@agent-team-foundation/first-tree-hub 0.10.8 → 0.10.9

package/dist/cli/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import "../observability-DPyf745N-BSc8QNcR.mjs";
-import { A as checkServerHealth, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as installClientService, G as createOwner, H as ClientRuntime, I as isServiceSupported, J as fail, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as getClientServiceStatus, Q as setJsonMode, S as runMigrations, T as checkClientConfig, U as handleClientOrgMismatch, V as stopPostgres, Y as success, Z as print, _ as onboardCreate, a as declineUpdate, at as cleanWorkspaces, b as createApiNameResolver, c as COMMAND_VERSION, ct as configureClientLoggerForService, d as isInteractive, et as ClientOrgMismatchError, f as promptAddAgent, g as onboardCheck, h as loadOnboardState, i as createExecuteUpdate, it as SessionRegistry, j as checkServerReachable, k as checkServerConfig, l as reconcileLocalRuntimeProviders, m as formatCheckReport, nt as FirstTreeHubSDK, o as promptUpdate, ot as probeCapabilities, p as promptMissingFields, q as resolveReplyToFromEnv, r as registerSaaSConnectCommand, rt as SdkError, s as startServer, st as applyClientLoggerConfig, tt as ClientUserMismatchError, u as uploadClientCapabilities, v as saveOnboardState, w as checkBackgroundService, x as migrateLocalAgentDirs, y as runHomeMigration } from "../saas-connect-D-fy3xu-.mjs";
+import { $ as success, A as checkServerHealth, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as getClientServiceStatus, H as stopPostgres, I as installClientService, J as removeLocalAgent, K as findStaleAliases, L as isServiceSupported, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as reconcileAgentConfigs, Q as fail, S as runMigrations, T as checkClientConfig, U as ClientRuntime, W as handleClientOrgMismatch, Y as createOwner, Z as resolveReplyToFromEnv, _ as onboardCreate, a as declineUpdate, at as ClientUserMismatchError, b as createApiNameResolver, c as COMMAND_VERSION, ct as SessionRegistry, d as isInteractive, dt as applyClientLoggerConfig, f as promptAddAgent, ft as configureClientLoggerForService, g as onboardCheck, h as loadOnboardState, i as createExecuteUpdate, it as ClientOrgMismatchError, j as checkServerReachable, k as checkServerConfig, l as reconcileLocalRuntimeProviders, lt as cleanWorkspaces, m as formatCheckReport, nt as setJsonMode, o as promptUpdate, ot as FirstTreeHubSDK, p as promptMissingFields, q as formatStaleReason, r as registerSaaSConnectCommand, s as startServer, st as SdkError, tt as print, u as uploadClientCapabilities, ut as probeCapabilities, v as saveOnboardState, w as checkBackgroundService, x as migrateLocalAgentDirs, y as runHomeMigration } from "../saas-connect-CKQ15VLz.mjs";
 import "../logger-core-BTmvdflj-DjW8FM4T.mjs";
-import { C as serverConfigSchema, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-jx5nN1qZ.mjs";
+import { C as serverConfigSchema, S as resolveConfigReadonly, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-jx5nN1qZ.mjs";
 import "../dist-DSr_I5Ia.mjs";
 import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-eynC54km.mjs";
 import "../invitation-B1pjAyOz-BaCA9PII.mjs";
 import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { Command } from "commander";
 import { confirm, input, password, select } from "@inquirer/prompts";
 //#region src/commands/agent-config.ts
@@ -281,6 +281,21 @@ async function resolveAgent(serverUrl, adminToken, agentName) {
 	if (!found) fail("NOT_FOUND", `Agent "${agentName}" not found`, 1);
 	return found;
 }
+/**
+* Read the persisted `client.id` from `client.yaml`. Required by `agent
+* prune` to filter the user-scoped `listMyAgents` response down to "what
+* actually binds on THIS machine". `fail()` instead of throwing so the
+* "no client.yaml — run client connect first" path renders as a clean
+* CLI error rather than a stack trace.
+*/
+function readClientId() {
+	const id = resolveConfigReadonly({
+		schema: clientConfigSchema,
+		role: "client"
+	}).client?.id;
+	if (typeof id !== "string" || id.length === 0) fail("MISSING_CLIENT_ID", "No client.id found in client.yaml. Run `first-tree-hub connect <token>` first.", 2);
+	return id;
+}
 function registerAgentCommands(program) {
 	const agent = program.command("agent").description("Agent management — config, bindings, messaging");
 	registerAgentConfigCommands(agent);
@@ -307,22 +322,65 @@ function registerAgentCommands(program) {
 		}
 	});
 	agent.command("remove <name>").description("Remove an agent from this client and delete its local runtime data (config dir, workspace, session state)").action((name) => {
-		const agentDir = join(DEFAULT_CONFIG_DIR, "agents", name);
-		if (!existsSync(agentDir)) {
+		if (!existsSync(join(DEFAULT_CONFIG_DIR, "agents", name))) {
 			print.line(`  Agent "${name}" not found.\n`);
 			process.exit(1);
 		}
-		rmSync(agentDir, {
-			recursive: true,
-			force: true
-		});
-		rmSync(join(DEFAULT_DATA_DIR, "workspaces", name), {
-			recursive: true,
-			force: true
-		});
-		rmSync(join(DEFAULT_DATA_DIR, "sessions", `${name}.json`), { force: true });
+		removeLocalAgent(name);
 		print.line(`  Agent "${name}" removed.\n`);
 	});
+	agent.command("prune").description("Remove local agent aliases that won't bind on this client (unowned, pinned elsewhere, or unreadable)").option("--yes", "Skip the interactive confirmation prompt").option("--dry-run", "Only list what would be removed; don't touch the filesystem").option("--server <url>", "Hub server URL").action(async (options) => {
+		try {
+			const serverUrl = resolveServerUrl(options.server);
+			const clientId = readClientId();
+			const sdk = new FirstTreeHubSDK({
+				serverUrl,
+				getAccessToken: () => ensureFreshAccessToken()
+			});
+			const stale = await findStaleAliases({
+				clientId,
+				listPinnedAgents: () => sdk.listMyAgents()
+			});
+			if (stale.length === 0) {
+				print.line("\n  ✓ No stale agent aliases. Local config matches the server.\n\n");
+				return;
+			}
+			print.line(`\n  ${stale.length} stale ${stale.length === 1 ? "alias" : "aliases"}:\n\n`);
+			for (const s of stale) {
+				const id = s.agentId ?? "—";
+				print.line(`    - ${s.name.padEnd(30)} ${id.padEnd(38)} ${formatStaleReason(s.reason)}\n`);
+			}
+			print.line("\n");
+			if (options.dryRun) {
+				print.line("  Dry run — no files removed. Re-run without --dry-run to delete.\n\n");
+				return;
+			}
+			if (!options.yes) {
+				if (!await confirm({
+					message: `Remove the ${stale.length} stale ${stale.length === 1 ? "alias" : "aliases"} above (config + workspace + session state)?`,
+					default: false
+				}).catch(() => false)) {
+					print.line("  Cancelled.\n\n");
+					return;
+				}
+			}
+			let removed = 0;
+			let failed = 0;
+			for (const s of stale) try {
+				removeLocalAgent(s.name);
+				print.line(`  ✓ removed ${s.name}\n`);
+				removed++;
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				print.line(`  ✗ ${s.name} (${msg.slice(0, 80)})\n`);
+				failed++;
+			}
+			print.line(`\n  ${removed} pruned${failed > 0 ? `, ${failed} failed (re-run to retry)` : ""}.\n\n`);
+			if (failed > 0) process.exitCode = 1;
+		} catch (error) {
+			fail("PRUNE_ERROR", error instanceof Error ? error.message : String(error));
+		}
+	});
 	agent.command("list").description("List agents — locally-configured by default, or every agent you manage with --remote").option("--remote", "List every agent you manage on the Hub server (cross-org)").option("--org <id>", "When listing remote, restrict to a single organization id").option("--server <url>", "Hub server URL").action(async (options) => {
 		if (!(options.remote === true || typeof options.org === "string")) {
 			const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
@@ -1124,11 +1182,32 @@ function registerClientCommands(program) {
 	});
 	client.command("doctor").description("Check client environment readiness").action(async () => {
 		print.line("\n  First Tree Hub Client Doctor\n\n");
+		let agentCheck;
+		try {
+			const serverUrl = resolveServerUrl();
+			const cfg = await initConfig({
+				schema: clientConfigSchema,
+				role: "client"
+			});
+			const sdk = new FirstTreeHubSDK({
+				serverUrl,
+				getAccessToken: () => ensureFreshAccessToken()
+			});
+			agentCheck = await reconcileAgentConfigs({
+				clientId: cfg.client.id,
+				listPinnedAgents: () => sdk.listMyAgents()
+			});
+		} catch {
+			agentCheck = checkAgentConfigs();
+		} finally {
+			resetConfig();
+			resetConfigMeta();
+		}
 		printResults([
 			checkNodeVersion(),
 			checkClientConfig(),
 			await checkServerReachable(),
-			checkAgentConfigs(),
+			agentCheck,
 			await checkWebSocket(),
 			checkBackgroundService()
 		]);
@@ -1182,7 +1261,7 @@ function registerClientCommands(program) {
 			fail("CLIENT_LIST_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	client.command("claim").description("Transfer ownership of this machine to your account (unpins the previous owner's agents from this machine)").option("--confirm", "Skip the interactive confirmation prompt").option("--server <url>", "Hub server URL").action(async (options) => {
+	client.command("claim").description("Transfer ownership of this machine to your account (unpins the previous owner's agents from this machine)").option("--confirm", "Skip confirmation prompts (claim + auto-prune stale aliases)").option("--server <url>", "Hub server URL").action(async (options) => {
 		try {
 			const config = await initConfig({
 				schema: clientConfigSchema,
@@ -1221,7 +1300,47 @@ function registerClientCommands(program) {
 			}
 			const result = await response.json();
 			print.line(`  ✓ Ownership transferred. ${result.unpinnedAgentCount} agent(s) unpinned.\n`);
-			print.line("  Run `first-tree-hub client start` to reconnect.\n\n");
+			try {
+				const sdk = new FirstTreeHubSDK({
+					serverUrl,
+					getAccessToken: () => ensureFreshAccessToken()
+				});
+				const stale = await findStaleAliases({
+					clientId,
+					listPinnedAgents: () => sdk.listMyAgents()
+				});
+				if (stale.length === 0) print.line("  No stale local aliases — local config already matches the server.\n");
+				else {
+					print.line(`\n  ${stale.length} local ${stale.length === 1 ? "alias" : "aliases"} won't bind on this client:\n\n`);
+					for (const s of stale) {
+						const id = s.agentId ?? "—";
+						print.line(`    - ${s.name.padEnd(30)} ${id.padEnd(38)} ${formatStaleReason(s.reason)}\n`);
+					}
+					print.line("\n");
+					if (options.confirm === true ? true : await confirm({
+						message: `Remove the ${stale.length} stale ${stale.length === 1 ? "alias" : "aliases"} above (config + workspace + session state)?`,
+						default: true
+					}).catch(() => false)) {
+						let removed = 0;
+						let failed = 0;
+						for (const s of stale) try {
+							removeLocalAgent(s.name);
+							print.line(`  ✓ removed ${s.name}\n`);
+							removed++;
+						} catch (err) {
+							const msg = err instanceof Error ? err.message : String(err);
+							print.line(`  ✗ ${s.name} (${msg.slice(0, 80)})\n`);
+							failed++;
+						}
+						print.line(`\n  ${removed} pruned${failed > 0 ? `, ${failed} failed (re-run \`agent prune\` to retry)` : ""}.\n`);
+					} else print.line("  Skipped. Run `first-tree-hub agent prune` later to clean up.\n");
+				}
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				print.line(`  (Could not check for stale aliases: ${msg.slice(0, 100)})\n`);
+				print.line("  Run `first-tree-hub agent prune` after reconnecting.\n");
+			}
+			print.line("\n  Run `first-tree-hub client start` to reconnect.\n\n");
 		} catch (error) {
 			fail("CLAIM_ERROR", error instanceof Error ? error.message : String(error));
 		} finally {

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import "./observability-DPyf745N-BSc8QNcR.mjs";
-import { $ as status, A as checkServerHealth, B as isDockerAvailable, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as installClientService, G as createOwner, H as ClientRuntime, I as isServiceSupported, K as hasUser, L as resolveCliInvocation, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as getClientServiceStatus, R as uninstallClientService, S as runMigrations, T as checkClientConfig, U as handleClientOrgMismatch, V as stopPostgres, W as rotateClientIdWithBackup, X as blank, _ as onboardCreate, d as isInteractive, f as promptAddAgent, g as onboardCheck, j as checkServerReachable, k as checkServerConfig, m as formatCheckReport, n as deriveHubUrlFromToken, nt as FirstTreeHubSDK, p as promptMissingFields, rt as SdkError, s as startServer, t as HubUrlDerivationError, y as runHomeMigration, z as ensurePostgres } from "./saas-connect-D-fy3xu-.mjs";
+import { A as checkServerHealth, B as ensurePostgres, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as getClientServiceStatus, G as rotateClientIdWithBackup, H as stopPostgres, I as installClientService, L as isServiceSupported, M as checkWebSocket, N as printResults, O as checkNodeVersion, R as resolveCliInvocation, S as runMigrations, T as checkClientConfig, U as ClientRuntime, V as isDockerAvailable, W as handleClientOrgMismatch, X as hasUser, Y as createOwner, _ as onboardCreate, d as isInteractive, et as blank, f as promptAddAgent, g as onboardCheck, j as checkServerReachable, k as checkServerConfig, m as formatCheckReport, n as deriveHubUrlFromToken, ot as FirstTreeHubSDK, p as promptMissingFields, rt as status, s as startServer, st as SdkError, t as HubUrlDerivationError, y as runHomeMigration, z as uninstallClientService } from "./saas-connect-CKQ15VLz.mjs";
 import "./logger-core-BTmvdflj-DjW8FM4T.mjs";
 import { a as resolveAccessToken, n as ensureFreshAccessToken, o as resolveServerUrl, r as ensureFreshAdminToken } from "./bootstrap-jx5nN1qZ.mjs";
 import "./dist-DSr_I5Ia.mjs";

package/dist/{saas-connect-D-fy3xu-.mjs → saas-connect-CKQ15VLz.mjs}

@@ -19,11 +19,11 @@ import { execFileSync, execSync, spawn, spawnSync } from "node:child_process";
 import { Codex } from "@openai/codex-sdk";
 import { fileURLToPath } from "node:url";
 import * as semver from "semver";
+import { confirm, input, password, select } from "@inquirer/prompts";
 import bcrypt from "bcrypt";
 import { and, asc, count, desc, eq, gt, inArray, isNotNull, isNull, lt, ne, or, sql } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
-import { confirm, input, password, select } from "@inquirer/prompts";
 import { migrate } from "drizzle-orm/postgres-js/migrator";
 import { bigserial, boolean, index, integer, jsonb, pgTable, primaryKey, serial, text, timestamp, unique, uniqueIndex } from "drizzle-orm/pg-core";
 import cors from "@fastify/cors";
@@ -5196,6 +5196,12 @@ var AgentSlot = class {
 			agentId: config.agentId
 		});
 	}
+	get name() {
+		return this.config.name;
+	}
+	get agentId() {
+		return this.config.agentId;
+	}
 	get clientConnection() {
 		return this.config.clientConnection;
 	}
@@ -5998,6 +6004,130 @@ function makeUuidV7() {
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 //#endregion
+//#region src/core/agent-prune.ts
+const minimalAgentYamlSchema = z.object({ agentId: z.string().min(1) }).passthrough();
+/**
+* Cross-reference local `agents/<name>/agent.yaml` files against the
+* server's pinned-agent set, returning every alias that won't bind on
+* THIS client.
+*
+* Why we don't use `loadAgents`:
+* `shared/config/loader.loadAgents` is fail-fast — one malformed
+* agent.yaml throws and the whole scan dies. The dominant prune target
+* IS the malformed dir (typo `agent add d`, half-written yaml, missing
+* agentId), so we walk dirs ourselves and degrade per-entry instead.
+*
+* Why we filter by clientId, not just userId:
+* `listPinnedAgents` (`/api/v1/clients/me/agents`) returns every agent
+* pinned to ANY client this user owns (cross-machine). For prune the
+* relevant question is "will R-RUN accept it on THIS machine", which
+* needs `agents.client_id === current client.id`. Anything pinned on
+* another client is reported with `pinned-elsewhere` so the operator
+* can either re-pin or delete the local alias deliberately.
+*/
+async function findStaleAliases(opts) {
+	const agentsDir = opts.agentsDir ?? join(DEFAULT_CONFIG_DIR, "agents");
+	if (!existsSync(agentsDir)) return [];
+	const remote = await opts.listPinnedAgents();
+	const pinnedHere = /* @__PURE__ */ new Set();
+	const pinnedElsewhere = /* @__PURE__ */ new Map();
+	for (const r of remote) if (r.clientId === opts.clientId) pinnedHere.add(r.agentId);
+	else pinnedElsewhere.set(r.agentId, r.clientId);
+	const stale = [];
+	for (const entry of readdirSync(agentsDir)) {
+		const agentDir = join(agentsDir, entry);
+		let isDir = false;
+		try {
+			isDir = statSync(agentDir).isDirectory();
+		} catch {
+			continue;
+		}
+		if (!isDir) continue;
+		const yamlPath = join(agentDir, "agent.yaml");
+		if (!existsSync(yamlPath)) {
+			stale.push({
+				name: entry,
+				agentId: null,
+				reason: {
+					kind: "unreadable",
+					error: "missing agent.yaml"
+				}
+			});
+			continue;
+		}
+		let agentId;
+		try {
+			const raw = parse(readFileSync(yamlPath, "utf-8"));
+			const parsed = minimalAgentYamlSchema.safeParse(raw);
+			if (!parsed.success) {
+				const issue = parsed.error.issues[0]?.message ?? "schema error";
+				stale.push({
+					name: entry,
+					agentId: null,
+					reason: {
+						kind: "unreadable",
+						error: issue
+					}
+				});
+				continue;
+			}
+			agentId = parsed.data.agentId;
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			stale.push({
+				name: entry,
+				agentId: null,
+				reason: {
+					kind: "unreadable",
+					error: msg
+				}
+			});
+			continue;
+		}
+		if (pinnedHere.has(agentId)) continue;
+		const otherClient = pinnedElsewhere.get(agentId);
+		if (otherClient !== void 0) stale.push({
+			name: entry,
+			agentId,
+			reason: {
+				kind: "pinned-elsewhere",
+				clientId: otherClient
+			}
+		});
+		else stale.push({
+			name: entry,
+			agentId,
+			reason: { kind: "unowned" }
+		});
+	}
+	return stale;
+}
+/** Human-readable suffix for the per-alias listing. */
+function formatStaleReason(reason) {
+	switch (reason.kind) {
+		case "unreadable": return `unreadable: ${reason.error}`;
+		case "unowned": return "no longer owned by you (deleted or transferred)";
+		case "pinned-elsewhere": return `pinned to another client: ${reason.clientId}`;
+	}
+}
+/**
+* Remove an agent's local footprint: the YAML alias dir, the workspace
+* tree under `data/workspaces/<name>`, and the session-mapping file under
+* `data/sessions/<name>.json`. Mirrors what `agent remove` does, exposed
+* separately so prune and claim can share it.
+*/
+function removeLocalAgent(name) {
+	rmSync(join(DEFAULT_CONFIG_DIR, "agents", name), {
+		recursive: true,
+		force: true
+	});
+	rmSync(join(DEFAULT_DATA_DIR$1, "workspaces", name), {
+		recursive: true,
+		force: true
+	});
+	rmSync(join(DEFAULT_DATA_DIR$1, "sessions", `${name}.json`), { force: true });
+}
+//#endregion
 //#region src/core/client-reidentify.ts
 /**
 * Handle a `CLIENT_ORG_MISMATCH` from the server by rotating the local
@@ -7090,6 +7220,69 @@ function checkAgentConfigs() {
 		};
 	}
 }
+/**
+* Server-aware agent reconciliation. Walks `agents/<name>/agent.yaml` and
+* cross-references each `agentId` with `/api/v1/clients/me/agents`,
+* filtering by `clientId` so the "stale" verdict matches what R-RUN will
+* actually accept on this machine.
+*
+* Categorises each local alias into:
+*   - pinned             — bind would succeed on this client.
+*   - pinned-elsewhere   — owned by you, but pinned to a different client
+*                          (alias is dead weight here; real agent is alive
+*                          on the other machine).
+*   - unowned            — agentId not in the server's response at all.
+*   - unreadable         — yaml missing/malformed/no agentId.
+*
+* The plain `checkAgentConfigs` (sync, local-only) is retained for
+* back-compat with external consumers but its "N configured" wording is
+* misleading because stale aliases never bind at runtime.
+*
+* Skipped reconciliation (server unreachable / unauthenticated) returns
+* `ok: false` — doctor's other server-touching checks already report
+* connectivity loss as a failure, and silently passing here would hide
+* the very issue the operator is running doctor to diagnose.
+*/
+async function reconcileAgentConfigs(opts) {
+	const agentsDir = opts.agentsDir ?? join(DEFAULT_CONFIG_DIR, "agents");
+	let localCount = 0;
+	if (existsSync(agentsDir)) for (const entry of readdirSync(agentsDir)) try {
+		if (statSync(join(agentsDir, entry)).isDirectory()) localCount++;
+	} catch {}
+	if (localCount === 0) return {
+		label: "Agents",
+		ok: false,
+		detail: "no agents configured"
+	};
+	let stale;
+	try {
+		stale = await findStaleAliases({
+			clientId: opts.clientId,
+			listPinnedAgents: opts.listPinnedAgents,
+			agentsDir
+		});
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		return {
+			label: "Agents",
+			ok: false,
+			detail: `${localCount} configured locally — server reconciliation failed (${msg.slice(0, 60)})`
+		};
+	}
+	const pinnedCount = localCount - stale.length;
+	if (stale.length === 0) return {
+		label: "Agents",
+		ok: true,
+		detail: `${localCount} configured, all pinned to this client`
+	};
+	const staleSummary = stale.map((s) => `${s.name} [${formatStaleReason(s.reason)}]`).slice(0, 5).join("; ");
+	const truncated = stale.length > 5 ? `; ...+${stale.length - 5} more` : "";
+	return {
+		label: "Agents",
+		ok: false,
+		detail: `${localCount} configured locally, ${pinnedCount} pinned to this client; ${stale.length} stale: ${staleSummary}${truncated} — run \`first-tree-hub agent prune\` to clean up`
+	};
+}
 function checkBackgroundService() {
 	const info = getClientServiceStatus();
 	if (info.platform === "unsupported") return {
@@ -18560,4 +18753,4 @@ function registerSaaSConnectCommand(program) {
 	});
 }
 //#endregion
-export { status as $, checkServerHealth as A, isDockerAvailable as B, checkAgentConfigs as C, checkDocker as D, checkDatabase as E, installClientService as F, createOwner as G, ClientRuntime as H, isServiceSupported as I, fail as J, hasUser as K, resolveCliInvocation as L, checkWebSocket as M, printResults as N, checkNodeVersion as O, getClientServiceStatus as P, setJsonMode as Q, uninstallClientService as R, runMigrations as S, checkClientConfig as T, handleClientOrgMismatch as U, stopPostgres as V, rotateClientIdWithBackup as W, blank as X, success as Y, print as Z, onboardCreate as _, declineUpdate as a, cleanWorkspaces as at, createApiNameResolver as b, COMMAND_VERSION as c, configureClientLoggerForService as ct, isInteractive as d, ClientOrgMismatchError as et, promptAddAgent as f, onboardCheck as g, loadOnboardState as h, createExecuteUpdate as i, SessionRegistry as it, checkServerReachable as j, checkServerConfig as k, reconcileLocalRuntimeProviders as l, formatCheckReport as m, deriveHubUrlFromToken as n, FirstTreeHubSDK as nt, promptUpdate as o, probeCapabilities as ot, promptMissingFields as p, resolveReplyToFromEnv as q, registerSaaSConnectCommand as r, SdkError as rt, startServer as s, applyClientLoggerConfig as st, HubUrlDerivationError as t, ClientUserMismatchError as tt, uploadClientCapabilities as u, saveOnboardState as v, checkBackgroundService as w, migrateLocalAgentDirs as x, runHomeMigration as y, ensurePostgres as z };
+export { success as $, checkServerHealth as A, ensurePostgres as B, checkAgentConfigs as C, checkDocker as D, checkDatabase as E, getClientServiceStatus as F, rotateClientIdWithBackup as G, stopPostgres as H, installClientService as I, removeLocalAgent as J, findStaleAliases as K, isServiceSupported as L, checkWebSocket as M, printResults as N, checkNodeVersion as O, reconcileAgentConfigs as P, fail as Q, resolveCliInvocation as R, runMigrations as S, checkClientConfig as T, ClientRuntime as U, isDockerAvailable as V, handleClientOrgMismatch as W, hasUser as X, createOwner as Y, resolveReplyToFromEnv as Z, onboardCreate as _, declineUpdate as a, ClientUserMismatchError as at, createApiNameResolver as b, COMMAND_VERSION as c, SessionRegistry as ct, isInteractive as d, applyClientLoggerConfig as dt, blank as et, promptAddAgent as f, configureClientLoggerForService as ft, onboardCheck as g, loadOnboardState as h, createExecuteUpdate as i, ClientOrgMismatchError as it, checkServerReachable as j, checkServerConfig as k, reconcileLocalRuntimeProviders as l, cleanWorkspaces as lt, formatCheckReport as m, deriveHubUrlFromToken as n, setJsonMode as nt, promptUpdate as o, FirstTreeHubSDK as ot, promptMissingFields as p, formatStaleReason as q, registerSaaSConnectCommand as r, status as rt, startServer as s, SdkError as st, HubUrlDerivationError as t, print as tt, uploadClientCapabilities as u, probeCapabilities as ut, saveOnboardState as v, checkBackgroundService as w, migrateLocalAgentDirs as x, runHomeMigration as y, uninstallClientService as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-team-foundation/first-tree-hub",
-  "version": "0.10.8",
+  "version": "0.10.9",
   "type": "module",
   "description": "First Tree Hub — unified CLI for server, client, and agent management",
   "exports": {