@phnx-labs/agents-cli 1.22.50 → 1.22.51

package/CHANGELOG.md

@@ -1,5 +1,132 @@
 # Changelog
 
+## 1.22.51
+
+- **`publish-computer-helper-mac.sh` cuts the helper's own tag (PHNX-3228).**
+  It published `ComputerHelper.app.zip` to the CLI's `v<version>` release, but since the
+  client was repointed at per-helper tags the resolver asks for `computer-mac/v<x.y.z>`
+  (`helperTag` in `cli/src/lib/helper-versions.ts`). The asset therefore landed at an
+  address nothing requests, and there was **no way to cut a new computer-mac release at
+  all** — the last publisher still coupled to the CLI's version line. It now cuts
+  `computer-mac/v<x.y.z>`, requires the helper's version explicitly instead of defaulting
+  to `cli/package.json` (that default was the coupling), and refuses an existing tag, since
+  the upload uses `--clobber` and would otherwise replace a binary an installed CLI already
+  pins. Symmetric with `publish-computer-win.sh`. Source:
+  `cli/scripts/publish-computer-helper-mac.sh`.
+  It also cuts the tag itself now. `gh release create --verify-tag` refuses to invent a
+  tag absent from the remote, and nothing else pushed `computer-mac/v<x.y.z>` — `release.sh`
+  delegates helper tagging to "where the helper is released", which is this script. So it
+  ran green through build + notarize and then failed at the release step, meaning no new
+  helper version could be cut. The tag is pushed AFTER a successful build, deliberately:
+  pushing first would leave a published, immutable address with nothing behind it whenever
+  notarization failed.
+  Origin, not the local ref, is what makes a helper release immutable. Adding tag creation
+  introduced a wedge: a run that tagged and then failed to push left a local tag, and the
+  guard read that as "published" and told the operator to cut the next patch — burning a
+  version over a transient network error, and (since the guard precedes the build) making
+  that version uncuttable from the checkout without a manual `git tag -d`. A local-only tag
+  now resumes the interrupted publish instead.
+  Immutability keys on the published RELEASE, not the tag. A tag with no release is an
+  interrupted run — whether the push failed or the release creation did — and both now
+  resume rather than burning the version. The asset is what an installed CLI downloads, so
+  the release is the thing that must never be replaced.
+  The published-release check fails CLOSED. A non-zero `gh` is not evidence of absence —
+  unauthenticated, offline, and rate-limited all exit non-zero — so reading that as "not
+  published" would have carried on into `gh release upload --clobber` over a live binary,
+  the exact outcome the guard exists to prevent. Only an explicit not-found means not-found;
+  anything else stops the release and prints what `gh` actually said.
+
+- **`agents traces sync` retains and reports failed sessions instead of stranding them (PHNX-3267).**
+  The sync watermark advanced to the max mtime of *successful* uploads, so a later
+  success moved it past an earlier failed session and the next run's
+  `file_mtime_ms > watermark` filter skipped that session forever — the "failures are
+  retried" comment was false. A live 1.22.49 sync on a real device reported 11,073
+  uploaded and 6,050 errors with no way to tell a transcript cleaned off disk from a
+  genuine upload failure. Sync now records each failed session's identity and typed,
+  redacted evidence in the ledger and unions those retry-worthy ids back into the row
+  query regardless of the watermark, so a stranded session is re-attempted until it
+  succeeds. Failures are classified `transcript-unavailable` (the file is gone —
+  expected history, not re-read, aged out after 14 days), `parse-failed`, or
+  `upload-failed` (both retried); `agents traces sync` prints the breakdown
+  (`… errors (N transcripts no longer on disk · M parse/upload failures — will retry)`)
+  and `agents traces status` lists the outstanding retry set with example detail.
+  Source: `cli/src/lib/traces/sync.ts`, `cli/src/commands/traces.ts`.
+
+- **Helper binaries no longer download through a repository-rename redirect.**
+  `HELPER_RELEASE_REPO` still named `phnx-labs/agents-cli` after the repository was renamed
+  to `phnx-labs/agi-cli`. Nothing was broken — GitHub redirects a renamed repo, and both
+  slugs returned HTTP 200 — but every signed helper asset (`MenubarHelper.app.zip`,
+  `Agents_CLI.app.zip`, `ComputerHelper.app.zip`, `computer-helper-win.exe`) was resolving
+  through that redirect, which is one re-created repository away from pointing elsewhere.
+  What actually protects the download is the sha256 + `codesign` + designated-requirement +
+  Team ID verification in `helper-download.ts`; this removes the reliance on the redirect.
+  The `agents.yaml` `$schema` URL, the CHANGELOG link, the star nudge, and the
+  `package.json` repository/issues metadata moved with it.
+  **The npm package name is deliberately unchanged** — it is still
+  `@phnx-labs/agents-cli`, and renaming it would orphan every installed CLI. That
+  distinction is now pinned by a test. Source: `cli/src/lib/helper-download.ts`.
+  `publish-computer-helper-mac.sh` carried the old slug too, and that one is a **write**
+  path: `REPO_SLUG` reaches `gh release view` (the immutability guard), `gh release create`,
+  and `gh release upload --clobber`. Publishing signed helper binaries was going through the
+  rename redirect. Found by sweeping `scripts/` and `.github/` after the source tree was
+  already clean — the source sweep alone would have missed it.
+  Three further live paths carried the old slug and were missed by the first sweep:
+  `ssh-tunnel.ts:170` `WIN_HELPER_RELEASE_REPO` (a **separately hardcoded** constant — the
+  download URL for `computer-helper-win.exe`, the fourth signed asset, which the first
+  version of this change claimed to cover and did not); `commands/feedback.ts:14`, which
+  opens real GitHub issues; and `factory/snapshot.ts:30`, which polls this repo's PRs.
+  `installations/migrate.ts` also wrote the old URL into the `agents.yaml` header it
+  generates. Separately, `.github/workflows/tests-windows-host-e2e.yml:54` gated on
+  `github.repository == 'phnx-labs/agents-cli'`, which is permanently false after a rename
+  — that job had silently stopped running on every push to main and on its daily cron.
+  The JSON Schema's own `$id` moved with it — `state.ts` and `migrate.ts` write that URL as
+  the `$schema` hint into every user's `agents.yaml`, so a mismatched `$id` would make
+  editors reject their own config.
+
+- **The menu-bar helper's staleness check compares the HELPER's version, not the CLI's
+  (RUSH-3230).** `installAndStartService` stamped `getCliVersion()` as the installed
+  helper's version, and `menubarSetupStale()` compared against `getCliVersion()` too. Once
+  helpers gained their own version line that was wrong in both directions: every CLI
+  release made an unchanged helper look stale and reinstalled it — recopying the bundle
+  under the running helper, which `KeepAlive` then restarts (the #2109 storm: a new pid
+  every 5-15s, 578 launches in one log) — while a genuinely newer helper at the same CLI
+  version never looked stale at all, so it could never install.
+  The stamp is now JSON recording what the helper actually IS: `release` with its helper
+  version, or `local` with the source path + mtime for a dev build (menubar's build.sh
+  hardcodes `CFBundleShortVersionString`, so a local build has no version to compare).
+  Staleness compares like with like, treats a kind change (local <-> release) as stale, and
+  never downgrades when the installed helper is ahead of the floor. A pre-JSON stamp is
+  stale exactly once and is re-stamped in the new format, so the migration cannot loop.
+  `agents menubar status` / `doctor` now print three labelled lines — helper installed,
+  helper available, CLI version — instead of conflating two axes into one, and the
+  permanent false "(mismatch — `agents menubar setup` updates it)" hint is gone.
+  Source: `cli/src/lib/menubar/install-menubar.ts`.
+
+- **The Windows helper's "asset missing" error names a tag that exists (RUSH-3230).**
+  `downloadWinHelperExe` built its error message from `` `v${version}` `` — the CLI's tag
+  shape — while the URL it had just tried came from `helperTag('computer-win', version)`.
+  So a genuine 404 sent the reader looking for `v1.0.0`, which does not exist, instead of
+  `computer-win/v1.0.0`, which does. The mac path was corrected when helpers moved to their
+  own tags; the Windows path was left behind. Also drops a `getCliVersion` import that had
+  no call site — the last trace of the old CLI-version coupling in that file.
+  Source: `cli/src/lib/computer/ssh-tunnel.ts`.
+
+- **Claude status-line delegate no longer fork-bombs the machine.** The delegate
+  self-reference guard compared the saved command against the exact literal
+  `agents __claude-statusline`, so a delegate seeded with the same private
+  subcommand under a *different* binary name (e.g. `agents-dev __claude-statusline`
+  from a dev install, or an absolute path) was not recognized as us. Every
+  status-line render then `spawnSync`ed that command, which read the same delegate
+  and spawned another — unbounded recursion. Observed on a real box: ~4,900 live
+  `node __claude-statusline` processes accumulated over a 2-day uptime, exhausting
+  96 GB of swap and driving load past 300, so keystrokes lagged. The guard now
+  matches the `__claude-statusline` subcommand under any binary name or path
+  (`isStatusLineSelfReference`), `installClaudeStatusLine` refuses to persist such
+  a command as a delegate (and deletes an already-poisoned delegate on re-install),
+  a `AGENTS_CLAUDE_STATUSLINE_DELEGATED` env marker hard-caps delegation at one hop,
+  and the delegate `spawnSync` now carries a 5 s timeout. Source:
+  `cli/src/lib/claude-statusline.ts`.
+
 ## 1.22.50
 
 ### Fixed

package/dist/bootstrap.js

@@ -322,7 +322,7 @@ async function showWhatsNew(fromVersion, toVersion) {
             for (const line of relevantChanges) {
                 console.log(line);
             }
-            console.log(chalk.gray('\nFull notes: https://github.com/phnx-labs/agents-cli/blob/main/CHANGELOG.md'));
+            console.log(chalk.gray('\nFull notes: https://github.com/phnx-labs/agi-cli/blob/main/CHANGELOG.md'));
             console.log();
         }
     }

package/dist/commands/browser.d.ts

@@ -1,6 +1,16 @@
 import { Command } from 'commander';
 import { type BrowserProfile } from '../lib/browser/profiles.js';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
+/**
+ * The fleet browser hub this box drives by default (`browser.device`), or
+ * undefined to drive locally. It is one fleet-synced value in the central
+ * agents.yaml, so every box reads the same hub name — but the hub itself resolves
+ * to a self-host, and a fleet-dispatched invocation is already ON its target, so
+ * both return undefined. That self short-circuit is what lets a single synced
+ * value be safe: only the boxes that are NOT the hub forward to it, and the hub
+ * never forwards to itself.
+ */
+export declare function defaultBrowserHub(): string | undefined;
 export declare function registerBrowserCommand(program: Command): void;
 export declare function registerBrowserSubcommands(program: Command): void;
 interface BrowserUseOptions {

package/dist/commands/browser.js

@@ -248,6 +248,23 @@ function assertDeviceDeclaresProfile(device, profileName) {
     throw new Error(`Device "${device}" does not declare browser profile "${profileName}". ${where}\n` +
         `Next: run \`agents browser profiles add ${profileName} --browser <b>\` on ${device}.`);
 }
+/**
+ * The fleet browser hub this box drives by default (`browser.device`), or
+ * undefined to drive locally. It is one fleet-synced value in the central
+ * agents.yaml, so every box reads the same hub name — but the hub itself resolves
+ * to a self-host, and a fleet-dispatched invocation is already ON its target, so
+ * both return undefined. That self short-circuit is what lets a single synced
+ * value be safe: only the boxes that are NOT the hub forward to it, and the hub
+ * never forwards to itself.
+ */
+export function defaultBrowserHub() {
+    if (isFleetRemoteInvocation())
+        return undefined;
+    const hub = getConfigValue('browser.device').value;
+    if (!hub || isSelfHost(hub))
+        return undefined;
+    return hub;
+}
 // Help groups — surfaces the actual mental model an agent follows
 // ("open a session / drive the page / capture evidence / rare extras")
 // instead of an alphabetical dump. Everything not listed falls into a
@@ -356,7 +373,14 @@ export async function runBrowserUse(name, opts, interactive = isInteractiveTermi
             console.log(current
                 ? `Default browser profile (this machine): ${current}`
                 : 'Default browser profile (this machine): auto-detect');
+            const hub = getConfigValue('browser.device').value;
+            if (hub) {
+                console.log(isSelfHost(hub)
+                    ? `Browser hub (browser.device): ${hub} — this machine, so drives locally`
+                    : `Browser hub (browser.device): ${hub} — bare \`agents browser start\` drives ${hub}'s browser`);
+            }
             console.log('Usage: agents browser use <name>  (or --unset)');
+            console.log('Fleet hub: agents config set browser.device <device>  (drive that box\'s browser from every machine)');
             return true;
         }
         const choices = buildBrowserUseChoices(await listProfiles(), listInstalledBrowsers(), current);
@@ -1353,7 +1377,7 @@ function registerTaskCommands(browser) {
         .option('--title <label>', 'Human label shown in `browser status` (defaults to first navigated host)')
         .option('-e, --endpoint <name>', 'Endpoint preset (defaults to the profile\'s default)')
         .option('-u, --url <url>', 'Open URL in first tab')
-        .option('--device <name>', 'Device that hosts this task; later verbs resolve it from --task (not valid on page verbs)')
+        .option('--device <name>', 'Device that hosts this task (defaults to the browser.device hub when set; use `local` to force this machine). Later verbs resolve it from --task; not valid on page verbs')
         .option('--fresh', 'Always open a new tab, skipping the reclaim of a tab an abandoned task is holding on that URL')
         .option('--no-skills', 'Skip auto-discovery of site-specific SKILL.md from ~/.agents/skills/browser/domain-skills/')
         .option('--record', 'Start recording right after the tab opens (shorthand for `agents browser record start` as a follow-up)')
@@ -1373,6 +1397,54 @@ function registerTaskCommands(browser) {
             console.error(err instanceof Error ? err.message : String(err));
             process.exit(1);
         }
+        // Thin-client hub (PHNX-2010): when this box has a fleet browser hub
+        // (`browser.device`) and the caller gave no explicit --device, forward the
+        // WHOLE start there — bare OR --profile — and skip the local profile/browser
+        // resolution below. The hub owns its profiles, browser, and consent, so this
+        // box needs no local browser and need not carry the named profile; forwarding
+        // the local pre-checks here would reject a profile that lives only on the hub.
+        // Later page verbs follow the task to the hub via the task→device index bound
+        // here. `--device local`/`--device self` (below) force a local run instead;
+        // `defaultBrowserHub()` is undefined on the hub itself and on a fleet-remote
+        // re-exec, so neither forwards to itself.
+        if (!opts.device) {
+            const hub = defaultBrowserHub();
+            if (hub) {
+                // No local profile validation: the hub is the authority on its own
+                // profiles (including fleet-scoped ones this box can't see in
+                // `declaringDevices`), so a bad `--profile` is caught by the hub's own
+                // start and streamed back with its exit code, rather than second-guessed
+                // here against a registry that doesn't carry the hub's profiles.
+                try {
+                    const result = await dispatchBrowserToDevice(hub, browserForwardedArgv(), 'capture');
+                    process.stdout.write(result.stdout);
+                    process.stderr.write(result.stderr);
+                    if (result.code !== 0)
+                        process.exit(result.code);
+                    const taskName = opts.task || result.stdout.trim().split('\n').find((line) => line.length > 0);
+                    if (!taskName) {
+                        console.error(`Remote start on ${hub} produced no task name.`);
+                        process.exit(1);
+                    }
+                    bindTask(taskName, {
+                        device: hub,
+                        // Only what the caller named; the hub's own default (bare start) is
+                        // opaque here. Name-based `done`/`stop --task` and the post-stop
+                        // unbind GC these regardless.
+                        profile: opts.profile,
+                        url: opts.url,
+                        sessionId: callerSessionId(),
+                        launchId: callerLaunchId(),
+                        createdAt: Date.now(),
+                    });
+                }
+                catch (err) {
+                    console.error(err instanceof Error ? err.message : String(err));
+                    process.exit(1);
+                }
+                return;
+            }
+        }
         // One resolution order for every command (RUSH-2709): `--profile default`
         // means the same profile here as it does in stop / status / navigate.
         // `start` is the one command that LAUNCHES, so its implicit path goes
@@ -1409,7 +1481,10 @@ function registerTaskCommands(browser) {
                 process.exit(1);
             }
         }
-        const deviceName = opts.device;
+        // The `browser.device` hub default is applied above (bare/--profile, no
+        // --device). Here only an EXPLICIT --device remains — with `local`/`self` as
+        // the escape that forces a local run when a hub is configured.
+        const deviceName = opts.device === 'local' || opts.device === 'self' ? undefined : opts.device;
         if (deviceName) {
             const lowered = deviceName.toLowerCase();
             if (lowered === 'all' || lowered === 'auto') {

package/dist/commands/config.js

@@ -111,6 +111,11 @@ function setConfig(parsed, value) {
             return;
         }
         case 'browser': {
+            if (parsed.property === 'device') {
+                // Fleet hub: user scope, one central value, never peer-targeted.
+                setConfigValue('browser.device', value);
+                return;
+            }
             // Device-local default lives in the per-device doc's config: block
             // (same store `agents devices config` / getConfigValue use). Bare
             // browser.profile targets this machine; devices.<name>.browser.profile
@@ -155,6 +160,11 @@ function unsetConfig(parsed) {
             return had;
         }
         case 'browser': {
+            if (parsed.property === 'device') {
+                const had = getConfigValue('browser.device').value !== undefined;
+                unsetConfigValue('browser.device');
+                return had;
+            }
             const target = parsed.device ? { device: parsed.device } : undefined;
             // Must follow parsed.property. Hardcoding 'browser.profile' here meant
             // `config unset browser.viewer` deleted the user's browser.profile while
@@ -195,6 +205,9 @@ function getConfig(parsed) {
         case 'auto':
             return getConfigValue('auto.pool').value;
         case 'browser': {
+            if (parsed.property === 'device') {
+                return getConfigValue('browser.device').value;
+            }
             return getConfigValue(parsed.property === 'viewer' ? 'browser.viewer' : 'browser.profile', parsed.device ? { device: parsed.device } : undefined).value;
         }
         case 'project':
@@ -267,6 +280,13 @@ function* listCentralConfigEntries() {
         const key = 'browser.viewer';
         yield { key, value: browserViewer, hint: configKeyStorageHint(parseConfigKey(key)) };
     }
+    // Fleet browser hub — user scope, so it belongs in the central listing next to
+    // its siblings. Omitting it repeats the browser.viewer invisibility bug.
+    const browserDevice = getConfigValue('browser.device').value;
+    if (browserDevice !== undefined) {
+        const key = 'browser.device';
+        yield { key, value: browserDevice, hint: configKeyStorageHint(parseConfigKey(key)) };
+    }
 }
 /** Collect device-scope config entries. */
 function* listDeviceConfigEntries(device) {

package/dist/commands/feedback.js

@@ -7,7 +7,7 @@ import { arch, platform, release } from 'node:os';
 import { createRequire } from 'node:module';
 import chalk from 'chalk';
 import { showUrl } from '../lib/open-url.js';
-const REPO = 'phnx-labs/agents-cli';
+const REPO = 'phnx-labs/agi-cli';
 const DISCUSSION_BASE = `https://github.com/${REPO}/discussions/new`;
 const ISSUE_BASE = `https://github.com/${REPO}/issues/new`;
 function readCliVersion() {

package/dist/commands/menubar.js

@@ -27,8 +27,9 @@ function printStatus(s, opts = {}) {
         return;
     }
     console.log(`  app installed      ${s.installedApp ? chalk.gray(s.installedApp) : chalk.gray('no')}`);
-    console.log(`  installed version  ${s.installedVersion ? chalk.gray(s.installedVersion) : chalk.gray('unknown')}`);
-    console.log(`  current version    ${chalk.gray(s.currentVersion)}`);
+    console.log(`  helper installed   ${s.installedVersion ? chalk.gray(s.installedVersion) : chalk.gray('unknown')}`);
+    console.log(`  helper available   ${chalk.gray(s.currentVersion)}`);
+    console.log(`  CLI version        ${chalk.gray(s.cliVersion)}`);
     console.log(`  bundle source      ${s.source ? chalk.gray(s.source) : chalk.red('missing (cannot enable)')}`);
     console.log(`  disabled by user   ${yn(s.disabledByUser)}`);
     // Two copies of the INSTALLED bundle is the duplicate the user sees as two
@@ -80,8 +81,9 @@ function printSetupResult(r) {
 function printDoctorReport(r) {
     console.log(chalk.bold('AGI Menu doctor\n'));
     console.log(`  install path       ${r.installPath ? chalk.gray(r.installPath) : chalk.red('not installed')}`);
-    console.log(`  installed version  ${r.installedVersion ? chalk.gray(r.installedVersion) : chalk.gray('unknown')}`);
-    console.log(`  CLI version        ${chalk.gray(r.currentVersion)}${r.versionMatches ? '' : chalk.yellow('  (mismatch — `agents menubar setup` updates it)')}`);
+    console.log(`  helper installed   ${r.installedVersion ? chalk.gray(r.installedVersion) : chalk.gray('unknown')}`);
+    console.log(`  helper available   ${chalk.gray(r.currentVersion)}${r.versionMatches ? '' : chalk.yellow('  (newer helper available — `agents menubar setup` installs it)')}`);
+    console.log(`  CLI version        ${chalk.gray(r.cliVersion)}`);
     const identity = r.signingIdentity === 'developer-id'
         ? chalk.green('Developer ID (update-stable)')
         : r.signingIdentity === 'ad-hoc'

package/dist/commands/traces.js

@@ -1,7 +1,6 @@
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
-import { syncTraces } from '../lib/traces/sync.js';
-import { readSyncLedger } from '../lib/traces/sync.js';
+import { readSyncLedger, syncTraces } from '../lib/traces/sync.js';
 import { managedTracesBaseUrl, resolveTracesBackend } from '../lib/traces/backend.js';
 import { showUrl } from '../lib/open-url.js';
 import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/share/config.js';
@@ -93,7 +92,18 @@ async function handleSync(opts) {
         parts.push(chalk.dim(`${result.skipped} skipped`));
     }
     if (result.errors > 0) {
-        parts.push(chalk.yellow(`${result.errors} errors`));
+        // Distinguish expected history (transcripts cleaned off disk) from genuine
+        // failures that will be retried, so the operator knows which need attention.
+        const detail = [];
+        if (result.transcriptUnavailable > 0) {
+            detail.push(`${result.transcriptUnavailable} transcripts no longer on disk`);
+        }
+        const retryable = result.parseFailed + result.uploadFailed;
+        if (retryable > 0) {
+            detail.push(`${retryable} parse/upload failures — will retry`);
+        }
+        parts.push(chalk.yellow(`${result.errors} errors`) +
+            (detail.length ? chalk.dim(` (${detail.join(' · ')})`) : ''));
     }
     if (parts.length === 0) {
         parts.push(chalk.dim('nothing new'));
@@ -108,7 +118,25 @@ async function handleStatus() {
     }
     const when = new Date(ledger.lastSyncMtime).toLocaleString();
     console.log(`Last sync: ${chalk.bold(when)}`);
-    console.log(chalk.dim('Run `agents traces sync` to push new sessions.'));
+    const failures = ledger.failures ?? [];
+    if (failures.length > 0) {
+        const byKind = new Map();
+        for (const f of failures) {
+            const list = byKind.get(f.kind) ?? [];
+            list.push(f);
+            byKind.set(f.kind, list);
+        }
+        console.log(chalk.yellow(`\n${failures.length} unresolved failure${failures.length === 1 ? '' : 's'}:`));
+        for (const [kind, list] of byKind) {
+            const retry = kind === 'transcript-unavailable' ? chalk.dim(' (not retried)') : chalk.dim(' (retried each sync)');
+            console.log(`  ${chalk.bold(list.length)} ${kind}${retry}`);
+            const example = list[0];
+            if (example?.detail) {
+                console.log(chalk.dim(`    e.g. ${example.id.slice(0, 8)} · ${example.detail}`));
+            }
+        }
+    }
+    console.log(chalk.dim('\nRun `agents traces sync` to push new sessions.'));
 }
 async function handleOpen() {
     // M2 console — for now open the base URL which will route to the console once deployed.

package/dist/lib/claude-statusline.d.ts

@@ -1,4 +1,12 @@
 export declare const CLAUDE_STATUSLINE_COMMAND = "agents __claude-statusline";
+/**
+ * True when `command` re-invokes THIS status-line producer (our private
+ * `__claude-statusline` subcommand) under any binary name or path. Delegating to
+ * such a command is the fork bomb, so both the read side (renderDelegate) and the
+ * write side (installClaudeStatusLine) treat it as "not a real external
+ * producer" and never chain to it.
+ */
+export declare function isStatusLineSelfReference(command: string): boolean;
 interface ClaudeStatusLinePayload {
     cwd?: string;
     workspace?: {
@@ -20,6 +28,7 @@ interface ClaudeStatusLinePayload {
     };
 }
 export declare function ingestClaudeStatusLineUsage(payload: ClaudeStatusLinePayload, versionHome: string): boolean;
+export declare function renderDelegate(payload: string, versionHome: string): string;
 export declare function renderClaudeStatusLine(payload: ClaudeStatusLinePayload, host?: string, delegated?: string): string;
 export declare function runClaudeStatusLine(): Promise<number>;
 export declare function installClaudeStatusLine(versionHome: string): {

package/dist/lib/claude-statusline.js

@@ -7,6 +7,39 @@ import { atomicWriteFileSync } from './fs-atomic.js';
 import { mergeClaudeUsageCacheWindows } from './accounting/usage.js';
 export const CLAUDE_STATUSLINE_COMMAND = 'agents __claude-statusline';
 const DELEGATE_FILE = path.join('.agents', 'claude-statusline-delegate');
+// The private subcommand this feature runs. It is only ever invoked internally,
+// so ANY command that contains it — under any binary name or path (`agents`,
+// `agents-dev`, `ag`, an absolute path, a wrapper) — IS this status-line
+// producer, and delegating to it recurses without bound. Match the subcommand,
+// not the exact `agents __claude-statusline` string, or a delegate seeded with a
+// differently-named binary (e.g. `agents-dev __claude-statusline`) fork-bombs the
+// machine: each render spawns a copy that reads the same delegate and spawns
+// another, forever.
+const STATUSLINE_SUBCOMMAND = '__claude-statusline';
+// Set on the child env before spawning a delegate. If it is already present we
+// are ourselves running as someone's delegate, so we refuse to delegate again —
+// a hard depth-1 backstop that bounds the blast radius even if a self-reference
+// somehow slips past isStatusLineSelfReference(). One hop is the contract:
+// installClaudeStatusLine only ever preserves a single prior command.
+const DELEGATE_GUARD_ENV = 'AGENTS_CLAUDE_STATUSLINE_DELEGATED';
+// A hung or slow delegate must never pin a status-line render open — the render
+// is re-invoked on every refresh, so an unbounded delegate accumulates processes.
+const DELEGATE_TIMEOUT_MS = 5_000;
+/**
+ * True when `command` re-invokes THIS status-line producer (our private
+ * `__claude-statusline` subcommand) under any binary name or path. Delegating to
+ * such a command is the fork bomb, so both the read side (renderDelegate) and the
+ * write side (installClaudeStatusLine) treat it as "not a real external
+ * producer" and never chain to it.
+ */
+export function isStatusLineSelfReference(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return false;
+    if (trimmed === CLAUDE_STATUSLINE_COMMAND)
+        return true;
+    return new RegExp(`(^|\\s)${STATUSLINE_SUBCOMMAND}(\\s|$)`).test(trimmed);
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -48,7 +81,10 @@ export function ingestClaudeStatusLineUsage(payload, versionHome) {
 function delegatePath(versionHome) {
     return path.join(versionHome, DELEGATE_FILE);
 }
-function renderDelegate(payload, versionHome) {
+export function renderDelegate(payload, versionHome) {
+    // Already running as a delegate hop — never spawn another. Hard recursion stop.
+    if (process.env[DELEGATE_GUARD_ENV])
+        return '';
     let command = '';
     try {
         command = fs.readFileSync(delegatePath(versionHome), 'utf8').trim();
@@ -56,13 +92,14 @@ function renderDelegate(payload, versionHome) {
     catch {
         return '';
     }
-    if (!command || command === CLAUDE_STATUSLINE_COMMAND)
+    if (!command || isStatusLineSelfReference(command))
         return '';
     const result = spawnSync(command, {
         shell: true,
         input: payload,
         encoding: 'utf8',
-        env: process.env,
+        env: { ...process.env, [DELEGATE_GUARD_ENV]: '1' },
+        timeout: DELEGATE_TIMEOUT_MS,
     });
     return result.status === 0 ? result.stdout.trim() : '';
 }
@@ -117,11 +154,15 @@ export function installClaudeStatusLine(versionHome) {
             : '';
         if (existing === CLAUDE_STATUSLINE_COMMAND)
             return { changed: false };
-        if (existing) {
+        if (existing && !isStatusLineSelfReference(existing)) {
+            // A genuine third-party status-line command → preserve it as a delegate.
             fs.mkdirSync(path.dirname(delegatePath(versionHome)), { recursive: true });
             atomicWriteFileSync(delegatePath(versionHome), `${existing}\n`);
         }
         else {
+            // Empty, or our own subcommand under a different binary name
+            // (`agents-dev __claude-statusline`, an absolute path, …). Saving that as a
+            // delegate is the fork bomb — never persist it. Drop any prior delegate.
             fs.rmSync(delegatePath(versionHome), { force: true });
         }
         settings.statusLine = {

package/dist/lib/computer/ssh-tunnel.d.ts

@@ -59,11 +59,11 @@ export declare const WIN_HELPER_TOKEN_FILE = "helper-token";
  * the release-asset download (`ensureWinHelperExe`).
  */
 export declare function resolveWinHelperExe(): string | null;
-/** GitHub repo whose `v<version>` releases carry the exe as an asset. */
-export declare const WIN_HELPER_RELEASE_REPO = "phnx-labs/agents-cli";
+/** GitHub repo whose `computer-win/v<version>` releases carry the exe as an asset. */
+export declare const WIN_HELPER_RELEASE_REPO = "phnx-labs/agi-cli";
 /** Cache dir for downloaded helper exes, one subdir per release tag. */
 export declare function winHelperCacheDir(version: string): string;
-/** Release-asset URLs for the exe + its checksum at one exact `v<version>` tag. */
+/** Release-asset URLs for the exe + its checksum at one exact `computer-win/v<version>` tag. */
 export declare function winHelperAssetUrls(version: string): {
     exe: string;
     sha256: string;
@@ -73,10 +73,11 @@ export declare function winHelperAssetUrls(version: string): {
  * a bare hex digest. Throws on anything that does not lead with 64 hex chars.
  */
 /**
- * Download the exe release asset for this CLI version, verify its sha256
+ * Download the exe release asset for this HELPER version, verify its sha256
  * against the published `.sha256` asset, and cache it under the agents cache
- * dir. Only the exact `v<version>` tag is consulted — a missing asset is a
- * hard error naming that tag, never a silent fallback to another release.
+ * dir. Only the exact `computer-win/v<version>` tag is consulted — a missing
+ * asset is a hard error naming that tag, never a silent fallback to another
+ * release. The version is the HELPER's own, not the CLI's.
  */
 export declare function downloadWinHelperExe(version: string): Promise<string>;
 /**

package/dist/lib/computer/ssh-tunnel.js

@@ -127,13 +127,13 @@ export function resolveWinHelperExe() {
     }
     return null;
 }
-/** GitHub repo whose `v<version>` releases carry the exe as an asset. */
-export const WIN_HELPER_RELEASE_REPO = 'phnx-labs/agents-cli';
+/** GitHub repo whose `computer-win/v<version>` releases carry the exe as an asset. */
+export const WIN_HELPER_RELEASE_REPO = 'phnx-labs/agi-cli';
 /** Cache dir for downloaded helper exes, one subdir per release tag. */
 export function winHelperCacheDir(version) {
     return path.join(getCacheDir(), 'computer', 'win-helper', `v${version}`);
 }
-/** Release-asset URLs for the exe + its checksum at one exact `v<version>` tag. */
+/** Release-asset URLs for the exe + its checksum at one exact `computer-win/v<version>` tag. */
 export function winHelperAssetUrls(version) {
     // The helper's OWN tag, not the CLI's. This exe is not an .app bundle so it
     // cannot share helper-download.ts's zip/codesign machinery, but it had the
@@ -148,19 +148,24 @@ export function winHelperAssetUrls(version) {
  * a bare hex digest. Throws on anything that does not lead with 64 hex chars.
  */
 /**
- * Download the exe release asset for this CLI version, verify its sha256
+ * Download the exe release asset for this HELPER version, verify its sha256
  * against the published `.sha256` asset, and cache it under the agents cache
- * dir. Only the exact `v<version>` tag is consulted — a missing asset is a
- * hard error naming that tag, never a silent fallback to another release.
+ * dir. Only the exact `computer-win/v<version>` tag is consulted — a missing
+ * asset is a hard error naming that tag, never a silent fallback to another
+ * release. The version is the HELPER's own, not the CLI's.
  */
 export async function downloadWinHelperExe(version) {
     const cached = path.join(winHelperCacheDir(version), WIN_HELPER_EXE);
     if (fs.existsSync(cached))
         return cached;
-    const tag = `v${version}`;
+    // The SAME tag the URL is built from. This said `v${version}` — the CLI's tag
+    // shape — while winHelperAssetUrls uses helperTag('computer-win', ...), so a
+    // missing asset sent you looking for a tag that does not exist. The mac path
+    // had this fixed already; the Windows path was left behind by the tag split.
+    const tag = helperTag('computer-win', version);
     const { exe: exeUrl, sha256: shaUrl } = winHelperAssetUrls(version);
     const missing = (status, url) => new Error(`no ${WIN_HELPER_EXE} release asset for tag ${tag} (HTTP ${status} on ${url}). ` +
-        `The Windows helper ships as a GitHub release asset per tagged CLI version; ` +
+        `The Windows helper ships as a GitHub release asset on its own helper tag; ` +
         `from a repo checkout you can build it locally instead: bash scripts/build-win.sh`);
     // Checksum first: it is tiny and 404s fast when the tag has no assets.
     const shaRes = await fetch(shaUrl, { signal: AbortSignal.timeout(30_000) });

package/dist/lib/config-keys.d.ts

@@ -28,11 +28,12 @@ export interface ParsedAutoConfigKey {
     scope: 'auto';
     property: 'pool';
 }
-/** A device-scope browser key (self or peer): the profile agents drive, or the
- *  browser that shows the user a page. */
+/** A browser key: the profile agents drive or the browser that shows the user a
+ *  page (both device-scope, self or peer), or `device` — the user-scope fleet
+ *  hub every box drives by default, which is central and never peer-targeted. */
 export interface ParsedBrowserConfigKey {
     scope: 'browser';
-    property: 'profile' | 'viewer';
+    property: 'profile' | 'viewer' | 'device';
     device?: string;
 }
 export interface ParsedProjectConfigKey {