@phnx-labs/agents-cli 1.22.49 → 1.22.50

package/CHANGELOG.md

@@ -1,5 +1,107 @@
 # Changelog
 
+## 1.22.50
+
+### Fixed
+
+- **Teams now persist observed teammate failure evidence and keep independent DAG branches moving.** Placement, local/remote launch, cloud dispatch, dependency, and process-exit failures carry a stable code, sanitized message, exit code, retryability, and observation time in `teams status` text/JSON. A runnable node with a durable placement failure fails independently; a node blocked only by pool capacity or load stays pending with retryable evidence so a later wave can launch it. Descendants name failed or missing `--after` blockers instead of spinning until `--max-waves`. `teams start` (no `--watch`) reports teammates that failed during the wave in a `Failed this wave` section (JSON: `failed[]` with evidence) and exits non-zero when a wave produced only failures. Because a failed launch now keeps its record (evidence) instead of deleting it, re-running the identical `teams add --name <name>` after a failure requires `teams remove <team> <name>` first.
+  Successfully resuming a failed teammate clears the prior attempt's evidence as
+  the replacement enters `running`; a replacement that fails to launch restores
+  the original terminal state and evidence intact.
+
+- **Register the Phoenix session with Prix after sync (PHNX-3257).** A successful
+  (non-dry-run) `agents traces sync` now fire-and-forget POSTs the Phoenix bearer
+  to `api.prix.dev/api/v1/traces/link`, so the Prix web console can mint a token
+  and serve live trajectories instead of fixtures. Scoped to the managed Phoenix
+  backend only — a BYO/self-hosted `AGENTS_TRACES_WRITE_TOKEN` is never sent to
+  Prix. Source: `cli/src/lib/traces/sync.ts`.
+
+- **Ship `traces-daily-sync` routine (PHNX-3258).** Daily `agents traces sync` at 02:00 UTC
+  to accumulate `bucketHistory` for drift signals; requires a device pin
+  (`agents routines devices traces-daily-sync --set <name>`) before it fires.
+  Source: `cli/routines/traces-daily-sync.yml`.
+
+- **`--strategy balanced` now spreads across your provider accounts, not just
+  native logins (RUSH-3182).** A setup-token or API-key account added with
+  `agents accounts add` is now a first-class balancing candidate for every harness
+  its provider can authenticate — claude, codex, grok, cursor, opencode (a harness
+  with only a native login and no provider adapter, like kimi, keeps balancing its
+  native logins). Before, balanced only rotated across accounts that sat in a version
+  home, so a worker's shared setup-tokens never participated and `--account`
+  couldn't select them. The run path folds those provider accounts into the
+  candidate list and injects the picked one through the existing `--account` path
+  (a setup-token still authenticates via `CLAUDE_CODE_OAUTH_TOKEN`); the other
+  candidate consumers — the watchdog, session recovery, teams placement — keep the
+  native-only list, so nothing else changes. On a box dominated by verified native
+  logins a usage-less provider account is deprioritized until the daemon fetches
+  its usage; on a worker (setup-token majority) it participates immediately.
+  Source: `cli/src/lib/accounting/account-pool.ts`,
+  `cli/src/lib/accounting/account-pool-collect.ts`,
+  `cli/src/lib/accounting/rotate.ts`, `cli/src/commands/exec.ts`.
+
+- **The attestation producer skips the helper manifest by default too (RUSH-3216).**
+  `release.sh` gained `--with-helpers` so an ordinary release does no helper work, but
+  `release-attestation-produce.sh` kept the same unconditional
+  `release-manifest.sh` verification — so the coupling survived one step upstream. Found
+  live: a one-line **comment** fix in `native/computer-mac/scripts/build.sh` (an
+  `apps/cli/` → `cli/` path in prose) changed that helper's input digest and aborted an
+  otherwise-clean 1.22.49 attestation, for a helper the tarball no longer ships and the
+  CLI resolves from its own tag. The producer now takes the same `--with-helpers` flag,
+  default off. Source: `cli/scripts/release-attestation-produce.sh`.
+
+- **`scripts/publish-computer-win.sh` — a publish path for the Windows helper (RUSH-3228).**
+  Its release now triggers on `computer-win/v<x.y.z>` rather than the CLI's `v*` tag, but
+  nothing in the repo cut such a tag, so the trigger would have been dead — trading a
+  wasteful 165 MB rebuild on every CLI release for no rebuild at all. The tag *is* the
+  publish action (`release-exe` builds, smokes on a real windows-latest runner, and
+  uploads the exe + sha256), so a mis-shaped tag is a silent no-op: the script refuses a
+  `v`-prefixed or non-semver version, refuses an existing tag because the upload uses
+  `--clobber` and an installed CLI may already pin it, and is dry-run by default.
+  Symmetric with `publish-computer-helper-mac.sh`. Source: `cli/scripts/publish-computer-win.sh`.
+
+- **`scripts/test.sh --shard <n>` — fan the suite across n fleet workers (RUSH-3230).**
+  Uses vitest's own `--shard=i/n`, drawing workers from the same auto pool a single
+  `--device auto` run uses, so `role=worker`/`role=personal` marks govern the fan-out too.
+  This is the change that moves release time, and the reason is arithmetic: a measured full
+  run is 3,079s of CPU at 11.5× parallelism on one box, so wall equals CPU/workers (269s) —
+  the suite is **throughput-bound**, not bound by any single slow file. Adding boxes divides
+  the CPU: 3 ≈ 93s, 6 ≈ 47s, 9 ≈ 31s. Shards run concurrently and every one is waited on
+  before reporting, so a failure in one does not hide the others. Requires `agents` ≥ 1.22.49
+  for `devices pick --json`; an older CLI fails naming the version and the fix rather than
+  passing through a commander error. Source: `cli/scripts/test.sh`.
+- **`scripts/test.sh --devices a,b,c` — name the shard workers explicitly (RUSH-3230).**
+  Pins the fan-out to known-idle boxes instead of auto-picking, and skips the
+  `devices pick --json` dependency, so sharding also works from a machine whose installed
+  CLI predates 1.22.49. Source: `cli/scripts/test.sh`.
+- **`--shard` fails loud on a count below 2 and on a conflicting target flag (RUSH-3230).**
+  `--shard 0` previously passed the numeric check, ran zero shards, and still printed
+  `All 0 shards passed.` with exit 0 — a false green that reported success having run no
+  tests. It now requires at least 2 (a single worker is `--device auto`). Separately, `MODE`
+  was last-write-wins with no cross-flag validation, so `--shard 6 --device box` silently
+  dropped one of the two purely on argument order; conflicting target flags now die naming
+  both. Source: `cli/scripts/test.sh`.
+- **`--devices` obeys the same 2-worker floor, and is validated before prerequisites (RUSH-3230).**
+  `--devices onebox` derived the shard count from the list length and skipped the floor
+  entirely, running a one-shard fan-out. The list is now resolved and checked immediately
+  after argument parsing rather than inside the dispatch branch, so a bad invocation reports
+  its own problem instead of dying on a missing `rsync` first. Source: `cli/scripts/test.sh`.
+
+- **Split `ssh.device-config.test.ts`, the second-slowest file (RUSH-3230).** 18 subprocess
+  tests in one file at ~44s locally (151s on a loaded worker) — 8.4s *per test*. Now three
+  files along its existing `describe` boundaries (per-device config / fleet-wide defaults +
+  role + describe / retired-subcommand tombstones) over a shared
+  `device-config-test-harness.ts`: **45s → 19s wall, all 18 tests still passing**, none
+  changed, skipped, or dropped. Source: `cli/src/commands/device-config-test-harness.ts`.
+
+- **Split `daemon.test.ts`, the suite's floor (RUSH-3230).** It was 35 subprocess tests in
+  one file at ~53s locally (159s on a loaded worker) — the slowest file in the repo, and
+  therefore the whole suite's floor, because vitest parallelises across *files* and runs
+  one file's tests sequentially in a single worker. Now three files by theme (command
+  surface / services + webhooks / doctor + logs) over a shared
+  `daemon-test-harness.ts`, so they run concurrently: **53.5s → 26s wall, all 35 tests
+  still passing**. No test was changed, skipped, or dropped. Source:
+  `cli/src/commands/daemon-test-harness.ts`.
+
 ## 1.22.49
 
 - **Check CLI benchmark numbers into `docs/benchmarks.md` (RUSH-2385).** Commander-bootstrap and audit-hook means from the yosemite-s1 vitest bench (PR #2349) plus pointers to OPT-01/OPT-02 live in git. Linear is not the ledger. Source: `cli/docs/benchmarks.md`.

package/README.md

@@ -741,6 +741,16 @@ Teammates run detached -- close your terminal, they keep working. Check in with
 
 Team state is observable via `agents teams list --json` / `agents teams status --json` (compact by default; add `--verbose` for the full per-teammate shape). External tools join it with `sessions --json` (teammates get `isTeamOrigin: true`) and `cloud list --json` (for `--cloud` teammates) to build a unified fleet view. See [docs/observability.md](cli/docs/observability.md).
 
+Placement, spawn, dependency, and non-zero-exit failures are persisted as sanitized
+evidence on the teammate record and shown by `teams status`. A failed root does not stop
+independent DAG branches; descendants name the failed or missing `--after` dependency
+that blocked them instead of remaining pending indefinitely. Capacity- or load-blocked
+placement stays pending with retryable evidence and is reconsidered on the next wave.
+`teams start` reports
+teammates that failed during the wave (`Failed this wave` / JSON `failed[]`) and exits
+non-zero when a wave produced only failures. A failed teammate keeps its record as
+evidence, so re-adding the same name needs `teams remove <team> <name>` first.
+
 ---
 
 ## Cloud

package/dist/commands/accounts.js

@@ -18,7 +18,7 @@ import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
 import { runDevicesAccounts } from './ssh.js';
 import { discoverNativeAccounts } from '../lib/account-catalog.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
-import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
+import { getAccountProvider, listAccountProviders, providerAuthenticatesHarness } from '../lib/account-provider-registry.js';
 import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, labelNativeAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
 function cleanCommandError(command, err) {
     command.error(err instanceof Error ? err.message : String(err), { exitCode: 1, code: 'accounts.error' });
@@ -288,18 +288,6 @@ async function pickLabelIdentity(agent, identities) {
         throw err;
     }
 }
-function providerAuthenticatesHarness(provider, auth, agent) {
-    try {
-        getAccountProvider(provider).envFor(agent, auth);
-        return true;
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.includes('cannot authenticate'))
-            return false;
-        throw err;
-    }
-}
 /** Every account (native + provider) registered/usable for this harness, oldest-first by name. */
 function accountsForHarness(agent) {
     const meta = readMeta();

package/dist/commands/daemon-test-harness.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared harness for the `agents daemon` CLI subprocess suites (RUSH-2354).
+ *
+ * Every test spawns the real CLI against an isolated mkdtemp HOME with no
+ * daemon running — no mocks. Modeled on routines.test.ts.
+ *
+ * EXTRACTED so the suite can live in several files. `daemon.test.ts` was 35
+ * tests in ONE file at 159s — the slowest file in the repo and therefore the
+ * SUITE'S FLOOR, because vitest parallelises across files and runs the tests
+ * inside one file sequentially in a single worker. Splitting the tests across
+ * files lets them run concurrently; sharing the harness is what makes that
+ * possible without duplicating the spawn plumbing.
+ */
+import { spawnSync, type ChildProcess } from 'child_process';
+export declare const REPO_ROOT: string;
+export declare const TSX_IMPORT: string;
+export declare const CLI_ENTRYPOINT: string;
+/**
+ * win32: subprocess CLI + process-group signals / path spawn assumptions
+ * (RUSH-2215). Exported as a PREDICATE, not as a pre-bound `describe.skip` —
+ * vitest's suite type is not nameable across a module boundary (TS4023), so
+ * each suite builds its own `describe` from this.
+ */
+export declare const DAEMON_TESTS_SUPPORTED: boolean;
+/** Provision an isolated HOME with just enough scaffolding for the CLI to boot. */
+export declare function makeHome(): string;
+/** Run `agents daemon <args>` against an isolated HOME — no daemon process ever started. */
+export declare function run(home: string, args: string[]): ReturnType<typeof spawnSync>;
+/**
+ * Spawn a real, long-lived process whose command line ends in `__daemon-run`
+ * (so `isDaemonRunProcess`'s `ps` check accepts it — see
+ * `lib/daemon.test.ts`'s "reaps a live __daemon-run registrant" test, same
+ * technique) and register it in `home`'s OWN instance registry, exactly the
+ * marker `registerDaemonInstance` would write. A real live process, not a
+ * mock — `agents daemon status` reads it through the actual registry +
+ * `ps`-liveness path, the same one the reaper and `stopDaemon`'s postcondition
+ * use.
+ */
+export declare function spawnFakeRegisteredDaemon(home: string): Promise<ChildProcess>;
+/** Register a pid in `home`'s instance registry — the scope stale/duplicate reporting uses. */
+export declare function registerInstance(home: string, pid: number): void;
+export declare function killFakeDaemon(child: ChildProcess): void;

package/dist/commands/daemon-test-harness.js

@@ -0,0 +1,90 @@
+/**
+ * Shared harness for the `agents daemon` CLI subprocess suites (RUSH-2354).
+ *
+ * Every test spawns the real CLI against an isolated mkdtemp HOME with no
+ * daemon running — no mocks. Modeled on routines.test.ts.
+ *
+ * EXTRACTED so the suite can live in several files. `daemon.test.ts` was 35
+ * tests in ONE file at 159s — the slowest file in the repo and therefore the
+ * SUITE'S FLOOR, because vitest parallelises across files and runs the tests
+ * inside one file sequentially in a single worker. Splitting the tests across
+ * files lets them run concurrently; sharing the harness is what makes that
+ * possible without duplicating the spawn plumbing.
+ */
+import { spawnSync, spawn } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { createRequire } from 'module';
+export const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const require = createRequire(import.meta.url);
+export const TSX_IMPORT = pathToFileURL(require.resolve('tsx')).href;
+export const CLI_ENTRYPOINT = path.join(REPO_ROOT, 'src', 'index.ts');
+/**
+ * win32: subprocess CLI + process-group signals / path spawn assumptions
+ * (RUSH-2215). Exported as a PREDICATE, not as a pre-bound `describe.skip` —
+ * vitest's suite type is not nameable across a module boundary (TS4023), so
+ * each suite builds its own `describe` from this.
+ */
+export const DAEMON_TESTS_SUPPORTED = process.platform !== 'win32';
+/** Provision an isolated HOME with just enough scaffolding for the CLI to boot. */
+export function makeHome() {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-daemon-test-'));
+    fs.mkdirSync(path.join(home, '.agents', '.system', '.git'), { recursive: true });
+    fs.writeFileSync(path.join(home, '.agents', 'agents.yaml'), 'agents: {}\n');
+    return home;
+}
+/** Run `agents daemon <args>` against an isolated HOME — no daemon process ever started. */
+export function run(home, args) {
+    return spawnSync('node', ['--import', TSX_IMPORT, CLI_ENTRYPOINT, 'daemon', ...args], {
+        cwd: REPO_ROOT,
+        env: {
+            ...process.env,
+            HOME: home,
+            USERPROFILE: home,
+            AGENTS_SKIP_MIGRATION: '1',
+            AGENTS_NO_AUTOPULL: '1',
+            AGENTS_CLI_DISABLE_AUTO_UPDATE: '1',
+            AGENTS_DAEMON_DIR: path.join(home, '.agents', '.cache', 'helpers', 'daemon'),
+        },
+        encoding: 'utf-8',
+        timeout: 30_000,
+    });
+}
+/**
+ * Spawn a real, long-lived process whose command line ends in `__daemon-run`
+ * (so `isDaemonRunProcess`'s `ps` check accepts it — see
+ * `lib/daemon.test.ts`'s "reaps a live __daemon-run registrant" test, same
+ * technique) and register it in `home`'s OWN instance registry, exactly the
+ * marker `registerDaemonInstance` would write. A real live process, not a
+ * mock — `agents daemon status` reads it through the actual registry +
+ * `ps`-liveness path, the same one the reaper and `stopDaemon`'s postcondition
+ * use.
+ */
+export async function spawnFakeRegisteredDaemon(home) {
+    const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1e9)', '__daemon-run'], {
+        stdio: 'ignore',
+    });
+    // Give the exec a moment to land before `ps` (read by the status command's
+    // isDaemonRunProcess check) is asked to see its real argv — mirrors
+    // lib/daemon.test.ts's identical fake-daemon technique.
+    await new Promise((r) => setTimeout(r, 150));
+    const instancesDir = path.join(home, '.agents', '.cache', 'helpers', 'daemon', 'instances');
+    fs.mkdirSync(instancesDir, { recursive: true });
+    fs.writeFileSync(path.join(instancesDir, String(child.pid)), '__daemon-run', 'utf-8');
+    return child;
+}
+/** Register a pid in `home`'s instance registry — the scope stale/duplicate reporting uses. */
+export function registerInstance(home, pid) {
+    const dir = path.join(home, '.agents', '.cache', 'helpers', 'daemon', 'instances');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, String(pid)), '__daemon-run', 'utf-8');
+}
+export function killFakeDaemon(child) {
+    try {
+        if (child.pid)
+            process.kill(child.pid, 'SIGKILL');
+    }
+    catch { /* already gone */ }
+}

package/dist/commands/device-config-test-harness.d.ts

@@ -0,0 +1,11 @@
+export declare const REPO_ROOT: string;
+export declare const INDEX: string;
+export declare function guardedHome(): void;
+export declare function run(args: string[], extraEnv?: Record<string, string>): {
+    stdout: string;
+    stderr: string;
+    status: number | null;
+};
+export declare function centralDoc(): string;
+export declare function deviceDoc(name: string): string;
+export declare function addDevice(name: string, target?: string): void;

package/dist/commands/device-config-test-harness.js

@@ -0,0 +1,59 @@
+import { afterEach, expect } from 'vitest';
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+// End-to-end tests for the unified `agents devices config` surface and the
+// retired-subcommand tombstones (configure / note / set / set-interactive /
+// enable / disable / prefer / unprefer). Spawns the REAL CLI against a
+// throwaway HOME (same pattern as ssh.test.ts) — no mocking; the assertions
+// read the actual files the commands wrote: per-device docs under
+// devices/<name>/agents.yaml (device layer) and central agents.yaml
+// fleet.defaults.config (fleet layer).
+export const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+export const INDEX = path.join(REPO_ROOT, 'src', 'index.ts');
+let testHome = '';
+afterEach(() => {
+    if (testHome)
+        fs.rmSync(testHome, { recursive: true, force: true });
+    testHome = '';
+});
+export function guardedHome() {
+    testHome = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-devices-config-home-'));
+    const systemDir = path.join(testHome, '.agents', '.system');
+    fs.mkdirSync(path.join(systemDir, '.git'), { recursive: true });
+    fs.writeFileSync(path.join(systemDir, '.update-check'), JSON.stringify({ lastCheck: 4102444800000, latestVersion: '0.0.0' }));
+}
+export function run(args, extraEnv = {}) {
+    const r = spawnSync('bun', [INDEX, ...args], {
+        encoding: 'utf-8',
+        env: {
+            ...process.env,
+            HOME: testHome,
+            // os.homedir() reads USERPROFILE on Windows, so HOME alone leaves the
+            // spawned CLI resolving the real profile ('agents-cli is not set up').
+            USERPROFILE: testHome,
+            AGENTS_NO_UPDATE_CHECK: '1',
+            AGENTS_NO_USAGE_TRACK: '1',
+            // Default identity is mac-mini so machine-local keys (scheduler, tmux,
+            // browser consent) can be set in these tests. Override per-call to act
+            // as a different box.
+            AGENTS_SYNC_MACHINE_ID: 'mac-mini',
+            ...extraEnv,
+        },
+    });
+    return { stdout: r.stdout ?? '', stderr: r.stderr ?? '', status: r.status };
+}
+export function centralDoc() {
+    const p = path.join(testHome, '.agents', 'agents.yaml');
+    return fs.existsSync(p) ? fs.readFileSync(p, 'utf-8') : '';
+}
+export function deviceDoc(name) {
+    const p = path.join(testHome, '.agents', 'devices', name, 'agents.yaml');
+    return fs.existsSync(p) ? fs.readFileSync(p, 'utf-8') : '';
+}
+export function addDevice(name, target = 'muqsit@192.0.2.1') {
+    const r = run(['devices', 'add', name, target]);
+    expect(r.status, r.stderr).toBe(0);
+}

package/dist/commands/exec.js

@@ -2377,7 +2377,13 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             }
             else {
                 try {
-                    const resolved = await resolveRunVersion(agent, strategy, cwd);
+                    // Account-centric candidate list: native version-home logins PLUS
+                    // provider accounts (setup-token / API-key) that can auth this agent,
+                    // so `--strategy balanced` spreads across ALL accounts, not just the
+                    // ones sitting in a version home (RUSH-3182). Run-path only — the
+                    // picker's other callers keep the native-only collector.
+                    const { collectRunCandidatesForRun } = await import('../lib/accounting/account-pool-collect.js');
+                    const resolved = await resolveRunVersion(agent, strategy, cwd, collectRunCandidatesForRun);
                     if (resolved.exhausted) {
                         // Zero healthy accounts splits two ways, and conflating them is what
                         // stranded a logged-out harness with no way in at all (RUSH-2334):
@@ -2428,6 +2434,23 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     else if (resolved.version) {
                         version = resolved.version;
                         rotationResult = resolved.rotation;
+                        // A balanced/available pick of a PROVIDER account (setup-token /
+                        // API-key) carries `providerAccount`. Resolve its env through the
+                        // same `resolveSpawnAccount` path an explicit `--account` uses, so
+                        // exec injects the credential; a native pick has no providerAccount
+                        // and runs from its own version home unchanged (RUSH-3182).
+                        const pickedProviderAccount = resolved.rotation?.picked.providerAccount;
+                        if (pickedProviderAccount) {
+                            try {
+                                const picked = resolveSpawnAccount(pickedProviderAccount, agent, resolved.version, readMeta(), { useDefault: false });
+                                if (picked?.kind === 'provider')
+                                    accountEnv = picked.env;
+                            }
+                            catch (err) {
+                                console.error(chalk.red(err.message));
+                                process.exit(1);
+                            }
+                        }
                         if (resolved.rotation && !options.quiet) {
                             const banner = formatRotationBanner(resolved.rotation, strategy);
                             process.stderr.write(chalk.gray(banner + '\n'));

package/dist/commands/share.js

@@ -36,6 +36,9 @@ export function formatSharePublishResult(result, json = false) {
     if (visibility === 'unlisted') {
         lines.push(chalk.dim('  visibility: unlisted (noindex, hidden from gallery)'));
     }
+    else if (visibility === 'me' || visibility === 'org') {
+        lines.push(chalk.dim(`  visibility: ${visibility} (login required, hidden from gallery)`));
+    }
     else {
         lines.push(chalk.dim(`  visibility: ${visibility}`));
     }
@@ -436,8 +439,8 @@ export function registerShareCommands(artifactsCmd) {
         .option('--slug <slug>', 'custom URL slug under your namespace (default: <feature>-<16hex>)')
         .option('--github-user <user>', 'GitHub username for the share namespace (default: resolved from gh/git config; ignored on the managed endpoint)')
         .option('--expire <spec>', "auto-expire (default 30d). e.g. 12h, 30d, 2026-08-01, or 'never'")
-        .addOption(new Option('--visibility <level>', 'public | unlisted (default public). unlisted is a capability URL: GET still works, hidden from the gallery, X-Robots-Tag: noindex')
-        .choices(['public', 'unlisted'])
+        .addOption(new Option('--visibility <level>', 'public | unlisted | me | org (default public). unlisted is a capability URL; me/org require a Phoenix session and are hidden from the gallery')
+        .choices(['public', 'unlisted', 'me', 'org'])
         .default('public'))
         .addOption(new Option('--unlisted', 'hidden alias of --visibility unlisted').hideHelp())
         .addOption(new Option('--private', 'hidden alias of --visibility unlisted').hideHelp())
@@ -525,8 +528,10 @@ ${SHARE_DELETE_EXAMPLES}
   a permanent link. --visibility unlisted (hidden aliases: --unlisted / --private)
   hides the page from the public gallery and agents artifacts share list; the
   direct URL is still world-readable (unlisted, not secret) and GET sends
-  X-Robots-Tag: noindex. A pre-publish scan refuses emails and credential-shaped
-  strings unless --force is passed.
+  X-Robots-Tag: noindex. --visibility me requires a Phoenix session and is only
+  visible to the signed-in owner; --visibility org requires the same and is
+  visible to members of the same Phoenix organization. A pre-publish scan
+  refuses emails and credential-shaped strings unless --force is passed.
 
   Every publish carries provenance auto-captured from the exec env/git/clock
   (agent, session, host, repo, date) — never invented, only sent when present —

package/dist/commands/teams.d.ts

@@ -7,9 +7,11 @@
  */
 import type { Command } from 'commander';
 import { AgentManager, AgentStatus, type TaskType } from '../lib/teams/agents.js';
+import type { DispatchOptions } from '../lib/cloud/types.js';
 import { type TaskInfo } from '../lib/teams/api.js';
 import { type TeamRow } from './teams-picker.js';
 import { type TeamSpawner } from '../lib/session/db.js';
+import type { AgentProcess } from '../lib/teams/agents.js';
 type TeamRegistry = Record<string, {
     created_at: string;
     description?: string;
@@ -106,6 +108,16 @@ export declare function staleRepoError(params: {
  * the teammate itself so we don't need the original --cloud CLI args.
  */
 export declare function wireCloudDispatcher(mgr: AgentManager): void;
+export declare function cloudDispatchOptions(agent: Pick<AgentProcess, 'prompt' | 'agentType' | 'cloudRepo' | 'cloudBranch' | 'model'>): DispatchOptions;
+/**
+ * Single-wave start used by `teams start` without --watch. startReady()
+ * terminalizes a placement/spawn/cloud/dependency failure to FAILED with
+ * evidence rather than leaving it PENDING, so a teammate that failed this wave
+ * appears in neither `launched` nor `still_pending` — it must be diffed against
+ * the pre-wave roster and reported explicitly, or the wave reads as a success.
+ * A wave that only produced failures sets a non-zero exit code.
+ */
+export declare function runOneWave(mgr: AgentManager, team: string, json: boolean): Promise<void>;
 export declare function buildTeamRowsFromSnapshots(registry: TeamRegistry, agents: TeamListAgentSnapshot[], 
 /** team name -> the session that spawned it (see teamSpawners). */
 spawners?: Map<string, TeamSpawner>): {

package/dist/commands/teams.js

@@ -364,17 +364,21 @@ export function wireCloudDispatcher(mgr) {
             throw new Error(`Teammate ${a.agentId} has no cloud provider set`);
         }
         const prov = resolveProvider(a.cloudProvider);
-        const dispatchOpts = {
-            prompt: a.prompt,
-            agent: a.agentType,
-            repo: a.cloudRepo ?? undefined,
-            branch: a.cloudBranch ?? undefined,
-            model: a.model ?? undefined,
-        };
+        const dispatchOpts = cloudDispatchOptions(a);
         const cloudTask = await prov.dispatch(dispatchOpts);
         return { cloudSessionId: cloudTask.id };
     });
 }
+export function cloudDispatchOptions(agent) {
+    return {
+        prompt: agent.prompt,
+        agent: agent.agentType,
+        repo: agent.cloudRepo ?? undefined,
+        branch: agent.cloudBranch ?? undefined,
+        model: agent.model ?? undefined,
+        env: shareRuntimeEnv(),
+    };
+}
 /**
  * Advisory: warn once per agent type of any still-pending (staged `--after`)
  * teammate whose CLI may not be signed in. Warn-only — never blocks `start`.
@@ -446,20 +450,32 @@ async function warnUnsignedTeammates(mgr, team) {
         }
     }
 }
-/** Single-wave start used by `teams start` without --watch. */
-async function runOneWave(mgr, team, json) {
+/**
+ * Single-wave start used by `teams start` without --watch. startReady()
+ * terminalizes a placement/spawn/cloud/dependency failure to FAILED with
+ * evidence rather than leaving it PENDING, so a teammate that failed this wave
+ * appears in neither `launched` nor `still_pending` — it must be diffed against
+ * the pre-wave roster and reported explicitly, or the wave reads as a success.
+ * A wave that only produced failures sets a non-zero exit code.
+ */
+export async function runOneWave(mgr, team, json) {
+    const preWavePending = new Set((await mgr.listByTask(team)).filter((a) => a.status === 'pending').map((a) => a.agentId));
     const launched = await mgr.startReady(team);
     const all = await mgr.listByTask(team);
     const stillPending = all.filter((a) => a.status === 'pending');
+    const failed = all.filter((a) => a.status === 'failed' && preWavePending.has(a.agentId));
+    if (failed.length > 0 && launched.length === 0)
+        process.exitCode = 1;
     if (json) {
         console.log(JSON.stringify({
             team,
             launched: launched.map((a) => ({ agent_id: a.agentId, name: a.name, after: a.after })),
             still_pending: stillPending.map((a) => ({ agent_id: a.agentId, name: a.name, after: a.after })),
+            failed: failed.map((a) => ({ agent_id: a.agentId, name: a.name, after: a.after, failure: a.failure })),
         }, null, 2));
         return;
     }
-    if (launched.length === 0 && stillPending.length === 0) {
+    if (launched.length === 0 && stillPending.length === 0 && failed.length === 0) {
         console.log(chalk.gray(`No pending teammates in team ${team}.`));
         return;
     }
@@ -471,6 +487,16 @@ async function runOneWave(mgr, team, json) {
             console.log(`  ${chalk.cyan(h)}  ${who}`);
         }
     }
+    if (failed.length > 0) {
+        if (launched.length > 0)
+            console.log();
+        console.log(chalk.red(`Failed this wave (${failed.length}):`));
+        for (const a of failed) {
+            const h = a.name || shortId(a.agentId);
+            const why = a.failure ? `${a.failure.code}: ${a.failure.message}` : 'no failure evidence recorded';
+            console.log(`  ${chalk.red(h)}  ${why}`);
+        }
+    }
     if (stillPending.length > 0) {
         console.log();
         console.log(chalk.gray(`Still pending (${stillPending.length}):`));
@@ -710,6 +736,9 @@ function printAgentDetail(a, session) {
     if (a.host) {
         console.log(`    ${chalk.gray('host    ')} ${chalk.cyan(a.host)}`);
     }
+    if (a.failure) {
+        console.log(`    ${chalk.red('failure ')} ${a.failure.code}: ${a.failure.message}`);
+    }
     // If the agent's internal session id differs from ours (non-Claude), show
     // it as a hint for `agents sessions <id>`.
     if (a.remote_session_id && a.remote_session_id !== a.agent_id) {
@@ -798,6 +827,9 @@ function printAgentSummary(s) {
     const tools = chalk.gray(` · ${s.tool_count} tools`);
     const hostBadge = s.host ? chalk.gray(' · on ') + chalk.cyan(s.host) : '';
     console.log(`  ${chalk.cyan(handle.padEnd(14))} ${ident.padEnd(11)} ${label}${duration}${tools}${hostBadge}${errBadge}`);
+    if (s.failure) {
+        console.log(`    ${chalk.red('failure ')} ${s.failure.code}: ${s.failure.message}`);
+    }
     // Files: counts + basenames. Read is count only.
     const fileLines = [];
     const renderCat = (label, cat) => {
@@ -1856,36 +1888,8 @@ export function registerTeamsCommands(program) {
                 return { cloudSessionId: cloudTask.id };
             });
         }
-        let cloudSessionId = null;
+        const cloudSessionId = null;
         const isStaged = after.length > 0;
-        if (cloudProviderId && !isStaged) {
-            // Ready to run now: dispatch to the cloud provider before registering
-            // the teammate so we have the remote session id up front.
-            //
-            // resolveProvider() and shareRuntimeEnv() are INSIDE the try on purpose:
-            // both read config (the cloud registry; `agents.yaml`'s share block) and
-            // both throw on a malformed one, and by this point the worktree already
-            // exists — leaving them outside stranded the branch with no catch at all.
-            try {
-                const prov = resolveProvider(cloudProviderId);
-                const dispatchOpts = {
-                    prompt: effectiveTask,
-                    agent,
-                    repo: opts.repo,
-                    branch: opts.branch,
-                    model: opts.model,
-                    env: shareRuntimeEnv(),
-                };
-                const cloudTask = await prov.dispatch(dispatchOpts);
-                cloudSessionId = cloudTask.id;
-            }
-            catch (err) {
-                // Same orphan class as a failed spawn: this add already created its
-                // worktree, so a dispatch failure must not strand the branch either.
-                await tearDownCreatedWorktree();
-                dieFriction('teams', 'cloud-dispatch-failed', `Cloud dispatch failed: ${err.message}`);
-            }
-        }
         try {
             const result = await handleSpawn(mgr, team, agent, effectiveTask, cwd, opts.mode, opts.effort, null, cwd, version, opts.name ?? null, after, opts.model ?? null, envOverrides ?? null, taskType, cloudProviderId, cloudSessionId, opts.repo ?? null, opts.branch ?? null, worktreeName, worktreePath, profileName, hostName, hostTarget, hostRepoPath, teamMeta?.project ?? null);
             emit('teams.add', { module: 'teams', team, agent, name: result.name, agent_id: result.agent_id, status: result.status });
@@ -2057,7 +2061,7 @@ export function registerTeamsCommands(program) {
     });
     // start — fire any staged teammates whose --after deps have all completed
     addHostOption(teams.command('start [team]'))
-        .description('Launch any pending teammates whose --after dependencies are satisfied. Use --watch to keep draining the DAG as teammates finish and as new tasks are added mid-flight.')
+        .description('Launch ready teammates independently. Failed launch/placement and blocked --after dependencies persist in status; --watch keeps draining viable DAG branches.')
         .option('--json', 'Output machine-readable JSON')
         .option('--watch', 'Keep running: poll every --interval seconds, fire new waves, exit when the DAG drains.')
         .option('--interval <seconds>', 'Seconds between waves in --watch mode (default 8)', '8')
@@ -2094,33 +2098,6 @@ export function registerTeamsCommands(program) {
             await warnUnsignedTeammates(mgr, team);
             await warnThrottledTeammates(mgr, team);
         }
-        // Health-/harness-aware pre-flight (RUSH-2002): if the team declares a
-        // device pool and no device in it can run a pending teammate's agent, fail
-        // loud here rather than launching a wave that strands teammates pending.
-        // --force downgrades it to a warning so the user can still try.
-        const placementError = await mgr.preflightPlacement(team);
-        if (placementError) {
-            if (isJsonMode(opts)) {
-                console.log(JSON.stringify({
-                    team,
-                    error: 'no-viable-device',
-                    message: placementError.message,
-                    excluded: placementError.excluded,
-                }));
-                if (!opts.force) {
-                    process.exitCode = 1;
-                    return;
-                }
-            }
-            else if (opts.force) {
-                console.error(chalk.yellow(`⚠ ${placementError.message}\n  Continuing anyway (--force).`));
-            }
-            else {
-                console.error(chalk.red(placementError.message));
-                process.exitCode = 1;
-                return;
-            }
-        }
         emit('teams.start', { module: 'teams', team, watch: Boolean(opts.watch) });
         if (!opts.watch) {
             await runOneWave(mgr, team, Boolean(opts.json));