@phnx-labs/agents-cli 1.22.65 → 1.22.68

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 1.22.68
+
+Fix OpenCode session history to index and backfill the genuine first user request.
+
+- **`agents sessions resume` is native-first with same-harness account rotation, and records the origin version so it stops falling back (PHNX-3626).** Resume continues the SAME session with the harness's own native resume (`claude --resume <id>`, codex/grok/opencode native) on its recorded `agent@version` + device, rather than spinning up a fresh `/continue` transcript replay. When the origin account is rate/usage/session-limited, recovery rotates to a healthy INJECTABLE provider account of the same harness and stays native in the origin home (`--strategy balanced`, the same weighted-by-headroom picker dispatch uses); `/continue` replay is now the last-resort fallback only when no native path or no healthy same-harness account exists. The origin version is recorded forward at launch — `buildExecEnv` exports `AGENTS_RUN_VERSION`, the SessionStart hook joins it to the harness's real session id in the durable sidecar (like the launch mode), and the scan joins it at row build (`meta.version ?? actorRec.version`) and write-once COALESCEs it into the index — so a codex session whose transcript carried no derivable version (its relocated `.codex-homes/<version>/` home, which the scanner now also reads) no longer degrades to `/continue` for a missing recorded origin. Resume prefers the recorded device and falls back to a clearly-labelled local `/continue` replay from the synced mirror when that device is genuinely unreachable. Source: `cli/src/lib/session/recovery.ts`, `cli/src/lib/exec.ts`, `cli/src/commands/resume.ts`, `cli/src/lib/session/actor-sidecar.ts`, `cli/src/lib/session/db.ts`, `cli/src/lib/session/discover.ts`, `cli/src/lib/accounting/account-pool-collect.ts`, `packages/session-tracker/src/hook.sh`.
+
+- **`agents artifacts share --private/--unlisted` had no read authentication — private shares were world-readable by URL (PHNX-3654).** The share Worker's GET served any object with `cache-control: public` after only existence + expiry checks, so `--private`/`--unlisted` were obscurity, not authentication, and a private share could get a title-derived guessable slug. Two fixes ship together. **(A)** An `unlisted`/`--private` publish now prints a loud stderr warning that unlisted is NOT authenticated and points at the real controls, and forces a **64-bit random slug tail** (regardless of `--label`/title) so the capability URL can't be guessed. **(B)** A new **`--protected`** flag (= `--visibility private`) is token-gated read auth: the CLI mints a random viewer token, the Worker stores only its **SHA-256 hash** (`viewer-token-hash`) and serves the object — its page, generated OG cover, and revision list — only to a request whose `?k=<token>` or `Authorization: Bearer` matches under a constant-time compare, returning `404` (never `401`, no existence leak) otherwise. The key rides only in the emitted `https://<host>/<user>/<slug>?k=<token>` URL; the namespace owner reads their own private page without it, and it works for BYO endpoints too. `private` is publish-only — the in-place `share visibility` / PATCH route rejects it with a `400`. Source: `cli/src/lib/share/publish.ts`, `cli/src/lib/share/worker-template.ts`, `cli/src/commands/share.ts`, `cli/docs/share.md`.
+
+## 1.22.67
+
+- **Keep the shared daemon client-safe (PHNX-3605).** Browser version reconciliation no longer restarts the process; browser and routines lifecycle commands now enable, disable, and reload only their own services while sibling work keeps running. Source: `src/lib/browser/ipc.ts`, `src/commands/browser.ts`, `src/commands/routines.ts`.
+
+- **Daemon stop/start races can no longer erase a successor or signal a reused PID (PHNX-3607).** `stopDaemon()` now holds the same `daemon.lock` as start/claim through signal, wait, postcondition, and cleanup; it trusts a recorded PID only when the live process command ends in `__daemon-run`, and compare-deletes the PID/socket identity it captured instead of unlinking a successor's replacement. The stray-daemon reaper now waits for SIGTERM death, escalates to `killTree` when needed, waits again, and retains the registry marker if a duplicate somehow survives. Source: `cli/src/lib/daemon/daemon.ts`, `cli/src/lib/browser/ipc.ts`.
+
+- **Daemon supervisor hardening: abandon hung ticks, thread an AbortSignal, and bring account-state/catch-up under the supervisor (PHNX-3608).** A supervised tick that awaited something that never settled used to park the service but hold its in-flight guard forever, so the backoff restart, `agents daemon services restart`, and SIGHUP reload were all blocked — a service could freeze for the daemon's life while still looking healthy (the 12h usage-dark class). On a deadline breach the supervisor now ABANDONS the tick: it aborts the tick's new `AbortSignal`, releases the in-flight guard immediately, and schedules the backoff restart right away, draining the runaway promise separately. `PeriodicService.tick(ctx, signal)` receives that signal so a service can bound its own I/O. `start()`/`stop()`/`restart()` are now bounded by a lifecycle deadline so a wedged bind/close can't stall daemon startup or shutdown. The account-state usage/auth refresh — previously its own un-deadlined `setInterval` behind a `usageRunning` latch (the exact hang that froze usage) — is now TWO supervised `PeriodicService`s (`account-state` usage + `account-auth`) with a real deadline + abort and INDEPENDENT circuit breakers, so a run of usage-refresh failures parks only usage and never starves the slower auth refresh; the deadline signal is threaded through to each provider fetch. Catch-up recovery moved off its bare `setInterval` onto a supervised `catchup` service. Disabling the `monitors` service now routes through `supervisor.stop`, and a stopped monitor engine dispatches nothing on tick — so a disabled monitors service actually stops firing instead of being ticked with its last-loaded set. Source: `cli/src/lib/daemon/supervisor.ts`, `cli/src/lib/daemon/service.ts`, `cli/src/lib/daemon/account-state-daemon-service.ts`, `cli/src/lib/daemon/catchup-service.ts`, `cli/src/lib/daemon/monitor-engine-service.ts`, `cli/src/lib/monitors/engine.ts`, `cli/src/lib/daemon/daemon.ts`, `cli/src/lib/daemon-services.ts`, `cli/src/lib/daemon-ticks.ts`, `cli/src/lib/usage-refresh.ts`, `cli/src/lib/accounting/usage.ts`, `cli/src/lib/auth-health.ts`.
+
+- **A cold `agents browser navigate` on a worker now follows the fleet browser hub instead of failing locally (PHNX-3610).** A bare `agents browser start` already forwards to the hub (`config.defaultBrowserDevice`), but a page verb with no bound task — `agents browser navigate|screenshot|click|…` run without a preceding `start` — did not: `resolveTaskRoute`'s no-task branch returned the local box, so the verb ran on the worker and failed with "no default browser on this machine." Agents on other devices could only drive the hub's logged-in browser if they knew to `start` first. The no-task branch now follows `defaultBrowserHub()` (passed in as `resolveTaskRoute`'s `hub` option so the leaf stays pure), and the task-routing hook forwards a taskless drive verb to the hub. So the hub creates the caller's OWN task, the dispatch now **forwards the caller's session/launch identity** (`AGENT_SESSION_ID`/`AGENT_LAUNCH_ID`, the same surface-parity mechanism `run --device` uses) — without it a forwarded verb resolved BLANK identity on the hub and its no-identity task bucket could collide with an unrelated agent's or a human's browser. A cold CLOSE verb (`done`/`stop`) is deliberately **not** forwarded when taskless — with no task it would target a context this session never opened — so it can never blindly stop a hub task. Behavior-only, no new flags; the existing `isSelfHost`/`isFleetRemoteInvocation` guards mean the hub never forwards to itself and a re-exec never loops. Source: `cli/src/lib/browser/task-index.ts`, `cli/src/lib/browser/caller-identity.ts`, `cli/src/commands/browser.ts`.
+
+- **The canonical session watch now carries the genuine request and recoverable history (PHNX-3621).** Transcript indexing stores `firstUserMessage` separately from the one-line topic, skips harness-injected plugin/developer scaffolding, preserves long multi-line requests, and backfills existing rows through the versioned content index. `agents feed watch --json` also folds in a bounded set of durable Previous rows on reset, marks ended live rows as Previous, and emits `agent.remove` before their replacement so presentation clients can render and resume history without parsing transcripts or issuing a second session fetch. Source: `cli/src/lib/session/prompt.ts`, `cli/src/lib/session/discover.ts`, `cli/src/lib/session/db.ts`, `cli/src/lib/session/active.ts`, `cli/src/lib/session/remote/watch.ts`, `cli/src/lib/feed/watch.ts`.
+
+- **Auto-sync traces when a local run exits (PHNX-3628).** Trace upload was manual-only — the sole caller of `syncTraces()` was `agents traces sync`, so the Prix console went stale between hand-runs. A local, headless `agents run` now spawns a detached `agents traces sync` on exit (mirroring `run-notify`; the incremental ledger means it pushes essentially just the finished session). It fires only when you have already opted into the traces store (signed in AND synced at least once); opt out per-run with `--no-trace-sync` or `AGENTS_NO_TRACE_SYNC=1`. Local runs only. Source: `src/lib/run-trace-sync.ts`, `src/lib/traces/sync.ts`, `src/commands/exec.ts`.
+
+- **The shared daemon now contains lock-refresh and reload failures instead of crashing, and concurrent health writers preserve the restart-backoff streak (PHNX-3606).** Every direct `proper-lockfile` lease used by device/team registries, routine launch claims, and usage refresh coordination overrides the library's timer-level compromise throw with an observable log-and-continue barrier. The daemon's `SIGHUP` reload callback is guarded independently of service supervision, and `health.json` updates now serialize the complete read-modify-write under a file lock and publish through atomic rename, so parallel processes cannot erase each other's failure counts or expose partial JSON. Source: `cli/src/lib/lock-compromise.ts`, `cli/src/lib/daemon/daemon.ts`, `cli/src/lib/daemon-health.ts`.
+
+- **Daemon usage/auth sync no longer blocks the event loop or opens a per-tick SSH mesh (PHNX-3609).** Headed devices publish one identity-keyed usage snapshot into their conflict-free tracked `~/.agents/devices/<device>/daemon-state.json`; each daemon automatically commits only its owned file and exchanges the user repo under one cross-process lock and a 45-second hard process-tree deadline, so workers receive and merge snapshots newest-wins without a human `agents repo sync user`. `auth-sync` uses the same file for non-secret `ready`/`missing`/`invalid` verdicts, elects one ready publisher, and opens device-to-device SSH only to provision a peer known to be missing the reserved bundle. That exceptional secret transfer is fully async and every import/read-back operation has a 20-second deadline; timeout disables SSH multiplexing, sends `SIGTERM`, then `SIGKILL`s an uncooperative client after a short grace so both the local promise and direct remote connection are bounded. OAuth/setup-token values never enter the Git store. Source: `cli/src/lib/fleet-shared-state.ts`, `cli/src/lib/fleet-shared-repo-sync.ts`, `cli/src/lib/accounting/usage-sync.ts`, `cli/src/lib/secrets/reserved-sync.ts`, `cli/src/lib/secrets/push.ts`, `cli/src/lib/ssh-exec.ts`.
+
+## 1.22.66
+
+- **Fleet usage/auth sync now reaches FQDN-only-pinned workers (PHNX-3505).** The
+  usage-sync and reserved-auth-sync push/pull planners judged a peer "pinned" by its
+  bare device name, but a tailnet-discovered worker's host key is pinned under its
+  FQDN (`yosemite-m6.tail….ts.net`). So every worker not also pinned under its short
+  name was silently skipped — its `claude-usage.json` went days stale and `balanced`
+  routed into weekly-maxed accounts, and its auth token never propagated. The pin
+  check now resolves the same host string the ssh connection dials
+  (`isDevicePinned`), matching either form. Source:
+  `cli/src/lib/devices/known-hosts.ts`, `cli/src/lib/accounting/usage-sync.ts`,
+  `cli/src/lib/secrets/reserved-sync.ts`.
+
 ## 1.22.65
 
 - **`agents view` shows the last-known usage number with its age instead of hiding it (PHNX-3453).** When the usage endpoint 429-backs-off an account so a window is not refreshed within its own lifetime (Claude's 5h session window) or a billing period rolls over (Grok's weekly credit window), the view now renders the last reading with a staleness suffix — `S: █▌░░░ 30% · 6h old`, `W: ██▏░░ 42% · stale (period ended 1h ago)` — instead of `S: ┄┄┄┄┄ unavailable` or a numberless `run grok once to refresh usage`. The dropped windows ride a new VIEW-ONLY `UsageSnapshot.staleWindows` field; routing still reads only `windows`, so `isUsageVerified`/`hasStaleUsage`/`deriveUsageStatusFromSnapshot` continue to treat a stale/expired number as unverified and never route on it. Source: `cli/src/lib/accounting/usage.ts`.

package/README.md

@@ -1252,6 +1252,8 @@ agents daemon services                      # health of the two hosted services
 agents daemon services list                 # every toggleable service and its current on/off state
 agents daemon services enable secrets-broker
 agents daemon services disable browser-ipc  # stop hosting browser IPC without stopping the daemon
+agents browser stop --service               # browser-scoped alias; next browser action requiring IPC re-enables it
+agents routines stop                        # disable/reload only the scheduler service
 agents daemon logs -f --level warn --since 1h
 agents daemon doctor                        # one-shot health check; non-zero exit on problems
 ```
@@ -1261,8 +1263,11 @@ watchdog, device probe, self-heal, keychain reap, account-state refresh,
 state-dir checks) is an independent toggle in `~/.agents/daemon/services.yaml`.
 `agents daemon services list` shows every service; `enable|disable <id>` flips
 one. Missing keys default to enabled, so upgrades are no-ops. Most services take
-effect on the next daemon start; scheduler and monitor engine also re-evaluate
-on `SIGHUP reload`.
+effect on the next daemon start; browser IPC is registered even when boot-disabled
+so browser commands can enable it live, while scheduler and monitor engine also
+re-evaluate on `SIGHUP reload`. Only `agents daemon start|stop|restart` owns the
+whole process lifecycle. Browser and routines clients change their own service
+state without evicting sibling work.
 
 There is no `agents daemon jobs` -- scheduled work is always `agents routines`
 (see `agents routines stats` for per-routine failure detail). `disable` is a

package/dist/bootstrap.js

@@ -1163,15 +1163,15 @@ catch (err) {
     if (err instanceof Error && err.name === 'ExitPromptError') {
         process.exit(130);
     }
-    // Browser-daemon-not-running and CDP-not-reachable surface as typed errors
+    // Browser-service-not-running and CDP-not-reachable surface as typed errors
     // from src/lib/browser/. Don't dump a Node stacktrace for these — they are
     // user-actionable, not engineering bugs. See issues #41 and #43.
     if (err instanceof Error) {
-        const isBrowserDaemonNotRunning = err.name === 'BrowserDaemonNotRunningError';
+        const isBrowserServiceNotRunning = err.name === 'BrowserServiceNotRunningError';
         const isBrowserCdpUnreachable = err.name === 'BrowserCdpConnectionError';
         const isBrowserIpcDown = err.message.startsWith('IPC error:') &&
             (err.message.includes('ECONNREFUSED') || err.message.includes('ENOENT'));
-        if (isBrowserDaemonNotRunning || isBrowserCdpUnreachable || isBrowserIpcDown) {
+        if (isBrowserServiceNotRunning || isBrowserCdpUnreachable || isBrowserIpcDown) {
             console.error(err.message);
             process.exit(1);
         }

package/dist/commands/apply.js

@@ -14,7 +14,7 @@ import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { loadDevices } from '../lib/devices/registry.js';
-import { isHostPinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
+import { isHostPinned, isDevicePinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired, emptyTargetsMessage } from '../lib/fleet/manifest.js';
 import { snapshotAuth } from '../lib/fleet/auth-sync.js';
@@ -233,7 +233,14 @@ async function runApply(opts) {
         provisionSecrets: opts.provisionSecrets === true,
         forceSecrets: opts.force === true,
         // Portable secret values only ever go to a host whose key is already pinned.
-        isHostPinned: (device) => isHostPinned(device, managedKnownHostsPath()),
+        // Resolve the device to its profile so the pin is checked against the FQDN the
+        // ssh connection dials (isDevicePinned), not the bare name — a tailnet worker
+        // pinned only under its FQDN would otherwise be refused as "not pinned"
+        // (PHNX-3505). A name with no profile falls back to the raw host-string check.
+        isHostPinned: (device) => {
+            const p = nameToProfile.get(device);
+            return p ? isDevicePinned(p) : isHostPinned(device, managedKnownHostsPath());
+        },
     });
     // --only filter.
     if (opts.only) {

package/dist/commands/browser.js

@@ -1,3 +1,4 @@
+import { Option } from 'commander';
 import chalk from 'chalk';
 import { spawnSync } from 'node:child_process';
 import * as fs from 'fs';
@@ -14,8 +15,9 @@ import { DEFAULT_VIEWPORT, parseWindowSize, parseWindowPosition } from '../lib/b
 import { runBrowserSessionsCommand } from './browser-sessions-picker.js';
 import { discoverBrowserWsUrl, verifyBrowserIdentity } from '../lib/browser/cdp.js';
 import { parseTargetFilter } from '../lib/browser/service.js';
-import { BrowserDaemonNotRunningError, formatBrowserDaemonNotRunningError, sendIPCRequest as sendRawIPCRequest, resetBrowserDaemon, } from '../lib/browser/ipc.js';
-import { bindTask, getTaskBinding, honorScreenshotOutput, REJECT_DEVICE_MESSAGE, resolveTaskRoute, unbindTask, unbindTasksForProfile, updateTaskBinding, } from '../lib/browser/task-index.js';
+import { BrowserServiceNotRunningError, formatBrowserServiceNotRunningError, sendIPCRequest as sendRawIPCRequest, stopBrowserService, } from '../lib/browser/ipc.js';
+import { bindTask, getTaskBinding, honorScreenshotOutput, isTerminalBrowserVerb, REJECT_DEVICE_MESSAGE, resolveTaskRoute, unbindTask, unbindTasksForProfile, updateTaskBinding, } from '../lib/browser/task-index.js';
+import { callerIdentityEnv, resolveCallerIdentity } from '../lib/browser/caller-identity.js';
 import { isSelfHost } from '../lib/devices/self-host.js';
 import { resolveHost } from '../lib/hosts/registry.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
@@ -132,12 +134,17 @@ async function dispatchBrowserToDevice(device, forwardedArgs, mode) {
     }
     const target = sshTargetFor(host);
     const remoteOs = resolveRemoteOsSync(host.name);
-    const env = withActorEnv({ AGENTS_FLEET_REMOTE: '1' });
+    // Forward the caller's identity so the HUB resolves the same session/launch id
+    // the worker would stamp locally. Without it the forwarded verb lands blank on
+    // the hub and its no-identity task bucket collides with unrelated tasks — the
+    // surface-parity gap the run --device path already closes (caller-identity.ts).
+    const identityEnv = callerIdentityEnv(resolveCallerIdentity());
+    const env = withActorEnv({ ...identityEnv, AGENTS_FLEET_REMOTE: '1' });
     const remoteCmd = buildRemoteAgentsInvocation(forwardedArgs, undefined, remoteOs, env);
     if (mode === 'stream') {
         const code = streamAgentsOnHost(host, forwardedArgs, {
             interactive: !!process.stdout.isTTY && !process.argv.includes('--no-tty'),
-            extraEnv: { AGENTS_FLEET_REMOTE: '1' },
+            extraEnv: { ...identityEnv, AGENTS_FLEET_REMOTE: '1' },
             remoteOs,
             target,
         });
@@ -304,7 +311,7 @@ export function registerBrowserCommand(program) {
       agents browser navigate https://example.com
       agents browser screenshot
 
-      # Keep one process and daemon socket warm for repeated actions
+      # Keep one process and browser-service socket warm for repeated actions
       agents browser stream --task "$AGENTS_BROWSER_TASK"
 
       # Bind a device at start; later verbs resolve it from the task
@@ -324,9 +331,9 @@ export function registerBrowserCommand(program) {
       # Close tabs the daemon's own reaper would have caught on its next 5-min tick
       agents browser prune --dry-run
 
-      # Recover a wedged daemon ("Timeout waiting for browser daemon socket"):
-      # stop it and clear a stale socket, then start clean
-      agents browser stop --daemon
+      # Recover browser IPC without interrupting routines, usage, or secrets:
+      # stop only the browser service, then start it clean
+      agents browser stop --service
       agents browser start
     `,
         notes: `
@@ -1261,13 +1268,25 @@ function registerTaskCommands(browser) {
             task: taskFlag ?? process.env.AGENTS_BROWSER_TASK,
             sessionId: callerSessionId(),
             launchId: callerLaunchId(),
+            hub: defaultBrowserHub(),
         });
         if (route.kind !== 'proceed') {
             console.error(route.message);
             process.exit(1);
         }
         inferredTaskName = route.task;
-        if (isSelfHost(route.device) || !route.task)
+        // A cold page verb (no bound task) whose route is the fleet hub still
+        // forwards: `route.task` is undefined but `route.device` is a peer, so the
+        // `--task` push below is skipped and the hub's daemon creates the caller's
+        // OWN task (keyed to the identity `dispatchBrowserToDevice` now forwards).
+        // Only a self-host route runs locally.
+        if (isSelfHost(route.device))
+            return;
+        // ...but a cold CLOSE verb (done/stop) must NOT forward: with no task it
+        // would target a browsing context this session never opened. It stays local
+        // (its historic no-task behaviour) unless an explicit --task/local binding
+        // routes it — a taskless `done` must never blindly stop a hub task.
+        if (!route.task && isTerminalBrowserVerb(top))
             return;
         const forwarded = browserForwardedArgv();
         if (route.task && !forwarded.includes('--task')) {
@@ -1364,7 +1383,7 @@ function registerTaskCommands(browser) {
     });
     setHelpSections(stream, {
         examples: `
-      # Batch two warm actions through one process and one daemon connection
+      # Batch two warm actions through one process and one browser-service connection
       printf '%s\\n' \\
         '{"action":"screenshot","path":"/tmp/page.jpg"}' \\
         '{"action":"click","atX":320,"atY":540}' \\
@@ -1688,24 +1707,29 @@ function registerTaskCommands(browser) {
     });
     browser
         .command('stop')
-        .description('Stop a browser task and close its tabs; with --profile, detach the whole profile (close browser + drop cached connection); with --daemon, stop the browser daemon and clear a wedged socket')
+        .description('Stop a browser task and close its tabs; with --profile, detach the whole profile; with --service, stop only browser IPC while the shared daemon stays up')
         .option(TASK_OPTION_FLAG, TASK_OPTION_DESC)
         .option(DEVICE_ON_PAGE_VERB_FLAG, DEVICE_ON_PAGE_VERB_DESC)
         .option('-p, --profile <name>', 'Detach the whole profile (incl. composite "name@endpoint") instead of stopping a single task')
-        .option('--daemon', 'Stop the browser daemon entirely and clear a stale/wedged socket so the next start comes up clean (recovery for "Timeout waiting for browser daemon socket")')
+        .option('--service', 'Stop only the browser-ipc service and clear a stale/wedged socket; the shared daemon and its other services stay up')
+        .addOption(new Option('--daemon').hideHelp())
         .action(async (opts) => {
-        if (opts.daemon) {
+        if (opts.service || opts.daemon) {
             if (opts.profile || opts.task) {
-                console.error('--daemon stops the whole browser daemon; do not combine it with --profile or --task.');
+                console.error('--service stops browser IPC; do not combine it with --profile or --task.');
                 process.exit(1);
             }
+            if (opts.daemon) {
+                console.error('`--daemon` now means the browser service only; use `--service`. The shared daemon will not be stopped.');
+            }
             try {
-                const result = await resetBrowserDaemon();
+                const result = await stopBrowserService();
                 const parts = [];
-                parts.push(result.wasRunning ? 'Stopped browser daemon' : 'Browser daemon was not running');
+                parts.push(result.wasRunning ? 'Stopped browser service' : 'Browser service was not running');
                 if (result.socketCleared)
                     parts.push('cleared stale socket');
-                console.log(`${parts.join('; ')}. It restarts on the next browser command.`);
+                parts.push(result.daemonRunning ? 'shared daemon is still running' : 'shared daemon was already stopped');
+                console.log(`${parts.join('; ')}. Browser IPC starts again on the next browser action that requires it.`);
             }
             catch (err) {
                 console.error(err instanceof Error ? err.message : String(err));
@@ -2121,7 +2145,7 @@ function registerTaskCommands(browser) {
     }
     browser
         .command('status')
-        .description('Show running browser tasks')
+        .description('Show browser service state and running browser tasks')
         .option('-p, --profile <name>', 'Filter by profile')
         .option('--json', 'Output machine-readable JSON')
         .action(async (opts) => {
@@ -2133,10 +2157,10 @@ function registerTaskCommands(browser) {
             }, { autoStartDaemon: false });
         }
         catch (err) {
-            if (err instanceof BrowserDaemonNotRunningError) {
-                const message = formatBrowserDaemonNotRunningError();
+            if (err instanceof BrowserServiceNotRunningError) {
+                const message = formatBrowserServiceNotRunningError();
                 if (opts.json) {
-                    console.log(JSON.stringify({ ok: false, error: message }));
+                    console.log(JSON.stringify({ ok: false, service: { id: 'browser-ipc', state: 'stopped' }, error: message }));
                 }
                 else {
                     console.error(message);
@@ -2158,6 +2182,7 @@ function registerTaskCommands(browser) {
             console.log(JSON.stringify(response.profiles ?? [], null, 2));
             return;
         }
+        console.log(chalk.gray('Browser service: running (shared daemon unchanged)'));
         // Build flat list of tasks with profile context
         const allTasks = [];
         for (const profile of response.profiles || []) {

package/dist/commands/daemon-test-harness.d.ts

@@ -28,7 +28,7 @@ export declare function makeHome(): string;
 export declare function run(home: string, args: string[]): ReturnType<typeof spawnSync>;
 /**
  * Spawn a real, long-lived process whose command line ends in `__daemon-run`
- * (so `isDaemonRunProcess`'s `ps` check accepts it — see
+ * (so `isLiveDaemon`'s process-command check accepts it — see
  * `lib/daemon.test.ts`'s "reaps a live __daemon-run registrant" test, same
  * technique) and register it in `home`'s OWN instance registry, exactly the
  * marker `registerDaemonInstance` would write. A real live process, not a

package/dist/commands/daemon-test-harness.js

@@ -54,7 +54,7 @@ export function run(home, args) {
 }
 /**
  * Spawn a real, long-lived process whose command line ends in `__daemon-run`
- * (so `isDaemonRunProcess`'s `ps` check accepts it — see
+ * (so `isLiveDaemon`'s process-command check accepts it — see
  * `lib/daemon.test.ts`'s "reaps a live __daemon-run registrant" test, same
  * technique) and register it in `home`'s OWN instance registry, exactly the
  * marker `registerDaemonInstance` would write. A real live process, not a
@@ -67,7 +67,7 @@ export async function spawnFakeRegisteredDaemon(home) {
         stdio: 'ignore',
     });
     // Give the exec a moment to land before `ps` (read by the status command's
-    // isDaemonRunProcess check) is asked to see its real argv — mirrors
+    // isLiveDaemon check) is asked to see its real argv — mirrors
     // lib/daemon.test.ts's identical fake-daemon technique.
     await new Promise((r) => setTimeout(r, 150));
     const instancesDir = path.join(home, '.agents', '.cache', 'helpers', 'daemon', 'instances');

package/dist/commands/daemon.js

@@ -297,9 +297,9 @@ async function probeSecretsBroker() {
 }
 async function probeBrowserIPC() {
     const record = readSubsystemHealth(SUBSYSTEM_BROWSER_IPC);
-    const { isDaemonReachable, getSocketPath } = await import('../lib/browser/ipc.js');
+    const { isBrowserServiceReachable, getSocketPath } = await import('../lib/browser/ipc.js');
     const { listAllProfileSnapshots } = await import('../lib/browser/runtime-state.js');
-    const bound = await isDaemonReachable();
+    const bound = await isBrowserServiceReachable();
     const sessionCount = listAllProfileSnapshots().filter((s) => s.pidAlive && s.daemonAlive).length;
     return { bound, socketPath: getSocketPath(), sessionCount, record };
 }
@@ -892,14 +892,13 @@ export function registerDaemonCommand(program) {
       'systemctl start' on a disabled unit.
 
       'agents daemon services enable|disable|restart <id>' applies live (no
-      daemon restart) for the 10 supervisor-managed services: secrets-broker,
-      browser-ipc, account-state, session-index, monitors (off only — turning
-      monitors back on still needs a restart), watchdog, device-probe,
-      self-heal, keychain-reap, and state-dir-check. The other 2 services
-      (scheduler, webhook-receiver) are still bare interval/socket setups with
-      no live start/stop hook, so a toggle there — and 'enable' on any service
-      that was disabled at daemon boot — still needs 'agents daemon restart'.
-      'agents daemon services' names which case you're in per row.
+      daemon restart) for supervisor-managed services that were registered at
+      boot. browser-ipc is also registered while disabled, specifically so a
+      browser client can enable it live. The inline scheduler re-evaluates its
+      toggle on every reload as well. A boot-disabled service other than
+      browser-ipc, the monitor on-transition, and webhook-receiver still need an
+      operator 'agents daemon restart'. 'agents daemon services' names which
+      case you're in per row.
     `,
     });
     cmd.command('status')
@@ -1020,12 +1019,13 @@ export function registerDaemonCommand(program) {
       agents daemon services restart secrets-broker
     `,
         notes: `
-      A service disabled at daemon boot was never registered on the
-      supervisor, so 'enable' on it — and any toggle/restart on the 2
-      services the supervisor doesn't manage yet (scheduler,
-      webhook-receiver) — falls back to 'restart the daemon to apply'. Each
-      row in the plain-text view names which case it is; 'supervised:
-      true/false' does the same in --json.
+      A service disabled at daemon boot is normally not registered on the
+      supervisor, so enabling it needs an operator restart. browser-ipc is the
+      exception: it is registered stopped and can be enabled live. The inline
+      scheduler also applies enable/disable on reload; webhook-receiver and the
+      monitor on-transition still require 'agents daemon restart'. Each row in
+      the plain-text view names which case it is; 'supervised: true/false' does
+      the same in --json.
     `,
     });
     servicesCmd
@@ -1057,12 +1057,11 @@ export function registerDaemonCommand(program) {
      * Apply an enable/disable toggle live (RUSH-3193 P4): persist it, then signal
      * the running daemon to reload — its handler diffs the toggle and drives
      * `supervisor.start/stop(id)` for a supervised service, so no restart is
-     * needed for the 10 supervisor-managed services (secrets-broker,
-     * browser-ipc, account-state, session-index, monitors' off-transition,
-     * watchdog, device-probe, self-heal, keychain-reap, state-dir-check). The 2
-     * remaining `setInterval`/socket-driven services (scheduler,
-     * webhook-receiver) and monitors' on-transition still need a restart — the
-     * daemon's own reload log says so.
+     * needed for supervisor-managed services registered at boot. browser-ipc is
+     * registered even when disabled so it can be enabled live; the inline
+     * scheduler also re-evaluates its toggle on reload. webhook-receiver,
+     * monitors' on-transition, and other boot-disabled services still need a
+     * deliberate operator restart — the daemon's own reload log says so.
      */
     function applyServiceToggleLive(service) {
         if (!isDaemonRunning())

package/dist/commands/exec.js

@@ -516,6 +516,7 @@ export function registerRunCommand(program) {
         .option('--session-id <id>', 'Force a NEW conversation to use this exact session UUID (Claude only). This CREATES a session — to resume an existing one, use --resume.')
         .option('--name <slug>', 'Name the run — seeds the session label so it shows up as `<name>` in `agents sessions` and resolves by it (and `agents hosts logs <name>` for --device runs) instead of an opaque id. An agent-generated title later refines the label; your name shows until then. Optional.')
         .option('--notify', 'Post a desktop notification when a headless run finishes. Fired by this process on exit, so it survives whatever launched the run (the menu bar dispatching it, a terminal you closed).')
+        .option('--no-trace-sync', 'Skip the run-exit trace auto-sync for this run. Auto-sync fires by default only for local runs and only once you have run `agents traces sync` at least once (also silenced by AGENTS_NO_TRACE_SYNC=1).')
         .option('--terminal [backend]', "Open this run in a real terminal tab instead of here. Without a value the terminal is detected from your live sessions (`agents sessions --active` host), so it lands where you already work — Ghostty for a Ghostty user, iTerm for an iTerm user. Name one to force it: iterm | ghostty | terminal | tmux | vscodium-agent. This is how the menu bar's New Session opens.")
         .option('--verbose', 'Show detailed execution logs')
         .option('--raw', 'Keep this interactive run direct when the device has opted into tmux wrapping. A no-op under the default tmux-off configuration; equivalent to AGENTS_NO_TMUX=1.')
@@ -1340,6 +1341,23 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         // --device/--on/--computer: offload this run onto a registered agent host
         // over SSH instead of running locally. The three flags are aliases.
         const hostGiven = hostTargetGiven(options);
+        // Auto-sync this run's redacted trajectory when it exits, so the console is
+        // never stale and a session link/QR resolves the moment the run finishes
+        // (PHNX-3628). Armed HERE — after hostGiven is finalized — so every
+        // remote-placement signal is already reflected in options: --device/--on/
+        // --computer and --where device: (expanded to options.host above), AND the
+        // --resume-to-peer redirect that sets options.host during resume
+        // resolution. A run that will dispatch remotely (hostGiven non-empty, or
+        // --lease/--box) has its trajectory on that box and never arms a local
+        // sync; --cloud returned earlier. The module additionally gates on opt-in
+        // (signed in + already synced once) and is best-effort.
+        if (prompt !== undefined &&
+            hostGiven.length === 0 &&
+            !options.lease &&
+            !options.box) {
+            const { armRunFinishTraceSync } = await import('../lib/run-trace-sync.js');
+            armRunFinishTraceSync({ disabled: options.traceSync === false });
+        }
         // --project <slug>[@worktree]: resolve the projects-root shorthand into a
         // cwd. On a host run it resolves home-relative (`~/…`, so the host expands
         // it); locally it becomes an absolute path. It owns the working directory,
@@ -2337,6 +2355,28 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 // differ from the earlier cwd that selected projects/<cwd-key>.
                 if (!options.cwd && resolvedRecoveryTarget.cwd)
                     options.cwd = resolvedRecoveryTarget.cwd;
+                // Account rotation on a limit (PHNX-3626): recovery kept resume NATIVE
+                // in the origin home but rotated to a healthy provider account of the
+                // SAME harness. Inject that credential through the same `--account`
+                // path an explicit selection uses, so exec authenticates as the
+                // rotated account while reading the origin transcript. An explicit
+                // --account (configuredAccount) always wins — never rotate over it.
+                const rotatedAccount = resolvedRecoveryTarget.account;
+                if (rotatedAccount && !configuredAccount) {
+                    try {
+                        const picked = resolveSpawnAccount(rotatedAccount.providerAccount, agent, version, readMeta(), { useDefault: false });
+                        if (picked?.kind === 'provider')
+                            accountEnv = picked.env;
+                    }
+                    catch {
+                        // Account-registry errors can carry provider credential material;
+                        // never relay them onto the terminal from this automatic path.
+                        console.error(chalk.red('Could not prepare the rotated provider account for native resume.'));
+                        process.exit(1);
+                    }
+                    if (!options.quiet)
+                        process.stderr.write(chalk.gray(`[agents] origin ${agent} account limited → rotated to ${rotatedAccount.label} (native resume)\n`));
+                }
                 if (!options.quiet)
                     process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''} in ${options.cwd ?? cwd}\n`));
             }

package/dist/commands/monitors.js

@@ -248,10 +248,10 @@ function ensureDaemonRunning() {
     const result = startDaemon();
     if (result.pid) {
         console.log(chalk.green(`Daemon started (PID: ${result.pid}). It will watch monitors in the background.`));
-        console.log(chalk.gray('Stop anytime with: agents routines stop'));
+        console.log(chalk.gray('Disable only monitor polling with: agents daemon services disable monitors'));
     }
     else {
-        stderrLine(chalk.yellow('Could not start the daemon. Start it manually with: agents routines start'));
+        stderrLine(chalk.yellow('Could not start the daemon. Start it manually with: agents daemon start'));
     }
     return true;
 }

package/dist/commands/repo.js

@@ -57,6 +57,41 @@ function syncMarketplacesForDefaults() {
         catch { /* best-effort */ }
     }
 }
+/** Write this device's account metadata before the user repo is committed. */
+async function publishUserRepoAccountState(provisionAuth) {
+    const { publishUsageSnapshotToSharedStore } = await import('../lib/accounting/usage-sync.js');
+    const usage = publishUsageSnapshotToSharedStore();
+    if (usage.error)
+        console.error(chalk.yellow(`Usage snapshot: ${usage.error}`));
+    if (provisionAuth) {
+        const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
+        const auth = await syncReservedAuthBundle();
+        if (auth.pushed.length > 0)
+            console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
+        for (const err of auth.errors)
+            console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
+        return;
+    }
+    const { publishReservedAuthVerdict } = await import('../lib/secrets/reserved-sync.js');
+    const auth = publishReservedAuthVerdict();
+    if (auth.error)
+        console.error(chalk.yellow(`Auth verdict: ${auth.device}: ${auth.error}`));
+}
+/** Consume freshly pulled usage/auth metadata from the local user-repo checkout. */
+async function consumeUserRepoAccountState() {
+    const { consumeUsageSnapshotsFromSharedStore } = await import('../lib/accounting/usage-sync.js');
+    const usage = consumeUsageSnapshotsFromSharedStore();
+    if (usage.merged > 0)
+        console.log(chalk.gray(`Usage snapshot: merged ${usage.merged} row(s) from ${usage.sources.join(', ')}`));
+    for (const err of usage.errors)
+        console.error(chalk.yellow(`Usage snapshot: ${err.device}: ${err.message}`));
+    const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
+    const auth = await syncReservedAuthBundle();
+    if (auth.pushed.length > 0)
+        console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
+    for (const err of auth.errors)
+        console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
+}
 const ALIAS_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
 /** Derive a default alias from a source URL (e.g. gh:foo/.agents-work -> agents-work). */
 function deriveAlias(source) {
@@ -1052,14 +1087,7 @@ export function registerRepoCommands(program) {
             ].filter(Boolean);
             if (parts.length > 0)
                 console.log(chalk.gray(`Device policy: ${parts.join(' · ')}`));
-            const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
-            const auth = syncReservedAuthBundle();
-            if (auth.pushed.length > 0) {
-                console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
-            }
-            for (const err of auth.errors) {
-                console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
-            }
+            await consumeUserRepoAccountState();
         }
     });
     repoCmd
@@ -1095,20 +1123,14 @@ export function registerRepoCommands(program) {
             return;
         }
         for (const t of pushable) {
+            // Account snapshots must exist BEFORE commitAndPush or this push ships
+            // the previous tick's state and delays propagation by one repo cycle.
+            if (t.alias === 'user')
+                await publishUserRepoAccountState(true);
             const spinner = ora(`Pushing ${formatRepoTarget(t.alias, t.dir)}...`).start();
             const result = await commitAndPush(t.dir, options.message);
             if (result.success) {
                 spinner.succeed(`${formatRepoTarget(t.alias, t.dir, result.branch)}: ${result.detail ?? 'pushed'}`);
-                if (t.alias === 'user') {
-                    const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
-                    const auth = syncReservedAuthBundle();
-                    if (auth.pushed.length > 0) {
-                        console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
-                    }
-                    for (const err of auth.errors) {
-                        console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
-                    }
-                }
             }
             else {
                 spinner.fail(`${formatRepoTarget(t.alias, t.dir)}: ${result.error}`);
@@ -1173,8 +1195,23 @@ Examples:
                 }
             }
             const push = t.alias !== 'system';
+            // syncRepoGit pulls then pushes. Seed our conflict-free owner file first
+            // so the same transaction carries it; consume peers after the pull.
+            if (t.alias === 'user')
+                await publishUserRepoAccountState(false);
             const spinner = ora(`Syncing ${formatRepoTarget(t.alias, t.dir)}...`).start();
-            const result = await syncRepoGit(t.dir, { push });
+            const result = t.alias === 'user'
+                ? await (async () => {
+                    const { syncFleetSharedStateRepo } = await import('../lib/fleet-shared-repo-sync.js');
+                    const synced = await syncFleetSharedStateRepo({ userAgentsDir: t.dir });
+                    return {
+                        success: synced.success,
+                        commit: synced.commit ?? '',
+                        pushed: synced.pushed,
+                        error: synced.error ?? synced.skipped ?? undefined,
+                    };
+                })()
+                : await syncRepoGit(t.dir, { push });
             if (result.success) {
                 const pushed = result.pushed ? ' (pushed)' : '';
                 spinner.succeed(`${formatRepoTarget(t.alias, t.dir)}: ${result.commit}${pushed}`);
@@ -1184,6 +1221,7 @@ Examples:
                         recordUserRepoRemote(t.dir, u);
                     const { reconcileDeviceDiscoveryPolicies } = await import('../lib/devices/discovery-policy.js');
                     await reconcileDeviceDiscoveryPolicies();
+                    await consumeUserRepoAccountState();
                 }
             }
             else {

package/dist/commands/resume.d.ts

@@ -1,4 +1,20 @@
+import type { SessionMeta } from '../lib/session/types.js';
 export declare const RESUME_SOURCE_ENV = "AGENTS_RESUME_SOURCE_JSON";
+/**
+ * The source a dead-remote local fallback resumes from: the same session, but
+ * with `machine` rewritten to THIS box so the delegated `agents run --resume`
+ * resolves recovery locally (`sessionRecoveryPeer` returns undefined) instead of
+ * bouncing back to the unreachable owner. Because no local version home owns the
+ * peer's transcript, that local recovery lands on a labelled `/continue` replay
+ * from the synced mirror — the only way to continue a session whose owning device
+ * is gone. Owner-approved prefer-device, fall-back-local (PHNX-3626).
+ *
+ * Safe against the RUSH-2022 "silent local resume forks live state" hazard by
+ * PRECONDITION: this is reached only after `runOnPeer` proved the owner
+ * unreachable, so there is no live process on the peer to fork, and the fallback
+ * is announced with a log line — never silent.
+ */
+export declare function resumeLocalFallbackSource(session: SessionMeta, self?: string): SessionMeta;
 export interface StrictResumeOptions {
     mode?: string;
     interactive?: boolean;