@phnx-labs/agents-cli 1.22.6 → 1.22.7

package/dist/lib/exec.js

@@ -480,6 +480,25 @@ export const AGENT_COMMANDS = {
         jsonFlags: ['--format', 'json'],
         modelFlag: '--model',
     },
+    // Oh My Pi (`omp`). Headless is the positional MESSAGES arg + `-p/--print`.
+    // Approval modes map to omp's `--approval-mode`: always-ask (read-only tools
+    // auto-approved, writes gated -> our `plan`), write (read + workspace writes
+    // auto-approved -> `edit`), yolo (all tiers auto-approved -> `skip`). JSON is
+    // omp's `--mode json` event stream. `--model` fuzzy-matches a provider/model
+    // selector. Native resume is `-r/--resume <id-prefix>`.
+    pi: {
+        base: ['omp'],
+        promptFlag: 'positional',
+        modeFlags: {
+            plan: ['--approval-mode', 'always-ask'],
+            edit: ['--approval-mode', 'write'],
+            skip: ['--approval-mode', 'yolo'],
+        },
+        jsonFlags: ['--mode', 'json'],
+        modelFlag: '--model',
+        printFlags: ['-p'],
+        resume: { flag: '--resume' },
+    },
     openclaw: {
         base: ['openclaw'],
         promptFlag: 'positional',
@@ -1038,6 +1057,30 @@ export async function execShimPassthrough(agent, rawArgs, cwd, pinnedVersion) {
         });
     });
 }
+/**
+ * Whether a dead pane's failure should be recapped to stderr (RUSH-2185 / EXEC-23a).
+ *
+ * For headless runs only a nonzero exit is a failure worth surfacing — a
+ * clean 0 means the agent finished the task before we could attach.
+ * For interactive runs ANY exit (including 0) is a failure: an instant clean
+ * exit means the harness has no bare REPL and the user would see only a mute
+ * `[detached]` with no explanation.
+ */
+export function shouldRecapDeadPane(status, interactive) {
+    return (status ?? 0) !== 0 || interactive;
+}
+/**
+ * True only when a `display-message #{pane_dead}` tmux query explicitly returned
+ * "0" (pane alive). Used to distinguish "pane alive" from "query failed" in
+ * situations where `paneExitStatus` conservatively returns `{dead: false}` for
+ * both (RUSH-2185 / EXEC-23a / F3).
+ *
+ * @param code   The exit code of the `tmux display-message` command.
+ * @param stdout Its stdout (expected to be "0" when the pane is alive).
+ */
+export function isPaneKnownAliveFromQueryResult(code, stdout) {
+    return code === 0 && stdout.trim() === '0';
+}
 /**
  * Decide whether to run an interactive agent INSIDE a detached tmux session on
  * the shared socket (then attach the current TTY) instead of a bare spawn.
@@ -1225,29 +1268,51 @@ async function runInTmux(options, executable, args) {
     // already-dead pane — surface its output + status directly and tear down.
     const before = pane ? await paneExitStatus(pane, socket) : { dead: false };
     if (before.dead) {
-        // Only recap a FAILURE. A clean (0) exit before we attached is a successful
-        // quick run, not a crash — a red banner there would be spurious (mirrors the
-        // post-attach guard below).
-        if ((before.status ?? 0) !== 0) {
+        // F2 (RUSH-2185 / EXEC-23a): for interactive runs, ALWAYS recap — a clean
+        // exit-0 before attach means the harness has no interactive REPL and the
+        // user would see only a bare `[detached]` with no clue why. For headless
+        // runs the old quiet behaviour stands: exit-0 is a successful quick run.
+        if (shouldRecapDeadPane(before.status, resolveInteractive(options))) {
             await surfacePaneFailure(before.status, `${options.agent} exited before it could start`);
         }
         await killSession(name, socket).catch(() => { });
         return { exitCode: before.status ?? 0, stderr: '', stdout: '' };
     }
     await attachTmux({ socket, args: ['attach-session', '-t', name] });
+    // F3 (RUSH-2185 / EXEC-23a): paneExitStatus returns {dead:false} for BOTH
+    // "pane is alive" and "tmux query failed (race / pane already gone)". Require
+    // POSITIVE proof before taking the keep-session path — a separate direct query
+    // that only returns true when tmux explicitly confirms pane_dead=0.
+    const checkPaneKnownAlive = async (p) => {
+        try {
+            const r = await runTmux({ socket, args: ['display-message', '-pt', p, '-p', '#{pane_dead}'], throwOnError: false });
+            return isPaneKnownAliveFromQueryResult(r.code, r.stdout);
+        }
+        catch {
+            return false;
+        }
+    };
     const after = pane ? await paneExitStatus(pane, socket) : { dead: false };
     if (after.dead) {
         // Nonzero exit after attach → the agent crashed rather than the user
         // detaching cleanly (a clean detach leaves the pane ALIVE, handled below).
-        // The pane-died hook may have yanked the view before the error was readable,
-        // so recap it into the shell. A clean (0) exit stays quiet — nothing to say.
-        if ((after.status ?? 0) !== 0) {
+        // F2: for interactive runs, also recap a clean exit-0 — the harness exited
+        // without error but without starting a REPL, which is still a failure.
+        if (shouldRecapDeadPane(after.status, resolveInteractive(options))) {
             await surfacePaneFailure(after.status, `${options.agent} exited`);
         }
         await killSession(name, socket).catch(() => { });
         return { exitCode: after.status ?? 0, stderr: '', stdout: '' };
     }
-    // Pane still alive → the user detached; keep the session for `agents focus`.
+    // after.dead===false, but that could be a stale/unreadable-pane result.
+    // Require positive proof before keeping the session as "user detached".
+    if (pane && await checkPaneKnownAlive(pane)) {
+        // Confirmed alive: the user pressed Ctrl-b d; keep the session for `agents focus`.
+        return { exitCode: 0, stderr: '', stdout: '' };
+    }
+    // Ambiguous or unreadable pane (race between pane-died hook and our query) —
+    // tear down rather than leave an orphan session.
+    await killSession(name, socket).catch(() => { });
     return { exitCode: 0, stderr: '', stdout: '' };
 }
 /**

package/dist/lib/feed-outcome.d.ts

@@ -88,6 +88,7 @@ export interface SessionOutcomeHint {
     prUrl?: string | null;
     worktreeSlug?: string | null;
     branch?: string | null;
+    project?: string | null;
 }
 /**
  * Overlay session meta onto a block when the block itself is missing ticket/PR/

package/dist/lib/feed-outcome.js

@@ -220,6 +220,8 @@ export function enrichBlockFromSession(block, hint) {
     }
     if (!next.worktreeSlug && hint.worktreeSlug)
         next.worktreeSlug = hint.worktreeSlug;
+    if (!next.project && hint.project)
+        next.project = hint.project;
     return next;
 }
 /**

package/dist/lib/feed-post.js

@@ -2,7 +2,7 @@
  * Agent status posts — deliberate progress messages into the activity stream.
  *
  * Surface: `agents feed post --title <subject> <body>` (agent-callable; humans
- * watch via `agents feed` / `agents activity` / `agents events --module activity`).
+ * watch via `agents feed` / `agents events --module activity`).
  *
  * Identity is automatic: session id, agent, cwd, launch/pid/tmux provenance
  * are resolved from the process environment and the per-pid launch registry

package/dist/lib/feed-ranking.d.ts

@@ -11,6 +11,7 @@ export interface FeedSessionSignal {
     runtime?: string;
     pid?: number;
     cwd?: string;
+    project?: string;
     startedAtMs?: number;
     status?: ActiveSession['status'];
     tokPerSec?: number;

package/dist/lib/feed-ranking.js

@@ -1,5 +1,6 @@
 import { classifyBlock } from './ask-classifier.js';
 import { outcomeForBlock } from './feed-outcome.js';
+import { projectKeyFromCwd } from './project-key.js';
 const MINUTES_PER_HOUR = 60;
 const NEEDY_ASKS_PER_HOUR = 6;
 const RUNAWAY_TOK_PER_SEC = 250;
@@ -26,6 +27,7 @@ export function buildSessionSignals(active, metas = []) {
             runtime: s.context,
             pid: s.pid,
             cwd: s.cwd,
+            project: s.project ?? projectKeyFromCwd(s.cwd),
             startedAtMs: s.startedAtMs,
             status: s.status,
             tokPerSec: s.tokPerSec,
@@ -146,6 +148,7 @@ export function needyControlCards(stats, signals = [], now = new Date(), thresho
             mailboxId: row.mailboxId,
             host: signal?.host ?? 'local',
             runtime: signal?.runtime ?? signal?.context ?? 'unknown',
+            project: signal?.project,
             ts: row.lastAskAt,
             kind: 'control',
             questions: [{
@@ -200,6 +203,7 @@ export function runawayControlCards(signals, now = new Date()) {
             mailboxId: signal.mailboxId ?? id,
             host: signal.host ?? 'local',
             runtime: signal.runtime ?? signal.context ?? 'unknown',
+            project: signal.project,
             ts: new Date(signal.startedAtMs ?? nowMs).toISOString(),
             kind: 'control',
             questions: [{

package/dist/lib/feed.d.ts

@@ -36,6 +36,8 @@ export interface OpenBlock {
     mailboxId: string;
     host: string;
     runtime: string;
+    /** Project/repo name this block belongs to (derived from cwd, worktree-aware). */
+    project?: string;
     ts: string;
     questions: BlockQuestion[];
     /**
@@ -178,6 +180,7 @@ export interface DeclaringAgent {
     mailboxId: string;
     host: string;
     runtime: string;
+    cwd?: string;
 }
 export interface DeclareBlockInput {
     /** What the agent needs from the user, front-loaded. */
@@ -218,7 +221,7 @@ export declare function removeBlock(blockId: string, root?: string): boolean;
  * Embedded so it ships with the compiled CLI and can be installed to the
  * CLI-writable user hooks dir without a separate file in the npm tarball.
  */
-export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"idle_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A declared block (`agents feed post --blocked`) is the agent explicitly\n        # saying it is stuck. Unlike a question/notification/approval block -- which\n        # tracks an in-flight harness prompt that a lifecycle event resolves -- a\n        # declared block stays open until it is actually ANSWERED. So while it is\n        # still UNANSWERED, Stop/SessionEnd/PostToolUse must never silently drop it:\n        # otherwise the needs-you record vanishes the moment the agent parks the block\n        # and its turn ends -- exactly when the owner still needs to see and answer it.\n        # Once it IS answered (an answered marker exists), it clears like any other\n        # block by falling through below -- which frees that marker too, so a later\n        # `--blocked` in the same session is not falsely locked as already-answered\n        # (recordAnswer creates the marker with O_EXCL).\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            answered = os.path.exists(os.path.join(answered_dir, f\"{block_id}.json\"))\n            if existing.get(\"kind\") == \"declared\" and not answered:\n                return\n        except Exception:\n            pass\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": datetime.now(timezone.utc).isoformat(),\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so the Factory extension can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now_iso = datetime.now(timezone.utc).isoformat()\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
+export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"idle_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef project_from_cwd(cwd):\n    \"\"\"Basename of cwd, with worktree paths resolved to their repo name.\"\"\"\n    if not cwd:\n        return None\n    norm = cwd.replace(\"\\\\\", \"/\").rstrip(\"/\")\n    if not norm:\n        return None\n    marker = \"/.agents/worktrees/\"\n    idx = norm.find(marker)\n    if idx > 0:\n        repo_path = norm[:idx]\n        base = repo_path[repo_path.rfind(\"/\") + 1:]\n        if base:\n            return base\n    base = norm[norm.rfind(\"/\") + 1:]\n    return base or None\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A declared block (`agents feed post --blocked`) is the agent explicitly\n        # saying it is stuck. Unlike a question/notification/approval block -- which\n        # tracks an in-flight harness prompt that a lifecycle event resolves -- a\n        # declared block stays open until it is actually ANSWERED. So while it is\n        # still UNANSWERED, Stop/SessionEnd/PostToolUse must never silently drop it:\n        # otherwise the needs-you record vanishes the moment the agent parks the block\n        # and its turn ends -- exactly when the owner still needs to see and answer it.\n        # Once it IS answered (an answered marker exists), it clears like any other\n        # block by falling through below -- which frees that marker too, so a later\n        # `--blocked` in the same session is not falsely locked as already-answered\n        # (recordAnswer creates the marker with O_EXCL).\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            answered = os.path.exists(os.path.join(answered_dir, f\"{block_id}.json\"))\n            if existing.get(\"kind\") == \"declared\" and not answered:\n                return\n        except Exception:\n            pass\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": datetime.now(timezone.utc).isoformat(),\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so the Factory extension can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now_iso = datetime.now(timezone.utc).isoformat()\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    project = project_from_cwd(cwd)\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if project:\n        block[\"project\"] = project\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
 /** Manifest entry for the feed-publish hook, matching the ManifestHook shape. */
 export declare const FEED_PUBLISH_HOOK_MANIFEST: {
     name: string;

package/dist/lib/feed.js

@@ -26,6 +26,7 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { getFeedDir, getUserAgentsDir } from './state.js';
 import { isAdmin, isHighConsequenceAllowed, isKnownOperator } from './operator.js';
+import { projectKeyFromCwd } from './project-key.js';
 /**
  * Stable block id for a session. One block per session -- a new question
  * replaces the previous one (the agent can only ask one question at a time).
@@ -261,6 +262,7 @@ export function buildDeclaredBlock(agent, input) {
         .map((label) => label.trim())
         .filter(Boolean)
         .map((label) => ({ label }));
+    const project = projectKeyFromCwd(agent.cwd);
     return {
         blockId: blockIdForSession(agent.sessionId),
         sessionId: agent.sessionId,
@@ -272,6 +274,7 @@ export function buildDeclaredBlock(agent, input) {
         questions: [{ text, header: 'Needs you', ...(options.length ? { options } : {}) }],
         blockClass: input.safeDefault ? 'approval' : 'decision',
         costOfDelay: 'high',
+        ...(project ? { project } : {}),
         ...(input.safeDefault ? { safeDefault: input.safeDefault } : {}),
         ...(input.timeoutMinutes !== undefined ? { timeoutMinutes: input.timeoutMinutes } : {}),
     };
@@ -417,6 +420,24 @@ def write_json(path, value):
             pass
 
 
+def project_from_cwd(cwd):
+    """Basename of cwd, with worktree paths resolved to their repo name."""
+    if not cwd:
+        return None
+    norm = cwd.replace("\\\\", "/").rstrip("/")
+    if not norm:
+        return None
+    marker = "/.agents/worktrees/"
+    idx = norm.find(marker)
+    if idx > 0:
+        repo_path = norm[:idx]
+        base = repo_path[repo_path.rfind("/") + 1:]
+        if base:
+            return base
+    base = norm[norm.rfind("/") + 1:]
+    return base or None
+
+
 def main():
     raw = sys.stdin.read()
     try:
@@ -626,6 +647,8 @@ def main():
     host = re.sub(r"[^a-z0-9_-]", "-", host) or "unknown"
 
     runtime = os.environ.get("AGENTS_RUNTIME", "headless")
+    cwd = payload.get("cwd") or os.environ.get("AGENTS_CWD")
+    project = project_from_cwd(cwd)
 
     block = {
         "blockId": block_id,
@@ -637,6 +660,8 @@ def main():
         "questions": normalized_questions,
         "kind": kind,
     }
+    if project:
+        block["project"] = project
     if notification_type:
         block["notificationType"] = notification_type
 

package/dist/lib/hosts/passthrough.js

@@ -106,7 +106,6 @@ const OWN_HOST_COMMANDS = new Set([
     'harnesses',
     'sessions',
     'feed',
-    'activity', // fans `--host`/`--device`/`--devices-all` out itself (feed-style)
     'computer',
     'secrets',
     'logs',

package/dist/lib/mcp.js

@@ -594,6 +594,7 @@ function writeMcpConfigSupportsAgent(agentId) {
         case 'grok':
         case 'opencode':
         case 'hermes':
+        case 'pi':
             return true;
         default:
             return false;
@@ -615,7 +616,11 @@ export function writeMcpConfig(agentId, configPath, servers, mode = 'overwrite')
         case 'claude':
         case 'cursor':
         case 'kimi':
-        case 'droid': {
+        case 'droid':
+        // omp reads the same Claude `{ "mcpServers": {...} }` schema from .mcp.json
+        // (stdio: command/args/env; http/sse: url/headers — transport inferred from
+        // command/url presence).
+        case 'pi': {
             let config = {};
             if (fs.existsSync(configPath)) {
                 try {

package/dist/lib/model-tiers.js

@@ -124,7 +124,10 @@ function newer(a, b) {
  */
 function rankCatalog(agent, models) {
     const usable = models.filter((m) => !PSEUDO.test(m.id));
-    const aggregator = agent === 'cursor';
+    // Cursor and Pi (Oh My Pi) are cross-provider aggregators: their ids are
+    // provider-qualified (`anthropic/…`, `openai/…`) and span vendors, so price of
+    // the normalized base id is the only unifying rank signal.
+    const aggregator = agent === 'cursor' || agent === 'pi';
     const scored = usable.map((m) => {
         const rawId = m.id;
         const baseId = aggregator ? normalizeAggregatorId(rawId) : rawId;

package/dist/lib/models.js

@@ -234,6 +234,18 @@ export function locateModelSource(agent, version) {
             return { path: pathBin, kind: 'cli' };
         return null;
     }
+    if (agent === 'pi') {
+        // omp (Oh My Pi) installs via `bun install -g`; a version-managed install
+        // exposes it under node_modules/.bin/omp, otherwise it lives on PATH. We let
+        // the CLI produce its own catalog via `omp models --json` (extractPiCatalog).
+        const cli = path.join(versionDir, 'node_modules', '.bin', 'omp');
+        if (fs.existsSync(cli))
+            return { path: cli, kind: 'cli' };
+        const pathBin = findOnPath('omp');
+        if (pathBin)
+            return { path: pathBin, kind: 'cli' };
+        return null;
+    }
     return null;
 }
 /** Real Grok binaries are ~100MB+; failed-download stubs are tens of bytes. */
@@ -907,6 +919,55 @@ function extractKimiCatalog(binaryPath) {
     }
     return { models, aliases: {} };
 }
+/**
+ * Extract Oh My Pi's catalog via `omp models --json`. omp is a cross-provider
+ * aggregator: its catalog is the union of every provider it has a key for, so
+ * ids are provider-qualified selectors (`anthropic/claude-opus-4-8`,
+ * `openai/gpt-5.2`, `xai/grok-4`, `deepseek/deepseek-chat`, …) — exactly the
+ * `provider/model` convention `ModelInfo.id` already uses. Output shape:
+ *   {"models":[{"provider":"anthropic","id":"claude-opus-4-8",
+ *               "selector":"anthropic/claude-opus-4-8","name":"Claude Opus 4.8",
+ *               "cost":{...}}, ...]}
+ * The catalog is gated per-provider by key presence (no key -> that provider's
+ * models are absent, and an empty env yields `{"models":[]}`). That is truthful:
+ * the extractor surfaces exactly the providers the user has authenticated.
+ * Pricing is attached uniformly by getModelCatalog via getModelPricing(id),
+ * which strips the `provider/` prefix — so no per-catalog price shape here.
+ */
+function extractPiCatalog(binaryPath) {
+    let stdout;
+    try {
+        stdout = execFileSync(binaryPath, ['models', '--json'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 15_000,
+            maxBuffer: 64 * 1024 * 1024,
+        });
+    }
+    catch {
+        return { models: [], aliases: {} };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout.replace(/\x1b\[[0-9;]*[A-Za-z]/g, ''));
+    }
+    catch {
+        return { models: [], aliases: {} };
+    }
+    if (!parsed || !Array.isArray(parsed.models))
+        return { models: [], aliases: {} };
+    const models = [];
+    const seen = new Set();
+    for (const m of parsed.models) {
+        // Prefer the provider-qualified selector; fall back to provider/id.
+        const id = m.selector || (m.provider && m.id ? `${m.provider}/${m.id}` : m.id);
+        if (!id || seen.has(id))
+            continue;
+        seen.add(id);
+        models.push({ id, displayName: typeof m.name === 'string' ? m.name : undefined });
+    }
+    return { models, aliases: {} };
+}
 /**
  * Build (or load from cache) the model catalog for a specific (agent, version).
  * Cache is keyed on source-file mtime (binary or js module), so re-extracts
@@ -964,6 +1025,8 @@ export function getModelCatalog(agent, version) {
             ({ models, aliases } = extractKimiCatalog(src.path));
         else if (agent === 'grok')
             ({ models, aliases } = extractGrokCatalog(src.path));
+        else if (agent === 'pi')
+            ({ models, aliases } = extractPiCatalog(src.path));
     }
     // Attach per-token pricing where the offline table knows the model, so the
     // catalog carries $/token for the tier display and budgeting. Subscription /

package/dist/lib/profiles.d.ts

@@ -7,6 +7,7 @@
  */
 import type { AgentId } from './types.js';
 import { type Preset } from './profiles-presets.js';
+import { type ModelTier } from './model-tiers.js';
 /** A named profile binding an agent host, env vars, and optional keychain auth. */
 export interface Profile {
     name: string;
@@ -49,6 +50,19 @@ export interface Profile {
      * changes; auth, base URL, and every other profile env value are preserved.
      */
     fallback_model?: string;
+    /**
+     * Per-tier model ids for this harness's OWN catalog, keyed by the same cost
+     * tiers `agents run --model cheap|default|best|ultra` uses for a native
+     * agent. Lets a custom harness (which runs through a host agent's binary,
+     * e.g. `deepseek-flash` hosted on `claude`) resolve a tier against its own
+     * models instead of colliding with the host agent's native catalog
+     * (`resolveTier` in model-tiers.ts, which only knows native agents).
+     * An unset tier clamps to the next CHEAPER tier that IS set (see
+     * `resolveProfileTierModel`). Omitted entirely -> tiers are not supported
+     * for this profile and a requested tier falls back to the harness's single
+     * pinned model, unchanged from before this field existed.
+     */
+    models?: Partial<Record<ModelTier, string>>;
 }
 /**
  * Stable, machine-readable summary used by `agents view` and `--json`.
@@ -193,13 +207,40 @@ export interface ResolvedProfileRun {
         envKey: string;
         model: string;
     };
+    /**
+     * Set when the caller requested a cost tier (`--model cheap|default|...`)
+     * but this profile has no `models:` entry to resolve it against (not even a
+     * cheaper tier to clamp to). `env` is returned unmodified — the harness's
+     * single pinned model — and this note is informational only, matching the
+     * "using harness default" convention exec.ts's native tier block already
+     * uses; the caller prints it, it never throws.
+     */
+    tierNote?: string;
+    /**
+     * Set when `requestedModel` was a tier token AND this profile resolved it
+     * against its own `models:` map. Callers that forward a `--model` value
+     * downstream (e.g. as `ExecOptions.model`) should substitute this in place
+     * of the original tier token — exec.ts's native tier block only knows how
+     * to resolve a tier against the HOST agent's own catalog, which is the
+     * wrong catalog for a profile's own harness identity. Undefined both when
+     * no tier was requested and when tier resolution degraded (see `tierNote`).
+     */
+    resolvedModel?: string;
 }
 /**
  * Resolve a name into (agent, version, env). Throws if the name is not a
  * profile. Callers are expected to try agent-id resolution first and fall
  * back to this when that fails, so we don't need a "isProfile" probe.
+ *
+ * `requestedModel` is the caller's raw `--model` value. When it is a cost-tier
+ * token (`cheap`/`default`/`best`/`ultra`), it is resolved against the
+ * profile's OWN `models:` map (see `resolveProfileTierModel`) and substituted
+ * into `env` as a concrete model id BEFORE returning — so exec.ts's native
+ * tier-resolution block (which indexes the HOST agent's catalog, e.g. Claude's
+ * own models) never sees a tier token for a profile-based run, and can't
+ * collide the profile's harness identity with its host's catalog.
  */
-export declare function resolveProfileForRun(name: string): ResolvedProfileRun;
+export declare function resolveProfileForRun(name: string, requestedModel?: string): ResolvedProfileRun;
 /**
  * Look up the preset a profile was created from, if any. Used by
  * `profiles view` to show upstream metadata like signup URLs.

package/dist/lib/profiles.js

@@ -11,6 +11,7 @@ import * as yaml from 'yaml';
 import { getUserAgentsDir } from './state.js';
 import { getKeychainToken, hasKeychainToken, keychainItemName } from './secrets/profiles.js';
 import { getPreset } from './profiles-presets.js';
+import { MODEL_TIERS, isTierToken } from './model-tiers.js';
 const PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]{0,48}$/i;
 /** Get the directory where profile YAML files are stored. */
 export function getProfilesDir() {
@@ -378,17 +379,45 @@ export function resolveProfileEnv(profile) {
     }
     return env;
 }
+/**
+ * Resolve a requested cost tier against a profile's `models:` map. An unset
+ * tier clamps to the next CHEAPER tier that IS set (ultra -> best -> default
+ * -> cheap), mirroring the clamp semantics of `bucketRungs` in
+ * model-tiers.ts. Returns null when the profile declares no `models:` at all,
+ * or none of the tiers at-or-below the request are set.
+ */
+function resolveProfileTierModel(profile, tier) {
+    if (!profile.models)
+        return null;
+    const idx = MODEL_TIERS.indexOf(tier);
+    for (let i = idx; i >= 0; i--) {
+        const rung = MODEL_TIERS[i];
+        const model = profile.models[rung];
+        if (model)
+            return { model, clampedFrom: rung === tier ? undefined : rung };
+    }
+    return null;
+}
 /**
  * Resolve a name into (agent, version, env). Throws if the name is not a
  * profile. Callers are expected to try agent-id resolution first and fall
  * back to this when that fails, so we don't need a "isProfile" probe.
+ *
+ * `requestedModel` is the caller's raw `--model` value. When it is a cost-tier
+ * token (`cheap`/`default`/`best`/`ultra`), it is resolved against the
+ * profile's OWN `models:` map (see `resolveProfileTierModel`) and substituted
+ * into `env` as a concrete model id BEFORE returning — so exec.ts's native
+ * tier-resolution block (which indexes the HOST agent's catalog, e.g. Claude's
+ * own models) never sees a tier token for a profile-based run, and can't
+ * collide the profile's harness identity with its host's catalog.
  */
-export function resolveProfileForRun(name) {
+export function resolveProfileForRun(name, requestedModel) {
     const profile = readProfile(name);
+    const env = resolveProfileEnv(profile);
     const resolved = {
         agent: profile.host.agent,
         version: profile.host.version,
-        env: resolveProfileEnv(profile),
+        env,
         profileName: profile.name,
     };
     if (profile.fallback_model) {
@@ -397,6 +426,25 @@ export function resolveProfileForRun(name) {
             resolved.fallbackModel = { envKey, model: profile.fallback_model };
         }
     }
+    if (isTierToken(requestedModel)) {
+        const tierPick = resolveProfileTierModel(profile, requestedModel);
+        if (tierPick) {
+            const envKey = profileModelEnvKey(profile) ?? modelEnvKeyForHost(profile.host.agent);
+            env[envKey] = tierPick.model;
+            resolved.resolvedModel = tierPick.model;
+            // Mirror the native-harness tier block (lib/exec.ts's resolveTier callers):
+            // a clamp is always announced, never silent, so a user asking for "ultra"
+            // on a harness that only configures "best" knows what it actually got.
+            if (tierPick.clampedFrom) {
+                resolved.tierNote = `no "${requestedModel}" model configured on profile '${profile.name}'; using its "${tierPick.clampedFrom}" tier (${tierPick.model})`;
+            }
+        }
+        // No `models:` opt-in at all, or no rung to clamp to: leave `env` and
+        // `requestedModel` untouched. `agents commands/exec.ts`'s own profile-tier
+        // guard (the "cost tiers don't apply to profile ..." discard) still sees
+        // the raw tier token downstream and handles the message -- this function
+        // doesn't compete with that canonical fallback for the no-opt-in case.
+    }
     return resolved;
 }
 /**

package/dist/lib/project-focus.d.ts

@@ -40,3 +40,12 @@ export declare function rankFocusAreas(files: string[], limit?: number): FocusAr
  * the user's last fetch, which is the correct trade for a read-only card.
  */
 export declare function readFocusAreas(root: string, windowDays: number): Promise<FocusArea[]>;
+/** Compact count: 2329 → "2.3k", under 1000 stays exact. */
+export declare function formatFocusCount(n: number): string;
+/**
+ * One scannable focus line: path + count, with a single unit trailer so the
+ * bare integer is never mistaken for commits or minutes.
+ *
+ *   apps/cli/src 2.3k  ·  apps/cli/docs 302  ·  apps/factory/src 245  file-touches (7d)
+ */
+export declare function formatFocusAreas(areas: FocusArea[], windowDays: number): string;