@phnx-labs/agents-cli 1.22.66 → 1.22.69

package/dist/commands/exec.js

@@ -27,6 +27,7 @@ import { randomUUID } from 'crypto';
 import { isSessionTrackedAgent } from '../lib/session/types.js';
 import { applyActiveRulesPresetAtRun } from '../lib/rules/run-sync.js';
 import { handleBroadcast } from './run-broadcast.js';
+import { bootMark } from '../lib/boot-profile.js';
 /** Distinguish a terminal account-picker marker from an explicit @version pin. */
 export function parseRunAccountPickerRequest(agentSpec) {
     const requested = agentSpec.endsWith('@');
@@ -516,6 +517,7 @@ export function registerRunCommand(program) {
         .option('--session-id <id>', 'Force a NEW conversation to use this exact session UUID (Claude only). This CREATES a session — to resume an existing one, use --resume.')
         .option('--name <slug>', 'Name the run — seeds the session label so it shows up as `<name>` in `agents sessions` and resolves by it (and `agents hosts logs <name>` for --device runs) instead of an opaque id. An agent-generated title later refines the label; your name shows until then. Optional.')
         .option('--notify', 'Post a desktop notification when a headless run finishes. Fired by this process on exit, so it survives whatever launched the run (the menu bar dispatching it, a terminal you closed).')
+        .option('--no-trace-sync', 'Skip the run-exit trace auto-sync for this run. Auto-sync fires by default only for local runs and only once you have run `agents traces sync` at least once (also silenced by AGENTS_NO_TRACE_SYNC=1).')
         .option('--terminal [backend]', "Open this run in a real terminal tab instead of here. Without a value the terminal is detected from your live sessions (`agents sessions --active` host), so it lands where you already work — Ghostty for a Ghostty user, iTerm for an iTerm user. Name one to force it: iterm | ghostty | terminal | tmux | vscodium-agent. This is how the menu bar's New Session opens.")
         .option('--verbose', 'Show detailed execution logs')
         .option('--raw', 'Keep this interactive run direct when the device has opted into tmux wrapping. A no-op under the default tmux-off configuration; equivalent to AGENTS_NO_TMUX=1.')
@@ -689,6 +691,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
     `,
     });
     runCmd.action(async (agentSpec, prompt, options, command) => {
+        bootMark('run-action:enter');
         // Capture everything after -- as passthrough args forwarded verbatim to the
         // underlying CLI. Commander strips the literal `--` and folds what follows
         // into the positional operands (so `agents run codex -- --yolo` would parse
@@ -1340,6 +1343,23 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         // --device/--on/--computer: offload this run onto a registered agent host
         // over SSH instead of running locally. The three flags are aliases.
         const hostGiven = hostTargetGiven(options);
+        // Auto-sync this run's redacted trajectory when it exits, so the console is
+        // never stale and a session link/QR resolves the moment the run finishes
+        // (PHNX-3628). Armed HERE — after hostGiven is finalized — so every
+        // remote-placement signal is already reflected in options: --device/--on/
+        // --computer and --where device: (expanded to options.host above), AND the
+        // --resume-to-peer redirect that sets options.host during resume
+        // resolution. A run that will dispatch remotely (hostGiven non-empty, or
+        // --lease/--box) has its trajectory on that box and never arms a local
+        // sync; --cloud returned earlier. The module additionally gates on opt-in
+        // (signed in + already synced once) and is best-effort.
+        if (prompt !== undefined &&
+            hostGiven.length === 0 &&
+            !options.lease &&
+            !options.box) {
+            const { armRunFinishTraceSync } = await import('../lib/run-trace-sync.js');
+            armRunFinishTraceSync({ disabled: options.traceSync === false });
+        }
         // --project <slug>[@worktree]: resolve the projects-root shorthand into a
         // cwd. On a host run it resolves home-relative (`~/…`, so the host expands
         // it); locally it becomes an absolute path. It owns the working directory,
@@ -1788,6 +1808,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             import('../lib/capabilities.js'),
             import('../lib/share/config.js'),
         ]);
+        bootMark('run-deps:imported');
         const isValidAgent = (agent) => ALL_AGENT_IDS.includes(agent);
         // Parse agent@version#label. The label selects native auth without pinning
         // the binary version; --account remains the equivalent flag form.
@@ -2327,6 +2348,25 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 process.exit(1);
             }
             version = resolvedRecoveryTarget.version;
+            // Account rotation (PHNX-3626 / PHNX-3674): recovery picked a healthy
+            // provider of the SAME harness. Inject that credential through the
+            // `--account` path so spawn does not authenticate as the version home's
+            // native login (the exhausted origin when the continue pick is a
+            // provider). An explicit --account (configuredAccount) always wins.
+            const rotatedAccount = resolvedRecoveryTarget.account;
+            if (rotatedAccount && !configuredAccount) {
+                try {
+                    const picked = resolveSpawnAccount(rotatedAccount.providerAccount, agent, version, readMeta(), { useDefault: false });
+                    if (picked?.kind === 'provider')
+                        accountEnv = picked.env;
+                }
+                catch {
+                    // Account-registry errors can carry provider credential material;
+                    // never relay them onto the terminal from this automatic path.
+                    console.error(chalk.red('Could not prepare the rotated provider account for session recovery.'));
+                    process.exit(1);
+                }
+            }
             if (resolvedRecoveryTarget.mode === 'native') {
                 version = session.version;
                 resumeNative = true;
@@ -2337,6 +2377,9 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 // differ from the earlier cwd that selected projects/<cwd-key>.
                 if (!options.cwd && resolvedRecoveryTarget.cwd)
                     options.cwd = resolvedRecoveryTarget.cwd;
+                if (rotatedAccount && !configuredAccount && !options.quiet) {
+                    process.stderr.write(chalk.gray(`[agents] origin ${agent} account limited → rotated to ${rotatedAccount.label} (native resume)\n`));
+                }
                 if (!options.quiet)
                     process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''} in ${options.cwd ?? cwd}\n`));
             }
@@ -2346,6 +2389,9 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 prompt = buildContinuePrompt(session.id, prompt);
                 if (prompt.trim() === `/continue ${session.id}`)
                     forceInteractive = true;
+                if (rotatedAccount && !configuredAccount && !options.quiet) {
+                    process.stderr.write(chalk.gray(`[agents] origin ${agent} account limited → rotated to ${rotatedAccount.label} (/continue)\n`));
+                }
                 if (!options.quiet)
                     process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (/continue replay)${version ? ` @${version}` : ''}\n`));
             }
@@ -2403,7 +2449,9 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     // ones sitting in a version home (RUSH-3182). Run-path only — the
                     // picker's other callers keep the native-only collector.
                     const { collectRunCandidatesForRun } = await import('../lib/accounting/account-pool-collect.js');
+                    bootMark('resolve-version:start');
                     const resolved = await resolveRunVersion(agent, strategy, cwd, collectRunCandidatesForRun);
+                    bootMark('resolve-version:done');
                     if (resolved.exhausted) {
                         // Zero healthy accounts splits two ways, and conflating them is what
                         // stranded a logged-out harness with no way in at all (RUSH-2334):
@@ -2570,6 +2618,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 version = healed;
             }
         }
+        bootMark('ensure-runnable:done');
         // The harness may simply not be on this machine. The self-heal above only
         // runs when a managed version resolved, so with nothing installed we used
         // to fall through and spawn the bare `cliCommand`, which dies as
@@ -2606,6 +2655,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         if (defaultVersion) {
             applyActiveRulesPresetAtRun(agent, defaultVersion, getVersionHomePath(agent, defaultVersion));
         }
+        bootMark('rules-sync:done');
         // Login preflight (advisory, warn + continue). On a local INTERACTIVE
         // launch, probe whether this agent's account has a credential and print a
         // one-line warning if it looks logged out — so you find out BEFORE the TUI

package/dist/commands/feed.js

@@ -5,7 +5,8 @@ import { projectKeyFromCwd } from '../lib/project-key.js';
 import { postFeedStatus } from '../lib/feed-post.js';
 import { linearIssueUrl } from '../lib/session/linear.js';
 import { parseFeedPostLevel, planFeedBroadcast, runFeedBroadcast, effectiveBroadcastConfig, withDesktopNotify, blockBroadcastContext, blockDeliveryFailure, } from '../lib/feed-broadcast.js';
-import { getSessionById } from '../lib/session/db.js';
+import { getSessionById, resolveFullSessionId } from '../lib/session/db.js';
+import { fireTraceSyncInBackground } from '../lib/run-trace-sync.js';
 import { readMeta } from '../lib/state.js';
 import { enrichBlocksFromSessions, groupBlocksByOutcome, isUnambiguousOutcomeAnswer, openBlocksForOutcome, stampBlockOutcomes, } from '../lib/feed-outcome.js';
 import { classifyBlock, filterBlocksForFeed, suppressionDigest, } from '../lib/ask-classifier.js';
@@ -692,7 +693,10 @@ async function broadcastPostedEvent(event, level, meta, notify = false) {
     const config = withDesktopNotify(effectiveBroadcastConfig(meta.feed?.broadcast, level, meta), notify);
     if (!config)
         return [];
-    const ticket = getSessionById(event.sessionId)?.ticketId;
+    // Upgrade an 8-char footer crumb to the full indexed id so the console session
+    // URL resolves instead of 404ing, and so the ticket join hits the right row.
+    const session = resolveFullSessionId(event.sessionId) ?? event.sessionId;
+    const ticket = getSessionById(session)?.ticketId;
     const planned = planFeedBroadcast(config, {
         title: event.title,
         text: event.detail ?? '',
@@ -702,11 +706,16 @@ async function broadcastPostedEvent(event, level, meta, notify = false) {
         project: event.project,
         agent: event.agent,
         host: event.host,
-        session: event.sessionId,
+        session,
         links: (event.attachments ?? [])
             .map((a) => a.href)
             .filter((href) => /^https?:\/\//i.test(href)),
-    });
+    }, meta);
+    // An important post links the session's console page; fire the trace sync now
+    // so that page exists when the owner taps it (trace sync otherwise waits for
+    // run exit — PHNX-3628/PHNX-3698). Gated + best-effort, never blocks the post.
+    if (level === 'important')
+        fireTraceSyncInBackground();
     return runFeedBroadcast(planned, meta);
 }
 /**
@@ -722,9 +731,13 @@ async function broadcastBlock(block, extras, meta, notify = false) {
     const config = withDesktopNotify(effectiveBroadcastConfig(meta.feed?.broadcast, 'important', meta), notify);
     if (!config)
         return [];
-    const ticket = getSessionById(block.sessionId)?.ticketId;
-    const ctx = blockBroadcastContext({ ...block, ticket: block.ticket ?? ticket }, extras);
-    return runFeedBroadcast(planFeedBroadcast(config, ctx), meta);
+    const sessionId = resolveFullSessionId(block.sessionId) ?? block.sessionId;
+    const ticket = getSessionById(sessionId)?.ticketId;
+    const ctx = blockBroadcastContext({ ...block, sessionId, ticket: block.ticket ?? ticket }, extras);
+    // A block is always important and links the session's console page — fire the
+    // trace sync so the page exists when tapped (best-effort, gated, non-blocking).
+    fireTraceSyncInBackground();
+    return runFeedBroadcast(planFeedBroadcast(config, ctx, meta), meta);
 }
 /** One line per sink that ran. Silent when nothing is configured. */
 function reportBroadcast(outcomes) {

package/dist/commands/monitors.js

@@ -248,10 +248,10 @@ function ensureDaemonRunning() {
     const result = startDaemon();
     if (result.pid) {
         console.log(chalk.green(`Daemon started (PID: ${result.pid}). It will watch monitors in the background.`));
-        console.log(chalk.gray('Stop anytime with: agents routines stop'));
+        console.log(chalk.gray('Disable only monitor polling with: agents daemon services disable monitors'));
     }
     else {
-        stderrLine(chalk.yellow('Could not start the daemon. Start it manually with: agents routines start'));
+        stderrLine(chalk.yellow('Could not start the daemon. Start it manually with: agents daemon start'));
     }
     return true;
 }
@@ -947,6 +947,9 @@ export function registerMonitorsCommands(program) {
         console.log(observation.raw.split('\n').slice(0, 20).map((l) => `  ${l}`).join('\n'));
         if (observation.meta)
             console.log(chalk.gray(`  meta: ${JSON.stringify(observation.meta)}`));
+        if (observation.failed) {
+            console.log(chalk.yellow(`  poll failed (${observation.failureReason ?? 'observation failure'}) — not a value change; skipped`));
+        }
         console.log('');
         console.log(`Would fire: ${wouldFire ? chalk.green('yes') : chalk.gray('no')}`);
         if (decision?.event) {

package/dist/commands/projects.d.ts

@@ -13,13 +13,33 @@ import { type LinearMilestone } from '../lib/linear-project-counts.js';
 /** Recursion guard: a peer answering a probe fan-out never re-fans-out itself. */
 export declare const PROJECTS_NO_FANOUT_ENV = "AGENTS_PROJECTS_LOCAL";
 /**
- * Render `agents projects for-cwd`'s output for a resolved (or absent)
- * project name — `--json` always prints `{"name": ...}` even on no match, so
- * a scripted caller can distinguish "ran and found nothing" from a crash;
- * the plain-text form prints nothing on no match. Returns '' when nothing
- * should be printed.
+ * A path-shaped `agents projects view` argument — `.`, `..`, a `~`-prefixed
+ * value, or anything containing a path separator — means "auto-detect the
+ * project for this DIRECTORY", not "a project named literally this". A bare
+ * token (no separators) stays a project name, exactly as before.
  */
-export declare function formatForCwdOutput(name: string | undefined, json: boolean): string;
+export declare function looksLikePath(token: string): boolean;
+/** Machine-readable shape of `agents projects view <path> --json`. */
+export interface ViewDetection {
+    /** Detected project name, or null when no definition contains the path. */
+    name: string | null;
+    /** The detected project's Linear binding; fields are null when unbound. */
+    linear: {
+        name: string | null;
+        projectId: string | null;
+    };
+    /** The detected project's repo/monorepo root (home-relative), or null. */
+    root: string | null;
+}
+/**
+ * Best-effort cwd->project detection for `agents projects view <path>`. Delegates
+ * to the shared {@link projectNameForCwd} (def-root containment, longest wins),
+ * then reads the matched definition's Linear binding and root so ONE call yields
+ * the name AND the Linear projectId. Fail-open: an all-null shape when nothing
+ * contains the path — never throws, so a scripted caller stays unscoped rather
+ * than crashing. This subsumes the removed `agents projects for-cwd`.
+ */
+export declare function detectProjectForPath(cwd: string, defs: ProjectDef[]): ViewDetection;
 /**
  * One compact trailing note for peers that didn't answer the `--fleet`
  * fan-out — unreachable, running an agents-cli too old to carry `projects

package/dist/commands/projects.js

@@ -35,16 +35,33 @@ export const PROJECTS_NO_FANOUT_ENV = 'AGENTS_PROJECTS_LOCAL';
 /** Max peers named in the skipped note before the rest collapse to `+N`. */
 const SKIPPED_NAME_LIMIT = 4;
 /**
- * Render `agents projects for-cwd`'s output for a resolved (or absent)
- * project name — `--json` always prints `{"name": ...}` even on no match, so
- * a scripted caller can distinguish "ran and found nothing" from a crash;
- * the plain-text form prints nothing on no match. Returns '' when nothing
- * should be printed.
+ * A path-shaped `agents projects view` argument — `.`, `..`, a `~`-prefixed
+ * value, or anything containing a path separator — means "auto-detect the
+ * project for this DIRECTORY", not "a project named literally this". A bare
+ * token (no separators) stays a project name, exactly as before.
  */
-export function formatForCwdOutput(name, json) {
-    if (json)
-        return JSON.stringify({ name: name ?? null });
-    return name ?? '';
+export function looksLikePath(token) {
+    return token === '.' || token === '..' || token.startsWith('~') || token.includes('/');
+}
+/**
+ * Best-effort cwd->project detection for `agents projects view <path>`. Delegates
+ * to the shared {@link projectNameForCwd} (def-root containment, longest wins),
+ * then reads the matched definition's Linear binding and root so ONE call yields
+ * the name AND the Linear projectId. Fail-open: an all-null shape when nothing
+ * contains the path — never throws, so a scripted caller stays unscoped rather
+ * than crashing. This subsumes the removed `agents projects for-cwd`.
+ */
+export function detectProjectForPath(cwd, defs) {
+    const name = projectNameForCwd(cwd, defs);
+    const def = name ? defs.find((d) => d.name === name) : undefined;
+    return {
+        name: name ?? null,
+        linear: {
+            name: def?.linear?.name ?? null,
+            projectId: def?.linear?.projectId ?? null,
+        },
+        root: def?.root ?? null,
+    };
 }
 /**
  * One compact trailing note for peers that didn't answer the `--fleet`
@@ -570,17 +587,6 @@ export function registerProjectsCommands(program) {
             console.log(`  ${chalk.bold(row.name.padEnd(w.name))} ${chalk.dim(row.path.padEnd(w.path))} ${chalk.cyan(row.repo.padEnd(w.repo))}${agentsSuffix}`);
         }
     });
-    // ---- for-cwd ----
-    projects
-        .command('for-cwd [cwd]')
-        .description('Resolve a directory to its defined project name (root or a repos[].path/subpath match). Defaults to the current directory.')
-        .option('--json', 'Machine-readable output: {"name": string | null}')
-        .action((cwdArg, opts) => {
-        const name = projectNameForCwd(cwdArg ?? process.cwd(), listProjectDefs());
-        const out = formatForCwdOutput(name, !!opts.json);
-        if (out)
-            console.log(out);
-    });
     // ---- add ----
     projects
         .command('add <name>')
@@ -763,15 +769,42 @@ export function registerProjectsCommands(program) {
             process.stdout.write(formatFleetSkippedNote(fleetSkipped));
     }
     projects
-        .command('status [name]')
+        .command('status [nameOrPath]')
         .alias('view')
-        .description('Progress card for every project across the whole fleet, or one named project (alias: view). Named form also prints every milestone and the stored definition.')
+        .description('Progress card for every project across the whole fleet, or one named project (alias: view). Named form also prints every milestone and the stored definition. A path argument (., .., a ~-prefixed value, a /-containing value, or --path) auto-detects the project that CONTAINS that directory.')
         .option('--json', 'Machine-readable output')
+        .option('--path [dir]', 'Treat the argument as a DIRECTORY and auto-detect the project that contains it (bare --path uses the cwd). With --json prints {name, linear:{name,projectId}, root}, all-null when nothing matches (fail-open, exit 0).')
         .option('--window <days>', 'Window for merged PRs, artifacts, and focus areas', '7')
         .option('--no-remote', 'Skip the GitHub and Linear lookups; faster, offline')
         .option('--device <name...>', 'Scope fleet status to one or more devices (repeatable)')
         .option('--devices <names>', 'Scope fleet status to a comma-separated list of devices')
         .action(async (name, rawOpts) => {
+        // Path mode: an explicit --path, or a path-shaped positional (., .., a
+        // ~-prefixed value, or a /-containing value) means "auto-detect the
+        // project for this DIRECTORY" rather than "a project named literally
+        // this". projectNameForCwd resolves the dir (expandLocalHome +
+        // path.resolve), so `.`, `~/…`, and relative paths all normalize. This
+        // subsumes the removed `agents projects for-cwd`.
+        let detectDir;
+        if (typeof rawOpts.path === 'string')
+            detectDir = rawOpts.path;
+        else if (rawOpts.path === true)
+            detectDir = process.cwd();
+        else if (name !== undefined && looksLikePath(name))
+            detectDir = name;
+        if (detectDir !== undefined) {
+            const detection = detectProjectForPath(detectDir, listProjectDefs());
+            if (rawOpts.json) {
+                console.log(JSON.stringify(detection));
+                return;
+            }
+            if (!detection.name) {
+                console.log(chalk.gray(`No defined project contains ${detectDir}`));
+                return;
+            }
+            // Non-JSON: fall through and render the full card for the detected project.
+            name = detection.name;
+        }
         // Named invocation = `view` depth (all milestones + definition). Unnamed
         // stays the scannable multi-project rollup. `view` is a commander alias
         // of this same command, so there is only one implementation.

package/dist/commands/repo.js

@@ -57,6 +57,41 @@ function syncMarketplacesForDefaults() {
         catch { /* best-effort */ }
     }
 }
+/** Write this device's account metadata before the user repo is committed. */
+async function publishUserRepoAccountState(provisionAuth) {
+    const { publishUsageSnapshotToSharedStore } = await import('../lib/accounting/usage-sync.js');
+    const usage = publishUsageSnapshotToSharedStore();
+    if (usage.error)
+        console.error(chalk.yellow(`Usage snapshot: ${usage.error}`));
+    if (provisionAuth) {
+        const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
+        const auth = await syncReservedAuthBundle();
+        if (auth.pushed.length > 0)
+            console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
+        for (const err of auth.errors)
+            console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
+        return;
+    }
+    const { publishReservedAuthVerdict } = await import('../lib/secrets/reserved-sync.js');
+    const auth = publishReservedAuthVerdict();
+    if (auth.error)
+        console.error(chalk.yellow(`Auth verdict: ${auth.device}: ${auth.error}`));
+}
+/** Consume freshly pulled usage/auth metadata from the local user-repo checkout. */
+async function consumeUserRepoAccountState() {
+    const { consumeUsageSnapshotsFromSharedStore } = await import('../lib/accounting/usage-sync.js');
+    const usage = consumeUsageSnapshotsFromSharedStore();
+    if (usage.merged > 0)
+        console.log(chalk.gray(`Usage snapshot: merged ${usage.merged} row(s) from ${usage.sources.join(', ')}`));
+    for (const err of usage.errors)
+        console.error(chalk.yellow(`Usage snapshot: ${err.device}: ${err.message}`));
+    const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
+    const auth = await syncReservedAuthBundle();
+    if (auth.pushed.length > 0)
+        console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
+    for (const err of auth.errors)
+        console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
+}
 const ALIAS_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
 /** Derive a default alias from a source URL (e.g. gh:foo/.agents-work -> agents-work). */
 function deriveAlias(source) {
@@ -1052,14 +1087,7 @@ export function registerRepoCommands(program) {
             ].filter(Boolean);
             if (parts.length > 0)
                 console.log(chalk.gray(`Device policy: ${parts.join(' · ')}`));
-            const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
-            const auth = syncReservedAuthBundle();
-            if (auth.pushed.length > 0) {
-                console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
-            }
-            for (const err of auth.errors) {
-                console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
-            }
+            await consumeUserRepoAccountState();
         }
     });
     repoCmd
@@ -1095,20 +1123,14 @@ export function registerRepoCommands(program) {
             return;
         }
         for (const t of pushable) {
+            // Account snapshots must exist BEFORE commitAndPush or this push ships
+            // the previous tick's state and delays propagation by one repo cycle.
+            if (t.alias === 'user')
+                await publishUserRepoAccountState(true);
             const spinner = ora(`Pushing ${formatRepoTarget(t.alias, t.dir)}...`).start();
             const result = await commitAndPush(t.dir, options.message);
             if (result.success) {
                 spinner.succeed(`${formatRepoTarget(t.alias, t.dir, result.branch)}: ${result.detail ?? 'pushed'}`);
-                if (t.alias === 'user') {
-                    const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
-                    const auth = syncReservedAuthBundle();
-                    if (auth.pushed.length > 0) {
-                        console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
-                    }
-                    for (const err of auth.errors) {
-                        console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
-                    }
-                }
             }
             else {
                 spinner.fail(`${formatRepoTarget(t.alias, t.dir)}: ${result.error}`);
@@ -1173,8 +1195,23 @@ Examples:
                 }
             }
             const push = t.alias !== 'system';
+            // syncRepoGit pulls then pushes. Seed our conflict-free owner file first
+            // so the same transaction carries it; consume peers after the pull.
+            if (t.alias === 'user')
+                await publishUserRepoAccountState(false);
             const spinner = ora(`Syncing ${formatRepoTarget(t.alias, t.dir)}...`).start();
-            const result = await syncRepoGit(t.dir, { push });
+            const result = t.alias === 'user'
+                ? await (async () => {
+                    const { syncFleetSharedStateRepo } = await import('../lib/fleet-shared-repo-sync.js');
+                    const synced = await syncFleetSharedStateRepo({ userAgentsDir: t.dir });
+                    return {
+                        success: synced.success,
+                        commit: synced.commit ?? '',
+                        pushed: synced.pushed,
+                        error: synced.error ?? synced.skipped ?? undefined,
+                    };
+                })()
+                : await syncRepoGit(t.dir, { push });
             if (result.success) {
                 const pushed = result.pushed ? ' (pushed)' : '';
                 spinner.succeed(`${formatRepoTarget(t.alias, t.dir)}: ${result.commit}${pushed}`);
@@ -1184,6 +1221,7 @@ Examples:
                         recordUserRepoRemote(t.dir, u);
                     const { reconcileDeviceDiscoveryPolicies } = await import('../lib/devices/discovery-policy.js');
                     await reconcileDeviceDiscoveryPolicies();
+                    await consumeUserRepoAccountState();
                 }
             }
             else {

package/dist/commands/resume.d.ts

@@ -1,4 +1,20 @@
+import type { SessionMeta } from '../lib/session/types.js';
 export declare const RESUME_SOURCE_ENV = "AGENTS_RESUME_SOURCE_JSON";
+/**
+ * The source a dead-remote local fallback resumes from: the same session, but
+ * with `machine` rewritten to THIS box so the delegated `agents run --resume`
+ * resolves recovery locally (`sessionRecoveryPeer` returns undefined) instead of
+ * bouncing back to the unreachable owner. Because no local version home owns the
+ * peer's transcript, that local recovery lands on a labelled `/continue` replay
+ * from the synced mirror — the only way to continue a session whose owning device
+ * is gone. Owner-approved prefer-device, fall-back-local (PHNX-3626).
+ *
+ * Safe against the RUSH-2022 "silent local resume forks live state" hazard by
+ * PRECONDITION: this is reached only after `runOnPeer` proved the owner
+ * unreachable, so there is no live process on the peer to fork, and the fallback
+ * is announced with a log line — never silent.
+ */
+export declare function resumeLocalFallbackSource(session: SessionMeta, self?: string): SessionMeta;
 export interface StrictResumeOptions {
     mode?: string;
     interactive?: boolean;

package/dist/commands/resume.js

@@ -7,7 +7,25 @@ import { spawn } from 'child_process';
 import chalk from 'chalk';
 import { resolveSessionMetadataValue } from './sessions.js';
 import { sessionOwnerDevice, consumeResumePinned, RESUME_PINNED_ENV } from '../lib/session/resume-owner.js';
+import { machineId } from '../lib/machine-id.js';
 export const RESUME_SOURCE_ENV = 'AGENTS_RESUME_SOURCE_JSON';
+/**
+ * The source a dead-remote local fallback resumes from: the same session, but
+ * with `machine` rewritten to THIS box so the delegated `agents run --resume`
+ * resolves recovery locally (`sessionRecoveryPeer` returns undefined) instead of
+ * bouncing back to the unreachable owner. Because no local version home owns the
+ * peer's transcript, that local recovery lands on a labelled `/continue` replay
+ * from the synced mirror — the only way to continue a session whose owning device
+ * is gone. Owner-approved prefer-device, fall-back-local (PHNX-3626).
+ *
+ * Safe against the RUSH-2022 "silent local resume forks live state" hazard by
+ * PRECONDITION: this is reached only after `runOnPeer` proved the owner
+ * unreachable, so there is no live process on the peer to fork, and the fallback
+ * is announced with a log line — never silent.
+ */
+export function resumeLocalFallbackSource(session, self = machineId()) {
+    return { ...session, machine: self };
+}
 /**
  * The argv to re-run this resume on the machine that owns the session.
  *
@@ -165,14 +183,30 @@ export async function runStrictResume(sessionId, prompt, options) {
             },
             sessionId: outcome.session.id,
         });
-        if (rc === 'no-target') {
-            console.error(chalk.red(`Session ${outcome.session.shortId} lives on ${owner}, which isn't a reachable device right now.`));
-            console.error(chalk.gray(`Register/wake it (agents devices), or run there: agents ssh ${owner}`));
-            process.exitCode = 1;
+        if (rc === 'no-target' || rc === 'unreachable') {
+            // Prefer-device, fall back to local (PHNX-3626): the owning device is
+            // unreachable — either not a dialable registered device ('no-target') or
+            // registered but offline/asleep so the SSH connection itself failed
+            // ('unreachable'). Either way there is no live harness to reach OR to fork,
+            // so continue the session HERE from its synced mirror rather than
+            // dead-ending. The local recovery resolves this to a labelled `/continue`
+            // replay (no local home owns the peer's transcript), the honest degradation.
+            if (!options.quiet) {
+                process.stderr.write(chalk.yellow(`[agents] session ${outcome.session.shortId} belongs to ${owner}, which is unreachable → resuming locally (/continue replay from the synced transcript)\n`));
+            }
+            process.exitCode = await delegateLocalResume(resumeLocalFallbackSource(outcome.session), prompt, options);
         }
         return;
     }
-    const args = buildResumeRunArgs(outcome.session, prompt, options);
+    process.exitCode = await delegateLocalResume(outcome.session, prompt, options);
+}
+/**
+ * Spawn the delegated local `agents run --resume` for a session this box owns
+ * (or is falling back to). The run command remains the sole executor; recovery
+ * (native vs `/continue`) is resolved there. Returns the child's exit code.
+ */
+async function delegateLocalResume(session, prompt, options) {
+    const args = buildResumeRunArgs(session, prompt, options);
     const child = spawn(process.execPath, [process.argv[1], ...args], {
         stdio: 'inherit',
         env: {
@@ -180,12 +214,11 @@ export async function runStrictResume(sessionId, prompt, options) {
             // Avoid repeating the fleet lookup in the delegated local `run`
             // process. The value is metadata-only and is not forwarded over SSH;
             // the owner performs its own local SQLite lookup.
-            [RESUME_SOURCE_ENV]: JSON.stringify(outcome.session),
+            [RESUME_SOURCE_ENV]: JSON.stringify(session),
         },
     });
-    const exitCode = await new Promise((resolve) => {
+    return new Promise((resolve) => {
         child.once('error', () => resolve(127));
         child.once('exit', (code, signal) => resolve(code ?? (signal ? 1 : 0)));
     });
-    process.exitCode = exitCode;
 }