@phnx-labs/agents-cli 1.22.68 → 1.22.70

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 1.22.70
+
+- **`agents browser stop --profile` is now gated by the remote-control consent gate (PHNX-3317).** `stop --profile <name>` (no `--task`) is handled entirely by `bindTask`'s early return in `ipc.ts`, so it never reached `resolveOrCreateTask` — the one chokepoint every other page/close/attach verb's `assertRemoteControlAllowedForRequest` gate runs through — and `case 'stop'` called `BrowserService.stopProfile()` directly with no consent check at all. That left one destructive fleet-remote path (kills the profile's browser process, clears its runtime dir) reachable from `browser --device <device> stop --profile` even with `remote-control off` on the target. `stopProfile()` now takes the same `{ fleetRemote, actor }` opts as `start`/`showUrl`/`resolveOrCreateTask` and asserts the gate first; a local (non-fleet-remote) call is unaffected. Source: `cli/src/lib/browser/service.ts`, `cli/src/lib/browser/ipc.ts`.
+
+- **The PHNX-2939 headless-account regression test now genuinely exercises the headless path (PHNX-3352).** The real-macOS-keychain test in `account-registry.keychain.test.ts` set `AGENTS_RUNTIME='test-headless-account-launch'`, a made-up value `isHeadlessSecretsContext()` never matches — its set is exactly `headless`/`teams`/`terminal` — so the resolve never entered the headless keychain guard and the test passed identically with OR without the PHNX-2939 biometry-ACL fix, reproducing nothing. It now sets `AGENTS_RUNTIME='headless'` and asserts `isHeadlessSecretsContext()` is `true` before resolving, so the test fails against the pre-fix code (a direct `getKeychainToken` read of the policy-`never`, no-ACL account item is rejected as if it required Touch ID) and passes only because the fix routes through the bundle path that attests `silentNoAcl`. Source: `cli/src/lib/account-registry.keychain.test.ts`.
+
+- **`agents daemon stop` reclaims a stale `browser.sock` when the daemon vanishes mid-stop (PHNX-3618).** `stopDaemonLocked` captured the browser IPC socket's inode ONLY when a live pid resolved (`pid !== null && browserSock ? …`). If the daemon died in the window between the CLI liveness precheck (`isDaemonRunning()` was true) and the locked read, `resolveLiveDaemonPid()` returned null, so the owner was never captured — and the socket the daemon's ungraceful death left on disk hit the else branch, was reported "browser IPC socket ownership could not be verified", and was left behind, so the next daemon start raced a dead binding. The socket inode is now captured **independently of the pid**, and the stale binding is reclaimed once no live daemon — the signalled target OR any successor for this state dir — is proven to own it. PHNX-3607's never-delete-a-successor invariant is preserved: a successor that rebinds during the stop gets a new inode (identity no longer matches) or shows up as a survivor, and in either case its socket is left untouched. Source: `cli/src/lib/daemon/daemon.ts`.
+
+- **`agents run --cloud` no longer rejects a non-expiring Phoenix bearer (PHNX-3645).** A Rush session stores `expires_at: 0` for an opaque Phoenix `pid_` bearer, which by contract means NON-EXPIRING. Three freshness checks read that `0` as an absolute timestamp — `new Date(0)` = 1970-01-01 — and refused a valid, fresh session with `Rush session expired at 1970-01-01`, so no Phoenix-authed box could dispatch a cloud run, push/pull secrets over Rush, or list cloud sessions. The `expires_at === 0` (and missing) special-case now lives in one place, `isRushSessionExpired` (`cli/src/lib/rush-session.ts`), which cloud dispatch, the secrets Rush driver, and the cloud session source all route through — mirroring rush/cli's own `isFresh` (RUSH-1310, PHNX-3637). Source: `cli/src/lib/rush-session.ts`, `cli/src/lib/cloud/rush.ts`, `cli/src/lib/secrets/drivers/rush.ts`, `cli/src/lib/session/cloud.ts`.
+
+- **Owner alerts now render per destination — Slack gets tappable links, iMessage stays plain (PHNX-3698).** `agents notify` / `agents send --to owner` (and an important `feed post` that fans out to the owner) resolve every channel in `owner.policy.normal` and composed ONE plain string for all of them, so a Slack owner destination received a wall of prose with no `<url|label>` links and no tappable session crumb — the labeled-link support already in `composeBroadcastMessage` never fired on the path the owner actually uses. The owner fan-out (`sendToOwner`) now re-renders the body PER destination, keyed on each channel's resolved provider (the same `notify.transports` remap delivery uses): a Slack destination turns every `TEAM-N` key the post names into `<https://linear.app/<ws>/issue/<KEY>|<KEY>>` and the `Sent from claude/<id> on <host>` crumb into `<https://prix.dev/console/sessions/<full-id>|claude/<id>>` (the 8-char crumb upgraded to the full indexed id first), while iMessage / owner-scoped rush / desktop / `command:` sinks stay the plain human sentence with no URLs. Each delivery echoes the exact body it sent, so `agents notify --dry-run --json` now shows the two different bodies. Source: `cli/src/lib/notify.ts`, `cli/src/lib/owner-message.ts`, `cli/src/lib/sink-format.ts`, `cli/src/lib/feed-broadcast.ts`, `cli/src/lib/channels/send.ts`, `cli/src/commands/send.ts`.
+
+- **A release no longer starves waiting for the tip of `main` to be attested (PHNX-3705).** `release.sh` phase 2 required an attestation for `origin/main`'s tree *as of the instant the release ran*, but `attest-main.yml` produces that by running the full suite — minutes of work. On a repo where agents merge continuously, main advances faster than attestation completes, so every release lost the race and died at `missing exact attestation key`. Measured 2026-09-01: six merges to `main` in ~30 minutes with attest-main runs still pending or superseded; the tip was never attested long enough to release from, which also makes the R2 bar (ordinary release under 60s) unreachable by construction. The release does not need *the tip* — it needs a green base to cut the release commit from and derive the release-tree attestation against (PHNX-3696), and any attested **ancestor** serves. Phase 2 now requires an attestation for the tree it is **actually releasing from** (`$BASE_SHA`) rather than the live remote tip, and `derive_release_attestation` inherits from that same commit — the release commit's real parent — instead of the tip. New `cli/scripts/release-attested-base.sh` resolves the newest attested commit at or below `origin/<default>` (bounded lookback, fails closed when none is found), `release-worktree.sh` cuts the release worktree from it and says so on stderr when it is behind the tip, and `release.sh`'s base check now requires an *ancestor* of the remote tip rather than the tip exactly. The supply-chain guarantee is unchanged: the published tarball is still bound to a tree whose suite passed, and `derive`'s allowlist still fails closed on any code file — the release simply ships from a slightly older tree than the tip, which was always true of an attested tree. Source: `cli/scripts/release-attested-base.sh`, `cli/scripts/release-worktree.sh`, `cli/scripts/release.sh`.
+
+- **Docs: sign-in unlocks managed sharing, not only team spaces; `traces setup` marked advanced/self-host.** The README said signing in unlocks "the one thing" — team spaces — which predated managed, private-by-default sharing; it now names both hosted surfaces (team spaces AND `agents artifacts share`/`agents traces sync` on our storage with zero Cloudflare setup, private by default when signed in). The `agents traces setup` command description no longer reads as a normal user step — it is now labeled advanced/self-host, since `agents auth login` syncs to the managed endpoint with no setup. Source: `README.md`, `cli/src/commands/traces.ts`, `cli/docs/command-index.{md,json}`.
+
+## 1.22.69
+
+- **`agents monitors` no longer fires an action on a poll FAILURE (PHNX-3510).** An `[on-change]` monitor treated a failing poll — a `gh pr list … | jq` that intermittently printed `GraphQL: API rate limit already exceeded …` — as a value change: the empty→error→empty flap read as two changes and dispatched a full agent run each time on a premise that was false (~10 sessions burned re-verifying two already-merged PRs). A command/poll source now flags a snapshot that exited non-zero, or whose output matches a transport/auth/rate-limit error shape (caught even on exit 0, since a pipe to jq swallows the failing half's exit code), as an *observation failure*: the engine skips it, leaves watched-state untouched, does not fire, and records it as a failed check so a sustained streak escalates to the owner as a drought. `agents monitors test` labels a failed poll and reports `Would fire: no`. Note: a non-zero exit is now an observation failure rather than a watchable value — a monitor that wants to watch a command's success/failure should emit a stable token (`… && echo UP || echo DOWN`, always exit 0) so the state it cares about diffs as a value; sustained failures still reach the owner via the drought escalation. Source: `cli/src/lib/monitors/sources/failure.ts`, `cli/src/lib/monitors/sources/command.ts`, `cli/src/lib/monitors/engine.ts`, `cli/docs/automation.md`.
+
+- **`agents fleet worktrees` surfaces the worktree-sweep's held set as buckets, not a silent count (PHNX-3520).** The nightly `worktree-sweep` (PHNX-3503, in `phnx-labs/.agents`) reclaims merged agent worktrees and correctly HOLDS anything dirty, unmerged, or undeterminable — but it only ever emitted a `held=<n>` count, so the held set became a permanent, growing residue nothing resolved. Measured 2026-08-30 it is consistently LARGER than the reclaimed set (~800 worktrees fleet-wide), and one bucket inside it is real stranded work: a worktree whose branch carries commits on no remote (the PHNX-2951 / PHNX-2732 class — an agent finished, its commits never reached a remote, nothing surfaced them). The new read-only command classifies every held worktree into its three buckets — **`unmerged-commits`** (the one that matters), **`uncommitted-changes`**, and **`undeterminable`** (`status-unreadable` / `merge-state-unknown`, failing closed exactly as the sweep does) — and reports each with device/repo/worktree/branch/reason/age/size. `--json` is the structured form for machine callers; `--fleet` fans out over every online device and aggregates; `--bucket <name>` filters. The safe recovery action for the stranded bucket is `--push`: it PUBLISHES each `unmerged-commits` branch that is on no remote (re-reading the merge state immediately before pushing and refusing anything already on origin), making the work visible — it never removes a worktree or a branch. The destructive reclaim stays in the sweep; this is the surfacing half the sweep can consume. Source: `cli/src/lib/worktree/held.ts`, `cli/src/commands/ssh.ts`, `cli/src/lib/worktree/held.test.ts`.
+
+- **`agents run` starts ~0.6s faster on a box with many secrets bundles (PHNX-3585).** The AGI EXT "New Claude" boot runs `agents run claude --interactive`, and the whole wrapper cost is spent BEFORE the harness prints anything. Profiling that pre-exec window (new `AGENTS_PROFILE_BOOT=1` per-stage tracer, `cli/src/lib/boot-profile.ts`) showed the dominant stage was `--strategy balanced` account rotation: `readAccountRegistry` → `listBundles` decrypted EVERY file-store bundle's metadata to find the account bundles, and each decrypt runs a fresh scrypt KDF (~12ms) because every `.enc` file carries its own salt — ~690ms of pure KDF on a box with ~40 bundles, on every launch. Bundle metadata is non-secret by contract (it holds `keychain:`/`env:`/literal refs, never the secret bytes, and is already stored no-ACL so `secrets list` enumerates without Touch ID), so the file store now caches the decrypted metadata JSON keyed by each `.enc` file's `(mtime,size)` plus a passphrase fingerprint. Any bundle write (new mtime/size) or passphrase change (new fingerprint; rotation re-writes every file) misses and re-derives — no staleness, self-healing on any miss — and secret VALUE items never enter the cache. Measured on a worker box: `agents run claude` pre-exec `resolve-version` dropped from ~690ms to ~31ms (warm), total pre-exec ~1040ms → ~370ms. A committed `cli/scripts/bench-boot.sh` keeps it measured. Source: `cli/src/lib/secrets/filestore.ts`.
+
+- **Grok's cheap scan now fills `firstUserMessage` from a bounded `chat_history.jsonl` prefix read (PHNX-3621).** The summary-only path never parsed the log. The prefix reader skips Grok `<user_info>` / `synthetic_reason` scaffolding, prefers the first `prompt_index` user turn, and unwraps `<user_query>`. Existing Grok rows backfill through `CONTENT_INDEX_VERSION` v4. Source: `cli/src/lib/session/discover.ts`.
+
+- **Worker homes provisioned before seed-on-attach self-heal their account identity at resolve time (PHNX-3660).** `resolveClaudeSetupToken` required the version home's `.claude.json` to carry `oauthAccount.emailAddress`; homes whose `.oauth_token` was written by a pre-fix `accounts attach` had none, so exec-env injection and per-account usage reads were silently inert for them (they authenticated only via the shim's `.oauth_token` fallback). The resolver now recovers the email by matching the home's `.oauth_token` value against the `auth` bundle (re-encode-guarded slug decode, so a lossy or unmatched token can never invent a mapping), writes it back with `seedClaudeWorkerHomeIdentity` so the home converges after one read, and still fails closed — writing nothing — when the token matches no bundle key. Ambient no-home resolves never rewrite the operator's real `~/.claude.json`. Source: `cli/src/lib/claude-account-token.ts`.
+
+- **Resume `/continue` no longer launches the exhausted origin login when the pick is a provider account (PHNX-3674).** After native-first rotation (PHNX-3626), a usage-limited origin whose transcript is not in the origin home (trash/backup/reinstall, or local fallback from an unreachable peer) fell through to `/continue` on the provider-inclusive pool without carrying `RecoveryAccount`, so exec authenticated as the rate-limited native login. That continue target now injects the healthy provider the same way native rotation does. Source: `cli/src/lib/session/recovery.ts`, `cli/src/commands/exec.ts`.
+
+- **Private share OG covers are no longer cacheable by shared proxies (PHNX-3676).** Token-gated `visibility=private` pages already served HTML as `Cache-Control: private, no-store`, but the generated `/user/slug.png` cover used `public, max-age=31536000, immutable` after the token gate. RFC 9111 lets a shared cache reuse a `public` Authorization response for later unauthenticated requests keyed on the unauthenticated URL, so a Bearer fetch of the cover could leak the preview. `managedCoverHeaders` now treats `private` like `me`/`org` (`private, no-store` + `X-Robots-Tag: noindex`). Source: `cli/src/lib/share/worker-template.ts`.
+
+- **`agents sessions inject` can nudge a live remote tmux session that has no session id, and no longer crashes on `--pane --device` (PHNX-3688).** Two bugs are fixed. (1) A live session whose `agents sessions --active` id column shows `-` — only a tmux label like `ag-claude-214edaae:0.0` is known — was untargetable: `inject <shortid>` failed `No active session matches`. The lookup now matches the `ag-<agent>-<shortid>` tmux name's suffix (and the full name / pane id), the only selector such a row exposes, and the discovered row carries its `tmuxName` so the match has something to key on. (2) `inject _ "text" --pane %122 --device <box>` crashed with `TypeError: host.startsWith is not a function`: under `optsWithGlobals()` the parent `sessions` command's variadic `-D, --device <target...>` shadows this subcommand's scalar `--device`, so a single `--device box` arrived as `['box']` and the array flowed straight into `sshExec`. It is now coerced to one host (and fails loud on more than one, since inject delivers to exactly one terminal). A bare session id combined with `--device` now resolves ON that device — its tmux panes live there, not on the box you typed the command from — by re-running the inject over SSH, the tool-native form of the old `agents ssh <box> "agents sessions inject <id> …"` workaround. Source: `cli/src/commands/sessions-inject.ts`, `cli/src/lib/session/active.ts`.
+
+- **`agents` releases no longer wedge waiting for a human to mint an attestation (PHNX-3696).** RUSH-2666 made an exact-tree attestation for the *release commit* mandatory but shipped no producer for it, so every `release.sh --apply` since 2026-08-15 stopped at `missing exact attestation key` and required an operator to hand-run `release-attestation-produce.sh` and copy the tarball into the store. `attest-main.yml` already attests every push to `main`; the release commit differs from that base only by the version bump, the folded changelog, and the regenerated command index — exactly the set `release-attestation.sh derive` allowlists — so `release.sh` now derives the record itself (`derive_release_attestation`, inheriting the green base's suite via `--inherit-suite-from`, no suite re-run). Soundness is unchanged: `derive` still fails closed if the tree diff touches anything outside that allowlist, so a code change can never inherit a stale pass, and the derive is best-effort — any failure falls through to the previous poll-then-`require`, which still fails loud (the call site guards it with `|| true`, which is load-bearing under `set -euo pipefail`: a bare call returning non-zero would abort the release before that fallback ran). The regression survived review because `release.test.ts` asserted against `release.sh` as *text*; the new coverage executes the real `derive_release_attestation` body against a real git repo and store. Source: `cli/scripts/release.sh`, `cli/scripts/release.test.ts`, `cli/AGENTS.md`.
+
+- **Owner phone pings are short and tappable — but only where a sink can render a link (PHNX-3698).** Every owner-bound message goes through one composer (`composeBroadcastMessage`), and the shared `{message}` now surfaces its links per-sink instead of dumping naked URLs after the footer. A **Slack `channel:` sink** gets mrkdwn labeled links `<url|label>`: the `Sent from claude/6fc1db18 on zion` crumb becomes `<https://prix.dev/console/sessions/<full-id>|claude/6fc1db18>` (an 8-char crumb is first upgraded to the full indexed id, since a truncated id would 404), and every `TEAM-N` key the title or body *names* — not just the session's own `ticketId`, so a ping that only mentions `PHNX-3689` in prose is still tappable — becomes `<https://linear.app/<workspace>/issue/<KEY>|<KEY>>` in place. **iMessage, the owner-scoped rush message, `command:` sinks, and every other channel stay plain** — they cannot render a labeled link and a dumped naked URL reads as noise, so the message is the human sentence with no URLs (keys and crumb as text); there is never a trailing URL line on any sink. `agents notify` and `agents send --to owner` route through that same composer on the owner-scoped (plain) path instead of shipping the raw body dump; a non-owner `agents send` is still delivered verbatim. An important/`--blocked` post (and an owner send) fires a best-effort, opt-in background `agents traces sync` so the linked console page exists when a Slack crumb is tapped (gated exactly like the run-exit arm; `AGENTS_NO_TRACE_SYNC=1` opts out). The Linear-key detector is canonical in one place shared with transcript ticket detection (`session/linear.ts`). Source: `cli/src/lib/feed-broadcast.ts`, `cli/src/lib/owner-message.ts`, `cli/src/lib/session/linear.ts`, `cli/src/lib/session/db.ts`, `cli/src/lib/run-trace-sync.ts`, `cli/src/commands/send.ts`, `cli/src/commands/feed.ts`.
+
+- **An ordinary CLI release no longer signs or notarizes anything on macOS, and the macOS attestation producer works again (PHNX-3699, PHNX-3631).** `release-attestation-produce.sh` gated its sign+notarize block on `uname == Darwin` alone, with no `--with-helpers` condition — so a CLI-only attestation produced on a Mac codesigned the CLI binary and rebuilt + signed both helper `.app`s, none of which ship in the tarball (RUSH-3026 removed the binary, RUSH-3100 the bundles). That violates the R3 requirement ("no signing, no notarization on the ordinary path") and, because `agents secrets exec apple.com` cannot unlock a Touch-ID-gated bundle headlessly, it *killed* the release outright — hit live cutting 1.22.69 right after PHNX-3696 made `release.sh` produce this attestation itself. The block is now gated on `--with-helpers`, so cutting a helper release still signs and an ordinary CLI release does not. Shipped alongside the **PHNX-3631** fix in the same path: `ATTEST_TMP` used `mktemp ".../agents-cli-attest.XXXXXX.json"`, but BSD/macOS `mktemp` only substitutes trailing X's and treats a template with a suffix after them as a literal filename — so the first call created that exact file and every later call died with `mkstemp failed … File exists`. Now `agents-cli-attest.json.XXXXXX`, which GNU accepts identically; the same pattern in `remote-sign-mac.sh` is fixed too. Together these take `release-attestation-produce.test.ts` on macOS from 22-of-29 failing to 31/31 passing. Source: `cli/scripts/release-attestation-produce.sh`, `cli/scripts/remote-sign-mac.sh`.
+
+- **`agents projects view <path>` auto-detects the cwd's project; `projects for-cwd` is gone (PHNX-3704).** `agents projects view [nameOrPath]` now accepts a DIRECTORY as well as a project name. A path-shaped argument — `.`, `..`, a `~`-prefixed value, a `/`-containing value, or an explicit `--path [dir]` (bare `--path` = cwd) — auto-detects the project that contains that directory via the existing path-based `projectNameForCwd` (def-root containment, longest wins); a bare token stays a project name. `view <path> --json` prints `{name, linear:{name,projectId}, root}` in ONE call, so a consumer gets the project name AND its Linear binding without a second `projects list` round-trip. Fail-open: an all-null shape when nothing contains the path, exit 0, never throws. The `projects for-cwd` subcommand and its `formatForCwdOutput` helper are deleted — `view <path> --json` subsumes them. Source: `cli/src/commands/projects.ts`.
+
+- **`agents artifacts share` is private by default when signed in, and storage + visibility now live in one shared module.** A publish with no `--visibility` flag is now `me` (owner-only, Phoenix-gated) instead of `public` — signed in, your share is private unless you opt into `--visibility org` (everyone at your email domain, no org to create) or `--visibility public` (the gallery). A BYO (signed-out) publish still defaults to `public`, since the Worker refuses `me`/`org` without a Phoenix owner. The managed-vs-BYO selection policy and the visibility model are now the single `cli/src/lib/storage/` module (`selectStorageBackendKind` + `publishVisibility`/`defaultVisibilityForBackend`), consumed by both `agents artifacts share` (`lib/share/backend.ts`) and `agents traces sync` (`lib/traces/backend.ts`) instead of each re-deriving it — the seam the `sessions` backup surface reuses next. Failed share calls (publish/list/revisions/delete) now surface the Worker's own error — a 400/413/429 shows its `{"error":"…"}` reason and a 429's `Retry-After` — via one bounded extractor (`lib/share/http-error.ts`) that never dumps an arbitrary body. Source: `cli/src/lib/storage/`, `cli/src/lib/share/{backend,publish,delete,http-error}.ts`, `cli/src/commands/share.ts`.
+
+- **`agents view grok` shows the last-known usage % again instead of a numberless "run grok once to refresh usage".** Two bugs compounded. (1) `getGrokUsageInfo` read `unified.jsonl` from the home it was given, but `agents view` fetches usage per INSTALLED VERSION, passing each version's isolated home (`~/.agents/.history/versions/grok/<ver>`) — whose `.grok/logs/unified.jsonl` never exists, because Grok writes its billing log only to the user's shared real home `~/.grok`. So every version fell back to the refresh hint while the real reading (e.g. week 42%) sat unread in the shared home. Grok usage now resolves the requested home's log first and falls back to the shared `~/.grok` log where Grok actually writes (a per-version log, if one ever appears, still wins). The shared last line is attributed only to the identity that owns `~/.grok` (matching `auth.json`, or the real home itself) — other version-scoped Grok accounts stay as no-recent-usage rather than inheriting that meter. (2) The usage cache serializer persisted only fresh `windows`, dropping the `staleWindows` Grok's collector pre-partitions an ended-period reading onto — so the daemon-refreshed cache the plain `agents view grok` reads rendered the plan alone (no bar), even right after a `--refresh` had shown "W: 42% · stale". The serializer now persists the union of fresh and stale windows; `deserializeClaudeUsageSnapshot` re-runs the freshness gate on read, so the round-trip is preserved for every collector (Claude, which returns raw windows, is unchanged). Source: `cli/src/lib/accounting/usage.ts`.
+
 ## 1.22.68
 
 Fix OpenCode session history to index and backfill the genuine first user request.

package/README.md

@@ -34,7 +34,6 @@
       
   <a href="https://dev.meta.ai/docs/muse-code" title="Meta Muse Code"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/muse.svg"><img src="assets/harnesses/muse-light.svg" height="32" alt="Meta Muse Code" /></picture></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
-  <a href="https://omp.sh" title="Oh My Pi"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/pi.svg"><img src="assets/harnesses/pi-light.svg" height="32" alt="Oh My Pi" /></picture></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
   <a href="https://docs.warp.dev/reference/cli" title="Warp Agent CLI (Oz)"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/warp.svg"><img src="assets/harnesses/warp-light.svg" height="32" alt="Warp Agent CLI" /></picture></a>
 </p>
@@ -54,7 +53,7 @@ agents setup status                    # readiness for browser, computer, fleet,
 agents run claude "explain this repo"  # run any agent on your existing subscription
 ```
 
-Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` exists only for [team spaces](#sign-in). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
+Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` unlocks the hosted surfaces — [team spaces](#sign-in) and managed, private-by-default sharing (`agents artifacts share` / `agents traces sync` with no Cloudflare setup). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
 
 The command surface teaches setup through `agents setup` and group-level `--help`.
 The durable system model starts at [`cli/docs/README.md`](cli/docs/README.md).
@@ -416,11 +415,11 @@ agents sessions resume 019fd0c8-b3e9-77a2-a1a4-444698c4d897  # original harness/
 agents run auto --resume 019fd0c8-b3e9-77a2-a1a4-444698c4d897  # adapt if its account is unavailable
 ```
 
-`agents sessions resume` reopens several sessions in whatever terminal you're in -- auto-detected across iTerm, Ghostty, tmux, and the VSCodium agent-terminal, or forced with `--iterm` / `--ghostty` / `--tmux` / `--vscodium`. `agents sessions resume <id>` resumes one session without requiring you to name its harness: exact IDs take a local SQLite fast path, then resolve fleet-wide and recover on the source device. If the origin version is installed, signed in, healthy, and still owns the indexed transcript, its isolated home performs native resume. Claude launches that native resume from the original project directory recorded before the first turn, so its `projects/<cwd-key>` lookup reaches the conversation even when the session later changed directories. Otherwise a healthy version of the **same harness** starts with `/continue <id>`, which reads the indexed transcript even when the old version home is retained under version trash or the same version number was reinstalled into a new home. It never native-resumes from a different isolated home. Back them with **tmux** and the runs turn durable: detach, close your editor, reboot the GUI -- the session is still alive to `agents tmux attach`. The whole `agents tmux` subsystem (persistent multiplexer sessions that survive editor restarts and can be shared with other tools) sits underneath.
+`agents sessions resume` reopens several sessions in whatever terminal you're in -- auto-detected across iTerm, Ghostty, tmux, and the VSCodium agent-terminal, or forced with `--iterm` / `--ghostty` / `--tmux` / `--vscodium`. `agents sessions resume <id>` resumes one session without requiring you to name its harness: exact IDs take a local SQLite fast path, then resolve fleet-wide and recover on the source device. If the origin version is installed, signed in, healthy, and still owns the indexed transcript, its isolated home performs native resume. Claude launches that native resume from the original project directory recorded before the first turn, so its `projects/<cwd-key>` lookup reaches the conversation even when the session later changed directories. When that origin login is usage-limited but the home still owns the transcript, resume stays native and rotates to a healthy injectable provider account of the **same harness**. `/continue <id>` is the last-resort fallback — a signed-out, revoked, trashed, backup-only, or same-number-reinstalled origin, or a limited origin whose transcript is no longer in that home — and still authenticates as a healthy same-harness account (injecting a provider credential when that is the pick, so it never launches the exhausted native login). It never native-resumes from a different isolated home. Back them with **tmux** and the runs turn durable: detach, close your editor, reboot the GUI -- the session is still alive to `agents tmux attach`. The whole `agents tmux` subsystem (persistent multiplexer sessions that survive editor restarts and can be shared with other tools) sits underneath.
 
 ### Send an agent to the background — and bring it back
 
-Running 30 agents and drowning in terminal tabs? `agents sessions detach <id>` stops a session's interactive process and keeps it working **headless** in the background -- it drives its task to done unattended, no tab, lower cost. `agents sessions resume <id>` brings it back through the same origin-device recovery decision: native resume in the exact healthy origin home, or same-harness `/continue` when that home is unavailable, with the full indexed history (including whatever it did while backgrounded).
+Running 30 agents and drowning in terminal tabs? `agents sessions detach <id>` stops a session's interactive process and keeps it working **headless** in the background -- it drives its task to done unattended, no tab, lower cost. `agents sessions resume <id>` brings it back through the same origin-device recovery decision: native resume in the exact origin home (healthy login, or a rotated injectable account on a usage limit), or same-harness `/continue` as last resort when that home is unavailable, with the full indexed history (including whatever it did while backgrounded).
 
 ```
 agents sessions detach a1b2c3d4     # go headless in the background, keep working
@@ -658,6 +657,9 @@ agents fleet status                     # online/offline rollup + NEEDS ATTENTIO
 agents fleet status --verbose           # full per-device auth/CLI/sync/version grid
 agents fleet status --live              # force a live resource probe (alias of --refresh)
 agents fleet status --json --strict     # scriptable fleet health gate
+agents fleet worktrees                  # held agent worktrees by bucket: stranded (unmerged) · dirty · undeterminable
+agents fleet worktrees --fleet          # aggregate the held set across every online device
+agents fleet worktrees --push           # publish stranded on-no-remote branches (recovers work; never deletes)
 agents devices harnesses                # per device: agent@version · account · signed · quota · ready
 agents devices accounts                 # same, one row per account (which harnesses share it)
 agents devices harnesses --agents claude,codex --json   # scoped, machine-readable
@@ -1087,7 +1089,7 @@ agents browser profiles create cloud \
 
 ## Sign in
 
-Signing in is **optional**. Every local feature — `agents run`, sessions, teams, fleet dispatch, secrets, browser, computer — works with no account. The one thing an account unlocks is **team spaces**, the hosted surface under `agents auth space`. `agents auth` signs this machine in to **Phoenix ID**, the Phoenix Labs account layer behind team spaces. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
+Signing in is **optional**. Every local feature — `agents run`, sessions, teams, fleet dispatch, secrets, browser, computer — works with no account. Signing in unlocks the hosted surfaces: **team spaces** (`agents auth space`) and **managed sharing** — `agents artifacts share` and `agents traces sync` publish to our storage with **zero Cloudflare setup**, and a signed-in `agents artifacts share` is **private by default** (`me`, owner-only) unless you pass `--visibility org`/`public`. `agents auth` signs this machine in to **Phoenix ID**, the Phoenix Labs account layer behind these hosted surfaces. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
 
 ```bash
 agents auth login                        # shows a code, opens a Phoenix-branded page
@@ -1322,6 +1324,7 @@ Sources: a command's stdout (`--watch` / `--poll`), an HTTP endpoint (`--poll-ht
 # Signed in? Just publish — no Cloudflare setup.
 agents auth login
 agents artifacts share plan.html --visibility unlisted      # → https://share.agents-cli.sh/<handle>/<slug>-<id>
+agents artifacts share secret.html --protected              # → https://share.agents-cli.sh/<handle>/<slug>-<id>?k=<token>
 
 # Or provision your own Cloudflare R2 (~$0).
 agents artifacts setup                                      # once: provision bucket + Worker on your CF
@@ -1331,7 +1334,7 @@ agents artifacts share plan.html --label "Q3 fleet plan" --meta kind=plan   # hu
 agents artifacts share plan.html --json                     # URL object for plan-render hooks
 agents artifacts share list --agent claude                  # public gallery, filterable
 agents artifacts share list --meta kind=plan                # exact, repeatable metadata filters
-agents artifacts share list --all                           # include hidden unlisted/me/org pages
+agents artifacts share list --all                           # include hidden unlisted/private/me/org pages
 agents artifacts share list --scope me                      # just the owner-only pages
 agents artifacts share edit fleet --label "Final fleet plan" --meta status=final
 agents artifacts share revisions fleet                      # prior versions kept under a slug
@@ -1353,7 +1356,10 @@ Worker lazily renders and caches the branded 1200×630 Open Graph card at `<slug
 so publishing from Linux does not require a local Chromium; BYO endpoints keep the
 local screenshot fallback. `--visibility unlisted` (hidden aliases
 `--unlisted` / `--private`) is a capability URL: GET still works, the gallery hides it,
-and the Worker sends `X-Robots-Tag: noindex`. `--visibility me` is visible only to
+and the Worker sends `X-Robots-Tag: noindex`. `--protected` (`--visibility private`)
+is token-gated: the published URL carries a secret `?k=` key (`Authorization: Bearer`
+is accepted too) and GET returns 404 without it — treat the whole link as a secret.
+`--visibility me` is visible only to
 you (the signed-in owner); `--visibility org` is visible to anyone at your email
 **domain** — derived from your own address, so it needs a **workspace** Google
 account and is refused on a public-inbox domain (`gmail.com`, `outlook.com`,
@@ -1373,8 +1379,9 @@ single **Phoenix ID** (Google-only device-code OAuth, `agents auth login`) — s
 a Cloudflare API token from your `cloudflare.com` secrets bundle (or `--token`), creates
 an R2 bucket, uploads a tiny Worker, and enables the free `*.workers.dev` subdomain (or
 maps `--domain share.example.com` when the token owns the zone). Writes are bearer-gated
-**through** the Worker (Phoenix bearer or static `WRITE_TOKEN`); reads are **public**, so
-a link outlives the agent. R2 has zero egress + a 10 GB free tier, so BYO is still
+**through** the Worker (Phoenix bearer or static `WRITE_TOKEN`); public and unlisted
+reads are **public** so a link outlives the agent, while `--protected` token-gates
+reads on BYO too. R2 has zero egress + a 10 GB free tier, so BYO is still
 effectively free.
 
 **Fleet mode:** provision one endpoint, then every fleet / cloud / ephemeral agent
@@ -1594,7 +1601,6 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | OpenCode | yes | no | yes | >= 1.1.1 | yes | yes | no | no | `AGENTS.md` | no |
 | Copilot | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Amp | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
-| Kiro | yes | no | yes | >= 2.8.0 | yes | yes | no | >= 1.23.0 | `AGENTS.md` | no |
 | Goose | yes | no | yes | no | no | no | no | no | `AGENTS.md` | no |
 | Roo Code | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Droid | yes | yes | yes | >= 0.57.5 | >= 0.26.0 | yes | yes | yes | `AGENTS.md` | no |
@@ -1615,17 +1621,14 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | Antigravity | -- | yes | -- |
 | Copilot | -- | -- | yes |
 | OpenClaw, Amp, Goose, Roo | -- | -- | -- |
-| Kiro | -- | -- | -- |
 
 ### Version-gated sync
 
 | Capability | Agent | Gate |
 |------------|-------|------|
 | Hooks | Codex | >= 0.116.0 |
-| Subagents | Kiro | >= 1.23.0 |
 | Skills | Droid | >= 0.26.0 |
 | Permissions | Droid | >= 0.57.5 |
-| Permissions | Kiro | >= 2.8.0 |
 | File-based commands | Codex | < 0.117.0 (0.117+ uses command-as-skill) |
 | Plugins | Codex | >= 0.128.0 |
 
@@ -1641,7 +1644,7 @@ Claude Code, Codex CLI, Antigravity, Grok Build, and others each have their own
 
 ### Is it free?
 
-Yes — every feature, with no account and no signup. `agents run`, sessions, teams, fleet dispatch, secrets, browser, and computer automation all work the moment you install. The optional `agents auth login` exists only to unlock hosted team spaces (`agents auth space`); there are no paid tiers. This developer tool is entirely free because we believe developers should have the best tools — fast and robust — so they can create the best products for their users.
+Yes — every feature, with no account and no signup. `agents run`, sessions, teams, fleet dispatch, secrets, browser, and computer automation all work the moment you install. The optional `agents auth login` unlocks the hosted surfaces — team spaces (`agents auth space`) and managed, private-by-default sharing (`agents artifacts share` / `agents traces sync`, no Cloudflare setup); there are no paid tiers. This developer tool is entirely free because we believe developers should have the best tools — fast and robust — so they can create the best products for their users.
 
 ### Is this like `nvm` / `mise` / `asdf` for AI agents?
 

package/dist/bootstrap.js

@@ -19,6 +19,7 @@ import * as path from 'path';
 import { fileURLToPath } from 'url';
 import { detectDevBuild } from './lib/startup/dev-build.js';
 import { configureRootCommand } from './lib/startup/root-command.js';
+import { bootMark } from './lib/boot-profile.js';
 // `ora`, `@inquirer/prompts`, `./commands/utils.js`, and the agents/versions/shims
 // modules are imported dynamically at their use sites: they are needed only on
 // interactive / update / shim-repair paths, never for fast commands like
@@ -1029,6 +1030,7 @@ if (helpAllRequested) {
 // immediately: skip the update check (PATH scan + cache read) and the detached
 // background sync (spawns a child process) that every other invocation runs.
 if (!isDocumentationRequest) {
+    bootMark('bootstrap:evaluated');
     // Run update check before parsing so the upgrade notice/prompt precedes output.
     await checkForUpdates();
     // Fire-and-forget the background sync. System repo gets a real fast-forward
@@ -1157,6 +1159,7 @@ if (passedArgs.length === 0) {
 }
 try {
     await maybeBootstrapShimIntegration(requestedCommand, isDocumentationRequest, verboseStartup);
+    bootMark('bootstrap:pre-parse');
     await program.parseAsync();
 }
 catch (err) {

package/dist/commands/accounts.js

@@ -336,7 +336,10 @@ export async function listSwitchableAccounts(agent) {
  */
 export function setDefaultAccount(agentRaw, name) {
     const agent = parseHarness(agentRaw);
-    const account = findUnifiedAccount(name, readMeta());
+    // Scope to the harness this default is FOR: a bare identity (`<email>`) matches
+    // every harness that identity is signed into, so an un-scoped lookup resolved
+    // the wrong row and then rejected it as "is a <other> login" just below.
+    const account = findUnifiedAccount(name, readMeta(), undefined, agent);
     if (!account)
         throw new Error(`Unknown account '${name}'.`);
     if (account.kind === 'provider') {
@@ -519,14 +522,19 @@ agents run codex#work`,
         .action(async (name, target, _o, command) => {
         await runAccountsAction(command, async () => {
             const meta = readMeta();
-            const account = findUnifiedAccount(name, meta);
+            // Validate the target exists before mutating any binding — and resolve it
+            // FIRST so the account lookup can be scoped to the harness being attached
+            // to. `identityLabel` defaults to the login's email, so a bare identity
+            // (`muqsitnawaz@gmail.com`) matches every harness that identity is signed
+            // into; un-scoped this resolved whichever row the store ordered first and
+            // then rejected it below as "is a <other> login".
+            const t = classifyAttachTarget(target);
+            const targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
+            const account = findUnifiedAccount(name, meta, undefined, targetAgent);
             if (!account)
                 throw new Error(`Unknown account '${name}'.`);
             if (account.kind === 'native')
                 assertNativeAccountNameable(account.agent);
-            // Validate the target exists before mutating any binding.
-            const t = classifyAttachTarget(target);
-            const targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
             if (account.kind === 'native') {
                 // A provider-backed profile injects provider env at spawn, which would run
                 // under a different credential than the native identity claims — refuse it.
@@ -572,7 +580,7 @@ agents run codex#work`,
                 // Provider account: it must be able to authenticate the target's harness.
                 getAccountProvider(account.provider).envFor(targetAgent, account.auth);
             }
-            bindAccount(name, target);
+            bindAccount(name, target, targetAgent);
             writeClaudeInteractiveOauthToken(t, targetAgent, account.kind === 'native' && account.agent === 'claude' ? account.identityLabel : undefined);
             console.log(chalk.green(`Attached ${account.name} to ${target}.`));
         });
@@ -581,7 +589,15 @@ agents run codex#work`,
         .description('Remove one account attachment')
         .action(async (name, target, _o, command) => {
         await runAccountsAction(command, () => {
-            unbindAccount(name, target);
+            // Classify the target first so the unbind is scoped to the right harness
+            // for a colliding identity selector (same as the attach path).
+            let targetAgent;
+            try {
+                const t = classifyAttachTarget(target);
+                targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
+            }
+            catch { /* an unresolvable target still unbinds by whatever row matches */ }
+            unbindAccount(name, target, targetAgent);
             // With the binding gone, no setup-token resolves for this version home, so this
             // clears any .oauth_token the attach left behind (else interactive runs would keep
             // authenticating as the just-detached account).

package/dist/commands/exec.js

@@ -27,6 +27,7 @@ import { randomUUID } from 'crypto';
 import { isSessionTrackedAgent } from '../lib/session/types.js';
 import { applyActiveRulesPresetAtRun } from '../lib/rules/run-sync.js';
 import { handleBroadcast } from './run-broadcast.js';
+import { bootMark } from '../lib/boot-profile.js';
 /** Distinguish a terminal account-picker marker from an explicit @version pin. */
 export function parseRunAccountPickerRequest(agentSpec) {
     const requested = agentSpec.endsWith('@');
@@ -690,6 +691,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
     `,
     });
     runCmd.action(async (agentSpec, prompt, options, command) => {
+        bootMark('run-action:enter');
         // Capture everything after -- as passthrough args forwarded verbatim to the
         // underlying CLI. Commander strips the literal `--` and folds what follows
         // into the positional operands (so `agents run codex -- --yolo` would parse
@@ -1806,6 +1808,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             import('../lib/capabilities.js'),
             import('../lib/share/config.js'),
         ]);
+        bootMark('run-deps:imported');
         const isValidAgent = (agent) => ALL_AGENT_IDS.includes(agent);
         // Parse agent@version#label. The label selects native auth without pinning
         // the binary version; --account remains the equivalent flag form.
@@ -2241,7 +2244,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             const { pickSessionInteractive } = await import('./sessions.js');
             const { buildContinuePrompt } = await import('../lib/loop.js');
             // Freshen the index for this agent before any lookup (incremental, cached).
-            // AgentId is wider than SessionAgentId (amp/kiro/goose/copilot keep no transcripts);
+            // AgentId is wider than SessionAgentId (amp/goose/copilot keep no transcripts);
             // those simply yield no matches and fall through to the not-found error.
             const sessionAgent = agent;
             if (!resolvedResumeSource)
@@ -2345,6 +2348,25 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 process.exit(1);
             }
             version = resolvedRecoveryTarget.version;
+            // Account rotation (PHNX-3626 / PHNX-3674): recovery picked a healthy
+            // provider of the SAME harness. Inject that credential through the
+            // `--account` path so spawn does not authenticate as the version home's
+            // native login (the exhausted origin when the continue pick is a
+            // provider). An explicit --account (configuredAccount) always wins.
+            const rotatedAccount = resolvedRecoveryTarget.account;
+            if (rotatedAccount && !configuredAccount) {
+                try {
+                    const picked = resolveSpawnAccount(rotatedAccount.providerAccount, agent, version, readMeta(), { useDefault: false });
+                    if (picked?.kind === 'provider')
+                        accountEnv = picked.env;
+                }
+                catch {
+                    // Account-registry errors can carry provider credential material;
+                    // never relay them onto the terminal from this automatic path.
+                    console.error(chalk.red('Could not prepare the rotated provider account for session recovery.'));
+                    process.exit(1);
+                }
+            }
             if (resolvedRecoveryTarget.mode === 'native') {
                 version = session.version;
                 resumeNative = true;
@@ -2355,27 +2377,8 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 // differ from the earlier cwd that selected projects/<cwd-key>.
                 if (!options.cwd && resolvedRecoveryTarget.cwd)
                     options.cwd = resolvedRecoveryTarget.cwd;
-                // Account rotation on a limit (PHNX-3626): recovery kept resume NATIVE
-                // in the origin home but rotated to a healthy provider account of the
-                // SAME harness. Inject that credential through the same `--account`
-                // path an explicit selection uses, so exec authenticates as the
-                // rotated account while reading the origin transcript. An explicit
-                // --account (configuredAccount) always wins — never rotate over it.
-                const rotatedAccount = resolvedRecoveryTarget.account;
-                if (rotatedAccount && !configuredAccount) {
-                    try {
-                        const picked = resolveSpawnAccount(rotatedAccount.providerAccount, agent, version, readMeta(), { useDefault: false });
-                        if (picked?.kind === 'provider')
-                            accountEnv = picked.env;
-                    }
-                    catch {
-                        // Account-registry errors can carry provider credential material;
-                        // never relay them onto the terminal from this automatic path.
-                        console.error(chalk.red('Could not prepare the rotated provider account for native resume.'));
-                        process.exit(1);
-                    }
-                    if (!options.quiet)
-                        process.stderr.write(chalk.gray(`[agents] origin ${agent} account limited → rotated to ${rotatedAccount.label} (native resume)\n`));
+                if (rotatedAccount && !configuredAccount && !options.quiet) {
+                    process.stderr.write(chalk.gray(`[agents] origin ${agent} account limited → rotated to ${rotatedAccount.label} (native resume)\n`));
                 }
                 if (!options.quiet)
                     process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (native)${version ? ` @${version}` : ''} in ${options.cwd ?? cwd}\n`));
@@ -2386,6 +2389,9 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 prompt = buildContinuePrompt(session.id, prompt);
                 if (prompt.trim() === `/continue ${session.id}`)
                     forceInteractive = true;
+                if (rotatedAccount && !configuredAccount && !options.quiet) {
+                    process.stderr.write(chalk.gray(`[agents] origin ${agent} account limited → rotated to ${rotatedAccount.label} (/continue)\n`));
+                }
                 if (!options.quiet)
                     process.stderr.write(chalk.gray(`Resuming ${agent} ${session.shortId} (/continue replay)${version ? ` @${version}` : ''}\n`));
             }
@@ -2443,7 +2449,9 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     // ones sitting in a version home (RUSH-3182). Run-path only — the
                     // picker's other callers keep the native-only collector.
                     const { collectRunCandidatesForRun } = await import('../lib/accounting/account-pool-collect.js');
+                    bootMark('resolve-version:start');
                     const resolved = await resolveRunVersion(agent, strategy, cwd, collectRunCandidatesForRun);
+                    bootMark('resolve-version:done');
                     if (resolved.exhausted) {
                         // Zero healthy accounts splits two ways, and conflating them is what
                         // stranded a logged-out harness with no way in at all (RUSH-2334):
@@ -2610,6 +2618,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 version = healed;
             }
         }
+        bootMark('ensure-runnable:done');
         // The harness may simply not be on this machine. The self-heal above only
         // runs when a managed version resolved, so with nothing installed we used
         // to fall through and spawn the bare `cliCommand`, which dies as
@@ -2646,6 +2655,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         if (defaultVersion) {
             applyActiveRulesPresetAtRun(agent, defaultVersion, getVersionHomePath(agent, defaultVersion));
         }
+        bootMark('rules-sync:done');
         // Login preflight (advisory, warn + continue). On a local INTERACTIVE
         // launch, probe whether this agent's account has a credential and print a
         // one-line warning if it looks logged out — so you find out BEFORE the TUI
@@ -2713,7 +2723,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             process.exit(1);
         }
         // Default CLI mode is the generic 'plan'. Agents without a read-only
-        // mode (antigravity, kiro, …) degrade via resolveMode to their
+        // mode (antigravity, …) degrade via resolveMode to their
         // safest native mode (modes[0], typically edit). That covers both the
         // implicit default and an explicit `--mode plan`, so multi-agent
         // scripts can pass a uniform plan flag without per-agent branching.

package/dist/commands/feed.js

@@ -5,7 +5,8 @@ import { projectKeyFromCwd } from '../lib/project-key.js';
 import { postFeedStatus } from '../lib/feed-post.js';
 import { linearIssueUrl } from '../lib/session/linear.js';
 import { parseFeedPostLevel, planFeedBroadcast, runFeedBroadcast, effectiveBroadcastConfig, withDesktopNotify, blockBroadcastContext, blockDeliveryFailure, } from '../lib/feed-broadcast.js';
-import { getSessionById } from '../lib/session/db.js';
+import { getSessionById, resolveFullSessionId } from '../lib/session/db.js';
+import { fireTraceSyncInBackground } from '../lib/run-trace-sync.js';
 import { readMeta } from '../lib/state.js';
 import { enrichBlocksFromSessions, groupBlocksByOutcome, isUnambiguousOutcomeAnswer, openBlocksForOutcome, stampBlockOutcomes, } from '../lib/feed-outcome.js';
 import { classifyBlock, filterBlocksForFeed, suppressionDigest, } from '../lib/ask-classifier.js';
@@ -692,7 +693,10 @@ async function broadcastPostedEvent(event, level, meta, notify = false) {
     const config = withDesktopNotify(effectiveBroadcastConfig(meta.feed?.broadcast, level, meta), notify);
     if (!config)
         return [];
-    const ticket = getSessionById(event.sessionId)?.ticketId;
+    // Upgrade an 8-char footer crumb to the full indexed id so the console session
+    // URL resolves instead of 404ing, and so the ticket join hits the right row.
+    const session = resolveFullSessionId(event.sessionId) ?? event.sessionId;
+    const ticket = getSessionById(session)?.ticketId;
     const planned = planFeedBroadcast(config, {
         title: event.title,
         text: event.detail ?? '',
@@ -702,11 +706,16 @@ async function broadcastPostedEvent(event, level, meta, notify = false) {
         project: event.project,
         agent: event.agent,
         host: event.host,
-        session: event.sessionId,
+        session,
         links: (event.attachments ?? [])
             .map((a) => a.href)
             .filter((href) => /^https?:\/\//i.test(href)),
-    });
+    }, meta);
+    // An important post links the session's console page; fire the trace sync now
+    // so that page exists when the owner taps it (trace sync otherwise waits for
+    // run exit — PHNX-3628/PHNX-3698). Gated + best-effort, never blocks the post.
+    if (level === 'important')
+        fireTraceSyncInBackground();
     return runFeedBroadcast(planned, meta);
 }
 /**
@@ -722,9 +731,13 @@ async function broadcastBlock(block, extras, meta, notify = false) {
     const config = withDesktopNotify(effectiveBroadcastConfig(meta.feed?.broadcast, 'important', meta), notify);
     if (!config)
         return [];
-    const ticket = getSessionById(block.sessionId)?.ticketId;
-    const ctx = blockBroadcastContext({ ...block, ticket: block.ticket ?? ticket }, extras);
-    return runFeedBroadcast(planFeedBroadcast(config, ctx), meta);
+    const sessionId = resolveFullSessionId(block.sessionId) ?? block.sessionId;
+    const ticket = getSessionById(sessionId)?.ticketId;
+    const ctx = blockBroadcastContext({ ...block, sessionId, ticket: block.ticket ?? ticket }, extras);
+    // A block is always important and links the session's console page — fire the
+    // trace sync so the page exists when tapped (best-effort, gated, non-blocking).
+    fireTraceSyncInBackground();
+    return runFeedBroadcast(planFeedBroadcast(config, ctx, meta), meta);
 }
 /** One line per sink that ran. Silent when nothing is configured. */
 function reportBroadcast(outcomes) {

package/dist/commands/import.js

@@ -56,7 +56,7 @@ async function runImport(agentArg, opts) {
     if (!opts.isolated) {
         assertIsolationBoundary(agentId, 'adopt your existing install');
     }
-    // installScript-based agents (Grok, Antigravity, Cursor, Kiro, Goose, Roo)
+    // installScript-based agents (Grok, Antigravity, Cursor, Goose, Roo)
     // don't have an npm package; their binary lives wherever the curl/brew
     // installer dropped it. We adopt by symlinking that PATH binary directly
     // into the version's `node_modules/.bin/`. No package.json walk.
@@ -345,7 +345,7 @@ When to use:
   pointing at the existing install — nothing is copied or moved (except the
   agent's config dir, which is moved into the version's home). Works for both
   npm-style packages (claude, codex, opencode, openclaw) and
-  installScript-based agents (grok, antigravity, cursor, kiro, goose).
+  installScript-based agents (grok, antigravity, cursor, goose).
 `)
         .action((...args) => withIsolationBoundary(() => runImport(...args)));
 }

package/dist/commands/models.js

@@ -18,13 +18,13 @@ import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/widt
 import { wrapJoined } from './inspect.js';
 import { setHelpSections } from '../lib/help.js';
 import { formatRunDefaultEntry, listRunDefaults, parseRunDefaultSelector, setRunDefault, } from '../lib/run-defaults.js';
-const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi', 'grok', 'droid', 'pi'];
+const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi', 'grok', 'droid'];
 /**
  * Agents that don't necessarily install under ~/.agents/versions (cursor ships
  * via a curl script). For these, fall back to the PATH binary and synthesize
  * a version label from the install path so cache keys stay stable.
  */
-const PATH_ONLY_AGENTS = new Set(['cursor', 'pi']);
+const PATH_ONLY_AGENTS = new Set(['cursor']);
 /** Derive a version label from the PATH-installed binary location for agents without managed versions. */
 function fallbackPathVersion(agent) {
     const src = locateModelSource(agent, 'unresolved');

package/dist/commands/monitors.js

@@ -947,6 +947,9 @@ export function registerMonitorsCommands(program) {
         console.log(observation.raw.split('\n').slice(0, 20).map((l) => `  ${l}`).join('\n'));
         if (observation.meta)
             console.log(chalk.gray(`  meta: ${JSON.stringify(observation.meta)}`));
+        if (observation.failed) {
+            console.log(chalk.yellow(`  poll failed (${observation.failureReason ?? 'observation failure'}) — not a value change; skipped`));
+        }
         console.log('');
         console.log(`Would fire: ${wouldFire ? chalk.green('yes') : chalk.gray('no')}`);
         if (decision?.event) {

package/dist/commands/permissions.js

@@ -377,8 +377,8 @@ Examples:
             //
             // This used to hardcode `.json`/`.jsonc`/`.toml` plus a `.claude`/
             // `.opencode`/`.codex` substring, which excluded the ten other harnesses
-            // the CLI writes -- and excluded kiro/hermes twice over, since
-            // their configs are YAML. The registry already answers this by matching
+            // the CLI writes -- and excluded hermes twice over, since
+            // its config is YAML. The registry already answers this by matching
             // each harness's own declared path, so ask it (RUSH-2676).
             const isAgentConfig = detectPermissionAgentFromPath(localPath) !== null;
             if (isAgentConfig) {

package/dist/commands/projects.d.ts

@@ -13,13 +13,33 @@ import { type LinearMilestone } from '../lib/linear-project-counts.js';
 /** Recursion guard: a peer answering a probe fan-out never re-fans-out itself. */
 export declare const PROJECTS_NO_FANOUT_ENV = "AGENTS_PROJECTS_LOCAL";
 /**
- * Render `agents projects for-cwd`'s output for a resolved (or absent)
- * project name — `--json` always prints `{"name": ...}` even on no match, so
- * a scripted caller can distinguish "ran and found nothing" from a crash;
- * the plain-text form prints nothing on no match. Returns '' when nothing
- * should be printed.
+ * A path-shaped `agents projects view` argument — `.`, `..`, a `~`-prefixed
+ * value, or anything containing a path separator — means "auto-detect the
+ * project for this DIRECTORY", not "a project named literally this". A bare
+ * token (no separators) stays a project name, exactly as before.
  */
-export declare function formatForCwdOutput(name: string | undefined, json: boolean): string;
+export declare function looksLikePath(token: string): boolean;
+/** Machine-readable shape of `agents projects view <path> --json`. */
+export interface ViewDetection {
+    /** Detected project name, or null when no definition contains the path. */
+    name: string | null;
+    /** The detected project's Linear binding; fields are null when unbound. */
+    linear: {
+        name: string | null;
+        projectId: string | null;
+    };
+    /** The detected project's repo/monorepo root (home-relative), or null. */
+    root: string | null;
+}
+/**
+ * Best-effort cwd->project detection for `agents projects view <path>`. Delegates
+ * to the shared {@link projectNameForCwd} (def-root containment, longest wins),
+ * then reads the matched definition's Linear binding and root so ONE call yields
+ * the name AND the Linear projectId. Fail-open: an all-null shape when nothing
+ * contains the path — never throws, so a scripted caller stays unscoped rather
+ * than crashing. This subsumes the removed `agents projects for-cwd`.
+ */
+export declare function detectProjectForPath(cwd: string, defs: ProjectDef[]): ViewDetection;
 /**
  * One compact trailing note for peers that didn't answer the `--fleet`
  * fan-out — unreachable, running an agents-cli too old to carry `projects