@phnx-labs/agents-cli 1.22.51 → 1.22.53

package/CHANGELOG.md

@@ -1,5 +1,243 @@
 # Changelog
 
+## 1.22.53
+
+- **Custom-harness runs launched via a profile now show their real harness name in agents sessions instead of 'claude' (PHNX-2935).**
+
+- **Watchdog un-addressable stalls now include the same recovery command as `agents focus` (PHNX-3070).**
+  Rotate, needs-human declared-block, and nudge-refuse paths append `addressabilityRecoveryHint` so an un-addressable session prints `agents sessions resume <id>` / tmux wrap instead of a reason-only skip. Source: `cli/src/lib/watchdog/runner.ts`.
+
+- **Un-addressable live sessions now surface a clear recovery hint at the point of use** — `agents focus`, `sessions inject`, and the session picker report when a bare interactive session has no addressable terminal rail (not tmux/iTerm/an IDE terminal/a pty sidecar) instead of failing silently, and the hint now names the session's real id in `agents sessions resume <id>` rather than a placeholder (PHNX-3070).
+
+- **Vitest can no longer launch the developer's browser (PHNX-3072).** `tests/setup.ts`
+  sandboxed `HOME` but not desktop-opener binaries, so a test that reached a real
+  `spawn('open' | 'xdg-open')` opened the URL on the developer's machine — green on
+  Linux CI, where `xdg-open` is absent, and disruptive locally. The harness now
+  prepends stub `open` / `xdg-open` / `gnome-open` binaries to `PATH` so a spawn
+  cannot reach the real handler; an unauthorized spawn fails the file. Source:
+  `cli/tests/opener-sandbox.ts`.
+
+- **Feed attention stamps `sourceCursor` at block-write time (PHNX-3073).**
+  `coveredByResolution` conservatively suppresses a candidate with no comparable
+  cursor when a tombstone exists, which is correct for a stale lifecycle re-read
+  but buried a genuinely new open block whenever `session.lastActivityMs` was
+  unresolvable (cloud / remote / index-lag) because neither writer stamped a
+  cursor. `buildDeclaredBlock` and the feed-publish hook now stamp
+  `sourceCursor.lastActivityMs` from the write instant, so a fresh generation
+  compares strictly newer than any prior tombstone. Source:
+  `cli/src/lib/feed/feed.ts`.
+
+- **Cursor auto-titles go through the same skill-scaffolding cleaner as Claude (PHNX-3123).**
+  `readCursorMeta` took `chatMeta.title` verbatim, so a Cursor session whose
+  server-generated title echoed the injected `Base directory for this skill: …`
+  line kept that path as `SessionMeta.label` — the field that wins on every
+  surface for the session's whole life. Claude's `ai-title` was already collapsed
+  to `/<skill>` at label composition (PR #2995); that collapse now lives in one
+  shared helper (`cleanGeneratedSessionLabel`) and Cursor's title takes the same
+  path. An ordinary Cursor title, and one that merely names a `skills/…` path,
+  is unchanged. A Claude `/rename` (`custom-title`) is still never rewritten.
+  Codex / OpenCode / Kimi / Droid put auto-titles on `topic`, not `label`, so
+  they are out of this change. **Not retroactive:** already-indexed labels stay
+  until the transcript next changes (RUSH-3122). Source:
+  `cli/src/lib/session/prompt.ts`, `cli/src/lib/session/discover.ts`.
+
+- **Traces insight engine — cross-session failure clustering + wasted time (PHNX-3141).** `agents traces sync`'s `index.json` now carries `failurePatterns[]` (top-K, ranked by wasted time, not raw occurrence count — a rare 8-hour retry loop still outranks a frequent 2-minute one), `wastedMsTotal`, and `latency` (time-to-first-tool p50/p90/p99/max). Failed `tool_calls` are grouped by `(tool, cause, normalized error)` so near-identical failures (a GitHub rate-limit message with a different countdown each time) fold into one pattern instead of a wall of near-duplicates. Per-session `SessionDetail` also gains `surfacedToolFailures` — every failed step, listed regardless of the run's overall outcome, so a session that ultimately succeeded still shows the tool failures it hit along the way. Source: `cli/src/lib/traces/insights.ts`, `cli/src/lib/traces/sync.ts`.
+
+- **Traces insight group-by dimensions (PHNX-3141).** `cli/src/lib/traces/segments.ts` derives the console bar axes — agent (model × harness), task type, failure timing — and the time-to-first-tool latency insight (`firstToolMs` p50/p90/p99/max). Pure functions; the sync integrator wires them into the shard. Source: `cli/src/lib/traces/segments.ts`.
+
+- **Native-account labels live on the central `accounts.native` rows in agents.yaml (already fleet-synced via `agents repo push/pull`). `remove`/`rename`/`label` operate on every row matching `(agent, identityKey)`, so a post-merge duplicate cannot silently survive (PHNX-3206).**
+
+- **The top-level `agents.yaml` header heals itself instead of freezing (PHNX-3315).**
+  `serializeCentral` parses the committed file to preserve its hand-written body
+  comments, but that also preserved the leading metadata header verbatim — so a
+  top-level `agents.yaml` written before the `agi-cli` rename kept its stale
+  3-line header (repo `agents-cli`, no `$schema:` line) forever while every
+  freshly-written device doc got the current header. The header is now rewritten
+  to the current `META_HEADER` on the next central write, textually (the `yaml`
+  library folds the leading comment onto the first key when that key already
+  carries a comment, so `doc.commentBefore` is unreliable), leaving body comments
+  and every config key intact, and byte-stable once healed so it never re-churns.
+  Source: `cli/src/lib/state.ts`.
+- **The legacy central `browser:` tombstone drains itself on `agents sync` (PHNX-3315).**
+  New browser profiles write the per-device doc, but profiles created before the
+  device-scoped store lingered in the shared top-level `agents.yaml` and churned
+  every fleet pull until someone ran `agents browser profiles claim` by hand.
+  `agents sync` now auto-evicts a lingering central profile into this device's
+  doc and clears it from central — but ONLY for remote (`ssh://`) profiles. An
+  `ssh://` endpoint names a specific host, so the profile is fungible by design:
+  any box resolves it to the same browser, so a concurrent cross-machine
+  double-claim is harmless. A local/`cdp://` profile has no per-machine ownership
+  signal ("that browser is installed here" is not "I hold this profile's
+  credentialed session"), so auto-claiming it would let two boxes with the same
+  common browser each claim the same tombstone and flip a credentialed profile
+  from identity-bearing to fungible fleet-wide — the exact logged-out-browser
+  failure this module exists to prevent. Local/cdp tombstones are left central for
+  an explicit `agents browser profiles claim`. The claim is selected and committed
+  inside a single meta-lock acquisition, and non-throwing (a config conflict or
+  unhostable profile is left central rather than wedging the sync). `profileRegistry` is left as the single source of truth: a
+  claimed profile lives in the device doc alone, never double-counted across two
+  stores. Source: `cli/src/lib/browser/registry.ts`, `cli/src/commands/sync.ts`,
+  `cli/src/lib/state.ts`.
+
+- **`fleet.discovery` / `fleet.ignored` are device-scoped with a union-on-read view (PHNX-3315).**
+  Every box used to rewrite one shared `fleet.discovery`/`fleet.ignored` map in the
+  top-level `agents.yaml` (each dismissal stamped `ignoredOn:<host>`), so two boxes
+  dismissing different peers produced guaranteed git line-conflicts on the next
+  pull. Each box now records ONLY its own discovery decisions and dismissals in its
+  tracked device doc (`devices/<host>/agents.yaml` `fleet:` block), and the
+  effective fleet view is recomputed as a deterministic, order-independent UNION
+  across every device doc at read time — `ignored` beats `approved` for a
+  conflicting name, and the newest `ignoredAt` wins a shared dismissal — so every
+  box computes the identical view and no box ever rewrites another's file. A
+  fold-then-delete migration moves the existing central maps into the owning box's
+  device doc before the central keys are dropped (the device-doc write lands before
+  the central strip, so a crash re-folds idempotently). `agents devices
+  register/ignore/unignore/ignored`, discovery reconcile, the sync pending-diff, and
+  `agents fleet capture` all read the union. Source:
+  `cli/src/lib/devices/{discovery-policy,registry,device-docs,config-migration}.ts`,
+  `cli/src/commands/{ssh,fleet-capture}.ts`, `cli/src/lib/state.ts`.
+- **Agent-host registrations are device-scoped (`deviceHosts`) with a merged read (PHNX-3315).**
+  Locally-discovered SSH hosts and inline registrations landed in one shared
+  `hosts:` map in the top-level `agents.yaml`, so every box that enrolled a host
+  rewrote the fleet-shared file. Registrations now write this box's device doc
+  `hosts:` block; the effective host directory is the cross-box union (newest
+  `addedAt` wins a name collision), and `remove` only edits this box's own doc. A
+  fold-then-delete migration relocates the existing central `hosts:` map into this
+  box's device doc and drops the central key. Source:
+  `cli/src/lib/hosts/{providers/local,registry,remote-os}.ts`,
+  `cli/src/lib/devices/{device-docs,config-migration}.ts`, `cli/src/lib/state.ts`.
+- **`scope:'device'` native accounts move off the shared file into the device doc (PHNX-3315).**
+  `addNativeAccount` accepted `scope:'device'` but always wrote the central
+  `accounts.native` map, so a per-box login (and its email / `identityKey` PII)
+  landed in the git-tracked, fleet-synced `agents.yaml`. A native login is
+  machine-local, so its home now follows its scope: a `scope:'device'` identity
+  (and any binding that targets it) writes this box's device doc `accounts:` block,
+  keeping its identity PII off the shared file; genuinely fleet-shared account
+  `defaults` and `scope:'version'` identities stay central. Every account reader
+  (`listNativeAccounts`, `findUnifiedAccount`, binding resolution, rename/remove)
+  merges the fleet-shared central store with this box's device slice. A
+  fold-then-delete migration relocates existing `scope:'device'` natives and their
+  bindings out of central (forward-only; no history rewrite). Source:
+  `cli/src/lib/account-registry.ts`, `cli/src/lib/devices/config-migration.ts`,
+  `cli/src/lib/state.ts`.
+
+- **`tmux.enabled` now gates remote `--device` runs too — no more forced tmux wrap (PHNX-3316).**
+  `resolveTmuxWrap` (`cli/src/lib/exec.ts`) no longer lets `remoteDispatch`
+  override the device's `tmux.enabled`: off (the default) means a followed
+  `agents run --device <host>` spawns the agent directly, with no tmux session
+  on the peer. Durability for a bare remote run comes from the existing
+  auto-reconnect in `cli/src/lib/hosts/reconnect.ts`, whose target
+  (`agents sessions focus <id> --local`) already resumes the harness session in
+  place when no pane exists — a dropped link costs the in-flight turn, not the
+  conversation. One case still wraps regardless: a followed remote run whose
+  launcher has no TTY (CI, scripts, another agent driving the CLI), where the
+  detached pane is the run's only interface.
+  `undurable` is now reached only when a wrap was actually wanted (opted-in
+  device, or the no-TTY case) but the peer has no tmux; its refusal message
+  names the `agents ssh <host> 'agents devices config <host> tmux.enabled off'`
+  alternative (the key is machine-local, so it must be set on the peer)
+  alongside `--raw`.
+  RUSH-3125's forced wrap conflated durability with an ergonomics preference
+  and wrapped boxes whose operator had explicitly left tmux off.
+  `hosts/reconnect.ts`'s header premise, the `hosts/dispatch.ts`
+  REMOTE_INTERACTIVE_ENV comments, and the `tmux.enabled` help text
+  (`device-config.ts`) are updated to match; wrap-matrix tests cover the new
+  gate.
+
+- **Share attribution bar: full-width chrome, not a floating box.** The bar was injected `position:sticky` inside `<body>`, so on a page whose body is a narrow centered column (`max-width` + `margin:auto`) it inherited that width and rendered as a floating black rectangle. It's now `position:fixed`, full viewport width, with an injected `html{padding-top}` pushing the page content down beneath it — clean top chrome on any page layout. `flex-wrap:nowrap` + left-side ellipsis keep it one line so the push height stays correct. Source: `cli/src/lib/share/worker-template.ts`.
+
+## 1.22.52
+
+- **`agents artifacts share --visibility me|org` — identity-gated share pages (PHNX-3260).**
+  Extends the P1 `public|unlisted` tiers (RUSH-3135) with two Phoenix-gated GET
+  visibilities. `me` is visible only to the signed-in owner (the viewer's Phoenix
+  `userId` must equal the stamped `owner`); `org` is visible to any signed-in
+  Phoenix user whose **verified email domain** matches the owner's company domain
+  (`org_domain`, stamped from the owner's verified email on PUT). A mismatch on
+  either returns **404** — the same body as a missing object — so a wrong viewer
+  cannot even learn the page exists. Both are hidden from the public gallery and
+  `share list`, like `unlisted`. Publishing `org` from a public inbox
+  (gmail/googlemail/outlook/hotmail/live/icloud/me) is refused with **400**, and
+  `me`/`org` PUT without a Phoenix identity is a loud 400 (a BYO `WRITE_TOKEN`
+  alone cannot publish them). Browser GET of an unauthenticated `me`/`org` URL
+  **302**s to `${PHOENIX_ID_BASE}/login?return=<url>` (the same Google OAuth as
+  `/device`, no new IdP); the returned one-time `phoenix_ticket` is redeemed once
+  via `POST /api/v1/auth/ticket` and exchanged for an HttpOnly, HMAC-signed
+  `__Host-phoenix_share` cookie on the share host. An existing CLI
+  `Authorization: Bearer` still works with no redirect. `me`/`org` responses send
+  `Cache-Control: private, no-store` and `X-Robots-Tag: noindex`;
+  `public`/`unlisted` GET is unchanged (anonymous 200). Because the Worker template
+  changed, **already-provisioned BYO endpoints need `agents artifacts share update`**
+  to serve the new gate. Source: `cli/src/lib/share/worker-template.ts`,
+  `cli/src/lib/share/{backend,publish}.ts`, `cli/src/commands/share.ts`.
+
+- **Harden the browser daemon against the socket-timeout wedge (PHNX-3289).** Four
+  fixes to the browser/daemon reliability surface. `agents daemon status` no longer
+  errors on macOS with `ps: etimes: keyword not found` — the process-uptime probe now
+  shells the portable `ps -o etime=` and parses it with the same helper the keychain
+  reaper uses. `waitForSocket` raises its ceiling from a flat 6s to 15s and re-probes
+  across an IPC-server restart (requiring two stable accepts), so a browser
+  start/navigate that lands in a restart window no longer intermittently throws
+  `Timeout waiting for browser daemon socket`. New `agents browser stop --daemon` stops
+  the browser daemon and clears a stale/wedged `browser.sock`, failing loud if a live
+  server still holds it, so the next `start` comes up clean. And `agents browser start
+  --device <host>` now resolves the browser/profile on the TARGET device instead of the
+  local one — a bare start from a browserless box forwards to `--device` instead of
+  failing with a misleading `No supported browser found`. Source:
+  `cli/src/commands/daemon.ts`, `cli/src/lib/browser/ipc.ts`, `cli/src/commands/browser.ts`.
+
+- **Managed share: a BYO-published page no longer locks the rightful Phoenix owner out of their own handle (PHNX-3291).** The share Worker's handle-ownership check (`assertHandleOwner`) scanned every page under a namespace and 409'd `handle taken` when any page's stamped `owner` differed from the writer's Phoenix `userId`. But a BYO `WRITE_TOKEN` publish stamps `owner = SHARE_NAMESPACE` (the namespace string, e.g. `octocat`), not a userId — so once a namespace held any BYO page, its legitimate Phoenix handle owner got a 409 on every subsequent publish, and could neither publish nor change a page's `--visibility` (which blocked the me/org tiers from PHNX-3260 for that user entirely). The `__handles/<handle>` claim object is now authoritative when it exists: the recorded userId may write and anyone else is refused, regardless of a stray page's owner stamp. The page-owner scan remains as the pre-claim fallback but ignores BYO namespace stamps (`owner === handle`), so a first Phoenix publish can still claim a handle previously used only by BYO pages. Source: `cli/src/lib/share/worker-template.ts`. Requires `agents artifacts share update` on already-provisioned endpoints (the Worker template hash changed).
+
+- **`sessions resume`/`sessions attach`/`sessions focus` no longer SSH-probe the fleet before attaching a live local tmux pane (PHNX-3292).** First unique match now wins: a selector naming a live pane on THIS box — the full `ag-<agent>-<8hex>` alias `agents tmux ls` prints, or its bare 8-hex suffix when it names exactly one live local pane — attaches with zero SSH, for bare `sessions resume <alias>` and deprecated `sessions attach <alias>` too, not just `--attach-only`. Previously `collectSessionCandidates` ran first — two fleet sweeps (transcript pool + live roster) that stall on offline devices (~2 minutes measured on yosemite-s0, two copies of `unreachable or no agents CLI — skipped`) — and bare `resume` of a live alias didn't even reach the tmux-attach path at all. A miss still races the reachable fleet in parallel: `isDefinitiveMatch`/`selectorAllowsEarlyExit` (RUSH-2203) now cover a tmux alias and an exact 8-hex short id, not just a full UUID, so the first peer to answer with that pane aborts the rest of the sweep instead of waiting out every offline box's timeout. Two LIVE panes (local or fleet-answered) sharing the same 8-hex suffix fail closed with both names printed, rather than guessing; a dead/retained pane is never attached. `--device` skips the local gate entirely and scopes the race to the named box(es). Source: `cli/src/lib/session/local-tmux-attach.ts` (new, `attachLocalLiveSelector`), `cli/src/commands/{sessions,sessions-resume,attach,focus}.ts`.
+
+- **`agents tmux attach` tears the session down when the agent exits (PHNX-3293).**
+  Attaching to a wrapped pane and exiting the agent (`/exit`, Ctrl-c) used to
+  print `[detached]` and leave the tmux session in `tmux ls` — the v6 pane-died
+  hook only `detach-client`s when a client is attached, and the attach verbs
+  never killed the `remain-on-exit` husk. `tmux attach`, `sessions focus` /
+  `resume --attach-only`, and `go`'s local-tmux attach now destroy the session
+  when every pane is dead and still keep it on Ctrl-b d. A piped (no-TTY)
+  local `agents run --interactive` no longer wraps in tmux, so session-tracker
+  tests cannot leak live "trust this folder" panes. `agents tmux kill` with no
+  name opens a picker whose preview is the pane's last screen (so a leaked
+  first-run dialog is distinguishable from real work); `tmux ls` prints that
+  snippet on each row. Source:
+  `cli/src/lib/tmux/session.ts`, `cli/src/commands/tmux.ts`,
+  `cli/src/commands/focus.ts`, `cli/src/lib/exec.ts`.
+
+- **`agents browser start` no longer silently mints a logged-out `auto-chrome` (PHNX-3296).** With no configured default and no existing launchable profile, start now errors and points at `agents setup` / `agents browser use <name>` / the `browser.device` fleet hub instead of popping a signed-out Chrome. A pre-existing `auto-chrome` or legacy `default` still resolves. `agents setup`'s browser pick replaces the misleading "auto-detect on first use" opt-out with an explicit "None — this box uses the fleet hub" choice. Source: `cli/src/lib/browser/profiles.ts`, `cli/src/commands/setup-preferences.ts`, `cli/src/commands/browser.ts`.
+
+- **`sessions detach` / `sessions stop` of a unique live local session no longer wait for fleet SSH timeouts (PHNX-3298).** A live pane already visible locally is the hit: a full UUID or a unique 8-hex prefix skips `gatherRemoteActive` entirely, so a sleeping peer cannot print `unreachable or no agents CLI` or stall SIGTERM. Two local matches fail closed without waiting for unanswered boxes. A genuine miss still races the fleet and aborts remaining SSH on the first unique reachable live row; browse / `focus` with no id stays all-settle. Source: `cli/src/commands/go.ts`, `cli/src/commands/detach.ts`, `cli/src/commands/sessions-stop.ts`.
+
+- **`agents monitors add` refuses immediately when a reachable peer already has the same watcher (PHNX-3299).** The fleet duplicate guard used to collect every peer before reporting a clash, so a single slow box forced the full 12-second timeout even when another peer had already answered with the same fingerprint. The fan-out now aborts remaining SSH captures the moment a peer reports a matching monitor, while the no-match path still waits for the whole fleet so uniqueness can be proved. Source: `cli/src/commands/monitors.ts`, `cli/src/lib/monitors/remote.ts`.
+
+- **`agents repo sync user` self-heals a non-git or partial `~/.agents` by adopting it in place — no re-clone, no data loss (PHNX-3301).** When the user-layer checkout lost (or never had) its `.git`, sync hard-failed with `Not a git repo: ~/.agents` and the only fix was a destructive re-clone that wiped runtime state (`.cache` / `.history` / `scratch` / device config). It now git-backs the existing directory in place with plumbing only (`init` / `remote` / `fetch` / `update-ref` / `read-tree` / `checkout-index` / `restore`, so it never trips the fleet git-guard): materializes only the MISSING tracked files, restores a stale-stub top-level `agents.yaml` from origin (backing up the previous copy to `.history/agents.yaml.pre-adopt.bak` first), preserves gitignored runtime state, and surfaces (never clobbers) real local edits. The remote URL is resolved from an existing `origin`, `AGENTS_USER_REPO_URL`, or a device-local record left by a prior healthy sync — never hardcoded. `agents sync status` now flags a non-git `~/.agents` as a distinct drift state instead of burying it as "N missing". Source: `cli/src/lib/git.ts`, `cli/src/commands/sync.ts`, `cli/src/commands/repo.ts`, `cli/src/lib/sync-status.ts`, `cli/src/commands/status.ts`.
+
+- **Owner notifications forward to a capable fleet peer when this box can't deliver (PHNX-3303).**
+  The owner's delivery provider for the rush-backed channels (imessage / telegram /
+  slack / discord via the `rush` CLI) is macOS-only, so `agents feed post --level
+  important` / `--blocked`, `agents notify`, and monitor `notify` actions run from a
+  headless Linux worker used to record the post but fail to reach the owner with
+  `owner failed: … rush CLI not found on PATH`. They now hand the delivery over SSH to
+  a reachable macOS peer that DOES have the provider — the same reroute
+  `agents message` already uses — instead of stranding the important post. It is
+  best-effort: it never throws or blocks the post, only the macOS-only rush family
+  triggers a forward (a Linux-capable transport like openclaw-telegram stays local),
+  and when no capable peer is reachable the existing clean local error stands. A box
+  that received a forward never forwards onward (`AGENTS_OWNER_NO_FORWARD` guard).
+  Source: `cli/src/lib/channels/owner-forward.ts`, `cli/src/lib/notify.ts`,
+  `cli/src/lib/feed-broadcast.ts`.
+
+- **`agents artifacts share <file>` now derives a stable slug automatically (PHNX-3310).**
+  The default comes from the HTML `<title>` or Markdown frontmatter `title:`, then
+  the filename, so repeat publishes of a long-running artifact update the same URL;
+  `--slug` remains an optional explicit override. Source:
+  `cli/src/lib/share/publish.ts`, `cli/src/commands/share.ts`.
+
+- **The release attestation now shards its test suite across the fleet instead of pinning one box.** `release-attestation-produce.sh` — the full-suite run that mints a release's exact-tree attestation — ran the ~13k-test suite on a single auto-picked box at `--maxWorkers=2` (~880s measured, ~14 min per attestation). It now fans the suite across the fleet via `test.sh --shard N` by default, resolving N from the eligible workers `agents devices pick` reports (capped) and falling back to a single box only when fewer than two are eligible. The suite is throughput-bound, so this is ~1/N the wall time (~269s on one box → ~31s on nine). Each shard still runs vitest at `--maxWorkers=2 --retry=2`, so the RUSH-3015 per-box flake mitigation is unchanged — sharding adds machines, not per-box concurrency. New `--test-shard <n>` / `--test-devices a,b,c` overrides mirror `test.sh`. Source: `cli/scripts/release-attestation-produce.sh`.
+
+- **Shared pages now show who shared them and — the point — a visibility cue (PHNX-3260 follow-up).** The share Worker injects a slim attribution bar at the top of every served HTML page: `Shared by <handle>`, `Made with <agent>`, the date, and a colour-coded **visibility chip** — 🔒 `Only you` (me), 🏢 `Anyone at <org>` (org), 🌐 `Public`, 🔗 `Unlisted` — so a viewer can tell at a glance who can see the page, the thing the raw served HTML never surfaced. All values come from metadata the Worker already stamps (`visibility`, `owner`/handle, `org_domain`, `agent`, `date`); no new publish-time metadata and no CLI change, so it ships with `agents artifacts share update`. Non-HTML assets (images, JSON, the OG cover) are served byte-for-byte; metadata is HTML-escaped; the rewritten body drops the now-stale R2 etag. Source: `cli/src/lib/share/worker-template.ts`.
+
 ## 1.22.51
 
 - **`publish-computer-helper-mac.sh` cuts the helper's own tag (PHNX-3228).**

package/README.md

@@ -1085,7 +1085,7 @@ agents harness add deepinfra --account deepinfra
 
 One provider account **is** one `agents secrets` bundle -- `agents accounts add` creates it with secrets policy `never`, so a background agent launch on that account never raises Touch ID. `agents accounts` (no subcommand) lists provider bundles next to harness-native signed-in identities so you see both kinds of credential together; `accounts list` / `inspect <name>` / `set-key <name>` (rotate) / `rename` / `remove` manage a bundle by its stable id, independent of its current label. `accounts switch <harness>` is the fast picker over that default -- it writes the same binding as `set-default`, and balanced rotation already honors it.
 
-Harness-native OAuth logins (Claude Code's own `/login`, `codex login`, and so on) stay exactly where the harness put them -- agi-cli discovers and displays them but never copies, renames, or converts them into a provider bundle. Native `accounts name` / `attach` is only for harnesses agents-cli can isolate today (claude, codex, grok; muse when an email is present). A device-scoped login (kimi, droid, …) is refused with a named reason; provider `accounts add --provider` is unrestricted. `accounts sync <name> --device <device>` is the only way a provider account crosses machines, and it's explicit: nothing syncs automatically. Selection order for a run is explicit `--account`, then `accounts set-default` / `switch` for that harness, then the harness's native/balanced account behavior.
+Harness-native OAuth logins (Claude Code's own `/login`, `codex login`, and so on) stay exactly where the harness put them -- agi-cli discovers and displays them but never copies, renames, or converts them into a provider bundle. Native `accounts name` / `attach` is only for harnesses agents-cli can isolate today (claude, codex, grok; muse when an email is present). A device-scoped login (kimi, droid, …) is refused with a named reason; provider `accounts add --provider` is unrestricted. Native **labels** (`agents accounts label codex personal`) bind to a stable identityKey on the central account row in `agents.yaml`, which `agents repo push/pull` already syncs fleet-wide, so `codex#personal` selects the same login on every box. `accounts sync <name> --device <device>` is the only way a **provider** account credential crosses machines, and it's explicit: nothing copies OAuth automatically. Selection order for a run is explicit `--account`, then `accounts set-default` / `switch` for that harness, then the harness's native/balanced account behavior.
 
 ---
 

package/dist/commands/accounts.js

@@ -464,7 +464,7 @@ export function registerAccountsCommand(program) {
 agents accounts label codex@0.146.0 personal
 agents accounts label codex work --account you@example.com
 agents run codex#work`,
-        notes: 'The label binds to the signed-in account identity, not the version — codex#work keeps selecting that account after it moves to a newer install. One signed-in login needs no selector; with several, an interactive terminal opens a picker, while scripts pass --account or <harness>@<version>.',
+        notes: 'The label binds to the signed-in account identity, not the version — codex#work keeps selecting that account after it moves to a newer install. Labels live on the central account rows in agents.yaml, which `agents repo push/pull` already syncs fleet-wide, keyed by (agent, identityKey). One signed-in login needs no selector; with several, an interactive terminal opens a picker, while scripts pass --account or <harness>@<version>.',
     });
     accounts.command('attach <account> <target>')
         .description('Attach a named account to a native installation or custom harness')

package/dist/commands/attach.js

@@ -3,6 +3,7 @@ import { runOnPeer } from '../lib/session/remote-list.js';
 import { sessionRecoveryPeer } from '../lib/session/recovery.js';
 import { resolveSessionMetadataValue, resumeSessionInPlace } from './sessions.js';
 import { readDetachRecord, clearDetachRecord, isHeadlessAlive } from '../lib/session/detached.js';
+import { attachLocalLiveSelector } from '../lib/session/local-tmux-attach.js';
 export function registerAttachCommand(program) {
     // Deprecated: superseded by `agents sessions resume`, which detects the state
     // (live pane / headless / ended) instead of making the caller pick a verb.
@@ -19,6 +20,12 @@ export function registerAttachCommand(program) {
     });
 }
 export async function attachAction(id) {
+    // PHNX-3292: this deprecated spelling still gets the local-pane fast path —
+    // a live tmux alias/short id on THIS box attaches with zero SSH, matching
+    // `sessions resume`. `attach` takes no `--device`, so hosts is always empty.
+    if (await attachLocalLiveSelector(id.trim(), [])) {
+        return;
+    }
     const outcome = await resolveSessionMetadataValue(id);
     if (outcome.kind === 'partial') {
         // RUSH-2492: an unreachable peer is a warning, not a hard failure. The

package/dist/commands/browser.js

@@ -14,7 +14,7 @@ import { DEFAULT_VIEWPORT, parseWindowSize, parseWindowPosition } from '../lib/b
 import { runBrowserSessionsCommand } from './browser-sessions-picker.js';
 import { discoverBrowserWsUrl, verifyBrowserIdentity } from '../lib/browser/cdp.js';
 import { parseTargetFilter } from '../lib/browser/service.js';
-import { BrowserDaemonNotRunningError, formatBrowserDaemonNotRunningError, sendIPCRequest as sendRawIPCRequest, } from '../lib/browser/ipc.js';
+import { BrowserDaemonNotRunningError, formatBrowserDaemonNotRunningError, sendIPCRequest as sendRawIPCRequest, resetBrowserDaemon, } from '../lib/browser/ipc.js';
 import { bindTask, getTaskBinding, honorScreenshotOutput, REJECT_DEVICE_MESSAGE, resolveTaskRoute, unbindTask, unbindTasksForProfile, updateTaskBinding, } from '../lib/browser/task-index.js';
 import { isSelfHost } from '../lib/devices/self-host.js';
 import { resolveHost } from '../lib/hosts/registry.js';
@@ -294,7 +294,7 @@ export function registerBrowserCommand(program) {
       # Create a Chrome profile pointed at a CDP endpoint
       agents browser profiles create work --browser chrome --endpoint http://localhost:9222
 
-      # Start a session — auto-picks the first installed Chromium-family browser
+      # Start a session on this machine's default browser (set it once with: agents browser use)
       agents browser start
 
       # Or pin to a specific profile
@@ -323,6 +323,11 @@ export function registerBrowserCommand(program) {
 
       # Close tabs the daemon's own reaper would have caught on its next 5-min tick
       agents browser prune --dry-run
+
+      # Recover a wedged daemon ("Timeout waiting for browser daemon socket"):
+      # stop it and clear a stale socket, then start clean
+      agents browser stop --daemon
+      agents browser start
     `,
         notes: `
       Most agent workflows should use the 'browser' skill instead of raw subcommands.
@@ -363,7 +368,7 @@ export function buildBrowserUseChoices(profiles, installed, current) {
 export async function runBrowserUse(name, opts, interactive = isInteractiveTerminal()) {
     if (opts.unset || name === 'auto') {
         unsetConfigValue('browser.profile');
-        console.log('Default browser profile cleared. `agents browser start` will auto-detect an installed Chromium-family browser.');
+        console.log('Default browser profile cleared. Pick one with `agents browser use <name>` (or `agents setup`); until then `agents browser start` has no default to launch here.');
         return true;
     }
     let selectedName = name;
@@ -372,7 +377,7 @@ export async function runBrowserUse(name, opts, interactive = isInteractiveTermi
         if (!interactive) {
             console.log(current
                 ? `Default browser profile (this machine): ${current}`
-                : 'Default browser profile (this machine): auto-detect');
+                : 'Default browser profile (this machine): none — pick one with `agents browser use <name>`');
             const hub = getConfigValue('browser.device').value;
             if (hub) {
                 console.log(isSelfHost(hub)
@@ -421,7 +426,7 @@ export async function runBrowserUse(name, opts, interactive = isInteractiveTermi
 function configureBrowserUseCommand(command, deprecated = false) {
     command
         .description('Pick the profile `agents browser start` uses when no --profile is passed. No name opens a picker on a TTY or prints the current default headlessly.')
-        .option('--unset', 'Clear the configured default (revert to auto-detecting an installed browser)')
+        .option('--unset', 'Clear the configured default (leaves this machine with no default until you pick one)')
         .action(async (name, opts) => {
         if (deprecated) {
             console.warn(chalk.yellow('Deprecation: `agents browser profiles set-default` is replaced by `agents browser use`.'));
@@ -942,7 +947,7 @@ function registerProfilesCommands(browser) {
             (removed > 0 ? ` (and ${removed} cache dir${removed === 1 ? '' : 's'})` : ''));
         if (getConfiguredDefaultProfileName() === name) {
             console.error(`warning: "${name}" was this machine's default browser profile; ` +
-                `\`agents browser start\` will auto-detect until you run: agents browser use <name>`);
+                `\`agents browser start\` has no default here until you run: agents browser use <name>`);
         }
     });
     profiles
@@ -1025,13 +1030,13 @@ function registerProfilesCommands(browser) {
       with \`agents browser profiles claim\` on the machine that hosts the browser.
 
       In \`list\`, the \`*\` marker means "this machine's configured default"
-      (\`agents browser start\` with no --profile). The auto-detected profile is
-      named \`auto-chrome\`; \`default\` is only an ALIAS for whichever profile
+      (\`agents browser start\` with no --profile). A profile a setup wizard pins
+      is named \`auto-chrome\`; \`default\` is only an ALIAS for whichever profile
       this machine is configured to use, resolved the same way by every command.
 
       \`prune\` only considers profiles this device declares. It never removes a
-      profile that is in use, the configured default, or the auto-detected
-      \`auto-chrome\`.
+      profile that is in use, the configured default, or the \`auto-chrome\`
+      profile a setup wizard created.
     `,
     });
     profiles
@@ -1371,8 +1376,8 @@ function registerTaskCommands(browser) {
     });
     browser
         .command('start')
-        .description('Start a browser task. Pass --profile <name>; omit to use your configured default (`agents browser use <name>`), else auto-pick an installed Chromium-family browser. Page verbs (navigate/screenshot/…) create a task implicitly when none exists — start is for --profile/--url/--record/--title.')
-        .option('-p, --profile <name>', 'Browser profile to use (omit to use the configured default, else auto-pick an installed Chromium-family browser)')
+        .description('Start a browser task. Pass --profile <name>; omit to use your configured default (set it with `agents browser use <name>` or `agents setup`). Page verbs (navigate/screenshot/…) create a task implicitly when none exists — start is for --profile/--url/--record/--title.')
+        .option('-p, --profile <name>', 'Browser profile to use (omit to use this machine\'s configured default; set it with `agents browser use <name>`)')
         .option(TASK_OPTION_FLAG, 'Task name (auto-generated short id if omitted)')
         .option('--title <label>', 'Human label shown in `browser status` (defaults to first navigated host)')
         .option('-e, --endpoint <name>', 'Endpoint preset (defaults to the profile\'s default)')
@@ -1445,13 +1450,85 @@ function registerTaskCommands(browser) {
                 return;
             }
         }
+        // Resolve an EXPLICIT --device BEFORE any local profile/browser
+        // resolution (PHNX-3289). The task lives on the TARGET device, so its
+        // browser binary and profile must resolve THERE. Resolving locally first
+        // made a browserless box fail with a misleading "No supported browser
+        // found" (bare start) or "Profile <x> not found" (a profile that lives
+        // only on the target) before the start ever routed to --device. This
+        // mirrors the hub path above: the target is the authority on its own
+        // profiles, so forward the whole start and let it validate. `local`/`self`
+        // force a local run; a fleet-remote re-exec is already ON the target and
+        // falls through to the local launch below.
+        const deviceName = opts.device === 'local' || opts.device === 'self' ? undefined : opts.device;
+        if (deviceName) {
+            const lowered = deviceName.toLowerCase();
+            if (lowered === 'all' || lowered === 'auto') {
+                console.error(`--device ${deviceName} is not valid on \`agents browser start\`: a task lives on one device.\n` +
+                    `Next: agents browser start --task <name> --device <device>`);
+                process.exit(1);
+            }
+            if (!isSelfHost(deviceName) && !isFleetRemoteInvocation()) {
+                // Resolve the profile NAME (never a local browser auto-pick) so a
+                // named profile can still be validated against the target's
+                // declarations before we round-trip. A bare start carries no name to
+                // validate — the target picks its own default — so it forwards
+                // straight through, which is exactly what unblocks a browserless box.
+                // Only resolve when the caller actually named a profile: passing an
+                // undefined ref would let `resolveProfileRef` fall back to THIS box's
+                // configured/auto-detected default (matching the ~4 other call sites
+                // in this file), and validating that local name against the target
+                // re-introduces the exact false failure this reorder fixes.
+                const forwardProfile = opts.profile ? await resolveProfileRef(opts.profile) : undefined;
+                if (forwardProfile) {
+                    try {
+                        assertDeviceDeclaresProfile(deviceName, forwardProfile);
+                    }
+                    catch (err) {
+                        console.error(err instanceof Error ? err.message : String(err));
+                        process.exit(1);
+                    }
+                }
+                try {
+                    const result = await dispatchBrowserToDevice(deviceName, browserForwardedArgv(), 'capture');
+                    process.stdout.write(result.stdout);
+                    process.stderr.write(result.stderr);
+                    if (result.code !== 0)
+                        process.exit(result.code);
+                    const taskName = opts.task || result.stdout.trim().split('\n').find((line) => line.length > 0);
+                    if (!taskName) {
+                        console.error(`Remote start on ${deviceName} produced no task name.`);
+                        process.exit(1);
+                    }
+                    bindTask(taskName, {
+                        device: deviceName,
+                        // Only the caller-named profile; the target's own default (bare
+                        // start) is opaque here, exactly as in the hub path.
+                        profile: forwardProfile ?? opts.profile,
+                        url: opts.url,
+                        sessionId: callerSessionId(),
+                        launchId: callerLaunchId(),
+                        createdAt: Date.now(),
+                    });
+                    if (!result.stderr.includes(`started on ${deviceName}`)) {
+                        console.error(`Task "${taskName}" started on ${deviceName}.`);
+                    }
+                }
+                catch (err) {
+                    console.error(err instanceof Error ? err.message : String(err));
+                    process.exit(1);
+                }
+                return;
+            }
+        }
         // One resolution order for every command (RUSH-2709): `--profile default`
         // means the same profile here as it does in stop / status / navigate.
         // `start` is the one command that LAUNCHES, so its implicit path goes
         // through ensureDefaultBrowserProfile, which additionally verifies the
-        // resolved default can launch on THIS machine and regenerates it when it
-        // can't (the "Custom binary not found" repair) — a filter-only command
-        // must not warn or rewrite a profile, so that check lives only here.
+        // resolved default can launch on THIS machine and, when nothing launchable
+        // resolves, throws an actionable "pick a browser in `agents setup`" error
+        // (PHNX-3296 — it no longer silently mints an auto-chrome). A filter-only
+        // command must not warn about the config, so that check lives only here.
         let profileName;
         try {
             profileName = await resolveProfileRefForStart(opts.profile);
@@ -1481,17 +1558,12 @@ function registerTaskCommands(browser) {
                 process.exit(1);
             }
         }
-        // The `browser.device` hub default is applied above (bare/--profile, no
-        // --device). Here only an EXPLICIT --device remains — with `local`/`self` as
-        // the escape that forces a local run when a hub is configured.
-        const deviceName = opts.device === 'local' || opts.device === 'self' ? undefined : opts.device;
+        // Only the LOCAL launch reaches here — an explicit remote --device already
+        // forwarded and returned above. A residual `deviceName` means an explicit
+        // self target (or a fleet-remote re-exec on the target); its profile
+        // resolved locally, so verify this box actually declares it (the
+        // `profiles claim` hint lives in `assertDeviceDeclaresProfile`).
         if (deviceName) {
-            const lowered = deviceName.toLowerCase();
-            if (lowered === 'all' || lowered === 'auto') {
-                console.error(`--device ${deviceName} is not valid on \`agents browser start\`: a task lives on one device.\n` +
-                    `Next: agents browser start --task <name> --device <device>`);
-                process.exit(1);
-            }
             try {
                 assertDeviceDeclaresProfile(deviceName, profileName);
             }
@@ -1499,36 +1571,6 @@ function registerTaskCommands(browser) {
                 console.error(err instanceof Error ? err.message : String(err));
                 process.exit(1);
             }
-            if (!isSelfHost(deviceName) && !isFleetRemoteInvocation()) {
-                try {
-                    const result = await dispatchBrowserToDevice(deviceName, browserForwardedArgv(), 'capture');
-                    process.stdout.write(result.stdout);
-                    process.stderr.write(result.stderr);
-                    if (result.code !== 0)
-                        process.exit(result.code);
-                    const taskName = opts.task || result.stdout.trim().split('\n').find((line) => line.length > 0);
-                    if (!taskName) {
-                        console.error(`Remote start on ${deviceName} produced no task name.`);
-                        process.exit(1);
-                    }
-                    bindTask(taskName, {
-                        device: deviceName,
-                        profile: profileName,
-                        url: opts.url,
-                        sessionId: callerSessionId(),
-                        launchId: callerLaunchId(),
-                        createdAt: Date.now(),
-                    });
-                    if (!result.stderr.includes(`started on ${deviceName}`)) {
-                        console.error(`Task "${taskName}" started on ${deviceName} (profile: ${profileName}).`);
-                    }
-                }
-                catch (err) {
-                    console.error(err instanceof Error ? err.message : String(err));
-                    process.exit(1);
-                }
-                return;
-            }
         }
         // Grounded login guardrail: if the opening URL is a known login-gated
         // service and the resolved profile has no session for it, say so on stderr
@@ -1641,11 +1683,31 @@ function registerTaskCommands(browser) {
     });
     browser
         .command('stop')
-        .description('Stop a browser task and close its tabs; with --profile, detach the whole profile (close browser + drop cached connection)')
+        .description('Stop a browser task and close its tabs; with --profile, detach the whole profile (close browser + drop cached connection); with --daemon, stop the browser daemon and clear a wedged socket')
         .option(TASK_OPTION_FLAG, TASK_OPTION_DESC)
         .option(DEVICE_ON_PAGE_VERB_FLAG, DEVICE_ON_PAGE_VERB_DESC)
         .option('-p, --profile <name>', 'Detach the whole profile (incl. composite "name@endpoint") instead of stopping a single task')
+        .option('--daemon', 'Stop the browser daemon entirely and clear a stale/wedged socket so the next start comes up clean (recovery for "Timeout waiting for browser daemon socket")')
         .action(async (opts) => {
+        if (opts.daemon) {
+            if (opts.profile || opts.task) {
+                console.error('--daemon stops the whole browser daemon; do not combine it with --profile or --task.');
+                process.exit(1);
+            }
+            try {
+                const result = await resetBrowserDaemon();
+                const parts = [];
+                parts.push(result.wasRunning ? 'Stopped browser daemon' : 'Browser daemon was not running');
+                if (result.socketCleared)
+                    parts.push('cleared stale socket');
+                console.log(`${parts.join('; ')}. It restarts on the next browser command.`);
+            }
+            catch (err) {
+                console.error(err instanceof Error ? err.message : String(err));
+                process.exit(1);
+            }
+            return;
+        }
         if (opts.profile) {
             const profile = (await resolveProfileRef(opts.profile)) ?? opts.profile;
             const response = await sendIPCRequest({

package/dist/commands/daemon.d.ts

@@ -16,6 +16,8 @@
  */
 import type { Command } from 'commander';
 import { type DaemonServiceId } from '../lib/daemon-services.js';
+/** Elapsed wall-clock seconds since `pid` started, or null if unavailable (best-effort, POSIX only). */
+export declare function uptimeSeconds(pid: number): number | null;
 /** One row of the roster every registered daemon service — supervisor-managed or legacy — renders in `agents daemon services`. */
 export interface DaemonServiceRow {
     id: DaemonServiceId;

package/dist/commands/daemon.js

@@ -30,6 +30,7 @@ import { parseDuration } from '../lib/hooks/cache.js';
 import { registerFunnelCommand } from './funnel.js';
 import { DEFAULT_WEBHOOK_PORT, DEFAULT_WEBHOOK_RATE_LIMIT, addHostedReceiver, getDaemonWebhooksConfigPath, hostedReceiverPort, readDaemonWebhooksConfig, removeHostedReceiver, } from '../lib/daemon-webhooks.js';
 import { parseFunnelPort } from '../lib/funnel.js';
+import { parseEtimeToSeconds } from '../lib/secrets/reaper.js';
 /**
  * Provably absent, or null when unknowable.
  *
@@ -256,13 +257,16 @@ function registryScopedDuplicates(processes, ownerPid) {
     return processes.filter((p) => registered.has(p.pid));
 }
 /** Elapsed wall-clock seconds since `pid` started, or null if unavailable (best-effort, POSIX only). */
-function uptimeSeconds(pid) {
+export function uptimeSeconds(pid) {
     if (process.platform === 'win32')
         return null;
     try {
-        const out = execFileSync('ps', ['-o', 'etimes=', '-p', String(pid)], { encoding: 'utf-8' }).trim();
-        const n = parseInt(out, 10);
-        return isNaN(n) ? null : n;
+        // `-o etimes=` is a GNU/procps keyword macOS/BSD `ps` rejects with a
+        // non-zero exit (`ps: etimes: keyword not found`), so `agents daemon status`
+        // errored out entirely on macOS. `etime` (`[[dd-]hh:]mm:ss`) is the portable
+        // POSIX field; `parseEtimeToSeconds` (shared with the keychain reaper) parses it.
+        const out = execFileSync('ps', ['-o', 'etime=', '-p', String(pid)], { encoding: 'utf-8' }).trim();
+        return parseEtimeToSeconds(out);
     }
     catch {
         return null;