@phnx-labs/agents-cli 1.22.50 → 1.22.52

package/CHANGELOG.md

@@ -1,5 +1,224 @@
 # Changelog
 
+## 1.22.52
+
+- **`agents artifacts share --visibility me|org` — identity-gated share pages (PHNX-3260).**
+  Extends the P1 `public|unlisted` tiers (RUSH-3135) with two Phoenix-gated GET
+  visibilities. `me` is visible only to the signed-in owner (the viewer's Phoenix
+  `userId` must equal the stamped `owner`); `org` is visible to any signed-in
+  Phoenix user whose **verified email domain** matches the owner's company domain
+  (`org_domain`, stamped from the owner's verified email on PUT). A mismatch on
+  either returns **404** — the same body as a missing object — so a wrong viewer
+  cannot even learn the page exists. Both are hidden from the public gallery and
+  `share list`, like `unlisted`. Publishing `org` from a public inbox
+  (gmail/googlemail/outlook/hotmail/live/icloud/me) is refused with **400**, and
+  `me`/`org` PUT without a Phoenix identity is a loud 400 (a BYO `WRITE_TOKEN`
+  alone cannot publish them). Browser GET of an unauthenticated `me`/`org` URL
+  **302**s to `${PHOENIX_ID_BASE}/login?return=<url>` (the same Google OAuth as
+  `/device`, no new IdP); the returned one-time `phoenix_ticket` is redeemed once
+  via `POST /api/v1/auth/ticket` and exchanged for an HttpOnly, HMAC-signed
+  `__Host-phoenix_share` cookie on the share host. An existing CLI
+  `Authorization: Bearer` still works with no redirect. `me`/`org` responses send
+  `Cache-Control: private, no-store` and `X-Robots-Tag: noindex`;
+  `public`/`unlisted` GET is unchanged (anonymous 200). Because the Worker template
+  changed, **already-provisioned BYO endpoints need `agents artifacts share update`**
+  to serve the new gate. Source: `cli/src/lib/share/worker-template.ts`,
+  `cli/src/lib/share/{backend,publish}.ts`, `cli/src/commands/share.ts`.
+
+- **Harden the browser daemon against the socket-timeout wedge (PHNX-3289).** Four
+  fixes to the browser/daemon reliability surface. `agents daemon status` no longer
+  errors on macOS with `ps: etimes: keyword not found` — the process-uptime probe now
+  shells the portable `ps -o etime=` and parses it with the same helper the keychain
+  reaper uses. `waitForSocket` raises its ceiling from a flat 6s to 15s and re-probes
+  across an IPC-server restart (requiring two stable accepts), so a browser
+  start/navigate that lands in a restart window no longer intermittently throws
+  `Timeout waiting for browser daemon socket`. New `agents browser stop --daemon` stops
+  the browser daemon and clears a stale/wedged `browser.sock`, failing loud if a live
+  server still holds it, so the next `start` comes up clean. And `agents browser start
+  --device <host>` now resolves the browser/profile on the TARGET device instead of the
+  local one — a bare start from a browserless box forwards to `--device` instead of
+  failing with a misleading `No supported browser found`. Source:
+  `cli/src/commands/daemon.ts`, `cli/src/lib/browser/ipc.ts`, `cli/src/commands/browser.ts`.
+
+- **Managed share: a BYO-published page no longer locks the rightful Phoenix owner out of their own handle (PHNX-3291).** The share Worker's handle-ownership check (`assertHandleOwner`) scanned every page under a namespace and 409'd `handle taken` when any page's stamped `owner` differed from the writer's Phoenix `userId`. But a BYO `WRITE_TOKEN` publish stamps `owner = SHARE_NAMESPACE` (the namespace string, e.g. `octocat`), not a userId — so once a namespace held any BYO page, its legitimate Phoenix handle owner got a 409 on every subsequent publish, and could neither publish nor change a page's `--visibility` (which blocked the me/org tiers from PHNX-3260 for that user entirely). The `__handles/<handle>` claim object is now authoritative when it exists: the recorded userId may write and anyone else is refused, regardless of a stray page's owner stamp. The page-owner scan remains as the pre-claim fallback but ignores BYO namespace stamps (`owner === handle`), so a first Phoenix publish can still claim a handle previously used only by BYO pages. Source: `cli/src/lib/share/worker-template.ts`. Requires `agents artifacts share update` on already-provisioned endpoints (the Worker template hash changed).
+
+- **`sessions resume`/`sessions attach`/`sessions focus` no longer SSH-probe the fleet before attaching a live local tmux pane (PHNX-3292).** First unique match now wins: a selector naming a live pane on THIS box — the full `ag-<agent>-<8hex>` alias `agents tmux ls` prints, or its bare 8-hex suffix when it names exactly one live local pane — attaches with zero SSH, for bare `sessions resume <alias>` and deprecated `sessions attach <alias>` too, not just `--attach-only`. Previously `collectSessionCandidates` ran first — two fleet sweeps (transcript pool + live roster) that stall on offline devices (~2 minutes measured on yosemite-s0, two copies of `unreachable or no agents CLI — skipped`) — and bare `resume` of a live alias didn't even reach the tmux-attach path at all. A miss still races the reachable fleet in parallel: `isDefinitiveMatch`/`selectorAllowsEarlyExit` (RUSH-2203) now cover a tmux alias and an exact 8-hex short id, not just a full UUID, so the first peer to answer with that pane aborts the rest of the sweep instead of waiting out every offline box's timeout. Two LIVE panes (local or fleet-answered) sharing the same 8-hex suffix fail closed with both names printed, rather than guessing; a dead/retained pane is never attached. `--device` skips the local gate entirely and scopes the race to the named box(es). Source: `cli/src/lib/session/local-tmux-attach.ts` (new, `attachLocalLiveSelector`), `cli/src/commands/{sessions,sessions-resume,attach,focus}.ts`.
+
+- **`agents tmux attach` tears the session down when the agent exits (PHNX-3293).**
+  Attaching to a wrapped pane and exiting the agent (`/exit`, Ctrl-c) used to
+  print `[detached]` and leave the tmux session in `tmux ls` — the v6 pane-died
+  hook only `detach-client`s when a client is attached, and the attach verbs
+  never killed the `remain-on-exit` husk. `tmux attach`, `sessions focus` /
+  `resume --attach-only`, and `go`'s local-tmux attach now destroy the session
+  when every pane is dead and still keep it on Ctrl-b d. A piped (no-TTY)
+  local `agents run --interactive` no longer wraps in tmux, so session-tracker
+  tests cannot leak live "trust this folder" panes. `agents tmux kill` with no
+  name opens a picker whose preview is the pane's last screen (so a leaked
+  first-run dialog is distinguishable from real work); `tmux ls` prints that
+  snippet on each row. Source:
+  `cli/src/lib/tmux/session.ts`, `cli/src/commands/tmux.ts`,
+  `cli/src/commands/focus.ts`, `cli/src/lib/exec.ts`.
+
+- **`agents browser start` no longer silently mints a logged-out `auto-chrome` (PHNX-3296).** With no configured default and no existing launchable profile, start now errors and points at `agents setup` / `agents browser use <name>` / the `browser.device` fleet hub instead of popping a signed-out Chrome. A pre-existing `auto-chrome` or legacy `default` still resolves. `agents setup`'s browser pick replaces the misleading "auto-detect on first use" opt-out with an explicit "None — this box uses the fleet hub" choice. Source: `cli/src/lib/browser/profiles.ts`, `cli/src/commands/setup-preferences.ts`, `cli/src/commands/browser.ts`.
+
+- **`sessions detach` / `sessions stop` of a unique live local session no longer wait for fleet SSH timeouts (PHNX-3298).** A live pane already visible locally is the hit: a full UUID or a unique 8-hex prefix skips `gatherRemoteActive` entirely, so a sleeping peer cannot print `unreachable or no agents CLI` or stall SIGTERM. Two local matches fail closed without waiting for unanswered boxes. A genuine miss still races the fleet and aborts remaining SSH on the first unique reachable live row; browse / `focus` with no id stays all-settle. Source: `cli/src/commands/go.ts`, `cli/src/commands/detach.ts`, `cli/src/commands/sessions-stop.ts`.
+
+- **`agents monitors add` refuses immediately when a reachable peer already has the same watcher (PHNX-3299).** The fleet duplicate guard used to collect every peer before reporting a clash, so a single slow box forced the full 12-second timeout even when another peer had already answered with the same fingerprint. The fan-out now aborts remaining SSH captures the moment a peer reports a matching monitor, while the no-match path still waits for the whole fleet so uniqueness can be proved. Source: `cli/src/commands/monitors.ts`, `cli/src/lib/monitors/remote.ts`.
+
+- **`agents repo sync user` self-heals a non-git or partial `~/.agents` by adopting it in place — no re-clone, no data loss (PHNX-3301).** When the user-layer checkout lost (or never had) its `.git`, sync hard-failed with `Not a git repo: ~/.agents` and the only fix was a destructive re-clone that wiped runtime state (`.cache` / `.history` / `scratch` / device config). It now git-backs the existing directory in place with plumbing only (`init` / `remote` / `fetch` / `update-ref` / `read-tree` / `checkout-index` / `restore`, so it never trips the fleet git-guard): materializes only the MISSING tracked files, restores a stale-stub top-level `agents.yaml` from origin (backing up the previous copy to `.history/agents.yaml.pre-adopt.bak` first), preserves gitignored runtime state, and surfaces (never clobbers) real local edits. The remote URL is resolved from an existing `origin`, `AGENTS_USER_REPO_URL`, or a device-local record left by a prior healthy sync — never hardcoded. `agents sync status` now flags a non-git `~/.agents` as a distinct drift state instead of burying it as "N missing". Source: `cli/src/lib/git.ts`, `cli/src/commands/sync.ts`, `cli/src/commands/repo.ts`, `cli/src/lib/sync-status.ts`, `cli/src/commands/status.ts`.
+
+- **Owner notifications forward to a capable fleet peer when this box can't deliver (PHNX-3303).**
+  The owner's delivery provider for the rush-backed channels (imessage / telegram /
+  slack / discord via the `rush` CLI) is macOS-only, so `agents feed post --level
+  important` / `--blocked`, `agents notify`, and monitor `notify` actions run from a
+  headless Linux worker used to record the post but fail to reach the owner with
+  `owner failed: … rush CLI not found on PATH`. They now hand the delivery over SSH to
+  a reachable macOS peer that DOES have the provider — the same reroute
+  `agents message` already uses — instead of stranding the important post. It is
+  best-effort: it never throws or blocks the post, only the macOS-only rush family
+  triggers a forward (a Linux-capable transport like openclaw-telegram stays local),
+  and when no capable peer is reachable the existing clean local error stands. A box
+  that received a forward never forwards onward (`AGENTS_OWNER_NO_FORWARD` guard).
+  Source: `cli/src/lib/channels/owner-forward.ts`, `cli/src/lib/notify.ts`,
+  `cli/src/lib/feed-broadcast.ts`.
+
+- **`agents artifacts share <file>` now derives a stable slug automatically (PHNX-3310).**
+  The default comes from the HTML `<title>` or Markdown frontmatter `title:`, then
+  the filename, so repeat publishes of a long-running artifact update the same URL;
+  `--slug` remains an optional explicit override. Source:
+  `cli/src/lib/share/publish.ts`, `cli/src/commands/share.ts`.
+
+- **The release attestation now shards its test suite across the fleet instead of pinning one box.** `release-attestation-produce.sh` — the full-suite run that mints a release's exact-tree attestation — ran the ~13k-test suite on a single auto-picked box at `--maxWorkers=2` (~880s measured, ~14 min per attestation). It now fans the suite across the fleet via `test.sh --shard N` by default, resolving N from the eligible workers `agents devices pick` reports (capped) and falling back to a single box only when fewer than two are eligible. The suite is throughput-bound, so this is ~1/N the wall time (~269s on one box → ~31s on nine). Each shard still runs vitest at `--maxWorkers=2 --retry=2`, so the RUSH-3015 per-box flake mitigation is unchanged — sharding adds machines, not per-box concurrency. New `--test-shard <n>` / `--test-devices a,b,c` overrides mirror `test.sh`. Source: `cli/scripts/release-attestation-produce.sh`.
+
+- **Shared pages now show who shared them and — the point — a visibility cue (PHNX-3260 follow-up).** The share Worker injects a slim attribution bar at the top of every served HTML page: `Shared by <handle>`, `Made with <agent>`, the date, and a colour-coded **visibility chip** — 🔒 `Only you` (me), 🏢 `Anyone at <org>` (org), 🌐 `Public`, 🔗 `Unlisted` — so a viewer can tell at a glance who can see the page, the thing the raw served HTML never surfaced. All values come from metadata the Worker already stamps (`visibility`, `owner`/handle, `org_domain`, `agent`, `date`); no new publish-time metadata and no CLI change, so it ships with `agents artifacts share update`. Non-HTML assets (images, JSON, the OG cover) are served byte-for-byte; metadata is HTML-escaped; the rewritten body drops the now-stale R2 etag. Source: `cli/src/lib/share/worker-template.ts`.
+
+## 1.22.51
+
+- **`publish-computer-helper-mac.sh` cuts the helper's own tag (PHNX-3228).**
+  It published `ComputerHelper.app.zip` to the CLI's `v<version>` release, but since the
+  client was repointed at per-helper tags the resolver asks for `computer-mac/v<x.y.z>`
+  (`helperTag` in `cli/src/lib/helper-versions.ts`). The asset therefore landed at an
+  address nothing requests, and there was **no way to cut a new computer-mac release at
+  all** — the last publisher still coupled to the CLI's version line. It now cuts
+  `computer-mac/v<x.y.z>`, requires the helper's version explicitly instead of defaulting
+  to `cli/package.json` (that default was the coupling), and refuses an existing tag, since
+  the upload uses `--clobber` and would otherwise replace a binary an installed CLI already
+  pins. Symmetric with `publish-computer-win.sh`. Source:
+  `cli/scripts/publish-computer-helper-mac.sh`.
+  It also cuts the tag itself now. `gh release create --verify-tag` refuses to invent a
+  tag absent from the remote, and nothing else pushed `computer-mac/v<x.y.z>` — `release.sh`
+  delegates helper tagging to "where the helper is released", which is this script. So it
+  ran green through build + notarize and then failed at the release step, meaning no new
+  helper version could be cut. The tag is pushed AFTER a successful build, deliberately:
+  pushing first would leave a published, immutable address with nothing behind it whenever
+  notarization failed.
+  Origin, not the local ref, is what makes a helper release immutable. Adding tag creation
+  introduced a wedge: a run that tagged and then failed to push left a local tag, and the
+  guard read that as "published" and told the operator to cut the next patch — burning a
+  version over a transient network error, and (since the guard precedes the build) making
+  that version uncuttable from the checkout without a manual `git tag -d`. A local-only tag
+  now resumes the interrupted publish instead.
+  Immutability keys on the published RELEASE, not the tag. A tag with no release is an
+  interrupted run — whether the push failed or the release creation did — and both now
+  resume rather than burning the version. The asset is what an installed CLI downloads, so
+  the release is the thing that must never be replaced.
+  The published-release check fails CLOSED. A non-zero `gh` is not evidence of absence —
+  unauthenticated, offline, and rate-limited all exit non-zero — so reading that as "not
+  published" would have carried on into `gh release upload --clobber` over a live binary,
+  the exact outcome the guard exists to prevent. Only an explicit not-found means not-found;
+  anything else stops the release and prints what `gh` actually said.
+
+- **`agents traces sync` retains and reports failed sessions instead of stranding them (PHNX-3267).**
+  The sync watermark advanced to the max mtime of *successful* uploads, so a later
+  success moved it past an earlier failed session and the next run's
+  `file_mtime_ms > watermark` filter skipped that session forever — the "failures are
+  retried" comment was false. A live 1.22.49 sync on a real device reported 11,073
+  uploaded and 6,050 errors with no way to tell a transcript cleaned off disk from a
+  genuine upload failure. Sync now records each failed session's identity and typed,
+  redacted evidence in the ledger and unions those retry-worthy ids back into the row
+  query regardless of the watermark, so a stranded session is re-attempted until it
+  succeeds. Failures are classified `transcript-unavailable` (the file is gone —
+  expected history, not re-read, aged out after 14 days), `parse-failed`, or
+  `upload-failed` (both retried); `agents traces sync` prints the breakdown
+  (`… errors (N transcripts no longer on disk · M parse/upload failures — will retry)`)
+  and `agents traces status` lists the outstanding retry set with example detail.
+  Source: `cli/src/lib/traces/sync.ts`, `cli/src/commands/traces.ts`.
+
+- **Helper binaries no longer download through a repository-rename redirect.**
+  `HELPER_RELEASE_REPO` still named `phnx-labs/agents-cli` after the repository was renamed
+  to `phnx-labs/agi-cli`. Nothing was broken — GitHub redirects a renamed repo, and both
+  slugs returned HTTP 200 — but every signed helper asset (`MenubarHelper.app.zip`,
+  `Agents_CLI.app.zip`, `ComputerHelper.app.zip`, `computer-helper-win.exe`) was resolving
+  through that redirect, which is one re-created repository away from pointing elsewhere.
+  What actually protects the download is the sha256 + `codesign` + designated-requirement +
+  Team ID verification in `helper-download.ts`; this removes the reliance on the redirect.
+  The `agents.yaml` `$schema` URL, the CHANGELOG link, the star nudge, and the
+  `package.json` repository/issues metadata moved with it.
+  **The npm package name is deliberately unchanged** — it is still
+  `@phnx-labs/agents-cli`, and renaming it would orphan every installed CLI. That
+  distinction is now pinned by a test. Source: `cli/src/lib/helper-download.ts`.
+  `publish-computer-helper-mac.sh` carried the old slug too, and that one is a **write**
+  path: `REPO_SLUG` reaches `gh release view` (the immutability guard), `gh release create`,
+  and `gh release upload --clobber`. Publishing signed helper binaries was going through the
+  rename redirect. Found by sweeping `scripts/` and `.github/` after the source tree was
+  already clean — the source sweep alone would have missed it.
+  Three further live paths carried the old slug and were missed by the first sweep:
+  `ssh-tunnel.ts:170` `WIN_HELPER_RELEASE_REPO` (a **separately hardcoded** constant — the
+  download URL for `computer-helper-win.exe`, the fourth signed asset, which the first
+  version of this change claimed to cover and did not); `commands/feedback.ts:14`, which
+  opens real GitHub issues; and `factory/snapshot.ts:30`, which polls this repo's PRs.
+  `installations/migrate.ts` also wrote the old URL into the `agents.yaml` header it
+  generates. Separately, `.github/workflows/tests-windows-host-e2e.yml:54` gated on
+  `github.repository == 'phnx-labs/agents-cli'`, which is permanently false after a rename
+  — that job had silently stopped running on every push to main and on its daily cron.
+  The JSON Schema's own `$id` moved with it — `state.ts` and `migrate.ts` write that URL as
+  the `$schema` hint into every user's `agents.yaml`, so a mismatched `$id` would make
+  editors reject their own config.
+
+- **The menu-bar helper's staleness check compares the HELPER's version, not the CLI's
+  (RUSH-3230).** `installAndStartService` stamped `getCliVersion()` as the installed
+  helper's version, and `menubarSetupStale()` compared against `getCliVersion()` too. Once
+  helpers gained their own version line that was wrong in both directions: every CLI
+  release made an unchanged helper look stale and reinstalled it — recopying the bundle
+  under the running helper, which `KeepAlive` then restarts (the #2109 storm: a new pid
+  every 5-15s, 578 launches in one log) — while a genuinely newer helper at the same CLI
+  version never looked stale at all, so it could never install.
+  The stamp is now JSON recording what the helper actually IS: `release` with its helper
+  version, or `local` with the source path + mtime for a dev build (menubar's build.sh
+  hardcodes `CFBundleShortVersionString`, so a local build has no version to compare).
+  Staleness compares like with like, treats a kind change (local <-> release) as stale, and
+  never downgrades when the installed helper is ahead of the floor. A pre-JSON stamp is
+  stale exactly once and is re-stamped in the new format, so the migration cannot loop.
+  `agents menubar status` / `doctor` now print three labelled lines — helper installed,
+  helper available, CLI version — instead of conflating two axes into one, and the
+  permanent false "(mismatch — `agents menubar setup` updates it)" hint is gone.
+  Source: `cli/src/lib/menubar/install-menubar.ts`.
+
+- **The Windows helper's "asset missing" error names a tag that exists (RUSH-3230).**
+  `downloadWinHelperExe` built its error message from `` `v${version}` `` — the CLI's tag
+  shape — while the URL it had just tried came from `helperTag('computer-win', version)`.
+  So a genuine 404 sent the reader looking for `v1.0.0`, which does not exist, instead of
+  `computer-win/v1.0.0`, which does. The mac path was corrected when helpers moved to their
+  own tags; the Windows path was left behind. Also drops a `getCliVersion` import that had
+  no call site — the last trace of the old CLI-version coupling in that file.
+  Source: `cli/src/lib/computer/ssh-tunnel.ts`.
+
+- **Claude status-line delegate no longer fork-bombs the machine.** The delegate
+  self-reference guard compared the saved command against the exact literal
+  `agents __claude-statusline`, so a delegate seeded with the same private
+  subcommand under a *different* binary name (e.g. `agents-dev __claude-statusline`
+  from a dev install, or an absolute path) was not recognized as us. Every
+  status-line render then `spawnSync`ed that command, which read the same delegate
+  and spawned another — unbounded recursion. Observed on a real box: ~4,900 live
+  `node __claude-statusline` processes accumulated over a 2-day uptime, exhausting
+  96 GB of swap and driving load past 300, so keystrokes lagged. The guard now
+  matches the `__claude-statusline` subcommand under any binary name or path
+  (`isStatusLineSelfReference`), `installClaudeStatusLine` refuses to persist such
+  a command as a delegate (and deletes an already-poisoned delegate on re-install),
+  a `AGENTS_CLAUDE_STATUSLINE_DELEGATED` env marker hard-caps delegation at one hop,
+  and the delegate `spawnSync` now carries a 5 s timeout. Source:
+  `cli/src/lib/claude-statusline.ts`.
+
 ## 1.22.50
 
 ### Fixed

package/dist/bootstrap.js

@@ -322,7 +322,7 @@ async function showWhatsNew(fromVersion, toVersion) {
             for (const line of relevantChanges) {
                 console.log(line);
             }
-            console.log(chalk.gray('\nFull notes: https://github.com/phnx-labs/agents-cli/blob/main/CHANGELOG.md'));
+            console.log(chalk.gray('\nFull notes: https://github.com/phnx-labs/agi-cli/blob/main/CHANGELOG.md'));
             console.log();
         }
     }

package/dist/commands/attach.js

@@ -3,6 +3,7 @@ import { runOnPeer } from '../lib/session/remote-list.js';
 import { sessionRecoveryPeer } from '../lib/session/recovery.js';
 import { resolveSessionMetadataValue, resumeSessionInPlace } from './sessions.js';
 import { readDetachRecord, clearDetachRecord, isHeadlessAlive } from '../lib/session/detached.js';
+import { attachLocalLiveSelector } from '../lib/session/local-tmux-attach.js';
 export function registerAttachCommand(program) {
     // Deprecated: superseded by `agents sessions resume`, which detects the state
     // (live pane / headless / ended) instead of making the caller pick a verb.
@@ -19,6 +20,12 @@ export function registerAttachCommand(program) {
     });
 }
 export async function attachAction(id) {
+    // PHNX-3292: this deprecated spelling still gets the local-pane fast path —
+    // a live tmux alias/short id on THIS box attaches with zero SSH, matching
+    // `sessions resume`. `attach` takes no `--device`, so hosts is always empty.
+    if (await attachLocalLiveSelector(id.trim(), [])) {
+        return;
+    }
     const outcome = await resolveSessionMetadataValue(id);
     if (outcome.kind === 'partial') {
         // RUSH-2492: an unreachable peer is a warning, not a hard failure. The

package/dist/commands/browser.d.ts

@@ -1,6 +1,16 @@
 import { Command } from 'commander';
 import { type BrowserProfile } from '../lib/browser/profiles.js';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
+/**
+ * The fleet browser hub this box drives by default (`browser.device`), or
+ * undefined to drive locally. It is one fleet-synced value in the central
+ * agents.yaml, so every box reads the same hub name — but the hub itself resolves
+ * to a self-host, and a fleet-dispatched invocation is already ON its target, so
+ * both return undefined. That self short-circuit is what lets a single synced
+ * value be safe: only the boxes that are NOT the hub forward to it, and the hub
+ * never forwards to itself.
+ */
+export declare function defaultBrowserHub(): string | undefined;
 export declare function registerBrowserCommand(program: Command): void;
 export declare function registerBrowserSubcommands(program: Command): void;
 interface BrowserUseOptions {