@phnx-labs/agents-cli 1.22.63 → 1.22.64

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 1.22.64
+
+- **`agents accounts attach` bootstraps a keychain-less Linux worker (PHNX-3502).**
+  Attaching a Claude account to a version home on a headless worker now seeds the
+  home's identity and writes its `.oauth_token` from the account's non-rotating
+  setup-token already synced in the `auth` bundle, instead of refusing because the
+  home was never interactively signed in. This is what lets all accounts show as
+  logged in — and interactive worker runs authenticate (the shim's Linux
+  `.oauth_token` fallback) instead of dropping to the login screen. No rotating
+  OAuth credential is ever copied. Source: `apps/cli/src/commands/accounts.ts`,
+  `apps/cli/src/lib/claude-account-token.ts`.
+
+- Fixed Rush-backed feed channel sinks failing on Linux workers by handing delivery to a reachable macOS fleet peer with the Keychain-bound transport.
+
+- **Auto-produce the origin/main release attestation on merge (RUSH-2666).** A new
+  `attest-main.yml` workflow runs the full suite on every push to `main` and uploads
+  the exact-tree attestation + pretested tarball to a rolling `main-attestations`
+  GitHub Release, keyed by tree hash. `release.sh` now prefetches that proof into the
+  local store before waiting, so an ordinary release promotes without running the
+  suite inline — no more human running the suite by hand to unwedge a release. Purely
+  additive and fail-safe: on any fetch miss or error it falls back to exactly the
+  prior poll-then-`require` behavior, and a fetched proof is trusted only because the
+  existing exact-tree `require` re-verifies it. Source: `cli/scripts/release.sh`,
+  `.github/workflows/attest-main.yml`.
+
+- **Phoenix ID now uses the branded `id.byphoenix.com` API hostname by default (PHNX-3543).** New CLI sessions start and poll device authorization, resolve `whoami`, and bind managed share/traces Workers against the same canonical Phoenix ID base. The legacy hostname remains live for older installed clients. `PHOENIX_ID_BASE` remains an environment override for development and private deployments. Source: `src/lib/identity/client.ts`.
+
+- **A pre-launch `run.launch` event makes a launch into a logged-out version visible instead of silent.** `agents run <agent> --device auto --strategy balanced` (the VS Code "New Claude" flow) launched a version that was LOGGED OUT on the target box: `--device auto` (`applyDeviceAutoToOptions`) only ensures SOME account is ready on the device, not that the SPECIFIC version launched is signed in there, and the failure was invisible — the pinned/default path in `resolveRunVersion` returns without emitting `rotation.resolved`, and `run.dispatched` only fires at run FINALIZE (post-exit), but a logged-out agent sits at the login screen and never finalizes, so nothing was recorded. A new `run.launch` event is now emitted RIGHT BEFORE the harness child is spawned, on the device that will run it, so it fires even when the agent then sits stuck at a login screen. Both live launch paths are covered by one shared emitter: `spawnAgent` (after the tmux-durability gate, for the tmux-wrapped AND bare spawns) and the Windows `execShimPassthrough` shim (`resolvedVia: 'shim'`), which was the second blind spot. Payload: `module: 'run'`, `agent`, `version`, `strategy`, `signedIn` (the launchable-signed-in verdict for the SPECIFIC launched version on THIS device — REUSED from the rotated pick's `rotationResult.picked.signedIn` when the command already computed it, else derived via the new `isVersionLaunchableHere` helper, which applies the same `getVersionHomePath` -> `getAccountInfo` -> `isLaunchableSignedIn` gate as `collectRunCandidates`), `launchedLoggedOut` (the headline flag, `signedIn === false`), `email`, and `resolvedVia`; the device hostname is auto-stamped by `emit()`. It sits in the AUDIT lane — the sibling of `run.dispatched` and the more reliable stuck-launch signal — so `agents events --level audit --include runs` surfaces it. Purely additive observability — the emit is best-effort (it can never break a launch) and no routing/launch behavior changes; refusing to launch a logged-out version is a separate follow-up. Source: `cli/src/lib/exec.ts`, `cli/src/lib/accounting/rotate.ts`, `cli/src/lib/feed/events.ts`, `cli/src/lib/event-families.ts`, `cli/src/commands/exec.ts`.
+
+- **Live session rows carry outcome-card metrics and deliverables (PHNX-3574).** `agents sessions --active --json` and `agents sessions watch --json` now enrich each live row with indexed `tokenCount`, `durationMs`, and `subAgentCount`, plus created plan/artifact documents detected by the existing bounded transcript-tail state engine. Thin clients such as AGI EXT can render the initial request, progress, deliverables, team fan-out, runtime, and token use from the one canonical stream without polling or parsing transcripts themselves. Source: `cli/src/lib/session/active.ts`, `cli/src/lib/session/state.ts`.
+
 ## 1.22.63
 
 - **Managed share endpoint enforces a per-user storage quota, object limit, per-file size cap, and publish rate limit (PHNX-3542).** The managed `share.agents-cli.sh` Worker authenticated any Phoenix ID bearer and then accepted **unbounded** writes into shared R2 — no quota, no rate limit, no size cap — which blocked opening publishing to third parties. Each managed (Phoenix-identity) publish now charges a per-user usage ledger stored in R2 at `__usage/<owner>` (a conditional-put CAS object, mirroring the existing `__views`/`__handles` precedent — no Durable Object, no new binding): free tier is 200 MiB total, 150 canonical pages, 20 MiB per file, and 60 publishes/hour. Enforcement measures the **real request body** (bounded-buffered so a streaming body can't exceed the cap) and rejects on the true size **before any write**, so a spoofed-low declared size can't bypass the caps or destroy an existing page. It **fails loud** — `413` for a file, object-count, or byte-quota overage, `429` (with `Retry-After`) for the rate limit — and refunds bytes + object count on delete and on lazy expiry. Covers/views are server-generated overhead and excluded from the quota. BYO (`WRITE_TOKEN`) publishes write to the operator's own bucket at their own cost and are **unaffected** (a deliberate, documented policy). A `SHARE_PLANS` map is the seam for future paid tiers (billing follow-up PHNX-3569). Source: `cli/src/lib/share/worker-template.ts`.

package/dist/commands/accounts.d.ts

@@ -37,7 +37,7 @@ export declare function classifyAttachTarget(target: string): AttachTarget;
  * the credential in the keychain, so `resolveClaudeSetupToken` returns null there and this
  * is a no-op off Linux.
  */
-export declare function writeClaudeInteractiveOauthToken(target: AttachTarget, targetAgent: AgentId): void;
+export declare function writeClaudeInteractiveOauthToken(target: AttachTarget, targetAgent: AgentId, email?: string): void;
 export declare function parseBundleKey(raw: string): {
     bundle: string;
     key: string;

package/dist/commands/accounts.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import { password, select } from '@inquirer/prompts';
-import { resolveClaudeSetupToken } from '../lib/claude-account-token.js';
+import { readClaudeAccountEmail, resolveClaudeSetupToken, resolveClaudeSetupTokenForEmail, seedClaudeWorkerHomeIdentity } from '../lib/claude-account-token.js';
 import { setHelpSections } from '../lib/help.js';
 import { readMeta, updateMeta } from '../lib/state.js';
 import { ALL_AGENT_IDS, getAccountInfo, resolveAgentName } from '../lib/agents.js';
@@ -91,12 +91,17 @@ export function classifyAttachTarget(target) {
  * the credential in the keychain, so `resolveClaudeSetupToken` returns null there and this
  * is a no-op off Linux.
  */
-export function writeClaudeInteractiveOauthToken(target, targetAgent) {
+export function writeClaudeInteractiveOauthToken(target, targetAgent, email) {
     if (process.platform !== 'linux' || targetAgent !== 'claude' || target.kind !== 'installation')
         return;
     const versionHome = getVersionHomePath('claude', target.version);
     const tokenPath = path.join(versionHome, '.claude', '.oauth_token');
-    const token = resolveClaudeSetupToken(versionHome);
+    // Resolve by the attached account's email when known (a freshly-seeded worker
+    // home the `.claude.json` read below could not key on yet), else by the home's
+    // own recorded identity for a re-point/detach.
+    const token = email
+        ? resolveClaudeSetupTokenForEmail(email, versionHome)
+        : resolveClaudeSetupToken(versionHome);
     // A re-point (attach B over A, or a detach) can leave no setup-token resolving for
     // this version — B's may not be minted yet. A leftover file from the previous binding
     // would silently authenticate interactive runs as the OLD account (the shim's Linux
@@ -536,9 +541,30 @@ agents run codex#work`,
                 else {
                     if (t.kind !== 'installation')
                         throw new Error(`${account.agent} authentication is per-version. Attach '${account.name}' to a specific ${account.agent}@<version>.`);
-                    const identity = await nativeIdentityFromSource(target);
-                    if (identity.identityKey !== account.identityKey)
-                        throw new Error(`'${target}' is signed in to a different identity than account '${account.name}'.`);
+                    const versionHome = getVersionHomePath(t.agent, t.version);
+                    // The literal email keys the account's `auth`-bundle setup-token. It lives
+                    // in `identityLabel` — `identityKey` is a synthetic composite
+                    // (`claude:account=<uuid>:org=<uuid>`, agents.ts nativeIdentityKey), never
+                    // the address, so it must NOT be used to derive the token key.
+                    const accountEmail = account.identityLabel;
+                    // Headless-worker bootstrap: a keychain-less Linux worker home never had
+                    // an interactive login, so its `.claude.json` carries no identity and
+                    // `nativeIdentityFromSource` would reject the attach — yet the account's
+                    // non-rotating setup-token is already fleet-synced in the `auth` bundle.
+                    // Seed the identity (email only, no rotating credential) so the token
+                    // resolves; `writeClaudeInteractiveOauthToken` then writes `.oauth_token`.
+                    if (process.platform === 'linux' &&
+                        account.agent === 'claude' &&
+                        accountEmail &&
+                        !readClaudeAccountEmail(versionHome) &&
+                        resolveClaudeSetupTokenForEmail(accountEmail)) {
+                        seedClaudeWorkerHomeIdentity(versionHome, accountEmail);
+                    }
+                    else {
+                        const identity = await nativeIdentityFromSource(target);
+                        if (identity.identityKey !== account.identityKey)
+                            throw new Error(`'${target}' is signed in to a different identity than account '${account.name}'.`);
+                    }
                 }
             }
             else {
@@ -546,7 +572,7 @@ agents run codex#work`,
                 getAccountProvider(account.provider).envFor(targetAgent, account.auth);
             }
             bindAccount(name, target);
-            writeClaudeInteractiveOauthToken(t, targetAgent);
+            writeClaudeInteractiveOauthToken(t, targetAgent, account.kind === 'native' && account.agent === 'claude' ? account.identityLabel : undefined);
             console.log(chalk.green(`Attached ${account.name} to ${target}.`));
         });
     });

package/dist/commands/exec.js

@@ -2356,6 +2356,18 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         // synthesize a same-agent fallback chain from the other healthy accounts
         // (issue #348). Stays null unless a non-pinned strategy actually rotated.
         let rotationResult = null;
+        // Precomputed launchable-signed-in verdict for the ACTUAL launched
+        // candidate, fed to the pre-launch `run.launch` event so it need not
+        // re-probe. Sourced per resolution branch from the candidate that WON, not
+        // the original auto-pick: the interactive picker (RUSH-2334 / PHNX-2526)
+        // deliberately lets the user launch a LOGGED-OUT account, which is a
+        // different candidate than `rotationResult.picked` — reading the verdict off
+        // the auto-pick there would report `launchedLoggedOut:false` for a version
+        // that is actually logged out, the exact false-negative this event exists to
+        // prevent. Left undefined for pinned-default / explicit-pin so emitRunLaunch
+        // falls back to probing the version home itself.
+        let launchSignedIn;
+        let launchEmail;
         // Set when the zero-healthy path already announced a deliberate
         // launch-to-sign-in, so the login preflight below does not repeat it.
         let signInLaunch = false;
@@ -2460,6 +2472,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                             if (!selected)
                                 return;
                             version = selected.version;
+                            // Source the run.launch verdict from the account the user ACTUALLY
+                            // picked — the picker may deliberately return a logged-out one
+                            // (RUSH-2334), so it can differ from rotationResult.picked.
+                            launchSignedIn = selected.signedIn;
+                            launchEmail = selected.email;
                             // Keep the rotation so mid-run failover can still cascade across
                             // the other (stale) healthy accounts after a real rejection.
                             rotationResult = resolved.rotation;
@@ -2476,6 +2493,12 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     else if (resolved.version) {
                         version = resolved.version;
                         rotationResult = resolved.rotation;
+                        // The auto-pick already computed the launchable-signed-in verdict for
+                        // this exact version via the same gate — reuse it for run.launch.
+                        if (resolved.rotation) {
+                            launchSignedIn = resolved.rotation.picked.signedIn;
+                            launchEmail = resolved.rotation.picked.email;
+                        }
                         // A balanced/available pick of a PROVIDER account (setup-token /
                         // API-key) carries `providerAccount`. Resolve its env through the
                         // same `resolveSpawnAccount` path an explicit `--account` uses, so
@@ -2818,6 +2841,23 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             // forwards `--emit-session-id`): print the resolved session id as a
             // stdout sentinel so the launcher captures the id this run coined.
             emitSessionId: options.emitSessionId === true,
+            // Observability-only: carried onto the pre-launch `run.launch` event so
+            // the stream records HOW this version was chosen. Neither affects the
+            // spawn. `resolvedVia` attributes the version source cheaply — an
+            // explicit @version pin, a strategy rotation, or the pinned default.
+            strategy,
+            resolvedVia: rawVersion
+                ? 'explicit-pin'
+                : rotationResult
+                    ? 'rotated'
+                    : 'pinned-default',
+            // Launchable-signed-in verdict for the ACTUAL launched candidate, set per
+            // resolution branch above (auto-pick from rotation.picked; interactive
+            // picker from the user's `selected`, which may be logged out). Undefined
+            // for a pinned-default / explicit-pin launch, where spawnAgent probes the
+            // version home itself.
+            launchSignedIn,
+            launchEmail,
         };
         if (options.interactive && options.headless) {
             console.error(chalk.red('--interactive and --headless are mutually exclusive. Pass one, or neither (mode is inferred from prompt presence).'));

package/dist/lib/accounting/rotate.d.ts

@@ -131,6 +131,28 @@ export declare function setGlobalRunStrategy(agent: AgentId, strategy: RunStrate
  * existing `signedIn` signal.
  */
 export declare function isLaunchableSignedIn(signedIn: boolean, presence: Pick<CredentialPresence, 'knownLocation' | 'perVersion'>): boolean;
+/** Launchable-signed-in verdict for ONE specific version on THIS device. */
+export interface VersionLaunchState {
+    /** True iff this exact version home can spawn a signed-in agent right now. */
+    launchable: boolean;
+    /** The version home's account email when launchable, else null. */
+    email: string | null;
+}
+/**
+ * Whether a SPECIFIC installed version is launchable-signed-in on THIS device,
+ * plus the account email when it is. Mirrors EXACTLY the per-version gate
+ * {@link collectRunCandidates} applies (getVersionHomePath -> getAccountInfo ->
+ * {@link isLaunchableSignedIn} over {@link credentialPresence}), so the
+ * pre-launch `run.launch` event can report the same signed-in verdict the
+ * balanced router computes for that version.
+ *
+ * The point is to make a launch into a logged-out version VISIBLE at spawn time:
+ * `--device auto` only guarantees SOME account is ready on the device, not that
+ * the specific version launched is signed in there (the yosemite-m3 2.1.219
+ * incident — 2.1.219 was logged out, the router correctly excluded it, yet it
+ * launched). Non-fatal by construction: callers wrap it best-effort.
+ */
+export declare function isVersionLaunchableHere(agent: AgentId, version: string): Promise<VersionLaunchState>;
 /**
  * How old a usage snapshot may be and still settle a routing DECISION.
  *

package/dist/lib/accounting/rotate.js

@@ -98,6 +98,26 @@ export function isLaunchableSignedIn(signedIn, presence) {
         return true;
     return presence.perVersion;
 }
+/**
+ * Whether a SPECIFIC installed version is launchable-signed-in on THIS device,
+ * plus the account email when it is. Mirrors EXACTLY the per-version gate
+ * {@link collectRunCandidates} applies (getVersionHomePath -> getAccountInfo ->
+ * {@link isLaunchableSignedIn} over {@link credentialPresence}), so the
+ * pre-launch `run.launch` event can report the same signed-in verdict the
+ * balanced router computes for that version.
+ *
+ * The point is to make a launch into a logged-out version VISIBLE at spawn time:
+ * `--device auto` only guarantees SOME account is ready on the device, not that
+ * the specific version launched is signed in there (the yosemite-m3 2.1.219
+ * incident — 2.1.219 was logged out, the router correctly excluded it, yet it
+ * launched). Non-fatal by construction: callers wrap it best-effort.
+ */
+export async function isVersionLaunchableHere(agent, version) {
+    const home = getVersionHomePath(agent, version);
+    const info = await getAccountInfo(agent, home);
+    const launchable = isLaunchableSignedIn(info.signedIn, credentialPresence(agent, home));
+    return { launchable, email: launchable ? info.email : null };
+}
 function isAvailableEligible(candidate) {
     return isRotationEligible(candidate);
 }

package/dist/lib/claude-account-token.d.ts

@@ -22,3 +22,29 @@ export declare function readClaudeAccountEmail(home?: string): string | null;
  * authenticate with the shareable setup-token, not the ACL-bound login item.
  */
 export declare function resolveClaudeSetupToken(home?: string): string | null;
+/**
+ * Resolve a long-lived setup-token for an EXPLICIT account email, independent of
+ * any version home's `.claude.json`. This is what lets `agents accounts attach`
+ * provision a headless worker home that has never had an interactive login: the
+ * account's non-rotating setup-token is already fleet-synced in the file-based
+ * `auth` bundle, keyed by email ({@link claudeAccountTokenKey}), so we can write
+ * the home's `.oauth_token` from it without the circular
+ * "read the home's email to resolve the home's token" dependency that
+ * {@link resolveClaudeSetupToken} has. Same file-backed-only, fail-closed,
+ * fingerprint-stable read as the home-keyed path — it is the shared core.
+ *
+ * `cacheKey` scopes the process-local token cache; callers pass a version home
+ * so a home-keyed and email-keyed read of the same account share nothing stale.
+ */
+export declare function resolveClaudeSetupTokenForEmail(email: string, cacheKey?: string): string | null;
+/**
+ * Seed a keychain-less Linux worker's Claude version-home identity so an account's
+ * fleet-synced setup-token resolves for it. A worker home never had an interactive
+ * browser login, so its `.claude.json` carries no `oauthAccount.emailAddress` and
+ * the account reads "signed out" even though its non-rotating setup-token is present
+ * in the `auth` bundle. This writes ONLY the descriptive identity (the email), merged
+ * into both `.claude.json` locations Claude Code reads, preserving every other field.
+ * It never copies a rotating OAuth credential (`.credentials.json`) — the setup-token
+ * stays the credential of record.
+ */
+export declare function seedClaudeWorkerHomeIdentity(versionHome: string, email: string): void;

package/dist/lib/claude-account-token.js

@@ -76,12 +76,32 @@ export function readClaudeAccountEmail(home) {
  * authenticate with the shareable setup-token, not the ACL-bound login item.
  */
 export function resolveClaudeSetupToken(home) {
+    // Require a known account (email) up front: without it we cannot key a
+    // per-account token, and we must NOT fall back to a bare shared key that
+    // would misapply one account's setup-token to another.
+    const email = readClaudeAccountEmail(home);
+    if (!email)
+        return null;
+    return resolveClaudeSetupTokenForEmail(email, home ?? os.homedir());
+}
+/**
+ * Resolve a long-lived setup-token for an EXPLICIT account email, independent of
+ * any version home's `.claude.json`. This is what lets `agents accounts attach`
+ * provision a headless worker home that has never had an interactive login: the
+ * account's non-rotating setup-token is already fleet-synced in the file-based
+ * `auth` bundle, keyed by email ({@link claudeAccountTokenKey}), so we can write
+ * the home's `.oauth_token` from it without the circular
+ * "read the home's email to resolve the home's token" dependency that
+ * {@link resolveClaudeSetupToken} has. Same file-backed-only, fail-closed,
+ * fingerprint-stable read as the home-keyed path — it is the shared core.
+ *
+ * `cacheKey` scopes the process-local token cache; callers pass a version home
+ * so a home-keyed and email-keyed read of the same account share nothing stale.
+ */
+export function resolveClaudeSetupTokenForEmail(email, cacheKey) {
     try {
-        // Require a known account (email) up front: without it we cannot key a
-        // per-account token, and we must NOT fall back to a bare shared key that
-        // would misapply one account's setup-token to another.
-        const email = readClaudeAccountEmail(home);
-        if (!email)
+        const trimmed = email.trim();
+        if (!trimmed)
             return null;
         if (!bundleExists(AUTH_BUNDLE))
             return null;
@@ -92,25 +112,26 @@ export function resolveClaudeSetupToken(home) {
             // hint that the seeded setup-token was being ignored.
             throw new ReservedBundleWrongBackendError(AUTH_BUNDLE, backend);
         }
-        const cacheKey = home ?? os.homedir();
-        const item = secretsKeychainItem(AUTH_BUNDLE, claudeAccountTokenKey(email));
+        const key = claudeAccountTokenKey(trimmed);
+        const ck = cacheKey ?? `email:${trimmed}`;
+        const item = secretsKeychainItem(AUTH_BUNDLE, key);
         const credentialPath = fileStoreItemPath(item);
         for (let attempt = 0; attempt < 2; attempt++) {
             const before = credentialFingerprint(credentialPath);
-            const cached = setupTokenCache.get(cacheKey);
+            const cached = setupTokenCache.get(ck);
             if (cached?.credentialPath === credentialPath && cached.fingerprint === before) {
                 return cached.token;
             }
             if (before === 'missing') {
-                setupTokenCache.set(cacheKey, { credentialPath, fingerprint: before, token: null });
+                setupTokenCache.set(ck, { credentialPath, fingerprint: before, token: null });
                 return null;
             }
             const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
-            const v = (env[claudeAccountTokenKey(email)] ?? '').trim();
+            const v = (env[key] ?? '').trim();
             const token = v.length > 0 && isValidClaudeSetupToken(v) ? v : null;
             const after = credentialFingerprint(credentialPath);
             if (before === after) {
-                setupTokenCache.set(cacheKey, { credentialPath, fingerprint: after, token });
+                setupTokenCache.set(ck, { credentialPath, fingerprint: after, token });
                 return token;
             }
         }
@@ -124,3 +145,36 @@ export function resolveClaudeSetupToken(home) {
         return null;
     }
 }
+/**
+ * Seed a keychain-less Linux worker's Claude version-home identity so an account's
+ * fleet-synced setup-token resolves for it. A worker home never had an interactive
+ * browser login, so its `.claude.json` carries no `oauthAccount.emailAddress` and
+ * the account reads "signed out" even though its non-rotating setup-token is present
+ * in the `auth` bundle. This writes ONLY the descriptive identity (the email), merged
+ * into both `.claude.json` locations Claude Code reads, preserving every other field.
+ * It never copies a rotating OAuth credential (`.credentials.json`) — the setup-token
+ * stays the credential of record.
+ */
+export function seedClaudeWorkerHomeIdentity(versionHome, email) {
+    const trimmed = email.trim();
+    if (!trimmed)
+        return;
+    for (const p of [
+        path.join(versionHome, '.claude', '.claude.json'),
+        path.join(versionHome, '.claude.json'),
+    ]) {
+        let doc = {};
+        try {
+            doc = JSON.parse(fs.readFileSync(p, 'utf-8'));
+        }
+        catch {
+            // Missing or unreadable at this location — write a fresh minimal document.
+        }
+        const existing = (doc.oauthAccount && typeof doc.oauthAccount === 'object'
+            ? doc.oauthAccount
+            : {});
+        doc.oauthAccount = { ...existing, emailAddress: trimmed };
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, JSON.stringify(doc));
+    }
+}

package/dist/lib/event-families.js

@@ -36,7 +36,7 @@ export function parseFamilyList(raw, flagName) {
 /** Command-churn event kinds. */
 export const COMMAND_EVENT_TYPES = ['command.start', 'command.end'];
 /** Run-dispatch outcome kinds (replaces the separate audit/log.jsonl product). */
-export const RUN_EVENT_TYPES = ['run.dispatched', 'agent.run.end'];
+export const RUN_EVENT_TYPES = ['run.dispatched', 'run.launch', 'agent.run.end'];
 /**
  * Fold family include/exclude into a UnifiedQuery.
  * Precedence: family narrows sources/types; field filters (module, event, …)

package/dist/lib/exec.d.ts

@@ -1,4 +1,5 @@
-import type { AgentId, Mode } from './types.js';
+import type { AgentId, Mode, RunStrategy } from './types.js';
+import { type EventPayload } from './feed/events.js';
 import { type UsernsStatus } from './linux-userns.js';
 /**
  * Agent execution modes. Canonical name `skip` (dangerously skip permissions);
@@ -212,6 +213,31 @@ export interface ExecOptions {
      * session. Also forced off by AGENTS_NO_TMUX=1. No effect on headless runs.
      */
     raw?: boolean;
+    /**
+     * The run strategy that resolved this launch (pinned/available/balanced).
+     * Observability-only: threaded from the `agents run` command purely so the
+     * pre-launch `run.launch` event can record HOW the version was chosen. Never
+     * read by the spawn itself.
+     */
+    strategy?: RunStrategy;
+    /**
+     * How the launched version was resolved (e.g. 'pinned-default', 'rotated',
+     * 'explicit-pin'), when cheaply determinable. Observability-only, carried on
+     * `run.launch`. Optional — omitted when the caller can't attribute it.
+     */
+    resolvedVia?: string;
+    /**
+     * Precomputed launchable-signed-in verdict for the launched version, supplied
+     * by a caller that already computed it via the identical gate (a rotated pick
+     * carries `rotationResult.picked.signedIn`). When present, `run.launch` uses it
+     * instead of re-probing the version home — removing a double fs read on the hot
+     * path and any disagreement window. `undefined` means "not precomputed" (the
+     * pinned-default / shim paths), which makes `emitRunLaunch` fall back to
+     * {@link isVersionLaunchableHere}. Observability-only.
+     */
+    launchSignedIn?: boolean | null;
+    /** Precomputed account email companion to {@link launchSignedIn}. */
+    launchEmail?: string | null;
 }
 /**
  * Identity a custom-harness run stamps on env / pid-registry / sidecars.
@@ -550,6 +576,45 @@ export declare function writeTmuxEnvFile(env: NodeJS.ProcessEnv, filePath: strin
  * `[detached]` the pane-died hook otherwise leaves behind.
  */
 export declare function formatPaneTail(raw: string, maxLines?: number): string;
+/**
+ * Spawn an agent process and return its exit code plus a tee'd copy of stderr.
+ *
+ * Stderr is always piped so the caller can inspect it (e.g., for rate-limit
+ * detection) while also forwarding every chunk to process.stderr in real time --
+ * the user sees the same output they would with stdio: 'inherit'. Stdout keeps
+ * the original behavior: 'pipe' when downstream output is piped (so `agents
+ * run ... | ...` composes cleanly), otherwise 'inherit' so TTY output is
+ * unbuffered.
+ */
+/** Inputs the pre-launch `run.launch` payload is built from. */
+export interface RunLaunchInput {
+    agent: AgentId;
+    harnessName?: string;
+    /** The version being launched, or undefined when none could be resolved. */
+    version?: string;
+    strategy?: RunStrategy;
+    /**
+     * Whether the launched version is launchable-signed-in on THIS device
+     * ({@link isVersionLaunchableHere}). `null` when the verdict is unknown — a
+     * missing verdict must NOT be read as logged out.
+     */
+    signedIn: boolean | null;
+    /** Account email of the version home when signed in, else null. */
+    email: string | null;
+    /** How the version was resolved (explicit-pin / rotated / pinned-default). */
+    resolvedVia?: string;
+}
+/**
+ * Build the `run.launch` event payload. Pure and exported so the signedIn ->
+ * launchedLoggedOut mapping is unit-testable without spawning. Mirrors the
+ * buildRotationDecisionEvent / emitRotationDecision split in rotate.ts.
+ *
+ * `launchedLoggedOut` is the headline flag — true ONLY when `signedIn` was
+ * resolved to false (a launch into a logged-out version, the yosemite-m3 2.1.219
+ * incident). An UNKNOWN verdict (`signedIn === null`) is never treated as
+ * logged out.
+ */
+export declare function buildRunLaunchPayload(input: RunLaunchInput): EventPayload;
 /** Exit code spawnAgent resolves with when a run is killed for crossing a budget cap. */
 export declare const BUDGET_KILL_EXIT_CODE = 7;
 /**

package/dist/lib/exec.js

@@ -14,7 +14,7 @@ import { parseTimeout } from './scheduling/routines.js';
 import { compareVersions, getBinaryPath, getVersionHomePath, isVersionInstalled, listInstalledVersions, resolveVersion } from './installations/versions.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { isTierToken, resolveTier } from './model-tiers.js';
-import { createTimer, redactPrompt, redactArgs } from './feed/events.js';
+import { emit, createTimer, redactPrompt, redactArgs } from './feed/events.js';
 import { sanitizeProcessEnv } from './secrets/bundles.js';
 import { resolveActor, actorEnv } from './actor.js';
 import { expandLocalHome } from './project-root.js';
@@ -1151,6 +1151,12 @@ export async function execShimPassthrough(agent, rawArgs, cwd, pinnedVersion) {
     // buildExecEnv — `installations/shims.ts` generateShimScript).
     const env = buildExecEnv({ agent, version, cwd, mode: defaultModeFor(agent), effort: 'auto', env: { AGENT_LAUNCH_ID: launchId } });
     const { command, args, shell } = resolveShimSpawn(process.platform, binary, [...launchArgs, ...rawArgs]);
+    // Pre-launch marker for the SECOND live launch path: the Windows generated
+    // `.cmd` shim delegates here and spawns the harness directly, so without this
+    // a pinned, logged-out version launched via the shim would be invisible —
+    // exactly the blind spot this event closes. Best-effort; re-derives the
+    // signed-in verdict from the pinned version home (no rotated pick here).
+    await emitRunLaunch({ agent, version, resolvedVia: 'shim' });
     return new Promise((resolve) => {
         const child = spawn(command, args, { cwd, stdio: 'inherit', env, shell });
         // Record the launch so `ag sessions --active` can attribute the agent
@@ -1633,15 +1639,88 @@ function emitResolvedSessionId(options, launchId, childPid) {
         process.stdout.write(sessionIdMarkerLine(sessionId));
 }
 /**
- * Spawn an agent process and return its exit code plus a tee'd copy of stderr.
+ * Build the `run.launch` event payload. Pure and exported so the signedIn ->
+ * launchedLoggedOut mapping is unit-testable without spawning. Mirrors the
+ * buildRotationDecisionEvent / emitRotationDecision split in rotate.ts.
  *
- * Stderr is always piped so the caller can inspect it (e.g., for rate-limit
- * detection) while also forwarding every chunk to process.stderr in real time --
- * the user sees the same output they would with stdio: 'inherit'. Stdout keeps
- * the original behavior: 'pipe' when downstream output is piped (so `agents
- * run ... | ...` composes cleanly), otherwise 'inherit' so TTY output is
- * unbuffered.
+ * `launchedLoggedOut` is the headline flag — true ONLY when `signedIn` was
+ * resolved to false (a launch into a logged-out version, the yosemite-m3 2.1.219
+ * incident). An UNKNOWN verdict (`signedIn === null`) is never treated as
+ * logged out.
  */
+export function buildRunLaunchPayload(input) {
+    return {
+        module: 'run',
+        agent: input.agent,
+        ...(input.harnessName ? { harnessName: input.harnessName } : {}),
+        // Omitted only when no version could be resolved at all — the typed `version`
+        // field can't carry null, and an absent version is honest.
+        version: input.version,
+        strategy: input.strategy ?? null,
+        signedIn: input.signedIn,
+        launchedLoggedOut: input.signedIn === false,
+        email: input.email,
+        ...(input.resolvedVia ? { resolvedVia: input.resolvedVia } : {}),
+    };
+}
+/**
+ * Emit the pre-launch `run.launch` observability event just before the harness
+ * child is spawned. Best-effort by construction — the whole point is that it can
+ * NEVER break a launch, so every step (the signed-in probe, the emit itself) is
+ * wrapped and a failure is swallowed. Mirrors the non-fatal pattern of
+ * recordDispatchedRun and emitRotationDecision.
+ *
+ * The `signedIn` verdict is for the SPECIFIC launched version on THIS device, so
+ * `launchedLoggedOut` catches a launch into a logged-out version that
+ * `--device auto` readiness let through (the yosemite-m3 2.1.219 incident). It is
+ * REUSED from `ctx.launchSignedIn` when the caller already computed it via the
+ * identical gate (the rotated pick — no double fs read, no disagreement window),
+ * and only otherwise re-derived via {@link isVersionLaunchableHere} (dynamically
+ * imported so the spawn path takes on no static dependency on the accounting
+ * layer).
+ */
+async function emitRunLaunch(ctx) {
+    try {
+        let signedIn;
+        let email;
+        if (ctx.launchSignedIn !== undefined) {
+            // Caller already computed the verdict for this exact version via the same
+            // gate — reuse it verbatim.
+            signedIn = ctx.launchSignedIn;
+            email = ctx.launchEmail ?? null;
+        }
+        else {
+            // Pinned-default / shim paths: probe the version home now. Without a
+            // concrete version we cannot probe, so leave the verdict unknown (null)
+            // rather than guess.
+            signedIn = null;
+            email = null;
+            if (ctx.version) {
+                try {
+                    const { isVersionLaunchableHere } = await import('./accounting/rotate.js');
+                    const state = await isVersionLaunchableHere(ctx.agent, ctx.version);
+                    signedIn = state.launchable;
+                    email = state.email;
+                }
+                catch {
+                    /* probe unavailable — record the launch without the signed-in verdict */
+                }
+            }
+        }
+        emit('run.launch', buildRunLaunchPayload({
+            agent: ctx.agent,
+            harnessName: ctx.harnessName,
+            version: ctx.version,
+            strategy: ctx.strategy,
+            signedIn,
+            email,
+            resolvedVia: ctx.resolvedVia,
+        }));
+    }
+    catch {
+        /* observability must never break a launch */
+    }
+}
 async function spawnAgent(options) {
     // Assign a known session id up front for agents that accept one, so the
     // launcher can record an EXACT pid -> session mapping (see pid-registry) —
@@ -1758,6 +1837,23 @@ async function spawnAgent(options) {
         timer.end({ exitCode: 1, status: 'failed', error: 'remote interactive run has no tmux for durability' });
         return { exitCode: 1, stdout: '', stderr: msg };
     }
+    // Pre-launch marker (`run.launch`), fired on THIS device right before the
+    // harness child is spawned — for BOTH the tmux-wrapped and bare paths below,
+    // and only once the undurable refusal above has passed (a refused run never
+    // spawns). Unlike `run.dispatched` (recordDispatchedRun, at FINALIZE), this
+    // records a launch that then sits stuck at a login screen and never finalizes,
+    // so a launch into a logged-out version is visible instead of silent. The
+    // signed-in verdict is REUSED from the rotated pick when the command threaded
+    // it (options.launchSignedIn), else re-derived from the version home.
+    await emitRunLaunch({
+        agent: options.agent,
+        harnessName: options.harnessName,
+        version: options.version ?? resolveVersion(options.agent, options.cwd || process.cwd()) ?? undefined,
+        strategy: options.strategy,
+        resolvedVia: options.resolvedVia,
+        launchSignedIn: options.launchSignedIn,
+        launchEmail: options.launchEmail,
+    });
     if (tmuxWrap.kind === 'wrap') {
         timer.mark('startup');
         try {

package/dist/lib/feed/events.d.ts

@@ -13,7 +13,7 @@
  */
 import type { ActorKind } from '../actor.js';
 export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'run.dispatched' | 'daemon.start' | 'daemon.stop' | 'daemon.error' | 'daemon.info' | 'routine.start' | 'routine.end' | 'watchdog.action' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'rotation.unresolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.failed' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'run.dispatched' | 'run.launch' | 'daemon.start' | 'daemon.stop' | 'daemon.error' | 'daemon.info' | 'routine.start' | 'routine.end' | 'watchdog.action' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'rotation.unresolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.failed' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
 /** Every known event kind. Derived from {@link EVENT_TYPE_TABLE}, never hand-listed. */
 export declare const EVENT_TYPES: readonly EventType[];
 /** Runtime guard for an event kind arriving from outside this process. */

package/dist/lib/feed/events.js

@@ -121,6 +121,7 @@ const FILE_MODE = 0o600;
 const EVENT_TYPE_TABLE = {
     'agent.run.start': true, 'agent.run.end': true, 'agent.spawn.start': true, 'agent.spawn.end': true,
     'run.dispatched': true,
+    'run.launch': true,
     'daemon.start': true, 'daemon.stop': true, 'daemon.error': true, 'daemon.info': true,
     'routine.start': true, 'routine.end': true,
     'watchdog.action': true,
@@ -158,6 +159,10 @@ export function isEventType(value) {
 const AUDIT_EVENTS = new Set([
     'command.start', 'command.end',
     'run.dispatched',
+    // Sibling of run.dispatched, and the MORE reliable signal for a stuck /
+    // logged-out launch (it fires pre-spawn, before an agent can hang at a login
+    // screen and never finalize). Must surface under --level audit --include runs.
+    'run.launch',
     'secrets.get', 'secrets.unlocked', 'secrets.create', 'secrets.import', 'secrets.export', 'secrets.view', 'secrets.lease-denied', 'secrets.lease-expire',
     'secrets.set', 'secrets.delete', 'secrets.rename',
     'teams.create', 'teams.add', 'teams.start', 'teams.complete', 'teams.disband',

package/dist/lib/feed-broadcast.js

@@ -38,6 +38,7 @@ import { isOwnerAlias, readOwnerDest, resolveSendEnvelope, deliverEnvelope } fro
 import { lookupTransport } from './channels/resolve.js';
 import { registerBuiltinProviders } from './channels/providers/index.js';
 import { sendToOwner } from './notify.js';
+import { forwardOwnerNotifyToPeer } from './channels/owner-forward.js';
 const LEVEL_RANK = { milestone: 0, important: 1 };
 /** Parse a `--level` value; anything unrecognized is a usage error, not a default. */
 export function parseFeedPostLevel(raw) {
@@ -500,6 +501,14 @@ async function runChannelSink(sink, meta) {
     const result = await deliverEnvelope(resolved.envelope, meta);
     if (result.ok)
         return { name, ok: true };
+    // Explicit rush-backed channel sinks need the same cross-device handoff as
+    // the owner alias. Linux workers do not carry the macOS Keychain-bound Rush
+    // transport, but feed posts originate on those workers routinely. Keep the
+    // destination explicit so the peer delivers exactly this sink once instead
+    // of expanding the owner's multi-channel policy.
+    const forwarded = await forwardOwnerNotifyToPeer(resolved.envelope.text, resolved.envelope.channel, resolved.envelope.to, meta);
+    if (forwarded?.ok)
+        return { name, ok: true };
     return { name, ok: false, error: result.error };
 }
 /**

package/dist/lib/identity/client.d.ts

@@ -17,11 +17,12 @@
 /**
  * Where the account backend lives. Config, never a literal at a call site.
  *
- * The default is the deployed Phoenix ID Worker. It is a `workers.dev` URL
- * rather than a vanity hostname because no custom domain is attached yet — and
- * a default naming an unregistered domain is worse than an ugly one: every
- * `agents auth login` would fail DNS with nothing to point at.
+ * The default is Phoenix ID's branded custom domain. The legacy workers.dev
+ * hostname remains live for already-released clients, but new clients and
+ * managed Workers must share this canonical base so token verification cannot
+ * drift across the release boundary.
  */
+export declare const DEFAULT_PHOENIX_ID_BASE = "https://id.byphoenix.com";
 export declare const PHOENIX_ID_BASE: string;
 /** Our own session file. agents-cli never reads another product's credentials. */
 export declare function sessionFilePath(): string;

package/dist/lib/identity/client.js

@@ -20,12 +20,13 @@ import { getRuntimeStateDir } from '../state.js';
 /**
  * Where the account backend lives. Config, never a literal at a call site.
  *
- * The default is the deployed Phoenix ID Worker. It is a `workers.dev` URL
- * rather than a vanity hostname because no custom domain is attached yet — and
- * a default naming an unregistered domain is worse than an ugly one: every
- * `agents auth login` would fail DNS with nothing to point at.
+ * The default is Phoenix ID's branded custom domain. The legacy workers.dev
+ * hostname remains live for already-released clients, but new clients and
+ * managed Workers must share this canonical base so token verification cannot
+ * drift across the release boundary.
  */
-export const PHOENIX_ID_BASE = process.env.PHOENIX_ID_BASE ?? 'https://phoenix-id.muqsitnawaz.workers.dev';
+export const DEFAULT_PHOENIX_ID_BASE = 'https://id.byphoenix.com';
+export const PHOENIX_ID_BASE = process.env.PHOENIX_ID_BASE ?? DEFAULT_PHOENIX_ID_BASE;
 /** Our own session file. agents-cli never reads another product's credentials. */
 export function sessionFilePath() {
     return path.join(getRuntimeStateDir(), 'phoenix-session.json');

package/dist/lib/session/active.d.ts

@@ -55,7 +55,7 @@ export declare function attributedSetLostPids(prev: Set<number>, next: Set<numbe
 export declare function filterCachedUnattributed(sessions: ActiveSession[], attributed: Set<number>, alive: (pid: number, startedAtMs?: number) => boolean): ActiveSession[];
 type ActiveContext = 'terminal' | 'teams' | 'cloud' | 'headless';
 /** The SessionMeta fields the live-row backfill reads — the enrichment a running process cannot report. */
-export type BackfillMeta = Pick<SessionMeta, 'version' | 'account' | 'timestamp' | 'label' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName' | 'harness'>;
+export type BackfillMeta = Pick<SessionMeta, 'version' | 'account' | 'timestamp' | 'label' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName' | 'harness' | 'tokenCount' | 'durationMs' | 'subAgentCount'>;
 export declare function backfillActiveRowsFromMeta(sessions: ActiveSession[], metaById: Map<string, BackfillMeta>): void;
 export declare function backfillActiveRowsFromIndex(sessions: ActiveSession[]): void;
 export declare function isRunningLiveSession(s: ActiveSession): boolean;
@@ -205,6 +205,15 @@ export interface ActiveSession {
     spawnedTeam?: string;
     /** Files/screenshots attached to the session prompt. */
     attachments?: SessionAttachment[];
+    /** Total tokens and elapsed duration from the indexed transcript. */
+    tokenCount?: number;
+    durationMs?: number;
+    /** Number of subagents launched, persisted by the index scanner. */
+    subAgentCount?: number;
+    /** Durable documents created in the live transcript tail. */
+    artifacts?: import('./highlights.js').ProducedArtifact[];
+    /** Created plan document singled out for plan-first consumers. */
+    planFile?: string;
     sessionFile?: string;
     startedAtMs?: number;
     /**

package/dist/lib/session/active.js

@@ -164,6 +164,12 @@ export function backfillActiveRowsFromMeta(sessions, metaById) {
             s.routineName = m.routineName;
         if (!s.harness && m.harness)
             s.harness = m.harness;
+        if (s.tokenCount == null && m.tokenCount != null)
+            s.tokenCount = m.tokenCount;
+        if (s.durationMs == null && m.durationMs != null)
+            s.durationMs = m.durationMs;
+        if (s.subAgentCount == null && m.subAgentCount != null)
+            s.subAgentCount = m.subAgentCount;
     }
 }
 function loadBackfillMetaFor(sessions) {
@@ -851,6 +857,8 @@ function applyState(base, state, fallbackFile, pidAlive) {
         createdTickets: state.createdTickets,
         spawnedTeam: state.spawnedTeam,
         attachments: state.attachments,
+        artifacts: state.artifacts,
+        planFile: state.planFile,
         rateLimited: state.rateLimited,
     };
 }

package/dist/lib/session/digest.js

@@ -98,9 +98,15 @@ export function classifyFileChanges(events) {
             deleted.delete(p); // a write after a delete recreates the file
         }
         else if (EDIT_TOOLS.has(tool)) {
-            modified.add(p);
+            if (args.patch_op === 'Add')
+                created.add(p);
+            else if (args.patch_op === 'Delete')
+                deleted.add(p);
+            else
+                modified.add(p);
             seen.add(p);
-            deleted.delete(p);
+            if (args.patch_op !== 'Delete')
+                deleted.delete(p);
         }
     }
     const out = [];

package/dist/lib/session/parse.d.ts

@@ -70,6 +70,10 @@ export declare function parseCodex(filePath: string): SessionEvent[];
  * Returns every path in order (a multi-file patch emits multiple paths so
  * artifact discovery sees each file — RUSH-1410). Empty when unparseable.
  */
+export declare function applyPatchTargets(input: string): Array<{
+    path: string;
+    op: 'Add' | 'Update' | 'Delete';
+}>;
 export declare function applyPatchTargetPaths(input: string): string[];
 /**
  * Parse Codex JSONL *content* (already read into a string) into normalized

package/dist/lib/session/parse.js

@@ -555,15 +555,18 @@ export function parseCodex(filePath) {
  * Returns every path in order (a multi-file patch emits multiple paths so
  * artifact discovery sees each file — RUSH-1410). Empty when unparseable.
  */
-export function applyPatchTargetPaths(input) {
-    const paths = [];
-    const re = /^\*\*\* (?:Update|Add|Delete) File: (.+)$/gm;
+export function applyPatchTargets(input) {
+    const targets = [];
+    const re = /^\*\*\* (Update|Add|Delete) File: (.+)$/gm;
     for (const m of input.matchAll(re)) {
-        const p = m[1].trim();
+        const p = m[2].trim();
         if (p)
-            paths.push(p);
+            targets.push({ path: p, op: m[1] });
     }
-    return paths;
+    return targets;
+}
+export function applyPatchTargetPaths(input) {
+    return applyPatchTargets(input).map((target) => target.path);
 }
 /** @deprecated Prefer applyPatchTargetPaths — kept for single-file call sites. */
 function applyPatchTargetPath(input) {
@@ -724,13 +727,15 @@ export function parseCodexContent(content) {
                 const execCommand = rawName === 'exec' ? codexExecCommand(input) : undefined;
                 // Multi-file patches: one tool_use per file so artifact discovery sees
                 // every path (RUSH-1410). Single-file / non-patch keep one event.
-                const patchPaths = isApplyPatch ? applyPatchTargetPaths(input) : [];
+                const patchTargets = isApplyPatch ? applyPatchTargets(input) : [];
                 const tool = isApplyPatch ? 'Edit' : rawName;
                 const truncatedInput = input.length > 500 ? input.slice(0, 497) + '...' : input;
-                const emitOne = (patchPath) => {
+                const emitOne = (patchPath, patchOp) => {
                     const args = { input: truncatedInput };
                     if (patchPath)
                         args.file_path = patchPath;
+                    if (patchOp)
+                        args.patch_op = patchOp;
                     if (execCommand)
                         args.command = execCommand;
                     const callId = payload.call_id || payload.id;
@@ -747,9 +752,9 @@ export function parseCodexContent(content) {
                         path: patchPath,
                     });
                 };
-                if (isApplyPatch && patchPaths.length > 0) {
-                    for (const p of patchPaths)
-                        emitOne(p);
+                if (isApplyPatch && patchTargets.length > 0) {
+                    for (const target of patchTargets)
+                        emitOne(target.path, target.op);
                 }
                 else {
                     emitOne(undefined);

package/dist/lib/session/state.d.ts

@@ -15,6 +15,7 @@
  * shape + mtime — same function, driven off the normalized events.
  */
 import type { SessionAttachment, SessionEvent, TodoItem, TodoProgress } from './types.js';
+import { type ProducedArtifact } from './highlights.js';
 export type { TodoItem, TodoProgress };
 export type SessionActivity = 'working' | 'waiting_input' | 'idle';
 export type AwaitingReason = 'question' | 'plan_review' | 'permission';
@@ -95,6 +96,10 @@ export interface SessionState {
      * checklist, notably for remote/device-dispatched agents with no local stream.
      */
     todos?: TodoProgress;
+    /** Durable documents created in the bounded transcript slice. */
+    artifacts?: ProducedArtifact[];
+    /** First created plan document, for consumers that give plans special treatment. */
+    planFile?: string;
     /** Last few assistant turns (most-recent last), one line each — panel context. */
     tail?: string[];
     lastActivityMs?: number;

package/dist/lib/session/state.js

@@ -17,6 +17,8 @@
 import * as path from 'path';
 import { isCompletedTodoStatus, SNAPSHOT_TODO_TOOLS, summarizeToolUse } from './parse.js';
 import { isShellExecTool } from './shell-programs.js';
+import { classifyFileChanges } from './digest.js';
+import { extractArtifacts } from './highlights.js';
 /**
  * Detect per-session rate-limit / usage-limit signals in assistant or error
  * text (RUSH-1523). Matches the same shapes the ext's prewarm detectBlockingPrompt
@@ -626,6 +628,8 @@ export function inferSessionState(events, ctx = {}) {
     const state = inferActivity(events, ctx);
     const { pr, ticket, createdTickets, spawnedTeam, attachments } = detectDurableSignals(events);
     const worktree = detectWorktree(ctx.cwd, ctx.gitBranch);
+    const artifacts = extractArtifacts(classifyFileChanges(events));
+    const planFile = artifacts.find((artifact) => artifact.bucket === 'plans')?.path;
     // Rate-limit: scan the most recent assistant messages + tool errors (tail-first).
     let rateLimited = false;
     for (let i = events.length - 1; i >= 0 && i >= events.length - 12; i--) {
@@ -651,6 +655,8 @@ export function inferSessionState(events, ctx = {}) {
         createdTickets,
         spawnedTeam,
         attachments,
+        artifacts: artifacts.length > 0 ? artifacts : undefined,
+        planFile,
         rateLimited: rateLimited || undefined,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.63",
+  "version": "1.22.64",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",