@phnx-labs/agents-cli 1.22.68 → 1.22.70

package/dist/lib/daemon/daemon.js

@@ -2249,7 +2249,15 @@ function stopDaemonLocked() {
     // any service-manager teardown or direct signal and repairs only under lock.
     const pid = resolveLiveDaemonPid(true);
     const browserSock = process.platform === 'win32' ? null : getBrowserIpcSocketPath();
-    const browserSockOwner = pid !== null && browserSock ? readPathIdentity(browserSock) : null;
+    // Capture the socket's inode INDEPENDENTLY of whether a live pid resolved
+    // (PHNX-3618). A daemon that died between the CLI liveness precheck and this
+    // locked read leaves resolveLiveDaemonPid() returning null while its ungraceful
+    // exit left the binding on disk — capturing only when `pid !== null` meant that
+    // genuinely stale socket could never be reclaimed and was reported "ownership
+    // could not be verified". The inode is the successor guard: a fresh daemon that
+    // rebinds during the stop gets a new inode, so a later identity match still
+    // proves this exact binding is the one we captured, never a successor's.
+    const browserSockOwner = browserSock ? readPathIdentity(browserSock) : null;
     if (platform === 'darwin') {
         const plistPath = getLaunchdPlistPath();
         if (fs.existsSync(plistPath)) {
@@ -2380,8 +2388,19 @@ function stopDaemonLocked() {
     // ungracefully (killTree) and left a stale binding — the owner is provably
     // dead, so reclaim it and report.
     if (process.platform !== 'win32') {
+        // A binding is provably stale — and reclaimable — when the inode on disk is
+        // still the exact one captured under this lock AND no daemon (the signalled
+        // target OR any successor for this state dir) survives to own it. Keying the
+        // "a daemon still owns it" test on the whole survivor set rather than only the
+        // captured target is what lets a daemon that died BEFORE this stop (pid ===
+        // null, PHNX-3618) still have its stale socket reclaimed, while a live
+        // successor — which either rebound the inode or shows up as a survivor — is
+        // never touched (PHNX-3607's never-delete-a-successor invariant).
+        const aDaemonSurvives = survivors.length > 0 || unverifiedSurvivors.length > 0;
         if (browserSock && fs.existsSync(browserSock)) {
-            if (browserSockOwner && pathIdentityMatches(browserSock, browserSockOwner) && !targetStillOwnsResources) {
+            const ownsCapturedBinding = browserSockOwner !== null
+                && pathIdentityMatches(browserSock, browserSockOwner);
+            if (ownsCapturedBinding && !aDaemonSurvives) {
                 try {
                     fs.unlinkSync(browserSock);
                 }
@@ -2393,13 +2412,14 @@ function stopDaemonLocked() {
                 else
                     released.push('browser IPC socket (reclaimed)');
             }
+            else if (aDaemonSurvives) {
+                surviving.push('browser IPC socket still owned by a surviving daemon');
+            }
             else {
-                // The path was absent when the target was captured, there was no proven
-                // daemon target, or a successor replaced the inode. In every case this
-                // invocation does not own the current binding and must leave it alone.
-                surviving.push(targetStillOwnsResources
-                    ? 'browser IPC socket still owned by a surviving daemon'
-                    : 'browser IPC socket ownership could not be verified');
+                // The path was absent when this transaction captured the target (a
+                // successor bound it afterward) or a successor replaced the inode. Either
+                // way this invocation does not own the current binding and must leave it.
+                surviving.push('browser IPC socket ownership could not be verified');
             }
         }
         else {

package/dist/lib/daemon/runner.js

@@ -922,8 +922,12 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
     if (config.account && !explicitCredential) {
         // A native routine account is named by its durable name; the version matcher
         // keys on the identity (email/accountKey), so translate before resolving,
-        // and refuse a login that belongs to a different harness.
-        const unified = findUnifiedAccount(config.account, meta);
+        // and refuse a login that belongs to a different harness. Scope the lookup to
+        // the routine's own harness: `identityLabel` defaults to the login's email, so
+        // `account: <email>` matches every harness that identity is signed into, and
+        // un-scoped this resolved whichever row the store ordered first — then rejected
+        // it on the very next line.
+        const unified = findUnifiedAccount(config.account, meta, undefined, agent);
         if (unified?.kind === 'native' && unified.agent !== agent) {
             throw new Error(`Routine '${config.name}' account '${config.account}' is a ${unified.agent} login and cannot authenticate ${agent}.`);
         }

package/dist/lib/devices/health.d.ts

@@ -12,9 +12,37 @@
  * separate copy on purpose: the CLI does not import across packages.
  */
 import type { DeviceProfile } from './registry.js';
-/** Default per-device probe budget. Short enough that the list never hangs on a
- * wedged box, long enough for a cold relayed SSH handshake. */
+/** Default per-device probe budget, for a device reachable over a DIRECT
+ * Tailscale path. Short enough that the list never hangs on a wedged box. */
 export declare const PROBE_TIMEOUT_MS = 2500;
+/**
+ * Probe budget for a device whose last handshake was DERP-relayed
+ * ({@link DeviceTailscale.direct} === false).
+ *
+ * This constant used to not exist: 2.5s was applied to every device and its
+ * docstring claimed to be "long enough for a cold relayed SSH handshake". That
+ * was false, and on a fleet with no direct paths it broke `--device auto`
+ * outright (PHNX-3682). Measured on a 9-box relayed fleet, probed in parallel
+ * with cold paths: 1686/1805/1914/2688/2706/2749/3082/5586/6588 ms — six of nine
+ * over budget, every one of them healthy (rc=0 within 10s). Warm, the same
+ * probes take 512-872ms, which is what made the failure intermittent.
+ *
+ * A relayed hop pays DERP path setup on top of the TCP+SSH handshake, so it
+ * gets the same budget the readiness probe already allows
+ * (`READY_PROBE_TIMEOUT_MS`) rather than the direct-path one.
+ */
+export declare const RELAYED_PROBE_TIMEOUT_MS = 8000;
+/**
+ * The probe budget for one device. A relayed peer gets
+ * {@link RELAYED_PROBE_TIMEOUT_MS}; a direct (or unknown-path) peer keeps the
+ * tight {@link PROBE_TIMEOUT_MS}. Windows keeps its own larger budget, which
+ * already exceeds both.
+ *
+ * `direct` is only meaningful when a tailscale snapshot exists — a
+ * `via:"manual"` device never gets a peer entry, so absence is "unknown path",
+ * not "relayed", and must not silently widen every manual device's budget.
+ */
+export declare function probeBudgetMs(device: DeviceProfile): number;
 /** Windows probe budget. The first CIM query of a PowerShell session pays a
  * "Preparing modules for first use" cost on top of PowerShell startup, which
  * routinely blows the 2.5s POSIX budget on a relayed connection. */
@@ -35,6 +63,14 @@ export declare function localProbeInvocation(platform: NodeJS.Platform): {
 export interface DeviceStats {
     host: string;
     reachable: boolean;
+    /**
+     * The probe exceeded its budget rather than being refused or unresolvable.
+     * Only meaningful when `reachable` is false — it separates "this box did not
+     * answer in time" from "this box actively could not be reached", so callers
+     * report a slow link honestly instead of calling a healthy device offline
+     * (PHNX-3682).
+     */
+    timedOut?: boolean;
     loadAvg1?: number;
     ncpu?: number;
     /** Load normalized to core count (the "has room" number): loadAvg1 / ncpu *

package/dist/lib/devices/health.js

@@ -13,9 +13,43 @@
  */
 import { execFile } from 'child_process';
 import { buildSshInvocation, writeAskpassShim } from './connect.js';
-/** Default per-device probe budget. Short enough that the list never hangs on a
- * wedged box, long enough for a cold relayed SSH handshake. */
+/** Default per-device probe budget, for a device reachable over a DIRECT
+ * Tailscale path. Short enough that the list never hangs on a wedged box. */
 export const PROBE_TIMEOUT_MS = 2_500;
+/**
+ * Probe budget for a device whose last handshake was DERP-relayed
+ * ({@link DeviceTailscale.direct} === false).
+ *
+ * This constant used to not exist: 2.5s was applied to every device and its
+ * docstring claimed to be "long enough for a cold relayed SSH handshake". That
+ * was false, and on a fleet with no direct paths it broke `--device auto`
+ * outright (PHNX-3682). Measured on a 9-box relayed fleet, probed in parallel
+ * with cold paths: 1686/1805/1914/2688/2706/2749/3082/5586/6588 ms — six of nine
+ * over budget, every one of them healthy (rc=0 within 10s). Warm, the same
+ * probes take 512-872ms, which is what made the failure intermittent.
+ *
+ * A relayed hop pays DERP path setup on top of the TCP+SSH handshake, so it
+ * gets the same budget the readiness probe already allows
+ * (`READY_PROBE_TIMEOUT_MS`) rather than the direct-path one.
+ */
+export const RELAYED_PROBE_TIMEOUT_MS = 8_000;
+/**
+ * The probe budget for one device. A relayed peer gets
+ * {@link RELAYED_PROBE_TIMEOUT_MS}; a direct (or unknown-path) peer keeps the
+ * tight {@link PROBE_TIMEOUT_MS}. Windows keeps its own larger budget, which
+ * already exceeds both.
+ *
+ * `direct` is only meaningful when a tailscale snapshot exists — a
+ * `via:"manual"` device never gets a peer entry, so absence is "unknown path",
+ * not "relayed", and must not silently widen every manual device's budget.
+ */
+export function probeBudgetMs(device) {
+    if (device.shell === 'powershell')
+        return WIN_PROBE_TIMEOUT_MS;
+    return device.tailscale && device.tailscale.direct === false
+        ? RELAYED_PROBE_TIMEOUT_MS
+        : PROBE_TIMEOUT_MS;
+}
 /** Windows probe budget. The first CIM query of a PowerShell session pays a
  * "Preparing modules for first use" cost on top of PowerShell startup, which
  * routinely blows the 2.5s POSIX budget on a relayed connection. */
@@ -227,10 +261,14 @@ export function probeDeviceStats(device, opts = {}) {
         execFile('ssh', args, {
             encoding: 'utf-8',
             env: { ...process.env, ...env },
-            timeout: opts.timeoutMs ?? (isWin ? WIN_PROBE_TIMEOUT_MS : PROBE_TIMEOUT_MS),
+            timeout: opts.timeoutMs ?? probeBudgetMs(device),
         }, (err, stdout) => {
-            if (err || !stdout)
-                return resolve({ host, reachable: false, fetchedAt });
+            // execFile kills an over-budget child with a signal; that is a slow link,
+            // not an unreachable box, and the two must not read the same downstream.
+            if (err || !stdout) {
+                const timedOut = Boolean(err && err.killed);
+                return resolve(timedOut ? { host, reachable: false, timedOut, fetchedAt } : { host, reachable: false, fetchedAt });
+            }
             resolve(isWin ? parseWinProbeOutput(host, stdout, fetchedAt) : parseProbeOutput(host, stdout, fetchedAt));
         });
     });

package/dist/lib/devices/worker-pick.d.ts

@@ -2,7 +2,7 @@ import { type DevicePlacementSignal } from '../teams/scheduler.js';
 /** Why a candidate was dropped, for the fail-loud error message. */
 export interface WorkerExclusion {
     device: string;
-    reason: 'unreachable' | 'overloaded' | 'wrong-platform' | 'interactive';
+    reason: 'unreachable' | 'probe timed out' | 'overloaded' | 'wrong-platform' | 'interactive';
 }
 export interface WorkerPickPlan {
     /** The chosen device name. Never the local box unless it is an auto-pool member. */

package/dist/lib/devices/worker-pick.js

@@ -79,7 +79,10 @@ export async function resolveWorkerDevice(opts = {}) {
     const eligible = onPlatform.filter((device) => {
         const signal = signals.get(device);
         if (signal?.reachable !== true) {
-            excluded.push({ device, reason: 'unreachable' });
+            // A probe killed for exceeding its budget says nothing about whether the
+            // box is up — on a relayed fleet it usually is. Report the two apart so
+            // the message points at the link, not at a fleet outage (PHNX-3682).
+            excluded.push({ device, reason: signal?.timedOut ? 'probe timed out' : 'unreachable' });
             return false;
         }
         if (signal.headroom === 'loaded') {

package/dist/lib/exec.d.ts

@@ -44,7 +44,7 @@ export declare function headlessPlanStallCommand(args: {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/kiro have no plan flag; hard-failing made
+ *   like antigravity have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -64,7 +64,7 @@ export declare function resolveMode(agent: AgentId, requested: Mode): Mode;
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
  * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
- * and kiro get for having no plan flag at all. Interactive runs are never
+ * get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */

package/dist/lib/exec.js

@@ -40,6 +40,7 @@ import { resolveHarnessAdapter, stripForeignConfigDir } from './harness/index.js
 import { resolveConfigVersion } from './harness/exec-config-version.js';
 import { getAccountInfo } from './agents.js';
 import { getUsageLookupKey, noteClaudeSessionLimit, noteClaudeOutOfCredits, clearClaudeAccountRefusal, parseClaudeSessionLimitReset } from './accounting/usage.js';
+import { bootMark, flushBootProfile } from './boot-profile.js';
 /**
  * Map a raw mode string (CLI flag, YAML field, env var) to the canonical Mode.
  *
@@ -95,7 +96,7 @@ export function headlessPlanStallCommand(args) {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/kiro have no plan flag; hard-failing made
+ *   like antigravity have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -115,7 +116,7 @@ export function resolveMode(agent, requested) {
     }
     if (requested === 'plan') {
         // No read-only mode on this agent. modes[0] is the declared safest mode
-        // (edit for antigravity/kiro/…). Prefer that over hard-fail so
+        // (edit for antigravity/…). Prefer that over hard-fail so
         // uniform multi-agent `--mode plan` dispatches still run.
         return supported[0];
     }
@@ -131,7 +132,7 @@ export function resolveMode(agent, requested) {
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
  * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
- * and kiro get for having no plan flag at all. Interactive runs are never
+ * get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */
@@ -521,25 +522,6 @@ export const AGENT_COMMANDS = {
         jsonFlags: ['--format', 'json'],
         modelFlag: '--model',
     },
-    // Oh My Pi (`omp`). Headless is the positional MESSAGES arg + `-p/--print`.
-    // Approval modes map to omp's `--approval-mode`: always-ask (read-only tools
-    // auto-approved, writes gated -> our `plan`), write (read + workspace writes
-    // auto-approved -> `edit`), yolo (all tiers auto-approved -> `skip`). JSON is
-    // omp's `--mode json` event stream. `--model` fuzzy-matches a provider/model
-    // selector. Native resume is `-r/--resume <id-prefix>`.
-    pi: {
-        base: ['omp'],
-        promptFlag: 'positional',
-        modeFlags: {
-            plan: ['--approval-mode', 'always-ask'],
-            edit: ['--approval-mode', 'write'],
-            skip: ['--approval-mode', 'yolo'],
-        },
-        jsonFlags: ['--mode', 'json'],
-        modelFlag: '--model',
-        printFlags: ['-p'],
-        resume: { flag: '--resume' },
-    },
     openclaw: {
         base: ['openclaw'],
         promptFlag: 'positional',
@@ -583,18 +565,6 @@ export const AGENT_COMMANDS = {
         },
         modelFlag: '--model',
     },
-    kiro: {
-        // Standalone hooks live under ~/.kiro/hooks/*.json and only fire on the
-        // v3 engine (opt-in via --v3; see https://kiro.dev/docs/cli/v3/hooks/).
-        // Without this flag agents-cli would write v3 hook files that never run.
-        base: ['kiro-cli', '--v3'],
-        promptFlag: 'positional',
-        modeFlags: {
-            // kiro-cli has no permission flags — edit is the default behavior.
-            edit: [],
-        },
-        modelFlag: '--model',
-    },
     goose: {
         base: ['goose', 'run'],
         promptFlag: 'positional',
@@ -1733,6 +1703,7 @@ async function emitRunLaunch(ctx) {
     }
 }
 async function spawnAgent(options) {
+    bootMark('spawn-agent:enter');
     // Assign a known session id up front for agents that accept one, so the
     // launcher can record an EXACT pid -> session mapping (see pid-registry) —
     // otherwise the headless `ag sessions --active` path can only guess
@@ -1867,6 +1838,7 @@ async function spawnAgent(options) {
     });
     if (tmuxWrap.kind === 'wrap') {
         timer.mark('startup');
+        flushBootProfile('spawn');
         try {
             const result = await runInTmux(options, executable, args);
             timer.end({ exitCode: result.exitCode, status: result.exitCode === 0 ? 'success' : 'failed' });
@@ -1898,6 +1870,7 @@ async function spawnAgent(options) {
         const useShell = process.platform === 'win32' && (!path.isAbsolute(executable) || executable.endsWith('.cmd'));
         const spawnCommand = useShell ? composeWin32CommandLine(executable, args) : executable;
         const spawnArgs = useShell ? [] : args;
+        flushBootProfile('spawn');
         const child = spawn(spawnCommand, spawnArgs, {
             cwd: options.cwd || process.cwd(),
             stdio,

package/dist/lib/feed-broadcast.d.ts

@@ -1,4 +1,5 @@
 import type { Meta } from './types.js';
+import { type SinkMessageFormat } from './sink-format.js';
 /** How loudly a post asks to be heard. Ordered — `important` implies milestone. */
 export type FeedPostLevel = 'milestone' | 'important';
 /** Parse a `--level` value; anything unrecognized is a usage error, not a default. */
@@ -122,6 +123,17 @@ export interface PlannedSink {
     to?: string;
     /** Channel sink body — the composed `{message}` for this post. */
     text?: string;
+    /**
+     * Owner-alias sinks only: the post context + its `message:` template, carried
+     * so the owner fan-out can re-render the body PER DESTINATION — Slack in the
+     * policy gets `mrkdwn` labeled links while iMessage stays plain (PHNX-3698).
+     * `text` above is the plain default (dry-run display + the fallback when a
+     * destination has no resolvable provider); this drives the real send. A
+     * direct `channel:` sink resolves its one provider's format at plan time and
+     * needs neither field.
+     */
+    ctx?: FeedBroadcastContext;
+    messageTemplate?: string;
 }
 export interface SinkOutcome {
     name: string;
@@ -136,6 +148,22 @@ export interface SinkOutcome {
 export declare function shortHost(host: string | undefined): string | undefined;
 /** First 8 hex chars of a session id for the footer (readable, not a full uuid). */
 export declare function shortSessionChunk(session: string | undefined): string | undefined;
+/**
+ * Tap-to-view link for the session behind a post: the addressable console page
+ * ({@link https://prix.dev/console/sessions/<id>}, prix/web). The footer already
+ * carries a short session crumb for disambiguation; this rides the link trail so
+ * the owner can open the full transcript straight from an iMessage broadcast
+ * instead of hunting for it in the console.
+ *
+ * Accepts any real, path-safe session id — a Claude/Codex UUID *and* a native
+ * `ses_…` id from OpenCode or another harness. The console shard uploader
+ * (`traces/sync.ts`) syncs sessions with no harness filter, so all of them are
+ * addressable; a UUID-only gate would silently drop the link for every non-Claude
+ * harness (the whole point of the link). Reject only an id that could not resolve:
+ * one with a path separator (URL-unsafe, via {@link isValidMailboxId}) or the bare
+ * 8-char footer crumb (a truncated id that would 404).
+ */
+export declare function sessionConsoleUrl(session: string | undefined): string | undefined;
 /**
  * Scrub em/en dashes from outbound phone copy (house rule + iMessage readability).
  * Collapses whitespace; does not invent meaning.
@@ -148,10 +176,15 @@ export declare function scrubOutboundDashes(text: string): string;
  *
  * Agent name first; session chunk for disambiguation when many groks run;
  * host last. Skip the uninformative default label `agent`.
+ *
+ * In `mrkdwn` the crumb (`agent/short`) becomes a Slack labeled link to the
+ * session's console page, so the human sentence reads identically while the
+ * crumb turns blue and taps through (PHNX-3698). `plain` keeps the bare sentence
+ * — it can't render a labeled link and must not dump the URL.
  */
-export declare function composeBroadcastFooter(ctx: FeedBroadcastContext): string | undefined;
+export declare function composeBroadcastFooter(ctx: FeedBroadcastContext, format?: SinkMessageFormat): string | undefined;
 export declare function truncateBroadcastBody(body: string): string;
-export declare function composeBroadcastMessage(ctx: FeedBroadcastContext): string;
+export declare function composeBroadcastMessage(ctx: FeedBroadcastContext, format?: SinkMessageFormat): string;
 /**
  * Substitute `{placeholder}` tokens in an argv template. Returns undefined when
  * the template needs a value this post does not have — the sink is then skipped
@@ -159,8 +192,13 @@ export declare function composeBroadcastMessage(ctx: FeedBroadcastContext): stri
  * would otherwise comment on nothing.
  */
 export declare function renderSinkArgv(template: string[], ctx: FeedBroadcastContext): string[] | undefined;
-/** Render one channel-message template with the same fail-closed placeholder contract as argv. */
-export declare function renderSinkMessage(template: string, ctx: FeedBroadcastContext): string | undefined;
+/**
+ * Render one channel-message template with the same fail-closed placeholder
+ * contract as argv. `format` (Slack `mrkdwn` vs `plain`) flows into the shared
+ * `{message}` var so a Slack sink gets labeled links and an iMessage/owner sink
+ * gets the plain sentence.
+ */
+export declare function renderSinkMessage(template: string, ctx: FeedBroadcastContext, format?: SinkMessageFormat): string | undefined;
 /**
  * Which sinks this post reaches, in config order. Pure — the dry-run listing and
  * the real fan-out plan through here, so what `--dry-run` shows is what runs.
@@ -168,8 +206,12 @@ export declare function renderSinkMessage(template: string, ctx: FeedBroadcastCo
  * A `channel:` sink is gated by the same `minLevel` rule as a `command:` sink —
  * one level check for both shapes, so a dry-run plan is truthful regardless of
  * which shape an operator's sink uses.
+ *
+ * `meta` is used only to resolve a channel name to its real provider for the
+ * mrkdwn/plain format decision (`notify.transports`), the same map delivery uses;
+ * it is optional so a test can plan without a config snapshot (identity mapping).
  */
-export declare function planFeedBroadcast(config: FeedBroadcastConfig | undefined, ctx: FeedBroadcastContext): PlannedSink[];
+export declare function planFeedBroadcast(config: FeedBroadcastConfig | undefined, ctx: FeedBroadcastContext, meta?: Meta): PlannedSink[];
 /**
  * The effective sink config for a post: the operator's `feed.broadcast`, or —
  * when that is unset or empty — an implicit fallback straight to