@phnx-labs/agents-cli 1.22.53 → 1.22.55

package/dist/lib/monitors/state.js

@@ -13,6 +13,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { createHash } from 'crypto';
+import { spawnSync } from 'child_process';
 import { getMonitorsHistoryDir, ensureAgentsDir } from '../state.js';
 import { safeJoin } from '../paths.js';
 import { readRunMeta } from '../scheduling/routines.js';
@@ -199,11 +200,50 @@ export function listFires(name) {
     }
     return fires;
 }
-/** Run statuses that read as a healthy fire: still in flight, or settled clean. */
-const OK_RUN_STATUSES = new Set(['running', 'completed']);
+/** Cap a display-time postcondition so `monitors runs` cannot hang on a stuck command. */
+const POSTCONDITION_TIMEOUT_MS = 15_000;
+/**
+ * Run a fire's postcondition command. Exit 0 means the intended effect happened;
+ * anything else (nonzero, timeout, spawn error, empty command) is "no effect".
+ * Real `/bin/sh -c` (or `cmd /c`) — the same seam command sources use.
+ */
+export function evaluatePostcondition(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return { ok: false, error: 'postcondition not met: empty command' };
+    const [bin, args] = process.platform === 'win32'
+        ? ['cmd', ['/c', trimmed]]
+        : ['/bin/sh', ['-c', trimmed]];
+    const result = spawnSync(bin, args, {
+        encoding: 'utf-8',
+        timeout: POSTCONDITION_TIMEOUT_MS,
+        maxBuffer: 8 * 1024 * 1024,
+        env: { ...process.env, CLICOLOR: '0', NO_COLOR: '1', FORCE_COLOR: '0' },
+    });
+    if (result.status === 0)
+        return { ok: true };
+    if (result.error) {
+        const err = result.error;
+        if (err.code === 'ETIMEDOUT') {
+            return { ok: false, error: `postcondition not met: timed out after ${POSTCONDITION_TIMEOUT_MS / 1000}s` };
+        }
+        return { ok: false, error: `postcondition not met: ${err.message}` };
+    }
+    const detail = (result.stderr || result.stdout || '').trim().replace(/\s+/g, ' ').slice(0, 200);
+    const exit = result.status ?? 'unknown';
+    return { ok: false, error: `postcondition not met${detail ? `: ${detail}` : ` (exit ${exit})`}` };
+}
+/** Persist the postcondition result onto the existing fire record. Frozen `ok` is left as the fire-time snapshot. */
+function persistPostcondition(fire, result) {
+    writeFireRecord(fire, {
+        postconditionOk: result.ok,
+        ...(result.error ? { postconditionError: result.error } : {}),
+    });
+}
 /**
  * Reconcile a fire's frozen `ok` against its dispatched run's REAL, current
- * status — the render-time fix for RUSH-2690.
+ * status — the render-time fix for RUSH-2690 — and, when the run has settled
+ * `completed`, against a declared postcondition (PHNX-2842).
  *
  * `writeFireRecord` (this module) persists `ok` once, at fire time, from
  * `dispatchAction`'s synchronous return. For a `run`/`routine` action that
@@ -219,6 +259,14 @@ const OK_RUN_STATUSES = new Set(['running', 'completed']);
  * A fire with no `runId` (a `notify`/`webhook-out` action, or a `run`/`routine`
  * dispatch that never got a runId at all) has nothing to reconcile against —
  * its frozen `ok` is the only signal and is returned as-is.
+ *
+ * `completed` is not success by itself. An agent that exits 0 without doing
+ * the job (merge-on-green that never merged) used to record `ok` because
+ * `OK_RUN_STATUSES` treated `completed` as healthy. When the fire carries a
+ * `postcondition` command, this function runs it once the run has settled and
+ * returns `ok: false, effect: 'none'` when it fails — distinguishing "ran but
+ * no effect" from a working fire. The result is persisted on the fire record
+ * so later listings do not re-exec the command.
  */
 export function resolveFireOutcome(jobName, fire) {
     if (!fire.runId)
@@ -226,5 +274,32 @@ export function resolveFireOutcome(jobName, fire) {
     const run = readRunMeta(jobName, fire.runId);
     if (!run)
         return { ok: fire.ok !== false };
-    return { ok: OK_RUN_STATUSES.has(run.status), runStatus: run.status };
+    if (run.status === 'running')
+        return { ok: true, runStatus: run.status };
+    if (run.status !== 'completed')
+        return { ok: false, runStatus: run.status };
+    if (!fire.postcondition)
+        return { ok: true, runStatus: 'completed' };
+    if (fire.postconditionOk === true) {
+        return { ok: true, runStatus: 'completed', effect: 'met' };
+    }
+    if (fire.postconditionOk === false) {
+        return {
+            ok: false,
+            runStatus: 'completed',
+            effect: 'none',
+            ...(fire.postconditionError ? { error: fire.postconditionError } : {}),
+        };
+    }
+    const result = evaluatePostcondition(fire.postcondition);
+    persistPostcondition(fire, result);
+    fire.postconditionOk = result.ok;
+    if (result.error)
+        fire.postconditionError = result.error;
+    return {
+        ok: result.ok,
+        runStatus: 'completed',
+        effect: result.ok ? 'met' : 'none',
+        ...(result.error ? { error: result.error } : {}),
+    };
 }

package/dist/lib/permissions-registry.d.ts

@@ -7,6 +7,8 @@ export declare const KIRO_CAPABILITY_BY_TOOL: Record<string, string | undefined>
 export declare const CANONICAL_TO_OPENCLAW_TOOL: Record<string, string>;
 /** Canonical tool -> Antigravity's action namespace. */
 export declare const ANTIGRAVITY_ACTION_BY_TOOL: Record<string, string | undefined>;
+/** Filename Codex stores generated deny rules under `.codex/rules/`. */
+export declare const CODEX_RULES_FILENAME = "agents-deny.rules";
 /**
  * Strip JSON comments for JSONC parsing, only OUTSIDE string literals.
  *

package/dist/lib/permissions-registry.js

@@ -97,6 +97,8 @@ const CANONICAL_BY_GROK_TOOL = invertFirstWins(GROK_TOOL_BY_CANONICAL);
 const CANONICAL_BY_KIRO_CAPABILITY = invertFirstWins(KIRO_CAPABILITY_BY_TOOL);
 const CANONICAL_BY_OPENCLAW_TOOL = invertFirstWins(CANONICAL_TO_OPENCLAW_TOOL);
 const CANONICAL_BY_ANTIGRAVITY_ACTION = invertFirstWins(ANTIGRAVITY_ACTION_BY_TOOL);
+/** Filename Codex stores generated deny rules under `.codex/rules/`. */
+export const CODEX_RULES_FILENAME = 'agents-deny.rules';
 /** Canonical TitleCase spelling for a lowercased canonical tool name. */
 const CANONICAL_TOOL_CASE = {
     bash: 'Bash',
@@ -248,6 +250,106 @@ function existingOr(preferred, alternate) {
 function stringList(value) {
     return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
 }
+/**
+ * Invert `convertDenyToCodexRules` (permissions.ts). The writer emits
+ * `prefix_rule(pattern=["git", "reset"], decision="forbidden")` from a
+ * canonical `Bash(git reset:*)`. Prefix-match is the native form of `:*`,
+ * so the reverse always reconstructs `Bash(<parts>:*)`.
+ *
+ * Only `decision = "forbidden"` is a deny; anything else is skipped rather
+ * than guessed into an allow (Codex grants come from sandbox_mode).
+ */
+function convertCodexRulesToDeny(content) {
+    const deny = [];
+    const marker = 'prefix_rule';
+    let searchFrom = 0;
+    while (searchFrom < content.length) {
+        const start = content.indexOf(marker, searchFrom);
+        if (start < 0)
+            break;
+        const open = content.indexOf('(', start + marker.length);
+        if (open < 0)
+            break;
+        const bodyEnd = findMatchingCloser(content, open, '(', ')');
+        if (bodyEnd < 0) {
+            searchFrom = open + 1;
+            continue;
+        }
+        const body = content.slice(open + 1, bodyEnd);
+        searchFrom = bodyEnd + 1;
+        const decision = body.match(/decision\s*=\s*"((?:\\.|[^"\\])*)"/);
+        if (!decision || decision[1] !== 'forbidden')
+            continue;
+        const patternKw = body.search(/pattern\s*=/);
+        if (patternKw < 0)
+            continue;
+        const arrayStart = body.indexOf('[', patternKw);
+        if (arrayStart < 0)
+            continue;
+        const arrayEnd = findMatchingCloser(body, arrayStart, '[', ']');
+        if (arrayEnd < 0)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(body.slice(arrayStart, arrayEnd + 1));
+        }
+        catch {
+            continue;
+        }
+        if (!Array.isArray(parsed))
+            continue;
+        const parts = parsed.filter((p) => typeof p === 'string' && p.length > 0);
+        if (parts.length === 0)
+            continue;
+        deny.push(`Bash(${parts.join(' ')}:*)`);
+    }
+    return deny;
+}
+/** Index of the closer matching `source[openIdx]`, skipping quoted strings. */
+function findMatchingCloser(source, openIdx, open, close) {
+    let depth = 0;
+    let inString = false;
+    let escape = false;
+    for (let i = openIdx; i < source.length; i++) {
+        const c = source[i];
+        if (inString) {
+            if (escape) {
+                escape = false;
+                continue;
+            }
+            if (c === '\\') {
+                escape = true;
+                continue;
+            }
+            if (c === '"')
+                inString = false;
+            continue;
+        }
+        if (c === '"') {
+            inString = true;
+            continue;
+        }
+        if (c === open)
+            depth++;
+        else if (c === close) {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+function readCodexDenyRules(configPath) {
+    const rulesPath = path.join(path.dirname(configPath), 'rules', CODEX_RULES_FILENAME);
+    if (!fs.existsSync(rulesPath))
+        return [];
+    try {
+        return convertCodexRulesToDeny(fs.readFileSync(rulesPath, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Single source of truth for where each allowlist-capable agent stores
  * permissions and how to read them back. Keys MUST equal
@@ -309,24 +411,24 @@ export const PERMISSION_TARGETS = {
     codex: {
         home: (h) => path.join(h, '.codex', 'config.toml'),
         project: (cwd) => path.join(cwd, '.codex', 'config.toml'),
-        lossyBecause: 'Codex has no rule list — its sandbox mode is widened into representative blanket grants',
+        lossyBecause: 'sandbox mode widens into representative blanket grants; deny round-trips from agents-deny.rules as Bash(prefix:*)',
         toCanonical(configPath) {
             const config = readToml(configPath);
-            if (!config)
-                return null;
             const allow = [];
-            const sandboxMode = config.sandbox_mode;
-            if (config.approval_policy === 'never' || sandboxMode === 'danger-full-access') {
-                allow.push('Bash(*)', 'Read(**)', 'Write(**)', 'Edit(**)');
-            }
-            else if (sandboxMode === 'workspace-write') {
-                allow.push('Bash(*)', 'Read(**)');
-            }
-            const sw = config.sandbox_workspace_write;
-            if (sw && typeof sw === 'object' && !Array.isArray(sw) && sw.network_access) {
-                allow.push('WebSearch(*)', 'WebFetch(*)');
+            if (config) {
+                const sandboxMode = config.sandbox_mode;
+                if (config.approval_policy === 'never' || sandboxMode === 'danger-full-access') {
+                    allow.push('Bash(*)', 'Read(**)', 'Write(**)', 'Edit(**)');
+                }
+                else if (sandboxMode === 'workspace-write') {
+                    allow.push('Bash(*)', 'Read(**)');
+                }
+                const sw = config.sandbox_workspace_write;
+                if (sw && typeof sw === 'object' && !Array.isArray(sw) && sw.network_access) {
+                    allow.push('WebSearch(*)', 'WebFetch(*)');
+                }
             }
-            return permissionSet(allow, []);
+            return permissionSet(allow, readCodexDenyRules(configPath));
         },
     },
     cursor: {

package/dist/lib/permissions.d.ts

@@ -1,6 +1,6 @@
 import type { AgentId, PermissionSet, InstalledPermission, ClaudePermissions, CursorPermissions, OpenCodePermissions, CodexPermissions } from './types.js';
-/** Filename used for Codex Starlark deny-rules generated from permission groups. */
-export declare const CODEX_RULES_FILENAME = "agents-deny.rules";
+import { CODEX_RULES_FILENAME } from './permissions-registry.js';
+export { CODEX_RULES_FILENAME };
 export type ParsedRules = PermissionSet;
 export declare const COMPUTER_PERMISSION_RULE_PREFIX = "Computer";
 export declare const COMPUTER_APP_GATED_VERBS: readonly ["screenshot", "describe", "get-text", "launch", "raise", "click", "right-click", "type", "type-text", "key", "drag", "scroll", "ax-action", "focus", "wait"];
@@ -13,6 +13,9 @@ export declare function containsBroadGrants(rules: ParsedRules): {
 /**
  * Convert canonical deny rules to Codex Starlark .rules format.
  * E.g. "Bash(git reset:*)" -> prefix_rule(pattern=["git", "reset"], decision="forbidden")
+ *
+ * Inverse: `toCanonical` for `PERMISSION_TARGETS.codex` reads
+ * `.codex/rules/agents-deny.rules` back into `Bash(<parts>:*)`.
  */
 export declare function convertDenyToCodexRules(deny: string[]): string | null;
 /**
@@ -344,4 +347,3 @@ export declare function saveDefaultPermissionSet(set: PermissionSet): {
     success: boolean;
     error?: string;
 };
-export {};

package/dist/lib/permissions.js

@@ -20,16 +20,9 @@ import { updateGeminiSettings } from './gemini-settings.js';
 // The canonical<->native tool vocabularies live in the registry, which also owns
 // the reverse projections — so the serializers below and the readers there can
 // never disagree about what `fs_read` or `developer__shell` means.
-import { ANTIGRAVITY_ACTION_BY_TOOL, CANONICAL_TO_OPENCLAW_TOOL, stripJsonComments, GROK_TOOL_BY_CANONICAL, KIRO_CAPABILITY_BY_TOOL, PERMISSION_TARGETS, readCanonicalPermissions, } from './permissions-registry.js';
+import { ANTIGRAVITY_ACTION_BY_TOOL, CANONICAL_TO_OPENCLAW_TOOL, CODEX_RULES_FILENAME, stripJsonComments, GROK_TOOL_BY_CANONICAL, KIRO_CAPABILITY_BY_TOOL, PERMISSION_TARGETS, readCanonicalPermissions, } from './permissions-registry.js';
+export { CODEX_RULES_FILENAME };
 const HOME = os.homedir();
-// PERMISSIONS_CAPABLE_AGENTS removed — use `capableAgents('allowlist')`
-// from lib/capabilities.ts. The capability matrix on AgentConfig is the
-// single source of truth. (Per-agent native format details:
-//   antigravity → ~/.gemini/antigravity-cli/settings.json `permissions.{allow,deny}`
-//   grok        → ~/.grok/config.toml `[permission].rules`
-// the writer in `applyPermissionsToVersion` handles the format dispatch.)
-/** Filename used for Codex Starlark deny-rules generated from permission groups. */
-export const CODEX_RULES_FILENAME = 'agents-deny.rules';
 export const COMPUTER_PERMISSION_RULE_PREFIX = 'Computer';
 export const COMPUTER_APP_GATED_VERBS = [
     'screenshot',
@@ -103,6 +96,9 @@ export function containsBroadGrants(rules) {
 /**
  * Convert canonical deny rules to Codex Starlark .rules format.
  * E.g. "Bash(git reset:*)" -> prefix_rule(pattern=["git", "reset"], decision="forbidden")
+ *
+ * Inverse: `toCanonical` for `PERMISSION_TARGETS.codex` reads
+ * `.codex/rules/agents-deny.rules` back into `Bash(<parts>:*)`.
  */
 export function convertDenyToCodexRules(deny) {
     const rules = [];
@@ -122,6 +118,24 @@ export function convertDenyToCodexRules(deny) {
         return null;
     return `# Auto-generated by agents-cli from deny permission groups.\n# Do not edit manually — re-run "agents use" to regenerate.\n\n${rules.join('\n\n')}\n`;
 }
+/**
+ * Write `.codex/rules/agents-deny.rules` to match `deny`, or delete it when
+ * the current set has nothing to forbid. The reader (PHNX-2703) now surfaces
+ * this file, so a later apply with an empty deny must not leave a stale
+ * forbid behind — `agents permissions list codex` would keep reporting it.
+ */
+function syncCodexDenyRules(configDir, deny) {
+    const rulesPath = path.join(configDir, 'rules', CODEX_RULES_FILENAME);
+    const rulesContent = deny && deny.length > 0 ? convertDenyToCodexRules(deny) : null;
+    if (rulesContent) {
+        fs.mkdirSync(path.dirname(rulesPath), { recursive: true });
+        fs.writeFileSync(rulesPath, rulesContent, 'utf-8');
+        return;
+    }
+    if (fs.existsSync(rulesPath)) {
+        fs.unlinkSync(rulesPath);
+    }
+}
 /**
  * Ensure central permissions directory exists.
  */
@@ -1274,15 +1288,7 @@ function applyCodexPermissions(set, scope = 'user', cwd, merge = true) {
                 : newPermissions.sandbox_workspace_write;
         }
         fs.writeFileSync(configPath, TOML.stringify(config), 'utf-8');
-        // Write .rules file for deny permissions
-        if (set.deny && set.deny.length > 0) {
-            const rulesContent = convertDenyToCodexRules(set.deny);
-            if (rulesContent) {
-                const rulesDir = path.join(configDir, 'rules');
-                fs.mkdirSync(rulesDir, { recursive: true });
-                fs.writeFileSync(path.join(rulesDir, CODEX_RULES_FILENAME), rulesContent, 'utf-8');
-            }
-        }
+        syncCodexDenyRules(configDir, set.deny);
         return { success: true };
     }
     catch (err) {
@@ -1393,15 +1399,7 @@ export function applyPermissionsToVersion(agentId, set, versionHome, merge = tru
                     : newPermissions.sandbox_workspace_write;
             }
             fs.writeFileSync(configPath, TOML.stringify(config), 'utf-8');
-            // Write .rules file for deny permissions
-            if (set.deny && set.deny.length > 0) {
-                const rulesContent = convertDenyToCodexRules(set.deny);
-                if (rulesContent) {
-                    const rulesDir = path.join(configDir, 'rules');
-                    fs.mkdirSync(rulesDir, { recursive: true });
-                    fs.writeFileSync(path.join(rulesDir, CODEX_RULES_FILENAME), rulesContent, 'utf-8');
-                }
-            }
+            syncCodexDenyRules(configDir, set.deny);
             return { success: true };
         }
         if (agentId === 'antigravity') {

package/dist/lib/profiles.d.ts

@@ -248,13 +248,14 @@ export interface ResolvedProfileRun {
      */
     tierNote?: string;
     /**
-     * Set when `requestedModel` was a tier token AND this profile resolved it
-     * against its own `models:` map. Callers that forward a `--model` value
-     * downstream (e.g. as `ExecOptions.model`) should substitute this in place
-     * of the original tier token — exec.ts's native tier block only knows how
-     * to resolve a tier against the HOST agent's own catalog, which is the
-     * wrong catalog for a profile's own harness identity. Undefined both when
-     * no tier was requested and when tier resolution degraded (see `tierNote`).
+     * Concrete model id callers should forward as `ExecOptions.model`. Set when:
+     * - `requestedModel` was a cost-tier token resolved against this profile's
+     *   `models:` map, OR
+     * - no `--model` was requested and this is an OpenCode host whose pin lives
+     *   in `OPENCODE_MODEL` (OpenCode does not read that env var, so the pin
+     *   has to become `--model` on the argv).
+     * Undefined when the caller already passed a concrete `--model`, or when
+     * tier resolution degraded (see `tierNote`).
      */
     resolvedModel?: string;
 }

package/dist/lib/profiles.js

@@ -164,6 +164,7 @@ const MODEL_ENV_KEYS = [
     'OPENAI_MODEL',
     'GEMINI_MODEL',
     'GROK_MODEL',
+    'OPENCODE_MODEL',
 ];
 /** Return the configured model env value for display. */
 export function profileModelLabel(profile) {
@@ -583,6 +584,17 @@ export function resolveProfileForRun(name, requestedModel) {
         // the raw tier token downstream and handles the message -- this function
         // doesn't compete with that canonical fallback for the no-opt-in case.
     }
+    // OpenCode does not honor OPENCODE_MODEL (unlike claude/codex/gemini/grok,
+    // whose host CLIs read their MODEL env var). Copy the pin into resolvedModel
+    // so callers set ExecOptions.model and buildExecCommand emits `--model`.
+    // An explicit `--model` (including a cost-tier token the caller may still
+    // discard) wins and is left alone.
+    if (resolved.resolvedModel === undefined && !requestedModel && profile.host.agent === 'opencode') {
+        const envKey = profileModelEnvKey(profile) ?? modelEnvKeyForHost('opencode');
+        const pinned = env[envKey];
+        if (pinned)
+            resolved.resolvedModel = pinned;
+    }
     return resolved;
 }
 /**

package/dist/lib/project-key.d.ts

@@ -14,6 +14,15 @@
  * for local ones; {@link resolveProjectKey} adds the filesystem repo-root walk
  * for paths this machine can see.
  */
+/**
+ * Convert an absolute cwd to Claude Code's own project-folder name under
+ * `~/.claude/projects/` (slashes and dots become dashes) — the encoding
+ * Claude Code itself performs to name each project's session-transcript and
+ * native-memory directory. Pure, no filesystem: session discovery and
+ * native-memory sync both derive from this so they agree on one directory
+ * for a given cwd.
+ */
+export declare function claudeProjectDirName(cwd: string): string;
 /**
  * Resolve a stable project key from a working directory, or `undefined` when
  * the path carries nothing usable (empty, `/`, whitespace).

package/dist/lib/project-key.js

@@ -18,6 +18,17 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 const WORKTREE_SEGMENT = '/.agents/worktrees/';
+/**
+ * Convert an absolute cwd to Claude Code's own project-folder name under
+ * `~/.claude/projects/` (slashes and dots become dashes) — the encoding
+ * Claude Code itself performs to name each project's session-transcript and
+ * native-memory directory. Pure, no filesystem: session discovery and
+ * native-memory sync both derive from this so they agree on one directory
+ * for a given cwd.
+ */
+export function claudeProjectDirName(cwd) {
+    return cwd.replace(/[/.]/g, '-');
+}
 /**
  * Resolve a stable project key from a working directory, or `undefined` when
  * the path carries nothing usable (empty, `/`, whitespace).

package/dist/lib/scheduling/routines.d.ts

@@ -16,6 +16,53 @@ export declare function nextRunLabel(job: JobConfig, scheduler: JobScheduler, no
 export declare function localLatestRun(job: JobConfig): RunMeta | null;
 export declare function listJobsForDisplay(cwd?: string): JobConfig[];
 export declare function buildRoutineListJson(): Record<string, unknown>[];
+/** One routine's live scheduler-status row for `agents routines status --json`. */
+export interface RoutineStatusRow {
+    name: string;
+    /** The single device this routine is pinned to fire on, or null when unpinned. */
+    ownerDevice: string | null;
+    /** True when `devices:` names more than one device — no single owner (doctor flags it). */
+    ambiguousDevicePin: boolean;
+    /** Every device this routine is enabled on. */
+    enabledDevices: string[];
+    /** Whether THIS device is the one that fires the routine. */
+    runsHere: boolean;
+    enabled: boolean;
+    overdue: boolean;
+    nextRun: string | null;
+    /** Terminal status of the last local fire: completed/failed/timeout/missed/blocked/skipped/running, or null if it never ran here. */
+    lastStatus: RunMeta['status'] | null;
+    /** The last fire's failure reason, when it did not complete cleanly. Named to match `list --json`'s `failureReason`. */
+    failureReason: string | null;
+    lastRunStartedAt: string | null;
+    lastRunCompletedAt: string | null;
+    /** Present only while a run is genuinely in flight on THIS device (a live local child or a host-placed run) — never a provisional pre-spawn claim. */
+    inFlight: {
+        runId: string;
+        pid: number | null;
+        startedAt: string;
+        triggerKind: RunMeta['triggerKind'] | null;
+    } | null;
+}
+/**
+ * The per-routine rows behind `agents routines status --json`. Distinct from
+ * {@link buildRoutineListJson}: this is the scheduler-truth surface the daemon
+ * owns — per routine it names the single owner device, the last fire's outcome
+ * and error, and any in-flight spawn — the fields an operator (or the menu bar /
+ * ext) needs to answer "did this routine fire, and is one running right now?"
+ * that the definition-shaped `list --json` does not carry (PHNX-3215).
+ *
+ * `monitorRunningJobs()` runs first to reap runs whose process has exited, then
+ * `inFlight` is gated on {@link isRunGenuinelyInFlight} — NOT on `status ===
+ * 'running'` alone, because a provisional pre-spawn claim is `running` with a
+ * null pid that the reaper does not touch (RUSH-2640).
+ *
+ * The routine set is the schedulable one ({@link listJobs}, the same
+ * `getDaemonStatus`/`routines status` counts), not the display set
+ * {@link buildRoutineListJson} uses — a scheduler-status surface names what the
+ * daemon can actually fire, not discoverable-but-unmaterialised project routines.
+ */
+export declare function buildRoutineStatusRows(): RoutineStatusRow[];
 /** Tool/site/directory allow-list for sandboxed job execution. */
 export interface JobAllowConfig {
     tools?: string[];

package/dist/lib/scheduling/routines.js

@@ -26,7 +26,7 @@ import { enabledRoutineNames, devicesWithRoutineEnabled, replaceEnabledRoutines,
 import { humanizeCron, humanizeNextRun } from '../routines-format.js';
 import { discoverProjectRoutines } from '../routines-project.js';
 import { listProjectDefs } from '../projects.js';
-import { monitorRunningJobs } from '../daemon/runner.js';
+import { monitorRunningJobs, isRunGenuinelyInFlight } from '../daemon/runner.js';
 import { JobScheduler } from '../scheduler.js';
 import { detectOverdueJobs } from '../overdue.js';
 export function fireConditionLabel(job) {
@@ -142,6 +142,75 @@ export function buildRoutineListJson() {
         scheduler.stopAll();
     }
 }
+/**
+ * The per-routine rows behind `agents routines status --json`. Distinct from
+ * {@link buildRoutineListJson}: this is the scheduler-truth surface the daemon
+ * owns — per routine it names the single owner device, the last fire's outcome
+ * and error, and any in-flight spawn — the fields an operator (or the menu bar /
+ * ext) needs to answer "did this routine fire, and is one running right now?"
+ * that the definition-shaped `list --json` does not carry (PHNX-3215).
+ *
+ * `monitorRunningJobs()` runs first to reap runs whose process has exited, then
+ * `inFlight` is gated on {@link isRunGenuinelyInFlight} — NOT on `status ===
+ * 'running'` alone, because a provisional pre-spawn claim is `running` with a
+ * null pid that the reaper does not touch (RUSH-2640).
+ *
+ * The routine set is the schedulable one ({@link listJobs}, the same
+ * `getDaemonStatus`/`routines status` counts), not the display set
+ * {@link buildRoutineListJson} uses — a scheduler-status surface names what the
+ * daemon can actually fire, not discoverable-but-unmaterialised project routines.
+ */
+export function buildRoutineStatusRows() {
+    try {
+        monitorRunningJobs();
+    }
+    catch { /* best-effort orphan reap */ }
+    const jobs = listJobs();
+    if (jobs.length === 0)
+        return [];
+    const scheduler = new JobScheduler(async () => { });
+    scheduler.loadAll();
+    try {
+        const overdueSet = new Set();
+        try {
+            for (const job of detectOverdueJobs())
+                overdueSet.add(job.name);
+        }
+        catch {
+            // Best-effort indicator; never block status on detection errors.
+        }
+        const now = new Date();
+        return jobs.map((job) => {
+            const latestRun = localLatestRun(job);
+            const inFlight = latestRun && isRunGenuinelyInFlight(latestRun)
+                ? {
+                    runId: latestRun.runId,
+                    pid: latestRun.pid,
+                    startedAt: latestRun.startedAt,
+                    triggerKind: latestRun.triggerKind ?? null,
+                }
+                : null;
+            return {
+                name: job.name,
+                ownerDevice: routineOwnerDevice(job),
+                ambiguousDevicePin: hasAmbiguousDevicePin(job),
+                enabledDevices: devicesWithRoutineEnabled(job.name),
+                runsHere: jobRunsOnThisDevice(job),
+                enabled: job.enabled,
+                overdue: overdueSet.has(job.name),
+                nextRun: nextRunForDisplay(job, scheduler)?.toISOString() ?? null,
+                lastStatus: latestRun?.status ?? null,
+                failureReason: latestRun?.errorMessage ?? null,
+                lastRunStartedAt: latestRun?.startedAt ?? null,
+                lastRunCompletedAt: latestRun?.completedAt ?? null,
+                inFlight,
+            };
+        });
+    }
+    finally {
+        scheduler.stopAll();
+    }
+}
 export const HOST_STRATEGIES = ['local', 'host', 'fleet', 'cloud'];
 /** Canonical set of accepted GitHub trigger events — single source for validation. */
 export const GITHUB_TRIGGER_EVENTS = [

package/dist/lib/secrets/bundles.d.ts

@@ -101,6 +101,41 @@ export declare const ENV_KEY_PATTERN: RegExp;
 export declare const BUNDLE_KEY_PATTERN: RegExp;
 export declare const BUNDLE_META_PREFIX = "agents-cli.bundles.";
 export declare const RESERVED_ENV_NAMES: Set<string>;
+/**
+ * The reserved FILE-BACKED bundle that holds long-lived Claude setup-tokens.
+ * Usage/probe reads authenticate with these instead of the ACL-bound login item,
+ * so they never pop Touch ID and they can cross the fleet. A keychain- or
+ * vault-backed bundle of this name is a misconfiguration: the consumer used to
+ * return null (SEC-GAP-3) and silently fall through to Touch ID.
+ */
+export declare const AUTH_BUNDLE_NAME = "auth";
+export declare const AUTH_BUNDLE_BACKEND: SecretsBackend;
+export declare const RESERVED_BUNDLE_NAMES: Set<string>;
+export declare function isReservedBundleName(name: string): boolean;
+/** Thrown when a reserved bundle is written or resolved on the wrong backend. */
+export declare class ReservedBundleWrongBackendError extends Error {
+    readonly bundle: string;
+    readonly backend: SecretsBackend;
+    constructor(bundle: string, backend: SecretsBackend);
+}
+/** Fail loud when `name` is reserved and `backend` is not the required one. */
+export declare function assertReservedBundleBackend(name: string, backend: SecretsBackend): void;
+/**
+ * Presence + backend of the reserved `auth` bundle. `ok` is true when the
+ * bundle is absent (nothing to fix) or present and file-backed.
+ */
+export declare function inspectReservedAuthBundle(): {
+    exists: boolean;
+    backend: SecretsBackend | null;
+    ok: boolean;
+};
+/**
+ * After a file-backed import, actually decrypt the keys and fail if any are
+ * unreadable. Import used to print "Imported N key(s)" from the write tally
+ * alone — ciphertext sealed under a forwarded AGENTS_SECRETS_PASSPHRASE that
+ * the destination daemon does not hold still counted as success.
+ */
+export declare function assertFileBundleDecryptable(name: string, keys: string[]): void;
 export declare function bundleToEnvPrefix(name: string): string;
 export declare function isReservedEnvName(key: string): boolean;
 export declare function bundleKeyToEnvKey(key: string): string;