@phnx-labs/agents-cli 1.22.63 → 1.22.65

package/dist/lib/exec.js

@@ -14,7 +14,7 @@ import { parseTimeout } from './scheduling/routines.js';
 import { compareVersions, getBinaryPath, getVersionHomePath, isVersionInstalled, listInstalledVersions, resolveVersion } from './installations/versions.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { isTierToken, resolveTier } from './model-tiers.js';
-import { createTimer, redactPrompt, redactArgs } from './feed/events.js';
+import { emit, createTimer, redactPrompt, redactArgs } from './feed/events.js';
 import { sanitizeProcessEnv } from './secrets/bundles.js';
 import { resolveActor, actorEnv } from './actor.js';
 import { expandLocalHome } from './project-root.js';
@@ -1151,6 +1151,12 @@ export async function execShimPassthrough(agent, rawArgs, cwd, pinnedVersion) {
     // buildExecEnv — `installations/shims.ts` generateShimScript).
     const env = buildExecEnv({ agent, version, cwd, mode: defaultModeFor(agent), effort: 'auto', env: { AGENT_LAUNCH_ID: launchId } });
     const { command, args, shell } = resolveShimSpawn(process.platform, binary, [...launchArgs, ...rawArgs]);
+    // Pre-launch marker for the SECOND live launch path: the Windows generated
+    // `.cmd` shim delegates here and spawns the harness directly, so without this
+    // a pinned, logged-out version launched via the shim would be invisible —
+    // exactly the blind spot this event closes. Best-effort; re-derives the
+    // signed-in verdict from the pinned version home (no rotated pick here).
+    await emitRunLaunch({ agent, version, resolvedVia: 'shim' });
     return new Promise((resolve) => {
         const child = spawn(command, args, { cwd, stdio: 'inherit', env, shell });
         // Record the launch so `ag sessions --active` can attribute the agent
@@ -1633,15 +1639,88 @@ function emitResolvedSessionId(options, launchId, childPid) {
         process.stdout.write(sessionIdMarkerLine(sessionId));
 }
 /**
- * Spawn an agent process and return its exit code plus a tee'd copy of stderr.
+ * Build the `run.launch` event payload. Pure and exported so the signedIn ->
+ * launchedLoggedOut mapping is unit-testable without spawning. Mirrors the
+ * buildRotationDecisionEvent / emitRotationDecision split in rotate.ts.
  *
- * Stderr is always piped so the caller can inspect it (e.g., for rate-limit
- * detection) while also forwarding every chunk to process.stderr in real time --
- * the user sees the same output they would with stdio: 'inherit'. Stdout keeps
- * the original behavior: 'pipe' when downstream output is piped (so `agents
- * run ... | ...` composes cleanly), otherwise 'inherit' so TTY output is
- * unbuffered.
+ * `launchedLoggedOut` is the headline flag — true ONLY when `signedIn` was
+ * resolved to false (a launch into a logged-out version, the yosemite-m3 2.1.219
+ * incident). An UNKNOWN verdict (`signedIn === null`) is never treated as
+ * logged out.
  */
+export function buildRunLaunchPayload(input) {
+    return {
+        module: 'run',
+        agent: input.agent,
+        ...(input.harnessName ? { harnessName: input.harnessName } : {}),
+        // Omitted only when no version could be resolved at all — the typed `version`
+        // field can't carry null, and an absent version is honest.
+        version: input.version,
+        strategy: input.strategy ?? null,
+        signedIn: input.signedIn,
+        launchedLoggedOut: input.signedIn === false,
+        email: input.email,
+        ...(input.resolvedVia ? { resolvedVia: input.resolvedVia } : {}),
+    };
+}
+/**
+ * Emit the pre-launch `run.launch` observability event just before the harness
+ * child is spawned. Best-effort by construction — the whole point is that it can
+ * NEVER break a launch, so every step (the signed-in probe, the emit itself) is
+ * wrapped and a failure is swallowed. Mirrors the non-fatal pattern of
+ * recordDispatchedRun and emitRotationDecision.
+ *
+ * The `signedIn` verdict is for the SPECIFIC launched version on THIS device, so
+ * `launchedLoggedOut` catches a launch into a logged-out version that
+ * `--device auto` readiness let through (the yosemite-m3 2.1.219 incident). It is
+ * REUSED from `ctx.launchSignedIn` when the caller already computed it via the
+ * identical gate (the rotated pick — no double fs read, no disagreement window),
+ * and only otherwise re-derived via {@link isVersionLaunchableHere} (dynamically
+ * imported so the spawn path takes on no static dependency on the accounting
+ * layer).
+ */
+async function emitRunLaunch(ctx) {
+    try {
+        let signedIn;
+        let email;
+        if (ctx.launchSignedIn !== undefined) {
+            // Caller already computed the verdict for this exact version via the same
+            // gate — reuse it verbatim.
+            signedIn = ctx.launchSignedIn;
+            email = ctx.launchEmail ?? null;
+        }
+        else {
+            // Pinned-default / shim paths: probe the version home now. Without a
+            // concrete version we cannot probe, so leave the verdict unknown (null)
+            // rather than guess.
+            signedIn = null;
+            email = null;
+            if (ctx.version) {
+                try {
+                    const { isVersionLaunchableHere } = await import('./accounting/rotate.js');
+                    const state = await isVersionLaunchableHere(ctx.agent, ctx.version);
+                    signedIn = state.launchable;
+                    email = state.email;
+                }
+                catch {
+                    /* probe unavailable — record the launch without the signed-in verdict */
+                }
+            }
+        }
+        emit('run.launch', buildRunLaunchPayload({
+            agent: ctx.agent,
+            harnessName: ctx.harnessName,
+            version: ctx.version,
+            strategy: ctx.strategy,
+            signedIn,
+            email,
+            resolvedVia: ctx.resolvedVia,
+        }));
+    }
+    catch {
+        /* observability must never break a launch */
+    }
+}
 async function spawnAgent(options) {
     // Assign a known session id up front for agents that accept one, so the
     // launcher can record an EXACT pid -> session mapping (see pid-registry) —
@@ -1758,6 +1837,23 @@ async function spawnAgent(options) {
         timer.end({ exitCode: 1, status: 'failed', error: 'remote interactive run has no tmux for durability' });
         return { exitCode: 1, stdout: '', stderr: msg };
     }
+    // Pre-launch marker (`run.launch`), fired on THIS device right before the
+    // harness child is spawned — for BOTH the tmux-wrapped and bare paths below,
+    // and only once the undurable refusal above has passed (a refused run never
+    // spawns). Unlike `run.dispatched` (recordDispatchedRun, at FINALIZE), this
+    // records a launch that then sits stuck at a login screen and never finalizes,
+    // so a launch into a logged-out version is visible instead of silent. The
+    // signed-in verdict is REUSED from the rotated pick when the command threaded
+    // it (options.launchSignedIn), else re-derived from the version home.
+    await emitRunLaunch({
+        agent: options.agent,
+        harnessName: options.harnessName,
+        version: options.version ?? resolveVersion(options.agent, options.cwd || process.cwd()) ?? undefined,
+        strategy: options.strategy,
+        resolvedVia: options.resolvedVia,
+        launchSignedIn: options.launchSignedIn,
+        launchEmail: options.launchEmail,
+    });
     if (tmuxWrap.kind === 'wrap') {
         timer.mark('startup');
         try {

package/dist/lib/feed/events.d.ts

@@ -13,7 +13,7 @@
  */
 import type { ActorKind } from '../actor.js';
 export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'run.dispatched' | 'daemon.start' | 'daemon.stop' | 'daemon.error' | 'daemon.info' | 'routine.start' | 'routine.end' | 'watchdog.action' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'rotation.unresolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.failed' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'run.dispatched' | 'run.launch' | 'daemon.start' | 'daemon.stop' | 'daemon.error' | 'daemon.info' | 'routine.start' | 'routine.end' | 'watchdog.action' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'rotation.unresolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.failed' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
 /** Every known event kind. Derived from {@link EVENT_TYPE_TABLE}, never hand-listed. */
 export declare const EVENT_TYPES: readonly EventType[];
 /** Runtime guard for an event kind arriving from outside this process. */

package/dist/lib/feed/events.js

@@ -121,6 +121,7 @@ const FILE_MODE = 0o600;
 const EVENT_TYPE_TABLE = {
     'agent.run.start': true, 'agent.run.end': true, 'agent.spawn.start': true, 'agent.spawn.end': true,
     'run.dispatched': true,
+    'run.launch': true,
     'daemon.start': true, 'daemon.stop': true, 'daemon.error': true, 'daemon.info': true,
     'routine.start': true, 'routine.end': true,
     'watchdog.action': true,
@@ -158,6 +159,10 @@ export function isEventType(value) {
 const AUDIT_EVENTS = new Set([
     'command.start', 'command.end',
     'run.dispatched',
+    // Sibling of run.dispatched, and the MORE reliable signal for a stuck /
+    // logged-out launch (it fires pre-spawn, before an agent can hang at a login
+    // screen and never finalize). Must surface under --level audit --include runs.
+    'run.launch',
     'secrets.get', 'secrets.unlocked', 'secrets.create', 'secrets.import', 'secrets.export', 'secrets.view', 'secrets.lease-denied', 'secrets.lease-expire',
     'secrets.set', 'secrets.delete', 'secrets.rename',
     'teams.create', 'teams.add', 'teams.start', 'teams.complete', 'teams.disband',

package/dist/lib/feed-broadcast.d.ts

@@ -42,6 +42,8 @@ export interface FeedBroadcastContext {
     level: FeedPostLevel;
     /** Tracker id for the work, e.g. `RUSH-2081`. */
     ticket?: string;
+    /** Canonical clickable tracker URL for `ticket`, when the tracker can resolve it. */
+    ticketUrl?: string;
     /** Repo/project the post came from. */
     project?: string;
     agent?: string;

package/dist/lib/feed-broadcast.js

@@ -38,6 +38,8 @@ import { isOwnerAlias, readOwnerDest, resolveSendEnvelope, deliverEnvelope } fro
 import { lookupTransport } from './channels/resolve.js';
 import { registerBuiltinProviders } from './channels/providers/index.js';
 import { sendToOwner } from './notify.js';
+import { linearIssueUrl } from './session/linear.js';
+import { forwardOwnerNotifyToPeer } from './channels/owner-forward.js';
 const LEVEL_RANK = { milestone: 0, important: 1 };
 /** Parse a `--level` value; anything unrecognized is a usage error, not a default. */
 export function parseFeedPostLevel(raw) {
@@ -77,6 +79,7 @@ export function blockBroadcastContext(block, extras = {}) {
         text,
         level: 'important',
         ticket: block.ticket,
+        ticketUrl: linearIssueUrl(block.ticket),
         project: extras.project,
         agent: extras.agent,
         host: block.host,
@@ -117,7 +120,7 @@ export function blockDeliveryFailure(blocked, outcomes) {
     }
     return undefined;
 }
-const PLACEHOLDER = /\{([a-z]+)\}/g;
+const PLACEHOLDER = /\{([a-z_]+)\}/g;
 /**
  * Short host label for a phone line — strip user@ and domain so
  * `muqsit@mac-mini.tailnet.ts.net` reads as `mac-mini`.
@@ -240,7 +243,9 @@ export function composeBroadcastMessage(ctx) {
     const head = title || body;
     const mid = title && body && title !== body ? body : undefined;
     const footer = composeBroadcastFooter(ctx);
-    const link = ctx.links?.find((l) => /^https?:\/\//i.test(l));
+    const links = [ctx.ticketUrl, ...(ctx.links ?? [])]
+        .filter((l) => !!l && /^https?:\/\//i.test(l))
+        .filter((l, i, all) => all.indexOf(l) === i);
     // The action block: the one thing the operator can act on from a phone. Show the
     // choices, then what happens if they do not answer. Deliberately NOT a CLI command
     // (`agents focus <id>` is unusable from a phone) -- the safe default is the real
@@ -255,7 +260,7 @@ export function composeBroadcastMessage(ctx) {
         : undefined;
     const action = [choices, fallback].filter(Boolean).join('\n') || undefined;
     // Link trail after the "Sent from" footer so the human sentence stays at the top.
-    const trail = [footer, link].filter(Boolean);
+    const trail = [footer, ...links].filter(Boolean);
     const parts = [];
     if (head)
         parts.push(head);
@@ -284,6 +289,7 @@ function templateVars(ctx) {
         title: ctx.title,
         text: ctx.text,
         ticket: ctx.ticket,
+        ticket_url: ctx.ticketUrl,
         project: ctx.project,
         agent: ctx.agent,
         host: ctx.host,
@@ -338,7 +344,20 @@ export function renderSinkMessage(template, ctx) {
     });
     if (missing)
         return undefined;
-    const text = rendered.trim();
+    const seenUrls = new Set();
+    const text = rendered
+        .trim()
+        .split('\n')
+        .filter((line) => {
+        const value = line.trim();
+        if (!/^https?:\/\/\S+$/i.test(value))
+            return true;
+        if (seenUrls.has(value))
+            return false;
+        seenUrls.add(value);
+        return true;
+    })
+        .join('\n');
     return text || undefined;
 }
 /**
@@ -500,6 +519,14 @@ async function runChannelSink(sink, meta) {
     const result = await deliverEnvelope(resolved.envelope, meta);
     if (result.ok)
         return { name, ok: true };
+    // Explicit rush-backed channel sinks need the same cross-device handoff as
+    // the owner alias. Linux workers do not carry the macOS Keychain-bound Rush
+    // transport, but feed posts originate on those workers routinely. Keep the
+    // destination explicit so the peer delivers exactly this sink once instead
+    // of expanding the owner's multi-channel policy.
+    const forwarded = await forwardOwnerNotifyToPeer(resolved.envelope.text, resolved.envelope.channel, resolved.envelope.to, meta);
+    if (forwarded?.ok)
+        return { name, ok: true };
     return { name, ok: false, error: result.error };
 }
 /**

package/dist/lib/harness/adapters/claude.js

@@ -28,28 +28,33 @@ export const claudeAdapter = {
         // The `auth` bundle's setup-token exists so a run with NO human present
         // authenticates without the Touch-ID-gated login item — usage probes,
         // routines, dispatched runs (claude-account-token.ts). It is a WORKER
-        // credential. Two kinds of run defer to the per-version login instead:
+        // credential. Exactly one kind of run defers to the per-version login
+        // instead: ANY run on a `personal`/`desktop` (headed) device — the user's
+        // own interactive box (zion), marked `config.role: personal`. That box
+        // holds a real per-version login and is the single origin of it, so every
+        // run there — interactive TUI OR a headless one-shot like `agents run
+        // claude "fix the bug"` — MUST use that login, not the setup-token. Keying
+        // the credential on DEVICE ROLE, not run mode, is RUSH-2395's fix: gating on
+        // `ctx.interactive` alone sent a headless run on the laptop onto the
+        // setup-token and hijacked the login.
         //
-        //   1. An interactive run: a human is at the TTY, and their per-version login
-        //      is the credential they established and expect. Overriding it made
-        //      `/status` report `Auth token: CLAUDE_CODE_OAUTH_TOKEN` on a personal
-        //      machine and took every hand-driven session off that login.
-        //   2. ANY run on a `personal` device — the user's own interactive box (zion),
-        //      marked `config.role: personal`. That box holds a real per-version login
-        //      and is the single origin of it, so every run there — interactive TUI OR
-        //      a headless one-shot like `agents run claude "fix the bug"` — MUST use
-        //      that login, not the setup-token. Gating on run mode ALONE
-        //      (resolveInteractive = "this opens a TUI", NOT "a human is present")
-        //      sent a headless run on the laptop onto the setup-token and hijacked the
-        //      login. Keying the credential on DEVICE ROLE is the fix — RUSH-2395.
+        // A WORKER device carries no such login regardless of interactive/headless:
+        // an interactive run there is a remotely dispatched TUI (`agents run claude
+        // --interactive --device <worker>`), not a human sitting at that box's own
+        // Keychain-trusted session — the same worker credential headless runs use is
+        // the only credential that exists to authenticate it. Treating `interactive`
+        // as "defer to native login" regardless of device role left a keychain-less
+        // worker with NO injected token and a per-version `.credentials.json` that
+        // was never written, so the run landed on Claude Code's login screen instead
+        // of authenticating (PHNX-3502).
         //
         // macOS cannot cheaply confirm a home's login first (probing the Keychain
         // raises an authorization sheet per installed version on the `agents run` hot
-        // path — agents.ts `isClaudeCredentialFileBlank`), so this path defers to
-        // Claude Code, which reads its own ACL-trusted login item without a prompt and
-        // asks a present human to log in only if the login is missing.
+        // path — agents.ts `isClaudeCredentialFileBlank`), so the headed-device path
+        // defers to Claude Code, which reads its own ACL-trusted login item without a
+        // prompt and asks a present human to log in only if the login is missing.
         const headedDevice = isHeadedDeviceRole(ctx.deviceRole);
-        if (ctx.interactive || headedDevice) {
+        if (headedDevice) {
             // Drop an INHERITED copy of OUR OWN setup-token: a launch from inside a
             // headless agent's shell inherits that agent's injected value via
             // sanitizeProcessEnv(process.env) and would keep authenticating as it,
@@ -66,16 +71,17 @@ export const claudeAdapter = {
             }
         }
         else {
-            // Headless run on a NON-personal device (worker, dispatched, provisioned
-            // box): mirror the routines path (`runner.ts`) UNCONDITIONALLY. Inject the
-            // per-account setup-token when one resolves — it replaces any ambient shared
-            // value inherited from the launcher. When NONE resolves, STRIP the ambient
-            // CLAUDE_CODE_OAUTH_TOKEN so a run on a provisioned box can never silently
-            // authenticate as the shared, rotating token an earlier version of this path
-            // let through — the RUSH-1822 fleet-wide-logout hazard, tracked by RUSH-2360.
-            // A missing login then fails loud (401) against this home's own credential
-            // instead of quietly borrowing another's. options.env still wins below for an
-            // explicit caller override.
+            // Any run on a NON-personal device (worker, dispatched, provisioned box) —
+            // interactive OR headless: mirror the routines path (`runner.ts`)
+            // UNCONDITIONALLY. Inject the per-account setup-token when one resolves —
+            // it replaces any ambient shared value inherited from the launcher. When
+            // NONE resolves, STRIP the ambient CLAUDE_CODE_OAUTH_TOKEN so a run on a
+            // provisioned box can never silently authenticate as the shared, rotating
+            // token an earlier version of this path let through — the RUSH-1822
+            // fleet-wide-logout hazard, tracked by RUSH-2360. A missing login then
+            // fails loud (401) against this home's own credential instead of quietly
+            // borrowing another's. options.env still wins below for an explicit
+            // caller override.
             if (setupToken) {
                 result.CLAUDE_CODE_OAUTH_TOKEN = setupToken;
             }

package/dist/lib/hosts/passthrough.d.ts

@@ -25,6 +25,23 @@ export { flagValue, hasHostRoutingFlag } from './routing-flag.js';
 interface RemoteSpec {
     /** Flags appended when running non-interactively (no local TTY / `--no-tty`). */
     nonInteractive?: string[];
+    /**
+     * Pure read-only RENDER command: draws a screen and exits, never reads stdin.
+     * Forwarded over a PLAIN PIPE rather than `ssh -tt` (a forced PTY), because the
+     * PTY teardown + local-terminal restore on a CLEAN exit wipes the just-drawn
+     * output — so the render "flashes and vanishes" the moment it finishes
+     * (PHNX-3583). Over a pipe the output persists exactly as the working non-TTY
+     * path already proves; color and terminal geometry are forced into the remote
+     * env so it still comes back colored and correctly wrapped
+     * ({@link renderForwardDecision}).
+     */
+    render?: boolean;
+    /**
+     * For a {@link render} command with a NARROW interactive sub-path, return `true`
+     * when THIS argv hits it — the PTY is kept for that one invocation. Absent means
+     * the command never prompts, so it is always safe to forward over a pipe.
+     */
+    interactiveWhen?: (forwarded: string[]) => boolean;
 }
 /**
  * First-class groups that run transparently on a remote via SSH when
@@ -58,6 +75,33 @@ export declare const OWN_HOST_COMMANDS: Set<string>;
  * (RUSH-2864).
  */
 export declare function buildPassthroughForwardedArgs(command: string, allArgs: string[], interactive: boolean): string[];
+/**
+ * Decide whether a `--device` passthrough should forward over a PLAIN PIPE
+ * instead of a PTY, and what color/geometry env to inject when it does.
+ *
+ * A pure read-only render ({@link RemoteSpec.render}) drawn under a forced
+ * `ssh -tt` PTY vanishes on clean exit: the PTY teardown + local-terminal
+ * restore (`restoreLocalTerminal` in ssh-exec.ts) wipes the output the command
+ * just drew (PHNX-3583). The non-TTY (piped) path never had this problem, so a
+ * render command takes it too — but only when a human is actually at a real
+ * local terminal (`isTTY` and not `--no-tty`); a genuinely piped local run is
+ * already on the pipe path and wants neither color nor forced geometry.
+ *
+ * A render command's narrow interactive sub-path ({@link RemoteSpec.interactiveWhen},
+ * e.g. `view --prune`'s confirm) keeps the PTY. When forwarding over a pipe the
+ * remote sees `isTTY=false`, so chalk goes colorless and `terminalWidth()` has no
+ * `$COLUMNS` to read; `FORCE_COLOR`/`COLUMNS`/`LINES` restore both. `FORCE_COLOR`
+ * is withheld under `--json` so it can never taint machine-readable output.
+ */
+export declare function renderForwardDecision(command: string, allArgs: string[], io: {
+    isTTY: boolean;
+    noTty: boolean;
+    columns?: number;
+    rows?: number;
+}): {
+    noPty: boolean;
+    env?: Record<string, string>;
+};
 /** Injectable dependencies for {@link runFleetPassthrough} — used by tests. */
 export interface FleetPassthroughOptions {
     /** Override the device registry loader (tests). */

package/dist/lib/hosts/passthrough.js

@@ -54,14 +54,23 @@ export { flagValue, hasHostRoutingFlag } from './routing-flag.js';
  * `add`/`use`/`list`, and none) and were removed.
  */
 export const REMOTE_PASSTHROUGH = {
-    // inspect
-    view: {},
-    inspect: {},
-    doctor: {},
+    // inspect — pure read-only renders: forward over a pipe, never a forced PTY
+    // (PHNX-3583), so the drawn output persists instead of vanishing on exit.
+    view: {
+        render: true,
+        // Only `--prune` (without --yes/--dry-run) asks a confirm(); that one
+        // invocation needs the PTY. Every other `view` is a pure render.
+        interactiveWhen: (f) => f.includes('--prune') &&
+            !f.includes('--dry-run') &&
+            !f.includes('--yes') &&
+            !f.includes('-y'),
+    },
+    inspect: { render: true },
+    doctor: { render: true },
     check: {},
     list: {},
     usage: {},
-    insights: {},
+    insights: { render: true },
     // config / resources
     config: {},
     sync: { nonInteractive: ['--yes'] },
@@ -162,6 +171,41 @@ export function buildPassthroughForwardedArgs(command, allArgs, interactive) {
     }
     return forwarded;
 }
+/**
+ * Decide whether a `--device` passthrough should forward over a PLAIN PIPE
+ * instead of a PTY, and what color/geometry env to inject when it does.
+ *
+ * A pure read-only render ({@link RemoteSpec.render}) drawn under a forced
+ * `ssh -tt` PTY vanishes on clean exit: the PTY teardown + local-terminal
+ * restore (`restoreLocalTerminal` in ssh-exec.ts) wipes the output the command
+ * just drew (PHNX-3583). The non-TTY (piped) path never had this problem, so a
+ * render command takes it too — but only when a human is actually at a real
+ * local terminal (`isTTY` and not `--no-tty`); a genuinely piped local run is
+ * already on the pipe path and wants neither color nor forced geometry.
+ *
+ * A render command's narrow interactive sub-path ({@link RemoteSpec.interactiveWhen},
+ * e.g. `view --prune`'s confirm) keeps the PTY. When forwarding over a pipe the
+ * remote sees `isTTY=false`, so chalk goes colorless and `terminalWidth()` has no
+ * `$COLUMNS` to read; `FORCE_COLOR`/`COLUMNS`/`LINES` restore both. `FORCE_COLOR`
+ * is withheld under `--json` so it can never taint machine-readable output.
+ */
+export function renderForwardDecision(command, allArgs, io) {
+    const spec = REMOTE_PASSTHROUGH[command];
+    const localTty = io.isTTY && !io.noTty;
+    if (!spec?.render || !localTty)
+        return { noPty: false };
+    const forwarded = stripRoutingFlags(allArgs, STRIP_SPECS);
+    if (spec.interactiveWhen?.(forwarded))
+        return { noPty: false };
+    const env = {};
+    if (!allArgs.includes('--json'))
+        env.FORCE_COLOR = '1';
+    if (io.columns && io.columns > 0)
+        env.COLUMNS = String(io.columns);
+    if (io.rows && io.rows > 0)
+        env.LINES = String(io.rows);
+    return { noPty: true, env: Object.keys(env).length ? env : undefined };
+}
 /** Synthesize a `Host` for a raw `user@host` / bare-alias target (not enrolled). */
 function syntheticHost(target) {
     const at = target.indexOf('@');
@@ -554,10 +598,21 @@ export async function maybeRunOnHost(command, allArgs, opts) {
         return true;
     }
     const target = sshTargetFor(host);
+    // A read-only render (view/inspect/insights/doctor) must forward over a plain
+    // pipe even from a real terminal — a forced `ssh -tt` PTY wipes its output on
+    // clean exit (PHNX-3583). renderForwardDecision returns that choice plus the
+    // color/geometry env that keeps a piped render colored and correctly wrapped.
+    const { noPty: renderNoPty, env: renderForwardEnv } = renderForwardDecision(command, allArgs, {
+        isTTY: !!process.stdout.isTTY,
+        noTty: allArgs.includes('--no-tty'),
+        columns: process.stdout.columns,
+        rows: process.stdout.rows,
+    });
     // Interactive only when our own stdout is a terminal and the caller didn't opt
     // out — otherwise force the command's non-interactive path so no half-drawn
-    // picker is piped into a file or another program.
-    const interactive = !!process.stdout.isTTY && !allArgs.includes('--no-tty');
+    // picker is piped into a file or another program. A no-PTY render is
+    // non-interactive by construction.
+    const interactive = !!process.stdout.isTTY && !allArgs.includes('--no-tty') && !renderNoPty;
     const forwarded = buildPassthroughForwardedArgs(command, allArgs, interactive);
     // The one long-running case: keep the remote team supervisor alive past a
     // disconnect by dispatching it detached (nohup), still streaming live.
@@ -583,10 +638,13 @@ export async function maybeRunOnHost(command, allArgs, opts) {
     const doctorPath = isDoctorCommand && !/^win/i.test((remoteOs ?? '').trim())
         ? { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' }
         : undefined;
+    // Merge the doctor PATH bootstrap with the render color/geometry env (doctor is
+    // itself a render command, so both can apply). undefined when neither is needed.
+    const extraEnv = doctorPath || renderForwardEnv ? { ...doctorPath, ...renderForwardEnv } : undefined;
     process.exitCode = streamAgentsOnHost(host, forwarded, {
         remoteCwd,
         interactive,
-        extraEnv: doctorPath,
+        extraEnv,
         remoteOs,
         target,
     });

package/dist/lib/identity/client.d.ts

@@ -17,11 +17,12 @@
 /**
  * Where the account backend lives. Config, never a literal at a call site.
  *
- * The default is the deployed Phoenix ID Worker. It is a `workers.dev` URL
- * rather than a vanity hostname because no custom domain is attached yet — and
- * a default naming an unregistered domain is worse than an ugly one: every
- * `agents auth login` would fail DNS with nothing to point at.
+ * The default is Phoenix ID's branded custom domain. The legacy workers.dev
+ * hostname remains live for already-released clients, but new clients and
+ * managed Workers must share this canonical base so token verification cannot
+ * drift across the release boundary.
  */
+export declare const DEFAULT_PHOENIX_ID_BASE = "https://id.byphoenix.com";
 export declare const PHOENIX_ID_BASE: string;
 /** Our own session file. agents-cli never reads another product's credentials. */
 export declare function sessionFilePath(): string;

package/dist/lib/identity/client.js

@@ -20,12 +20,13 @@ import { getRuntimeStateDir } from '../state.js';
 /**
  * Where the account backend lives. Config, never a literal at a call site.
  *
- * The default is the deployed Phoenix ID Worker. It is a `workers.dev` URL
- * rather than a vanity hostname because no custom domain is attached yet — and
- * a default naming an unregistered domain is worse than an ugly one: every
- * `agents auth login` would fail DNS with nothing to point at.
+ * The default is Phoenix ID's branded custom domain. The legacy workers.dev
+ * hostname remains live for already-released clients, but new clients and
+ * managed Workers must share this canonical base so token verification cannot
+ * drift across the release boundary.
  */
-export const PHOENIX_ID_BASE = process.env.PHOENIX_ID_BASE ?? 'https://phoenix-id.muqsitnawaz.workers.dev';
+export const DEFAULT_PHOENIX_ID_BASE = 'https://id.byphoenix.com';
+export const PHOENIX_ID_BASE = process.env.PHOENIX_ID_BASE ?? DEFAULT_PHOENIX_ID_BASE;
 /** Our own session file. agents-cli never reads another product's credentials. */
 export function sessionFilePath() {
     return path.join(getRuntimeStateDir(), 'phoenix-session.json');

package/dist/lib/session/active.d.ts

@@ -55,7 +55,7 @@ export declare function attributedSetLostPids(prev: Set<number>, next: Set<numbe
 export declare function filterCachedUnattributed(sessions: ActiveSession[], attributed: Set<number>, alive: (pid: number, startedAtMs?: number) => boolean): ActiveSession[];
 type ActiveContext = 'terminal' | 'teams' | 'cloud' | 'headless';
 /** The SessionMeta fields the live-row backfill reads — the enrichment a running process cannot report. */
-export type BackfillMeta = Pick<SessionMeta, 'version' | 'account' | 'timestamp' | 'label' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName' | 'harness'>;
+export type BackfillMeta = Pick<SessionMeta, 'version' | 'account' | 'timestamp' | 'label' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName' | 'harness' | 'tokenCount' | 'durationMs' | 'subAgentCount'>;
 export declare function backfillActiveRowsFromMeta(sessions: ActiveSession[], metaById: Map<string, BackfillMeta>): void;
 export declare function backfillActiveRowsFromIndex(sessions: ActiveSession[]): void;
 export declare function isRunningLiveSession(s: ActiveSession): boolean;
@@ -205,6 +205,15 @@ export interface ActiveSession {
     spawnedTeam?: string;
     /** Files/screenshots attached to the session prompt. */
     attachments?: SessionAttachment[];
+    /** Total tokens and elapsed duration from the indexed transcript. */
+    tokenCount?: number;
+    durationMs?: number;
+    /** Number of subagents launched, persisted by the index scanner. */
+    subAgentCount?: number;
+    /** Durable documents created in the live transcript tail. */
+    artifacts?: import('./highlights.js').ProducedArtifact[];
+    /** Created plan document singled out for plan-first consumers. */
+    planFile?: string;
     sessionFile?: string;
     startedAtMs?: number;
     /**

package/dist/lib/session/active.js

@@ -164,6 +164,12 @@ export function backfillActiveRowsFromMeta(sessions, metaById) {
             s.routineName = m.routineName;
         if (!s.harness && m.harness)
             s.harness = m.harness;
+        if (s.tokenCount == null && m.tokenCount != null)
+            s.tokenCount = m.tokenCount;
+        if (s.durationMs == null && m.durationMs != null)
+            s.durationMs = m.durationMs;
+        if (s.subAgentCount == null && m.subAgentCount != null)
+            s.subAgentCount = m.subAgentCount;
     }
 }
 function loadBackfillMetaFor(sessions) {
@@ -851,6 +857,8 @@ function applyState(base, state, fallbackFile, pidAlive) {
         createdTickets: state.createdTickets,
         spawnedTeam: state.spawnedTeam,
         attachments: state.attachments,
+        artifacts: state.artifacts,
+        planFile: state.planFile,
         rateLimited: state.rateLimited,
     };
 }

package/dist/lib/session/digest.js

@@ -98,9 +98,15 @@ export function classifyFileChanges(events) {
             deleted.delete(p); // a write after a delete recreates the file
         }
         else if (EDIT_TOOLS.has(tool)) {
-            modified.add(p);
+            if (args.patch_op === 'Add')
+                created.add(p);
+            else if (args.patch_op === 'Delete')
+                deleted.add(p);
+            else
+                modified.add(p);
             seen.add(p);
-            deleted.delete(p);
+            if (args.patch_op !== 'Delete')
+                deleted.delete(p);
         }
     }
     const out = [];