Run Settings and palette agent updates on their captured owner

Packages/macOS/CmuxNext/Package.swift

@@ -66,6 +66,8 @@ import PackageDescription
 //     tab or its front tab, and the one-time rename; pure rules; the App supplies its pages and the rename command)
 //   CmuxNextAgentActivity -> Design (Agent activity pane: computer use sessions, timeline, prototype layouts;
 //     a projection of the CUA host; no daemon; the App supplies the source; plans/cmux-next/computer-use.md)
+//   CmuxNextAgentUpdates -> Actions, Daemon, DaemonService, Pages, Settings (Settings and palette agent CLI
+//     updates as owner-bound terminal jobs: intents, receipts, outcomes; the App supplies the route glue)
 //   CmuxNextFileGrid -> system frameworks only (the thumbnail grid: tiles, thumbnail cache, drag
 //     out, drop reading, Quick Look and the command menu; it reads and changes no files)
 //   CmuxNextScreenshots -> FileGrid, Files (the Screenshots pane: source detection for macOS and the
@@ -209,6 +211,7 @@ let package = Package(
                 "CmuxNextHomeEngine",
                 "CmuxNextHostedChief",
                 "CmuxNextDaemonService",
+                "CmuxNextAgentUpdates",
                 "CmuxNextFocus",
                 "CmuxNextFocusUI",
                 "CmuxNextComputerUse",
@@ -1235,12 +1238,20 @@ let package = Package(
             dependencies: ["CmuxNextWakeups", "CmuxNextCompat", "CmuxNextControl", "CmuxNextActions", "CmuxNextSettings", "CmuxNextDaemon"],
             swiftSettings: daemonSwiftSettings
         ),
+        // Settings and palette agent CLI updates (moved out of CmuxNextApp/AgentHarnesses):
+        // the shared registry handler, owner routes, intents and terminal outcomes.
+        .target(
+            name: "CmuxNextAgentUpdates",
+            dependencies: ["CmuxNextActions", "CmuxNextDaemon", "CmuxNextDaemonService", "CmuxNextPages", "CmuxNextSettings"],
+            swiftSettings: uiSwiftSettings
+        ),
         .testTarget(
             name: "CmuxNextAppTests",
             dependencies: [ // sorted: scripts/cmux-next/check-package-dependency-lists.py
                 "CmuxNextActions",
                 "CmuxNextAgentCursor",
                 "CmuxNextAgentLanes",
+                "CmuxNextAgentUpdates",
                 "CmuxNextApp",
                 "CmuxNextApps",
                 "CmuxNextBrowserHistory",

Packages/macOS/CmuxNext/Sources/CmuxNextActions/ActionRegistry+Work.swift

@@ -64,6 +64,10 @@ public nonisolated enum ActionWorkRefusal: Sendable, Hashable {
 /// tasks the handlers reported with `track(_:)`. Keyboard, menu, and
 /// palette runs capture nothing, so tracking costs them nothing.
 extension ActionRegistry {
+    /// Whether a caller awaits the work handlers report (`capturingWork`). A handler whose
+    /// failure would otherwise go unseen (a palette run) shows it itself when this is false.
+    public var isCapturingWork: Bool { capturedWork != nil }
+
     /// Reports a task a handler started. Ignored unless a caller is capturing.
     public func track(_ task: ActionWork) {
         if capturedWork != nil { capturedWork?.append(task) }

Packages/macOS/CmuxNext/Sources/CmuxNextActions/Catalog/AgentHarnessActionCatalog.swift

@@ -10,7 +10,7 @@ nonisolated enum AgentHarnessActionCatalog: ActionCatalogGroup {
             ActionEnumCase(value: "acp", title: t("argument.agent.harness.protocol.acp", "ACP")),
             ActionEnumCase(value: "terminal", title: t("argument.agent.harness.protocol.terminal", "Terminal")),
         ])
-        return [
+        var actions = [
             // Without arguments (the palette, the model picker's +) it opens Settings > Agents >
             // Add; with a command, registry agent or example it writes the profile.
             ActionDescriptor(
@@ -63,17 +63,21 @@ nonisolated enum AgentHarnessActionCatalog: ActionCatalogGroup {
                 cliName: "agent check-harness",
                 surfacePlan: ActionSurfacePlan(cli: .offered, contextMenuExemption: .noObject)
             ),
-            // Agent CLI health (cx-ny85): types every outdated agent CLI's own update into a
-            // terminal tab, like Settings > Agents > Update All; with nothing to update (or no
-            // window) it opens Settings > Agents.
+            // The native owner starts visible terminal jobs. Settings passes a profile id;
+            // the palette updates each observed outdated family on its captured machine.
             ActionDescriptor(
                 id: "agent.harness.updateAll", title: t("action.agent.harness.updateAll", "Update Agent CLIs"),
                 keywords: ["agent", "harness", "cli", "update", "upgrade", "version", "outdated", "npm", "brew", "codex", "claude", "gemini"],
                 category: .agents, symbol: "arrow.down.circle",
+                arguments: [id],
                 // A terminal tab the person watches: scripts run the updates themselves.
                 surfacePlan: ActionSurfacePlan(cli: .exempt(.guiOnly), contextMenuExemption: .noObject)
             ),
         ]
+        for index in actions.indices where actions[index].id == "agent.harness.updateAll" {
+            actions[index].isPersonOnly = true
+        }
+        return actions
     }
 
     private static func t(_ key: StaticString, _ english: String.LocalizationValue) -> String {

Packages/macOS/CmuxNext/Sources/CmuxNextAgentUpdates/AgentCLIUpdateActions+Route.swift

@@ -0,0 +1,69 @@
+import CmuxNextActions
+import CmuxNextDaemon
+public import CmuxNextDaemonService
+
+extension AgentCLIUpdateActions {
+    /// The app's daemons, read when an update captures its owner.
+    public struct Daemons {
+        let active: @MainActor () -> DaemonService?
+        let machine: @MainActor (String) -> DaemonService?
+
+        public init(active: @escaping @MainActor () -> DaemonService?, machine: @escaping @MainActor (String) -> DaemonService?) {
+            self.active = active
+            self.machine = machine
+        }
+    }
+
+    /// The palette's target machine, else the active daemon, while the app still routes to it.
+    public convenience init(daemons: Daemons, unsupported: @escaping @MainActor () -> String,
+                            nothingToUpdate: @escaping @MainActor () -> String,
+                            stillUpdating: @escaping @MainActor (String) -> String, localMachine: String) {
+        self.init(capture: { invocation in
+            let registered: @MainActor (DaemonService) -> Bool = { daemons.machine($0.machineID) === $0 }
+            if let target = invocation.target {
+                guard target.kind == .machine, let daemon = daemons.machine(target.id) else { throw DaemonError.notConnected }
+                return try Route.capture(daemon, registered: registered)
+            }
+            guard let daemon = daemons.active() else { throw DaemonError.notConnected }
+            return try Route.capture(daemon, registered: registered)
+        }, unsupported: unsupported, nothingToUpdate: nothingToUpdate, stillUpdating: stillUpdating, localMachine: localMachine)
+    }
+}
+
+extension AgentCLIUpdateActions.Route {
+    /// Captures one daemon's connected machine/session owner and connection epoch.
+    /// `registered` says whether the app still routes that machine to this daemon.
+    public static func capture(_ daemon: DaemonService, registered: @escaping @MainActor (DaemonService) -> Bool) throws -> Self {
+        guard registered(daemon), !daemon.policyBlock.isBlocked, case .connected = daemon.store.connectionState,
+              let connection = daemon.connection, let identity = daemon.identity,
+              let machine = identity.machineResourceID, let session = identity.sessionResourceID else {
+            throw DaemonError.notConnected
+        }
+        let epoch = daemon.store.connectionEpoch
+        let current: @MainActor () -> Bool = { [weak daemon] in
+            guard let daemon, registered(daemon), !daemon.policyBlock.isBlocked, case .connected = daemon.store.connectionState else {
+                return false
+            }
+            return daemon.connection === connection && daemon.store.connectionEpoch == epoch
+                && daemon.identity?.machineResourceID == machine && daemon.identity?.sessionResourceID == session
+        }
+        var carrier: AgentCLIJobCarrier?
+        // The owner-checked carrier, opened by whichever call comes first: a route re-captured
+        // after a reconnect starts (a replayed key) or observes without reading the inventory.
+        let opened: @MainActor () async throws -> AgentCLIJobCarrier = {
+            guard current() else { throw DaemonError.notConnected }
+            if let carrier { return carrier }
+            let captured = try await connection.agentCLIJobs(expectedMachineID: machine, expectedSessionID: session)
+            guard current() else { throw DaemonError.notConnected }
+            carrier = captured
+            return captured
+        }
+        return Self(machine: machine, session: session, isCurrent: current, inventory: {
+            try await opened().inventory()
+        }, start: { cli, key in
+            try await opened().startUpdate(cli: cli, idempotencyKey: key)
+        }, observe: { receipt in
+            try await opened().observe(receipt)
+        })
+    }
+}