@phnx-labs/agents-cli 1.22.88 → 1.22.90

package/CHANGELOG.md

@@ -1,5 +1,164 @@
 # Changelog
 
+## 1.22.90
+
+- **`accounts migrate --apply` no longer aborts on a worker whose accounts already hold slots (PHNX-3940).** The daemon's auth-sync provisions a durable slot per account on every worker, so `--apply` hit `Slot already exists` on the first credential-bearing legacy home and cleaned nothing. The plan now routes such a home to `trash` (restorable with `agents trash restore`) with the reason "account already holds a provisioned slot on this device", rewrites any `<harness>@<label>` binding to the account, and clears the stale home record; a canonical install in that state keeps its binary, has its stale home moved to `~/.agents/.history/trash/homes/…` (manifest key `<harness>@<label>#home`), and gets an empty home back. A regular file at the slot path is still not a slot, so the apply-time guard still fails loud on that corruption. Source: `cli/src/lib/accounts/migrate.ts`.
+
+- **AGI Menu: Sessions window, feed-driven RECENT, Notifications submenu (PHNX-4003).**
+  `Cmd-Shift-I` (or the new **Sessions** row at the top of the dropdown) opens a
+  persistent Sessions window: live sessions across the fleet grouped by project on
+  the left, with **Recent / Needs you / Running / Done today** filter chips, a
+  `Cmd-F` search (label, topic, project, ticket, device), and a device strip that
+  marks stale heartbeats; a session card on the right shows the phase, PR chip,
+  request excerpt, progress tally, latest action, today's rendered artifacts with an
+  **Open** button, and the attention block when the agent is waiting — numbered
+  option buttons, permission Allow/Deny, plan-review Approve/Send back — answered
+  atomically through `agents feed answer`. A reply field routes by capability
+  (`agents feed answer`, `agents sessions inject`, `agents cloud message`,
+  `agents teams message`) and shows the CLI's own result inline; keys `1`–`9`,
+  `Return`, `Cmd-Return`, `Cmd-K` answer, reply, open the terminal, or nudge. The
+  dropdown's RECENT section now renders the same feed-driven rows (status dot,
+  `n/N` checklist, `working · 18h · host`, latest action + PR chip) grouped by
+  project, each opening the window on that session, and a **Notifications**
+  submenu lists today's feed banners unanswered-first. Blocked sessions leave the
+  NEEDS YOU strip, which keeps only load, scheduler, and routine triage.
+  Source: `cli/menubar/Sources/MenubarHelper/SessionsWindow.swift`,
+  `cli/menubar/Sources/MenubarHelper/SessionCard.swift`,
+  `cli/menubar/Sources/MenubarHelper/SessionRowModel.swift`,
+  `cli/menubar/Sources/MenubarHelper/Reply.swift`,
+  `cli/menubar/Sources/MenubarHelper/RecentSectionBuilder.swift`.
+
+- **AGI Menu delivers attention banners on `UNUserNotificationCenter` with real
+  action buttons (PHNX-4004).** The deprecated `NSUserNotification` toast is
+  replaced for actionable notices: the banner carries the mapped category, a
+  time-sensitive interruption level for a blocked ask, a per-session thread so a
+  session's banners group, and the harness avatar as an attachment. The
+  persistent menu-bar instance is the delegate; a tapped action runs one bounded
+  `agents feed answer` / `agents open` command off the delegate thread and posts
+  a "Could not deliver your reply" follow-up when it fails, or a "Could not open
+  the report/PR" follow-up when a done banner carried no link for that button.
+  When macOS declines notification authorization it degrades to the old plain
+  banner so a notice is never lost.
+  Source: `menubar/Sources/MenubarHelper/Notifier.swift`,
+  `menubar/Sources/MenubarHelper/AgentAvatar.swift`.
+
+- **AGI Menu palette: dispatch form with remembered defaults, project pulse, and session-id minting (PHNX-4005).**
+  The `Cmd-Shift-O` palette now carries the dimensions a dispatch actually needs
+  below its text field — **mode** (Plan / Auto / Edit), **run on** (This Mac,
+  `auto`, or a fleet device by name), **surface** (Interactive / Headless), and
+  **watchdog** (Off / Keep moving / Hands-off) — collapsed to one summary line
+  (`Claude 2.1.263 · this-mac · agi · Auto · Interactive · Keep moving`) with a
+  `▸ details` disclosure. Every dimension is **remembered per project**, so
+  switching projects restores the agent, mode, and target you last used there and
+  one keystroke dispatches. `Cmd-P` switches **this one dispatch** to Plan without
+  touching the remembered defaults. A Claude dispatch mints its session id and
+  passes `--session-id`, which lets the palette apply a non-default watchdog policy
+  at dispatch and register a **launching placeholder** with the feed stream: the
+  row shows in the project pulse strip as `◌ launching · <name>` (and in any
+  window that reads the feed rows) until the real session reports, and reads
+  "did not start" — with the CLI's own stderr — if the launch exits non-zero or
+  no row arrives within 60 s. Under the project row a **pulse strip** shows the
+  headline milestone from `agents projects status`, open tickets and PRs, live
+  running / need-you / idle counts with NOW chips (not-progressing first), and
+  the NEXT UP ticket (`Cmd-N` attaches).
+  Source: `cli/menubar/Sources/MenubarHelper/DispatchForm.swift`,
+  `cli/menubar/Sources/MenubarHelper/DispatchDefaults.swift`,
+  `cli/menubar/Sources/MenubarHelper/ProjectPulse.swift`,
+  `cli/menubar/Sources/MenubarHelper/FeedStream.swift`,
+  `cli/menubar/Sources/MenubarHelper/AgentsCLI.swift`.
+
+- **AGI Menu palette: find a screenshot by the text on it (PHNX-4006).**
+  Every capture in the palette's screenshot folders (the system `screencapture`
+  location, CleanShot's export path, and the clip attachments dir) is now OCR'd
+  once, on-device, and indexed so you can search screenshots by the words on them.
+  With the palette key, `Cmd-Shift-F` focuses a search field above the strip:
+  typing filters the thumbnails to captures whose recognized text matches every
+  token (case-insensitive, tokenized AND), newest first, with an `n of m match`
+  hint; clearing it restores the newest-six strip. A **more** disclosure expands
+  the strip into a grid grouped by hour (last 24 h) then day — each cell shows the
+  thumbnail, the time, and the first recognized line — where a click attaches and a
+  double-click previews the full image in Preview.app. Nothing leaves the machine:
+  recognition runs through Vision locally (`.fast`, no language correction) on a
+  background queue, images over 20 MB are skipped and the rest downsampled to
+  2000 px before recognition, each capture is keyed by the SHA-256 of its bytes so
+  a rename or duplicate is never OCR'd twice, a deleted capture drops out of the
+  index (search and grid never return it, and the next scan prunes its row), and
+  the index is a local SQLite file at `~/.agents/.history/menubar/screenshots.db`.
+  Source:
+  `cli/menubar/Sources/MenubarHelper/ScreenshotIndex.swift`,
+  `cli/menubar/Sources/MenubarHelper/ScreenshotGrid.swift`,
+  `cli/menubar/Sources/MenubarHelper/PromptPanel.swift`.
+
+## 1.22.89
+
+- **Worker daemons now actually relaunch onto a new agents-cli release, so a fix
+  that ships reaches every worker without a hand `agents daemon restart`
+  (PHNX-3940 rollout).** Two defects kept every fleet daemon on the code it
+  booted with: `resolveRunningPackageRoot(__dirname)` resolved one level up from
+  the calling module, which from `dist/lib/daemon/self-update-service.js` is
+  `dist/lib`, so every self-update tick failed with `… is not an npm-managed
+  install` (eight Linux workers logged it for days and ran 1.22.79 code while the
+  disk sat at 1.22.88); and the tick only exited after an install it performed
+  itself, so an install written by an operator's `agents` command never relaunched
+  the daemon, and on a box with a second `agents` on PATH the tick declined
+  silently. The resolver now walks up to the `package.json` naming this package;
+  the tick compares the on-disk version with the version it booted with and, when
+  the disk is newer and the install has settled (`package.json` at rest for a
+  minute and every `bin` entry present, because bun's write is not atomic), exits
+  for the OS-supervisor relaunch without downloading anything. The shadow decline
+  is logged once per daemon process, and `auth-sync` logs accounts skipped
+  because their durable key is not readable on the box. Source:
+  `cli/src/lib/self-update.ts`, `cli/src/lib/daemon/self-update-service.ts`,
+  `cli/src/lib/daemon/auth-sync-service.ts`.
+
+- **AGI Menu palette: real projects, Linear from the binding, pin, live screenshots, image paste (PHNX-4001).**
+  The `Cmd-Shift-O` palette now picks a **project**, not a directory: it lists every
+  `agents projects` definition by name (with a type-ahead filter and the root as a
+  tooltip) instead of the last eight session working directories, so a project you
+  have not worked in today is still one keystroke away, and two definitions that
+  share a checkout — `prix` and `rush` both live in the same monorepo — stay two
+  entries. Dispatch passes `--project <name>`; recent session cwds now only offer a
+  worktree or subdirectory *inside* the chosen project. The ticket list is scoped by
+  the project's own Linear **binding** rather than by matching folder names against
+  Linear project names, which is why picking `agi` now shows the AGI board instead of
+  "no Linear project matches agents-cli"; a project with no binding says so and prints
+  `agents projects link <name> --linear`. The palette can be **pinned** (header button,
+  or press `Cmd-Shift-O` while it is already focused) so it survives another app
+  taking focus. The screenshot strip is **live** — a shot taken while the palette is
+  open appears within about a second, with no re-summon — and images can be pasted
+  with `Cmd-V` or dropped onto the panel; `Backspace` on a focused thumbnail removes
+  it. Attachments now travel to the agent as `<host>:<abs-path>` references (the same
+  form `Cmd-Shift-V` types), so a dispatch to another device can fetch them. The
+  ticket list starts folded and `Cmd-T` toggles it, remembered. On a machine with no
+  projects defined the palette falls back to recent session working directories, and
+  with neither a project nor a recent directory it now refuses to dispatch instead of
+  launching an agent with no working directory (which resolved to `/`).
+  Source: `cli/menubar/Sources/MenubarHelper/PromptPanel.swift`,
+  `cli/menubar/Sources/MenubarHelper/ScreenshotWatcher.swift`,
+  `cli/menubar/Sources/MenubarHelper/LinearTickets.swift`.
+
+- **The CLI now posts one actionable desktop banner per new attention item, so a
+  session asking a question, a permission prompt, or a plan review is answerable
+  straight from the notification (PHNX-4004).** A new supervised `attention-notify`
+  daemon service (tick 5 s, reader-independent) reconciles this host's live
+  sessions each tick and posts a banner carrying the category, the attention key,
+  the session id, and the answerable choices — Approve / Approve for session / Deny
+  for a permission, the options plus a typed reply for a question, Approve / Send
+  back for a plan review, Open terminal for a stall — which the macOS helper routes
+  back through `agents feed answer <key> --choice <id>`. A `deny`/`send-back`
+  choice delivers a real Escape keystroke (no trailing Enter) rather than the
+  letters "esc", so cancelling a permission or plan prompt never confirms it.
+  `agents run --notify` finish banners now carry `category: done|failure`; the
+  finish-notification shape also carries the session id and open-report / open-pr
+  choices when the caller supplies a session id, report path, or PR url.
+  Idempotency is a filesystem ledger under `~/.agents/.history/feed/notified/`,
+  pruned at 14 days, so a daemon restart never re-posts a banner already sent. The
+  `--notify` argv gains `--category`, `--key`, `--session`, and repeated
+  `--choice <id>=<label>` (see `docs/menubar.md` → Actionable notifications).
+  Source: `src/lib/menubar/notify-desktop.ts`,
+  `src/lib/daemon/attention-notify-service.ts`, `src/lib/feed/attention.ts`,
+  `src/lib/answer-router.ts`, `src/lib/run-notify.ts`.
+
 ## 1.22.88
 
 - **`agents run` no longer fails with `secrets request failed: spawnSync sh

package/dist/lib/accounts/migrate.js

@@ -163,6 +163,30 @@ async function duplicateTrashLabels(items) {
 function plannedTrashPath(agent, label) {
     return path.join(getHistoryDir(), 'trash', 'versions', agent, label, '<stamp>');
 }
+/**
+ * Where a canonical install's stale `home/` goes when its account already holds
+ * a slot: the binary and the (recreated, empty) home stay under `versions/`, so
+ * the old home cannot use the versions trash — `agents trash restore` would put a
+ * whole install back over a live one. Restoring is a plain move back; the
+ * migration manifest records the path under `<agent>@<label>#home`.
+ */
+function homeTrashDir(agent, label) {
+    return path.join(getHistoryDir(), 'trash', 'homes', agent, label);
+}
+function plannedHomeTrashPath(agent, label) {
+    return path.join(homeTrashDir(agent, label), '<stamp>');
+}
+function trashHome(agent, item) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const dest = path.join(homeTrashDir(agent, item.label), stamp);
+    fs.mkdirSync(path.dirname(dest), { recursive: true, mode: 0o700 });
+    if (!fs.existsSync(item.home)) {
+        throw new Error(`Home ${item.home} is missing; cannot trash it.`);
+    }
+    fs.renameSync(item.home, dest);
+    fs.mkdirSync(item.home, { recursive: true, mode: 0o700 });
+    return dest;
+}
 function emptyDir(dir) {
     if (!fs.existsSync(dir))
         return true;
@@ -180,6 +204,23 @@ function assertSlotAbsent(agent, accountId) {
     }
     return dest;
 }
+/**
+ * True when this device already holds a populated slot directory for the
+ * account. The daemon's auth-sync provisions durable worker slots on its own
+ * (PHNX-3940), so by the time an operator runs `--apply` a worker commonly has
+ * a slot for every account whose legacy per-version home is still on disk.
+ * A regular file at the slot path is NOT a slot: the plan keeps routing such a
+ * home to `slot` so the apply-time guard fails loud on the corruption.
+ */
+function provisionedSlotExists(agent, accountId) {
+    const dest = slotDir(agent, accountId);
+    try {
+        return fs.statSync(dest).isDirectory() && fs.readdirSync(dest).length > 0;
+    }
+    catch {
+        return false;
+    }
+}
 function takenNames(meta) {
     const taken = new Set();
     for (const row of listNativeAccounts(meta)) {
@@ -255,6 +296,42 @@ async function planHarness(agent, deps) {
             });
             continue;
         }
+        if (item.hasCredential && item.accountId && provisionedSlotExists(agent, item.accountId)) {
+            // The account already owns a populated slot on this device, so this
+            // per-version home is a stale copy of a credential the slot now carries.
+            // Routing it to `slot` would only trip `assertSlotAbsent` and abort the
+            // whole apply with nothing done — the state every auth-synced worker was
+            // in. Trash it instead (`agents trash restore` reverses). The canonical
+            // install keeps its binary and ends up with an empty home, exactly as it
+            // does when its home is the one that moves into the slot: two on-disk
+            // copies of one credential is not an end state the migration leaves.
+            if (canonical && item.label === canonical.label) {
+                actions.push({
+                    kind: 'canonical',
+                    label: item.label,
+                    release: item.release,
+                    reason: 'canonical install (binary kept); account already holds a slot — stale home trashed, empty home recreated',
+                    accountId: item.accountId,
+                    identityKey: item.identityKey,
+                    email: item.email,
+                    sessionCount: item.sessionCount,
+                    pathMoves: [{ from: item.home, to: plannedHomeTrashPath(agent, item.label) }],
+                });
+                continue;
+            }
+            actions.push({
+                kind: 'trash',
+                label: item.label,
+                release: item.release,
+                reason: 'account already holds a provisioned slot on this device — stale home trashed',
+                accountId: item.accountId,
+                identityKey: item.identityKey,
+                email: item.email,
+                sessionCount: item.sessionCount,
+                pathMoves: [{ from: item.dir, to: plannedTrashPath(agent, item.label) }],
+            });
+            continue;
+        }
         if (item.hasCredential && item.identityKey) {
             const dest = item.accountId ? slotDir(agent, item.accountId) : slotDir(agent, '<new-account>');
             actions.push({
@@ -494,6 +571,21 @@ export async function applyAccountMigration(agents = [...ALL_AGENT_IDS], deps =
             if (kept)
                 labelToAccount.set(item.label, kept);
         }
+        for (const action of h.actions.filter((a) => a.kind === 'canonical' && a.accountId)) {
+            // Canonical install whose account already holds a slot: hand the stale
+            // home off to the homes trash and leave an empty home behind, mirroring
+            // the slot branch's end state for a canonical home.
+            const item = byLabel.get(action.label);
+            if (!item)
+                throw new Error(`Plan named ${h.agent}@${action.label} but inventory has no such install.`);
+            const trashPath = trashHome(h.agent, item);
+            remaps.push({ from: item.home, to: trashPath });
+            labelToAccount.set(item.label, action.accountId);
+            movedAccountIds.push(action.accountId);
+            entry.trashed.push({ label: item.label, reason: 'stale canonical home — account already holds a provisioned slot', trashPath });
+            manifest.map[`${h.agent}@${item.label}#home`] = trashPath;
+            persistManifest(manifestPath, manifest);
+        }
         for (const action of trashActions) {
             const item = byLabel.get(action.label);
             if (!item)
@@ -504,6 +596,13 @@ export async function applyAccountMigration(agents = [...ALL_AGENT_IDS], deps =
             removeVersionedAlias(h.agent, item.label);
             remaps.push({ from: item.dir, to: trashPath });
             stillPresent.delete(item.label);
+            if (action.accountId) {
+                // A home trashed because its account already holds a slot: anything
+                // bound to this version label follows the account, and the stale
+                // home record clears so spawn resolves through the slot alone.
+                labelToAccount.set(item.label, action.accountId);
+                movedAccountIds.push(action.accountId);
+            }
             entry.trashed.push({ label: item.label, reason: action.reason, trashPath });
             manifest.map[`${h.agent}@${item.label}`] = trashPath;
             persistManifest(manifestPath, manifest);

package/dist/lib/answer-router.d.ts

@@ -32,6 +32,13 @@ export interface AnswerRoute {
         sessionId: string;
         agent: string;
     };
+    /**
+     * Whether to append Enter after the injected payload. Default (omitted) is
+     * true. A cancel keystroke (Escape, from a deny / send-back choice) sets this
+     * false — the ESC byte itself dismisses the prompt, and a trailing newline
+     * would submit a stray empty line into the composer behind it.
+     */
+    enter?: boolean;
 }
 export interface AnswerRouterInput {
     /** Resolved mailbox / session id. */
@@ -56,6 +63,7 @@ export declare function matchOptionIndex(answer: string, options: Array<Pick<Blo
 export declare function keystrokesForAnswer(answer: string, options?: Array<Pick<BlockOption, 'label'>>): {
     payload: string;
     matched: 'option' | 'free-text' | 'other';
+    enter?: boolean;
 };
 /** True when the session is waiting on user input (parked on a question/plan). */
 export declare function isParkedOnInput(session: ActiveSession | null | undefined): boolean;

package/dist/lib/answer-router.js

@@ -1,5 +1,7 @@
 import { addressabilityRecoveryHint } from './terminal/resolve.js';
 import { injectTargetFromReplyRail } from './session/inject.js';
+/** The Escape keystroke as its raw control byte — what a PTY/tmux/iterm rail reads as a real Escape. */
+const ESCAPE_KEY = '\u001b';
 /**
  * Match free-text answer against question options.
  * Exact (case-insensitive) > startsWith > includes. Returns 0-based index or -1.
@@ -31,6 +33,15 @@ export function keystrokesForAnswer(answer, options) {
         // AskUserQuestion / plan select-lists are 1-indexed digits.
         return { payload: `${idx + 1}`, matched: 'option' };
     }
+    // A symbolic cancel token — the `esc` deliveryKey a deny / send-back choice
+    // carries — is the Escape KEY, not the letters "esc". Send the ESC control
+    // byte (a real cancel on every raw pty/tmux/iterm rail) and suppress the
+    // trailing Enter, so the prompt is dismissed rather than confirmed by a stray
+    // newline. Runs after the option match so an option literally labelled "esc"
+    // still wins as a selection.
+    if (/^(?:esc|escape)$/i.test(answer.trim())) {
+        return { payload: ESCAPE_KEY, matched: 'other', enter: false };
+    }
     if (options?.length) {
         const otherIdx = options.findIndex((o) => /^other$/i.test((o.label ?? '').trim()));
         if (otherIdx >= 0) {
@@ -92,7 +103,7 @@ export function resolveAnswerRoute(input) {
         session?.question?.options?.map((o) => ({ label: o.label }));
     if (openQ && parked && session) {
         const inject = injectTargetForSession(session);
-        const { payload, matched } = keystrokesForAnswer(answer, options);
+        const { payload, matched, enter } = keystrokesForAnswer(answer, options);
         if (inject) {
             const kind = inject.backend === 'tmux' ? 'tmux'
                 : inject.backend === 'iterm' ? 'iterm'
@@ -103,6 +114,7 @@ export function resolveAnswerRoute(input) {
                 reason: `Parked on open question — drive ${inject.backend} selection (${matched}).`,
                 payload,
                 inject,
+                ...(enter === false ? { enter: false } : {}),
             };
         }
         // Headless / no rail: re-enter via resume.

package/dist/lib/auth-mint.d.ts

@@ -13,7 +13,7 @@
  * stored and optionally synced. Interactive mint is Claude-only; every other
  * harness fails loud with the command that actually provisions it.
  */
-import type { AgentId } from './types.js';
+import type { AgentId, Meta } from './types.js';
 import { type CredentialAccount } from './account-registry.js';
 import { type StorableCredentialKind } from './secrets-policy.js';
 import { type DriveOptions, type PtyDriver } from './fleet/remote-login.js';
@@ -110,6 +110,27 @@ export declare function seedReservedStoreKey(harness: AgentId, kind: StorableCre
     bundle: string;
     key: string;
 };
+export interface AdoptLegacyReservedItemsResult {
+    adopted: Array<{
+        bundle: string;
+        key: string;
+    }>;
+    errors: Array<{
+        bundle: string;
+        key: string;
+        message: string;
+    }>;
+}
+/**
+ * Adopt reserved-store keys written by 1.22.84–1.22.89 as bare file items (no
+ * bundle record) into the file-backed bundle the daemon push reads. Every
+ * `accounts add codex|grok|cursor` from those releases left its worker key in
+ * that shape on the laptop, unpushable; the item name is the same in both
+ * shapes, so adoption re-seeds the bundle from the raw value in place and
+ * nothing already on a worker changes. Idempotent: a key the bundle already
+ * carries is skipped. Local data repair only — it never talks to a peer.
+ */
+export declare function adoptLegacyReservedStoreItems(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): AdoptLegacyReservedItemsResult;
 /**
  * Create or rotate the named provider account that `agents run --account` and
  * `agents accounts sync` consume. Existing account of a different kind fails

package/dist/lib/auth-mint.js

@@ -1,7 +1,7 @@
 import { resolveAgentName } from './agents.js';
-import { AUTH_BUNDLE, claudeAccountTokenKey, isValidClaudeSetupToken, readClaudeAccountEmail, invalidateClaudeSetupTokenCache, } from './claude-account-token.js';
-import { addAccount, findAccount, readAccountRegistry, setAccountSecret } from './account-registry.js';
-import { bundleBackendSync, bundleExists, bundleExistsSync, keychainRef, pushBundleToHost, readBundleSync, rotateBundleSecretSync, secretsKeychainItem, storeSetSync, writeBundleWithItemsSync, } from './secrets-client.js';
+import { AUTH_BUNDLE, claudeAccountTokenKey, isValidClaudeSetupToken, readClaudeAccountEmail, readReservedCredential, invalidateClaudeSetupTokenCache, } from './claude-account-token.js';
+import { addAccount, findAccount, listNativeAccounts, readAccountRegistry, setAccountSecret } from './account-registry.js';
+import { bundleBackendSync, isSecretsClientError, bundleExists, bundleExistsSync, keychainRef, pushBundleToHost, readBundleSync, rotateBundleSecretSync, secretsKeychainItem, writeBundleWithItemsSync, } from './secrets-client.js';
 import { assertStorableCredentialKind, reservedStoreName, } from './secrets-policy.js';
 import { getBinaryPath, getGlobalDefault, getVersionHomePath, listInstalledVersions } from './installations/versions.js';
 import { shellQuote } from './ssh-exec.js';
@@ -243,13 +243,88 @@ export function seedReservedStoreKey(harness, kind, key, value) {
     const cleaned = value.trim();
     if (!cleaned)
         throw new Error(`Empty ${kind} for reserved store '${name}' key ${key}.`);
-    // A `__<harness>__` reserved store is written and read as raw FILE-backed items,
-    // never as a standalone bundle: the standalone's bundle-name validation rejects
-    // the `__`-wrapped reserved name, so the worker credential rides the raw item
-    // directly, symmetric with how `readReservedCredential` reads it. A first write
-    // and a rotation are the same operation — `store.set` overwrites the item value.
-    storeSetSync('file', secretsKeychainItem(name, key), cleaned);
-    return { bundle: name, key };
+    // A `__<harness>__` reserved store is a real FILE-backed, policy-`never` bundle
+    // — the same shape as the legacy `auth` bundle — because the only transport to
+    // a worker is the ordinary bundle push (`syncReservedStores` →
+    // `pushBundleToHost`), which reads the store as a bundle and imports it
+    // remotely as one. It used to be written as a bare `store.set` item with no
+    // bundle record (the standalone rejected the `__`-wrapped name at the time), so
+    // the push could never read it and no worker received a Cursor/Codex/Grok key.
+    // The item name is unchanged (`agents-cli.secrets.__<harness>__.<KEY>`), so
+    // `readReservedCredential` and every worker that already holds the raw item
+    // keep resolving it. Requires -labs/secrets-cli >= 0.1.1 (reserved-shape
+    // bundle names).
+    const item = secretsKeychainItem(name, key);
+    try {
+        if (bundleExistsSync(name)) {
+            const backend = bundleBackendSync(name);
+            if (backend !== 'file') {
+                throw new Error(`Reserved store '${name}' exists with backend '${backend}', but worker provisioning only reads a FILE-backed store. Recreate it with: agents secrets delete ${name} --yes`);
+            }
+            const bundle = readBundleSync(name);
+            if (key in bundle.vars) {
+                rotateBundleSecretSync(bundle, key, { newValue: cleaned, meta: { type: 'token' } });
+                return { bundle: name, key };
+            }
+            bundle.vars[key] = keychainRef(key);
+            if (!bundle.meta)
+                bundle.meta = {};
+            bundle.meta[key] = { type: 'token' };
+            writeBundleWithItemsSync(bundle, new Map([[item, cleaned]]));
+            return { bundle: name, key };
+        }
+        const bundle = {
+            name,
+            backend: 'file',
+            policy: 'never',
+            description: `Reserved ${harness} worker credentials (${kind}), one key per account; pushed to worker devices by the daemon. Never a native OAuth session.`,
+            vars: { [key]: keychainRef(key) },
+            meta: { [key]: { type: 'token' } },
+        };
+        writeBundleWithItemsSync(bundle, new Map([[item, cleaned]]));
+        return { bundle: name, key };
+    }
+    catch (err) {
+        // A standalone older than 0.1.1 rejects the `__<harness>__` bundle name and
+        // the client only sees a sanitized code. Name the real requirement instead
+        // of leaving `accounts add` to fail with `OPERATION_FAILED`.
+        if (isSecretsClientError(err, 'OPERATION_FAILED')) {
+            throw new Error(`Could not write the reserved store '${name}' as a bundle: ${err.message}. agents-cli needs @phnx-labs/secrets-cli 0.1.1 or newer, which accepts the __<harness>__ bundle name: npm i -g @phnx-labs/secrets-cli@latest`);
+        }
+        throw err;
+    }
+}
+/**
+ * Adopt reserved-store keys written by 1.22.84–1.22.89 as bare file items (no
+ * bundle record) into the file-backed bundle the daemon push reads. Every
+ * `accounts add codex|grok|cursor` from those releases left its worker key in
+ * that shape on the laptop, unpushable; the item name is the same in both
+ * shapes, so adoption re-seeds the bundle from the raw value in place and
+ * nothing already on a worker changes. Idempotent: a key the bundle already
+ * carries is skipped. Local data repair only — it never talks to a peer.
+ */
+export function adoptLegacyReservedStoreItems(meta) {
+    const result = { adopted: [], errors: [] };
+    for (const account of listNativeAccounts(meta)) {
+        const cred = account.workerCredential;
+        if (!cred || !cred.bundle.startsWith('__'))
+            continue;
+        if (cred.kind !== 'setup-token' && cred.kind !== 'api-key')
+            continue;
+        try {
+            if (bundleExistsSync(cred.bundle) && cred.key in readBundleSync(cred.bundle).vars)
+                continue;
+            const value = readReservedCredential(cred.bundle, cred.key);
+            if (value === null)
+                continue;
+            seedReservedStoreKey(account.agent, cred.kind, cred.key, value);
+            result.adopted.push({ bundle: cred.bundle, key: cred.key });
+        }
+        catch (err) {
+            result.errors.push({ bundle: cred.bundle, key: cred.key, message: err.message });
+        }
+    }
+    return result;
 }
 /**
  * Create or rotate the named provider account that `agents run --account` and

package/dist/lib/daemon/attention-notify-service.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Attention desktop banners as a supervised periodic service (PHNX-4004).
+ *
+ * Each tick reconciles this host's live sessions into attention items through
+ * the CLI-owned reconciler (feed/attention.ts — never re-deriving detection) and
+ * posts ONE actionable desktop banner per attention key not yet notified. The
+ * banner carries the category, the attention key, the session id, and the
+ * answerable choices, so the macOS companion can offer Approve / Approve for
+ * session / Deny (permission), the options plus a typed reply (question),
+ * Approve / Send back (plan review), or Open terminal (a stall/failure), and
+ * route the answer back through `agents feed answer <key> --choice <id>`.
+ *
+ * Idempotency is a filesystem ledger, not memory: one sidecar file per notified
+ * key under `~/.agents/.history/feed/notified/`, so a daemon restart never
+ * re-posts a banner already sent — the ledger is the truth. It is pruned with
+ * the feed's 14-day retention rule.
+ *
+ * Reader-independent: unlike the session-state publisher this does NOT gate on a
+ * live `sessions watch` reader — an attention banner must fire whether or not
+ * anyone is watching the stream. `done` banners are deliberately NOT produced
+ * here; they ride the run process's own exit (`run-notify.ts`).
+ */
+import { type ActiveSession } from '../session/active.js';
+import { type AttentionItem } from '../feed/attention.js';
+import { type DesktopNotification } from '../menubar/notify-desktop.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
+import type { DaemonServiceId } from '../daemon-services.js';
+/**
+ * The banner for one attention item, or `undefined` when its kind does not
+ * notify (`done` comes from the run process; `declared`/`review` are surfaced in
+ * the feed, not as a native banner). Pure — the service and its test both build
+ * through here, so what ships is what is asserted.
+ */
+export declare function buildAttentionNotification(item: AttentionItem, session: ActiveSession): DesktopNotification | undefined;
+export interface AttentionNotifyServiceOptions {
+    /** Live-session source (default: the real active-session query). Injected in tests. */
+    getSessions?: () => Promise<ActiveSession[]>;
+    /** Notifier (default: the real desktop notifier). Injected in tests to capture posts. */
+    notify?: (n: DesktopNotification) => void;
+    /** Feed store root (default: the real feed dir). Overridden in tests. */
+    feedRoot?: string;
+    /** Notified-ledger dir (default: `<feedRoot>/notified`). Overridden in tests. */
+    ledgerDir?: string;
+    /** Clock (default: `Date.now`). Injected in tests. */
+    now?: () => number;
+}
+export declare class AttentionNotifyService extends BasePeriodicService {
+    readonly id: DaemonServiceId;
+    readonly intervalMs = 5000;
+    readonly deadlineMs = 10000;
+    private readonly getSessions;
+    private readonly notify;
+    private readonly feedRoot?;
+    private readonly ledgerDir;
+    private readonly now;
+    private lastPruneMs;
+    constructor(opts?: AttentionNotifyServiceOptions);
+    protected onStart(_ctx: DaemonContext): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(ctx: DaemonContext): Promise<void>;
+    /** Filesystem-safe sidecar name for an attention key (`host/session/generation`). */
+    private ledgerPath;
+    private hasNotified;
+    private markNotified;
+    private pruneLedger;
+}