v1.23.43

• agents cloud --provider rush uses a Rush API key, not the deprecated rush login (PHNX-4381). The provider and agents cloud transcripts now call the Rush developer API (/o/{org}/sessions: start, read, list, …/events, …/messages, …/cancel) with RUSH_API_KEY and RUSH_ORG, read from the secrets bundle named in cloud.providers.rush.secretsBundle or from the environment (secrets exec getrush.ai -- agents cloud run …). Nothing reads ~/.rush/user.yaml any more. A run no longer needs --repo; it takes one repository (sent with --branch as a tree/<branch> resource), and two --repo flags are refused. --skill takes a public skill URL. agents cloud run loses --mode, -b/--balanced and --strategy, which only the old Rush path read: a key run uses the key creator's own model accounts, and agents run --cloud --mode … to Rush is refused. Source: cli/src/lib/cloud/rush.ts, cli/src/commands/cloud-transcripts.ts.

• --mode auto on Grok runs Grok's own auto mode instead of a flagless run that dies headless. Grok's spec listed no auto mode, so resolveMode turned auto into edit, which passes Grok no permission flag. A headless grok -p run then asked before most shell commands, had nobody to answer, and got "User cancelled" on the first one, cancelling every later tool and exiting 0 about a minute in. Every Finder "Variations · Soft" run since the action moved to grok#socials ended this way. auto now passes Grok's native --permission-mode auto (the flag string Claude's auto also gets), which runs ordinary shell commands headless, and a headless plan request for Grok downgrades to that auto rather than to edit. Source: cli/src/lib/agent-spec/agents.ts, cli/src/lib/exec.ts.