@phnx-labs/agents-cli 1.22.42 → 1.22.44

package/dist/lib/daemon/daemon.js

@@ -11,7 +11,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import { getDaemonDir } from '../state.js';
-import { isolatedHomeSuffix, namespacedServiceLabel, serviceManifestHomeEnv } from '../service-manifest.js';
+import { isolatedHomeSuffix, namespacedServiceLabel, serviceManifestHomeEnv, serviceManagerRegistrationAllowed } from '../service-manifest.js';
 import { isAlive, killTree, backgroundSpawnOptions, waitForExit } from '../platform/index.js';
 import { listJobs as listAllJobs } from '../scheduling/routines.js';
 import { syncAllProjectRoutines } from '../routines-project.js';
@@ -1763,6 +1763,9 @@ export { getAgentsBinPath };
  * in fact up. Returns null when the service isn't running or the query fails.
  */
 function readServiceManagerPid(platform = os.platform()) {
+    const reg = serviceManagerRegistrationAllowed();
+    if (!reg.allowed)
+        return null;
     try {
         if (platform === 'linux') {
             const out = execFileSync('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', daemonSystemdUnitName()], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
@@ -1865,6 +1868,17 @@ export function ensureDaemonStarted() {
     // callers that branch on this return (e.g. secrets/agent.ts).
     if (isDaemonRunning())
         return startDaemon();
+    // RUSH-3021: never LAUNCH a daemon from a redirected (sandbox/test) HOME.
+    // #2860 gated service-manager registration on this signal but left the
+    // detached spawn itself ungated, so a test-spawned CLI could fork a daemon
+    // into the test's temp HOME; the child outlives the test and races its
+    // recursive teardown rm (ENOTEMPTY). Placed after the already-running branch
+    // — reporting a live daemon stays allowed, same as the circuit breaker.
+    // AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME=1 is the test seam for suites
+    // that exercise daemon startup deliberately; `agents daemon start` remains
+    // the operator override.
+    if (!serviceManagerRegistrationAllowed().allowed)
+        return null;
     // RUSH-2418: the auto-start circuit breaker. A daemon that dies during
     // startup would otherwise be relaunched by EVERY foreground command that
     // wants one (secrets unlock, browser start, watchdog, ...) — an
@@ -1912,61 +1926,72 @@ function startDaemonLocked(agentsBin, releaseLock) {
         releaseLock();
         return startDetached({ agentsBin });
     };
+    const reg = serviceManagerRegistrationAllowed();
     if (platform === 'darwin') {
-        try {
-            const plistPath = getLaunchdPlistPath();
-            const plistDir = path.dirname(plistPath);
-            if (!fs.existsSync(plistDir)) {
-                fs.mkdirSync(plistDir, { recursive: true });
-            }
-            // The plist carries no credential (RUSH-1759 — the daemon reads the OAuth
-            // token itself at startup); still create owner-only atomically to match the
-            // detached path and keep the log/PATH surface owner-private.
-            writeOwnerOnlyServiceManifest(plistPath, generateLaunchdPlist(agentsBin));
+        if (reg.allowed) {
             try {
-                execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+                const plistPath = getLaunchdPlistPath();
+                const plistDir = path.dirname(plistPath);
+                if (!fs.existsSync(plistDir)) {
+                    fs.mkdirSync(plistDir, { recursive: true });
+                }
+                // The plist carries no credential (RUSH-1759 — the daemon reads the OAuth
+                // token itself at startup); still create owner-only atomically to match the
+                // detached path and keep the log/PATH surface owner-private.
+                writeOwnerOnlyServiceManifest(plistPath, generateLaunchdPlist(agentsBin));
+                try {
+                    execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+                }
+                catch { /* not loaded, expected */ }
+                // launchctl prints `Load failed:` and exits 0 when the label is in a
+                // stuck state from a prior session — so a zero exit code isn't proof
+                // of success. If no pid materializes within the window, give up on
+                // launchd and fall through to a plain detached spawn.
+                execFileSync('launchctl', ['load', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
+                // Launch issued — the child needs this lock to claim (RUSH-2417).
+                releaseLock();
+                const pid = waitForPid(3000) ?? readServiceManagerPid();
+                if (pid)
+                    return { pid, method: 'launchd' };
+                // launchctl claimed success but nothing ran. Fall through.
+            }
+            catch {
+                // load threw — fall through to detached spawn
             }
-            catch { /* not loaded, expected */ }
-            // launchctl prints `Load failed:` and exits 0 when the label is in a
-            // stuck state from a prior session — so a zero exit code isn't proof
-            // of success. If no pid materializes within the window, give up on
-            // launchd and fall through to a plain detached spawn.
-            execFileSync('launchctl', ['load', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-            // Launch issued — the child needs this lock to claim (RUSH-2417).
-            releaseLock();
-            const pid = waitForPid(3000) ?? readServiceManagerPid();
-            if (pid)
-                return { pid, method: 'launchd' };
-            // launchctl claimed success but nothing ran. Fall through.
         }
-        catch {
-            // load threw — fall through to detached spawn
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         return detachedFallback();
     }
     if (platform === 'linux') {
-        try {
-            const unitPath = getSystemdUnitPath();
-            const unitDir = path.dirname(unitPath);
-            if (!fs.existsSync(unitDir)) {
-                fs.mkdirSync(unitDir, { recursive: true });
+        if (reg.allowed) {
+            try {
+                const unitPath = getSystemdUnitPath();
+                const unitDir = path.dirname(unitPath);
+                if (!fs.existsSync(unitDir)) {
+                    fs.mkdirSync(unitDir, { recursive: true });
+                }
+                // Carries no credential (RUSH-1759 — the daemon reads the OAuth token
+                // itself at startup); owner-only to keep the PATH/log surface private.
+                writeOwnerOnlyServiceManifest(unitPath, generateSystemdUnit(agentsBin));
+                execFileSync('systemctl', ['--user', 'daemon-reload'], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'enable', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'start', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                // Launch issued — the child needs this lock to claim (RUSH-2417).
+                releaseLock();
+                const pid = waitForPid(3000) ?? readServiceManagerPid();
+                if (pid)
+                    return { pid, method: 'systemd' };
+                // systemctl returned success but no PID surfaced — fall through to a
+                // plain detached spawn rather than reporting a null PID.
+            }
+            catch {
+                // start threw — fall through to detached spawn
             }
-            // Carries no credential (RUSH-1759 — the daemon reads the OAuth token
-            // itself at startup); owner-only to keep the PATH/log surface private.
-            writeOwnerOnlyServiceManifest(unitPath, generateSystemdUnit(agentsBin));
-            execFileSync('systemctl', ['--user', 'daemon-reload'], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'enable', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'start', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            // Launch issued — the child needs this lock to claim (RUSH-2417).
-            releaseLock();
-            const pid = waitForPid(3000) ?? readServiceManagerPid();
-            if (pid)
-                return { pid, method: 'systemd' };
-            // systemctl returned success but no PID surfaced — fall through to a
-            // plain detached spawn rather than reporting a null PID.
         }
-        catch {
-            // start threw — fall through to detached spawn
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         return detachedFallback();
     }
@@ -2261,29 +2286,43 @@ export function stopDaemon() {
     const released = [];
     const surviving = [];
     let escalated = false;
+    const reg = serviceManagerRegistrationAllowed();
     if (platform === 'darwin') {
         const plistPath = getLaunchdPlistPath();
         if (fs.existsSync(plistPath)) {
+            if (reg.allowed) {
+                try {
+                    execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8' });
+                }
+                catch (err) {
+                    if (process.env.AGENTS_DEBUG) {
+                        console.error(`[debug] launchctl unload failed: ${err.message}`);
+                    }
+                }
+            }
+            else {
+                process.stderr.write(`[agents] ${reg.reason}\n`);
+            }
             try {
-                execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8' });
                 fs.unlinkSync(plistPath);
             }
+            catch { /* plist already removed */ }
+        }
+    }
+    if (platform === 'linux') {
+        if (reg.allowed) {
+            try {
+                execFileSync('systemctl', ['--user', 'stop', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'disable', daemonSystemdUnitName()], { encoding: 'utf-8' });
+            }
             catch (err) {
                 if (process.env.AGENTS_DEBUG) {
-                    console.error(`[debug] launchctl unload failed: ${err.message}`);
+                    console.error(`[debug] systemctl stop failed: ${err.message}`);
                 }
             }
         }
-    }
-    if (platform === 'linux') {
-        try {
-            execFileSync('systemctl', ['--user', 'stop', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'disable', daemonSystemdUnitName()], { encoding: 'utf-8' });
-        }
-        catch (err) {
-            if (process.env.AGENTS_DEBUG) {
-                console.error(`[debug] systemctl stop failed: ${err.message}`);
-            }
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         const unitPath = getSystemdUnitPath();
         if (fs.existsSync(unitPath)) {

package/dist/lib/daemon/daemon.test-fixture.d.ts

@@ -0,0 +1,24 @@
+import { type KeychainBackend } from '../secrets/index.js';
+/**
+ * Shared fixture for the daemon.*.test.ts suite slices (RUSH-2819).
+ *
+ * daemon.test.ts was a single 2201-line file (88 tests, ~112s in CI) — the
+ * slowest file in the daemon test-ownership group, serializing an entire
+ * vitest fork while every other selected file finished. The suite is split
+ * into topical slices so per-file fork parallelism can spread the
+ * process-spawning / real-daemon integration tests across workers; the
+ * helpers shared by more than one slice live here.
+ */
+/** An in-memory KeychainBackend stand-in, so a test never touches the real OS keychain. */
+export declare function makeMemoryBackend(): {
+    backend: KeychainBackend;
+    store: Map<string, string>;
+};
+/**
+ * Registers the keychain-backend swap + AGENTS_SECRETS_NO_AGENT hermeticity
+ * beforeEach/afterEach every slice of the original daemon.test.ts ran under,
+ * verbatim. Call once at the top level of each slice file.
+ */
+export declare function installKeychainHermeticity(): void;
+export declare const REPO_ROOT: string;
+export declare const DIST_ENTRY: string;

package/dist/lib/daemon/daemon.test-fixture.js

@@ -0,0 +1,71 @@
+import { beforeEach, afterEach } from 'vitest';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { setKeychainBackendForTest } from '../secrets/index.js';
+import { deleteBundle } from '../secrets/bundles.js';
+/**
+ * Shared fixture for the daemon.*.test.ts suite slices (RUSH-2819).
+ *
+ * daemon.test.ts was a single 2201-line file (88 tests, ~112s in CI) — the
+ * slowest file in the daemon test-ownership group, serializing an entire
+ * vitest fork while every other selected file finished. The suite is split
+ * into topical slices so per-file fork parallelism can spread the
+ * process-spawning / real-daemon integration tests across workers; the
+ * helpers shared by more than one slice live here.
+ */
+/** An in-memory KeychainBackend stand-in, so a test never touches the real OS keychain. */
+export function makeMemoryBackend() {
+    const store = new Map();
+    const backend = {
+        has: (item) => store.has(item),
+        get: (item) => {
+            const v = store.get(item);
+            if (v === undefined)
+                throw new Error(`Keychain item '${item}' not found.`);
+            return v;
+        },
+        set: (item, value) => { store.set(item, value); },
+        delete: (item) => store.delete(item),
+        list: (prefix) => Array.from(store.keys()).filter((k) => k.startsWith(prefix)),
+    };
+    return { backend, store };
+}
+/**
+ * Registers the keychain-backend swap + AGENTS_SECRETS_NO_AGENT hermeticity
+ * beforeEach/afterEach every slice of the original daemon.test.ts ran under,
+ * verbatim. Call once at the top level of each slice file.
+ */
+export function installKeychainHermeticity() {
+    let restore = null;
+    let prevNoAgent;
+    beforeEach(() => {
+        const m = makeMemoryBackend();
+        restore = setKeychainBackendForTest(m.backend);
+        // Hermeticity: readAndResolveBundleEnv consults the running secrets-agent
+        // (bundles.ts agentGetSync fast-path) BEFORE the injected keychain backend.
+        // On a dev machine where the agent is live and the real `claude` bundle is
+        // unlocked, that returns the machine's real CLAUDE_CODE_OAUTH_TOKEN and this
+        // test reads a live credential instead of the seeded value (CI has no agent,
+        // so it only bites locally). Disable the agent so the read falls through to
+        // the in-memory backend above — hermetic regardless of host state.
+        prevNoAgent = process.env.AGENTS_SECRETS_NO_AGENT;
+        process.env.AGENTS_SECRETS_NO_AGENT = '1';
+    });
+    afterEach(() => {
+        try {
+            deleteBundle('claude');
+        }
+        catch { /* not created */ }
+        setKeychainBackendForTest(restore);
+        if (prevNoAgent === undefined)
+            delete process.env.AGENTS_SECRETS_NO_AGENT;
+        else
+            process.env.AGENTS_SECRETS_NO_AGENT = prevNoAgent;
+    });
+}
+// The real compiled CLI entry, shared by every slice that drives an actual
+// `__daemon-run` subprocess (lifecycle/registry/stop). Computed relative to
+// this file's own location, which stays in src/lib/daemon/ alongside every
+// slice, so the path math is unaffected by the split.
+export const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+export const DIST_ENTRY = path.join(REPO_ROOT, 'dist', 'index.js');

package/dist/lib/daemon/runner.d.ts

@@ -74,6 +74,23 @@ interface RoutineAttempt {
  * but the gate should have paused such a routine before it ever spawned.
  */
 export declare function routineSpawnCwd(config: Pick<JobConfig, 'name' | 'project' | 'cwd' | 'agent' | 'workflow' | 'command'>): string;
+/**
+ * Bake the daemon-job argv skeleton from AGENT_COMMANDS.
+ *
+ * The two tables used to be independent copies of the same launch decision.
+ * Argv now comes from AGENT_COMMANDS.base / promptFlag / jsonFlags / modeFlags.
+ * Two documented exceptions, not a second table:
+ *   - kimi uses `--prompt` (long form). `-p` is the exec alias; combining
+ *     either with --plan/--auto/--yolo aborts, so routineModeArgs emits no
+ *     mode flag. The daemon has always spawned the long form.
+ *   - claude places `--verbose` (from jsonFlags) before the prompt and bakes
+ *     modeFlags.plan so claudeAdapter.routineModeArgs can splice
+ *     plan → acceptEdits / auto / skip.
+ *
+ * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (gemini, grok,
+ * and every other harness the daemon does not fire locally).
+ */
+export declare function bakeRoutineArgv(agent: string): string[] | undefined;
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export declare function buildJobCommand(config: JobConfig, resolvedPrompt: string, forwardAccount?: boolean): string[];
 /**
@@ -161,7 +178,7 @@ export declare function buildHostDispatchOptions(config: JobConfig, ctx: {
     runDir: string;
     detached: boolean;
 }): import('../hosts/run-target.js').HostPromptRun;
-export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow' | 'resume'>): boolean;
+export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow' | 'resume' | 'agent'>): boolean;
 /**
  * Merge sandbox/base env with the canonical per-version exec env
  * (CLAUDE_CONFIG_DIR / CODEX_HOME / …) so routines share account isolation

package/dist/lib/daemon/runner.js

@@ -21,7 +21,7 @@ import { getCliLaunch, getAgentsBinDir } from '../cli-entry.js';
 import { resolveJobPrompt, parseTimeout, writeRunMeta, listRuns, getJobRunsDir, getRunDir, checkJobDeviceEligibility, finalizeRunMeta, resolveJobExecutionContext, slotRunId, claimRunSlot, readRunMeta, resolveHostStrategy, } from '../scheduling/routines.js';
 import { getRunsDir, getUserAgentsDir, readMeta, getDaemonDir } from '../state.js';
 import { shortCodexHome } from '../codex-home.js';
-import { prepareJobHome, buildSpawnEnv, getJobHomePath } from '../sandbox.js';
+import { prepareJobHome, buildSpawnEnv, getJobHomePath, assertSandboxForwardsHostGhAuth } from '../sandbox.js';
 import { resolveModel, buildReasoningFlags } from '../models.js';
 import { createTimer, redactPrompt, emitRoutineEnd } from '../feed/events.js';
 import { resolveHarnessAdapter } from '../harness/index.js';
@@ -39,7 +39,8 @@ import { resolveClaudeSetupToken } from '../claude-account-token.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, } from '../accounting/rotate.js';
 import { readAuthHealth, isDeadVerdict } from '../auth-health.js';
 import { machineId } from '../machine-id.js';
-import { isSelfUpdatingAgent, ROUTINE_AGENT_COMMANDS, isAgentHardDeprecated, hardDeprecationError } from '../agents.js';
+import { isSelfUpdatingAgent, ROUTINE_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../agents.js';
+import { isCustomHarnessName, readProfile } from '../profiles.js';
 export class RoutineAlreadyRunningError extends Error {
     constructor(jobName, runId) {
         super(`Routine '${jobName}' already has a running execution (${runId})`);
@@ -308,7 +309,7 @@ function allocateRoutineAttempt(config, trigger) {
     // harness leaves the command table (gemini did), and the legacy routine must
     // still land a visible 'blocked' record, never a generic buildJobCommand
     // failure (RUSH-2202).
-    if (!config.workflow && config.agent && isAgentHardDeprecated(config.agent)) {
+    if (!config.workflow && config.agent && !isCustomHarnessName(config.agent) && isAgentHardDeprecated(config.agent)) {
         const reason = hardDeprecationError(config.agent);
         return {
             proceed: false,
@@ -488,6 +489,48 @@ export function routineSpawnCwd(config) {
     const ctx = resolveJobExecutionContext(config, { mode: 'local' });
     return ctx.absoluteCwd ?? os.homedir();
 }
+/**
+ * Bake the daemon-job argv skeleton from AGENT_COMMANDS.
+ *
+ * The two tables used to be independent copies of the same launch decision.
+ * Argv now comes from AGENT_COMMANDS.base / promptFlag / jsonFlags / modeFlags.
+ * Two documented exceptions, not a second table:
+ *   - kimi uses `--prompt` (long form). `-p` is the exec alias; combining
+ *     either with --plan/--auto/--yolo aborts, so routineModeArgs emits no
+ *     mode flag. The daemon has always spawned the long form.
+ *   - claude places `--verbose` (from jsonFlags) before the prompt and bakes
+ *     modeFlags.plan so claudeAdapter.routineModeArgs can splice
+ *     plan → acceptEdits / auto / skip.
+ *
+ * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (gemini, grok,
+ * and every other harness the daemon does not fire locally).
+ */
+export function bakeRoutineArgv(agent) {
+    if (!ROUTINE_AGENT_IDS.includes(agent))
+        return undefined;
+    const template = AGENT_COMMANDS[agent];
+    if (!template)
+        return undefined;
+    const json = template.jsonFlags ?? [];
+    const cmd = [...template.base];
+    if (agent === 'kimi') {
+        cmd.push('--prompt', '{prompt}', ...json);
+        return cmd;
+    }
+    if (agent === 'claude') {
+        const verbose = json.includes('--verbose') ? ['--verbose'] : [];
+        const jsonRest = json.filter((flag) => flag !== '--verbose');
+        cmd.push(template.promptFlag, ...verbose, '{prompt}', ...jsonRest, ...(template.modeFlags.plan ?? []));
+        return cmd;
+    }
+    if (template.promptFlag === 'positional') {
+        cmd.push('{prompt}', ...json);
+    }
+    else {
+        cmd.push(template.promptFlag, '{prompt}', ...json);
+    }
+    return cmd;
+}
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export function buildJobCommand(config, resolvedPrompt, forwardAccount = true) {
     // Workflow branch: delegate to `agents run <workflow>` which handles subagent
@@ -514,9 +557,25 @@ export function buildJobCommand(config, resolvedPrompt, forwardAccount = true) {
             cmd.push('--account', config.account);
         return cmd;
     }
-    const template = ROUTINE_AGENT_COMMANDS[agent];
+    // Custom-harness branch: delegate to `agents run <name>`, which owns profile
+    // resolution (host binary, model env, provider auth) — the same delegation
+    // the workflow and resume branches use. The profile pins its own version and
+    // auth, so no command template, binary pinning, or account-env injection
+    // applies here.
+    if (isCustomHarnessName(agent)) {
+        const cmd = ['agents', 'run', agent, resolvedPrompt, '--mode', config.mode];
+        if (config.account && forwardAccount)
+            cmd.push('--account', config.account);
+        return cmd;
+    }
+    const template = bakeRoutineArgv(agent);
     if (!template) {
-        throw new Error(`Unsupported agent for daemon jobs: ${agent}`);
+        // A name outside both tables was either never valid or was a custom
+        // harness whose profile has since been deleted — validateJob accepted it
+        // against a profile that existed then. Name the repair, not just the miss.
+        throw new Error(`Unsupported agent for daemon jobs: ${agent}. ` +
+            `If '${agent}' was a custom harness, its profile no longer exists on this device — ` +
+            `recreate it (agents harness add ${agent} ...) or point the routine at another agent.`);
     }
     let cmd = template.map((part) => part.replace('{prompt}', resolvedPrompt));
     // Canonicalize mode (accepts legacy `full` as alias for `skip`).
@@ -554,7 +613,8 @@ export function buildJobCommand(config, resolvedPrompt, forwardAccount = true) {
  * Reasoning level (config.config.reasoning) maps to per-agent flags via models.ts.
  */
 function appendModelAndReasoning(cmd, config) {
-    // Only called from buildJobCommand's agent path — config.agent is set.
+    // Only called from buildJobCommand's agent path AFTER the custom-harness
+    // branch returned — config.agent is a native id here.
     const agent = config.agent;
     const model = config.config?.model;
     if (model) {
@@ -636,6 +696,8 @@ function transcriptBasePath(runDir) {
 export function snapshotRoutineTranscriptBase(meta, runDir, overlayHome) {
     if (!meta.agent)
         return;
+    // A host/cloud custom-harness run records the harness name, which has no
+    // transcript spec — the null-specs guard below skips it, as before.
     const specs = ROUTINE_TRANSCRIPT_SPECS[meta.agent];
     if (!specs)
         return;
@@ -674,6 +736,8 @@ function readTranscriptBase(runDir) {
 export function archiveRoutineTranscripts(meta, runDir, overlayHome) {
     if (!meta.agent)
         return;
+    // A host/cloud custom-harness run records the harness name, which has no
+    // transcript spec — the null-specs guard below skips it, as before.
     const specs = ROUTINE_TRANSCRIPT_SPECS[meta.agent];
     if (!specs)
         return;
@@ -808,6 +872,13 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
     if (config.workflow) {
         return { chain: [], rotation: null, pinned: false };
     }
+    if (config.agent && isCustomHarnessName(config.agent)) {
+        // A custom harness pins its own version/auth in the profile, so there is
+        // no version/account chain to resolve here — `agents run <name>` owns it
+        // (matching exec's "strategy ignored: custom harness pins its own
+        // version/auth").
+        return { chain: [], rotation: null, pinned: false };
+    }
     // resolveRoutineLaunch is only called for agent jobs (workflow returns above;
     // command jobs branch out of execute*Job before reaching this).
     const agent = config.agent;
@@ -1012,7 +1083,7 @@ export function buildHostDispatchOptions(config, ctx) {
     };
 }
 export function dispatchesViaAgentsRun(config) {
-    return Boolean(config.workflow || config.resume);
+    return Boolean(config.workflow || config.resume || (config.agent && isCustomHarnessName(config.agent)));
 }
 /**
  * Merge sandbox/base env with the canonical per-version exec env
@@ -1214,7 +1285,11 @@ async function executeJobPlaced(config, deps, attempt) {
     // the agent's config dir, and the sandbox overlay home has only a freshly-generated
     // config with no session store. So a resume job is never sandboxed, regardless of
     // `config.sandbox` (see the resume branch in buildJobCommand).
-    const useSandbox = config.sandbox !== false && !config.resume;
+    // Resume needs the REAL home (session store); a custom harness needs it too —
+    // the delegated `agents run <name>` resolves ~/.agents (profiles, setup
+    // sentinel, version homes) from HOME, which the overlay would hide. Exec
+    // still isolates the run in the host version home it swaps HOME into.
+    const useSandbox = config.sandbox !== false && !config.resume && !(config.agent && isCustomHarnessName(config.agent));
     const overlayHome = useSandbox ? prepareJobHome(config) : undefined;
     const runId = attempt.runId;
     const runDir = getRunDir(config.name, runId);
@@ -1225,7 +1300,11 @@ async function executeJobPlaced(config, deps, attempt) {
     // Workflows run via `agents run <workflow>` which delegates to claude under the hood.
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
     // (command jobs branched out earlier, so config.agent is set on the non-workflow path.)
-    const effectiveAgent = config.workflow ? 'claude' : config.agent;
+    const effectiveAgent = config.workflow
+        ? 'claude'
+        : isCustomHarnessName(config.agent)
+            ? readProfile(config.agent).host.agent
+            : config.agent;
     if (!dispatchesViaAgentsRun(config)) {
         const { findUnifiedAccount, resolveAccountSelection, resolveCredentialAccount } = await import('../account-registry.js');
         const meta = readMeta();
@@ -1238,6 +1317,9 @@ async function executeJobPlaced(config, deps, attempt) {
                 Object.assign(baseEnv, resolveCredentialAccount(selectedAccount, effectiveAgent).env);
         }
     }
+    // RUSH-2860: if this host holds gh auth, the sandbox child MUST see it.
+    if (useSandbox)
+        assertSandboxForwardsHostGhAuth(baseEnv);
     const meta = {
         jobName: config.name,
         runId,
@@ -1728,7 +1810,11 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
     // the agent's config dir, and the sandbox overlay home has only a freshly-generated
     // config with no session store. So a resume job is never sandboxed, regardless of
     // `config.sandbox` (see the resume branch in buildJobCommand).
-    const useSandbox = config.sandbox !== false && !config.resume;
+    // Resume needs the REAL home (session store); a custom harness needs it too —
+    // the delegated `agents run <name>` resolves ~/.agents (profiles, setup
+    // sentinel, version homes) from HOME, which the overlay would hide. Exec
+    // still isolates the run in the host version home it swaps HOME into.
+    const useSandbox = config.sandbox !== false && !config.resume && !(config.agent && isCustomHarnessName(config.agent));
     const overlayHome = useSandbox ? prepareJobHome(config) : undefined;
     const runId = attempt.runId;
     const runDir = getRunDir(config.name, runId);
@@ -1755,7 +1841,15 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
         })()
         // Non-command path only: config.agent is always set here (command/workflow branch earlier).
         : buildRoutineSpawnEnv(baseEnv, config.agent, version, config.timezone, overlayHome);
-    const effectiveAgent = config.workflow ? 'claude' : config.agent;
+    // RUSH-2860: if this host holds gh auth, the sandbox child MUST see it —
+    // otherwise monitors runs records ok while every gh call inside fails.
+    if (useSandbox)
+        assertSandboxForwardsHostGhAuth(spawnEnv);
+    const effectiveAgent = config.workflow
+        ? 'claude'
+        : isCustomHarnessName(config.agent)
+            ? readProfile(config.agent).host.agent
+            : config.agent;
     const meta = {
         jobName: config.name,
         runId,

package/dist/lib/daemon-ticks.d.ts

@@ -18,11 +18,48 @@ export declare function isFreshFleetAuthSnapshot(value: {
     row: FleetStatusRow;
     authRows: AuthProbeRow[];
 }, minimumCapturedAt: number): boolean;
+/**
+ * How stale a cached auth verdict may get before the periodic tick re-probes.
+ *
+ * The auth verdict rides the same rate-limited `/api/oauth/usage` endpoint as
+ * the usage probe. Firing it every 3-minute tick on every fleet device drove one
+ * per-account request quota to a permanent 429, and the shared backoff then
+ * parked usage fleet-wide and froze the usage cache (RUSH-2998). Re-probing at
+ * most every 20 minutes cuts that endpoint traffic ~5x while still catching a
+ * revocation within one window — and every device keeps a REAL verdict (not a
+ * degraded "unverified"), so `agents devices ping --strict` and the run
+ * auth-preflight keep working on every host, unlike a publisher/subscriber split
+ * that would blind every non-primary box to revocation. Fleet status still
+ * publishes every tick — it does not ride that endpoint.
+ */
+export declare const AUTH_PROBE_MAX_AGE_MS: number;
+/**
+ * True when every cached auth row was probed within {@link AUTH_PROBE_MAX_AGE_MS}
+ * — i.e. reusing them would not let a verdict get staler than one probe window.
+ * Empty cache is never fresh (nothing to reuse). Pure — unit-tested.
+ */
+export declare function isCachedFleetAuthProbeFresh(authRows: AuthProbeRow[], now: number, maxAgeMs?: number): boolean;
+/**
+ * Whether the tick may reuse the cached auth verdict instead of re-probing the
+ * rate-limited endpoint. `force` (an on-demand `agents devices ping`) ALWAYS
+ * re-probes — the whole point of the command is a genuinely live verdict, and
+ * missing this `!force` is exactly how a `--strict` check silently passed a
+ * revoked account (the second `runFleetPing` call site, RUSH-2998). Pure —
+ * unit-tested so that inversion cannot regress unnoticed.
+ */
+export declare function shouldReuseCachedAuthProbe(force: boolean, cached: AuthProbeRow[], now: number, maxAgeMs?: number): boolean;
 /**
  * Fleet cache warm: publish THIS host's row for the caches `agents fleet
  * status` / `agents devices list` read (PUBLISH-OWN / READ-UNION, RUSH-2061).
+ *
+ * `force` is set by on-demand callers (`agents devices ping`) that must return a
+ * genuinely live verdict; the periodic daemon tick leaves it unset so it reuses a
+ * recent verdict per {@link AUTH_PROBE_MAX_AGE_MS} instead of hammering the
+ * rate-limited endpoint every 3 minutes (RUSH-2998).
  */
-export declare function refreshLocalFleetAuthState(): Promise<{
+export declare function refreshLocalFleetAuthState(opts?: {
+    force?: boolean;
+}): Promise<{
     row: FleetStatusRow;
     authRows: import('./auth-health.js').AuthProbeRow[];
 }>;