@phnx-labs/agents-cli 1.22.69 → 1.22.71

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.22.71
+
+- **The daemon now keeps itself current instead of running stale code for days (PHNX-3695).** The long-running daemon (`agents __daemon-run`) deliberately opted out of the interactive CLI's auto-update (`AGENTS_CLI_DISABLE_AUTO_UPDATE=1` forced on for `__daemon-run`), so new agents-cli code never reached a running daemon until a human ran `agents daemon restart` — R5 ("the installed CLI auto-updates") silently did not hold for the one process that runs unattended the longest. A new supervised `self-update` service checks npm roughly every 75 minutes, installs and byte-verifies a newer version with the same primitives `agents upgrade` already uses (never a bare `npm install -g`), best-effort pulls the `.system` companion repo and reconciles with `agents sync --local`, then exits so the OS supervisor (launchd `KeepAlive` / systemd `Restart=always`) relaunches it onto the new code — clients reconnect on their own, and the scheduler's atomic `(routine, scheduledFor)` claim dedupes any routine mid-fire across the restart. It fails closed on every step: an install or verify failure leaves the running daemon untouched and retries next tick, and it no-ops on a dev build or a shadowed install. A version-skewed browser-IPC client no longer just prints "run agents daemon restart" — `reconcileDaemonVersion` now asks the daemon to run this same fail-closed path on demand (`request-self-update`), sharing one in-flight attempt with the periodic tick so concurrent requests can't race two installs. That on-demand trigger is DECOUPLED from the install: because every version-skewed `agents browser <verb>` routes through it, the daemon kicks the self-update off in the background and answers "triggered" immediately rather than making the browser verb wait out the whole check→download→install→verify (tens of seconds, worst case ~15 min) — the daemon installs, verifies, and exits on its own, and the browser reconnects. Source: `cli/src/lib/daemon/self-update-service.ts`, `cli/src/lib/browser/ipc.ts`.
+
+- **The daemon's event loop is no longer starved by synchronous subprocess spawns on its service ticks (PHNX-3695).** Every daemon background service runs on one Node event loop, so a synchronous `execFileSync`/`readFileSync` inside a service tick froze that loop for the whole call — and while frozen the supervisor's per-tick deadline timer could not fire and the browser IPC server could not answer, which is the "accept but never reply" wedge the trivial `version` probe (`cli/src/lib/browser/ipc.ts`) surfaces. A new async, deadline-bounded, process-group-killable exec helper (`cli/src/lib/exec-bounded.ts` `execFileBounded`) replaces the tick-reachable sync spawns. The heartbeat tick is now fully async: it reaps exited routine children through `reapExitedRunningJobs` (an async twin of the sync `monitorRunningJobs`, sharing one reconciliation core so the CLI `routines list/status` builders keep their synchronous, off-loop path) with an `execFileBounded`-bounded `ps` identity probe and an async `sshExecAsync` read of a `host:`-placed run's remote exit (a synchronous `ssh` there would freeze the loop on a host timeout), plus the async terminal-routine reaper; the self-heal and state-dir-check service ticks moved their `existsSync`/`readFileSync` to `fs/promises`. The worst halt was the event-log **file lock** (`withFileLock` → `lockfile.lockSync` + `Atomics.wait`, up to 30s), reached from every `ctx.log` on every tick as well as the watchdog and routine-reaper emits; a new `withFileLockAsync` + `emitAsync` (`cli/src/lib/fs-atomic.ts`, `cli/src/lib/feed/events.ts`) acquire it without freezing the loop. The other unconditional every-tick halts are converted the same way: usage-sync/auth-sync publish through `updateFleetSharedDeviceStateAsync`, keychain-reap's whole-process-table `ps` uses `execFileBounded`, watchdog/browser-task-reap read config via async paths, and tmux-reap's `/proc` scan uses `fs/promises`. A structural guard test (`cli/src/lib/daemon/guard-no-sync-io.test.ts`) scans every `*-service.ts` tick/start body for a synchronous fs/exec/lock call AND pins that each hot tick call site uses its async variant (failing if a fix is reverted to its sync twin). Startup and stop/uninstall lifecycle code (pid/lock, `launchctl`/`systemctl`, the `ps` daemon-identity probe) stays synchronous — it runs in a short-lived CLI process, never on the served loop. Source: `cli/src/lib/{exec-bounded,fs-atomic,device-config,fleet-shared-state}.ts`, `cli/src/lib/feed/events.ts`, `cli/src/lib/secrets/{reaper,reserved-sync}.ts`, `cli/src/lib/accounting/usage-sync.ts`, `cli/src/lib/tmux/{session,orphan-reap}.ts`, `cli/src/lib/daemon/{runner,daemon,heartbeat-service,watchdog-service,usage-sync-service,auth-sync-service,keychain-reap-service,browser-task-reap-service,self-heal-service,state-dir-check-service}.ts`, `cli/src/lib/hosts/reconcile.ts`, `cli/src/lib/routine-process-cleanup.ts`, `cli/src/lib/daemon/AGENTS.md`.
+
+- **The required PR check no longer reinstalls 273 packages on every run.** Measured across recent Linux required runs, `bun install` took 14–22s on *every* run — whether the impact plan selected 78 test files or 2 — while a release check's actual test execution is 0.27s. The install was a fixed cost every pull request paid, and the largest single item in the required-check budget. `tests.yml` now restores `~/.bun/install/cache`, `cli/node_modules`, and `packages/session-tracker/node_modules` from an `actions/cache` keyed on **both** `cli/bun.lock` and `packages/session-tracker/bun.lock` — keying on the CLI lockfile alone would have left the session-tracker tree outside its own key. The key also carries a `node -v`/`bun -v` fingerprint, because `cli/package.json` trusts a native addon (`@homebridge/node-pty-prebuilt-multiarch`) whose prebuilt binary is Node-ABI-specific and nothing pins the runner's Node. `restore-keys` is deliberately omitted: a prefix fallback would let bun install on top of a *different* lockfile's modules, and `--frozen-lockfile` only guarantees the tree matches the lock from a clean or exact-match state — correctness beats a warmer cache when an attestation binds the tested tree to the published tarball. A dependency change misses the cache and reinstalls, which is exactly the previous behavior, so a miss can never be slower than not caching. Source: `.github/workflows/tests.yml`.
+
+- **The CI dependency cache now actually hits.** The cache added a change earlier was dead weight in practice: GitHub scopes caches per ref — a run can restore only from its own branch or the default branch — and the required `test` job runs on `pull_request` only, so every entry it saved landed under `refs/pull/<N>/merge`, invisible to every other pull request. Measured after it shipped: `deps-cache-hit=0` with `packages installed [21.63s]` on unrelated PRs, i.e. a permanent cold miss for everyone except a re-run of the same PR. A push-to-`main` `warm-dep-cache` job now writes the identical key and paths, so the first PR after any lockfile or toolchain change pays the install once and every later PR restores it. The job is push-only and never joins the required check identity. `tests-gate.test.ts` pins the two keys equal, because drift between them would be silent — the warm job would populate an entry the required job never asks for, and the cache would look healthy while never hitting. Source: `.github/workflows/tests.yml`.
+
+- **Managed session backup: harden the storage boundary (PHNX-3726).** Follow-up security fixes to the managed sessions Worker landed in the same ticket. The Worker is now **Phoenix-only** — the static `WRITE_TOKEN` principal is removed (and no longer provisioned): the zero-knowledge `--byo` path talks to your own R2 bucket directly and never reaches this Worker, so a token here was only a Phoenix-and-quota bypass. Mandatory encryption is now enforced at the storage boundary, not just client-side: a PUT whose body is not an encrypted bundle is rejected `422`, and a managed restore fails loud on any plaintext object instead of importing it. DELETE now refunds the per-user quota ledger via a delta CAS applied BEFORE the object is removed, and fails loud (503, object left intact and charged) when that CAS stays contended — instead of deleting first and silently dropping the refund on a contended ledger. Source: `cli/src/lib/session/sync/{worker-template,provision}.ts`, `cli/src/commands/sessions-import.ts`, `cli/docs/specifications.md`.
+
+- **Signed-in users back sessions up off-box with NO `r2.backups` bucket to set up (PHNX-3726).** `agents sessions export --to-r2` / `import --from-r2` now default to a managed, Phoenix-gated store (`sessions.agents-cli.sh`) when you are signed in (`agents auth login`) — the same zero-setup pattern `agents artifacts share` and `agents traces sync` already use, resolved through the one shared `selectStorageBackendKind` policy. It is **managed-first**: a signed-in user backs up to managed even with a stale `r2.backups` bundle present; only `--byo` / `AGENTS_SESSIONS_BACKEND=byo` flips to your own bucket. Every managed backup is **mandatorily** AES-256-GCM encrypted under a per-account key that is minted once, cached at `~/.agents/.cache/state/sessions-backup-key.json` (mode 0600), and escrowed at the bearer-gated, immutable Worker key `<userId>/__key/backup-dek` so a fresh box signing in recovers it and decrypts prior backups with zero setup — the managed path never uploads plaintext. Both the command and Worker reject plaintext/malformed managed objects, and restore revalidates every at-rest bundle before decryption. Honest trust boundary: confidential vs a raw R2/Cloudflare bucket read (ciphertext at rest) but NOT zero-knowledge vs Phoenix (the DEK is escrowed on Phoenix infra); `--byo` keeps the zero-knowledge own-bucket path (the key stays only in your `r2.backups` bundle). The isolated Worker verifies the Phoenix bearer on every PUT/GET/LIST/DELETE, enforces `segments[0] == userId` (401/403, no public GET), and meters a per-user CAS quota (`__usage`, 413 over quota). Same-key managed PUT/DELETE operations share an expiring R2 lease; every object change is etag-conditioned, DELETE leaves a GET-404/LIST-hidden tombstone, and expired recovery fences the predecessor's etag before settling quota. The ledger retains an idempotent pending delta plus a terminal generation per path in the same CAS object, preventing late predecessor charges, replacement deletes, double refunds, stranded paths, and phantom quota. A CAS-reserved historical-path budget is consumed before persistent per-path state is created and is not refunded on DELETE, so authenticated create/delete churn cannot grow tombstones, leases, or ledger history past the hard cap. Reserved `__usage`/`__key` prefixes are never listed. The BYO object layout is byte-for-byte unchanged (the `<userId>/` prefix is added inside the client) and the Worker is integration-tested against real workerd. Source: `cli/src/lib/session/sync/{backend,managed-config,managed-key,net-client,provision,worker-template}.ts`, `cli/src/commands/sessions-export.ts`, `cli/src/commands/sessions-import.ts`, `cli/docs/{sessions,specifications}.md`.
+
+- **Daemon: a host-placed run finishing on the heartbeat tick no longer freezes the event loop (PHNX-3727).** Fast-follow to PHNX-3695. `finalizeHostRunAsync` (the async, tick-reachable finalize path reached via `reapExitedRunningJobs`) called `applyHealedHostRun`, which ended by emitting routine-end through the **synchronous** `emitRoutineEnd` — whose event-log file lock (`withFileLock` → `lockSync` + `Atomics.wait`, up to 30s under contention) is exactly the loop-freeze PHNX-3695 removed elsewhere, on a path `guard-no-sync-io` couldn't see (it lives in `runner.ts`, not a `*-service.ts`). So a `host:`-placed routine run completing could still wedge the browser-IPC "accept but never reply" state under lock contention. `applyHealedHostRun` now takes an injected emitter: `finalizeHostRun` (sync CLI path) keeps the synchronous emit, while `finalizeHostRunAsync` (the tick) passes `emitRoutineEndAsync` (`withFileLockAsync`), so no daemon tick reaches the synchronous lock. `guard-no-sync-io` gains a call-site pin so reverting it fails loud. Source: `cli/src/lib/daemon/runner.ts`, `cli/src/lib/daemon/guard-no-sync-io.test.ts`.
+
+- **`agents traces sync` now surfaces silent behavioral failures as ranked issues, not just a friction counter (RUSH-2988).** A session where the agent went idle after its last event and a human had to nudge it is a real failure with **no error code**, so it never clustered through `computeInsights` (which only groups `outcome === 'error'` tool calls) and was previously only a `needsAttention` severity input. The per-session silent-stall friction (`silent stall: 5-15m/15-60m/1h+`, already computed by `computeInsightFacets`) is now promoted into cross-session `FailurePattern`s with a new `behavioral` failure cause (`cli/src/lib/traces/insights.ts` `computeBehavioralPatterns`), ranked into the same top-K `failurePatterns` by wasted idle time (a bucket's midpoint, bounded by the same 30-min `MAX_GAP_ATTRIBUTION_MS` cap the tool-error path uses) and summed into `wastedMsTotal`. `TraceFailureCause` gains `behavioral` (`cli/src/lib/traces/classify.ts`); it is producer-derived and never returned by `classifyCause`, so the `failures.byCause` tool-error split reports it as `0`. The console renders the new cause in a follow-up web change.
+
+## 1.22.70
+
+- **`agents browser stop --profile` is now gated by the remote-control consent gate (PHNX-3317).** `stop --profile <name>` (no `--task`) is handled entirely by `bindTask`'s early return in `ipc.ts`, so it never reached `resolveOrCreateTask` — the one chokepoint every other page/close/attach verb's `assertRemoteControlAllowedForRequest` gate runs through — and `case 'stop'` called `BrowserService.stopProfile()` directly with no consent check at all. That left one destructive fleet-remote path (kills the profile's browser process, clears its runtime dir) reachable from `browser --device <device> stop --profile` even with `remote-control off` on the target. `stopProfile()` now takes the same `{ fleetRemote, actor }` opts as `start`/`showUrl`/`resolveOrCreateTask` and asserts the gate first; a local (non-fleet-remote) call is unaffected. Source: `cli/src/lib/browser/service.ts`, `cli/src/lib/browser/ipc.ts`.
+
+- **The PHNX-2939 headless-account regression test now genuinely exercises the headless path (PHNX-3352).** The real-macOS-keychain test in `account-registry.keychain.test.ts` set `AGENTS_RUNTIME='test-headless-account-launch'`, a made-up value `isHeadlessSecretsContext()` never matches — its set is exactly `headless`/`teams`/`terminal` — so the resolve never entered the headless keychain guard and the test passed identically with OR without the PHNX-2939 biometry-ACL fix, reproducing nothing. It now sets `AGENTS_RUNTIME='headless'` and asserts `isHeadlessSecretsContext()` is `true` before resolving, so the test fails against the pre-fix code (a direct `getKeychainToken` read of the policy-`never`, no-ACL account item is rejected as if it required Touch ID) and passes only because the fix routes through the bundle path that attests `silentNoAcl`. Source: `cli/src/lib/account-registry.keychain.test.ts`.
+
+- **`agents daemon stop` reclaims a stale `browser.sock` when the daemon vanishes mid-stop (PHNX-3618).** `stopDaemonLocked` captured the browser IPC socket's inode ONLY when a live pid resolved (`pid !== null && browserSock ? …`). If the daemon died in the window between the CLI liveness precheck (`isDaemonRunning()` was true) and the locked read, `resolveLiveDaemonPid()` returned null, so the owner was never captured — and the socket the daemon's ungraceful death left on disk hit the else branch, was reported "browser IPC socket ownership could not be verified", and was left behind, so the next daemon start raced a dead binding. The socket inode is now captured **independently of the pid**, and the stale binding is reclaimed once no live daemon — the signalled target OR any successor for this state dir — is proven to own it. PHNX-3607's never-delete-a-successor invariant is preserved: a successor that rebinds during the stop gets a new inode (identity no longer matches) or shows up as a survivor, and in either case its socket is left untouched. Source: `cli/src/lib/daemon/daemon.ts`.
+
+- **`agents run --cloud` no longer rejects a non-expiring Phoenix bearer (PHNX-3645).** A Rush session stores `expires_at: 0` for an opaque Phoenix `pid_` bearer, which by contract means NON-EXPIRING. Three freshness checks read that `0` as an absolute timestamp — `new Date(0)` = 1970-01-01 — and refused a valid, fresh session with `Rush session expired at 1970-01-01`, so no Phoenix-authed box could dispatch a cloud run, push/pull secrets over Rush, or list cloud sessions. The `expires_at === 0` (and missing) special-case now lives in one place, `isRushSessionExpired` (`cli/src/lib/rush-session.ts`), which cloud dispatch, the secrets Rush driver, and the cloud session source all route through — mirroring rush/cli's own `isFresh` (RUSH-1310, PHNX-3637). Source: `cli/src/lib/rush-session.ts`, `cli/src/lib/cloud/rush.ts`, `cli/src/lib/secrets/drivers/rush.ts`, `cli/src/lib/session/cloud.ts`.
+
+- **Owner alerts now render per destination — Slack gets tappable links, iMessage stays plain (PHNX-3698).** `agents notify` / `agents send --to owner` (and an important `feed post` that fans out to the owner) resolve every channel in `owner.policy.normal` and composed ONE plain string for all of them, so a Slack owner destination received a wall of prose with no `<url|label>` links and no tappable session crumb — the labeled-link support already in `composeBroadcastMessage` never fired on the path the owner actually uses. The owner fan-out (`sendToOwner`) now re-renders the body PER destination, keyed on each channel's resolved provider (the same `notify.transports` remap delivery uses): a Slack destination turns every `TEAM-N` key the post names into `<https://linear.app/<ws>/issue/<KEY>|<KEY>>` and the `Sent from claude/<id> on <host>` crumb into `<https://prix.dev/console/sessions/<full-id>|claude/<id>>` (the 8-char crumb upgraded to the full indexed id first), while iMessage / owner-scoped rush / desktop / `command:` sinks stay the plain human sentence with no URLs. Each delivery echoes the exact body it sent, so `agents notify --dry-run --json` now shows the two different bodies. Source: `cli/src/lib/notify.ts`, `cli/src/lib/owner-message.ts`, `cli/src/lib/sink-format.ts`, `cli/src/lib/feed-broadcast.ts`, `cli/src/lib/channels/send.ts`, `cli/src/commands/send.ts`.
+
+- **A release no longer starves waiting for the tip of `main` to be attested (PHNX-3705).** `release.sh` phase 2 required an attestation for `origin/main`'s tree *as of the instant the release ran*, but `attest-main.yml` produces that by running the full suite — minutes of work. On a repo where agents merge continuously, main advances faster than attestation completes, so every release lost the race and died at `missing exact attestation key`. Measured 2026-09-01: six merges to `main` in ~30 minutes with attest-main runs still pending or superseded; the tip was never attested long enough to release from, which also makes the R2 bar (ordinary release under 60s) unreachable by construction. The release does not need *the tip* — it needs a green base to cut the release commit from and derive the release-tree attestation against (PHNX-3696), and any attested **ancestor** serves. Phase 2 now requires an attestation for the tree it is **actually releasing from** (`$BASE_SHA`) rather than the live remote tip, and `derive_release_attestation` inherits from that same commit — the release commit's real parent — instead of the tip. New `cli/scripts/release-attested-base.sh` resolves the newest attested commit at or below `origin/<default>` (bounded lookback, fails closed when none is found), `release-worktree.sh` cuts the release worktree from it and says so on stderr when it is behind the tip, and `release.sh`'s base check now requires an *ancestor* of the remote tip rather than the tip exactly. The supply-chain guarantee is unchanged: the published tarball is still bound to a tree whose suite passed, and `derive`'s allowlist still fails closed on any code file — the release simply ships from a slightly older tree than the tip, which was always true of an attested tree. Source: `cli/scripts/release-attested-base.sh`, `cli/scripts/release-worktree.sh`, `cli/scripts/release.sh`.
+
+- **Docs: sign-in unlocks managed sharing, not only team spaces; `traces setup` marked advanced/self-host.** The README said signing in unlocks "the one thing" — team spaces — which predated managed, private-by-default sharing; it now names both hosted surfaces (team spaces AND `agents artifacts share`/`agents traces sync` on our storage with zero Cloudflare setup, private by default when signed in). The `agents traces setup` command description no longer reads as a normal user step — it is now labeled advanced/self-host, since `agents auth login` syncs to the managed endpoint with no setup. Source: `README.md`, `cli/src/commands/traces.ts`, `cli/docs/command-index.{md,json}`.
+
 ## 1.22.69
 
 - **`agents monitors` no longer fires an action on a poll FAILURE (PHNX-3510).** An `[on-change]` monitor treated a failing poll — a `gh pr list … | jq` that intermittently printed `GraphQL: API rate limit already exceeded …` — as a value change: the empty→error→empty flap read as two changes and dispatched a full agent run each time on a premise that was false (~10 sessions burned re-verifying two already-merged PRs). A command/poll source now flags a snapshot that exited non-zero, or whose output matches a transport/auth/rate-limit error shape (caught even on exit 0, since a pipe to jq swallows the failing half's exit code), as an *observation failure*: the engine skips it, leaves watched-state untouched, does not fire, and records it as a failed check so a sustained streak escalates to the owner as a drought. `agents monitors test` labels a failed poll and reports `Would fire: no`. Note: a non-zero exit is now an observation failure rather than a watchable value — a monitor that wants to watch a command's success/failure should emit a stable token (`… && echo UP || echo DOWN`, always exit 0) so the state it cares about diffs as a value; sustained failures still reach the owner via the drought escalation. Source: `cli/src/lib/monitors/sources/failure.ts`, `cli/src/lib/monitors/sources/command.ts`, `cli/src/lib/monitors/engine.ts`, `cli/docs/automation.md`.

package/README.md

@@ -34,7 +34,6 @@
       
   <a href="https://dev.meta.ai/docs/muse-code" title="Meta Muse Code"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/muse.svg"><img src="assets/harnesses/muse-light.svg" height="32" alt="Meta Muse Code" /></picture></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
-  <a href="https://omp.sh" title="Oh My Pi"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/pi.svg"><img src="assets/harnesses/pi-light.svg" height="32" alt="Oh My Pi" /></picture></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
   <a href="https://docs.warp.dev/reference/cli" title="Warp Agent CLI (Oz)"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/warp.svg"><img src="assets/harnesses/warp-light.svg" height="32" alt="Warp Agent CLI" /></picture></a>
 </p>
@@ -54,7 +53,7 @@ agents setup status                    # readiness for browser, computer, fleet,
 agents run claude "explain this repo"  # run any agent on your existing subscription
 ```
 
-Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` exists only for [team spaces](#sign-in). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
+Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` unlocks the hosted surfaces — [team spaces](#sign-in) and managed, private-by-default sharing (`agents artifacts share` / `agents traces sync` with no Cloudflare setup). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
 
 The command surface teaches setup through `agents setup` and group-level `--help`.
 The durable system model starts at [`cli/docs/README.md`](cli/docs/README.md).
@@ -403,6 +402,31 @@ Sharing a session uses `agents sessions render <id> -o session.md`, not the raw
 
 `agents sessions share <id>` goes one step further and publishes that document as a self-contained web page on your own share endpoint, printing the link. It is **unlisted** unless you pass `--public` — a transcript carries file paths, command output, and error text that a plan does not, so it stays out of your public gallery by default, and emails are masked on top of the render's own redaction. The slug is `session-<shortId>`, so re-sharing one session updates one URL.
 
+### Back up sessions off-box
+
+Signed-in Phoenix users can back sessions up without creating a Cloudflare bucket or
+an `r2.backups` secrets bundle:
+
+```bash
+agents sessions export --since 30d --to-r2
+agents sessions import --from-r2 --dry-run
+agents sessions import --from-r2
+```
+
+The managed path encrypts every transcript body locally with AES-256-GCM before
+upload. Its per-account key is escrowed behind the same Phoenix bearer so another
+signed-in device can restore with zero setup. This protects transcript contents from
+a raw storage-bucket read, but it is not zero-knowledge against Phoenix because
+Phoenix-operated infrastructure stores the recovery key. Use `--byo` with your own
+`r2.backups` bundle and `R2_SYNC_ENC_KEY` when Phoenix must never possess the key:
+
+```bash
+agents sessions export --since 30d --to-r2 --byo
+agents sessions import --from-r2 --byo
+```
+
+Both targets are on-demand backups only; neither enables background session sync.
+
 ### Resume anywhere — and stay resumed
 
 Pick up any past conversation and drop it back into a terminal:
@@ -1090,7 +1114,7 @@ agents browser profiles create cloud \
 
 ## Sign in
 
-Signing in is **optional**. Every local feature — `agents run`, sessions, teams, fleet dispatch, secrets, browser, computer — works with no account. The one thing an account unlocks is **team spaces**, the hosted surface under `agents auth space`. `agents auth` signs this machine in to **Phoenix ID**, the Phoenix Labs account layer behind team spaces. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
+Signing in is **optional**. Every local feature — `agents run`, sessions, teams, fleet dispatch, secrets, browser, computer — works with no account. Signing in unlocks the hosted surfaces: **team spaces** (`agents auth space`) and **managed sharing** — `agents artifacts share` and `agents traces sync` publish to our storage with **zero Cloudflare setup**, and a signed-in `agents artifacts share` is **private by default** (`me`, owner-only) unless you pass `--visibility org`/`public`. `agents auth` signs this machine in to **Phoenix ID**, the Phoenix Labs account layer behind these hosted surfaces. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
 
 ```bash
 agents auth login                        # shows a code, opens a Phoenix-branded page
@@ -1262,8 +1286,13 @@ agents daemon doctor                        # one-shot health check; non-zero ex
 ```
 
 Each hosted responsibility (secrets broker, browser IPC, scheduler, monitors,
-watchdog, device probe, self-heal, keychain reap, account-state refresh,
+watchdog, device probe, self-heal, self-update, keychain reap, account-state refresh,
 state-dir checks) is an independent toggle in `~/.agents/daemon/services.yaml`.
+Self-update checks npm on its own schedule, installs + verifies a newer
+agents-cli with the same primitives `agents upgrade` uses, then exits so the OS
+supervisor relaunches the daemon onto the new code — the daemon used to run
+with auto-update forced off and only picked up new code on a manual
+`agents daemon restart`.
 `agents daemon services list` shows every service; `enable|disable <id>` flips
 one. Missing keys default to enabled, so upgrades are no-ops. Most services take
 effect on the next daemon start; browser IPC is registered even when boot-disabled
@@ -1602,7 +1631,6 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | OpenCode | yes | no | yes | >= 1.1.1 | yes | yes | no | no | `AGENTS.md` | no |
 | Copilot | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Amp | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
-| Kiro | yes | no | yes | >= 2.8.0 | yes | yes | no | >= 1.23.0 | `AGENTS.md` | no |
 | Goose | yes | no | yes | no | no | no | no | no | `AGENTS.md` | no |
 | Roo Code | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Droid | yes | yes | yes | >= 0.57.5 | >= 0.26.0 | yes | yes | yes | `AGENTS.md` | no |
@@ -1623,17 +1651,14 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | Antigravity | -- | yes | -- |
 | Copilot | -- | -- | yes |
 | OpenClaw, Amp, Goose, Roo | -- | -- | -- |
-| Kiro | -- | -- | -- |
 
 ### Version-gated sync
 
 | Capability | Agent | Gate |
 |------------|-------|------|
 | Hooks | Codex | >= 0.116.0 |
-| Subagents | Kiro | >= 1.23.0 |
 | Skills | Droid | >= 0.26.0 |
 | Permissions | Droid | >= 0.57.5 |
-| Permissions | Kiro | >= 2.8.0 |
 | File-based commands | Codex | < 0.117.0 (0.117+ uses command-as-skill) |
 | Plugins | Codex | >= 0.128.0 |
 
@@ -1649,7 +1674,7 @@ Claude Code, Codex CLI, Antigravity, Grok Build, and others each have their own
 
 ### Is it free?
 
-Yes — every feature, with no account and no signup. `agents run`, sessions, teams, fleet dispatch, secrets, browser, and computer automation all work the moment you install. The optional `agents auth login` exists only to unlock hosted team spaces (`agents auth space`); there are no paid tiers. This developer tool is entirely free because we believe developers should have the best tools — fast and robust — so they can create the best products for their users.
+Yes — every feature, with no account and no signup. `agents run`, sessions, teams, fleet dispatch, secrets, browser, and computer automation all work the moment you install. The optional `agents auth login` unlocks the hosted surfaces — team spaces (`agents auth space`) and managed, private-by-default sharing (`agents artifacts share` / `agents traces sync`, no Cloudflare setup); there are no paid tiers. This developer tool is entirely free because we believe developers should have the best tools — fast and robust — so they can create the best products for their users.
 
 ### Is this like `nvm` / `mise` / `asdf` for AI agents?
 

package/dist/bootstrap.js

@@ -328,7 +328,7 @@ async function installResolvedPackage(metadata) {
         // every subsequent upgrade dead-ends there forever. bun does not use
         // npm's retire-path staging scheme, so this only needs to run once, ahead
         // of both package-manager branches below.
-        sweepStaleInstallStaging(packageRoot);
+        await sweepStaleInstallStaging(packageRoot);
         // Upgrade with the package manager that owns this install. A bun global
         // install lives at <bunGlobalDir>/node_modules/... (no `lib` segment), so an
         // `npm install --prefix` would write to <bunGlobalDir>/lib/node_modules and
@@ -349,8 +349,8 @@ async function installResolvedPackage(metadata) {
             /* leave it for the OS temp sweep */
         }
     }
-    verifyInstalledVersion(packageRoot, metadata.version);
-    refreshAliasShims(packageRoot);
+    await verifyInstalledVersion(packageRoot, metadata.version);
+    await refreshAliasShims(packageRoot);
     // PHNX-2768: the npm install above can leave the package at the new version
     // but the global bin links GONE — the state that stranded zion (package at
     // 1.22.40, `/opt/homebrew/bin/{agents,ag,browser,computer}` missing, every
@@ -361,7 +361,7 @@ async function installResolvedPackage(metadata) {
     // own bin shims and are out of scope.
     if (detectPackageManager(packageRoot) !== 'bun' && process.platform !== 'win32') {
         const prefix = deriveGlobalPrefix(packageRoot);
-        const repairs = ensureGlobalBinLinks(packageRoot, prefix);
+        const repairs = await ensureGlobalBinLinks(packageRoot, prefix);
         const repaired = repairs.filter((r) => r.action === 'repaired');
         const failed = repairs.filter((r) => r.action === 'failed');
         if (repaired.length > 0) {

package/dist/commands/accounts.js

@@ -336,7 +336,10 @@ export async function listSwitchableAccounts(agent) {
  */
 export function setDefaultAccount(agentRaw, name) {
     const agent = parseHarness(agentRaw);
-    const account = findUnifiedAccount(name, readMeta());
+    // Scope to the harness this default is FOR: a bare identity (`<email>`) matches
+    // every harness that identity is signed into, so an un-scoped lookup resolved
+    // the wrong row and then rejected it as "is a <other> login" just below.
+    const account = findUnifiedAccount(name, readMeta(), undefined, agent);
     if (!account)
         throw new Error(`Unknown account '${name}'.`);
     if (account.kind === 'provider') {
@@ -519,14 +522,19 @@ agents run codex#work`,
         .action(async (name, target, _o, command) => {
         await runAccountsAction(command, async () => {
             const meta = readMeta();
-            const account = findUnifiedAccount(name, meta);
+            // Validate the target exists before mutating any binding — and resolve it
+            // FIRST so the account lookup can be scoped to the harness being attached
+            // to. `identityLabel` defaults to the login's email, so a bare identity
+            // (`muqsitnawaz@gmail.com`) matches every harness that identity is signed
+            // into; un-scoped this resolved whichever row the store ordered first and
+            // then rejected it below as "is a <other> login".
+            const t = classifyAttachTarget(target);
+            const targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
+            const account = findUnifiedAccount(name, meta, undefined, targetAgent);
             if (!account)
                 throw new Error(`Unknown account '${name}'.`);
             if (account.kind === 'native')
                 assertNativeAccountNameable(account.agent);
-            // Validate the target exists before mutating any binding.
-            const t = classifyAttachTarget(target);
-            const targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
             if (account.kind === 'native') {
                 // A provider-backed profile injects provider env at spawn, which would run
                 // under a different credential than the native identity claims — refuse it.
@@ -572,7 +580,7 @@ agents run codex#work`,
                 // Provider account: it must be able to authenticate the target's harness.
                 getAccountProvider(account.provider).envFor(targetAgent, account.auth);
             }
-            bindAccount(name, target);
+            bindAccount(name, target, targetAgent);
             writeClaudeInteractiveOauthToken(t, targetAgent, account.kind === 'native' && account.agent === 'claude' ? account.identityLabel : undefined);
             console.log(chalk.green(`Attached ${account.name} to ${target}.`));
         });
@@ -581,7 +589,15 @@ agents run codex#work`,
         .description('Remove one account attachment')
         .action(async (name, target, _o, command) => {
         await runAccountsAction(command, () => {
-            unbindAccount(name, target);
+            // Classify the target first so the unbind is scoped to the right harness
+            // for a colliding identity selector (same as the attach path).
+            let targetAgent;
+            try {
+                const t = classifyAttachTarget(target);
+                targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
+            }
+            catch { /* an unresolvable target still unbinds by whatever row matches */ }
+            unbindAccount(name, target, targetAgent);
             // With the binding gone, no setup-token resolves for this version home, so this
             // clears any .oauth_token the attach left behind (else interactive runs would keep
             // authenticating as the just-detached account).

package/dist/commands/exec.js

@@ -2244,7 +2244,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             const { pickSessionInteractive } = await import('./sessions.js');
             const { buildContinuePrompt } = await import('../lib/loop.js');
             // Freshen the index for this agent before any lookup (incremental, cached).
-            // AgentId is wider than SessionAgentId (amp/kiro/goose/copilot keep no transcripts);
+            // AgentId is wider than SessionAgentId (amp/goose/copilot keep no transcripts);
             // those simply yield no matches and fall through to the not-found error.
             const sessionAgent = agent;
             if (!resolvedResumeSource)
@@ -2723,7 +2723,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             process.exit(1);
         }
         // Default CLI mode is the generic 'plan'. Agents without a read-only
-        // mode (antigravity, kiro, …) degrade via resolveMode to their
+        // mode (antigravity, …) degrade via resolveMode to their
         // safest native mode (modes[0], typically edit). That covers both the
         // implicit default and an explicit `--mode plan`, so multi-agent
         // scripts can pass a uniform plan flag without per-agent branching.

package/dist/commands/import.js

@@ -56,7 +56,7 @@ async function runImport(agentArg, opts) {
     if (!opts.isolated) {
         assertIsolationBoundary(agentId, 'adopt your existing install');
     }
-    // installScript-based agents (Grok, Antigravity, Cursor, Kiro, Goose, Roo)
+    // installScript-based agents (Grok, Antigravity, Cursor, Goose, Roo)
     // don't have an npm package; their binary lives wherever the curl/brew
     // installer dropped it. We adopt by symlinking that PATH binary directly
     // into the version's `node_modules/.bin/`. No package.json walk.
@@ -345,7 +345,7 @@ When to use:
   pointing at the existing install — nothing is copied or moved (except the
   agent's config dir, which is moved into the version's home). Works for both
   npm-style packages (claude, codex, opencode, openclaw) and
-  installScript-based agents (grok, antigravity, cursor, kiro, goose).
+  installScript-based agents (grok, antigravity, cursor, goose).
 `)
         .action((...args) => withIsolationBoundary(() => runImport(...args)));
 }

package/dist/commands/models.js

@@ -18,13 +18,13 @@ import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/widt
 import { wrapJoined } from './inspect.js';
 import { setHelpSections } from '../lib/help.js';
 import { formatRunDefaultEntry, listRunDefaults, parseRunDefaultSelector, setRunDefault, } from '../lib/run-defaults.js';
-const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi', 'grok', 'droid', 'pi'];
+const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi', 'grok', 'droid'];
 /**
  * Agents that don't necessarily install under ~/.agents/versions (cursor ships
  * via a curl script). For these, fall back to the PATH binary and synthesize
  * a version label from the install path so cache keys stay stable.
  */
-const PATH_ONLY_AGENTS = new Set(['cursor', 'pi']);
+const PATH_ONLY_AGENTS = new Set(['cursor']);
 /** Derive a version label from the PATH-installed binary location for agents without managed versions. */
 function fallbackPathVersion(agent) {
     const src = locateModelSource(agent, 'unresolved');

package/dist/commands/permissions.js

@@ -377,8 +377,8 @@ Examples:
             //
             // This used to hardcode `.json`/`.jsonc`/`.toml` plus a `.claude`/
             // `.opencode`/`.codex` substring, which excluded the ten other harnesses
-            // the CLI writes -- and excluded kiro/hermes twice over, since
-            // their configs are YAML. The registry already answers this by matching
+            // the CLI writes -- and excluded hermes twice over, since
+            // its config is YAML. The registry already answers this by matching
             // each harness's own declared path, so ask it (RUSH-2676).
             const isAgentConfig = detectPermissionAgentFromPath(localPath) !== null;
             if (isAgentConfig) {

package/dist/commands/repo.js

@@ -60,7 +60,7 @@ function syncMarketplacesForDefaults() {
 /** Write this device's account metadata before the user repo is committed. */
 async function publishUserRepoAccountState(provisionAuth) {
     const { publishUsageSnapshotToSharedStore } = await import('../lib/accounting/usage-sync.js');
-    const usage = publishUsageSnapshotToSharedStore();
+    const usage = await publishUsageSnapshotToSharedStore();
     if (usage.error)
         console.error(chalk.yellow(`Usage snapshot: ${usage.error}`));
     if (provisionAuth) {
@@ -73,7 +73,7 @@ async function publishUserRepoAccountState(provisionAuth) {
         return;
     }
     const { publishReservedAuthVerdict } = await import('../lib/secrets/reserved-sync.js');
-    const auth = publishReservedAuthVerdict();
+    const auth = await publishReservedAuthVerdict();
     if (auth.error)
         console.error(chalk.yellow(`Auth verdict: ${auth.device}: ${auth.error}`));
 }

package/dist/commands/rules.js

@@ -52,7 +52,7 @@ Project rules & @-imports:
   @path imports inside AGENTS.md/CLAUDE.md are resolved at session start by the agent
   itself, not by agents-cli. Support is per-agent:
     Inlined natively:  claude
-    Literal text:      codex, cursor, opencode, copilot, amp, kiro, goose
+    Literal text:      codex, cursor, opencode, copilot, amp, goose
 
   For rules that need to work across all agents, inline the content rather than using
   @-imports — the second group will load '@path/to/file.md' as a literal string.

package/dist/commands/send.js

@@ -3,7 +3,7 @@ import { die } from '../lib/format.js';
 import { setHelpSections } from '../lib/help.js';
 import { readMeta } from '../lib/state.js';
 import { sendMessage, isOwnerAlias } from '../lib/channels/send.js';
-import { composeOwnerMessage } from '../lib/owner-message.js';
+import { ownerMessageComposer } from '../lib/owner-message.js';
 import { fireTraceSyncInBackground } from '../lib/run-trace-sync.js';
 function mergeAttachments(opts) {
     const list = [...(opts.attach ?? []), ...(opts.attachment ?? [])];
@@ -30,6 +30,7 @@ async function runSend(positionalText, opts, ownerMode) {
     // the SAME composer as an important `feed post` (PHNX-3698): short-shaped body,
     // TEAM-N keys linkified, session crumb as a tappable console URL — instead of a
     // raw dump. A non-owner send (explicit --channel/--to) is delivered verbatim.
+    let ownerCompose;
     if (ownerMode || isOwnerAlias(opts.to)) {
         const flagged = opts.text?.trim() ?? '';
         const positional = (positionalText ?? '').trim();
@@ -38,7 +39,12 @@ async function runSend(positionalText, opts, ownerMode) {
         // loud with the "pass the message once" error rather than composing a guess.
         const bothDiffer = flagged !== '' && positional !== '' && flagged !== positional;
         if (raw && !bothDiffer) {
-            input = { ...input, text: composeOwnerMessage(raw), positionalText: undefined };
+            // Resolve the context once, then let each owner destination render its own
+            // format: the envelope carries the plain default (for --json and dry-run
+            // display), while ownerCompose hands sendToOwner the mrkdwn variant for a
+            // Slack owner destination and plain for iMessage (PHNX-3698).
+            ownerCompose = ownerMessageComposer(raw);
+            input = { ...input, text: ownerCompose('plain'), positionalText: undefined };
             // The console URL in the composed body only resolves once this session's
             // trace shard is uploaded; fire that now so the tapped link isn't a 404.
             // A --dry-run resolves + composes but MUST NOT act (its documented contract),
@@ -46,7 +52,7 @@ async function runSend(positionalText, opts, ownerMode) {
             fireTraceSyncInBackground({ disabled: Boolean(opts.dryRun) });
         }
     }
-    const out = await sendMessage(input, meta);
+    const out = await sendMessage(input, meta, ownerCompose);
     if ('error' in out) {
         die(out.error);
     }

package/dist/commands/sessions-export.d.ts

@@ -1,5 +1,6 @@
 import type { Command } from 'commander';
 import type { SessionMeta } from '../lib/session/types.js';
+import { type SessionsBackupClient } from '../lib/session/sync/net-client.js';
 import { type BundleHeader, type BundleRecord } from '../lib/session/bundle.js';
 export declare function registerSessionsExportCommand(sessionsCmd: Command): void;
 interface GlobalSelection {
@@ -10,6 +11,7 @@ interface GlobalSelection {
     redact?: boolean;
     encrypt?: boolean;
     toR2?: boolean;
+    byo?: boolean;
     output?: string;
     stdout?: boolean;
     host?: string[];
@@ -36,7 +38,9 @@ interface GlobalSelection {
  * its test drive the exact same decision.
  */
 export declare function r2ExportGateError(g: Pick<GlobalSelection, 'toR2' | 'host'>, isConfigured: boolean): string | null;
-export declare function uploadToR2(header: BundleHeader, records: BundleRecord[]): Promise<void>;
+export declare function uploadToR2(header: BundleHeader, records: BundleRecord[], resolvedClient?: SessionsBackupClient): Promise<void>;
+/** Fail-closed guard at the managed transport boundary, not only at record construction. */
+export declare function managedUploadEncryptionError(header: BundleHeader, records: BundleRecord[]): string | null;
 /** R2 object key for one record — dir-shaped agents key by relKey, file-shaped by session. */
 export declare function r2KeyForRecord(rec: BundleRecord): string;
 /**