {
         super(`Routine '${jobName}' already has a running execution (${runId})`);
@@ -308,7 +309,7 @@ function allocateRoutineAttempt(config, trigger) {
     // harness leaves the command table (gemini did), and the legacy routine must
     // still land a visible 'blocked' record, never a generic buildJobCommand
     // failure (RUSH-2202).
-    if (!config.workflow && config.agent && isAgentHardDeprecated(config.agent)) {
+    if (!config.workflow && config.agent && !isCustomHarnessName(config.agent) && isAgentHardDeprecated(config.agent)) {
         const reason = hardDeprecationError(config.agent);
         return {
             proceed: false,
@@ -488,6 +489,48 @@ export function routineSpawnCwd(config) {
     const ctx = resolveJobExecutionContext(config, { mode: 'local' });
     return ctx.absoluteCwd ?? os.homedir();
 }
+/**
+ * Bake the daemon-job argv skeleton from AGENT_COMMANDS.
+ *
+ * The two tables used to be independent copies of the same launch decision.
+ * Argv now comes from AGENT_COMMANDS.base / promptFlag / jsonFlags / modeFlags.
+ * Two documented exceptions, not a second table:
+ *   - kimi uses `--prompt` (long form). `-p` is the exec alias; combining
+ *     either with --plan/--auto/--yolo aborts, so routineModeArgs emits no
+ *     mode flag. The daemon has always spawned the long form.
+ *   - claude places `--verbose` (from jsonFlags) before the prompt and bakes
+ *     modeFlags.plan so claudeAdapter.routineModeArgs can splice
+ *     plan → acceptEdits / auto / skip.
+ *
+ * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (gemini, grok,
+ * and every other harness the daemon does not fire locally).
+ */
+export function bakeRoutineArgv(agent) {
+    if (!ROUTINE_AGENT_IDS.includes(agent))
+        return undefined;
+    const template = AGENT_COMMANDS[agent];
+    if (!template)
+        return undefined;
+    const json = template.jsonFlags ?? [];
+    const cmd = [...template.base];
+    if (agent === 'kimi') {
+        cmd.push('--prompt', '{prompt}', ...json);
+        return cmd;
+    }
+    if (agent === 'claude') {
+        const verbose = json.includes('--verbose') ? ['--verbose'] : [];
+        const jsonRest = json.filter((flag) => flag !== '--verbose');
+        cmd.push(template.promptFlag, ...verbose, '{prompt}', ...jsonRest, ...(template.modeFlags.plan ?? []));
+        return cmd;
+    }
+    if (template.promptFlag === 'positional') {
+        cmd.push('{prompt}', ...json);
+    }
+    else {
+        cmd.push(template.promptFlag, '{prompt}', ...json);
+    }
+    return cmd;
+}
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export function buildJobCommand(config, resolvedPrompt, forwardAccount = true) {
     // Workflow branch: delegate to `agents run <workflow>` which handles subagent
@@ -514,9 +557,25 @@ export function buildJobCommand(config, resolvedPrompt, forwardAccount = true) {
             cmd.push('--account', config.account);
         return cmd;
     }
-    const template = ROUTINE_AGENT_COMMANDS[agent];
+    // Custom-harness branch: delegate to `agents run <name>`, which owns profile
+    // resolution (host binary, model env, provider auth) — the same delegation
+    // the workflow and resume branches use. The profile pins its own version and
+    // auth, so no command template, binary pinning, or account-env injection
+    // applies here.
+    if (isCustomHarnessName(agent)) {
+        const cmd = ['agents', 'run', agent, resolvedPrompt, '--mode', config.mode];
+        if (config.account && forwardAccount)
+            cmd.push('--account', config.account);
+        return cmd;
+    }
+    const template = bakeRoutineArgv(agent);
     if (!template) {
-        throw new Error(`Unsupported agent for daemon jobs: ${agent}`);
+        // A name outside both tables was either never valid or was a custom
+        // harness whose profile has since been deleted — validateJob accepted it
+        // against a profile that existed then. Name the repair, not just the miss.
+        throw new Error(`Unsupported agent for daemon jobs: ${agent}. ` +
+            `If '${agent}' was a custom harness, its profile no longer exists on this device — ` +
+            `recreate it (agents harness add ${agent} ...) or point the routine at another agent.`);
     }
     let cmd = template.map((part) => part.replace('{prompt}', resolvedPrompt));
     // Canonicalize mode (accepts legacy `full` as alias for `skip`).
@@ -554,7 +613,8 @@ export function buildJobCommand(config, resolvedPrompt, forwardAccount = true) {
  * Reasoning level (config.config.reasoning) maps to per-agent flags via models.ts.
  */
 function appendModelAndReasoning(cmd, config) {
-    // Only called from buildJobCommand's agent path — config.agent is set.
+    // Only called from buildJobCommand's agent path AFTER the custom-harness
+    // branch returned — config.agent is a native id here.
     const agent = config.agent;
     const model = config.config?.model;
     if (model) {
@@ -636,6 +696,8 @@ function transcriptBasePath(runDir) {
 export function snapshotRoutineTranscriptBase(meta, runDir, overlayHome) {
     if (!meta.agent)
         return;
+    // A host/cloud custom-harness run records the harness name, which has no
+    // transcript spec — the null-specs guard below skips it, as before.
     const specs = ROUTINE_TRANSCRIPT_SPECS[meta.agent];
     if (!specs)
         return;
@@ -674,6 +736,8 @@ function readTranscriptBase(runDir) {
 export function archiveRoutineTranscripts(meta, runDir, overlayHome) {
     if (!meta.agent)
         return;
+    // A host/cloud custom-harness run records the harness name, which has no
+    // transcript spec — the null-specs guard below skips it, as before.
     const specs = ROUTINE_TRANSCRIPT_SPECS[meta.agent];
     if (!specs)
         return;
@@ -808,6 +872,13 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
     if (config.workflow) {
         return { chain: [], rotation: null, pinned: false };
     }
+    if (config.agent && isCustomHarnessName(config.agent)) {
+        // A custom harness pins its own version/auth in the profile, so there is
+        // no version/account chain to resolve here — `agents run <name>` owns it
+        // (matching exec's "strategy ignored: custom harness pins its own
+        // version/auth").
+        return { chain: [], rotation: null, pinned: false };
+    }
     // resolveRoutineLaunch is only called for agent jobs (workflow returns above;
     // command jobs branch out of execute*Job before reaching this).
     const agent = config.agent;
@@ -1012,7 +1083,7 @@ export function buildHostDispatchOptions(config, ctx) {
     };
 }
 export function dispatchesViaAgentsRun(config) {
-    return Boolean(config.workflow || config.resume);
+    return Boolean(config.workflow || config.resume || (config.agent && isCustomHarnessName(config.agent)));
 }
 /**
  * Merge sandbox/base env with the canonical per-version exec env
@@ -1214,7 +1285,11 @@ async function executeJobPlaced(config, deps, attempt) {
     // the agent's config dir, and the sandbox overlay home has only a freshly-generated
     // config with no session store. So a resume job is never sandboxed, regardless of
     // `config.sandbox` (see the resume branch in buildJobCommand).
-    const useSandbox = config.sandbox !== false && !config.resume;
+    // Resume needs the REAL home (session store); a custom harness needs it too —
+    // the delegated `agents run <name>` resolves ~/.agents (profiles, setup
+    // sentinel, version homes) from HOME, which the overlay would hide. Exec
+    // still isolates the run in the host version home it swaps HOME into.
+    const useSandbox = config.sandbox !== false && !config.resume && !(config.agent && isCustomHarnessName(config.agent));
     const overlayHome = useSandbox ? prepareJobHome(config) : undefined;
     const runId = attempt.runId;
     const runDir = getRunDir(config.name, runId);
@@ -1225,7 +1300,11 @@ async function executeJobPlaced(config, deps, attempt) {
     // Workflows run via `agents run <workflow>` which delegates to claude under the hood.
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
     // (command jobs branched out earlier, so config.agent is set on the non-workflow path.)
-    const effectiveAgent = config.workflow ? 'claude' : config.agent;
+    const effectiveAgent = config.workflow
+        ? 'claude'
+        : isCustomHarnessName(config.agent)
+            ? readProfile(config.agent).host.agent
+            : config.agent;
     if (!dispatchesViaAgentsRun(config)) {
         const { findUnifiedAccount, resolveAccountSelection, resolveCredentialAccount } = await import('../account-registry.js');
         const meta = readMeta();
@@ -1238,6 +1317,9 @@ async function executeJobPlaced(config, deps, attempt) {
                 Object.assign(baseEnv, resolveCredentialAccount(selectedAccount, effectiveAgent).env);
         }
     }
+    // RUSH-2860: if this host holds gh auth, the sandbox child MUST see it.
+    if (useSandbox)
+        assertSandboxForwardsHostGhAuth(baseEnv);
     const meta = {
         jobName: config.name,
         runId,
@@ -1728,7 +1810,11 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
     // the agent's config dir, and the sandbox overlay home has only a freshly-generated
     // config with no session store. So a resume job is never sandboxed, regardless of
     // `config.sandbox` (see the resume branch in buildJobCommand).
-    const useSandbox = config.sandbox !== false && !config.resume;
+    // Resume needs the REAL home (session store); a custom harness needs it too —
+    // the delegated `agents run <name>` resolves ~/.agents (profiles, setup
+    // sentinel, version homes) from HOME, which the overlay would hide. Exec
+    // still isolates the run in the host version home it swaps HOME into.
+    const useSandbox = config.sandbox !== false && !config.resume && !(config.agent && isCustomHarnessName(config.agent));
     const overlayHome = useSandbox ? prepareJobHome(config) : undefined;
     const runId = attempt.runId;
     const runDir = getRunDir(config.name, runId);
@@ -1755,7 +1841,15 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
         })()
         // Non-command path only: config.agent is always set here (command/workflow branch earlier).
         : buildRoutineSpawnEnv(baseEnv, config.agent, version, config.timezone, overlayHome);
-    const effectiveAgent = config.workflow ? 'claude' : config.agent;
+    // RUSH-2860: if this host holds gh auth, the sandbox child MUST see it —
+    // otherwise monitors runs records ok while every gh call inside fails.
+    if (useSandbox)
+        assertSandboxForwardsHostGhAuth(spawnEnv);
+    const effectiveAgent = config.workflow
+        ? 'claude'
+        : isCustomHarnessName(config.agent)
+            ? readProfile(config.agent).host.agent
+            : config.agent;
     const meta = {
         jobName: config.name,
         runId,

package/dist/lib/devices/doctor-findings.js

@@ -42,7 +42,7 @@ import { AGENTS, ALL_AGENT_IDS, supportsAccountInspection } from '../agents.js';
 import { blocksLocalScripts } from '../platform/winpath.js';
 import { loginHint } from '../signin-badge.js';
 import { CONFIG_ENV_ISOLATED_AGENTS } from '../installations/shims.js';
-import { padToWidth, stringWidth } from '../session/width.js';
+import { padToWidth, stringWidth } from '../text/width.js';
 import { windowsSshEnrollmentProblem } from './windows-ssh-enrollment.js';
 const AGENT_NAMES = Object.fromEntries(ALL_AGENT_IDS.map((id) => [id, AGENTS[id].name]));
 /** Agents with NO per-version credential isolation: their login is shared across

package/dist/lib/devices/health-report.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import { padToWidth, stringWidth, terminalWidth, truncateToWidth } from '../session/width.js';
+import { padToWidth, stringWidth, terminalWidth, truncateToWidth } from '../text/width.js';
 import { fmtBytes, headroom } from './health.js';
 import { formatCheckedAge } from '../auth-health.js';
 import { compareFleetInventories } from './fleet-divergence.js';

package/dist/lib/drift-sync.d.ts

@@ -1,6 +1,6 @@
 /**
  * Interactive drift-sync flow — the single "we detected drift, want to fix it?"
- * action, shared by `agents status`, `agents doctor`, and the menu-bar "NEEDS
+ * action, shared by `agents sync status`, `agents doctor`, and the menu-bar "NEEDS
  * SYNC" row.
  *
  * It composes existing pieces, re-implementing nothing:

package/dist/lib/drift-sync.js

@@ -1,6 +1,6 @@
 /**
  * Interactive drift-sync flow — the single "we detected drift, want to fix it?"
- * action, shared by `agents status`, `agents doctor`, and the menu-bar "NEEDS
+ * action, shared by `agents sync status`, `agents doctor`, and the menu-bar "NEEDS
  * SYNC" row.
  *
  * It composes existing pieces, re-implementing nothing:
@@ -115,7 +115,7 @@ export async function promptDriftSync(opts = {}) {
     if (opts.yes || !isInteractiveTerminal()) {
         if (!opts.yes) {
             // Non-TTY without --yes: report, don't act, don't throw.
-            console.log(chalk.gray('\nRun `agents status --yes` to sync, or `agents status` in a terminal to choose.'));
+            console.log(chalk.gray('\nRun `agents sync status --yes` to sync, or `agents sync status` in a terminal to choose.'));
             return base;
         }
         const systemPulled = await pullSystem(status);

package/dist/lib/drift.d.ts

@@ -62,7 +62,7 @@ export interface DriftSummary {
      * True when the install is out of sync: any installed version is stale,
      * never-synced, carries unwired hooks, or has a broken generated hook runtime,
      * OR a source layer is behind origin.
-     * `agents doctor` surfaces it as "run `agents status`"; `agents doctor --check`
+     * `agents doctor` surfaces it as "run `agents sync status`"; `agents doctor --check`
      * maps it to a non-zero exit. Orphans are a `prune` concern, not sync drift, so they do
      * NOT set this flag (mirrors the sync-status engine: an orphan alone never
      * flags needsSync).