@phnx-labs/agents-cli 1.22.69 → 1.22.71

package/dist/lib/agent-spec/agents.js

@@ -2,7 +2,7 @@
  * Core agent configuration and detection module.
  *
  * Defines the canonical registry of current and legacy AI coding agents (Claude,
- * Codex, Gemini, Cursor, OpenCode, OpenClaw, Copilot, Amp, Kiro, Goose, Grok)
+ * Codex, Gemini, Cursor, OpenCode, OpenClaw, Copilot, Amp, Goose, Grok)
  * with their CLI commands, config paths, capability flags, and MCP integration
  * points.
  *
@@ -413,52 +413,6 @@ export const AGENTS = {
         supportsHooks: true,
         capabilities: { hooks: { since: '0.3.130' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: { since: '1.1.1' }, skills: true, commands: true, plugins: true, subagents: true, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit'], interactiveRepl: true },
     },
-    // Oh My Pi (`omp`, omp.sh) — a Bun-based, terminal-first coding agent that runs
-    // against many model providers (OpenRouter, OpenAI, Anthropic, xAI, DeepSeek,
-    // Ollama, LM Studio, …). It is Claude-compatible: it natively discovers
-    // `.claude/commands`, `.mcp.json`, and Claude-shaped subagents, and keeps its
-    // own native resources under `~/.omp/agent/` (config dir reported by
-    // `omp config path`). configDir points AT the agent dir (not `~/.omp`) so the
-    // rules file lands at `~/.omp/agent/AGENTS.md`, the user context file omp reads.
-    pi: {
-        id: 'pi',
-        name: 'Pi',
-        sessionDir: null,
-        sessionFileExt: null,
-        versionStdoutMatch: 'semver',
-        unmanagedBinary: 'path',
-        mcpRegister: 'cli',
-        mcpAddHttp: 'transport',
-        mcpAddStdio: 'simple',
-        mcpConfigWrite: 'json-mcpServers',
-        color: 'magenta',
-        cliCommand: 'omp',
-        npmPackage: '@oh-my-pi/pi-coding-agent',
-        configDir: path.join(HOME, '.omp', 'agent'),
-        commandsDir: path.join(HOME, '.omp', 'agent', 'commands'),
-        commandsSubdir: 'commands',
-        skillsDir: path.join(HOME, '.omp', 'agent', 'skills'),
-        hooksDir: 'hooks',
-        instructionsFile: 'AGENTS.md',
-        format: 'markdown',
-        variableSyntax: '$ARGUMENTS',
-        // omp hooks are per-tool JS/TS extension modules discovered from
-        // `~/.omp/agent/hooks/{pre,post}/<tool>.<ext>` (loaded as HookFactory code),
-        // NOT the event->shell-command registrations agents-cli's hook sync writes.
-        // The two models don't map, so hooks stay off (capabilities.hooks:false).
-        supportsHooks: false,
-        // MCP: omp reads `.mcp.json` with the Claude `{ "mcpServers": {...} }` schema
-        // at user scope (`~/.omp/agent/.mcp.json`) and project scope (`<root>/.mcp.json`),
-        // stdio + http + sse with headers. skills (`~/.omp/agent/skills/<name>/SKILL.md`),
-        // commands (`~/.omp/agent/commands/*.md`), and subagents (`~/.omp/agent/agents/*.md`,
-        // Claude-shaped) are all native. allowlist is OFF: omp gates approval per-TOOL
-        // only (`tools.approval` record: allow|prompt|deny) with no command/path/domain
-        // patterns, so agents-cli's granular permission format has nothing to map to.
-        // plugins are npm packages / TS modules, not the Claude marketplace manifest.
-        // interactiveRepl: true — bare `omp` runs the TUI; `omp -p` is the one-shot
-        // form that answers a prompt and exits (upstream README, "Four entry points").
-        capabilities: { hooks: false, mcp: true, mcpHttp: true, mcpHeaders: true, allowlist: false, skills: true, commands: true, plugins: false, subagents: true, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], interactiveRepl: true },
-    },
     openclaw: {
         id: 'openclaw',
         name: 'OpenClaw',
@@ -560,39 +514,6 @@ export const AGENTS = {
         // interactiveRepl: false — amp requires a prompt; bare invocation exits immediately.
         capabilities: { hooks: false, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: false, skills: true, commands: true, plugins: false, subagents: false, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit'], interactiveRepl: false },
     },
-    kiro: {
-        id: 'kiro',
-        name: 'Kiro',
-        sessionDir: null,
-        sessionFileExt: null,
-        versionStdoutMatch: 'semver',
-        unmanagedBinary: 'path',
-        mcpRegister: 'cli',
-        mcpAddHttp: 'transport',
-        mcpAddStdio: 'simple',
-        mcpConfigWrite: 'json-mcpServers',
-        color: 'greenBright',
-        cliCommand: 'kiro-cli',
-        npmPackage: '',
-        installScript: 'brew install --cask kiro-cli',
-        configDir: path.join(HOME, '.kiro'),
-        commandsDir: path.join(HOME, '.kiro', 'commands'),
-        commandsSubdir: 'commands',
-        skillsDir: path.join(HOME, '.kiro', 'skills'),
-        // Hooks: v3 standalone files under ~/.kiro/hooks/*.json
-        // (`{ "version": "v1", "hooks": [...] }`). Fixed PreToolUse/PostToolUse
-        // firing in kiro-cli 0.10; fully stable by 2.6.1. Launch always passes
-        // --v3 (see AGENT_COMMANDS.kiro) so the standalone files actually load.
-        // See registerHooksForKiro.
-        hooksDir: 'hooks',
-        instructionsFile: 'AGENTS.md',
-        format: 'markdown',
-        variableSyntax: '$ARGUMENTS',
-        supportsHooks: true,
-        // interactiveRepl: false — kiro-cli requires a prompt for coding sessions; bare
-        // invocation does not open a persistent REPL.
-        capabilities: { hooks: { since: '0.10.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: { since: '2.8.0' }, skills: true, commands: true, plugins: false, subagents: { since: '1.23.0' }, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit'], interactiveRepl: false },
-    },
     goose: {
         id: 'goose',
         name: 'Goose',
@@ -1117,7 +1038,7 @@ export const MANAGED_AGENT_IDS = ALL_AGENT_IDS.filter((id) => !AGENTS[id].deprec
  * `curl … | sh` / `brew install` script that carries NO version token — the
  * installer can only ever fetch the *current* release, and the binary then keeps
  * itself up to date in place (droid, grok, antigravity, cursor, hermes,
- * kiro, goose). There is no semver to pin, so agents-cli must not model these as
+ * goose). There is no semver to pin, so agents-cli must not model these as
  * having multiple installable version-homes the way it does for npm-packaged
  * agents (claude, codex, kimi, …).
  *
@@ -3029,8 +2950,6 @@ export const AGENT_NAME_ALIASES = {
     gh: 'copilot',
     amp: 'amp',
     sourcegraph: 'amp',
-    kiro: 'kiro',
-    'kiro-cli': 'kiro',
     goose: 'goose',
     'block-goose': 'goose',
     antigravity: 'antigravity',

package/dist/lib/browser/ipc.d.ts

@@ -3,6 +3,16 @@ import { BrowserService } from './service.js';
 import type { IPCRequest, IPCResponse } from './types.js';
 export interface IPCRequestOptions {
     autoStartDaemon?: boolean;
+    /**
+     * Opt-in client-side deadline in ms — most IPC actions (browser automation,
+     * long-running recordings) have no fixed budget and must NOT get one by
+     * default. Set explicitly for a request that genuinely has one, e.g.
+     * `request-self-update`, whose handler answers immediately (it kicks the
+     * install off in the background — see `triggerSelfUpdateInBackground`), so its
+     * client deadline (`DAEMON_SELF_UPDATE_TRIGGER_TIMEOUT_MS`) is a short
+     * "did the daemon accept the trigger?" bound, not a wait on the install.
+     */
+    timeoutMs?: number;
 }
 export declare class BrowserServiceNotRunningError extends Error {
     constructor();
@@ -148,6 +158,23 @@ export declare class BrowserIPCServer {
  * owns the shared process.
  */
 export declare function shouldRecommendDaemonRefresh(daemonVersion: string | undefined, clientVersion: string): boolean;
+/**
+ * Reconcile the running daemon's version with ours without evicting it. If the
+ * daemon is serving stale code, ask the daemon to run its OWN self-update path
+ * (`request-self-update`, same fail-closed check/install/verify/exit
+ * SelfUpdateService's periodic tick runs, self-update-service.ts) rather than
+ * telling a human to run `agents daemon restart` by hand. A browser client
+ * still owns neither the shared supervisor nor its sibling services, so
+ * version skew can never be permission for THIS client to stop or restart
+ * that process directly (PHNX-3605 holds) — it only asks the daemon to run a
+ * path the daemon already runs on its own schedule, which only exits once the
+ * daemon itself has verified the new version is good. If self-update declines
+ * (dev build, shadowed install, already current, or a real failure) this
+ * degrades to the same "nothing changed" outcome PHNX-3605 shipped.
+ */
+export declare function reconcileDaemonVersion(): Promise<void>;
+/** Test-only: `reconcileDaemonVersion` runs at most once per real process — this clears that latch so a test file can drive more than one branch. */
+export declare function resetVersionReconciliationForTest(): void;
 export declare function sendIPCRequest(request: IPCRequest, opts?: IPCRequestOptions): Promise<IPCResponse>;
 /**
  * Fill actor / launchId / sessionId from the calling process when the request
@@ -160,3 +187,10 @@ export declare function stampCallerIdentity(request: IPCRequest, env?: NodeJS.Pr
  * only the client process and IPC socket lifetime differ.
  */
 export declare function connectBrowserIPC(opts?: IPCRequestOptions): Promise<BrowserIPCConnection>;
+/**
+ * Exported (rather than kept module-private) so `ipc.test.ts` can drive the
+ * `opts.timeoutMs` client-side deadline directly against a raw `net.Server`
+ * test double that never responds — the hermetic way to prove the timeout
+ * actually fires without needing a slow real IPC action to provoke it.
+ */
+export declare function sendRawIPCRequest(request: IPCRequest, opts?: IPCRequestOptions): Promise<IPCResponse>;

package/dist/lib/browser/ipc.js

@@ -7,6 +7,8 @@ import { resolveBrowserTaskIdleMs } from '../device-config.js';
 import { getDaemonLogPath, isDaemonRunning, signalDaemonReload, startDaemon, } from '../daemon/daemon.js';
 import { getCliVersion } from '../version.js';
 import { compareVersions } from '../agent-spec/primitives.js';
+import { scheduleSelfUpdateExit, selfUpdateSyncDeclineReason, triggerSelfUpdateInBackground } from '../daemon/self-update-service.js';
+import { log as daemonLog } from '../daemon/daemon.js';
 import { isDaemonServiceEnabled, queueDaemonServiceRestart, setDaemonServiceEnabled, } from '../daemon-services.js';
 import { isFleetRemoteInvocation } from './remote-control.js';
 import { resolveCallerIdentity } from './caller-identity.js';
@@ -82,6 +84,17 @@ function isSameSocket(socketPath, expected) {
  * coming near the grace window.
  */
 const IPC_CLOSE_TIMEOUT_MS = 1_500;
+/**
+ * Client-side ceiling on the on-demand `request-self-update` call inside
+ * {@link reconcileDaemonVersion}. The daemon handler is DECOUPLED from the
+ * install — it kicks the self-update off in the background and answers
+ * immediately — so this only needs to be long enough to confirm the daemon
+ * ACCEPTED the trigger, never long enough to wait out a check/install/verify.
+ * It must stay short because a version-skewed browser verb routes through this
+ * reconcile on its way to the real request; a wedged or gone daemon degrades to
+ * the advisory PHNX-3605 shipped rather than stalling the verb.
+ */
+const DAEMON_SELF_UPDATE_TRIGGER_TIMEOUT_MS = 5_000;
 /**
  * How long {@link waitForBrowserService} waits for the browser service to come up before
  * failing loud (PHNX-3289).
@@ -655,6 +668,44 @@ export class BrowserIPCServer {
             case 'version': {
                 return { ok: true, version: getCliVersion() };
             }
+            // On-demand self-update, triggered by a client that noticed version
+            // skew (reconcileDaemonVersion below). DECOUPLED from the install
+            // (PHNX-3605): this handler MUST NOT await the check→download→install→
+            // verify, because it sits on the path of EVERY version-skewed
+            // `agents browser <verb>` (reconcileDaemonVersion → prepareIPC → here), so
+            // awaiting the whole thing would synchronously stall an ordinary browser
+            // verb for tens of seconds — worst case ~15 min — behind daemon
+            // housekeeping, exactly the client-stall PHNX-3605 exists to prevent.
+            // Instead: kick the self-update off in the BACKGROUND (bounded, and
+            // sharing the module-level in-flight guard so two triggers can't race a
+            // second install) and respond IMMEDIATELY that it was accepted. The daemon
+            // does install→verify→exit(0) on its own; the OS supervisor relaunches it
+            // and the browser reconnects. scheduleSelfUpdateExit (fired from the
+            // background continuation on a verified update) still delays the exit so
+            // this response has flushed to the socket first, and serializes against
+            // the periodic tick's own exit.
+            case 'request-self-update': {
+                // Instant, network-free decline gate FIRST (dev build / shadowed
+                // install), so a version-skewed browser client gets the PHNX-3605
+                // "nothing changed, not evicting" advisory immediately rather than a
+                // "triggered" it would never act on — reconcileDaemonVersion keys the
+                // advisory on !selfUpdateTriggered. Only a genuinely-eligible install is
+                // backgrounded below; the slow registry/download/install/verify never
+                // runs on this response path.
+                const declineReason = selfUpdateSyncDeclineReason();
+                if (declineReason) {
+                    return { ok: true, selfUpdateTriggered: false, reason: declineReason };
+                }
+                void triggerSelfUpdateInBackground({ log: daemonLog })
+                    .then((outcome) => {
+                    if (outcome.updated)
+                        scheduleSelfUpdateExit();
+                })
+                    .catch((err) => {
+                    daemonLog('ERROR', `self-update: background trigger failed: ${err instanceof Error ? err.message : String(err)}`);
+                });
+                return { ok: true, selfUpdateTriggered: true };
+            }
             case 'show': {
                 // Task-less by design — see BrowserService.showUrl. Absent from both
                 // PAGE_CREATE_VERBS and PAGE_RESOLVE_VERBS, so bindTask never ran above
@@ -707,7 +758,7 @@ export class BrowserIPCServer {
                 // this box's own configured default (or 30 minutes when unset).
                 const idleMs = request.idleMinutes !== undefined
                     ? (request.idleMinutes === 0 ? null : request.idleMinutes * 60_000)
-                    : resolveBrowserTaskIdleMs();
+                    : await resolveBrowserTaskIdleMs();
                 const reaped = await this.service.reapAbandoned({ idleMs, dryRun: request.dryRun });
                 return { ok: true, reaped };
             }
@@ -736,7 +787,15 @@ export class BrowserIPCServer {
                     };
                 }
                 if (request.profile) {
-                    await this.service.stopProfile(request.profile);
+                    try {
+                        await this.service.stopProfile(request.profile, {
+                            fleetRemote: request.fleetRemote,
+                            actor: request.actor,
+                        });
+                    }
+                    catch (err) {
+                        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+                    }
                     return { ok: true };
                 }
                 return {
@@ -1069,12 +1128,19 @@ export function shouldRecommendDaemonRefresh(daemonVersion, clientVersion) {
 }
 /**
  * Reconcile the running daemon's version with ours without evicting it. If the
- * daemon is serving stale code, surface the deliberate operator command once
- * and continue on the already-running service. A browser client owns neither
- * the shared supervisor nor its sibling services, so version skew can never be
- * permission to stop or restart that process (PHNX-3605).
+ * daemon is serving stale code, ask the daemon to run its OWN self-update path
+ * (`request-self-update`, same fail-closed check/install/verify/exit
+ * SelfUpdateService's periodic tick runs, self-update-service.ts) rather than
+ * telling a human to run `agents daemon restart` by hand. A browser client
+ * still owns neither the shared supervisor nor its sibling services, so
+ * version skew can never be permission for THIS client to stop or restart
+ * that process directly (PHNX-3605 holds) — it only asks the daemon to run a
+ * path the daemon already runs on its own schedule, which only exits once the
+ * daemon itself has verified the new version is good. If self-update declines
+ * (dev build, shadowed install, already current, or a real failure) this
+ * degrades to the same "nothing changed" outcome PHNX-3605 shipped.
  */
-async function reconcileDaemonVersion() {
+export async function reconcileDaemonVersion() {
     if (versionReconciledThisProcess)
         return;
     versionReconciledThisProcess = true;
@@ -1091,8 +1157,41 @@ async function reconcileDaemonVersion() {
     if (!shouldRecommendDaemonRefresh(daemon, client))
         return;
     process.stderr.write(`\nBrowser service is running on shared daemon ${daemon}, while this CLI is ${client}. `
-        + 'Continuing without evicting the daemon or its other services.\n'
-        + 'To load current daemon code when it is safe to interrupt every hosted service: agents daemon restart\n\n');
+        + 'Asking the daemon to self-update in the background (verify-then-exit; the OS supervisor relaunches it onto the new code)...\n');
+    try {
+        // SHORT timeout — the handler is decoupled from the install now (it kicks
+        // the self-update off in the background and answers at once), so this only
+        // waits for the daemon to CONFIRM it accepted the trigger, not for the
+        // install to finish. It must stay short so the real browser verb that
+        // triggered this reconcile proceeds promptly; a wedged/gone daemon degrades
+        // to the same advisory PHNX-3605 shipped.
+        const resp = await sendRawIPCRequest({ action: 'request-self-update' }, { autoStartDaemon: false, timeoutMs: DAEMON_SELF_UPDATE_TRIGGER_TIMEOUT_MS });
+        if (resp.selfUpdateTriggered) {
+            process.stderr.write('Daemon self-update requested — it verifies a newer version in the background and restarts if one is available. '
+                + 'Continuing without waiting.\n\n');
+        }
+        else {
+            // Two shapes reach here: a CURRENT daemon that ran the instant decline
+            // gate (dev build / shadowed install) and answered {selfUpdateTriggered:
+            // false, reason}, and an OLDER daemon that predates the field entirely and
+            // answered without it (no reason). Both degrade to the same non-evicting
+            // advisory PHNX-3605 shipped; only the lead sentence differs.
+            const declineDetail = resp.reason
+                ? `Daemon self-update declined (${resp.reason}). `
+                : 'Daemon did not accept the self-update request. ';
+            process.stderr.write(declineDetail
+                + 'Continuing without evicting the daemon or its other services. '
+                + 'To load current daemon code when it is safe to interrupt every hosted service: agents daemon restart\n\n');
+        }
+    }
+    catch (err) {
+        process.stderr.write(`Could not reach the daemon to request a self-update (${err instanceof Error ? err.message : String(err)}). `
+            + 'To load current daemon code when it is safe to interrupt every hosted service: agents daemon restart\n\n');
+    }
+}
+/** Test-only: `reconcileDaemonVersion` runs at most once per real process — this clears that latch so a test file can drive more than one branch. */
+export function resetVersionReconciliationForTest() {
+    versionReconciledThisProcess = false;
 }
 export async function sendIPCRequest(request, opts = {}) {
     // Stamp caller identity ONCE here so the 28+ call sites don't each have to.
@@ -1147,13 +1246,37 @@ export async function connectBrowserIPC(opts = {}) {
         });
     });
 }
-async function sendRawIPCRequest(request, opts = {}) {
+/**
+ * Exported (rather than kept module-private) so `ipc.test.ts` can drive the
+ * `opts.timeoutMs` client-side deadline directly against a raw `net.Server`
+ * test double that never responds — the hermetic way to prove the timeout
+ * actually fires without needing a slow real IPC action to provoke it.
+ */
+export async function sendRawIPCRequest(request, opts = {}) {
     const endpoint = getIpcEndpoint();
     const autoStartDaemon = opts.autoStartDaemon ?? true;
     await prepareIPC(request.action, opts);
     return new Promise((resolve, reject) => {
         const socket = net.createConnection(endpoint);
         let buffer = '';
+        let settled = false;
+        let deadline;
+        const settle = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            if (deadline)
+                clearTimeout(deadline);
+            fn();
+        };
+        if (opts.timeoutMs) {
+            deadline = setTimeout(() => {
+                settle(() => {
+                    socket.destroy();
+                    reject(new Error(`IPC request '${request.action}' timed out after ${opts.timeoutMs}ms`));
+                });
+            }, opts.timeoutMs);
+        }
         socket.on('connect', () => {
             socket.write(JSON.stringify(request) + '\n');
         });
@@ -1162,21 +1285,27 @@ async function sendRawIPCRequest(request, opts = {}) {
             const idx = buffer.indexOf('\n');
             if (idx !== -1) {
                 const response = JSON.parse(buffer.slice(0, idx));
-                socket.end();
-                resolve(response);
+                settle(() => {
+                    socket.end();
+                    resolve(response);
+                });
             }
         });
         socket.on('error', (err) => {
-            if (!autoStartDaemon && (err.code === 'ENOENT' || err.code === 'ECONNREFUSED')) {
-                reject(new BrowserServiceNotRunningError());
-                return;
-            }
-            reject(new Error(`IPC error: ${err.message}`));
+            settle(() => {
+                if (!autoStartDaemon && (err.code === 'ENOENT' || err.code === 'ECONNREFUSED')) {
+                    reject(new BrowserServiceNotRunningError());
+                    return;
+                }
+                reject(new Error(`IPC error: ${err.message}`));
+            });
         });
         socket.on('close', () => {
-            if (!buffer.includes('\n')) {
-                reject(new Error('Connection closed before response'));
-            }
+            settle(() => {
+                if (!buffer.includes('\n')) {
+                    reject(new Error('Connection closed before response'));
+                }
+            });
         });
     });
 }

package/dist/lib/browser/remote-control.d.ts

@@ -16,12 +16,15 @@
  * The authoritative gate is {@link assertRemoteControlAllowedForRequest}, called
  * inside the browser daemon at the top of `resolveOrCreateTask` — the one
  * chokepoint every task-scoped verb resolves through — plus `BrowserService.start`
- * for the task-less `browser start` command. It has to live there because ~18
+ * for the task-less `browser start` command and `BrowserService.stopProfile` for
+ * the task-less `browser stop --profile` command. It has to live there because ~18
  * page verbs (`navigate`, `click`, `screenshot`, `tab-add`, …) launch OR attach
  * to a browser implicitly, and gating only the `browser start` command left every
  * one of them ungated; gating only the create branch of `resolveOrCreateTask` left
- * the attach paths ungated (RUSH-3064). {@link assertRemoteControlAllowed} remains
- * as a fast-fail CLI-side check so a refused `start` never auto-creates a profile.
+ * the attach paths ungated (RUSH-3064); `stop --profile` is handled by `bindTask`'s
+ * early return before `resolveOrCreateTask` ever runs, so it needed its own gate
+ * call too (PHNX-3317). {@link assertRemoteControlAllowed} remains as a fast-fail
+ * CLI-side check so a refused `start` never auto-creates a profile.
  */
 /** Env marker set on every remote `agents` invocation by `buildRemoteAgentsInvocation` and `markFleetRemote`. */
 export declare const FLEET_REMOTE_ENV = "AGENTS_FLEET_REMOTE";

package/dist/lib/browser/remote-control.js

@@ -16,12 +16,15 @@
  * The authoritative gate is {@link assertRemoteControlAllowedForRequest}, called
  * inside the browser daemon at the top of `resolveOrCreateTask` — the one
  * chokepoint every task-scoped verb resolves through — plus `BrowserService.start`
- * for the task-less `browser start` command. It has to live there because ~18
+ * for the task-less `browser start` command and `BrowserService.stopProfile` for
+ * the task-less `browser stop --profile` command. It has to live there because ~18
  * page verbs (`navigate`, `click`, `screenshot`, `tab-add`, …) launch OR attach
  * to a browser implicitly, and gating only the `browser start` command left every
  * one of them ungated; gating only the create branch of `resolveOrCreateTask` left
- * the attach paths ungated (RUSH-3064). {@link assertRemoteControlAllowed} remains
- * as a fast-fail CLI-side check so a refused `start` never auto-creates a profile.
+ * the attach paths ungated (RUSH-3064); `stop --profile` is handled by `bindTask`'s
+ * early return before `resolveOrCreateTask` ever runs, so it needed its own gate
+ * call too (PHNX-3317). {@link assertRemoteControlAllowed} remains as a fast-fail
+ * CLI-side check so a refused `start` never auto-creates a profile.
  */
 import { getConfigValue } from '../device-config.js';
 /** Env marker set on every remote `agents` invocation by `buildRemoteAgentsInvocation` and `markFleetRemote`. */

package/dist/lib/browser/service.d.ts

@@ -263,7 +263,10 @@ export declare class BrowserService {
         ok: boolean;
         profile?: string;
     }>;
-    stopProfile(profileRef: ProfileName | ConnectionKey): Promise<void>;
+    stopProfile(profileRef: ProfileName | ConnectionKey, opts?: {
+        fleetRemote?: boolean;
+        actor?: string;
+    }): Promise<void>;
     navigate(taskId: string, url: string, profileRef?: ProfileName | ConnectionKey): Promise<{
         tabId: string;
         url: string;

package/dist/lib/browser/service.js

@@ -773,7 +773,13 @@ export class BrowserService {
     async done(taskName) {
         return this.stop(taskName);
     }
-    async stopProfile(profileRef) {
+    async stopProfile(profileRef, opts = {}) {
+        // Consent gate — this is a fleet-remote destructive path (kills the
+        // profile's browser process and clears its runtime dir) that reached the
+        // daemon without ever hitting resolveOrCreateTask's gate, since it is a
+        // task-less stop. Same per-request marker rule as every other gated verb —
+        // see remote-control.ts.
+        assertRemoteControlAllowedForRequest(opts.fleetRemote, { actor: opts.actor });
         // Connections are keyed by the runtime key `<profile>@<device>` (see
         // start()) while callers pass the bare profile name (or, occasionally, an
         // exact key). A plain `connections.get(profileRef)` therefore missed every

package/dist/lib/browser/types.d.ts

@@ -287,7 +287,7 @@ export interface ReapResult {
     /** Tasks left alone this pass: still live, still inside the idle window, or recording. */
     skipped: number;
 }
-export type IPCAction = 'start' | 'show' | 'gc' | 'record-start' | 'record-stop' | 'done' | 'stop' | 'status' | 'history' | 'navigate' | 'tab-add' | 'tab-focus' | 'tab-close' | 'tab-list' | 'evaluate' | 'screenshot' | 'pdf' | 'refs' | 'click' | 'type' | 'press' | 'hover' | 'scroll' | 'set-viewport' | 'set-device' | 'console' | 'errors' | 'requests' | 'response-body' | 'wait' | 'set-download-path' | 'wait-download' | 'upload' | 'getAppLogs' | 'version';
+export type IPCAction = 'start' | 'show' | 'gc' | 'record-start' | 'record-stop' | 'done' | 'stop' | 'status' | 'history' | 'navigate' | 'tab-add' | 'tab-focus' | 'tab-close' | 'tab-list' | 'evaluate' | 'screenshot' | 'pdf' | 'refs' | 'click' | 'type' | 'press' | 'hover' | 'scroll' | 'set-viewport' | 'set-device' | 'console' | 'errors' | 'requests' | 'response-body' | 'wait' | 'set-download-path' | 'wait-download' | 'upload' | 'getAppLogs' | 'version' | 'request-self-update';
 export interface IPCRequest {
     action: IPCAction;
     task?: string;
@@ -425,6 +425,8 @@ export interface IPCResponse {
     uploadMode?: 'input' | 'drop' | 'chooser';
     appLogs?: any[];
     version?: string;
+    selfUpdateTriggered?: boolean;
+    reason?: string;
     skill?: {
         name: string;
         path: string;

package/dist/lib/channels/registry.d.ts

@@ -33,6 +33,12 @@ export interface SendResult {
     attachments?: string[];
     /** Mailbox provider returns the enqueued message id. */
     msgId?: string;
+    /**
+     * The exact body handed to the provider for THIS destination. Set by the owner
+     * fan-out (`sendToOwner`) so a per-destination compose is observable — Slack
+     * carries the `mrkdwn` labeled-link variant, iMessage the plain one (PHNX-3698).
+     */
+    body?: string;
     /** Per-destination results when the owner policy selects multiple channels. */
     deliveries?: SendResult[];
 }

package/dist/lib/channels/send.d.ts

@@ -10,6 +10,7 @@
  */
 import type { Meta } from '../types.js';
 import type { SendResult } from './registry.js';
+import type { SinkMessageFormat } from '../sink-format.js';
 /** Normalized delivery request after CLI/config resolution. */
 export interface SendEnvelope {
     text: string;
@@ -78,8 +79,16 @@ export declare function resolveSendEnvelope(input: ResolveSendInput, meta: Meta)
  * internal caller that already has a resolved envelope.
  */
 export declare function deliverEnvelope(envelope: SendEnvelope, meta: Meta): Promise<SendResult>;
-/** Resolve + deliver in one step (CLI happy path). */
-export declare function sendMessage(input: ResolveSendInput, meta: Meta): Promise<{
+/**
+ * Resolve + deliver in one step (CLI happy path).
+ *
+ * `ownerCompose`, when given, shapes the body PER owner destination on the
+ * policy fan-out — Slack gets `mrkdwn` labeled links, iMessage stays plain
+ * (PHNX-3698). Only the owner-policy path uses it; a direct `--channel`/`--to`
+ * send is delivered verbatim. The envelope's own `text` remains the plain
+ * default (validation, `--json`, dry-run display).
+ */
+export declare function sendMessage(input: ResolveSendInput, meta: Meta, ownerCompose?: (format: SinkMessageFormat) => string): Promise<{
     result: SendResult;
     envelope: SendEnvelope;
 } | {

package/dist/lib/channels/send.js

@@ -108,8 +108,16 @@ export async function deliverEnvelope(envelope, meta) {
         dryRun: envelope.dryRun,
     });
 }
-/** Resolve + deliver in one step (CLI happy path). */
-export async function sendMessage(input, meta) {
+/**
+ * Resolve + deliver in one step (CLI happy path).
+ *
+ * `ownerCompose`, when given, shapes the body PER owner destination on the
+ * policy fan-out — Slack gets `mrkdwn` labeled links, iMessage stays plain
+ * (PHNX-3698). Only the owner-policy path uses it; a direct `--channel`/`--to`
+ * send is delivered verbatim. The envelope's own `text` remains the plain
+ * default (validation, `--json`, dry-run display).
+ */
+export async function sendMessage(input, meta, ownerCompose) {
     const resolved = resolveSendEnvelope(input, meta);
     if (!resolved.ok)
         return { error: resolved.error };
@@ -123,6 +131,7 @@ export async function sendMessage(input, meta) {
             thread: resolved.envelope.thread,
             attachments: resolved.envelope.attachments,
             from: resolved.envelope.from,
+            ...(ownerCompose ? { composeForFormat: ownerCompose } : {}),
         })
         : await deliverEnvelope(resolved.envelope, meta);
     return { result, envelope: resolved.envelope };

package/dist/lib/cloud/rush.d.ts

@@ -8,10 +8,18 @@ import type { CloudProvider, CloudTask, CloudTaskStatus, CloudEvent, DispatchOpt
 /**
  * Returns true when ~/.rush/user.yaml exists, carries an access_token, and
  * the token has not passed its expires_at timestamp (Unix seconds). A missing
- * expires_at is treated as non-expired so tokens written without an expiry
- * still work. Pass yamlPath to override the default path in tests.
+ * expires_at, or `expires_at: 0` (a non-expiring Phoenix `pid_` bearer), is
+ * treated as non-expired (see isRushSessionExpired, PHNX-3645). Pass yamlPath
+ * to override the default path in tests.
  */
 export declare function isRushSessionValid(yamlPath?: string): boolean;
+/**
+ * Read the Rush session access token from ~/.rush/user.yaml. Exported (with an
+ * overridable yamlPath, like isRushSessionValid) so the freshness behavior —
+ * including the `expires_at: 0` non-expiring case (PHNX-3645) — is directly
+ * testable; the class methods call it with the default path.
+ */
+export declare function readToken(yamlPath?: string): string;
 /** One version's entry in the account manifest sent on every dispatch. */
 export interface AccountManifestEntry {
     version: string;