@phnx-labs/agents-cli 1.22.69 → 1.22.70

package/dist/lib/browser/remote-control.d.ts

@@ -16,12 +16,15 @@
  * The authoritative gate is {@link assertRemoteControlAllowedForRequest}, called
  * inside the browser daemon at the top of `resolveOrCreateTask` — the one
  * chokepoint every task-scoped verb resolves through — plus `BrowserService.start`
- * for the task-less `browser start` command. It has to live there because ~18
+ * for the task-less `browser start` command and `BrowserService.stopProfile` for
+ * the task-less `browser stop --profile` command. It has to live there because ~18
  * page verbs (`navigate`, `click`, `screenshot`, `tab-add`, …) launch OR attach
  * to a browser implicitly, and gating only the `browser start` command left every
  * one of them ungated; gating only the create branch of `resolveOrCreateTask` left
- * the attach paths ungated (RUSH-3064). {@link assertRemoteControlAllowed} remains
- * as a fast-fail CLI-side check so a refused `start` never auto-creates a profile.
+ * the attach paths ungated (RUSH-3064); `stop --profile` is handled by `bindTask`'s
+ * early return before `resolveOrCreateTask` ever runs, so it needed its own gate
+ * call too (PHNX-3317). {@link assertRemoteControlAllowed} remains as a fast-fail
+ * CLI-side check so a refused `start` never auto-creates a profile.
  */
 /** Env marker set on every remote `agents` invocation by `buildRemoteAgentsInvocation` and `markFleetRemote`. */
 export declare const FLEET_REMOTE_ENV = "AGENTS_FLEET_REMOTE";

package/dist/lib/browser/remote-control.js

@@ -16,12 +16,15 @@
  * The authoritative gate is {@link assertRemoteControlAllowedForRequest}, called
  * inside the browser daemon at the top of `resolveOrCreateTask` — the one
  * chokepoint every task-scoped verb resolves through — plus `BrowserService.start`
- * for the task-less `browser start` command. It has to live there because ~18
+ * for the task-less `browser start` command and `BrowserService.stopProfile` for
+ * the task-less `browser stop --profile` command. It has to live there because ~18
  * page verbs (`navigate`, `click`, `screenshot`, `tab-add`, …) launch OR attach
  * to a browser implicitly, and gating only the `browser start` command left every
  * one of them ungated; gating only the create branch of `resolveOrCreateTask` left
- * the attach paths ungated (RUSH-3064). {@link assertRemoteControlAllowed} remains
- * as a fast-fail CLI-side check so a refused `start` never auto-creates a profile.
+ * the attach paths ungated (RUSH-3064); `stop --profile` is handled by `bindTask`'s
+ * early return before `resolveOrCreateTask` ever runs, so it needed its own gate
+ * call too (PHNX-3317). {@link assertRemoteControlAllowed} remains as a fast-fail
+ * CLI-side check so a refused `start` never auto-creates a profile.
  */
 import { getConfigValue } from '../device-config.js';
 /** Env marker set on every remote `agents` invocation by `buildRemoteAgentsInvocation` and `markFleetRemote`. */

package/dist/lib/browser/service.d.ts

@@ -263,7 +263,10 @@ export declare class BrowserService {
         ok: boolean;
         profile?: string;
     }>;
-    stopProfile(profileRef: ProfileName | ConnectionKey): Promise<void>;
+    stopProfile(profileRef: ProfileName | ConnectionKey, opts?: {
+        fleetRemote?: boolean;
+        actor?: string;
+    }): Promise<void>;
     navigate(taskId: string, url: string, profileRef?: ProfileName | ConnectionKey): Promise<{
         tabId: string;
         url: string;

package/dist/lib/browser/service.js

@@ -773,7 +773,13 @@ export class BrowserService {
     async done(taskName) {
         return this.stop(taskName);
     }
-    async stopProfile(profileRef) {
+    async stopProfile(profileRef, opts = {}) {
+        // Consent gate — this is a fleet-remote destructive path (kills the
+        // profile's browser process and clears its runtime dir) that reached the
+        // daemon without ever hitting resolveOrCreateTask's gate, since it is a
+        // task-less stop. Same per-request marker rule as every other gated verb —
+        // see remote-control.ts.
+        assertRemoteControlAllowedForRequest(opts.fleetRemote, { actor: opts.actor });
         // Connections are keyed by the runtime key `<profile>@<device>` (see
         // start()) while callers pass the bare profile name (or, occasionally, an
         // exact key). A plain `connections.get(profileRef)` therefore missed every

package/dist/lib/channels/registry.d.ts

@@ -33,6 +33,12 @@ export interface SendResult {
     attachments?: string[];
     /** Mailbox provider returns the enqueued message id. */
     msgId?: string;
+    /**
+     * The exact body handed to the provider for THIS destination. Set by the owner
+     * fan-out (`sendToOwner`) so a per-destination compose is observable — Slack
+     * carries the `mrkdwn` labeled-link variant, iMessage the plain one (PHNX-3698).
+     */
+    body?: string;
     /** Per-destination results when the owner policy selects multiple channels. */
     deliveries?: SendResult[];
 }

package/dist/lib/channels/send.d.ts

@@ -10,6 +10,7 @@
  */
 import type { Meta } from '../types.js';
 import type { SendResult } from './registry.js';
+import type { SinkMessageFormat } from '../sink-format.js';
 /** Normalized delivery request after CLI/config resolution. */
 export interface SendEnvelope {
     text: string;
@@ -78,8 +79,16 @@ export declare function resolveSendEnvelope(input: ResolveSendInput, meta: Meta)
  * internal caller that already has a resolved envelope.
  */
 export declare function deliverEnvelope(envelope: SendEnvelope, meta: Meta): Promise<SendResult>;
-/** Resolve + deliver in one step (CLI happy path). */
-export declare function sendMessage(input: ResolveSendInput, meta: Meta): Promise<{
+/**
+ * Resolve + deliver in one step (CLI happy path).
+ *
+ * `ownerCompose`, when given, shapes the body PER owner destination on the
+ * policy fan-out — Slack gets `mrkdwn` labeled links, iMessage stays plain
+ * (PHNX-3698). Only the owner-policy path uses it; a direct `--channel`/`--to`
+ * send is delivered verbatim. The envelope's own `text` remains the plain
+ * default (validation, `--json`, dry-run display).
+ */
+export declare function sendMessage(input: ResolveSendInput, meta: Meta, ownerCompose?: (format: SinkMessageFormat) => string): Promise<{
     result: SendResult;
     envelope: SendEnvelope;
 } | {

package/dist/lib/channels/send.js

@@ -108,8 +108,16 @@ export async function deliverEnvelope(envelope, meta) {
         dryRun: envelope.dryRun,
     });
 }
-/** Resolve + deliver in one step (CLI happy path). */
-export async function sendMessage(input, meta) {
+/**
+ * Resolve + deliver in one step (CLI happy path).
+ *
+ * `ownerCompose`, when given, shapes the body PER owner destination on the
+ * policy fan-out — Slack gets `mrkdwn` labeled links, iMessage stays plain
+ * (PHNX-3698). Only the owner-policy path uses it; a direct `--channel`/`--to`
+ * send is delivered verbatim. The envelope's own `text` remains the plain
+ * default (validation, `--json`, dry-run display).
+ */
+export async function sendMessage(input, meta, ownerCompose) {
     const resolved = resolveSendEnvelope(input, meta);
     if (!resolved.ok)
         return { error: resolved.error };
@@ -123,6 +131,7 @@ export async function sendMessage(input, meta) {
             thread: resolved.envelope.thread,
             attachments: resolved.envelope.attachments,
             from: resolved.envelope.from,
+            ...(ownerCompose ? { composeForFormat: ownerCompose } : {}),
         })
         : await deliverEnvelope(resolved.envelope, meta);
     return { result, envelope: resolved.envelope };

package/dist/lib/cloud/rush.d.ts

@@ -8,10 +8,18 @@ import type { CloudProvider, CloudTask, CloudTaskStatus, CloudEvent, DispatchOpt
 /**
  * Returns true when ~/.rush/user.yaml exists, carries an access_token, and
  * the token has not passed its expires_at timestamp (Unix seconds). A missing
- * expires_at is treated as non-expired so tokens written without an expiry
- * still work. Pass yamlPath to override the default path in tests.
+ * expires_at, or `expires_at: 0` (a non-expiring Phoenix `pid_` bearer), is
+ * treated as non-expired (see isRushSessionExpired, PHNX-3645). Pass yamlPath
+ * to override the default path in tests.
  */
 export declare function isRushSessionValid(yamlPath?: string): boolean;
+/**
+ * Read the Rush session access token from ~/.rush/user.yaml. Exported (with an
+ * overridable yamlPath, like isRushSessionValid) so the freshness behavior —
+ * including the `expires_at: 0` non-expiring case (PHNX-3645) — is directly
+ * testable; the class methods call it with the default path.
+ */
+export declare function readToken(yamlPath?: string): string;
 /** One version's entry in the account manifest sent on every dispatch. */
 export interface AccountManifestEntry {
     version: string;

package/dist/lib/cloud/rush.js

@@ -10,6 +10,7 @@ import * as os from 'os';
 import * as crypto from 'crypto';
 import * as yaml from 'yaml';
 import { resolveDispatchRepos, normalizeProviderStatus, MAX_IMAGES_PER_DISPATCH } from './types.js';
+import { isRushSessionExpired } from '../rush-session.js';
 import { parseSSE } from './stream.js';
 import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
 import { getAccountInfo } from '../agents.js';
@@ -19,8 +20,9 @@ const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
 /**
  * Returns true when ~/.rush/user.yaml exists, carries an access_token, and
  * the token has not passed its expires_at timestamp (Unix seconds). A missing
- * expires_at is treated as non-expired so tokens written without an expiry
- * still work. Pass yamlPath to override the default path in tests.
+ * expires_at, or `expires_at: 0` (a non-expiring Phoenix `pid_` bearer), is
+ * treated as non-expired (see isRushSessionExpired, PHNX-3645). Pass yamlPath
+ * to override the default path in tests.
  */
 export function isRushSessionValid(yamlPath = USER_YAML) {
     try {
@@ -30,8 +32,7 @@ export function isRushSessionValid(yamlPath = USER_YAML) {
         const data = yaml.parse(raw);
         if (!data?.session?.access_token)
             return false;
-        const expiresAt = data.session.expires_at;
-        if (typeof expiresAt === 'number' && expiresAt <= Date.now() / 1000)
+        if (isRushSessionExpired(data.session.expires_at))
             return false;
         return true;
     }
@@ -39,19 +40,24 @@ export function isRushSessionValid(yamlPath = USER_YAML) {
         return false;
     }
 }
-/** Read the Rush session access token from ~/.rush/user.yaml. */
-function readToken() {
-    if (!fs.existsSync(USER_YAML)) {
+/**
+ * Read the Rush session access token from ~/.rush/user.yaml. Exported (with an
+ * overridable yamlPath, like isRushSessionValid) so the freshness behavior —
+ * including the `expires_at: 0` non-expiring case (PHNX-3645) — is directly
+ * testable; the class methods call it with the default path.
+ */
+export function readToken(yamlPath = USER_YAML) {
+    if (!fs.existsSync(yamlPath)) {
         throw new Error('Not logged in to Rush. Run `rush login` first.');
     }
-    const raw = fs.readFileSync(USER_YAML, 'utf-8');
+    const raw = fs.readFileSync(yamlPath, 'utf-8');
     const data = yaml.parse(raw);
     const token = data?.session?.access_token;
     if (!token) {
         throw new Error('No session token in ~/.rush/user.yaml. Run `rush login` first.');
     }
     const expiresAt = data.session?.expires_at;
-    if (typeof expiresAt === 'number' && expiresAt <= Date.now() / 1000) {
+    if (isRushSessionExpired(expiresAt)) {
         const expiredAt = new Date(expiresAt * 1000).toISOString();
         throw new Error(`Rush session expired at ${expiredAt}. Run \`rush login\` to refresh.`);
     }

package/dist/lib/daemon/daemon.js

@@ -2249,7 +2249,15 @@ function stopDaemonLocked() {
     // any service-manager teardown or direct signal and repairs only under lock.
     const pid = resolveLiveDaemonPid(true);
     const browserSock = process.platform === 'win32' ? null : getBrowserIpcSocketPath();
-    const browserSockOwner = pid !== null && browserSock ? readPathIdentity(browserSock) : null;
+    // Capture the socket's inode INDEPENDENTLY of whether a live pid resolved
+    // (PHNX-3618). A daemon that died between the CLI liveness precheck and this
+    // locked read leaves resolveLiveDaemonPid() returning null while its ungraceful
+    // exit left the binding on disk — capturing only when `pid !== null` meant that
+    // genuinely stale socket could never be reclaimed and was reported "ownership
+    // could not be verified". The inode is the successor guard: a fresh daemon that
+    // rebinds during the stop gets a new inode, so a later identity match still
+    // proves this exact binding is the one we captured, never a successor's.
+    const browserSockOwner = browserSock ? readPathIdentity(browserSock) : null;
     if (platform === 'darwin') {
         const plistPath = getLaunchdPlistPath();
         if (fs.existsSync(plistPath)) {
@@ -2380,8 +2388,19 @@ function stopDaemonLocked() {
     // ungracefully (killTree) and left a stale binding — the owner is provably
     // dead, so reclaim it and report.
     if (process.platform !== 'win32') {
+        // A binding is provably stale — and reclaimable — when the inode on disk is
+        // still the exact one captured under this lock AND no daemon (the signalled
+        // target OR any successor for this state dir) survives to own it. Keying the
+        // "a daemon still owns it" test on the whole survivor set rather than only the
+        // captured target is what lets a daemon that died BEFORE this stop (pid ===
+        // null, PHNX-3618) still have its stale socket reclaimed, while a live
+        // successor — which either rebound the inode or shows up as a survivor — is
+        // never touched (PHNX-3607's never-delete-a-successor invariant).
+        const aDaemonSurvives = survivors.length > 0 || unverifiedSurvivors.length > 0;
         if (browserSock && fs.existsSync(browserSock)) {
-            if (browserSockOwner && pathIdentityMatches(browserSock, browserSockOwner) && !targetStillOwnsResources) {
+            const ownsCapturedBinding = browserSockOwner !== null
+                && pathIdentityMatches(browserSock, browserSockOwner);
+            if (ownsCapturedBinding && !aDaemonSurvives) {
                 try {
                     fs.unlinkSync(browserSock);
                 }
@@ -2393,13 +2412,14 @@ function stopDaemonLocked() {
                 else
                     released.push('browser IPC socket (reclaimed)');
             }
+            else if (aDaemonSurvives) {
+                surviving.push('browser IPC socket still owned by a surviving daemon');
+            }
             else {
-                // The path was absent when the target was captured, there was no proven
-                // daemon target, or a successor replaced the inode. In every case this
-                // invocation does not own the current binding and must leave it alone.
-                surviving.push(targetStillOwnsResources
-                    ? 'browser IPC socket still owned by a surviving daemon'
-                    : 'browser IPC socket ownership could not be verified');
+                // The path was absent when this transaction captured the target (a
+                // successor bound it afterward) or a successor replaced the inode. Either
+                // way this invocation does not own the current binding and must leave it.
+                surviving.push('browser IPC socket ownership could not be verified');
             }
         }
         else {

package/dist/lib/daemon/runner.js

@@ -922,8 +922,12 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
     if (config.account && !explicitCredential) {
         // A native routine account is named by its durable name; the version matcher
         // keys on the identity (email/accountKey), so translate before resolving,
-        // and refuse a login that belongs to a different harness.
-        const unified = findUnifiedAccount(config.account, meta);
+        // and refuse a login that belongs to a different harness. Scope the lookup to
+        // the routine's own harness: `identityLabel` defaults to the login's email, so
+        // `account: <email>` matches every harness that identity is signed into, and
+        // un-scoped this resolved whichever row the store ordered first — then rejected
+        // it on the very next line.
+        const unified = findUnifiedAccount(config.account, meta, undefined, agent);
         if (unified?.kind === 'native' && unified.agent !== agent) {
             throw new Error(`Routine '${config.name}' account '${config.account}' is a ${unified.agent} login and cannot authenticate ${agent}.`);
         }

package/dist/lib/exec.d.ts

@@ -44,7 +44,7 @@ export declare function headlessPlanStallCommand(args: {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/kiro have no plan flag; hard-failing made
+ *   like antigravity have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -64,7 +64,7 @@ export declare function resolveMode(agent: AgentId, requested: Mode): Mode;
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
  * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
- * and kiro get for having no plan flag at all. Interactive runs are never
+ * get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */

package/dist/lib/exec.js

@@ -96,7 +96,7 @@ export function headlessPlanStallCommand(args) {
  *   (every agent supports edit-like behavior as its default).
  * - `plan` on an agent without a read-only mode degrades to the agent's
  *   safest native mode (`capabilities.modes[0]`, typically `edit`). Agents
- *   like antigravity/kiro have no plan flag; hard-failing made
+ *   like antigravity have no plan flag; hard-failing made
  *   multi-agent scripts (`--mode plan` for everyone) unusable and diverged
  *   from `agents teams add`, which already defaults to `edit`. Callers that
  *   care (the `agents run` CLI) must surface a warning when requested ≠
@@ -116,7 +116,7 @@ export function resolveMode(agent, requested) {
     }
     if (requested === 'plan') {
         // No read-only mode on this agent. modes[0] is the declared safest mode
-        // (edit for antigravity/kiro/…). Prefer that over hard-fail so
+        // (edit for antigravity/…). Prefer that over hard-fail so
         // uniform multi-agent `--mode plan` dispatches still run.
         return supported[0];
     }
@@ -132,7 +132,7 @@ export function resolveMode(agent, requested) {
  * its ExitPlanMode gate. For those agents, a headless plan request degrades to
  * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
  * one-line stderr warning, mirroring the graceful plan→edit degrade antigravity
- * and kiro get for having no plan flag at all. Interactive runs are never
+ * get for having no plan flag at all. Interactive runs are never
  * downgraded. This is the single source of truth shared by buildExecCommand
  * (agents run / teams) and the routine runner.
  */
@@ -522,25 +522,6 @@ export const AGENT_COMMANDS = {
         jsonFlags: ['--format', 'json'],
         modelFlag: '--model',
     },
-    // Oh My Pi (`omp`). Headless is the positional MESSAGES arg + `-p/--print`.
-    // Approval modes map to omp's `--approval-mode`: always-ask (read-only tools
-    // auto-approved, writes gated -> our `plan`), write (read + workspace writes
-    // auto-approved -> `edit`), yolo (all tiers auto-approved -> `skip`). JSON is
-    // omp's `--mode json` event stream. `--model` fuzzy-matches a provider/model
-    // selector. Native resume is `-r/--resume <id-prefix>`.
-    pi: {
-        base: ['omp'],
-        promptFlag: 'positional',
-        modeFlags: {
-            plan: ['--approval-mode', 'always-ask'],
-            edit: ['--approval-mode', 'write'],
-            skip: ['--approval-mode', 'yolo'],
-        },
-        jsonFlags: ['--mode', 'json'],
-        modelFlag: '--model',
-        printFlags: ['-p'],
-        resume: { flag: '--resume' },
-    },
     openclaw: {
         base: ['openclaw'],
         promptFlag: 'positional',
@@ -584,18 +565,6 @@ export const AGENT_COMMANDS = {
         },
         modelFlag: '--model',
     },
-    kiro: {
-        // Standalone hooks live under ~/.kiro/hooks/*.json and only fire on the
-        // v3 engine (opt-in via --v3; see https://kiro.dev/docs/cli/v3/hooks/).
-        // Without this flag agents-cli would write v3 hook files that never run.
-        base: ['kiro-cli', '--v3'],
-        promptFlag: 'positional',
-        modeFlags: {
-            // kiro-cli has no permission flags — edit is the default behavior.
-            edit: [],
-        },
-        modelFlag: '--model',
-    },
     goose: {
         base: ['goose', 'run'],
         promptFlag: 'positional',

package/dist/lib/feed-broadcast.d.ts

@@ -1,4 +1,5 @@
 import type { Meta } from './types.js';
+import { type SinkMessageFormat } from './sink-format.js';
 /** How loudly a post asks to be heard. Ordered — `important` implies milestone. */
 export type FeedPostLevel = 'milestone' | 'important';
 /** Parse a `--level` value; anything unrecognized is a usage error, not a default. */
@@ -122,6 +123,17 @@ export interface PlannedSink {
     to?: string;
     /** Channel sink body — the composed `{message}` for this post. */
     text?: string;
+    /**
+     * Owner-alias sinks only: the post context + its `message:` template, carried
+     * so the owner fan-out can re-render the body PER DESTINATION — Slack in the
+     * policy gets `mrkdwn` labeled links while iMessage stays plain (PHNX-3698).
+     * `text` above is the plain default (dry-run display + the fallback when a
+     * destination has no resolvable provider); this drives the real send. A
+     * direct `channel:` sink resolves its one provider's format at plan time and
+     * needs neither field.
+     */
+    ctx?: FeedBroadcastContext;
+    messageTemplate?: string;
 }
 export interface SinkOutcome {
     name: string;
@@ -157,35 +169,6 @@ export declare function sessionConsoleUrl(session: string | undefined): string |
  * Collapses whitespace; does not invent meaning.
  */
 export declare function scrubOutboundDashes(text: string): string;
-/**
- * The rendering vocabulary a sink can display, which decides how the shared
- * `{message}` surfaces its links (PHNX-3698):
- *
- *   - `mrkdwn` — Slack, which renders `<url|label>` as blue tappable text. The
- *     session crumb and every ticket key the prose NAMES become inline labeled
- *     links, so nothing rides a trailing naked-URL line.
- *   - `plain` — iMessage, the owner-scoped rush message, a spawned `command:`
- *     sink, desktop banners: none can render a labeled link and a dumped naked
- *     URL reads as noise, so the message stays the human sentence with no URLs.
- *
- * The default is `plain`; only a Slack `channel:` sink opts into `mrkdwn`.
- */
-export type SinkMessageFormat = 'plain' | 'mrkdwn';
-/**
- * Only Slack renders `<url|label>`, so it is the one format that gets labeled
- * links. iMessage / owner-scoped rush / command / desktop sinks stay `plain`
- * (they can't turn `claude/6fc1db18` blue, and dumping the raw URL is worse than
- * leaving the crumb unlinked — PHNX-3698).
- *
- * The argument is the **resolved provider name**, not the sink's declared
- * channel: an operator can point an arbitrary channel name at the Slack provider
- * through `notify.transports` (e.g. `eng-alerts -> slack`), and delivery keys off
- * that resolved provider (`lookupTransport`), so the format decision must too —
- * otherwise an aliased Slack sink would compose plain while delivering to Slack,
- * or a name remapped AWAY from Slack would emit `<url|label>` markup a non-Slack
- * transport shows literally. {@link resolveSinkProvider} does the mapping.
- */
-export declare function sinkMessageFormat(provider: string | undefined): SinkMessageFormat;
 /**
  * Footer like "Sent from my iPhone" — who posted, a session crumb, which box.
  *

package/dist/lib/feed-broadcast.js

@@ -41,6 +41,7 @@ import { sendToOwner } from './notify.js';
 import { linearIssueUrl, linearIssueKeys } from './session/linear.js';
 import { isValidMailboxId } from './mailbox.js';
 import { forwardOwnerNotifyToPeer } from './channels/owner-forward.js';
+import { sinkMessageFormat } from './sink-format.js';
 const LEVEL_RANK = { milestone: 0, important: 1 };
 /** Parse a `--level` value; anything unrecognized is a usage error, not a default. */
 export function parseFeedPostLevel(raw) {
@@ -184,23 +185,6 @@ export function scrubOutboundDashes(text) {
 function slackLink(url, label) {
     return `<${url}|${label}>`;
 }
-/**
- * Only Slack renders `<url|label>`, so it is the one format that gets labeled
- * links. iMessage / owner-scoped rush / command / desktop sinks stay `plain`
- * (they can't turn `claude/6fc1db18` blue, and dumping the raw URL is worse than
- * leaving the crumb unlinked — PHNX-3698).
- *
- * The argument is the **resolved provider name**, not the sink's declared
- * channel: an operator can point an arbitrary channel name at the Slack provider
- * through `notify.transports` (e.g. `eng-alerts -> slack`), and delivery keys off
- * that resolved provider (`lookupTransport`), so the format decision must too —
- * otherwise an aliased Slack sink would compose plain while delivering to Slack,
- * or a name remapped AWAY from Slack would emit `<url|label>` markup a non-Slack
- * transport shows literally. {@link resolveSinkProvider} does the mapping.
- */
-export function sinkMessageFormat(provider) {
-    return provider?.trim().toLowerCase() === 'slack' ? 'mrkdwn' : 'plain';
-}
 /**
  * The provider a channel name actually delivers through — the same
  * `notify.transports` remap `lookupTransport` applies at delivery — so the format
@@ -481,21 +465,28 @@ export function planFeedBroadcast(config, ctx, meta) {
             // placeholder below).
             if (!isOwnerAlias(channel) && !sink.to?.trim())
                 continue;
-            // Slack renders labeled links; every other channel (owner alias, iMessage,
-            // telegram, discord, mailbox, desktop) stays plain (PHNX-3698). The owner
-            // alias is deliberately plain even when it fans out to a Slack destination:
-            // it delivers ONE shared string to every channel in owner.policy.normal, so
-            // mrkdwn markup would corrupt a sibling iMessage copy. Keying on the
-            // resolved provider (not the raw name) matches what delivery does.
-            const provider = isOwnerAlias(channel) ? channel : resolveSinkProvider(channel, meta);
-            const text = renderSinkMessage(sink.message ?? '{message}', ctx, sinkMessageFormat(provider));
+            // Slack renders labeled links; every other channel (iMessage, telegram,
+            // discord, mailbox, desktop) stays plain (PHNX-3698). A DIRECT channel sink
+            // has one known provider, so its format is resolved here. The OWNER ALIAS
+            // fans out to every channel in owner.policy.normal — each with its OWN
+            // provider — so it can't pick one format now: it carries the ctx + template
+            // and re-renders per destination inside the owner fan-out (runChannelSink →
+            // sendToOwner), so the Slack destination turns blue while a sibling iMessage
+            // copy stays plain. The plain body computed here is the dry-run/fallback
+            // default. Keying on the resolved provider (not the raw name) matches what
+            // delivery does.
+            const owner = isOwnerAlias(channel);
+            const template = sink.message ?? '{message}';
+            const provider = owner ? channel : resolveSinkProvider(channel, meta);
+            const text = renderSinkMessage(template, ctx, sinkMessageFormat(provider));
             if (!text)
                 continue;
             planned.push({
                 name,
                 channel,
-                to: isOwnerAlias(channel) ? undefined : sink.to.trim(),
+                to: owner ? undefined : sink.to.trim(),
                 text,
+                ...(owner ? { ctx, messageTemplate: template } : {}),
             });
             continue;
         }
@@ -604,7 +595,17 @@ async function runChannelSink(sink, meta) {
     registerBuiltinProviders();
     const owner = isOwnerAlias(sink.channel);
     if (owner) {
-        const result = await sendToOwner(sink.text ?? '', { meta });
+        // Re-render the body PER owner destination so a Slack channel in the policy
+        // gets mrkdwn labeled links while iMessage stays plain (PHNX-3698). The
+        // fan-out (sendToOwner) resolves each destination's provider and asks this
+        // composer for the matching format. renderSinkMessage is fail-closed on a
+        // missing placeholder — the plan already dropped the sink if the template
+        // couldn't fill, so here it always resolves; `?? sink.text` is a belt-and-
+        // braces guard, never the normal path.
+        const composeForFormat = sink.ctx
+            ? (format) => renderSinkMessage(sink.messageTemplate ?? '{message}', sink.ctx, format) ?? sink.text ?? ''
+            : undefined;
+        const result = await sendToOwner(sink.text ?? '', { meta, composeForFormat });
         return { name, ok: result.ok, ...(result.error ? { error: result.error } : {}) };
     }
     const resolved = resolveSendEnvelope({

package/dist/lib/hooks/install.js

@@ -1845,9 +1845,6 @@ export function registerHooksToSettings(agentId, versionHome, hookManifest, agen
     if (agentId === 'copilot') {
         return registerHooksForCopilot(versionHome, manifest, resolveScript, managedPrefixes);
     }
-    if (agentId === 'kiro') {
-        return registerHooksForKiro(versionHome, manifest, resolveScript, managedPrefixes);
-    }
     if (agentId === 'goose') {
         return registerHooksForGoose(versionHome, manifest, resolveScript, managedPrefixes);
     }
@@ -2846,90 +2843,6 @@ function registerHooksForCopilot(versionHome, manifest, resolveScript, _managedP
     }
     return { registered, errors };
 }
-/**
- * Canonical hooks.yaml event names → Kiro v3 trigger names.
- * Kiro v3 uses PascalCase triggers under `.kiro/hooks/*.json`
- * (https://kiro.dev/docs/cli/v3/hooks/). Unmapped events are skipped.
- */
-const KIRO_EVENT_MAP = {
-    SessionStart: 'SessionStart',
-    Stop: 'Stop',
-    PreToolUse: 'PreToolUse',
-    PostToolUse: 'PostToolUse',
-    UserPromptSubmit: 'UserPromptSubmit',
-};
-/**
- * Kiro triggers that evaluate the `matcher` regex (tool name, file path, or
- * prompt text depending on the trigger). Lifecycle SessionStart/Stop always fire.
- */
-const KIRO_MATCHER_EVENTS = new Set([
-    'PreToolUse',
-    'PostToolUse',
-    'UserPromptSubmit',
-]);
-/** Managed filename under ~/.kiro/hooks/ — we own this file entirely. */
-const KIRO_MANAGED_HOOKS_FILE = 'agents-cli-hooks.json';
-/**
- * Register hooks for Kiro CLI (v3 standalone hooks format).
- *
- * Each file under `~/.kiro/hooks/*.json` is:
- *   { "version": "v1", "hooks": [ { name, trigger, matcher?, action, timeout?, enabled? } ] }
- *
- * We rewrite a single managed file so GC is a rewrite and user-authored sibling
- * JSON files are never touched. Embedded agent-config hooks (2.x) still work
- * in Kiro but we only write the v3 path.
- */
-function registerHooksForKiro(versionHome, manifest, resolveScript, _managedPrefixes) {
-    const registered = [];
-    const errors = [];
-    const kiroHooksDir = path.join(versionHome, '.kiro', 'hooks');
-    fs.mkdirSync(kiroHooksDir, { recursive: true });
-    const hooks = [];
-    for (const [name, hookDef] of Object.entries(manifest)) {
-        if (!hookDef.events || hookDef.events.length === 0)
-            continue;
-        const commandPath = resolveHookCommand(name, hookDef, resolveScript);
-        if (!commandPath) {
-            errors.push(`${name}: script not found in user or system hooks dir`);
-            continue;
-        }
-        const timeout = hookDef.timeout ?? 60;
-        for (const event of hookDef.events) {
-            const trigger = KIRO_EVENT_MAP[event];
-            if (!trigger)
-                continue;
-            const entry = {
-                name,
-                trigger,
-                action: { type: 'command', command: commandPath },
-                timeout,
-                enabled: true,
-            };
-            if (KIRO_MATCHER_EVENTS.has(trigger) && hookDef.matcher) {
-                entry.matcher = hookDef.matcher;
-            }
-            // De-dupe on (name, trigger, matcher)
-            const existingIdx = hooks.findIndex((h) => h.name === entry.name &&
-                h.trigger === entry.trigger &&
-                (h.matcher ?? '') === (entry.matcher ?? ''));
-            if (existingIdx >= 0) {
-                hooks[existingIdx] = entry;
-            }
-            else {
-                hooks.push(entry);
-            }
-            registered.push(`${name} -> ${trigger}`);
-        }
-    }
-    const outPath = path.join(kiroHooksDir, KIRO_MANAGED_HOOKS_FILE);
-    try {
-        fs.writeFileSync(outPath, JSON.stringify({ version: 'v1', hooks }, null, 2) + '\n', 'utf-8');
-    }
-    catch (err) {
-        errors.push(`Failed to write ${KIRO_MANAGED_HOOKS_FILE}: ${err.message}`);
-    }
-    return { registered, errors };
-}
 /**
  * Canonical hooks.yaml event names that goose supports (Open Plugins PascalCase).
  * Unmapped events are skipped. Goose ≥ 1.34.0.