@phnx-labs/agents-cli 1.20.29 → 1.20.31

package/dist/commands/ssh.js

@@ -16,8 +16,11 @@ import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
-import { getDevice, loadDevices, removeDevice, upsertDevice, } from '../lib/devices/registry.js';
+import { machineId } from '../lib/session/sync/config.js';
+import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from '../lib/devices/tailscale.js';
+import { planDeviceReconciliation, runDeviceSync } from '../lib/devices/sync.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
 /** Parse `user@host` or `host` into pieces. */
@@ -27,8 +30,9 @@ function parseTarget(target) {
         return { host: target };
     return { user: target.slice(0, at), host: target.slice(at + 1) };
 }
-/** One-line summary of a device for `list`. */
-function deviceSummary(d) {
+/** One-line summary of a device for `list`. `isSelf` marks the machine this
+ * command is running on so it stands out from the rest of the tailnet. */
+function deviceSummary(d, isSelf = false) {
     const addr = hostNameFor(d) ?? chalk.gray('no address');
     const online = d.tailscale
         ? d.tailscale.online
@@ -36,7 +40,10 @@ function deviceSummary(d) {
             : chalk.gray('offline')
         : chalk.gray('unknown');
     const reach = d.tailscale?.online && !d.tailscale.direct ? chalk.yellow(' (relayed)') : '';
-    return `  ${chalk.bold(d.name.padEnd(16))} ${String(d.platform).padEnd(8)} ${(d.user ? d.user + '@' : '') + addr}  ${online}${reach}`;
+    const marker = isSelf ? chalk.cyan('▸ ') : '  ';
+    const name = isSelf ? chalk.bold.cyan(d.name.padEnd(16)) : chalk.bold(d.name.padEnd(16));
+    const here = isSelf ? chalk.cyan('  ← this machine') : '';
+    return `${marker}${name} ${String(d.platform).padEnd(8)} ${(d.user ? d.user + '@' : '') + addr}  ${online}${reach}${here}`;
 }
 /** Resolve a device or exit with a clear error. */
 async function mustGetDevice(name) {
@@ -47,6 +54,72 @@ async function mustGetDevice(name) {
     }
     return d;
 }
+/**
+ * Interactive `agents devices sync`: discover tailscale nodes, present a
+ * checkbox pre-checked with what's already registered, and reconcile the
+ * choice. Checked = registered (and un-ignored). Unchecked = removed from the
+ * registry AND added to the ignore-list, so auto-discovery never re-suggests
+ * it — this is the "click to register/unregister" surface, with dismissals that
+ * stick.
+ */
+async function runInteractiveDeviceSync() {
+    const spinner = ora('Reading tailscale status...').start();
+    let nodes;
+    try {
+        nodes = parseTailscaleStatus(tailscaleStatusJson());
+    }
+    catch (err) {
+        spinner.fail(err.message);
+        process.exit(1);
+    }
+    const [reg, ignored] = await Promise.all([loadDevices(), loadIgnored()]);
+    const registered = new Set(Object.keys(reg));
+    spinner.stop();
+    if (nodes.length === 0) {
+        console.log(chalk.gray('No tailscale nodes found.'));
+        return;
+    }
+    const { checkbox } = await import('@inquirer/prompts');
+    let selected;
+    try {
+        selected = await checkbox({
+            // Everything not already dismissed starts checked, so pressing Enter keeps
+            // the fleet as-is (matching what auto-sync would register). Unchecking a
+            // device removes it AND dismisses it so auto-sync never re-adds it.
+            message: 'Your fleet — uncheck a device to remove and stop suggesting it:',
+            pageSize: Math.min(nodes.length, 20),
+            choices: nodes.map((n) => {
+                const flags = [n.platform, n.online ? undefined : 'offline', ignored.has(n.name) ? 'ignored' : undefined]
+                    .filter(Boolean)
+                    .join(', ');
+                return { value: n.name, name: `${n.name}  ${chalk.gray(`(${flags})`)}`, checked: !ignored.has(n.name) };
+            }),
+        });
+    }
+    catch (err) {
+        if (isPromptCancelled(err)) {
+            console.log(chalk.gray('Cancelled — no changes.'));
+            return;
+        }
+        throw err;
+    }
+    const byName = new Map(nodes.map((n) => [n.name, n]));
+    const plan = planDeviceReconciliation(byName.keys(), selected, registered, ignored);
+    for (const name of plan.toRegister)
+        await upsertDevice(name, nodeToDeviceInput(byName.get(name)));
+    for (const name of plan.toUnignore)
+        await removeIgnored(name);
+    for (const name of plan.toRemove)
+        await removeDevice(name);
+    for (const name of plan.toIgnore)
+        await addIgnored(name);
+    const parts = [
+        chalk.green(`${plan.toRegister.length} registered`),
+        plan.toRemove.length ? chalk.yellow(`${plan.toRemove.length} removed`) : null,
+        plan.toIgnore.length ? chalk.gray(`${plan.toIgnore.length} ignored`) : null,
+    ].filter(Boolean);
+    console.log(parts.join(chalk.gray(' · ')));
+}
 /** Register the `agents devices` command tree. */
 function registerDevicesCommands(program) {
     const devicesCmd = program
@@ -54,43 +127,78 @@ function registerDevicesCommands(program) {
         .description('Registry of SSH device profiles (platform, user, address, auth), self-populated from Tailscale.')
         .addHelpText('after', `
 Typical workflow:
-  agents devices sync            # ingest tailscale nodes (auto-detect platform)
+  agents devices sync            # curate: pick which tailscale nodes to keep (TTY)
+  agents devices sync --yes      # non-interactive: register all non-ignored nodes
   agents devices list            # see what's registered
+  agents devices ignore ipad165  # dismiss a node so it's never re-suggested
   agents devices set win-mini --auth password --bundle muqsit
   agents devices render --write  # write ~/.ssh/config.d/agents include
 `);
     devicesCmd
         .command('sync')
-        .description('Ingest `tailscale status --json` and create/update device profiles (auto-detects platform, address, reachability).')
-        .action(async () => {
+        .description('Ingest `tailscale status --json` into device profiles. In a terminal, opens a checkbox to register/unregister nodes; with --yes, registers every non-ignored node.')
+        .option('--yes', 'skip the picker; register all discovered non-ignored nodes')
+        .action(async (opts) => {
+        if (isInteractiveTerminal() && !opts.yes) {
+            await runInteractiveDeviceSync();
+            return;
+        }
         const spinner = ora('Reading tailscale status...').start();
         try {
-            const nodes = parseTailscaleStatus(tailscaleStatusJson());
-            spinner.text = `Updating ${nodes.length} device${nodes.length === 1 ? '' : 's'}...`;
-            for (const node of nodes) {
-                await upsertDevice(node.name, nodeToDeviceInput(node));
-            }
-            spinner.succeed(`Synced ${nodes.length} device${nodes.length === 1 ? '' : 's'} from Tailscale`);
+            const res = await runDeviceSync();
+            const extra = res.pending.length ? chalk.gray(` (${res.pending.length} new)`) : '';
+            spinner.succeed(`Synced ${res.synced} device${res.synced === 1 ? '' : 's'} from Tailscale${extra}`);
         }
         catch (err) {
             spinner.fail(err.message);
             process.exit(1);
         }
     });
+    devicesCmd
+        .command('ignore <name>')
+        .description('Dismiss a node from auto-discovery so it is never re-suggested (and remove it from the registry if present).')
+        .action(async (name) => {
+        try {
+            await removeDevice(name);
+            await addIgnored(name);
+            console.log(chalk.green(`Ignored '${name}'`) + chalk.gray(" — it won't be suggested again. Undo with `agents devices unignore`."));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    devicesCmd
+        .command('unignore <name>')
+        .description('Undo `ignore`: allow a node to be discovered and registered again.')
+        .action(async (name) => {
+        const ok = await removeIgnored(name);
+        if (!ok) {
+            console.error(chalk.gray(`'${name}' was not ignored.`));
+            return;
+        }
+        console.log(chalk.green(`No longer ignoring '${name}'`) + chalk.gray(' — run `agents devices sync` to register it.'));
+    });
     devicesCmd
         .command('list')
         .alias('ls')
         .description('List registered devices with platform, address, and reachability.')
-        .action(async () => {
+        .option('--json', 'output the registry as a JSON array (for scripts and hooks)')
+        .action(async (opts) => {
         const reg = await loadDevices();
         const names = Object.keys(reg).sort();
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(names.map((n) => reg[n]), null, 2) + '\n');
+            return;
+        }
         if (names.length === 0) {
             console.log(chalk.gray("No devices. Run 'agents devices sync' or 'agents devices add <name> <user@host>'."));
             return;
         }
+        const self = machineId();
         console.log(chalk.bold(`Devices (${names.length})`));
         for (const name of names)
-            console.log(deviceSummary(reg[name]));
+            console.log(deviceSummary(reg[name], name === self));
     });
     devicesCmd
         .command('show <name>')

package/dist/commands/sync.js

@@ -30,7 +30,7 @@
 import * as path from 'path';
 import chalk from 'chalk';
 import { agentLabel, resolveAgentName } from '../lib/agents.js';
-import { isVersionInstalled, syncResourcesToVersion, parseAgentSpec, resolveVersion, resolveVersionAlias, listInstalledVersions, getAvailableResources, getActuallySyncedResources, getProjectOnlyResources, getNewResources, hasNewResources, promptResourceSelection, promptNewResourceSelection, } from '../lib/versions.js';
+import { isVersionInstalled, syncResourcesToVersion, parseAgentSpec, resolveVersion, resolveVersionAlias, listInstalledVersions, getAvailableResources, getActuallySyncedResources, getProjectOnlyResources, getNewResources, hasNewResources, promptResourceSelection, promptNewResourceSelection, buildRepoScopedSelection, listRepoNames, } from '../lib/versions.js';
 import { compileRulesForProject } from '../lib/rules/compile.js';
 import { runLaunchSync } from '../lib/project-launch.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
@@ -38,11 +38,12 @@ import { runUmbrellaSync } from '../lib/sync-umbrella.js';
 /** Register the `agents sync` command. */
 export function registerSyncCommand(program) {
     program
-        .command('sync [agentSpec]')
+        .command('sync [agentSpec] [repo]')
         .summary('Make this machine current, or sync resources into one agent')
-        .description('With an [agentSpec], syncs resources (commands, skills, hooks, rules, MCPs, plugins, etc.) into that installed agent version — previews changes and lets you pick. e.g. "claude", "claude@2.1.142", or a selector: @latest / @oldest / @pinned (= @default).\n\nWith NO agent, runs the umbrella verb: fetch remote state (config repos + secrets + sessions) then reconcile it into every installed agent. Scope it with --repos / --secrets / --sessions, --cloud (fetch only), or --local (reconcile only).')
+        .description('With an [agentSpec], syncs resources (commands, skills, hooks, rules, MCPs, plugins, etc.) into that installed agent version — previews changes and lets you pick. e.g. "claude", "claude@2.1.142", a selector: @latest / @oldest / @pinned (= @default), or @all for every installed version.\n\nAppend a [repo] (or pass --repo) to scope the sync to a single DotAgent repo — system / user / project / <alias>. e.g. "agents sync claude@all system" reconciles only the system repo\'s resources into every installed Claude.\n\nWith NO agent, runs the umbrella verb: fetch remote state (config repos + secrets + sessions) then reconcile it into every installed agent. Scope it with --repos / --secrets / --sessions, --cloud (fetch only), or --local (reconcile only).')
         .option('--agent <agent>', 'Agent identifier (legacy form; prefer the positional spec)')
         .option('--agent-version <version>', 'Version to sync into (legacy form; prefer "agent@version")')
+        .option('--repo <name>', 'Scope the sync to a single DotAgent repo: system / user / project / <alias> (also accepted as a positional)')
         .option('--project-dir <path>', 'Path to project-level .agents/ directory containing project-scoped resources')
         .option('--cwd <path>', 'Working directory for discovering project manifest and resources')
         .option('--launch', 'Hot-path mode (shim only): skip version-home reconciliation, run project-scoped compile + workspace mirror + plugin marketplaces', false)
@@ -55,8 +56,8 @@ export function registerSyncCommand(program) {
         .option('--sessions', 'Umbrella: sync session transcripts across machines', false)
         .option('--cloud', 'Umbrella: fetch all remote state but skip the local reconcile', false)
         .option('--local', "Umbrella: reconcile resources into installed agents only (no fetch)", false)
-        .action(async (agentSpec, opts) => {
-        await runSync(agentSpec, opts);
+        .action(async (agentSpec, repo, opts) => {
+        await runSync(agentSpec, repo, opts);
     });
 }
 /**
@@ -109,7 +110,7 @@ async function runUmbrella(opts, quiet, outLog, errLog) {
         process.exitCode = 1;
     }
 }
-async function runSync(agentSpec, opts) {
+async function runSync(agentSpec, repoArg, opts) {
     const quiet = !!opts.quiet;
     const errLog = (msg) => { if (!quiet)
         console.error(msg); };
@@ -119,16 +120,17 @@ async function runSync(agentSpec, opts) {
     let agentId;
     let version;
     // A positional @selector typed by the user (latest/oldest/pinned/default/
-    // explicit). parseAgentSpec defaults a missing version to 'latest', so a bare
-    // `agents sync claude` and `agents sync claude@latest` are indistinguishable
-    // after parsing — we only treat the version as a selector when an '@' was
-    // actually typed, keeping bare `claude` on the default-version path.
+    // all/explicit). parseAgentSpec defaults a missing version to 'latest', so a
+    // bare `agents sync claude` and `agents sync claude@latest` are
+    // indistinguishable after parsing — we only treat the version as a selector
+    // when an '@' was actually typed, keeping bare `claude` on the
+    // default-version path.
     let selector;
     if (agentSpec) {
         const parsed = parseAgentSpec(agentSpec);
         if (!parsed) {
             errLog(chalk.red(`Invalid agent spec '${agentSpec}'.`));
-            errLog(chalk.gray('Examples: claude, claude@2.1.142, claude@latest, claude@oldest, claude@pinned'));
+            errLog(chalk.gray('Examples: claude, claude@2.1.142, claude@latest, claude@oldest, claude@pinned, claude@all'));
             process.exitCode = 1;
             return;
         }
@@ -136,6 +138,18 @@ async function runSync(agentSpec, opts) {
         if (agentSpec.includes('@'))
             selector = parsed.version;
     }
+    // Repo scope: --repo flag wins over the positional. Validate against the
+    // known DotAgent repos so a typo fails loudly instead of syncing nothing.
+    const repoScope = opts.repo || repoArg;
+    if (repoScope !== undefined) {
+        const known = listRepoNames();
+        if (!known.includes(repoScope)) {
+            errLog(chalk.red(`Unknown repo '${repoScope}'.`));
+            errLog(chalk.gray(`Known repos: ${known.join(', ')}`));
+            process.exitCode = 1;
+            return;
+        }
+    }
     if (opts.agent) {
         const resolved = resolveAgentName(opts.agent);
         if (!resolved) {
@@ -156,6 +170,37 @@ async function runSync(agentSpec, opts) {
         await runUmbrella(opts, quiet, outLog, errLog);
         return;
     }
+    const projectDir = opts.projectDir;
+    const cwd = opts.cwd || process.cwd();
+    const force = !!opts.force;
+    // ---------- 2a. @all: reconcile every installed version of this agent ----------
+    // Non-interactive by design — fanning an interactive preview across N
+    // versions is unusable. Honors an optional repo scope.
+    if (selector === 'all') {
+        const installed = listInstalledVersions(agentId);
+        if (installed.length === 0) {
+            errLog(chalk.red(`No ${agentLabel(agentId)} versions installed.`));
+            errLog(chalk.gray(`Install one: agents add ${agentId}@latest`));
+            process.exitCode = 1;
+            return;
+        }
+        let selection;
+        if (repoScope) {
+            selection = buildRepoScopedSelection(repoScope, cwd);
+            if (Object.keys(selection).length === 0) {
+                outLog(chalk.gray(`Nothing from repo '${repoScope}' to sync.`));
+                return;
+            }
+        }
+        const scopeLabel = repoScope ? chalk.gray(` (repo: ${repoScope})`) : '';
+        outLog(chalk.cyan(`Syncing ${installed.length} ${agentLabel(agentId)} version(s)${scopeLabel}.`));
+        for (const v of installed) {
+            const result = syncResourcesToVersion(agentId, v, selection, { projectDir, cwd, force });
+            if (!quiet)
+                printSyncDetail(result, agentId, v, cwd);
+        }
+        return;
+    }
     // ---------- 2. Resolve version (project pin → global default → sole installed) ----------
     // A positional @selector wins over the default-resolution below.
     //   @latest / @oldest        → newest / oldest installed (process.exit if none)
@@ -197,15 +242,26 @@ async function runSync(agentSpec, opts) {
         process.exitCode = 1;
         return;
     }
-    const projectDir = opts.projectDir;
-    const cwd = opts.cwd || process.cwd();
     // ---------- 3. --launch mode bypasses everything below ----------
     if (opts.launch) {
         runLaunchMode(agentId, version, cwd, quiet);
         return;
     }
+    // ---------- 3b. Repo-scoped single-version sync ----------
+    // An explicit --repo / positional repo is a targeted request, so skip the
+    // interactive preview and reconcile just that repo's resources.
+    if (repoScope) {
+        const scoped = buildRepoScopedSelection(repoScope, cwd);
+        if (Object.keys(scoped).length === 0) {
+            outLog(chalk.gray(`Nothing from repo '${repoScope}' to sync into ${agentLabel(agentId)}@${version}.`));
+            return;
+        }
+        const result = syncResourcesToVersion(agentId, version, scoped, { projectDir, cwd, force });
+        if (!quiet)
+            printSyncDetail(result, agentId, version, cwd);
+        return;
+    }
     // ---------- 4. Decide selection (interactive preview vs auto) ----------
-    const force = !!opts.force;
     const yes = !!opts.yes;
     const interactive = !quiet && !yes && isInteractiveTerminal();
     let selection;

package/dist/lib/agents.d.ts

@@ -111,10 +111,6 @@ export interface AccountInfo {
 }
 /** Return the email address associated with the agent's auth config, or null. */
 export declare function getAccountEmail(agentId: AgentId, home?: string): Promise<string | null>;
-/**
- * Extract full account information (identity, plan, usage status, credits) from
- * the agent's local auth/config files. Supports Claude, Codex, and Gemini.
- */
 export declare function getAccountInfo(agentId: AgentId, home?: string): Promise<AccountInfo>;
 /**
  * Determine when the agent was last used by checking session file mtimes,

package/dist/lib/agents.js

@@ -410,6 +410,7 @@ export const AGENTS = {
         npmPackage: '',
         installScript: 'curl -fsSL https://antigravity.google/cli/install.sh | bash',
         configDir: path.join(HOME, '.gemini', 'antigravity-cli'),
+        authFiles: ['antigravity-oauth-token'],
         commandsDir: path.join(HOME, '.gemini', 'antigravity-cli', 'commands'),
         commandsSubdir: 'commands',
         skillsDir: path.join(HOME, '.gemini', 'antigravity-cli', 'skills'),
@@ -470,6 +471,7 @@ export const AGENTS = {
         npmPackage: '@moonshot-ai/kimi-code',
         installScript: 'curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash',
         configDir: path.join(HOME, '.kimi-code'),
+        authFiles: ['credentials/kimi-code.json'],
         commandsDir: '',
         commandsSubdir: '',
         skillsDir: path.join(HOME, '.kimi-code', 'skills'),
@@ -494,7 +496,8 @@ export const AGENTS = {
     },
     // Factory AI Droid CLI (`droid`) — agentic coding CLI from factory.ai.
     // Install: `curl -fsSL https://app.factory.ai/cli | sh` (no npm package).
-    // Binary is NOT in node_modules/.bin — resolved via resolveDroidBinary().
+    // Binary is NOT in node_modules/.bin — the shim resolves the fixed install
+    // path ~/.local/bin/droid directly (see the droid branch in shims.ts).
     // Config: `~/.factory/` (settings.json, mcp.json, droids/, commands/).
     // Memory: native AGENTS.md. Subagents = custom droids (top-level .md files
     // in ~/.factory/droids/). Config isolation rides the ~/.factory symlink
@@ -508,6 +511,7 @@ export const AGENTS = {
         npmPackage: '',
         installScript: 'curl -fsSL https://app.factory.ai/cli | sh',
         configDir: path.join(HOME, '.factory'),
+        authFiles: ['auth.v2.file', 'auth.v2.key'],
         commandsDir: path.join(HOME, '.factory', 'commands'),
         commandsSubdir: 'commands',
         skillsDir: '', // no skills concept
@@ -707,6 +711,7 @@ export const UNMANAGED_DETECTION_CANDIDATES = [
     'gemini',
     'grok',
     'copilot',
+    'droid',
 ];
 /**
  * Detect existing agent installations that are NOT yet managed by agents-cli.
@@ -770,6 +775,64 @@ export async function getAccountEmail(agentId, home) {
  * Extract full account information (identity, plan, usage status, credits) from
  * the agent's local auth/config files. Supports Claude, Codex, and Gemini.
  */
+/**
+ * Resolve a file-auth agent's credential file. Sign-in is account-global, but
+ * each installed version gets an isolated home; the credential physically lives
+ * only in the home the user logged in under (the one the `~/.<config>` symlink
+ * targets). Check the per-version `base` first, then fall back to the active
+ * config location under the real HOME so every installed version reflects the
+ * true account state (droid/antigravity/kimi all stored login per-version-home
+ * and showed non-active versions as "not signed in"). Returns the first
+ * existing path, or null.
+ */
+function resolveAccountCredentialPath(base, ...segments) {
+    const perVersion = path.join(base, ...segments);
+    try {
+        if (fs.existsSync(perVersion))
+            return perVersion;
+    }
+    catch { /* unreadable */ }
+    const active = path.join(process.env.AGENTS_REAL_HOME || os.homedir(), ...segments);
+    if (active !== perVersion) {
+        try {
+            if (fs.existsSync(active))
+                return active;
+        }
+        catch { /* unreadable */ }
+    }
+    return null;
+}
+let cachedAgyKeychainSignedIn;
+/**
+ * Antigravity (`agy`, a Codeium/Windsurf-based CLI) stores its OAuth token in
+ * the macOS keychain — service `gemini`, account `antigravity` — NOT a file.
+ * The file path (`antigravity-oauth-token`) only exists on Linux, where the Go
+ * keyring falls back to disk. Probe the keychain for existence (metadata only;
+ * `-w` omitted so it never prompts). Cached per process — the keychain is
+ * account-global, so one probe covers every installed version. Returns false on
+ * non-macOS (the file path handles those).
+ */
+async function antigravityKeychainSignedIn() {
+    if (cachedAgyKeychainSignedIn !== undefined)
+        return cachedAgyKeychainSignedIn;
+    // Test isolation: the real macOS keychain can't be sandboxed per-test, so
+    // allow suites asserting "signed out" to opt out of the probe (same spirit as
+    // AGENTS_REAL_HOME). Not cached, so tests can toggle it.
+    if (process.env.AGENTS_NO_KEYCHAIN_PROBE === '1')
+        return false;
+    if (process.platform !== 'darwin') {
+        cachedAgyKeychainSignedIn = false;
+        return false;
+    }
+    try {
+        await execFileAsync('security', ['find-generic-password', '-s', 'gemini', '-a', 'antigravity'], { timeout: 3000 });
+        cachedAgyKeychainSignedIn = true;
+    }
+    catch {
+        cachedAgyKeychainSignedIn = false;
+    }
+    return cachedAgyKeychainSignedIn;
+}
 export async function getAccountInfo(agentId, home) {
     const base = home || os.homedir();
     const empty = {
@@ -906,40 +969,60 @@ export async function getAccountInfo(agentId, home) {
                 return { ...empty, email, signedIn: !!email, lastActive };
             }
             case 'grok': {
-                // Grok stores auth in ~/.grok/auth.json
+                // Grok stores auth in ~/.grok/auth.json as a map keyed by
+                // "<oidc_issuer>::<client_id>" -> { email, user_id, refresh_token,
+                // create_time, expires_at, team_id, ... }. (Older builds wrote a flat
+                // object with a top-level email.) The old code only read a TOP-LEVEL
+                // `email`, so the current nested format always looked signed-out even
+                // when logged in. Read the newest account record: a refresh token means
+                // signed in, and we surface the email/ids like claude/codex.
+                const authPath = resolveAccountCredentialPath(base, '.grok', 'auth.json');
+                if (!authPath)
+                    return { ...empty, lastActive };
                 try {
-                    const authPath = path.join(base, '.grok', 'auth.json');
-                    if (fs.existsSync(authPath)) {
-                        const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
-                        const email = data.email || data.user?.email || data.account?.email || null;
-                        return { ...empty, email, signedIn: !!email, lastActive };
+                    const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
+                    const records = (data && typeof data === 'object' ? [data, ...Object.values(data)] : [])
+                        .filter((r) => !!r && typeof r === 'object');
+                    const account = records
+                        .filter(r => typeof r.refresh_token === 'string' || typeof r.email === 'string')
+                        .sort((a, b) => String(b.create_time || '').localeCompare(String(a.create_time || '')))[0];
+                    if (account) {
+                        const email = typeof account.email === 'string' ? account.email : null;
+                        const accountId = normalizeIdentityPart(account.user_id ?? account.principal_id);
+                        const organizationId = normalizeIdentityPart(account.team_id);
+                        const accountKey = buildIdentityKey(agentId, [['user', accountId], ['org', organizationId]]);
+                        return { ...empty, email, accountId, organizationId, accountKey, signedIn: true, lastActive };
                     }
                 }
                 catch { }
                 return { ...empty, lastActive };
             }
             case 'antigravity': {
-                // Antigravity (`agy`) stores a Google OAuth token at
-                // ~/.gemini/antigravity-cli/antigravity-oauth-token. It's a consumer
-                // OAuth grant (access + refresh token, no id_token), so there's no email
-                // claim to read locally — presence of a refresh token is the only
-                // signed-in signal we can derive without a network call.
-                const tokenPath = path.join(base, '.gemini', 'antigravity-cli', 'antigravity-oauth-token');
-                if (!fs.existsSync(tokenPath))
-                    return { ...empty, lastActive };
-                const data = JSON.parse(await fs.promises.readFile(tokenPath, 'utf-8'));
-                const hasToken = typeof data?.token?.refresh_token === 'string' && !!data.token.refresh_token;
-                if (!hasToken)
-                    return { ...empty, lastActive };
-                return { ...empty, signedIn: true, lastActive };
+                // Antigravity (`agy`) stores a consumer Google OAuth grant (access +
+                // refresh token, no id_token) — presence of a refresh token is the only
+                // signed-in signal we can derive without a network call. Storage is
+                // platform-split: on Linux it's a file at
+                // ~/.gemini/antigravity-cli/antigravity-oauth-token; on macOS the Go
+                // keyring puts it in the keychain (service 'gemini', account
+                // 'antigravity'), so no file exists — check both.
+                const tokenPath = resolveAccountCredentialPath(base, '.gemini', 'antigravity-cli', 'antigravity-oauth-token');
+                if (tokenPath) {
+                    const data = JSON.parse(await fs.promises.readFile(tokenPath, 'utf-8'));
+                    if (typeof data?.token?.refresh_token === 'string' && data.token.refresh_token) {
+                        return { ...empty, signedIn: true, lastActive };
+                    }
+                }
+                if (await antigravityKeychainSignedIn())
+                    return { ...empty, signedIn: true, lastActive };
+                return { ...empty, lastActive };
             }
             case 'kimi': {
                 // Kimi Code stores OAuth credentials at
                 // ~/.kimi-code/credentials/kimi-code.json. The access token is a JWT
                 // whose payload carries an opaque user_id (no email), so we report
                 // signed-in state plus a stable account key for usage dedup.
-                const credPath = path.join(base, '.kimi-code', 'credentials', 'kimi-code.json');
-                if (!fs.existsSync(credPath))
+                const credPath = resolveAccountCredentialPath(base, '.kimi-code', 'credentials', 'kimi-code.json');
+                if (!credPath)
                     return { ...empty, lastActive };
                 const data = JSON.parse(await fs.promises.readFile(credPath, 'utf-8'));
                 const accessToken = data?.access_token;
@@ -950,6 +1033,18 @@ export async function getAccountInfo(agentId, home) {
                 const accountKey = buildIdentityKey(agentId, [['user', userId]]);
                 return { ...empty, signedIn: true, accountId: userId, accountKey, lastActive };
             }
+            case 'droid': {
+                // Factory Droid stores auth at ~/.factory/auth.v2.file (+ auth.v2.key,
+                // an encrypted blob). No email/JWT is readable locally, so presence of
+                // the auth file is the only signed-in signal we can derive without a
+                // network call — same pattern as antigravity/kimi. `.factory` is the
+                // config dir on every platform (macOS/Linux ~/.factory, Windows
+                // %USERPROFILE%\.factory), so path.join keeps this cross-platform.
+                const authPath = resolveAccountCredentialPath(base, '.factory', 'auth.v2.file');
+                if (!authPath)
+                    return { ...empty, lastActive };
+                return { ...empty, signedIn: true, lastActive };
+            }
             default:
                 return { ...empty, lastActive };
         }
@@ -1051,6 +1146,8 @@ function getSessionDir(agentId, base) {
             // Copilot persists sessions at ~/.copilot/session-state/<id>/events.jsonl.
             // The events.jsonl is the canonical NDJSON event stream per session.
             return path.join(base, '.copilot', 'session-state');
+        case 'droid':
+            return path.join(base, '.factory', 'sessions');
         default:
             return null;
     }
@@ -1061,6 +1158,7 @@ function getSessionExtension(agentId) {
         case 'claude':
         case 'codex':
         case 'copilot':
+        case 'droid':
             return '.jsonl';
         case 'gemini':
             return '.json';
@@ -1661,6 +1759,8 @@ export const AGENT_NAME_ALIASES = {
     gk: 'grok',
     kimi: 'kimi',
     'kimi-code': 'kimi',
+    factory: 'droid',
+    'factory-ai': 'droid',
 };
 /**
  * Resolve a user-provided agent name (alias, shorthand, or canonical) to its AgentId.

package/dist/lib/browser/drivers/ssh.js

@@ -8,6 +8,10 @@ import { writeProfileRuntime, clearProfileRuntime } from '../runtime-state.js';
 // so existing importers of `shellQuote` from this module keep working.
 import { shellQuote } from '../../ssh-exec.js';
 export { shellQuote };
+// The `ssh -L` tunnel spawn is shared with `agents computer --host`; it lives in
+// the single ssh-tunnel helper. Calling it with no options preserves this
+// driver's original foreground, stderr-captured behavior exactly.
+import { startSSHTunnel } from '../../ssh-tunnel.js';
 export async function connectSSH(endpoint, profile) {
     const url = new URL(endpoint);
     if (url.protocol !== 'ssh:') {
@@ -102,41 +106,6 @@ export async function connectSSH(endpoint, profile) {
         },
     };
 }
-function startSSHTunnel(user, host, localPort, remotePort) {
-    return new Promise((resolve, reject) => {
-        const args = [
-            '-L',
-            `${localPort}:127.0.0.1:${remotePort}`,
-            `${user}@${host}`,
-            '-N',
-            '-o',
-            'StrictHostKeyChecking=accept-new',
-            '-o',
-            'BatchMode=yes',
-            '-o',
-            'ConnectTimeout=10',
-        ];
-        const tunnel = spawn('ssh', args, {
-            stdio: ['ignore', 'ignore', 'pipe'],
-            detached: false,
-        });
-        let stderr = '';
-        tunnel.stderr?.on('data', (data) => {
-            stderr += data.toString();
-        });
-        tunnel.on('error', (err) => {
-            reject(new Error(`SSH tunnel failed: ${err.message}`));
-        });
-        setTimeout(() => {
-            if (tunnel.killed) {
-                reject(new Error(`SSH tunnel died: ${stderr}`));
-            }
-            else {
-                resolve(tunnel);
-            }
-        }, 500);
-    });
-}
 async function waitForPort(port, timeoutMs) {
     const start = Date.now();
     while (Date.now() - start < timeoutMs) {