@phnx-labs/agents-cli 1.22.68 → 1.22.70

package/dist/lib/agent-spec/agents.js

@@ -2,7 +2,7 @@
  * Core agent configuration and detection module.
  *
  * Defines the canonical registry of current and legacy AI coding agents (Claude,
- * Codex, Gemini, Cursor, OpenCode, OpenClaw, Copilot, Amp, Kiro, Goose, Grok)
+ * Codex, Gemini, Cursor, OpenCode, OpenClaw, Copilot, Amp, Goose, Grok)
  * with their CLI commands, config paths, capability flags, and MCP integration
  * points.
  *
@@ -413,52 +413,6 @@ export const AGENTS = {
         supportsHooks: true,
         capabilities: { hooks: { since: '0.3.130' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: { since: '1.1.1' }, skills: true, commands: true, plugins: true, subagents: true, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit'], interactiveRepl: true },
     },
-    // Oh My Pi (`omp`, omp.sh) — a Bun-based, terminal-first coding agent that runs
-    // against many model providers (OpenRouter, OpenAI, Anthropic, xAI, DeepSeek,
-    // Ollama, LM Studio, …). It is Claude-compatible: it natively discovers
-    // `.claude/commands`, `.mcp.json`, and Claude-shaped subagents, and keeps its
-    // own native resources under `~/.omp/agent/` (config dir reported by
-    // `omp config path`). configDir points AT the agent dir (not `~/.omp`) so the
-    // rules file lands at `~/.omp/agent/AGENTS.md`, the user context file omp reads.
-    pi: {
-        id: 'pi',
-        name: 'Pi',
-        sessionDir: null,
-        sessionFileExt: null,
-        versionStdoutMatch: 'semver',
-        unmanagedBinary: 'path',
-        mcpRegister: 'cli',
-        mcpAddHttp: 'transport',
-        mcpAddStdio: 'simple',
-        mcpConfigWrite: 'json-mcpServers',
-        color: 'magenta',
-        cliCommand: 'omp',
-        npmPackage: '@oh-my-pi/pi-coding-agent',
-        configDir: path.join(HOME, '.omp', 'agent'),
-        commandsDir: path.join(HOME, '.omp', 'agent', 'commands'),
-        commandsSubdir: 'commands',
-        skillsDir: path.join(HOME, '.omp', 'agent', 'skills'),
-        hooksDir: 'hooks',
-        instructionsFile: 'AGENTS.md',
-        format: 'markdown',
-        variableSyntax: '$ARGUMENTS',
-        // omp hooks are per-tool JS/TS extension modules discovered from
-        // `~/.omp/agent/hooks/{pre,post}/<tool>.<ext>` (loaded as HookFactory code),
-        // NOT the event->shell-command registrations agents-cli's hook sync writes.
-        // The two models don't map, so hooks stay off (capabilities.hooks:false).
-        supportsHooks: false,
-        // MCP: omp reads `.mcp.json` with the Claude `{ "mcpServers": {...} }` schema
-        // at user scope (`~/.omp/agent/.mcp.json`) and project scope (`<root>/.mcp.json`),
-        // stdio + http + sse with headers. skills (`~/.omp/agent/skills/<name>/SKILL.md`),
-        // commands (`~/.omp/agent/commands/*.md`), and subagents (`~/.omp/agent/agents/*.md`,
-        // Claude-shaped) are all native. allowlist is OFF: omp gates approval per-TOOL
-        // only (`tools.approval` record: allow|prompt|deny) with no command/path/domain
-        // patterns, so agents-cli's granular permission format has nothing to map to.
-        // plugins are npm packages / TS modules, not the Claude marketplace manifest.
-        // interactiveRepl: true — bare `omp` runs the TUI; `omp -p` is the one-shot
-        // form that answers a prompt and exits (upstream README, "Four entry points").
-        capabilities: { hooks: false, mcp: true, mcpHttp: true, mcpHeaders: true, allowlist: false, skills: true, commands: true, plugins: false, subagents: true, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], interactiveRepl: true },
-    },
     openclaw: {
         id: 'openclaw',
         name: 'OpenClaw',
@@ -560,39 +514,6 @@ export const AGENTS = {
         // interactiveRepl: false — amp requires a prompt; bare invocation exits immediately.
         capabilities: { hooks: false, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: false, skills: true, commands: true, plugins: false, subagents: false, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit'], interactiveRepl: false },
     },
-    kiro: {
-        id: 'kiro',
-        name: 'Kiro',
-        sessionDir: null,
-        sessionFileExt: null,
-        versionStdoutMatch: 'semver',
-        unmanagedBinary: 'path',
-        mcpRegister: 'cli',
-        mcpAddHttp: 'transport',
-        mcpAddStdio: 'simple',
-        mcpConfigWrite: 'json-mcpServers',
-        color: 'greenBright',
-        cliCommand: 'kiro-cli',
-        npmPackage: '',
-        installScript: 'brew install --cask kiro-cli',
-        configDir: path.join(HOME, '.kiro'),
-        commandsDir: path.join(HOME, '.kiro', 'commands'),
-        commandsSubdir: 'commands',
-        skillsDir: path.join(HOME, '.kiro', 'skills'),
-        // Hooks: v3 standalone files under ~/.kiro/hooks/*.json
-        // (`{ "version": "v1", "hooks": [...] }`). Fixed PreToolUse/PostToolUse
-        // firing in kiro-cli 0.10; fully stable by 2.6.1. Launch always passes
-        // --v3 (see AGENT_COMMANDS.kiro) so the standalone files actually load.
-        // See registerHooksForKiro.
-        hooksDir: 'hooks',
-        instructionsFile: 'AGENTS.md',
-        format: 'markdown',
-        variableSyntax: '$ARGUMENTS',
-        supportsHooks: true,
-        // interactiveRepl: false — kiro-cli requires a prompt for coding sessions; bare
-        // invocation does not open a persistent REPL.
-        capabilities: { hooks: { since: '0.10.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: { since: '2.8.0' }, skills: true, commands: true, plugins: false, subagents: { since: '1.23.0' }, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit'], interactiveRepl: false },
-    },
     goose: {
         id: 'goose',
         name: 'Goose',
@@ -1117,7 +1038,7 @@ export const MANAGED_AGENT_IDS = ALL_AGENT_IDS.filter((id) => !AGENTS[id].deprec
  * `curl … | sh` / `brew install` script that carries NO version token — the
  * installer can only ever fetch the *current* release, and the binary then keeps
  * itself up to date in place (droid, grok, antigravity, cursor, hermes,
- * kiro, goose). There is no semver to pin, so agents-cli must not model these as
+ * goose). There is no semver to pin, so agents-cli must not model these as
  * having multiple installable version-homes the way it does for npm-packaged
  * agents (claude, codex, kimi, …).
  *
@@ -3029,8 +2950,6 @@ export const AGENT_NAME_ALIASES = {
     gh: 'copilot',
     amp: 'amp',
     sourcegraph: 'amp',
-    kiro: 'kiro',
-    'kiro-cli': 'kiro',
     goose: 'goose',
     'block-goose': 'goose',
     antigravity: 'antigravity',

package/dist/lib/boot-profile.d.ts

@@ -0,0 +1,14 @@
+/** True when `AGENTS_PROFILE_BOOT` is set — callers can skip building label strings. */
+export declare function bootProfileEnabled(): boolean;
+/**
+ * Record a named stage boundary. No-op unless `AGENTS_PROFILE_BOOT` is set, so
+ * this is free to call unconditionally on the launch path.
+ */
+export declare function bootMark(label: string): void;
+/**
+ * Print the collected timeline to stderr, once. Called right before the harness
+ * child is spawned (the end of the pre-exec window) and again as an
+ * `process.on('exit')` backstop for launch paths that error out before spawn.
+ * `reason` labels the final boundary (e.g. `spawn`, `exit`).
+ */
+export declare function flushBootProfile(reason: string): void;

package/dist/lib/boot-profile.js

@@ -0,0 +1,66 @@
+/**
+ * Boot-time profiler for the `agents run` pre-exec phase (PHNX-3585).
+ *
+ * The AGI EXT "New Claude" boot spends the whole `agents run` wrapper cost
+ * BEFORE the harness prints anything — version resolution, account rotation,
+ * config sync, login preflight. This module makes that window measurable
+ * without a debugger: gate it on `AGENTS_PROFILE_BOOT=1` and the run path
+ * stamps named marks, then flushes a per-stage timeline to stderr the instant
+ * before the child is spawned (the moment the wrapper's work ends).
+ *
+ * All marks are `performance.now()` values, which Node measures from
+ * `performance.timeOrigin` ≈ process start — so a mark's absolute value is
+ * "ms since the `agents` process began", and consecutive marks give the cost
+ * of each stage. When the env flag is off, every function here is a couple of
+ * cheap branches and pushes nothing, so it is safe to leave wired on the hot
+ * path (the committed `scripts/bench-boot.sh` benchmark drives it).
+ */
+import { performance } from 'node:perf_hooks';
+const ENABLED = process.env.AGENTS_PROFILE_BOOT === '1' || process.env.AGENTS_PROFILE_BOOT === 'true';
+const marks = [];
+let flushed = false;
+/** True when `AGENTS_PROFILE_BOOT` is set — callers can skip building label strings. */
+export function bootProfileEnabled() {
+    return ENABLED;
+}
+/**
+ * Record a named stage boundary. No-op unless `AGENTS_PROFILE_BOOT` is set, so
+ * this is free to call unconditionally on the launch path.
+ */
+export function bootMark(label) {
+    if (!ENABLED)
+        return;
+    marks.push({ label, at: performance.now() });
+}
+/**
+ * Print the collected timeline to stderr, once. Called right before the harness
+ * child is spawned (the end of the pre-exec window) and again as an
+ * `process.on('exit')` backstop for launch paths that error out before spawn.
+ * `reason` labels the final boundary (e.g. `spawn`, `exit`).
+ */
+export function flushBootProfile(reason) {
+    if (!ENABLED || flushed)
+        return;
+    flushed = true;
+    bootMark(reason);
+    if (marks.length === 0)
+        return;
+    const start = 0; // process start
+    const end = marks[marks.length - 1].at;
+    const width = Math.max(...marks.map((m) => m.label.length));
+    const lines = [];
+    lines.push(`[boot-profile] pre-exec timeline (total ${(end - start).toFixed(1)}ms since process start)`);
+    let prev = start;
+    for (const m of marks) {
+        const delta = m.at - prev;
+        prev = m.at;
+        lines.push(`  ${m.label.padEnd(width)}  +${delta.toFixed(1).padStart(7)}ms   @${m.at.toFixed(1).padStart(8)}ms`);
+    }
+    process.stderr.write(lines.join('\n') + '\n');
+}
+// Backstop: a run that exits before reaching the spawn (a login dead-end, a
+// missing install) still emits whatever stages it reached, so the profile is
+// never silently empty.
+if (ENABLED) {
+    process.on('exit', () => flushBootProfile('exit'));
+}

package/dist/lib/browser/ipc.js

@@ -736,7 +736,15 @@ export class BrowserIPCServer {
                     };
                 }
                 if (request.profile) {
-                    await this.service.stopProfile(request.profile);
+                    try {
+                        await this.service.stopProfile(request.profile, {
+                            fleetRemote: request.fleetRemote,
+                            actor: request.actor,
+                        });
+                    }
+                    catch (err) {
+                        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+                    }
                     return { ok: true };
                 }
                 return {

package/dist/lib/browser/remote-control.d.ts

@@ -16,12 +16,15 @@
  * The authoritative gate is {@link assertRemoteControlAllowedForRequest}, called
  * inside the browser daemon at the top of `resolveOrCreateTask` — the one
  * chokepoint every task-scoped verb resolves through — plus `BrowserService.start`
- * for the task-less `browser start` command. It has to live there because ~18
+ * for the task-less `browser start` command and `BrowserService.stopProfile` for
+ * the task-less `browser stop --profile` command. It has to live there because ~18
  * page verbs (`navigate`, `click`, `screenshot`, `tab-add`, …) launch OR attach
  * to a browser implicitly, and gating only the `browser start` command left every
  * one of them ungated; gating only the create branch of `resolveOrCreateTask` left
- * the attach paths ungated (RUSH-3064). {@link assertRemoteControlAllowed} remains
- * as a fast-fail CLI-side check so a refused `start` never auto-creates a profile.
+ * the attach paths ungated (RUSH-3064); `stop --profile` is handled by `bindTask`'s
+ * early return before `resolveOrCreateTask` ever runs, so it needed its own gate
+ * call too (PHNX-3317). {@link assertRemoteControlAllowed} remains as a fast-fail
+ * CLI-side check so a refused `start` never auto-creates a profile.
  */
 /** Env marker set on every remote `agents` invocation by `buildRemoteAgentsInvocation` and `markFleetRemote`. */
 export declare const FLEET_REMOTE_ENV = "AGENTS_FLEET_REMOTE";

package/dist/lib/browser/remote-control.js

@@ -16,12 +16,15 @@
  * The authoritative gate is {@link assertRemoteControlAllowedForRequest}, called
  * inside the browser daemon at the top of `resolveOrCreateTask` — the one
  * chokepoint every task-scoped verb resolves through — plus `BrowserService.start`
- * for the task-less `browser start` command. It has to live there because ~18
+ * for the task-less `browser start` command and `BrowserService.stopProfile` for
+ * the task-less `browser stop --profile` command. It has to live there because ~18
  * page verbs (`navigate`, `click`, `screenshot`, `tab-add`, …) launch OR attach
  * to a browser implicitly, and gating only the `browser start` command left every
  * one of them ungated; gating only the create branch of `resolveOrCreateTask` left
- * the attach paths ungated (RUSH-3064). {@link assertRemoteControlAllowed} remains
- * as a fast-fail CLI-side check so a refused `start` never auto-creates a profile.
+ * the attach paths ungated (RUSH-3064); `stop --profile` is handled by `bindTask`'s
+ * early return before `resolveOrCreateTask` ever runs, so it needed its own gate
+ * call too (PHNX-3317). {@link assertRemoteControlAllowed} remains as a fast-fail
+ * CLI-side check so a refused `start` never auto-creates a profile.
  */
 import { getConfigValue } from '../device-config.js';
 /** Env marker set on every remote `agents` invocation by `buildRemoteAgentsInvocation` and `markFleetRemote`. */

package/dist/lib/browser/service.d.ts

@@ -263,7 +263,10 @@ export declare class BrowserService {
         ok: boolean;
         profile?: string;
     }>;
-    stopProfile(profileRef: ProfileName | ConnectionKey): Promise<void>;
+    stopProfile(profileRef: ProfileName | ConnectionKey, opts?: {
+        fleetRemote?: boolean;
+        actor?: string;
+    }): Promise<void>;
     navigate(taskId: string, url: string, profileRef?: ProfileName | ConnectionKey): Promise<{
         tabId: string;
         url: string;

package/dist/lib/browser/service.js

@@ -773,7 +773,13 @@ export class BrowserService {
     async done(taskName) {
         return this.stop(taskName);
     }
-    async stopProfile(profileRef) {
+    async stopProfile(profileRef, opts = {}) {
+        // Consent gate — this is a fleet-remote destructive path (kills the
+        // profile's browser process and clears its runtime dir) that reached the
+        // daemon without ever hitting resolveOrCreateTask's gate, since it is a
+        // task-less stop. Same per-request marker rule as every other gated verb —
+        // see remote-control.ts.
+        assertRemoteControlAllowedForRequest(opts.fleetRemote, { actor: opts.actor });
         // Connections are keyed by the runtime key `<profile>@<device>` (see
         // start()) while callers pass the bare profile name (or, occasionally, an
         // exact key). A plain `connections.get(profileRef)` therefore missed every

package/dist/lib/channels/providers/desktop.d.ts

@@ -2,10 +2,11 @@ import type { ChannelProvider } from '../registry.js';
 /**
  * Split one message into the notification's title and body.
  *
- * A broadcast sink hands us `composeBroadcastMessage`'s shape — `<project> · <text>`
- * with any link on a second line — so honouring the newline puts the human
- * sentence in the title and the URL underneath, which is how the existing
- * daemon notifications already read.
+ * A broadcast sink hands us `composeBroadcastMessage`'s shape — a title line, a
+ * blank line, then the body (and a `Sent from …` footer) — so honouring the first
+ * newline puts the scannable head in the title and the rest in the body, which is
+ * how the existing daemon notifications already read. (Desktop is a plain sink, so
+ * the message carries no URLs to split off.)
  *
  * Notification banners show roughly two lines before an ellipsis, so a long
  * single-line message is split at the title boundary rather than truncated away:

package/dist/lib/channels/providers/desktop.js

@@ -28,10 +28,11 @@ const TITLE_MAX = 64;
 /**
  * Split one message into the notification's title and body.
  *
- * A broadcast sink hands us `composeBroadcastMessage`'s shape — `<project> · <text>`
- * with any link on a second line — so honouring the newline puts the human
- * sentence in the title and the URL underneath, which is how the existing
- * daemon notifications already read.
+ * A broadcast sink hands us `composeBroadcastMessage`'s shape — a title line, a
+ * blank line, then the body (and a `Sent from …` footer) — so honouring the first
+ * newline puts the scannable head in the title and the rest in the body, which is
+ * how the existing daemon notifications already read. (Desktop is a plain sink, so
+ * the message carries no URLs to split off.)
  *
  * Notification banners show roughly two lines before an ellipsis, so a long
  * single-line message is split at the title boundary rather than truncated away:

package/dist/lib/channels/registry.d.ts

@@ -33,6 +33,12 @@ export interface SendResult {
     attachments?: string[];
     /** Mailbox provider returns the enqueued message id. */
     msgId?: string;
+    /**
+     * The exact body handed to the provider for THIS destination. Set by the owner
+     * fan-out (`sendToOwner`) so a per-destination compose is observable — Slack
+     * carries the `mrkdwn` labeled-link variant, iMessage the plain one (PHNX-3698).
+     */
+    body?: string;
     /** Per-destination results when the owner policy selects multiple channels. */
     deliveries?: SendResult[];
 }

package/dist/lib/channels/send.d.ts

@@ -10,6 +10,7 @@
  */
 import type { Meta } from '../types.js';
 import type { SendResult } from './registry.js';
+import type { SinkMessageFormat } from '../sink-format.js';
 /** Normalized delivery request after CLI/config resolution. */
 export interface SendEnvelope {
     text: string;
@@ -78,8 +79,16 @@ export declare function resolveSendEnvelope(input: ResolveSendInput, meta: Meta)
  * internal caller that already has a resolved envelope.
  */
 export declare function deliverEnvelope(envelope: SendEnvelope, meta: Meta): Promise<SendResult>;
-/** Resolve + deliver in one step (CLI happy path). */
-export declare function sendMessage(input: ResolveSendInput, meta: Meta): Promise<{
+/**
+ * Resolve + deliver in one step (CLI happy path).
+ *
+ * `ownerCompose`, when given, shapes the body PER owner destination on the
+ * policy fan-out — Slack gets `mrkdwn` labeled links, iMessage stays plain
+ * (PHNX-3698). Only the owner-policy path uses it; a direct `--channel`/`--to`
+ * send is delivered verbatim. The envelope's own `text` remains the plain
+ * default (validation, `--json`, dry-run display).
+ */
+export declare function sendMessage(input: ResolveSendInput, meta: Meta, ownerCompose?: (format: SinkMessageFormat) => string): Promise<{
     result: SendResult;
     envelope: SendEnvelope;
 } | {

package/dist/lib/channels/send.js

@@ -108,8 +108,16 @@ export async function deliverEnvelope(envelope, meta) {
         dryRun: envelope.dryRun,
     });
 }
-/** Resolve + deliver in one step (CLI happy path). */
-export async function sendMessage(input, meta) {
+/**
+ * Resolve + deliver in one step (CLI happy path).
+ *
+ * `ownerCompose`, when given, shapes the body PER owner destination on the
+ * policy fan-out — Slack gets `mrkdwn` labeled links, iMessage stays plain
+ * (PHNX-3698). Only the owner-policy path uses it; a direct `--channel`/`--to`
+ * send is delivered verbatim. The envelope's own `text` remains the plain
+ * default (validation, `--json`, dry-run display).
+ */
+export async function sendMessage(input, meta, ownerCompose) {
     const resolved = resolveSendEnvelope(input, meta);
     if (!resolved.ok)
         return { error: resolved.error };
@@ -123,6 +131,7 @@ export async function sendMessage(input, meta) {
             thread: resolved.envelope.thread,
             attachments: resolved.envelope.attachments,
             from: resolved.envelope.from,
+            ...(ownerCompose ? { composeForFormat: ownerCompose } : {}),
         })
         : await deliverEnvelope(resolved.envelope, meta);
     return { result, envelope: resolved.envelope };

package/dist/lib/claude-account-token.js

@@ -79,11 +79,100 @@ export function resolveClaudeSetupToken(home) {
     // Require a known account (email) up front: without it we cannot key a
     // per-account token, and we must NOT fall back to a bare shared key that
     // would misapply one account's setup-token to another.
-    const email = readClaudeAccountEmail(home);
+    const email = readClaudeAccountEmail(home)
+        // Self-heal (PHNX-3660): a home provisioned before seed-on-attach carries an
+        // `.oauth_token` but no identity. Recover the email from the bundle and
+        // write it back, so the home converges instead of needing a re-attach.
+        // Explicit-home only: with no home the probe targets the operator's real
+        // ~/.claude.json, which a library read must never rewrite.
+        ?? (home ? discoverClaudeAccountEmailFromOauthToken(home) : null);
     if (!email)
         return null;
     return resolveClaudeSetupTokenForEmail(email, home ?? os.homedir());
 }
+/** Negative/positive discovery cache, keyed by home + .oauth_token fingerprint (SHOULD-2). */
+const discoveryCache = new Map();
+/**
+ * Recover a home's account email from its `.claude/.oauth_token` by matching
+ * the token VALUE against the `auth` bundle (the slug encodes the email, and
+ * the re-encode check makes the decode lossless or fail). On a match the
+ * identity is written back via {@link seedClaudeWorkerHomeIdentity}, so this
+ * runs at most once per home. Returns null — and writes nothing — when the
+ * file is missing, malformed, or matches no bundle key: a token that no longer
+ * exists in the bundle must not resurrect an account mapping. A no-match
+ * result is cached against the token file's fingerprint so a rotated-out home
+ * does not re-decrypt the bundle on every probe.
+ */
+function discoverClaudeAccountEmailFromOauthToken(home) {
+    try {
+        const tokenPath = path.join(home, '.claude', '.oauth_token');
+        const fingerprint = credentialFingerprint(tokenPath);
+        if (fingerprint === 'missing')
+            return null;
+        const cached = discoveryCache.get(home);
+        if (cached && cached.fingerprint === fingerprint)
+            return cached.email;
+        const email = discoverEmailUncached(home, tokenPath);
+        discoveryCache.set(home, { fingerprint, email });
+        return email;
+    }
+    catch (err) {
+        if (err instanceof ReservedBundleWrongBackendError)
+            throw err;
+        return null;
+    }
+}
+function discoverEmailUncached(home, tokenPath) {
+    let token;
+    try {
+        token = fs.readFileSync(tokenPath, 'utf-8').trim();
+    }
+    catch {
+        return null;
+    }
+    if (!isValidClaudeSetupToken(token))
+        return null;
+    if (!bundleExists(AUTH_BUNDLE))
+        return null;
+    if (bundleBackend(AUTH_BUNDLE) !== 'file') {
+        throw new ReservedBundleWrongBackendError(AUTH_BUNDLE, bundleBackend(AUTH_BUNDLE));
+    }
+    const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
+    for (const [key, value] of Object.entries(env)) {
+        if (value.trim() !== token)
+            continue;
+        const email = emailFromTokenKey(key);
+        if (!email)
+            continue;
+        seedClaudeWorkerHomeIdentity(home, email);
+        return email;
+    }
+    return null;
+}
+/**
+ * Decode the email a `CLAUDE_CODE_OAUTH_TOKEN_<slug>` key encodes — or null
+ * when the decode is ambiguous. The mapping collapses every non-alphanumeric
+ * to `_`, so a `_` surviving in the decoded address cannot be told apart from
+ * a folded `.`/`+`/etc. (`FIRST_DOT_LAST_AT_GMAIL_DOT_COM` decodes to
+ * `first_dot_last@gmail.com`, which round-trips — wrongly — under the bare
+ * re-encode check; review BLOCKER 1). Only a fully unambiguous decode — local
+ * and domain pure `[a-z0-9]`, dots in the domain only — is trusted.
+ */
+function emailFromTokenKey(key) {
+    const prefix = 'CLAUDE_CODE_OAUTH_TOKEN_';
+    if (!key.startsWith(prefix))
+        return null;
+    const slug = key.slice(prefix.length);
+    const [local, domain, ...rest] = slug.split('_AT_');
+    if (!local || !domain || rest.length > 0)
+        return null;
+    const email = `${local}@${domain.replace(/_DOT_/g, '.')}`.toLowerCase();
+    if (!/^[a-z0-9]+@[a-z0-9.]+$/.test(email))
+        return null;
+    if (claudeAccountTokenKey(email) !== key)
+        return null;
+    return email;
+}
 /**
  * Resolve a long-lived setup-token for an EXPLICIT account email, independent of
  * any version home's `.claude.json`. This is what lets `agents accounts attach`
@@ -167,14 +256,29 @@ export function seedClaudeWorkerHomeIdentity(versionHome, email) {
         try {
             doc = JSON.parse(fs.readFileSync(p, 'utf-8'));
         }
-        catch {
-            // Missing or unreadable at this location — write a fresh minimal document.
+        catch (err) {
+            // Missing file → write a fresh minimal document. A file that EXISTS but
+            // does not parse is being concurrently rewritten by Claude Code itself —
+            // skip it rather than overwrite a live config with the minimal doc.
+            if (err.code !== 'ENOENT')
+                continue;
         }
         const existing = (doc.oauthAccount && typeof doc.oauthAccount === 'object'
             ? doc.oauthAccount
             : {});
         doc.oauthAccount = { ...existing, emailAddress: trimmed };
         fs.mkdirSync(path.dirname(p), { recursive: true });
-        fs.writeFileSync(p, JSON.stringify(doc));
+        // Temp-write + rename: a reader mid-write never sees a truncated doc.
+        const tmp = `${p}.agents-${process.pid}.tmp`;
+        try {
+            fs.writeFileSync(tmp, JSON.stringify(doc));
+            fs.renameSync(tmp, p);
+        }
+        catch {
+            try {
+                fs.rmSync(tmp, { force: true });
+            }
+            catch { /* best effort */ }
+        }
     }
 }

package/dist/lib/cloud/rush.d.ts

@@ -8,10 +8,18 @@ import type { CloudProvider, CloudTask, CloudTaskStatus, CloudEvent, DispatchOpt
 /**
  * Returns true when ~/.rush/user.yaml exists, carries an access_token, and
  * the token has not passed its expires_at timestamp (Unix seconds). A missing
- * expires_at is treated as non-expired so tokens written without an expiry
- * still work. Pass yamlPath to override the default path in tests.
+ * expires_at, or `expires_at: 0` (a non-expiring Phoenix `pid_` bearer), is
+ * treated as non-expired (see isRushSessionExpired, PHNX-3645). Pass yamlPath
+ * to override the default path in tests.
  */
 export declare function isRushSessionValid(yamlPath?: string): boolean;
+/**
+ * Read the Rush session access token from ~/.rush/user.yaml. Exported (with an
+ * overridable yamlPath, like isRushSessionValid) so the freshness behavior —
+ * including the `expires_at: 0` non-expiring case (PHNX-3645) — is directly
+ * testable; the class methods call it with the default path.
+ */
+export declare function readToken(yamlPath?: string): string;
 /** One version's entry in the account manifest sent on every dispatch. */
 export interface AccountManifestEntry {
     version: string;

package/dist/lib/cloud/rush.js

@@ -10,6 +10,7 @@ import * as os from 'os';
 import * as crypto from 'crypto';
 import * as yaml from 'yaml';
 import { resolveDispatchRepos, normalizeProviderStatus, MAX_IMAGES_PER_DISPATCH } from './types.js';
+import { isRushSessionExpired } from '../rush-session.js';
 import { parseSSE } from './stream.js';
 import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
 import { getAccountInfo } from '../agents.js';
@@ -19,8 +20,9 @@ const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
 /**
  * Returns true when ~/.rush/user.yaml exists, carries an access_token, and
  * the token has not passed its expires_at timestamp (Unix seconds). A missing
- * expires_at is treated as non-expired so tokens written without an expiry
- * still work. Pass yamlPath to override the default path in tests.
+ * expires_at, or `expires_at: 0` (a non-expiring Phoenix `pid_` bearer), is
+ * treated as non-expired (see isRushSessionExpired, PHNX-3645). Pass yamlPath
+ * to override the default path in tests.
  */
 export function isRushSessionValid(yamlPath = USER_YAML) {
     try {
@@ -30,8 +32,7 @@ export function isRushSessionValid(yamlPath = USER_YAML) {
         const data = yaml.parse(raw);
         if (!data?.session?.access_token)
             return false;
-        const expiresAt = data.session.expires_at;
-        if (typeof expiresAt === 'number' && expiresAt <= Date.now() / 1000)
+        if (isRushSessionExpired(data.session.expires_at))
             return false;
         return true;
     }
@@ -39,19 +40,24 @@ export function isRushSessionValid(yamlPath = USER_YAML) {
         return false;
     }
 }
-/** Read the Rush session access token from ~/.rush/user.yaml. */
-function readToken() {
-    if (!fs.existsSync(USER_YAML)) {
+/**
+ * Read the Rush session access token from ~/.rush/user.yaml. Exported (with an
+ * overridable yamlPath, like isRushSessionValid) so the freshness behavior —
+ * including the `expires_at: 0` non-expiring case (PHNX-3645) — is directly
+ * testable; the class methods call it with the default path.
+ */
+export function readToken(yamlPath = USER_YAML) {
+    if (!fs.existsSync(yamlPath)) {
         throw new Error('Not logged in to Rush. Run `rush login` first.');
     }
-    const raw = fs.readFileSync(USER_YAML, 'utf-8');
+    const raw = fs.readFileSync(yamlPath, 'utf-8');
     const data = yaml.parse(raw);
     const token = data?.session?.access_token;
     if (!token) {
         throw new Error('No session token in ~/.rush/user.yaml. Run `rush login` first.');
     }
     const expiresAt = data.session?.expires_at;
-    if (typeof expiresAt === 'number' && expiresAt <= Date.now() / 1000) {
+    if (isRushSessionExpired(expiresAt)) {
         const expiredAt = new Date(expiresAt * 1000).toISOString();
         throw new Error(`Rush session expired at ${expiredAt}. Run \`rush login\` to refresh.`);
     }