@phnx-labs/agents-cli 1.22.91 → 1.22.93

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.22.93
+
+- **An idle reminder is not a permission request — attention is classified from explicit harness evidence, and time-based signals expire (PHNX-3999).** The fleet feed was rendering Claude's `idle_prompt` Notification ("the turn ended and you have been idle") as a `permission` with Approve/Deny — a session whose whole transcript was "reply with exactly: pong" → "pong" got an approval banner — and the state engine labelled any tool call that had run quietly for two minutes a permission too. Now a `notification` block is a `permission` only when its recorded subtype is `permission_prompt` and the session's transcript corroborates it (no tool result or new turn stamped after the block, process alive); the feed-publish hook no longer publishes `idle_prompt` at all, an `idle_prompt` block left on disk yields no request, an `elicitation_dialog` is a question with no invented buttons, and a pending tool call reads as `working` however long it has run. One unresolved record per `host/session/generation` is resolved by later evidence — a transcript event after the block, or a dead process — never by dismissing the banner. What the CLI cannot confirm (a stale hook block with no transcript cursor to check, a notification with no recorded subtype, an older peer's elapsed-time `permission` claim) is the new `unverified` kind: the banner and the `feed watch` stream say "Could not verify request" with an Open terminal action only, and `agents feed answer` refuses it. `computeLiveSignals` now memoizes only the parsed transcript tail on mtime and re-classifies against the current clock every call, so the 30-minute prose-question decay expires on schedule instead of freezing until someone types; rows carry `lastEventMs`, the harness stamp on the last meaningful event. Source: `cli/src/lib/feed/attention.ts`, `cli/src/lib/session/state.ts`, `cli/src/lib/session/active.ts`, `cli/src/lib/feed/feed.ts`, `cli/src/lib/feed/answer.ts`, `cli/src/lib/daemon/attention-notify-service.ts`.
+
+- **AGI Menu 1.1.1: three fixed tabs (PHNX-3999, PHNX-4036).** The `menubar` helper floor moves to 1.1.1, the first release cut from phnx-labs/agi-menu: the status item opens a popover with Sessions (working first, then confirmed requests), Projects (the tracker's projects → milestones with cycle chips → issues, expanding in place, from one `linear projects overview --json` call) and Settings, replacing the long dropdown. Fresh installs and `agents menubar setup` fetch it from the public `menubar/v1.1.1` release. Source: `cli/src/lib/helper-versions.ts`.
+
+- **AGI Menu moved out — the menu-bar helper now lives in `phnx-labs/agi-menu` (PHNX-4036).** `cli/menubar/` (the SwiftPM source, its build/test scripts, and the build-text test) is gone from this repo, the same split AGI EXT got in RUSH-3189. Nothing user-facing changes: `agents menubar setup`/`enable` still download and verify the signed, notarized `MenubarHelper.app.zip` from the `menubar/v<floor>` release tag (`src/lib/helper-versions.ts`), at the same URL, with the same bundle identity and designated-requirement pin — that release is now cut by agi-menu's `scripts/release.sh`, which also uploads a `menubar-source.txt` provenance sidecar. Release tooling never builds the helper again: a new `scripts/stage-menubar-helper.sh` downloads the published `menubar/v<floor>` asset, verifies its sha256, and (on macOS) extracts it into `bin/MenubarHelper.app` behind `codesign --verify --deep --strict`, `spctl --assess`, and the DR-pin gate (`scripts/verify-menubar-helper.sh`, no longer a prepack gate); `--fetch-only` downloads and sha-verifies on any OS. `release-attestation-produce.sh --with-helpers` records the menubar helper-manifest row from that published asset (asset digest = sha256 of the zip, `source` = the sidecar's repo/commit/tag when the release carries one) instead of a fresh build, keyed on `src/lib/helper-versions.ts` as its input — a floor bump is what re-records it; a missing or corrupt release fails closed naming the agi-menu publish step. `remote-sign-mac.sh` stages the published helper on the home base instead of running `swift build`. The installer's dead `cli/menubar/dist/` source candidate is removed; `bin/MenubarHelper.app` (staged, or copied from an agi-menu checkout) remains the working-tree source. Source: `cli/scripts/stage-menubar-helper.sh`, `cli/scripts/release-manifest.sh`, `cli/scripts/release-attestation-produce.sh`, `cli/scripts/remote-sign-mac.sh`, `cli/src/lib/menubar/download-menubar.ts`.
+
+- **A Claude account-slot launch now runs in its own slot home, and worker slots come pre-onboarded (PHNX-3940 follow-up).** `agents run claude --device <worker>` picked an account slot and pinned `CLAUDE_CONFIG_DIR` to it, but the versioned alias (`~/.agents/.cache/shims/claude@<version>`) re-exported the shared version home unconditionally, so the run authenticated as the picked account (the setup-token env survived) while reading and writing config, onboarding state and history in whatever home the version carried — on yosemite-m1 that home belonged to another account and had never onboarded, so every dispatched run opened on Claude Code's theme picker. `buildExecEnv` now stamps a slot launch in `AGENTS_EXEC_HOME`; every shim that pins a config-dir env (claude, grok, opencode, kimi, muse, copilot — bare shim and direct alias, schema 32 / alias 21 — the daemon self-heal or `agents doctor --fix` regenerates on-disk copies) yields its pin to that slot through one shared `slotAwareConfigEnvBash` and consumes the marker before `exec`, so a nested launch never inherits its parent's slot and a bare `<agent>@<version>` from a terminal still gets the version home; the same override was live for all six, codex and cursor already yielded. A re-seed that still reads as unseeded (a slot config file that exists but cannot be parsed) is reported as an error each tick instead of a false "provisioned". Separately, `provisionWorkerSlot` seeded only the identity email into a slot's `.claude.json`, never `hasCompletedOnboarding` — a worker has no human to finish onboarding — so every provisioned slot re-onboarded; it now seeds both, and the daemon's `reconcileLocalWorkerSlots` re-provisions a durable claude slot that lacks either instead of skipping it as "already provisioned", so the slots provisioned before this converge on the next tick. Source: `cli/src/lib/harness/adapter.ts`, `cli/src/lib/harness/adapters/*.ts`, `cli/src/lib/exec.ts`, `cli/src/lib/installations/shims.ts`, `cli/src/lib/claude-account-token.ts`, `cli/src/lib/secrets-policy.ts`, `cli/docs/credential-management.md`.
+
+## 1.22.92
+
+- **AGI Menu 1.1.0 is the helper the CLI installs (PHNX-4007).** The menu-bar
+  helper floor moves from 1.0.0 to 1.1.0, so `agents menubar setup` and
+  `agents menubar enable` download and install the release that carries the
+  dispatch form, the Sessions window, actionable notification banners, the
+  screenshot OCR index, and the FeedStream data layer (PHNX-3999). The startup
+  self-heal stays network-free: it reinstalls only from a bundled or cached copy,
+  so an existing 1.0.0 install upgrades on the next `agents menubar setup`.
+  Source: `src/lib/helper-versions.ts`.
+
 ## 1.22.91
 
 - **`agents sessions` search/list execs the standalone `sessions` CLI (PHNX-4012).** Read queries intercept in `index.ts` before bootstrap so they skip the 6K-line in-process engine. Lifecycle verbs (`resume`, `stop`, `inject`, `watch`, `--active`, `--markdown`) still load the in-repo command. The `sessions` alias shim is retired like `secrets` so it cannot recurse. Install: `npm i -g @phnx-labs/sessions-cli`. Source: `cli/src/index.ts`, `cli/src/lib/sessions-client.ts`, `cli/scripts/postinstall.js`.

package/README.md

@@ -1577,6 +1577,11 @@ duplicate icon. `agents menubar setup` is the recovery command when a machine is
 already wrong -- it ends any duplicate, installs the bundle, wires the login
 item, and verifies exactly one helper came back up.
 
+The helper itself is AGI Menu, developed in
+[phnx-labs/agi-menu](https://github.com/phnx-labs/agi-menu) and published as a
+signed, notarized build on this repo's `menubar/v<x.y.z>` releases; the CLI
+downloads and verifies it on demand, so nothing is built on your machine.
+
 The dropdown surfaces a **NEEDS YOU** queue (agents waiting on a question, a plan review, or a permission prompt), the running roster, and a routines summary -- the same live state as `agents sessions --active`, one click away.
 
 ### Quick-issue bar (⌘⇧O)

package/dist/commands/exec.js

@@ -2234,7 +2234,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 // dispatch time; the peer resolves ITS slot. This block is local-only.
                 const remoteTarget = options.host || options.device;
                 if (!remoteTarget) {
-                    const { adoptedConfigPointsAtHome, adoptedSymlinkMismatchError, isSymlinkAdoptedHarness, resolveNativeSpawnHome, symlinkAdoptedAccountError, } = await import('../lib/exec-account-home.js');
+                    const { adoptedConfigPointsAtHome, adoptedSymlinkMismatchError, durableSlotEnv, isSymlinkAdoptedHarness, resolveNativeSpawnHome, symlinkAdoptedAccountError, } = await import('../lib/exec-account-home.js');
                     const { readMeta } = await import('../lib/state.js');
                     const meta = readMeta();
                     if (isSymlinkAdoptedHarness(agent)) {
@@ -2251,6 +2251,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                             process.exit(1);
                         }
                         execHome = resolved.execHome;
+                        // A worker's durable api-key slot holds no file: the pushed key
+                        // rides the harness env var (CURSOR_API_KEY, …) on this launch.
+                        const durable = durableSlotEnv(agent, spawnAccount, resolved, meta);
+                        if (Object.keys(durable).length > 0)
+                            accountEnv = { ...accountEnv, ...durable };
                         if (resolved.source === 'legacy-home') {
                             accountConfigVersion = resolved.label;
                             // A leftover version-labeled home is both the spawn HOME and

package/dist/lib/claude-account-token.d.ts

@@ -91,4 +91,17 @@ export declare function readReservedCredential(bundle: string, key: string): str
  * token on this device rather than recording a slot that cannot authenticate.
  */
 export declare function provisionWorkerSlot(account: NativeAccountRecord): DeviceAccountSlot;
+/**
+ * True when a claude worker slot carries everything provisioning seeds: the
+ * identity email AND the completed-onboarding flag. A slot provisioned before
+ * onboarding was seeded answers false, so the daemon's reconcile re-seeds it.
+ */
+export declare function isClaudeWorkerHomeSeeded(home: string): boolean;
+/**
+ * Seed a worker slot's `.claude.json` (both locations Claude Code reads) with
+ * the account identity AND `hasCompletedOnboarding`. A worker never has a human
+ * at it, so nothing else can complete Claude Code's first-run onboarding (theme
+ * picker, "Let's get started"); without the flag every slot launch re-onboarded.
+ * Everything else in the document is preserved.
+ */
 export declare function seedClaudeWorkerHomeIdentity(versionHome: string, email: string): void;

package/dist/lib/claude-account-token.js

@@ -366,6 +366,34 @@ export function provisionWorkerSlot(account) {
     recordSlot(account.id, record);
     return record;
 }
+/**
+ * True when a claude worker slot carries everything provisioning seeds: the
+ * identity email AND the completed-onboarding flag. A slot provisioned before
+ * onboarding was seeded answers false, so the daemon's reconcile re-seeds it.
+ */
+export function isClaudeWorkerHomeSeeded(home) {
+    for (const p of [path.join(home, '.claude', '.claude.json'), path.join(home, '.claude.json')]) {
+        try {
+            const doc = JSON.parse(fs.readFileSync(p, 'utf-8'));
+            const email = doc.oauthAccount?.emailAddress;
+            if (doc.hasCompletedOnboarding !== true)
+                return false;
+            if (typeof email !== 'string' || email.trim().length === 0)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Seed a worker slot's `.claude.json` (both locations Claude Code reads) with
+ * the account identity AND `hasCompletedOnboarding`. A worker never has a human
+ * at it, so nothing else can complete Claude Code's first-run onboarding (theme
+ * picker, "Let's get started"); without the flag every slot launch re-onboarded.
+ * Everything else in the document is preserved.
+ */
 export function seedClaudeWorkerHomeIdentity(versionHome, email) {
     const trimmed = email.trim();
     if (!trimmed)
@@ -389,6 +417,7 @@ export function seedClaudeWorkerHomeIdentity(versionHome, email) {
             ? doc.oauthAccount
             : {});
         doc.oauthAccount = { ...existing, emailAddress: trimmed };
+        doc.hasCompletedOnboarding = true;
         fs.mkdirSync(path.dirname(p), { recursive: true });
         // Temp-write + rename: a reader mid-write never sees a truncated doc.
         const tmp = `${p}.agents-${process.pid}.tmp`;

package/dist/lib/daemon/attention-notify-service.d.ts

@@ -7,8 +7,11 @@
  * banner carries the category, the attention key, the session id, and the
  * answerable choices, so the macOS companion can offer Approve / Approve for
  * session / Deny (permission), the options plus a typed reply (question),
- * Approve / Send back (plan review), or Open terminal (a stall/failure), and
- * route the answer back through `agents feed answer <key> --choice <id>`.
+ * Approve / Send back (plan review), or Open terminal (a stall/failure, or a
+ * request the CLI could not verify is still pending), and route the answer back
+ * through `agents feed answer <key> --choice <id>`. The kind — and so the button
+ * set — is the reconciler's verdict from explicit harness evidence; an idle
+ * reminder never reaches here as a permission (PHNX-3999).
  *
  * Idempotency is a filesystem ledger, not memory: one sidecar file per notified
  * key under `~/.agents/.history/feed/notified/`, so a daemon restart never

package/dist/lib/daemon/attention-notify-service.js

@@ -7,8 +7,11 @@
  * banner carries the category, the attention key, the session id, and the
  * answerable choices, so the macOS companion can offer Approve / Approve for
  * session / Deny (permission), the options plus a typed reply (question),
- * Approve / Send back (plan review), or Open terminal (a stall/failure), and
- * route the answer back through `agents feed answer <key> --choice <id>`.
+ * Approve / Send back (plan review), or Open terminal (a stall/failure, or a
+ * request the CLI could not verify is still pending), and route the answer back
+ * through `agents feed answer <key> --choice <id>`. The kind — and so the button
+ * set — is the reconciler's verdict from explicit harness evidence; an idle
+ * reminder never reaches here as a permission (PHNX-3999).
  *
  * Idempotency is a filesystem ledger, not memory: one sidecar file per notified
  * key under `~/.agents/.history/feed/notified/`, so a daemon restart never
@@ -47,6 +50,10 @@ const BANNER_KINDS = {
     plan_review: { category: 'plan_review', label: 'Plan review' },
     stall: { category: 'failure', label: 'Failed' },
     failure: { category: 'failure', label: 'Failed' },
+    // A request record the CLI could not confirm is still pending: the `failure`
+    // category is the companion's one button set with no approval action — just
+    // Open terminal — which is exactly the honest offer here.
+    unverified: { category: 'failure', label: 'Could not verify request' },
 };
 function shorten(text, max = BODY_MAX) {
     const flat = text.replace(/\s+/g, ' ').trim();

package/dist/lib/exec-account-home.d.ts

@@ -1,3 +1,4 @@
+import { selfConfiguredDeviceRole } from './device-config.js';
 import { isSymlinkAdoptedHarness } from './installations/shims.js';
 import type { AgentId, DeviceAccountSlot, Meta } from './types.js';
 export { isAccountSlotDir } from './agents.js';
@@ -10,6 +11,24 @@ export interface NativeSpawnHome {
     /** Installation label when `source` is `legacy-home`. */
     label?: string;
 }
+/**
+ * The env a DURABLE slot injects at spawn (PHNX-3940 T5/T6). A worker's slot
+ * for an api-key harness (codex/grok/cursor/opencode/droid) holds no file — the
+ * daemon pushed the account's worker API key into the reserved
+ * `__<harness>__` store and `provisionWorkerSlot` recorded the slot as
+ * `durable`; the key rides the harness's own env var (`CURSOR_API_KEY`, …)
+ * on every launch. Anything else — a native login in the slot on a headed
+ * device, a claude durable slot (its setup-token is a `.oauth_token` file the
+ * adapter reads), a harness with no api-key worker kind, a headed device — injects
+ * nothing.
+ * Without this, `agents run cursor#gmail` on a worker reached Cursor with an
+ * empty env and got `Authentication required … set CURSOR_API_KEY`.
+ */
+export declare function durableSlotEnv(agent: AgentId, account: {
+    id: string;
+}, resolved: Pick<NativeSpawnHome, 'slot'>, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, deps?: {
+    selfRole?: () => ReturnType<typeof selfConfiguredDeviceRole>;
+}): Record<string, string>;
 export declare function missingSlotHint(agent: AgentId, name: string): string;
 export declare function symlinkAdoptedAccountError(agent: AgentId, name: string, defaultName: string | undefined): string;
 export declare function adoptedSymlinkMismatchError(agent: AgentId, name: string, execHome: string): string;

package/dist/lib/exec-account-home.js

@@ -13,7 +13,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { listNativeAccounts, nativeAccountHome } from './account-registry.js';
 import { readSlots } from './accounts/slots.js';
-import { workerProvisioningHint } from './accounts/add.js';
+import { workerProvisioningHint, workerApiKeyEnv } from './accounts/add.js';
 import { AGENTS, credentialPresence, getAccountInfo } from './agents.js';
 import { AUTH_BUNDLE, claudeAccountTokenKey, provisionWorkerSlot, readReservedCredential } from './claude-account-token.js';
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
@@ -22,6 +22,40 @@ import { getAgentConfigPath, isSymlinkAdoptedHarness, repointAdoptedConfigToHome
 import { getVersionHomePath, listInstalledVersions } from './installations/versions.js';
 export { isAccountSlotDir } from './agents.js';
 export { isSymlinkAdoptedHarness };
+/**
+ * The env a DURABLE slot injects at spawn (PHNX-3940 T5/T6). A worker's slot
+ * for an api-key harness (codex/grok/cursor/opencode/droid) holds no file — the
+ * daemon pushed the account's worker API key into the reserved
+ * `__<harness>__` store and `provisionWorkerSlot` recorded the slot as
+ * `durable`; the key rides the harness's own env var (`CURSOR_API_KEY`, …)
+ * on every launch. Anything else — a native login in the slot on a headed
+ * device, a claude durable slot (its setup-token is a `.oauth_token` file the
+ * adapter reads), a harness with no api-key worker kind, a headed device — injects
+ * nothing.
+ * Without this, `agents run cursor#gmail` on a worker reached Cursor with an
+ * empty env and got `Authentication required … set CURSOR_API_KEY`.
+ */
+export function durableSlotEnv(agent, account, resolved, meta, deps = {}) {
+    if (resolved.slot?.authMode !== 'durable')
+        return {};
+    // A headed device authenticates from its own native login (invariant 7). A
+    // `durable` record can outlive a role change (`agents devices role … personal`
+    // never rewrites slots), so the gate is the box's CURRENT role, the same
+    // predicate `isProvisionableWorker` applies — never a record on disk.
+    if (isHeadedDeviceRole((deps.selfRole ?? selfConfiguredDeviceRole)()))
+        return {};
+    const envName = workerApiKeyEnv(agent);
+    if (!envName)
+        return {};
+    const row = nativeRow(account.id, meta);
+    const cred = row?.workerCredential;
+    if (!cred || cred.kind !== 'api-key')
+        return {};
+    const value = readReservedCredential(cred.bundle, cred.key);
+    if (!value)
+        return {};
+    return { [envName]: value };
+}
 export function missingSlotHint(agent, name) {
     const role = selfConfiguredDeviceRole();
     if (!isHeadedDeviceRole(role)) {

package/dist/lib/exec.js

@@ -425,6 +425,17 @@ export function buildExecEnv(options) {
     if (options.cwd) {
         result.AGENTS_CWD = options.cwd;
     }
+    // An account-slot launch (PHNX-3940 T5) tells the versioned alias which
+    // HOME-shaped dir owns this run's config, so the alias's version-home pin
+    // (claude: CLAUDE_CONFIG_DIR) yields to the slot instead of overriding the
+    // adapter's pin above. Set only for a slot launch and cleared otherwise, so a
+    // run spawned from inside a slot session never inherits its parent's slot.
+    if (options.execHome) {
+        result.AGENTS_EXEC_HOME = options.execHome;
+    }
+    else {
+        delete result.AGENTS_EXEC_HOME;
+    }
     // Export the run's durable name (companion to AGENT_SESSION_ID) so a
     // SessionStart hook / the agent can associate its transcript with the handle
     // the user gave the run. Only set when --name was passed.

package/dist/lib/feed/answer.js

@@ -19,6 +19,10 @@ function blockFromAttention(attention, session) {
         state: 'open', sourceCursor: attention.sourceCursor, project: attention.project,
         ts: attention.openedAt, questions: [attention.question ?? { text: 'Continue from this attention item.' }],
         kind: attention.kind === 'permission' ? 'notification' : attention.kind === 'declared' ? 'declared' : attention.source === 'system' ? 'control' : 'question',
+        // A notification block is a permission only by its recorded subtype
+        // (attention.ts kindFromNotification), so the reconstructed block must carry
+        // it or a re-read classifies the same item as unverified.
+        ...(attention.kind === 'permission' ? { notificationType: 'permission_prompt' } : {}),
         safeDefault: attention.safeDefault,
     };
 }
@@ -30,6 +34,11 @@ async function resolveBlock(attentionKey, sessions, root) {
         let block = readBlock(blockIdForSession(session.sessionId), root);
         const projectedSession = { ...session, host: ownerHost };
         const attention = reconcileAttention({ block, session: projectedSession, pullRequest: await readPullRequestStatus(session), resolution: readResolution(blockIdForSession(session.sessionId), root), nowMs: Date.now() });
+        if (attention?.key === attentionKey && attention.kind === 'unverified') {
+            // No confirmed prompt to land a reply in: an answer typed into the session
+            // could hit an empty prompt line or a different dialog (PHNX-3999).
+            throw new Error(`'${attentionKey}' could not be verified as a pending request — open the session and answer it there.`);
+        }
         if (attention?.key === attentionKey && block)
             return { block, attention };
         // The winning caller advances the block to answered before a concurrent

package/dist/lib/feed/attention.d.ts

@@ -1,7 +1,15 @@
 import type { ActiveSession } from '../session/active.js';
 import { type AttentionResolution, type AttentionSource, type AttentionState, type BlockOption, type BlockQuestion, type OpenBlock, type SourceCursor } from './feed.js';
-/** What an attention item is asking of the operator. */
-export type AttentionKind = 'question' | 'permission' | 'plan_review' | 'declared' | 'failure' | 'stall' | 'review';
+/**
+ * What an attention item is asking of the operator. `unverified` is a request
+ * record whose pending state this CLI could not confirm — a hook-raised prompt
+ * with no transcript cursor to check it against that has aged past
+ * {@link UNVERIFIED_PROMPT_AGE_MS}, a notification whose subtype the writer did
+ * not record, or a lifecycle `permission` claim from a peer running an older
+ * state engine. It carries no choices: the only honest action is to open the
+ * session and look (PHNX-3999).
+ */
+export type AttentionKind = 'question' | 'permission' | 'plan_review' | 'declared' | 'failure' | 'stall' | 'review' | 'unverified';
 /** How an answer can be routed back to the waiting agent. */
 export type ReplyCapability = 'terminal' | 'tmux' | 'cloud' | 'team' | 'none';
 /**
@@ -70,6 +78,14 @@ export interface PullRequestAttentionSignal {
 export declare function attentionFingerprint(kind: AttentionKind, question?: BlockQuestion): string;
 /** Harness id behind a session — the profile name when set, else the host process. */
 export declare function harnessOf(session: ActiveSession): string;
+/**
+ * How long a hook-raised permission prompt is trusted on the hook's word alone
+ * when the session offers no transcript cursor to verify it against (a cloud or
+ * remote row, or a peer running an older CLI). Past this age with nothing to
+ * check, the record is `unverified`: the banner keeps the session findable but
+ * offers no Approve.
+ */
+export declare const UNVERIFIED_PROMPT_AGE_MS: number;
 /**
  * Reconcile the feed block ledger, the session lifecycle, a CLI-supplied PR
  * signal, and the latest resolution tombstone into one attention item — or

package/dist/lib/feed/feed.d.ts

@@ -94,7 +94,11 @@ export interface OpenBlock {
     /**
      * How this block came to exist.
      *   question     — an AskUserQuestion the harness surfaced
-     *   notification — a permission/idle prompt the harness raised
+     *   notification — a prompt the harness raised; `notificationType` names
+     *                  which (`permission_prompt`, `elicitation_dialog`). An
+     *                  `idle_prompt` is not published — it says the turn ended,
+     *                  not that anything is pending (PHNX-3999); a block of that
+     *                  type left on disk by an older hook is not a request either.
      *   control      — a synthetic card the feed itself computed (runaway, needy)
      *   declared     — the AGENT decided it is stuck and said so (`feed post --blocked`)
      *
@@ -342,7 +346,7 @@ export declare function removeBlock(blockId: string, root?: string): boolean;
  * Embedded so it ships with the compiled CLI and can be installed to the
  * CLI-writable user hooks dir without a separate file in the npm tarball.
  */
-export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"idle_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef project_from_cwd(cwd):\n    \"\"\"Basename of cwd, with worktree paths resolved to their repo name.\"\"\"\n    if not cwd:\n        return None\n    norm = cwd.replace(\"\\\\\", \"/\").rstrip(\"/\")\n    if not norm:\n        return None\n    marker = \"/.agents/worktrees/\"\n    idx = norm.find(marker)\n    if idx > 0:\n        repo_path = norm[:idx]\n        base = repo_path[repo_path.rfind(\"/\") + 1:]\n        if base:\n            return base\n    base = norm[norm.rfind(\"/\") + 1:]\n    return base or None\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A declared block (`agents feed post --blocked`) is the agent explicitly\n        # saying it is stuck. Unlike a question/notification/approval block -- which\n        # tracks an in-flight harness prompt that a lifecycle event resolves -- a\n        # declared block stays open until it is actually ANSWERED. So while it is\n        # still UNANSWERED, Stop/SessionEnd/PostToolUse must never silently drop it:\n        # otherwise the needs-you record vanishes the moment the agent parks the block\n        # and its turn ends -- exactly when the owner still needs to see and answer it.\n        # Once it IS answered (an answered marker exists), it clears like any other\n        # block by falling through below -- which frees that marker too, so a later\n        # `--blocked` in the same session is not falsely locked as already-answered\n        # (recordAnswer creates the marker with O_EXCL).\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            answered = os.path.exists(os.path.join(answered_dir, f\"{block_id}.json\"))\n            if existing.get(\"kind\") == \"declared\" and not answered:\n                return\n        except Exception:\n            pass\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    # A resolution tombstone is written BEFORE unlink (matching TS recordAnswer)\n    # so a stale lifecycle re-read cannot resurrect this generation.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        now_iso = datetime.now(timezone.utc).isoformat()\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": now_iso,\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Tombstone first, then drop the open-block view. A missing/corrupt\n        # block means there is nothing to resolve; fail open.\n        existing = read_json(target)\n        if isinstance(existing, dict):\n            generation = existing.get(\"generation\") or existing.get(\"ts\")\n            if generation:\n                tombstone = {\n                    \"blockId\": block_id,\n                    \"generation\": generation,\n                    \"resolvedAt\": now_iso,\n                    \"reason\": \"answered\",\n                }\n                source_cursor = existing.get(\"sourceCursor\")\n                if source_cursor:\n                    tombstone[\"sourceCursor\"] = source_cursor\n                write_json(\n                    os.path.join(feed_dir, \"resolutions\", f\"{block_id}.json\"),\n                    tombstone,\n                )\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so AGI EXT can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now = datetime.now(timezone.utc)\n    now_iso = now.isoformat()\n    now_ms = int(now.timestamp() * 1000)\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    project = project_from_cwd(cwd)\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        # Write-time cursor so a new generation is not suppressed when\n        # session.lastActivityMs is unresolvable (cloud / remote / index-lag).\n        \"sourceCursor\": {\"lastActivityMs\": now_ms},\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if project:\n        block[\"project\"] = project\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
+export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\n# Notification subtypes that mean something is PENDING. Claude's idle_prompt is\n# deliberately absent: it fires a minute after the turn ended with the operator\n# idle, which is a finished turn, not a request -- publishing it put an\n# Approve/Deny banner on a session that had already answered \"pong\" (PHNX-3999).\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef project_from_cwd(cwd):\n    \"\"\"Basename of cwd, with worktree paths resolved to their repo name.\"\"\"\n    if not cwd:\n        return None\n    norm = cwd.replace(\"\\\\\", \"/\").rstrip(\"/\")\n    if not norm:\n        return None\n    marker = \"/.agents/worktrees/\"\n    idx = norm.find(marker)\n    if idx > 0:\n        repo_path = norm[:idx]\n        base = repo_path[repo_path.rfind(\"/\") + 1:]\n        if base:\n            return base\n    base = norm[norm.rfind(\"/\") + 1:]\n    return base or None\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A declared block (`agents feed post --blocked`) is the agent explicitly\n        # saying it is stuck. Unlike a question/notification/approval block -- which\n        # tracks an in-flight harness prompt that a lifecycle event resolves -- a\n        # declared block stays open until it is actually ANSWERED. So while it is\n        # still UNANSWERED, Stop/SessionEnd/PostToolUse must never silently drop it:\n        # otherwise the needs-you record vanishes the moment the agent parks the block\n        # and its turn ends -- exactly when the owner still needs to see and answer it.\n        # Once it IS answered (an answered marker exists), it clears like any other\n        # block by falling through below -- which frees that marker too, so a later\n        # `--blocked` in the same session is not falsely locked as already-answered\n        # (recordAnswer creates the marker with O_EXCL).\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            answered = os.path.exists(os.path.join(answered_dir, f\"{block_id}.json\"))\n            if existing.get(\"kind\") == \"declared\" and not answered:\n                return\n        except Exception:\n            pass\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    # A resolution tombstone is written BEFORE unlink (matching TS recordAnswer)\n    # so a stale lifecycle re-read cannot resurrect this generation.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        now_iso = datetime.now(timezone.utc).isoformat()\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": now_iso,\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Tombstone first, then drop the open-block view. A missing/corrupt\n        # block means there is nothing to resolve; fail open.\n        existing = read_json(target)\n        if isinstance(existing, dict):\n            generation = existing.get(\"generation\") or existing.get(\"ts\")\n            if generation:\n                tombstone = {\n                    \"blockId\": block_id,\n                    \"generation\": generation,\n                    \"resolvedAt\": now_iso,\n                    \"reason\": \"answered\",\n                }\n                source_cursor = existing.get(\"sourceCursor\")\n                if source_cursor:\n                    tombstone[\"sourceCursor\"] = source_cursor\n                write_json(\n                    os.path.join(feed_dir, \"resolutions\", f\"{block_id}.json\"),\n                    tombstone,\n                )\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so AGI EXT can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now = datetime.now(timezone.utc)\n    now_iso = now.isoformat()\n    now_ms = int(now.timestamp() * 1000)\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    project = project_from_cwd(cwd)\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        # Write-time cursor so a new generation is not suppressed when\n        # session.lastActivityMs is unresolvable (cloud / remote / index-lag).\n        \"sourceCursor\": {\"lastActivityMs\": now_ms},\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if project:\n        block[\"project\"] = project\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
 /** Manifest entry for the feed-publish hook, matching the ManifestHook shape. */
 export declare const FEED_PUBLISH_HOOK_MANIFEST: {
     name: string;

package/dist/lib/feed/feed.js

@@ -533,9 +533,12 @@ import socket
 import tempfile
 from datetime import datetime, timezone
 
+# Notification subtypes that mean something is PENDING. Claude's idle_prompt is
+# deliberately absent: it fires a minute after the turn ended with the operator
+# idle, which is a finished turn, not a request -- publishing it put an
+# Approve/Deny banner on a session that had already answered "pong" (PHNX-3999).
 WAITING_NOTIFICATION_TYPES = {
     "permission_prompt",
-    "idle_prompt",
     "elicitation_dialog",
 }
 CLEAR_EVENTS = {
@@ -921,7 +924,7 @@ export const FEED_PUBLISH_HOOK_MANIFEST = {
 export const FEED_NOTIFICATION_HOOK_MANIFEST = {
     name: 'feed-publish-notification',
     events: ['Notification'],
-    matcher: 'permission_prompt|idle_prompt|elicitation_dialog',
+    matcher: 'permission_prompt|elicitation_dialog',
     script: '10-feed-publish.py',
     timeout: 5,
 };
@@ -980,10 +983,13 @@ export function ensureFeedPublishHook(userAgentsDir = getUserAgentsDir()) {
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
+            // idle_prompt is not matched: an idle reminder is a finished turn, not a
+            // pending request (PHNX-3999). An installed agents.yaml that still carries
+            // the old matcher is harmless -- the script drops the subtype itself.
             'feed-publish-notification': {
                 agents: ['claude', 'codex'],
                 events: ['Notification'],
-                matcher: 'permission_prompt|idle_prompt|elicitation_dialog',
+                matcher: 'permission_prompt|elicitation_dialog',
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
@@ -1007,7 +1013,7 @@ export function ensureFeedPublishHook(userAgentsDir = getUserAgentsDir()) {
             // never fires PermissionRequest, so it has no approval card to clear here,
             // and a matcher-less PostToolUse for Claude would (1) re-run the script on
             // every tool completion and (2) wipe Claude's notification-kind blocks
-            // (permission_prompt/idle_prompt/elicitation_dialog) the moment any later
+            // (permission_prompt/elicitation_dialog) the moment any later
             // tool runs, instead of letting them persist to Stop/SessionEnd like they
             // did before RUSH-2039. Registering it for codex alone keeps Claude's
             // card lifetime exactly as it was.

package/dist/lib/harness/adapter.d.ts

@@ -162,6 +162,29 @@ export declare const CONFIG_DIR_ENV_KEYS: readonly ["CLAUDE_CONFIG_DIR", "CODEX_
  * (the default / no-config-dir harness) deletes all of them — the old `else` arm.
  */
 export declare function stripForeignConfigDir(result: NodeJS.ProcessEnv, keep?: readonly string[]): void;
+/**
+ * Bash for a harness's config-dir pin that yields to an account-slot launch.
+ *
+ * A shim (bare or `<agent>@<version>` alias) pins the harness's config-dir env
+ * at the version home. An account-slot launch (PHNX-3940 T5) has already chosen
+ * the HOME-shaped slot: `agents run` pins the same env at the slot in
+ * buildExecEnv and stamps the slot in AGENTS_EXEC_HOME. The shim used to
+ * re-export the version home unconditionally, so a run picked as one account
+ * read and wrote another account's home (claude on yosemite-m1, 2026-09-10;
+ * the same override for every harness below). The pin now yields to the slot
+ * — the way the cursor alias's HOME swap yields to a spawner-chosen HOME — and
+ * consumes the marker so the launched harness never inherits it into a nested
+ * launch; a bare `<agent>@<version>` from a terminal still gets the version home.
+ *
+ * `pins` are `{ env, rel }` with `rel` the HOME-relative config path (the slot
+ * and the version home are both HOME-shaped); `versionHome` is the bash
+ * expression for the version home (`$VERSION_DIR/home` in the shared block, the
+ * absolute versions path in a direct alias).
+ */
+export declare function slotAwareConfigEnvBash(pins: ReadonlyArray<{
+    env: string;
+    rel: string;
+}>, versionHome: string): string;
 export declare function registerHarnessAdapter(adapter: HarnessAdapter): void;
 /**
  * The behavior adapter for a harness. Every `AgentId` resolves to an adapter —

package/dist/lib/harness/adapter.js

@@ -25,6 +25,35 @@ export function stripForeignConfigDir(result, keep = []) {
             delete result[key];
     }
 }
+/**
+ * Bash for a harness's config-dir pin that yields to an account-slot launch.
+ *
+ * A shim (bare or `<agent>@<version>` alias) pins the harness's config-dir env
+ * at the version home. An account-slot launch (PHNX-3940 T5) has already chosen
+ * the HOME-shaped slot: `agents run` pins the same env at the slot in
+ * buildExecEnv and stamps the slot in AGENTS_EXEC_HOME. The shim used to
+ * re-export the version home unconditionally, so a run picked as one account
+ * read and wrote another account's home (claude on yosemite-m1, 2026-09-10;
+ * the same override for every harness below). The pin now yields to the slot
+ * — the way the cursor alias's HOME swap yields to a spawner-chosen HOME — and
+ * consumes the marker so the launched harness never inherits it into a nested
+ * launch; a bare `<agent>@<version>` from a terminal still gets the version home.
+ *
+ * `pins` are `{ env, rel }` with `rel` the HOME-relative config path (the slot
+ * and the version home are both HOME-shaped); `versionHome` is the bash
+ * expression for the version home (`$VERSION_DIR/home` in the shared block, the
+ * absolute versions path in a direct alias).
+ */
+export function slotAwareConfigEnvBash(pins, versionHome) {
+    const slot = pins.map((p) => `  export ${p.env}="$AGENTS_EXEC_HOME/${p.rel}"`).join('\n');
+    const version = pins.map((p) => `  export ${p.env}="${versionHome}/${p.rel}"`).join('\n');
+    return `if [ -n "\${AGENTS_EXEC_HOME:-}" ]; then
+${slot}
+  unset AGENTS_EXEC_HOME
+else
+${version}
+fi`;
+}
 const REGISTRY = new Map();
 /**
  * The no-behavior adapter — a harness with no managed config-dir env and no

package/dist/lib/harness/adapters/claude.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { slotAwareConfigEnvBash, stripForeignConfigDir } from '../adapter.js';
 import { isHeadedDeviceRole } from '../../device-config.js';
 export const claudeAdapter = {
     id: 'claude',
@@ -95,8 +95,10 @@ export const claudeAdapter = {
         return `
 # Claude stores OAuth credentials in the macOS keychain. Scope them to the
 # selected version's config directory so switching versions also switches the
-# live Claude account.
-export CLAUDE_CONFIG_DIR="$VERSION_DIR/home/${ctx.configDirName}"
+# live Claude account. An account-slot launch (PHNX-3940 T5) has already chosen
+# the config dir (AGENTS_EXEC_HOME) and the pin yields to it — see
+# slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'CLAUDE_CONFIG_DIR', rel: ctx.configDirName }], '$VERSION_DIR/home')}
 # Managed installs are pinned in a per-version dir; Claude Code's background
 # auto-updater would rewrite the pinned binary in place. Disable it so a pin
 # stays a pin. An explicit user value always wins.

package/dist/lib/harness/adapters/copilot.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 export const copilotAdapter = {
     id: 'copilot',
     // Copilot honors COPILOT_HOME (relocates ~/.copilot, including settings,
@@ -17,7 +17,9 @@ export const copilotAdapter = {
 # (settings.json, mcp-config.json, session-state/, logs/, plugins/). Point
 # it at the versioned home so MCP servers, custom agents, and session
 # history are isolated per copilot version.
-export COPILOT_HOME="$VERSION_DIR/home/${ctx.configDirName}"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pin
+# yields to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'COPILOT_HOME', rel: ctx.configDirName }], '$VERSION_DIR/home')}
 `;
     },
 };

package/dist/lib/harness/adapters/grok.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 export const grokAdapter = {
     id: 'grok',
     applyExecConfigEnv(result, ctx) {
@@ -13,7 +13,9 @@ export const grokAdapter = {
 # Grok Build uses GROK_HOME to isolate its entire configuration tree
 # (skills, hooks, plugins, agents, memory, sessions, config.toml, MCP, etc.).
 # This gives agents-cli full versioned isolation + resource sync for grok.
-export GROK_HOME="$VERSION_DIR/home/.grok"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pin
+# yields to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'GROK_HOME', rel: '.grok' }], '$VERSION_DIR/home')}
 `;
     },
 };