@phnx-labs/agents-cli 1.22.51 → 1.22.53

package/dist/lib/devices/registry.d.ts

@@ -176,10 +176,12 @@ export declare function removeDevice(name: string): Promise<boolean>;
  */
 export type { IgnoredDeviceEntry } from '../fleet/types.js';
 /**
- * The full ignore-list entries — who dismissed a node, when, and on which box —
- * the typed read side for `agents devices ignored`. Absent `fleet.ignored` =>
- * []. A malformed block is a hard error for the same reason the registry is:
- * silently returning [] would let the next write wipe the user's dismissals.
+ * The EFFECTIVE ignore-list: the union of every box's device doc
+ * `fleet.ignored` (deduped by node name, newest `ignoredAt` winning) plus any
+ * lingering central-legacy `fleet.ignored` block (drained by the migration).
+ * Deterministic and order-independent. A malformed block is a hard error for the
+ * same reason the registry is: silently returning [] would let the next write
+ * wipe the user's dismissals.
  */
 export declare function loadIgnoredEntries(meta?: Meta): IgnoredDeviceEntry[];
 /** Load the set of ignored node names. Same corruption contract as
@@ -195,7 +197,11 @@ export declare function isIgnored(name: string): Promise<boolean>;
  * lib/devices/config-migration.ts.
  */
 export declare function withIgnoredAdded(meta: Meta, names: string[], ignoredAt: string): Meta;
-/** Add a node name to the ignore-list. Idempotent. Returns the resulting set. */
+/** Add a node name to THIS box's ignore-list (device doc). Idempotent. Returns
+ * the resulting cross-box union of dismissed names. Reads only the device docs
+ * for the return value — a corrupt central-legacy block surfaces loudly on the
+ * effective read path ({@link loadIgnoredEntries}), never blocks a per-box
+ * write that does not touch central at all. */
 export declare function addIgnored(name: string): Promise<Set<string>>;
 /** Remove a node name from the ignore-list (un-ignore). Returns false if it was
  * not ignored. */

package/dist/lib/devices/registry.js

@@ -20,6 +20,7 @@ import lockfile from 'proper-lockfile';
 import { getDevicesRegistryPath, readMeta, updateMeta } from '../state.js';
 import { atomicWriteJsonSync } from '../fs-atomic.js';
 import { machineId } from '../machine-id.js';
+import { addIgnoredEntry, unionDeviceIgnored } from './device-docs.js';
 /**
  * Whether a fan-out should dial this device, honouring the preference stated on
  * {@link DeviceProfile.reachability}: the live SSH probe wins over the cached
@@ -287,19 +288,48 @@ export async function removeDevice(name) {
  * []. A malformed block is a hard error for the same reason the registry is:
  * silently returning [] would let the next write wipe the user's dismissals.
  */
-export function loadIgnoredEntries(meta = readMeta()) {
-    const raw = meta.fleet?.ignored;
-    if (raw === undefined)
-        return [];
+/** Validate a raw ignore-list block, or throw with `where` naming the file. */
+function assertIgnoredShape(raw, where) {
     if (!Array.isArray(raw) ||
         raw.some((e) => !e ||
             typeof e.name !== 'string' ||
             typeof e.ignoredAt !== 'string' ||
             typeof e.ignoredOn !== 'string')) {
-        throw new Error(`Device ignore-list corrupted in agents.yaml (fleet.ignored): expected a list of { name, ignoredAt, ignoredOn } entries. Inspect and repair ~/.agents/agents.yaml.`);
+        throw new Error(`Device ignore-list corrupted in ${where}: expected a list of { name, ignoredAt, ignoredOn } entries. Inspect and repair it.`);
     }
+}
+/**
+ * THIS box's OWN dismissals — the writable slice in `meta.deviceFleet.ignored`
+ * (the device doc). `withIgnoredAdded`/`removeIgnored` operate on this so a box
+ * only ever edits its own folder (PHNX-3315). Absent => [].
+ */
+function loadOwnIgnoredEntries(meta) {
+    const raw = meta.deviceFleet?.ignored;
+    if (raw === undefined)
+        return [];
+    assertIgnoredShape(raw, `devices/<machine>/agents.yaml (fleet.ignored)`);
     return raw;
 }
+/**
+ * The EFFECTIVE ignore-list: the union of every box's device doc
+ * `fleet.ignored` (deduped by node name, newest `ignoredAt` winning) plus any
+ * lingering central-legacy `fleet.ignored` block (drained by the migration).
+ * Deterministic and order-independent. A malformed block is a hard error for the
+ * same reason the registry is: silently returning [] would let the next write
+ * wipe the user's dismissals.
+ */
+export function loadIgnoredEntries(meta = readMeta()) {
+    const byName = new Map();
+    const central = meta.fleet?.ignored;
+    if (central !== undefined) {
+        assertIgnoredShape(central, `agents.yaml (fleet.ignored)`);
+        for (const e of central)
+            addIgnoredEntry(byName, e);
+    }
+    for (const e of unionDeviceIgnored())
+        addIgnoredEntry(byName, e);
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
 /** Load the set of ignored node names. Same corruption contract as
  * {@link loadIgnoredEntries}. */
 export async function loadIgnored() {
@@ -317,40 +347,38 @@ export async function isIgnored(name) {
  * lib/devices/config-migration.ts.
  */
 export function withIgnoredAdded(meta, names, ignoredAt) {
-    const entries = loadIgnoredEntries(meta); // throws on a corrupted block — never wipe it
+    const entries = loadOwnIgnoredEntries(meta); // throws on a corrupted block — never wipe it
     const have = new Set(entries.map((e) => e.name));
     const fresh = names.filter((n) => !have.has(n));
     if (fresh.length === 0)
         return meta;
-    const fleet = (meta.fleet ?? { devices: {} });
     const ignored = [
         ...entries,
         ...fresh.map((name) => ({ name, ignoredAt, ignoredOn: machineId() })),
     ].sort((a, b) => a.name.localeCompare(b.name));
-    const nextFleet = { ...fleet, ignored };
-    return { ...meta, fleet: nextFleet };
+    return { ...meta, deviceFleet: { ...meta.deviceFleet, ignored } };
 }
-/** Add a node name to the ignore-list. Idempotent. Returns the resulting set. */
+/** Add a node name to THIS box's ignore-list (device doc). Idempotent. Returns
+ * the resulting cross-box union of dismissed names. Reads only the device docs
+ * for the return value — a corrupt central-legacy block surfaces loudly on the
+ * effective read path ({@link loadIgnoredEntries}), never blocks a per-box
+ * write that does not touch central at all. */
 export async function addIgnored(name) {
     assertValidDeviceName(name);
-    const meta = updateMeta((m) => withIgnoredAdded(m, [name], new Date().toISOString()));
-    return new Set(loadIgnoredEntries(meta).map((e) => e.name));
+    updateMeta((m) => withIgnoredAdded(m, [name], new Date().toISOString()));
+    return new Set(unionDeviceIgnored().map((e) => e.name));
 }
 /** Remove a node name from the ignore-list (un-ignore). Returns false if it was
  * not ignored. */
 export async function removeIgnored(name) {
     let removed = false;
     updateMeta((m) => {
-        const fleet = m.fleet;
-        if (!fleet?.ignored)
-            return m;
-        const entries = loadIgnoredEntries(m);
+        const entries = loadOwnIgnoredEntries(m); // only this box's own dismissals are ours to drop
         const next = entries.filter((e) => e.name !== name);
         if (next.length === entries.length)
             return m;
         removed = true;
-        const nextFleet = { ...fleet, ignored: next };
-        return { ...m, fleet: nextFleet };
+        return { ...m, deviceFleet: { ...m.deviceFleet, ignored: next } };
     });
     return removed;
 }

package/dist/lib/exec.d.ts

@@ -93,6 +93,14 @@ export type ExecEffort = 'low' | 'medium' | 'high' | 'xhigh' | 'max' | 'auto';
 /** Options for spawning an agent process. Omitting `prompt` launches the CLI interactively. */
 export interface ExecOptions {
     agent: AgentId;
+    /**
+     * Custom harness / profile name when this run was launched via
+     * `agents run <profile>` (e.g. `deepseek`). `agent` stays the HOST CLI
+     * that actually executes. Stamped onto `AGENTS_AGENT_NAME`, the pid
+     * registry, and the session-actor sidecar so listings can tell the
+     * profile apart from a native host run (PHNX-2935).
+     */
+    harnessName?: string;
     version?: string;
     /** Version home whose native auth/config is overlaid onto this run's binary. */
     configVersion?: string;
@@ -177,6 +185,18 @@ export interface ExecOptions {
      */
     raw?: boolean;
 }
+/**
+ * Identity a custom-harness run stamps on env / pid-registry / sidecars.
+ * `agent` is the host CLI; `harnessName` is the profile the user launched.
+ * Empty/whitespace harness names fall back to the host so a blank stamp
+ * never hides a real agent.
+ */
+export declare function stampedAgentName(options: Pick<ExecOptions, 'agent' | 'harnessName'>): string;
+/**
+ * Profile name when it differs from the host agent. Undefined for a native
+ * run, so pid-registry / sidecar records stay sparse.
+ */
+export declare function customHarnessName(options: Pick<ExecOptions, 'agent' | 'harnessName'>): string | undefined;
 /**
  * Resolve interactive vs headless. Explicit flags are definitive and win over
  * inference: `--interactive` forces interactive, `--headless` forces headless.
@@ -406,25 +426,39 @@ export interface TmuxWrapContext {
      * True when this run was dispatched onto this box over SSH by `--device`
      * (the launcher exports {@link REMOTE_INTERACTIVE_ENV}).
      *
-     * A remote interactive agent is a child of the sshd session and holds its
-     * controlling TTY, so without the wrap a dropped link SIGHUPs it and the work
-     * in flight is gone. Durability is therefore NOT a preference the way
-     * `configEnabled` is — `tmux.enabled` is about whether this box's operator
-     * likes tmux's mouse/clipboard/scrollback at their own keyboard, which says
-     * nothing about whether a run arriving over the network must outlive it.
-     * Conflating the two is what left every `--device` agent unsurvivable
-     * (RUSH-3125), while lib/hosts/reconnect.ts reconnected on the premise that
-     * they were detached.
+     * Since PHNX-3316 this flag no longer forces the wrap: `tmux.enabled` gates
+     * local and remote runs alike, because the operator reading "tmux disabled"
+     * expects NO tmux anywhere. A followed remote run left bare is protected by
+     * reconnect-and-resume (lib/hosts/reconnect.ts): a dropped link costs the
+     * in-flight turn, and the harness session resumes from disk.
+     *
+     * The flag still matters for one case: a followed remote run whose LAUNCHER
+     * has no TTY (CI, a script, another agent driving the CLI — `sshStream`
+     * allocates the peer's TTY from `process.stdin.isTTY`, dispatch.ts) gets no
+     * TTY on the peer either, so there is nothing to attach to and the detached
+     * pane is the run's only interface — it wraps regardless of `configEnabled`
+     * (and is refused as `undurable` when tmux is missing).
      */
     remoteDispatch: boolean;
     /** Whether a tmux binary is on PATH. */
     tmuxAvailable: boolean;
+    /**
+     * True when this process has a real TTY to attach (`stdout.isTTY`).
+     * A piped `agents run --interactive` (session-tracker tests, CI) has none:
+     * wrapping then treating the failed attach as Ctrl-b d leaked live panes
+     * for a week on yosemite-s0 (PHNX-3293). A remote dispatch still wraps
+     * without a TTY — a launcher that has none (CI, scripts, another agent)
+     * gives the peer nothing to attach to, so the detached pane is the run's
+     * only interface.
+     */
+    hasTty: boolean;
 }
 /**
- * What to do with an interactive spawn. Three outcomes, not two: a run that
- * MUST be durable and cannot be is neither "wrap" nor "spawn bare" — it is a
- * launch that should not happen, because a bare remote spawn looks fine right
- * up until the link blinks and the agent dies with it.
+ * What to do with an interactive spawn. Three outcomes, not two: a remote run
+ * that WOULD wrap (the operator opted in, or a `--no-follow` run whose only
+ * interface is the detached pane) on a box with no tmux is neither "wrap" nor
+ * "spawn bare" — it is a launch that should not happen, because a bare remote
+ * spawn looks fine right up until the link blinks and the agent dies with it.
  */
 export type TmuxWrapDecision = 
 /** Run the agent in a detached tmux session and attach this TTY. */
@@ -435,7 +469,7 @@ export type TmuxWrapDecision =
  | {
     kind: 'bare';
 }
-/** Remote-dispatched and tmux is missing on this box: refuse, don't pretend. */
+/** Remote-dispatched, wants the wrap, and tmux is missing: refuse, don't pretend. */
  | {
     kind: 'undurable';
 };
@@ -443,20 +477,24 @@ export type TmuxWrapDecision =
  * Decide whether to run an interactive agent INSIDE a detached tmux session on
  * the shared socket (then attach the current TTY) instead of a bare spawn.
  *
- * Wrapping serves two independent purposes, and they are gated differently:
- *
- *  - **Addressability** (`configEnabled`): a unique `%pane` handle so
- *    `agents sessions --active` can tell co-located agents apart and `agents
- *    focus` re-attaches without forking. That is a local preference — the
- *    operator turns it on once tmux's mouse/clipboard/scrollback suits them.
- *  - **Durability** (`remoteDispatch`): a run that arrived over SSH must outlive
- *    the SSH client, because a bare remote spawn dies of SIGHUP the moment the
- *    link blinks. That is not a preference, so it does not consult
- *    `configEnabled` (RUSH-3125 — see {@link TmuxWrapContext.remoteDispatch}).
- *
- * The per-run opt-outs bind BOTH: `--raw` / `--no-tmux` / `AGENTS_NO_TMUX=1` are
- * explicit "I want the bare process" requests, and honouring them over the
- * durability rule keeps one escape hatch that always works.
+ * The wrap is opt-in via this device's `tmux.enabled` (`configEnabled`): a
+ * unique `%pane` handle so `agents sessions --active` can tell co-located
+ * agents apart and `agents focus` re-attaches without forking, plus scrollback
+ * and mouse at the operator's keyboard. Off means OFF, for local and remote
+ * runs alike (PHNX-3316) — a followed `--device` run left bare is protected by
+ * reconnect-and-resume (lib/hosts/reconnect.ts), which rejoins the live pane
+ * when one exists and resumes the harness session from disk when it does not.
+ * The RUSH-3125 forced remote wrap conflated durability with that preference
+ * and surprised every operator who had explicitly left tmux off.
+ *
+ * One case still wraps regardless: a followed remote run whose launcher has
+ * no TTY (CI, scripts, another agent) gives the peer nothing to attach to —
+ * the detached pane is the run's only interface, not an ergonomics choice.
+ *
+ * The per-run opt-outs bind everything: `--raw` / `--no-tmux` /
+ * `AGENTS_NO_TMUX=1` are explicit "I want the bare process" requests, and an
+ * escape hatch that silently stopped applying over `--device` would be worse
+ * than the bare run the user asked for.
  *
  * Pure, so the gate is unit-tested independently of the (side-effecting) spawn.
  */

package/dist/lib/exec.js

@@ -181,6 +181,26 @@ export function defaultModeFor(agent) {
 export function implicitModeFor(agent) {
     return agent === 'codex' ? 'edit' : 'plan';
 }
+/**
+ * Identity a custom-harness run stamps on env / pid-registry / sidecars.
+ * `agent` is the host CLI; `harnessName` is the profile the user launched.
+ * Empty/whitespace harness names fall back to the host so a blank stamp
+ * never hides a real agent.
+ */
+export function stampedAgentName(options) {
+    const harness = options.harnessName?.trim();
+    return harness || options.agent;
+}
+/**
+ * Profile name when it differs from the host agent. Undefined for a native
+ * run, so pid-registry / sidecar records stay sparse.
+ */
+export function customHarnessName(options) {
+    const harness = options.harnessName?.trim();
+    if (!harness || harness === options.agent)
+        return undefined;
+    return harness;
+}
 /**
  * Resolve interactive vs headless. Explicit flags are definitive and win over
  * inference: `--interactive` forces interactive, `--headless` forces headless.
@@ -346,8 +366,11 @@ export function buildExecEnv(options) {
     result.AGENTS_RUN_MODE = resolveHeadlessMode(options.agent, normalizeMode(options.mode), resolveInteractive(options), options.modeWarningContext, options.modeWarningState);
     result.AGENTS_HISTORY_DIR = getHistoryDir();
     // So activity / feed posts stamp the right harness without re-detecting.
+    // A custom-harness run (`agents run deepseek`) must stamp the PROFILE name,
+    // not the host CLI (`claude`) — otherwise sessions and feed posts cannot
+    // tell the two apart (PHNX-2935).
     if (options.agent) {
-        result.AGENTS_AGENT_NAME = options.agent;
+        result.AGENTS_AGENT_NAME = stampedAgentName(options);
     }
     if (options.cwd) {
         result.AGENTS_CWD = options.cwd;
@@ -1176,41 +1199,52 @@ export function isPaneKnownAliveFromQueryResult(code, stdout) {
  * Decide whether to run an interactive agent INSIDE a detached tmux session on
  * the shared socket (then attach the current TTY) instead of a bare spawn.
  *
- * Wrapping serves two independent purposes, and they are gated differently:
+ * The wrap is opt-in via this device's `tmux.enabled` (`configEnabled`): a
+ * unique `%pane` handle so `agents sessions --active` can tell co-located
+ * agents apart and `agents focus` re-attaches without forking, plus scrollback
+ * and mouse at the operator's keyboard. Off means OFF, for local and remote
+ * runs alike (PHNX-3316) — a followed `--device` run left bare is protected by
+ * reconnect-and-resume (lib/hosts/reconnect.ts), which rejoins the live pane
+ * when one exists and resumes the harness session from disk when it does not.
+ * The RUSH-3125 forced remote wrap conflated durability with that preference
+ * and surprised every operator who had explicitly left tmux off.
  *
- *  - **Addressability** (`configEnabled`): a unique `%pane` handle so
- *    `agents sessions --active` can tell co-located agents apart and `agents
- *    focus` re-attaches without forking. That is a local preference — the
- *    operator turns it on once tmux's mouse/clipboard/scrollback suits them.
- *  - **Durability** (`remoteDispatch`): a run that arrived over SSH must outlive
- *    the SSH client, because a bare remote spawn dies of SIGHUP the moment the
- *    link blinks. That is not a preference, so it does not consult
- *    `configEnabled` (RUSH-3125 — see {@link TmuxWrapContext.remoteDispatch}).
+ * One case still wraps regardless: a followed remote run whose launcher has
+ * no TTY (CI, scripts, another agent) gives the peer nothing to attach to —
+ * the detached pane is the run's only interface, not an ergonomics choice.
  *
- * The per-run opt-outs bind BOTH: `--raw` / `--no-tmux` / `AGENTS_NO_TMUX=1` are
- * explicit "I want the bare process" requests, and honouring them over the
- * durability rule keeps one escape hatch that always works.
+ * The per-run opt-outs bind everything: `--raw` / `--no-tmux` /
+ * `AGENTS_NO_TMUX=1` are explicit "I want the bare process" requests, and an
+ * escape hatch that silently stopped applying over `--device` would be worse
+ * than the bare run the user asked for.
  *
  * Pure, so the gate is unit-tested independently of the (side-effecting) spawn.
  */
 export function resolveTmuxWrap(ctx) {
     // A headless `-p` run has no TTY to attach, Windows has no tmux path, and
-    // nesting tmux-in-tmux is pointless — none of these can wrap, and none of them
-    // is a remote interactive agent whose life depends on it.
+    // nesting tmux-in-tmux is pointless.
     if (!ctx.interactive)
         return { kind: 'bare' };
     if (ctx.platform === 'win32')
         return { kind: 'bare' };
     if (ctx.inTmux)
         return { kind: 'bare' };
-    // Explicit opt-outs win over the durability rule: `--raw` exists precisely to
-    // get the unwrapped process, and a flag that silently stopped working on a
-    // remote box would be worse than an undurable run the user asked for.
+    // Explicit opt-outs win over every other rule: `--raw` exists precisely to
+    // get the unwrapped process.
     if (ctx.raw)
         return { kind: 'bare' };
     if (ctx.noTmuxEnv)
         return { kind: 'bare' };
-    if (!ctx.configEnabled && !ctx.remoteDispatch)
+    // Local interactive with no TTY cannot attach. Wrapping anyway creates a
+    // detached pane, attach returns immediately, and resolveAfterAttach treats
+    // the still-alive pane as Ctrl-b d — the session-tracker test leak.
+    if (!ctx.hasTty && !ctx.remoteDispatch)
+        return { kind: 'bare' };
+    // tmux.enabled gates the wrap for local AND followed remote runs. The one
+    // exception: a followed remote run whose launcher has no TTY (CI, scripts)
+    // gives the peer nothing to attach to — the detached pane is its only
+    // interface, infrastructure rather than ergonomics.
+    if (!ctx.configEnabled && !(ctx.remoteDispatch && !ctx.hasTty))
         return { kind: 'bare' };
     // Fail loud rather than launch a remote agent that a blink would kill: the
     // caller refuses the run instead of starting work that cannot be recovered.
@@ -1514,6 +1548,7 @@ async function runInTmux(options, executable, args) {
         writePidSessionEntry({
             pid: panePid,
             agent: options.agent,
+            harness: customHarnessName(options),
             sessionId: options.sessionId,
             cwd,
             actor: resolveActor().id,
@@ -1532,6 +1567,7 @@ async function runInTmux(options, executable, args) {
                 sessionId: options.sessionId,
                 actor: resolveActor().id,
                 initiatedBy: resolveActor().kind,
+                harness: customHarnessName(options),
                 startedAtMs: Date.now(),
             });
         }
@@ -1656,9 +1692,10 @@ async function spawnAgent(options) {
         args: redactArgs(args.slice(0, 10)),
     });
     // Interactive spawn-wrap: run the agent INSIDE a shared-socket tmux session
-    // (then attach this TTY) so it gets a unique, addressable %pane — and, when
-    // the run arrived over `--device`, so it survives the SSH link that carries
-    // it. Every failed guard keeps the bare spawn below.
+    // (then attach this TTY) so it gets a unique, addressable %pane. Opt-in via
+    // this device's tmux.enabled, local and remote alike (PHNX-3316); a followed
+    // remote run left bare relies on reconnect-and-resume, not a pane. Every
+    // failed guard keeps the bare spawn below.
     const tmuxWrap = resolveTmuxWrap({
         interactive,
         platform: process.platform,
@@ -1668,6 +1705,7 @@ async function spawnAgent(options) {
         configEnabled: isTmuxEnabled(),
         remoteDispatch: process.env[REMOTE_INTERACTIVE_ENV] === '1',
         tmuxAvailable: isTmuxInstalled(),
+        hasTty: !!process.stdout.isTTY,
     });
     if (tmuxWrap.kind === 'undurable') {
         // Refuse rather than start work a blink would destroy. This is the ONLY
@@ -1676,10 +1714,15 @@ async function spawnAgent(options) {
         // there is no launcher-side probe ahead of this one. Failing here still
         // fails before the agent starts, which is what matters; a pre-dispatch
         // probe would only move the message earlier, at the cost of a round trip on
-        // every launch.
-        const msg = `agents: ${machineId()} has no tmux, so a --device run here could not survive a dropped connection.\n`
-            + `  install it:            (apt|dnf|brew) install tmux\n`
-            + `  or accept the risk:    agents run … --device ${machineId()} --raw\n`;
+        // every launch. Reached only when the wrap was wanted: the device opted in
+        // via tmux.enabled, or a followed run whose launcher had no TTY (CI,
+        // scripts) left the peer nothing to attach to, so the pane is its stdout.
+        // The config tip uses the ssh form because tmux.enabled is machine-local:
+        // setting it from the launcher throws (assertLocalTarget).
+        const msg = `agents: ${machineId()} has no tmux, so this --device run cannot get the pane it needs.\n`
+            + `  install it:              (apt|dnf|brew) install tmux\n`
+            + `  or turn the wrap off:    agents ssh ${machineId()} 'agents devices config ${machineId()} tmux.enabled off'\n`
+            + `  or accept a bare run:    agents run … --device ${machineId()} --raw\n`;
         process.stderr.write(`\x1b[31m${msg}\x1b[0m`);
         timer.end({ exitCode: 1, status: 'failed', error: 'remote interactive run has no tmux for durability' });
         return { exitCode: 1, stdout: '', stderr: msg };
@@ -1730,6 +1773,7 @@ async function spawnAgent(options) {
         writePidSessionEntry({
             pid: child.pid ?? 0,
             agent: options.agent,
+            harness: customHarnessName(options),
             sessionId: options.sessionId,
             cwd: options.cwd || process.cwd(),
             actor: resolveActor().id,
@@ -1744,6 +1788,7 @@ async function spawnAgent(options) {
                 sessionId: options.sessionId,
                 actor: resolveActor().id,
                 initiatedBy: resolveActor().kind,
+                harness: customHarnessName(options),
                 startedAtMs: Date.now(),
             });
         }

package/dist/lib/feed/feed.d.ts

@@ -76,7 +76,12 @@ export interface OpenBlock {
     source?: AttentionSource;
     /** Lifecycle state. Derived from the answer/continue markers when absent — see {@link deriveBlockState}. */
     state?: AttentionState;
-    /** Where in the source this block's generation sits — carried onto its resolution tombstone. */
+    /**
+     * Where in the source this block's generation sits — stamped at write time
+     * (`buildDeclaredBlock`, the feed-publish hook) and carried onto its resolution
+     * tombstone. Without a write-time cursor a new generation is suppressed whenever
+     * `session.lastActivityMs` is unresolvable (cloud / remote / index-lag).
+     */
     sourceCursor?: SourceCursor;
     /** Indexed launch origin, added at read time when the live session is known. */
     origin?: 'cli' | 'routine';
@@ -319,6 +324,9 @@ export interface DeclareBlockInput {
  * `costOfDelay: high` because a declared block is, by definition, an agent that
  * has already stopped making progress — that is what makes it worth interrupting
  * someone over, and what `feed --dispatch`'s urgency filter keys off.
+ *
+ * `sourceCursor` is stamped from `ts` at write time so a fresh generation is
+ * comparable even when the live session's `lastActivityMs` is unresolvable.
  */
 export declare function buildDeclaredBlock(agent: DeclaringAgent, input: DeclareBlockInput): OpenBlock;
 /** Atomic write a block record to the feed store. Clears stale lifecycle state. */
@@ -334,7 +342,7 @@ export declare function removeBlock(blockId: string, root?: string): boolean;
  * Embedded so it ships with the compiled CLI and can be installed to the
  * CLI-writable user hooks dir without a separate file in the npm tarball.
  */
-export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"idle_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef project_from_cwd(cwd):\n    \"\"\"Basename of cwd, with worktree paths resolved to their repo name.\"\"\"\n    if not cwd:\n        return None\n    norm = cwd.replace(\"\\\\\", \"/\").rstrip(\"/\")\n    if not norm:\n        return None\n    marker = \"/.agents/worktrees/\"\n    idx = norm.find(marker)\n    if idx > 0:\n        repo_path = norm[:idx]\n        base = repo_path[repo_path.rfind(\"/\") + 1:]\n        if base:\n            return base\n    base = norm[norm.rfind(\"/\") + 1:]\n    return base or None\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A declared block (`agents feed post --blocked`) is the agent explicitly\n        # saying it is stuck. Unlike a question/notification/approval block -- which\n        # tracks an in-flight harness prompt that a lifecycle event resolves -- a\n        # declared block stays open until it is actually ANSWERED. So while it is\n        # still UNANSWERED, Stop/SessionEnd/PostToolUse must never silently drop it:\n        # otherwise the needs-you record vanishes the moment the agent parks the block\n        # and its turn ends -- exactly when the owner still needs to see and answer it.\n        # Once it IS answered (an answered marker exists), it clears like any other\n        # block by falling through below -- which frees that marker too, so a later\n        # `--blocked` in the same session is not falsely locked as already-answered\n        # (recordAnswer creates the marker with O_EXCL).\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            answered = os.path.exists(os.path.join(answered_dir, f\"{block_id}.json\"))\n            if existing.get(\"kind\") == \"declared\" and not answered:\n                return\n        except Exception:\n            pass\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": datetime.now(timezone.utc).isoformat(),\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so AGI EXT can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now_iso = datetime.now(timezone.utc).isoformat()\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    project = project_from_cwd(cwd)\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if project:\n        block[\"project\"] = project\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
+export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"idle_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef project_from_cwd(cwd):\n    \"\"\"Basename of cwd, with worktree paths resolved to their repo name.\"\"\"\n    if not cwd:\n        return None\n    norm = cwd.replace(\"\\\\\", \"/\").rstrip(\"/\")\n    if not norm:\n        return None\n    marker = \"/.agents/worktrees/\"\n    idx = norm.find(marker)\n    if idx > 0:\n        repo_path = norm[:idx]\n        base = repo_path[repo_path.rfind(\"/\") + 1:]\n        if base:\n            return base\n    base = norm[norm.rfind(\"/\") + 1:]\n    return base or None\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A declared block (`agents feed post --blocked`) is the agent explicitly\n        # saying it is stuck. Unlike a question/notification/approval block -- which\n        # tracks an in-flight harness prompt that a lifecycle event resolves -- a\n        # declared block stays open until it is actually ANSWERED. So while it is\n        # still UNANSWERED, Stop/SessionEnd/PostToolUse must never silently drop it:\n        # otherwise the needs-you record vanishes the moment the agent parks the block\n        # and its turn ends -- exactly when the owner still needs to see and answer it.\n        # Once it IS answered (an answered marker exists), it clears like any other\n        # block by falling through below -- which frees that marker too, so a later\n        # `--blocked` in the same session is not falsely locked as already-answered\n        # (recordAnswer creates the marker with O_EXCL).\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            answered = os.path.exists(os.path.join(answered_dir, f\"{block_id}.json\"))\n            if existing.get(\"kind\") == \"declared\" and not answered:\n                return\n        except Exception:\n            pass\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": datetime.now(timezone.utc).isoformat(),\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so AGI EXT can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now = datetime.now(timezone.utc)\n    now_iso = now.isoformat()\n    now_ms = int(now.timestamp() * 1000)\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    project = project_from_cwd(cwd)\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        # Write-time cursor so a new generation is not suppressed when\n        # session.lastActivityMs is unresolvable (cloud / remote / index-lag).\n        \"sourceCursor\": {\"lastActivityMs\": now_ms},\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if project:\n        block[\"project\"] = project\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
 /** Manifest entry for the feed-publish hook, matching the ManifestHook shape. */
 export declare const FEED_PUBLISH_HOOK_MANIFEST: {
     name: string;

package/dist/lib/feed/feed.js

@@ -374,6 +374,9 @@ export function clearBlockLifecycle(blockId, root) {
  * `costOfDelay: high` because a declared block is, by definition, an agent that
  * has already stopped making progress — that is what makes it worth interrupting
  * someone over, and what `feed --dispatch`'s urgency filter keys off.
+ *
+ * `sourceCursor` is stamped from `ts` at write time so a fresh generation is
+ * comparable even when the live session's `lastActivityMs` is unresolvable.
  */
 export function buildDeclaredBlock(agent, input) {
     const text = input.text.trim().replace(/\s+/g, ' ');
@@ -399,6 +402,9 @@ export function buildDeclaredBlock(agent, input) {
         generation: ts,
         source: 'declared',
         state: 'open',
+        // Write-time cursor so a new generation is not suppressed when
+        // session.lastActivityMs is unresolvable (cloud / remote / index-lag).
+        sourceCursor: { lastActivityMs: Date.parse(ts) },
         kind: 'declared',
         questions: [{ text, header: 'Needs you', ...(options.length ? { options } : {}) }],
         blockClass: input.safeDefault ? 'approval' : 'decision',
@@ -769,7 +775,9 @@ def main():
         os.environ.get("AGENTS_MAILBOX_DIR", "").rstrip("/")
     ) or session_id
 
-    now_iso = datetime.now(timezone.utc).isoformat()
+    now = datetime.now(timezone.utc)
+    now_iso = now.isoformat()
+    now_ms = int(now.timestamp() * 1000)
     stats_path = os.path.join(asks_dir, f"{safe_session_id}.json")
     stats = read_json(stats_path) or {}
     recent = stats.get("recentAskTimestamps") if isinstance(stats, dict) else []
@@ -803,6 +811,9 @@ def main():
         "host": host,
         "runtime": runtime,
         "ts": now_iso,
+        # Write-time cursor so a new generation is not suppressed when
+        # session.lastActivityMs is unresolvable (cloud / remote / index-lag).
+        "sourceCursor": {"lastActivityMs": now_ms},
         "questions": normalized_questions,
         "kind": kind,
     }