@phnx-labs/agents-cli 1.22.74 → 1.22.76

package/dist/commands/setup-watchdog.js

@@ -10,7 +10,7 @@ export async function runWatchdogSetupWizard() {
     const devices = [...new Set([...Object.keys(registry), machineId()].map(normalizeHost))].sort();
     const enabled = new Set(devices.filter((device) => getConfigValue('watchdog.enabled', { device }).value === true));
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        requireInteractiveSelection('watchdog devices', ['agents watchdog on', 'agents watchdog on --device <device>']);
+        requireInteractiveSelection('watchdog devices', ['agents watchdog enable', 'agents watchdog enable --device <device>']);
     }
     try {
         const { checkbox } = await import('@inquirer/prompts');
@@ -25,7 +25,7 @@ export async function runWatchdogSetupWizard() {
                 setConfigValue('watchdog.enabled', on);
                 continue;
             }
-            const launch = getCliLaunch(['watchdog', on ? 'on' : 'off', '--device', device]);
+            const launch = getCliLaunch(['watchdog', on ? 'enable' : 'disable', '--device', device]);
             const result = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env });
             if ((result.status ?? 1) !== 0)
                 throw new Error(`Could not configure watchdog on ${device}`);

package/dist/commands/setup.js

@@ -29,6 +29,7 @@ import { registerSetupWatchdogCommand, runWatchdogSetupWizard } from './setup-wa
 import { hasMintedSetupToken } from '../lib/auth-mint.js';
 import { registerAliasCommand } from './alias.js';
 import { registerBetaCommands } from './beta.js';
+import { addUrlSchemeSubcommands } from './open.js';
 import { runPreferencesStep } from './setup-preferences.js';
 import { getConfiguredDefaultProfileName, getProfile, getAutoDetectedProfile, isProfileLaunchableHere } from '../lib/browser/profiles.js';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
@@ -228,7 +229,7 @@ export async function runSetup(program, options = {}) {
             console.log(chalk.gray('Registered the agents:// URL scheme (artifact session deep links).'));
     }
     catch {
-        // non-fatal — the user can run `agents open register` later.
+        // non-fatal — the user can run `agents setup url-scheme register` later.
     }
     if (options.suppressFooter)
         return;
@@ -382,6 +383,26 @@ export function registerSetupCommand(program) {
     registerSetupWatchdogCommand(setupCmd);
     registerAliasCommand(setupCmd);
     registerBetaCommands(setupCmd);
+    // `agents setup url-scheme register|unregister|status` — the canonical, visible
+    // home for the agents:// OS handler that routes artifact deep links to the
+    // machine-only `agents _callback` verb. Reuses the same builder the hidden
+    // `agents open` back-compat subcommands mount.
+    const urlScheme = setupCmd
+        .command('url-scheme')
+        .description('Register/unregister/status the agents:// OS URL-scheme handler for artifact session deep links.');
+    addUrlSchemeSubcommands(urlScheme, { hidden: false });
+    setHelpSections(urlScheme, {
+        examples: `
+      # Register the handler so agents:// links in rendered artifacts resume sessions
+      agents setup url-scheme register
+
+      # Check whether the handler is registered on this machine
+      agents setup url-scheme status
+
+      # Remove the handler
+      agents setup url-scheme unregister
+    `,
+    });
     setupCmd.command('status')
         .description('Show setup readiness for core, browser, computer, secrets, accounts, fleet, share, watchdog, and preferences.')
         .option('--json', 'print machine-readable JSON')

package/dist/commands/share.js

@@ -1,5 +1,5 @@
 // `agents artifacts share` — publish an HTML file to a shareable link. Signed-in
-// users hit the managed endpoint (share.agents-cli.sh) with the Phoenix bearer;
+// users hit the managed endpoint (share.getrush.ai) with the Phoenix bearer;
 // otherwise the existing BYO Cloudflare R2 + Worker path. See cli/docs/observability.md.
 //
 // Registered under the `artifacts` group by commands/artifacts.ts; the
@@ -19,6 +19,7 @@ import { extractShareHttpError, formatShareHttpErrorDetail } from '../lib/share/
 import { phoenixIdBaseForDeploy, resolveShareBackend, shouldUseManaged, } from '../lib/share/backend.js';
 import { publishVisibility } from '../lib/storage/visibility.js';
 import { resolveGitHubUsername } from '../lib/git.js';
+import { refreshSessionAvatar } from '../lib/identity/index.js';
 import { setHelpSections } from '../lib/help.js';
 import { showUrl } from '../lib/open-url.js';
 export function formatSharePublishResult(result, json = false) {
@@ -548,7 +549,7 @@ function registerShareDeleteOptions(cmd) {
 }
 const SHARE_DELETE_EXAMPLES = `
       # Delete by full URL — also takes down the sibling OG cover and any retained revisions
-      agents artifacts share delete https://share.agents-cli.sh/octocat/my-plan-a1b2
+      agents artifacts share delete https://share.getrush.ai/octocat/my-plan-a1b2
 
       # Delete by <user>/<slug>, or a bare slug in your own namespace
       agents artifacts share delete octocat/my-plan-a1b2
@@ -581,7 +582,7 @@ const SHARE_DELETE_NOTES = `
 `;
 const SHARE_VISIBILITY_EXAMPLES = `
       # Take a public page private to just you (Phoenix session required for me/org)
-      agents artifacts share visibility https://share.agents-cli.sh/octocat/q3-plan me
+      agents artifacts share visibility https://share.getrush.ai/octocat/q3-plan me
 
       # Make it public again — by <user>/<slug> or a bare slug in your namespace
       agents artifacts share visibility octocat/q3-plan public
@@ -627,6 +628,7 @@ export function registerShareCommands(artifactsCmd) {
         .argument('[file]', 'file to publish (HTML or any static asset)')
         .option('--slug <slug>', 'URL slug override (default: stable slug of the artifact title, then filename)')
         .option('--github-user <user>', 'GitHub username for the share namespace (default: resolved from gh/git config; ignored on the managed endpoint)')
+        .option('--handle <name>', 'managed only: publish under an alternate public handle instead of the email local-part (default: your email local-part). Escape hatch when your derived handle is taken, or for a vanity namespace — the Worker binds it with the same first-writer claim')
         .option('--expire <spec>', "auto-expire (default 30d). e.g. 12h, 30d, 2026-08-01, or 'never'")
         .addOption(new Option('--visibility <level>', 'public | unlisted | private | me | org. Default when signed in: me (owner-only, Phoenix-gated); use org for your whole email domain, public to opt into the gallery. unlisted is an UNAUTHENTICATED capability URL; private is token-gated (404 without the key). All but public are hidden from the gallery')
         .choices([...PUBLISH_VISIBILITY_LEVELS]))
@@ -669,9 +671,16 @@ export function registerShareCommands(artifactsCmd) {
             if (visibility === 'unlisted' && !opts.json) {
                 console.error(chalk.yellow(`⚠ ${unlistedNotPrivateWarning()}`));
             }
+            // Managed publish: fill the session's hosted avatar (one /auth/me call,
+            // no-op when already known) so the attribution bar can show the OAuth
+            // profile image — sessions written before the CLI tracked avatars only
+            // carry token/email/userId (PHNX-3547).
+            if (shouldUseManaged({}))
+                await refreshSessionAvatar();
             const result = await publishFile(file, {
                 slug: opts.slug,
                 githubUser: opts.githubUser,
+                handle: opts.handle,
                 expire: opts.expire,
                 visibility,
                 unlisted: visibility === 'unlisted',
@@ -720,18 +729,25 @@ export function registerShareCommands(artifactsCmd) {
 
       # Republish the same title to the same URL without retaining a revision
       agents artifacts share ./out/plan.html --no-revision
+
+      # Your derived handle is taken (or you want a vanity namespace)
+      agents artifacts share ./out/plan.html --handle acme-muqsit
 ${SHARE_DELETE_EXAMPLES}
       # One-time setup (or join an existing endpoint)
       agents artifacts setup
-      agents artifacts share join https://share.agents-cli.sh
+      agents artifacts share join https://share.getrush.ai
 
       # Push a worker-template.ts change out to an already-provisioned endpoint
       agents artifacts share update
     `,
         notes: `
-  Signed-in users publish to the managed endpoint (share.agents-cli.sh/<handle>/…)
+  Signed-in users publish to the managed endpoint (share.getrush.ai/<handle>/…)
   with the Phoenix session — no Cloudflare account, bucket, or write token. The
-  handle is the local-part of the signed-in email. The default slug is derived
+  handle is the local-part of the signed-in email; --handle publishes under an
+  alternate public namespace instead (first-writer-claimed like the derived one —
+  the recovery path when your derived handle belongs to another account; a
+  same-email re-login re-binds your old handle automatically). The default slug
+  is derived
   deterministically from the HTML <title> or Markdown frontmatter title, then
   the filename, so republishing the same title updates the same URL. --slug is
   an optional override. Without a session, the existing BYO Cloudflare path still
@@ -846,7 +862,7 @@ ${SHARE_DELETE_NOTES}
     setHelpSections(shareOpenCmd, {
         examples: `agents artifacts share open q3-plan               # open your page, signed in, ready to re-scope
 agents artifacts share open octocat/q3-plan
-agents artifacts share open https://share.agents-cli.sh/octocat/q3-plan --no-open`,
+agents artifacts share open https://share.getrush.ai/octocat/q3-plan --no-open`,
         notes: `The shared page's visibility chip is an interactive control only for the signed-in owner; a plain link has no login, so the chip renders as a static cue. This mints a short-lived, single-use login ticket (self-signed by your share Worker) and opens the page with it, so the chip becomes a dropdown you can switch in place.
 Managed (Phoenix) endpoints only — run 'agents auth login' first. If the mint 501s/404s, your Worker predates the feature: run 'agents artifacts share update' to redeploy it.
 Prefer to change visibility without a browser? Use 'agents artifacts share visibility <target> <level>'.`,
@@ -854,7 +870,7 @@ Prefer to change visibility without a browser? Use 'agents artifacts share visib
     shareCmd
         .command('join')
         .description('Use an existing synced share endpoint and write token (no provisioning).')
-        .argument('[baseUrl]', 'base URL of the endpoint, e.g. https://share.agents-cli.sh')
+        .argument('[baseUrl]', 'base URL of the endpoint, e.g. https://share.getrush.ai')
         .option('--token <token>', 'write token (else SHARE_WRITE_TOKEN env, existing bundle, or prompt)')
         .action(async (baseUrl, opts) => {
         try {
@@ -1039,7 +1055,7 @@ Prefer to change visibility without a browser? Use 'agents artifacts share visib
   Use --scope unlisted|me|org or --all to include your hidden pages; those scopes
   send the owner's bearer and a 'scope=mine' hint to the Worker's JSON listing route,
   which returns hidden pages ONLY after verifying the caller owns the namespace.
-  Signed-in users list the managed endpoint (share.agents-cli.sh/<handle>); otherwise
+  Signed-in users list the managed endpoint (share.getrush.ai/<handle>); otherwise
   BYO. It reads the endpoint's JSON listing route, which ships with the current
   Worker template. If a BYO Worker predates this feature the command says so and
   points you at 'agents artifacts share update' (RUSH-2449) rather than returning a
@@ -1138,7 +1154,7 @@ Prefer to change visibility without a browser? Use 'agents artifacts share visib
 
       # By <user>/<slug> or full URL, same target forms as 'agents artifacts unshare'
       agents artifacts share revisions octocat/q3-report
-      agents artifacts share revisions https://share.agents-cli.sh/octocat/q3-report
+      agents artifacts share revisions https://share.getrush.ai/octocat/q3-report
 
       # Machine-readable, and a bare slug resolved against another namespace
       agents artifacts share revisions q3-report --revisions-json

package/dist/commands/skills.js

@@ -1,3 +1,4 @@
+import { withAliases } from '../lib/verbs.js';
 import chalk from 'chalk';
 import ora from 'ora';
 import * as fs from 'fs';
@@ -41,8 +42,8 @@ When to use:
   - Specialization: install domain skills (rush-product-knowledge, rdev) per project
   - Version isolation: install different skills to different versions for experimentation
 `);
-    skillsCmd
-        .command('list [agent]')
+    withAliases(skillsCmd
+        .command('list [agent]'), 'list')
         .description('Show which skills are installed and which agent versions they are synced to')
         .option('-a, --agent <agent>', 'Filter to a specific agent (alternative to positional arg)')
         .option('--json', 'Emit machine-readable JSON instead of the table/picker')
@@ -302,8 +303,8 @@ Examples:
             process.exit(1);
         }
     });
-    skillsCmd
-        .command('remove [name]')
+    withAliases(skillsCmd
+        .command('remove [name]'), 'remove')
         .description('Delete a skill from central storage (interactive picker if no name given)')
         .addHelpText('after', `
 Examples:
@@ -416,8 +417,8 @@ Examples:
         console.error(chalk.gray('Use:  agents prune cleanup skills   (or `agents prune cleanup` for everything)'));
         process.exit(1);
     });
-    skillsCmd
-        .command('view [name]')
+    withAliases(skillsCmd
+        .command('view [name]'), 'view')
         .description('Read skill metadata (name, description, rules count)')
         .addHelpText('after', `
 Examples:

package/dist/commands/subagents.js

@@ -5,6 +5,7 @@
  * installing, and removing lightweight agent definitions (AGENT.md files)
  * that parent agents can spawn for focused subtasks.
  */
+import { withAliases } from '../lib/verbs.js';
 import chalk from 'chalk';
 import ora from 'ora';
 import * as fs from 'fs';
@@ -66,8 +67,8 @@ When to use:
         });
     };
     // agents subagents list
-    subagentsCmd
-        .command('list')
+    withAliases(subagentsCmd
+        .command('list'), 'list')
         .description('Show subagents in a table with sync status across agent versions')
         .option('--json', 'Emit machine-readable JSON instead of the table/picker')
         .addHelpText('after', `
@@ -77,8 +78,8 @@ Examples:
 `)
         .action(runList);
     // agents subagents view <name>
-    subagentsCmd
-        .command('view [name]')
+    withAliases(subagentsCmd
+        .command('view [name]'), 'view')
         .description('Show details for a specific subagent (use "list" to see all)')
         .addHelpText('after', `
 Examples:
@@ -236,8 +237,8 @@ Examples:
         console.log();
     });
     // agents subagents remove [name]
-    subagentsCmd
-        .command('remove [name]')
+    withAliases(subagentsCmd
+        .command('remove [name]'), 'remove')
         .description('Delete a subagent from central storage and unsync from all agent versions')
         .option('-y, --yes', 'Skip confirmation prompt')
         .addHelpText('after', `

package/dist/commands/sync.js

@@ -40,6 +40,7 @@ import { shouldAutoClaimCentralProfile } from '../lib/browser/profiles.js';
 import { isVersionInstalled, syncResourcesToVersion, parseAgentSpec, resolveVersion, resolveVersionAlias, listInstalledVersions, healDanglingVersionPointers, getAvailableResources, getActuallySyncedResources, getProjectOnlyResources, getNewResources, hasNewResources, promptResourceSelection, promptNewResourceSelection, buildSelection, mergeRepoScopedSelections, listRepoNames, getVersionHomePath, } from '../lib/installations/versions.js';
 import { capableAgents } from '../lib/capabilities.js';
 import { parseHookManifest, registerHooksToSettings } from '../lib/hooks/install.js';
+import { repairAfterSync, renderRepairAfterSync, repairHadFailures, repairChangedAnything, repairAfterSyncJson } from '../lib/reconcile-and-repair.js';
 import { compileRulesForProject } from '../lib/rules/compile.js';
 import { runLaunchSync } from '../lib/project-launch.js';
 import { formatKeptProjectResources } from '../lib/project-resources.js';
@@ -197,6 +198,7 @@ export function registerSyncCommand(program) {
         .option('--secrets', 'Umbrella: pull encrypted secret bundles from the remote', false)
         .option('--cloud', 'Umbrella: fetch all remote state but skip the local reconcile', false)
         .option('--local', "Umbrella: reconcile resources into installed agents only (no fetch)", false)
+        .option('--prune-clis', 'Umbrella: also purge stale/legacy agents-cli installs (npx-cache, pre-1.22.30, unsafe helper) when a fixed peer exists. DESTRUCTIVE and off by default — the purge never runs on a routine sync.', false)
         .action(async (agentSpec, repo, opts) => {
         await runSync(agentSpec, repo, opts);
     });
@@ -412,6 +414,7 @@ async function runInteractiveReconcile(opts, outLog, errLog) {
     //    register hooks so synced hook scripts fire.
     const hookManifest = parseHookManifest();
     const hookCapable = new Set(capableAgents('hooks'));
+    const touched = [];
     for (const agentId of agents) {
         const version = resolveVersion(agentId, cwd) || listInstalledVersions(agentId).slice(-1)[0];
         if (!version)
@@ -421,7 +424,24 @@ async function runInteractiveReconcile(opts, outLog, errLog) {
         if (result.hooks && hookCapable.has(agentId) && Object.keys(hookManifest).length > 0) {
             registerHooksToSettings(agentId, getVersionHomePath(agentId, version), hookManifest);
         }
+        touched.push({ agent: agentId, version });
     }
+    // Post-reconcile repair (the superset of the old `doctor --fix`): heal live-home
+    // gaps, re-wire hooks the diff left behind, and repair managed hook runtime
+    // shims for exactly the versions this reconcile touched. Always interactive
+    // here, so render its detail freely.
+    for (const t of touched) {
+        const repair = await repairAfterSync({ agent: t.agent, versions: [t.version], cwd });
+        renderRepairAfterSync(repair, outLog);
+    }
+    // Bare `agents sync` at a TTY is the umbrella verb — after per-agent repair,
+    // run one no-agent pass. This purges stale/legacy agents-cli copies ONLY when
+    // the user passed `--prune-clis` (the purge is never automatic); otherwise it is
+    // a cheap re-diff no-op over the just-reconciled homes.
+    const umbrellaRepair = await repairAfterSync({ cwd, pruneClis: !!opts.pruneClis });
+    renderRepairAfterSync(umbrellaRepair, outLog);
+    if (repairHadFailures(umbrellaRepair))
+        process.exitCode = 1;
 }
 /**
  * Drain the legacy central `browser:` tombstone during `agents sync` (PHNX-3315).
@@ -508,11 +528,21 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
         const residual = result.reconciled
             ? verifyReconciled(result.reconciledVersions.map((r) => ({ agent: r.agent, version: r.version })), cwd)
             : [];
+        // Post-reconcile repair, machine-wide: no agent scope → heal every installed
+        // agent, re-wire hooks the diff left behind, and repair managed hook runtime
+        // shims. The stale-CLI purge runs ONLY with `--prune-clis` (never automatic).
+        // Skipped under --cloud (fetch-only: nothing was reconciled to repair).
+        const repair = opts.cloud ? null : await repairAfterSync({ cwd, pruneClis: !!opts.pruneClis });
+        // A repair that left something for a human (an unresolvable shim, a failed
+        // rewire/purge) is a non-zero outcome, same as the deleted `doctor --fix`.
+        const repairFailed = repair !== null && repairHadFailures(repair);
+        if (repairFailed)
+            process.exitCode = 1;
         if (json) {
             emitJson({
-                // A refused resource OR residual drift is not a clean sync (RUSH-2700 +
-                // PHNX-3186).
-                ok: result.declined.length === 0 && residual.length === 0,
+                // A refused resource, residual drift, OR a repair failure is not a clean
+                // sync (RUSH-2700 + PHNX-3186).
+                ok: result.declined.length === 0 && residual.length === 0 && !repairFailed,
                 mode: 'umbrella',
                 plan: result.plan,
                 repos: result.repos,
@@ -521,6 +551,7 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
                 reconciled: result.reconciled,
                 declined: result.declined,
                 residualDrift: residual,
+                repair: repair ? repairAfterSyncJson(repair) : null,
             });
             return;
         }
@@ -545,6 +576,8 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
             for (const e of errs)
                 errLog(chalk.yellow(`  ! ${e}`));
             printResidual(residual, errLog);
+            if (repair)
+                renderRepairAfterSync(repair, outLog);
         }
     }
     catch (err) {
@@ -765,15 +798,25 @@ async function runSync(agentSpec, repoArg, opts) {
             : verifyReconciled(versions.map(({ version: v }) => ({ agent: agentId, version: v })), cwd);
         if (!quiet && !json)
             printResidual(residual, errLog);
+        // Post-reconcile repair over exactly the versions just reconciled (the
+        // superset of the old `doctor --fix`). Runs under --json too (fleet fan-out);
+        // only its human detail is gated on !quiet && !json.
+        const allRepair = await repairAfterSync({ agent: agentId, versions: installed, cwd });
+        if (!quiet && !json)
+            renderRepairAfterSync(allRepair, outLog);
+        const allRepairFailed = repairHadFailures(allRepair);
+        if (allRepairFailed)
+            process.exitCode = 1;
         if (json) {
             emitJson({
-                // Any version that refused a write, or any residual drift after the
-                // reconcile, makes the whole run not-ok (RUSH-2700 + PHNX-3186).
-                ok: versions.every(({ result }) => result.declined.length === 0) && residual.length === 0,
+                // Any version that refused a write, any residual drift, or a repair
+                // failure makes the whole run not-ok (RUSH-2700 + PHNX-3186).
+                ok: versions.every(({ result }) => result.declined.length === 0) && residual.length === 0 && !allRepairFailed,
                 mode: 'agent-all',
                 agent: agentId,
                 repo: repoScope,
                 residualDrift: residual,
+                repair: repairAfterSyncJson(allRepair),
                 ...healedPointers,
                 versions: versions.map(({ version: v, result }) => ({
                     version: v,
@@ -896,11 +939,17 @@ async function runSync(agentSpec, repoArg, opts) {
             return;
         }
         const result = syncResourcesToVersion(agentId, version, scoped, { projectDir, cwd, force, prune: !!repoScope, allowExecSurfaces: !!opts.allowExecSurfaces });
+        const scopedRepair = await repairAfterSync({ agent: agentId, versions: [version], cwd });
+        const scopedRepairFailed = repairHadFailures(scopedRepair);
+        if (scopedRepairFailed)
+            process.exitCode = 1;
         if (json) {
-            emitJson(agentSyncJson(agentId, version, result, repoScope));
+            const base = agentSyncJson(agentId, version, result, repoScope);
+            emitJson({ ...base, ok: base.ok === true && !scopedRepairFailed, repair: repairAfterSyncJson(scopedRepair) });
         }
         else if (!quiet) {
             printSyncDetail(result, agentId, version, cwd);
+            renderRepairAfterSync(scopedRepair, outLog);
         }
         return;
     }
@@ -934,8 +983,21 @@ async function runSync(agentSpec, repoArg, opts) {
                 selection = userSelection;
             }
             else if (!force) {
-                outLog(chalk.gray(`${agentLabel(agentId)}@${version} is already in sync.`));
-                outLog(chalk.gray('Run with --force to re-sync, or --yes to bypass this check.'));
+                // Tracked resources match source — but a generated hook shim can still be
+                // broken on an otherwise in-sync version (the yosemite-s1 class), and
+                // syncResourcesToVersion never generates it. Run the repair pass BEFORE
+                // the early return so a broken shim is still fixed on bare
+                // `agents sync <agent>`, then report what (if anything) it touched.
+                const repair = await repairAfterSync({ agent: agentId, versions: [version], cwd });
+                if (repairChangedAnything(repair)) {
+                    renderRepairAfterSync(repair, outLog);
+                }
+                else {
+                    outLog(chalk.gray(`${agentLabel(agentId)}@${version} is already in sync.`));
+                    outLog(chalk.gray('Run with --force to re-sync, or --yes to bypass this check.'));
+                }
+                if (repairHadFailures(repair))
+                    process.exitCode = 1;
                 return;
             }
             // else: --force on a fully-synced version → selection stays undefined,
@@ -973,6 +1035,13 @@ async function runSync(agentSpec, repoArg, opts) {
     // picked kinds, so the rest legitimately still differs and is not this run's
     // failure. This is the exact path `agents sync <agent>[@version]` takes.
     const residual = selection ? [] : verifyReconciled([{ agent: agentId, version }], cwd);
+    // Post-reconcile repair over the single version just reconciled (the superset
+    // of the old `doctor --fix`). Runs under --json too; only its human detail is
+    // gated on the non-quiet path below.
+    const singleRepair = await repairAfterSync({ agent: agentId, versions: [version], cwd });
+    const singleRepairFailed = repairHadFailures(singleRepair);
+    if (singleRepairFailed)
+        process.exitCode = 1;
     // Compile project-scope rules into the workspace itself so each agent's
     // native loader picks up cwd/<INSTRUCTIONS_FILE>. projectDir is the
     // .agents/ directory; the workspace root is its parent.
@@ -985,8 +1054,9 @@ async function runSync(agentSpec, repoArg, opts) {
         const base = agentSyncJson(agentId, version, result);
         emitJson({
             ...base,
-            ok: base.ok === true && residual.length === 0,
+            ok: base.ok === true && residual.length === 0 && !singleRepairFailed,
             residualDrift: residual,
+            repair: repairAfterSyncJson(singleRepair),
             ...healedPointers,
             projectCompile: projectCompile
                 ? {
@@ -1004,6 +1074,7 @@ async function runSync(agentSpec, repoArg, opts) {
     // ---------- 6. Detailed output ----------
     printSyncDetail(result, agentId, version, cwd);
     printResidual(residual, errLog);
+    renderRepairAfterSync(singleRepair, outLog);
     if (projectCompile?.compiled) {
         const linkInfo = projectCompile.symlinks.length > 0
             ? ` (+ ${projectCompile.symlinks.join(', ')})`

package/dist/commands/view.js

@@ -1287,6 +1287,7 @@ export async function collectAgentsJson(filterAgentId, resourceSections, opts) {
         const usageKey = getUsageLookupKey(info);
         const usageInfo = usageKey ? usageByKey.get(usageKey) : undefined;
         const snapshot = usageInfo?.snapshot ?? null;
+        const authHealth = authCache[authCacheKey(host, agentId, version)];
         const entry = {
             version,
             isDefault: version === globalDefault,
@@ -1298,13 +1299,15 @@ export async function collectAgentsJson(filterAgentId, resourceSections, opts) {
             // `collectRunCandidates` uses locally, so remote `--device auto` placement
             // is gated on identical launchability (PHNX-3466).
             launchable: isLaunchableSignedIn(info.signedIn, credentialPresence(agentId, home)),
-            authVerdict: authCache[authCacheKey(host, agentId, version)]?.verdict ?? null,
+            authVerdict: authHealth?.verdict ?? null,
+            authCheckedAt: authHealth?.checkedAt ?? null,
             email: info.email,
             accountId: info.accountId,
             organizationType: info.organizationType ?? null,
             organizationName: info.organizationName ?? null,
             plan: info.plan,
             usageStatus: info.usageStatus,
+            usageCapturedAt: snapshot?.capturedAt?.toISOString() ?? null,
             overageCredits: info.overageCredits,
             usageError: usageErrorForDisplay(usageInfo?.error),
             windows: snapshot

package/dist/commands/watchdog.d.ts

@@ -10,7 +10,7 @@
  *   agents watchdog --nudge            one tick, actually injects (explicit opt-in)
  *   agents watchdog --watch            manual poll loop (dry unless --nudge)
  *   agents watchdog --json             machine-readable tick output (for the menu-bar)
- *   agents watchdog on|off             turn the device-local daemon pass on/off
+ *   agents watchdog enable|disable             turn the device-local daemon pass on/off
  *   agents watchdog policy <id> <p>    per-session policy: off | keep | handsoff
  *
  * The agents daemon is the sole automatic watchdog scheduler. The menu bar reads

package/dist/commands/watchdog.js

@@ -10,7 +10,7 @@
  *   agents watchdog --nudge            one tick, actually injects (explicit opt-in)
  *   agents watchdog --watch            manual poll loop (dry unless --nudge)
  *   agents watchdog --json             machine-readable tick output (for the menu-bar)
- *   agents watchdog on|off             turn the device-local daemon pass on/off
+ *   agents watchdog enable|disable             turn the device-local daemon pass on/off
  *   agents watchdog policy <id> <p>    per-session policy: off | keep | handsoff
  *
  * The agents daemon is the sole automatic watchdog scheduler. The menu bar reads
@@ -138,7 +138,7 @@ export function registerWatchdogCommand(program) {
         .command('watchdog')
         .description('Auto-nudge stalled agent terminals: detect stalls, resolve the exact split, inject "Continue." — no menu-bar needed.')
         .option('--nudge', 'Actually inject (default is a dry run that only reports what it would do)')
-        .option('--watch', 'Manual poll loop: run a tick every --interval (dry unless --nudge; the always-on path is `watchdog on`)')
+        .option('--watch', 'Manual poll loop: run a tick every --interval (dry unless --nudge; the always-on path is `watchdog enable`)')
         .option('--interval <dur>', 'Poll interval in --watch mode (e.g. 30s, 1m)', '30s')
         .option('--stall <dur>', 'Idle time before a session counts as stalled', humanMs(DEFAULT_THRESHOLDS.stallMs))
         .option('--cooldown <dur>', 'Minimum time between nudges to the same session', humanMs(DEFAULT_THRESHOLDS.cooldownMs))
@@ -183,7 +183,7 @@ export function registerWatchdogCommand(program) {
         const intervalMs = durationMsOr(opts.interval, 30_000);
         if (!computeWillInject() && !opts.json) {
             console.log(chalk.yellow(`watchdog --watch is DETECT-ONLY. Pass --nudge to inject, ` +
-                `or run 'agents watchdog on' for the daemon-owned pass.`));
+                `or run 'agents watchdog enable' for the daemon-owned pass.`));
         }
         // eslint-disable-next-line no-constant-condition
         while (true) {
@@ -213,7 +213,7 @@ export function registerWatchdogCommand(program) {
       agents watchdog --json
 
       # Turn on the daemon-owned watchdog pass (every three minutes)
-      agents watchdog on
+      agents watchdog enable
 
       # Show device enablement, rotate config, and in-flight rotates
       agents watchdog status
@@ -261,7 +261,7 @@ export function registerWatchdogCommand(program) {
       'watchdog.rotate: off' to ~/.agents/agents.yaml; nudging stays on).
       State machine: ~/.agents/.cache/state/watchdog/rotate/<sessionId>.json.
 
-      Always-on: 'agents watchdog on' enables one daemon-owned pass every three
+      Always-on: 'agents watchdog enable' enables one daemon-owned pass every three
       minutes on this device and reloads the daemon; 'off' disables it here.
       Defaults OFF. Per-session policy: off (ignore), keep (default), handsoff
       (detect + flag).
@@ -280,21 +280,21 @@ export function registerWatchdogCommand(program) {
         await reloadDaemonForRoutine(false);
         console.log(chalk.yellow('watchdog: OFF on this device'));
     };
-    cmd.command('on')
+    cmd.command('enable')
+        .alias('on')
         .description('Enable the daemon watchdog pass on this device.')
         .action(async () => {
         await turnOn();
     });
-    cmd.command('off')
+    cmd.command('disable')
+        .alias('off')
         .description('Disable the daemon watchdog pass on this device.')
         .action(async () => {
         await turnOff();
     });
-    cmd.command('enable', { hidden: true }).action(turnOn);
-    cmd.command('disable', { hidden: true }).action(turnOff);
     cmd.command('rotate <state>')
         .description('Turn in-place rotate of rate-limited sessions on|off (watchdog.rotate in agents.yaml). ' +
-        'Rotate-only: nudging stays on — unlike `watchdog off`, which disables the whole watchdog on this device.')
+        'Rotate-only: nudging stays on — unlike `watchdog disable`, which disables the whole watchdog on this device.')
         .action((state) => {
         const s = state.toLowerCase();
         if (s !== 'on' && s !== 'off') {

package/dist/commands/webhook.d.ts

@@ -6,4 +6,8 @@
  * rotated without changing the Tailscale Funnel config.
  */
 import type { Command } from 'commander';
+import type { Server } from 'http';
+import type { Socket } from 'net';
+/** Stop accepting requests and destroy persistent connections so shutdown is bounded. */
+export declare function closeWebhookServer(server: Server, sockets: Set<Socket>): Promise<void>;
 export declare function registerWebhooksCommand(program: Command): void;

package/dist/commands/webhook.js

@@ -1,6 +1,7 @@
 import * as path from 'path';
 import chalk from 'chalk';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
+import { closeServerBounded } from '../lib/secrets/agent.js';
 import { createFileDeliveryStore, startWebhookServer, waitForListening } from '../lib/triggers/webhook.js';
 import { getRuntimeStateDir } from '../lib/state.js';
 const DEFAULT_HOST = '127.0.0.1';
@@ -32,6 +33,13 @@ function readWebhookSecrets(bundleName) {
     }
     return secrets;
 }
+/** Stop accepting requests and destroy persistent connections so shutdown is bounded. */
+export async function closeWebhookServer(server, sockets) {
+    const closing = closeServerBounded(server);
+    for (const socket of sockets)
+        socket.destroy();
+    await closing;
+}
 export function registerWebhooksCommand(program) {
     const webhooks = program
         .command('webhooks')
@@ -81,17 +89,27 @@ export function registerWebhooksCommand(program) {
                     console.error(chalk.red(`${new Date().toISOString()} ${webhook.source}:${webhook.event} dispatch failed after ack: ${err.message}`));
                 },
             });
+            const sockets = new Set();
+            server.on('connection', (socket) => {
+                sockets.add(socket);
+                socket.once('close', () => sockets.delete(socket));
+            });
             await waitForListening(server);
             const address = server.address();
             const bound = typeof address === 'object' && address ? address.port : port;
             console.log(`${chalk.green('agents webhooks')} ${chalk.dim('→')} ${chalk.cyan(`http://${opts.bind ?? DEFAULT_HOST}:${bound}`)}`);
             console.log(chalk.dim('signed · localhost by default · endpoints: /hooks/github, /hooks/linear, /hooks/slack · acks 202 then dispatches · Ctrl-C to stop'));
             console.log(chalk.dim('for a supervised receiver that survives reboot: agents daemon webhooks add --secrets-bundle <name>'));
-            const shutdown = () => {
-                server.close(() => process.exit(0));
+            let shuttingDown = false;
+            const shutdown = async () => {
+                if (shuttingDown)
+                    return;
+                shuttingDown = true;
+                await closeWebhookServer(server, sockets);
+                process.exit(0);
             };
-            process.on('SIGINT', shutdown);
-            process.on('SIGTERM', shutdown);
+            process.on('SIGINT', () => { void shutdown(); });
+            process.on('SIGTERM', () => { void shutdown(); });
         }
         catch (err) {
             console.error(chalk.red(`Could not start webhook receiver: ${err.message}`));