@phnx-labs/agents-cli 1.22.92 → 1.22.94

package/dist/lib/browser/types.d.ts

@@ -1,4 +1,53 @@
+import type { ArcNativeTabRef } from './drivers/arc.js';
+export type { ArcNativeTabRef } from './drivers/arc.js';
 export type BrowserType = 'chrome' | 'comet' | 'chromium' | 'brave' | 'edge' | 'arc' | 'custom';
+/**
+ * The transport backend a live browser connection uses (PHNX-2399).
+ *   - `cdp` — Chrome DevTools Protocol (the existing path for all Chromium-family browsers).
+ *   - `arc-native` — Apple Events via `osascript` (the native Arc path, no CDP port required).
+ *
+ * Load-bearing: every action method on `BrowserService` that calls `conn.cdp.send()`
+ * must check `conn.backend` and route to the native driver instead when it is
+ * `arc-native`. Unsupported native verbs throw `ArcNativeCapabilityError`.
+ */
+export type BackendKind = 'cdp' | 'arc-native';
+/**
+ * Stable native identity carried by an Arc profile declaration (PHNX-2399).
+ * One agents-cli profile is one Arc Space: the Space already carries its Arc
+ * profile (cookies, logins), so agents never learn a second "space" concept.
+ */
+export interface ArcNativeProfileIdentity {
+    /** Arc's profile directory basename the Space belongs to. Authoritative id. */
+    profileId: string;
+    /** Display-only Arc profile name from Local State. Never used for addressing. */
+    profileName: string;
+    /** Stable Space id used for every native operation. */
+    spaceId: string;
+    /** Display-only Space title. */
+    spaceTitle: string;
+}
+/** A crash-safe native create intent persisted before Arc is asked to mutate. */
+export interface ArcNativeCreateIntent {
+    tabId: string;
+    markerUrl: string;
+    targetUrl: string;
+    createdAt: number;
+    /** Active tab before creation, restored only if the owned tab stayed active. */
+    previousTabId?: string;
+    /** Written immediately after the driver returns, before final navigation. */
+    ref?: ArcNativeTabRef;
+}
+/** Durable Arc state owned by one browser task. */
+export interface ArcNativeTaskState {
+    profileId: string;
+    /** Original Arc window id. A tab moved elsewhere is never adopted. */
+    windowId: string;
+    spaceId: string;
+    /** Display-only snapshot for status output. */
+    spaceTitle: string;
+    tabs: Record<string, ArcNativeTabRef>;
+    createIntents?: Record<string, ArcNativeCreateIntent>;
+}
 /**
  * The user-facing name of a profile — what `agents browser profiles list`
  * prints and what `--profile <name>` takes. ALWAYS bare: it never carries an
@@ -139,6 +188,8 @@ export interface BrowserProfile {
     logDir?: string;
     /** Optional SSH host where logDir lives, e.g. "user@remote-host". */
     logHost?: string;
+    /** Native Arc identity. Present only for an `arc-native:` profile. */
+    arc?: ArcNativeProfileIdentity;
 }
 /** Parsed form of `BrowserProfile.targetFilter`. */
 export interface TargetFilter {
@@ -176,11 +227,12 @@ export interface Task {
      * {@link parseConnectionKey} to get the user-facing name out of it.
      */
     profile: ConnectionKey;
+    /** shortId -> CDP target id, or native tab id mirrored from arcNative.tabs. */
     tabs: Record<string, string>;
     /**
      * Tabs this task DRIVES but did not create, by shortId — a tab that already
      * existed in the browser and was reused because the browser cannot open new
-     * ones (Arc: `Target.createTarget` crashes it, #2778/#2786). Every close path
+     * ones (legacy CDP Arc is one example). Every close path
      * skips these: the task never opened the tab, so closing it on `done` would
      * take away something that was there first. Same rule `adoptTabShowing`
      * states for unowned pages, kept when reuse is unavoidable rather than
@@ -235,6 +287,8 @@ export interface Task {
      * it. See RefSnapshot / RefDescriptor.
      */
     refDescriptors?: Record<string, import('./refs.js').RefSnapshot>;
+    /** Durable stable native ids and crash-intent ledger for an Arc task. */
+    arcNative?: ArcNativeTaskState;
 }
 export interface TabInfo {
     id: string;

package/dist/lib/claude-account-token.d.ts

@@ -91,4 +91,17 @@ export declare function readReservedCredential(bundle: string, key: string): str
  * token on this device rather than recording a slot that cannot authenticate.
  */
 export declare function provisionWorkerSlot(account: NativeAccountRecord): DeviceAccountSlot;
+/**
+ * True when a claude worker slot carries everything provisioning seeds: the
+ * identity email AND the completed-onboarding flag. A slot provisioned before
+ * onboarding was seeded answers false, so the daemon's reconcile re-seeds it.
+ */
+export declare function isClaudeWorkerHomeSeeded(home: string): boolean;
+/**
+ * Seed a worker slot's `.claude.json` (both locations Claude Code reads) with
+ * the account identity AND `hasCompletedOnboarding`. A worker never has a human
+ * at it, so nothing else can complete Claude Code's first-run onboarding (theme
+ * picker, "Let's get started"); without the flag every slot launch re-onboarded.
+ * Everything else in the document is preserved.
+ */
 export declare function seedClaudeWorkerHomeIdentity(versionHome: string, email: string): void;

package/dist/lib/claude-account-token.js

@@ -366,6 +366,34 @@ export function provisionWorkerSlot(account) {
     recordSlot(account.id, record);
     return record;
 }
+/**
+ * True when a claude worker slot carries everything provisioning seeds: the
+ * identity email AND the completed-onboarding flag. A slot provisioned before
+ * onboarding was seeded answers false, so the daemon's reconcile re-seeds it.
+ */
+export function isClaudeWorkerHomeSeeded(home) {
+    for (const p of [path.join(home, '.claude', '.claude.json'), path.join(home, '.claude.json')]) {
+        try {
+            const doc = JSON.parse(fs.readFileSync(p, 'utf-8'));
+            const email = doc.oauthAccount?.emailAddress;
+            if (doc.hasCompletedOnboarding !== true)
+                return false;
+            if (typeof email !== 'string' || email.trim().length === 0)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Seed a worker slot's `.claude.json` (both locations Claude Code reads) with
+ * the account identity AND `hasCompletedOnboarding`. A worker never has a human
+ * at it, so nothing else can complete Claude Code's first-run onboarding (theme
+ * picker, "Let's get started"); without the flag every slot launch re-onboarded.
+ * Everything else in the document is preserved.
+ */
 export function seedClaudeWorkerHomeIdentity(versionHome, email) {
     const trimmed = email.trim();
     if (!trimmed)
@@ -389,6 +417,7 @@ export function seedClaudeWorkerHomeIdentity(versionHome, email) {
             ? doc.oauthAccount
             : {});
         doc.oauthAccount = { ...existing, emailAddress: trimmed };
+        doc.hasCompletedOnboarding = true;
         fs.mkdirSync(path.dirname(p), { recursive: true });
         // Temp-write + rename: a reader mid-write never sees a truncated doc.
         const tmp = `${p}.agents-${process.pid}.tmp`;

package/dist/lib/daemon/attention-notify-service.d.ts

@@ -7,8 +7,11 @@
  * banner carries the category, the attention key, the session id, and the
  * answerable choices, so the macOS companion can offer Approve / Approve for
  * session / Deny (permission), the options plus a typed reply (question),
- * Approve / Send back (plan review), or Open terminal (a stall/failure), and
- * route the answer back through `agents feed answer <key> --choice <id>`.
+ * Approve / Send back (plan review), or Open terminal (a stall/failure, or a
+ * request the CLI could not verify is still pending), and route the answer back
+ * through `agents feed answer <key> --choice <id>`. The kind — and so the button
+ * set — is the reconciler's verdict from explicit harness evidence; an idle
+ * reminder never reaches here as a permission (PHNX-3999).
  *
  * Idempotency is a filesystem ledger, not memory: one sidecar file per notified
  * key under `~/.agents/.history/feed/notified/`, so a daemon restart never

package/dist/lib/daemon/attention-notify-service.js

@@ -7,8 +7,11 @@
  * banner carries the category, the attention key, the session id, and the
  * answerable choices, so the macOS companion can offer Approve / Approve for
  * session / Deny (permission), the options plus a typed reply (question),
- * Approve / Send back (plan review), or Open terminal (a stall/failure), and
- * route the answer back through `agents feed answer <key> --choice <id>`.
+ * Approve / Send back (plan review), or Open terminal (a stall/failure, or a
+ * request the CLI could not verify is still pending), and route the answer back
+ * through `agents feed answer <key> --choice <id>`. The kind — and so the button
+ * set — is the reconciler's verdict from explicit harness evidence; an idle
+ * reminder never reaches here as a permission (PHNX-3999).
  *
  * Idempotency is a filesystem ledger, not memory: one sidecar file per notified
  * key under `~/.agents/.history/feed/notified/`, so a daemon restart never
@@ -47,6 +50,10 @@ const BANNER_KINDS = {
     plan_review: { category: 'plan_review', label: 'Plan review' },
     stall: { category: 'failure', label: 'Failed' },
     failure: { category: 'failure', label: 'Failed' },
+    // A request record the CLI could not confirm is still pending: the `failure`
+    // category is the companion's one button set with no approval action — just
+    // Open terminal — which is exactly the honest offer here.
+    unverified: { category: 'failure', label: 'Could not verify request' },
 };
 function shorten(text, max = BODY_MAX) {
     const flat = text.replace(/\s+/g, ' ').trim();

package/dist/lib/exec.js

@@ -425,6 +425,17 @@ export function buildExecEnv(options) {
     if (options.cwd) {
         result.AGENTS_CWD = options.cwd;
     }
+    // An account-slot launch (PHNX-3940 T5) tells the versioned alias which
+    // HOME-shaped dir owns this run's config, so the alias's version-home pin
+    // (claude: CLAUDE_CONFIG_DIR) yields to the slot instead of overriding the
+    // adapter's pin above. Set only for a slot launch and cleared otherwise, so a
+    // run spawned from inside a slot session never inherits its parent's slot.
+    if (options.execHome) {
+        result.AGENTS_EXEC_HOME = options.execHome;
+    }
+    else {
+        delete result.AGENTS_EXEC_HOME;
+    }
     // Export the run's durable name (companion to AGENT_SESSION_ID) so a
     // SessionStart hook / the agent can associate its transcript with the handle
     // the user gave the run. Only set when --name was passed.

package/dist/lib/feed/answer.js

@@ -19,6 +19,10 @@ function blockFromAttention(attention, session) {
         state: 'open', sourceCursor: attention.sourceCursor, project: attention.project,
         ts: attention.openedAt, questions: [attention.question ?? { text: 'Continue from this attention item.' }],
         kind: attention.kind === 'permission' ? 'notification' : attention.kind === 'declared' ? 'declared' : attention.source === 'system' ? 'control' : 'question',
+        // A notification block is a permission only by its recorded subtype
+        // (attention.ts kindFromNotification), so the reconstructed block must carry
+        // it or a re-read classifies the same item as unverified.
+        ...(attention.kind === 'permission' ? { notificationType: 'permission_prompt' } : {}),
         safeDefault: attention.safeDefault,
     };
 }
@@ -30,6 +34,11 @@ async function resolveBlock(attentionKey, sessions, root) {
         let block = readBlock(blockIdForSession(session.sessionId), root);
         const projectedSession = { ...session, host: ownerHost };
         const attention = reconcileAttention({ block, session: projectedSession, pullRequest: await readPullRequestStatus(session), resolution: readResolution(blockIdForSession(session.sessionId), root), nowMs: Date.now() });
+        if (attention?.key === attentionKey && attention.kind === 'unverified') {
+            // No confirmed prompt to land a reply in: an answer typed into the session
+            // could hit an empty prompt line or a different dialog (PHNX-3999).
+            throw new Error(`'${attentionKey}' could not be verified as a pending request — open the session and answer it there.`);
+        }
         if (attention?.key === attentionKey && block)
             return { block, attention };
         // The winning caller advances the block to answered before a concurrent

package/dist/lib/feed/attention.d.ts

@@ -1,7 +1,15 @@
 import type { ActiveSession } from '../session/active.js';
 import { type AttentionResolution, type AttentionSource, type AttentionState, type BlockOption, type BlockQuestion, type OpenBlock, type SourceCursor } from './feed.js';
-/** What an attention item is asking of the operator. */
-export type AttentionKind = 'question' | 'permission' | 'plan_review' | 'declared' | 'failure' | 'stall' | 'review';
+/**
+ * What an attention item is asking of the operator. `unverified` is a request
+ * record whose pending state this CLI could not confirm — a hook-raised prompt
+ * with no transcript cursor to check it against that has aged past
+ * {@link UNVERIFIED_PROMPT_AGE_MS}, a notification whose subtype the writer did
+ * not record, or a lifecycle `permission` claim from a peer running an older
+ * state engine. It carries no choices: the only honest action is to open the
+ * session and look (PHNX-3999).
+ */
+export type AttentionKind = 'question' | 'permission' | 'plan_review' | 'declared' | 'failure' | 'stall' | 'review' | 'unverified';
 /** How an answer can be routed back to the waiting agent. */
 export type ReplyCapability = 'terminal' | 'tmux' | 'cloud' | 'team' | 'none';
 /**
@@ -70,6 +78,14 @@ export interface PullRequestAttentionSignal {
 export declare function attentionFingerprint(kind: AttentionKind, question?: BlockQuestion): string;
 /** Harness id behind a session — the profile name when set, else the host process. */
 export declare function harnessOf(session: ActiveSession): string;
+/**
+ * How long a hook-raised permission prompt is trusted on the hook's word alone
+ * when the session offers no transcript cursor to verify it against (a cloud or
+ * remote row, or a peer running an older CLI). Past this age with nothing to
+ * check, the record is `unverified`: the banner keeps the session findable but
+ * offers no Approve.
+ */
+export declare const UNVERIFIED_PROMPT_AGE_MS: number;
 /**
  * Reconcile the feed block ledger, the session lifecycle, a CLI-supplied PR
  * signal, and the latest resolution tombstone into one attention item — or

package/dist/lib/feed/feed.d.ts

@@ -94,7 +94,11 @@ export interface OpenBlock {
     /**
      * How this block came to exist.
      *   question     — an AskUserQuestion the harness surfaced
-     *   notification — a permission/idle prompt the harness raised
+     *   notification — a prompt the harness raised; `notificationType` names
+     *                  which (`permission_prompt`, `elicitation_dialog`). An
+     *                  `idle_prompt` is not published — it says the turn ended,
+     *                  not that anything is pending (PHNX-3999); a block of that
+     *                  type left on disk by an older hook is not a request either.
      *   control      — a synthetic card the feed itself computed (runaway, needy)
      *   declared     — the AGENT decided it is stuck and said so (`feed post --blocked`)
      *
@@ -342,7 +346,7 @@ export declare function removeBlock(blockId: string, root?: string): boolean;
  * Embedded so it ships with the compiled CLI and can be installed to the
  * CLI-writable user hooks dir without a separate file in the npm tarball.
  */
-export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"idle_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef project_from_cwd(cwd):\n    \"\"\"Basename of cwd, with worktree paths resolved to their repo name.\"\"\"\n    if not cwd:\n        return None\n    norm = cwd.replace(\"\\\\\", \"/\").rstrip(\"/\")\n    if not norm:\n        return None\n    marker = \"/.agents/worktrees/\"\n    idx = norm.find(marker)\n    if idx > 0:\n        repo_path = norm[:idx]\n        base = repo_path[repo_path.rfind(\"/\") + 1:]\n        if base:\n            return base\n    base = norm[norm.rfind(\"/\") + 1:]\n    return base or None\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A declared block (`agents feed post --blocked`) is the agent explicitly\n        # saying it is stuck. Unlike a question/notification/approval block -- which\n        # tracks an in-flight harness prompt that a lifecycle event resolves -- a\n        # declared block stays open until it is actually ANSWERED. So while it is\n        # still UNANSWERED, Stop/SessionEnd/PostToolUse must never silently drop it:\n        # otherwise the needs-you record vanishes the moment the agent parks the block\n        # and its turn ends -- exactly when the owner still needs to see and answer it.\n        # Once it IS answered (an answered marker exists), it clears like any other\n        # block by falling through below -- which frees that marker too, so a later\n        # `--blocked` in the same session is not falsely locked as already-answered\n        # (recordAnswer creates the marker with O_EXCL).\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            answered = os.path.exists(os.path.join(answered_dir, f\"{block_id}.json\"))\n            if existing.get(\"kind\") == \"declared\" and not answered:\n                return\n        except Exception:\n            pass\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    # A resolution tombstone is written BEFORE unlink (matching TS recordAnswer)\n    # so a stale lifecycle re-read cannot resurrect this generation.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        now_iso = datetime.now(timezone.utc).isoformat()\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": now_iso,\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Tombstone first, then drop the open-block view. A missing/corrupt\n        # block means there is nothing to resolve; fail open.\n        existing = read_json(target)\n        if isinstance(existing, dict):\n            generation = existing.get(\"generation\") or existing.get(\"ts\")\n            if generation:\n                tombstone = {\n                    \"blockId\": block_id,\n                    \"generation\": generation,\n                    \"resolvedAt\": now_iso,\n                    \"reason\": \"answered\",\n                }\n                source_cursor = existing.get(\"sourceCursor\")\n                if source_cursor:\n                    tombstone[\"sourceCursor\"] = source_cursor\n                write_json(\n                    os.path.join(feed_dir, \"resolutions\", f\"{block_id}.json\"),\n                    tombstone,\n                )\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so AGI EXT can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now = datetime.now(timezone.utc)\n    now_iso = now.isoformat()\n    now_ms = int(now.timestamp() * 1000)\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    project = project_from_cwd(cwd)\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        # Write-time cursor so a new generation is not suppressed when\n        # session.lastActivityMs is unresolvable (cloud / remote / index-lag).\n        \"sourceCursor\": {\"lastActivityMs\": now_ms},\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if project:\n        block[\"project\"] = project\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
+export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\n# Notification subtypes that mean something is PENDING. Claude's idle_prompt is\n# deliberately absent: it fires a minute after the turn ended with the operator\n# idle, which is a finished turn, not a request -- publishing it put an\n# Approve/Deny banner on a session that had already answered \"pong\" (PHNX-3999).\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef project_from_cwd(cwd):\n    \"\"\"Basename of cwd, with worktree paths resolved to their repo name.\"\"\"\n    if not cwd:\n        return None\n    norm = cwd.replace(\"\\\\\", \"/\").rstrip(\"/\")\n    if not norm:\n        return None\n    marker = \"/.agents/worktrees/\"\n    idx = norm.find(marker)\n    if idx > 0:\n        repo_path = norm[:idx]\n        base = repo_path[repo_path.rfind(\"/\") + 1:]\n        if base:\n            return base\n    base = norm[norm.rfind(\"/\") + 1:]\n    return base or None\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A declared block (`agents feed post --blocked`) is the agent explicitly\n        # saying it is stuck. Unlike a question/notification/approval block -- which\n        # tracks an in-flight harness prompt that a lifecycle event resolves -- a\n        # declared block stays open until it is actually ANSWERED. So while it is\n        # still UNANSWERED, Stop/SessionEnd/PostToolUse must never silently drop it:\n        # otherwise the needs-you record vanishes the moment the agent parks the block\n        # and its turn ends -- exactly when the owner still needs to see and answer it.\n        # Once it IS answered (an answered marker exists), it clears like any other\n        # block by falling through below -- which frees that marker too, so a later\n        # `--blocked` in the same session is not falsely locked as already-answered\n        # (recordAnswer creates the marker with O_EXCL).\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            answered = os.path.exists(os.path.join(answered_dir, f\"{block_id}.json\"))\n            if existing.get(\"kind\") == \"declared\" and not answered:\n                return\n        except Exception:\n            pass\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    # A resolution tombstone is written BEFORE unlink (matching TS recordAnswer)\n    # so a stale lifecycle re-read cannot resurrect this generation.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        now_iso = datetime.now(timezone.utc).isoformat()\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": now_iso,\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Tombstone first, then drop the open-block view. A missing/corrupt\n        # block means there is nothing to resolve; fail open.\n        existing = read_json(target)\n        if isinstance(existing, dict):\n            generation = existing.get(\"generation\") or existing.get(\"ts\")\n            if generation:\n                tombstone = {\n                    \"blockId\": block_id,\n                    \"generation\": generation,\n                    \"resolvedAt\": now_iso,\n                    \"reason\": \"answered\",\n                }\n                source_cursor = existing.get(\"sourceCursor\")\n                if source_cursor:\n                    tombstone[\"sourceCursor\"] = source_cursor\n                write_json(\n                    os.path.join(feed_dir, \"resolutions\", f\"{block_id}.json\"),\n                    tombstone,\n                )\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so AGI EXT can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now = datetime.now(timezone.utc)\n    now_iso = now.isoformat()\n    now_ms = int(now.timestamp() * 1000)\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n    cwd = payload.get(\"cwd\") or os.environ.get(\"AGENTS_CWD\")\n    project = project_from_cwd(cwd)\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        # Write-time cursor so a new generation is not suppressed when\n        # session.lastActivityMs is unresolvable (cloud / remote / index-lag).\n        \"sourceCursor\": {\"lastActivityMs\": now_ms},\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if project:\n        block[\"project\"] = project\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
 /** Manifest entry for the feed-publish hook, matching the ManifestHook shape. */
 export declare const FEED_PUBLISH_HOOK_MANIFEST: {
     name: string;

package/dist/lib/feed/feed.js

@@ -533,9 +533,12 @@ import socket
 import tempfile
 from datetime import datetime, timezone
 
+# Notification subtypes that mean something is PENDING. Claude's idle_prompt is
+# deliberately absent: it fires a minute after the turn ended with the operator
+# idle, which is a finished turn, not a request -- publishing it put an
+# Approve/Deny banner on a session that had already answered "pong" (PHNX-3999).
 WAITING_NOTIFICATION_TYPES = {
     "permission_prompt",
-    "idle_prompt",
     "elicitation_dialog",
 }
 CLEAR_EVENTS = {
@@ -921,7 +924,7 @@ export const FEED_PUBLISH_HOOK_MANIFEST = {
 export const FEED_NOTIFICATION_HOOK_MANIFEST = {
     name: 'feed-publish-notification',
     events: ['Notification'],
-    matcher: 'permission_prompt|idle_prompt|elicitation_dialog',
+    matcher: 'permission_prompt|elicitation_dialog',
     script: '10-feed-publish.py',
     timeout: 5,
 };
@@ -980,10 +983,13 @@ export function ensureFeedPublishHook(userAgentsDir = getUserAgentsDir()) {
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
+            // idle_prompt is not matched: an idle reminder is a finished turn, not a
+            // pending request (PHNX-3999). An installed agents.yaml that still carries
+            // the old matcher is harmless -- the script drops the subtype itself.
             'feed-publish-notification': {
                 agents: ['claude', 'codex'],
                 events: ['Notification'],
-                matcher: 'permission_prompt|idle_prompt|elicitation_dialog',
+                matcher: 'permission_prompt|elicitation_dialog',
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
@@ -1007,7 +1013,7 @@ export function ensureFeedPublishHook(userAgentsDir = getUserAgentsDir()) {
             // never fires PermissionRequest, so it has no approval card to clear here,
             // and a matcher-less PostToolUse for Claude would (1) re-run the script on
             // every tool completion and (2) wipe Claude's notification-kind blocks
-            // (permission_prompt/idle_prompt/elicitation_dialog) the moment any later
+            // (permission_prompt/elicitation_dialog) the moment any later
             // tool runs, instead of letting them persist to Stop/SessionEnd like they
             // did before RUSH-2039. Registering it for codex alone keeps Claude's
             // card lifetime exactly as it was.

package/dist/lib/harness/adapter.d.ts

@@ -162,6 +162,29 @@ export declare const CONFIG_DIR_ENV_KEYS: readonly ["CLAUDE_CONFIG_DIR", "CODEX_
  * (the default / no-config-dir harness) deletes all of them — the old `else` arm.
  */
 export declare function stripForeignConfigDir(result: NodeJS.ProcessEnv, keep?: readonly string[]): void;
+/**
+ * Bash for a harness's config-dir pin that yields to an account-slot launch.
+ *
+ * A shim (bare or `<agent>@<version>` alias) pins the harness's config-dir env
+ * at the version home. An account-slot launch (PHNX-3940 T5) has already chosen
+ * the HOME-shaped slot: `agents run` pins the same env at the slot in
+ * buildExecEnv and stamps the slot in AGENTS_EXEC_HOME. The shim used to
+ * re-export the version home unconditionally, so a run picked as one account
+ * read and wrote another account's home (claude on yosemite-m1, 2026-09-10;
+ * the same override for every harness below). The pin now yields to the slot
+ * — the way the cursor alias's HOME swap yields to a spawner-chosen HOME — and
+ * consumes the marker so the launched harness never inherits it into a nested
+ * launch; a bare `<agent>@<version>` from a terminal still gets the version home.
+ *
+ * `pins` are `{ env, rel }` with `rel` the HOME-relative config path (the slot
+ * and the version home are both HOME-shaped); `versionHome` is the bash
+ * expression for the version home (`$VERSION_DIR/home` in the shared block, the
+ * absolute versions path in a direct alias).
+ */
+export declare function slotAwareConfigEnvBash(pins: ReadonlyArray<{
+    env: string;
+    rel: string;
+}>, versionHome: string): string;
 export declare function registerHarnessAdapter(adapter: HarnessAdapter): void;
 /**
  * The behavior adapter for a harness. Every `AgentId` resolves to an adapter —

package/dist/lib/harness/adapter.js

@@ -25,6 +25,35 @@ export function stripForeignConfigDir(result, keep = []) {
             delete result[key];
     }
 }
+/**
+ * Bash for a harness's config-dir pin that yields to an account-slot launch.
+ *
+ * A shim (bare or `<agent>@<version>` alias) pins the harness's config-dir env
+ * at the version home. An account-slot launch (PHNX-3940 T5) has already chosen
+ * the HOME-shaped slot: `agents run` pins the same env at the slot in
+ * buildExecEnv and stamps the slot in AGENTS_EXEC_HOME. The shim used to
+ * re-export the version home unconditionally, so a run picked as one account
+ * read and wrote another account's home (claude on yosemite-m1, 2026-09-10;
+ * the same override for every harness below). The pin now yields to the slot
+ * — the way the cursor alias's HOME swap yields to a spawner-chosen HOME — and
+ * consumes the marker so the launched harness never inherits it into a nested
+ * launch; a bare `<agent>@<version>` from a terminal still gets the version home.
+ *
+ * `pins` are `{ env, rel }` with `rel` the HOME-relative config path (the slot
+ * and the version home are both HOME-shaped); `versionHome` is the bash
+ * expression for the version home (`$VERSION_DIR/home` in the shared block, the
+ * absolute versions path in a direct alias).
+ */
+export function slotAwareConfigEnvBash(pins, versionHome) {
+    const slot = pins.map((p) => `  export ${p.env}="$AGENTS_EXEC_HOME/${p.rel}"`).join('\n');
+    const version = pins.map((p) => `  export ${p.env}="${versionHome}/${p.rel}"`).join('\n');
+    return `if [ -n "\${AGENTS_EXEC_HOME:-}" ]; then
+${slot}
+  unset AGENTS_EXEC_HOME
+else
+${version}
+fi`;
+}
 const REGISTRY = new Map();
 /**
  * The no-behavior adapter — a harness with no managed config-dir env and no

package/dist/lib/harness/adapters/claude.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { slotAwareConfigEnvBash, stripForeignConfigDir } from '../adapter.js';
 import { isHeadedDeviceRole } from '../../device-config.js';
 export const claudeAdapter = {
     id: 'claude',
@@ -95,8 +95,10 @@ export const claudeAdapter = {
         return `
 # Claude stores OAuth credentials in the macOS keychain. Scope them to the
 # selected version's config directory so switching versions also switches the
-# live Claude account.
-export CLAUDE_CONFIG_DIR="$VERSION_DIR/home/${ctx.configDirName}"
+# live Claude account. An account-slot launch (PHNX-3940 T5) has already chosen
+# the config dir (AGENTS_EXEC_HOME) and the pin yields to it — see
+# slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'CLAUDE_CONFIG_DIR', rel: ctx.configDirName }], '$VERSION_DIR/home')}
 # Managed installs are pinned in a per-version dir; Claude Code's background
 # auto-updater would rewrite the pinned binary in place. Disable it so a pin
 # stays a pin. An explicit user value always wins.

package/dist/lib/harness/adapters/copilot.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 export const copilotAdapter = {
     id: 'copilot',
     // Copilot honors COPILOT_HOME (relocates ~/.copilot, including settings,
@@ -17,7 +17,9 @@ export const copilotAdapter = {
 # (settings.json, mcp-config.json, session-state/, logs/, plugins/). Point
 # it at the versioned home so MCP servers, custom agents, and session
 # history are isolated per copilot version.
-export COPILOT_HOME="$VERSION_DIR/home/${ctx.configDirName}"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pin
+# yields to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'COPILOT_HOME', rel: ctx.configDirName }], '$VERSION_DIR/home')}
 `;
     },
 };

package/dist/lib/harness/adapters/grok.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 export const grokAdapter = {
     id: 'grok',
     applyExecConfigEnv(result, ctx) {
@@ -13,7 +13,9 @@ export const grokAdapter = {
 # Grok Build uses GROK_HOME to isolate its entire configuration tree
 # (skills, hooks, plugins, agents, memory, sessions, config.toml, MCP, etc.).
 # This gives agents-cli full versioned isolation + resource sync for grok.
-export GROK_HOME="$VERSION_DIR/home/.grok"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pin
+# yields to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'GROK_HOME', rel: '.grok' }], '$VERSION_DIR/home')}
 `;
     },
 };

package/dist/lib/harness/adapters/kimi.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 export const kimiAdapter = {
     id: 'kimi',
     // Kimi honors KIMI_CODE_HOME (relocates ~/.kimi-code, including config,
@@ -14,7 +14,9 @@ export const kimiAdapter = {
         return `
 # Kimi Code CLI honors KIMI_CODE_HOME to relocate ~/.kimi-code (config.toml,
 # mcp.json, sessions, skills, hooks). Point it at the versioned home.
-export KIMI_CODE_HOME="$VERSION_DIR/home/${ctx.configDirName}"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pin
+# yields to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'KIMI_CODE_HOME', rel: ctx.configDirName }], '$VERSION_DIR/home')}
 `;
     },
     execModeArgs(ctx) {

package/dist/lib/harness/adapters/muse.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 export const museAdapter = {
     id: 'muse',
     // Muse has no MUSE_CONFIG_DIR. Config is XDG-based:
@@ -23,8 +23,9 @@ export const museAdapter = {
 # Pin XDG into the version home so managed runs never walk the adopt-time
 # ~/.config/muse -> version-home symlink — Muse refuses agent-definition
 # sources that are SymlinkOrReparse (exit 1). Same idea as CLAUDE_CONFIG_DIR.
-export XDG_CONFIG_HOME="$VERSION_DIR/home/.config"
-export XDG_DATA_HOME="$VERSION_DIR/home/.local/share"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pins
+# yield to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'XDG_CONFIG_HOME', rel: '.config' }, { env: 'XDG_DATA_HOME', rel: '.local/share' }], '$VERSION_DIR/home')}
 `;
     },
     // muse exec: plan ≈ no non-shell writes; auto skips approval prompts but

package/dist/lib/harness/adapters/opencode.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 // OpenCode reads plugins/agents/commands from OPENCODE_CONFIG_DIR and auth from
 // $XDG_DATA_HOME/opencode (HARNESS_AUTH.slotEnv). Pin both at the slot / version
 // home so two accounts in one install never share a credential (PHNX-3940 T5).
@@ -17,7 +17,9 @@ export const opencodeAdapter = {
 # OpenCode reads plugins, agents, commands, and other config-directory
 # resources from OPENCODE_CONFIG_DIR. Point it at the versioned global config
 # tree where agents-cli syncs OpenCode resources.
-export OPENCODE_CONFIG_DIR="$VERSION_DIR/home/.config/opencode"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pin
+# yields to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'OPENCODE_CONFIG_DIR', rel: '.config/opencode' }], '$VERSION_DIR/home')}
 `;
     },
 };

package/dist/lib/helper-download.js

@@ -170,7 +170,7 @@ export async function downloadHelperApp(spec, version) {
     const { zip: zipUrl, sha256: shaUrl } = helperAssetUrls(spec, version);
     const missing = (status, url) => new Error(`no ${spec.assetName} release asset for tag ${tag} (HTTP ${status} on ${url}). ` +
         `The macOS helper ships as a GitHub release asset on its own helper tag; ` +
-        `from a repo checkout you can build it locally instead: ${spec.localBuildHint}`);
+        `from a repo checkout you can stage it locally instead: ${spec.localBuildHint}`);
     // Checksum first: it is tiny and 404s fast when the tag has no assets.
     const shaRes = await fetch(shaUrl, { signal: AbortSignal.timeout(30_000) });
     if (!shaRes.ok)

package/dist/lib/helper-versions.js

@@ -36,7 +36,7 @@
  * helper release now, off this table entirely.
  */
 export const HELPER_RELEASES = {
-    menubar: { tagPrefix: 'menubar', floor: '1.1.0' },
+    menubar: { tagPrefix: 'menubar', floor: '1.1.1' },
     'computer-mac': { tagPrefix: 'computer-mac', floor: '1.0.0' },
     // The Windows helper is a bare .exe, not an .app bundle, so it does not share
     // helper-download.ts's zip/codesign/notarize machinery -- but it has the same