@phnx-labs/agents-cli 1.20.30 → 1.20.31

package/dist/commands/sessions-picker.js

@@ -11,6 +11,7 @@ import { cleanSessionPrompt, extractSessionTopic } from '../lib/session/prompt.j
 import { linkPath, relativeToCwd } from '../lib/session/render.js';
 import { renderMarkdown } from '../lib/markdown.js';
 import { itemPicker } from '../lib/picker.js';
+import { classifyFileChanges, changeCounts, toolHistogram, detectTestResult } from '../lib/session/digest.js';
 /**
  * SessionMeta originates in discover.ts (gitBranch, cwd, label, etc. read from
  * untrusted session files). parseSession sanitizes event payloads at its
@@ -176,8 +177,8 @@ const TODOS_MAX_ITEMS = 5;
 function formatCompactPreview(events, session) {
     let firstUser = '';
     let lastAssistant = '';
-    const filesModified = new Set();
     const filesRead = new Set();
+    const toolCounts = {};
     let toolCalls = 0;
     let planFile = '';
     let latestTodos = null;
@@ -195,10 +196,7 @@ function formatCompactPreview(events, session) {
         else if (event.type === 'tool_use' && !event._local) {
             const tool = event.tool || '';
             const p = event.path || event.args?.file_path || event.args?.path || '';
-            if (['Write', 'Edit', 'write_file', 'edit_file', 'create_file', 'replace', 'patch'].includes(tool) && p) {
-                filesModified.add(p);
-            }
-            else if (['Read', 'read_file', 'view_file', 'cat_file', 'get_file'].includes(tool) && p) {
+            if (['Read', 'read_file', 'view_file', 'cat_file', 'get_file'].includes(tool) && p) {
                 filesRead.add(p);
             }
             if (!planFile && p && /\/plans\/[^/]+\.md$/.test(p)) {
@@ -207,9 +205,14 @@ function formatCompactPreview(events, session) {
             if (tool === 'TodoWrite' && Array.isArray(event.args?.todos)) {
                 latestTodos = event.args.todos;
             }
+            if (tool)
+                toolCounts[tool] = (toolCounts[tool] ?? 0) + 1;
             toolCalls++;
         }
     }
+    // Digest signals folded into the preview: change lifecycle, tool mix, tests.
+    const changes = classifyFileChanges(events);
+    const chg = changeCounts(changes);
     const lines = [];
     const termWidth = process.stdout.columns || 80;
     if (firstUser) {
@@ -219,14 +222,36 @@ function formatCompactPreview(events, session) {
         }
     }
     const activity = [];
-    if (filesModified.size)
-        activity.push(`${filesModified.size} modified`);
+    const changed = chg.created + chg.modified + chg.deleted;
+    if (changed) {
+        const parts = [
+            chg.created ? chalk.green(`+${chg.created}`) : '',
+            chg.modified ? chalk.yellow(`~${chg.modified}`) : '',
+            chg.deleted ? chalk.red(`−${chg.deleted}`) : '',
+        ].filter(Boolean).join(' ');
+        activity.push(`${parts} ${chalk.gray('changed')}`);
+    }
     if (filesRead.size)
-        activity.push(`${filesRead.size} read`);
+        activity.push(chalk.gray(`${filesRead.size} read`));
     if (toolCalls)
-        activity.push(`${toolCalls} tool${toolCalls === 1 ? '' : 's'}`);
+        activity.push(chalk.gray(`${toolCalls} tool${toolCalls === 1 ? '' : 's'}`));
     if (activity.length) {
-        lines.push(chalk.cyan('Activity: ') + chalk.gray(activity.join(' · ')));
+        lines.push(chalk.cyan('Changes:  ') + activity.join(chalk.gray(' · ')));
+    }
+    // Tool mix (top 4) — what kind of work this was.
+    const hist = toolHistogram(toolCounts, 4);
+    if (hist.length) {
+        lines.push(chalk.cyan('Tools:    ') + chalk.gray(hist.map(h => `${h.tool} ${h.count}`).join(' · ')));
+    }
+    // Last test/build verdict.
+    const test = detectTestResult(events);
+    if (test?.ok) {
+        const bits = [
+            test.passed !== undefined ? chalk.green(`${test.passed} pass`) : '',
+            test.failed ? chalk.red(`${test.failed} fail`) : '',
+        ].filter(Boolean).join(chalk.gray(' · '));
+        const mark = test.failed ? chalk.red('✗') : chalk.green('✓');
+        lines.push(chalk.cyan('Tests:    ') + `${mark} ${test.runner}${bits ? ' ' + bits : ''}`);
     }
     if (planFile) {
         const basename = planFile.split('/').pop() || planFile;

package/dist/commands/sessions.js

@@ -227,7 +227,8 @@ function printActiveRow(s, indent) {
     const kindCol = colorAgent(s.kind)(padToWidth(truncateToWidth(s.kind, 8), 9));
     const hostCol = chalk.gray(padToWidth(truncateToWidth(s.host ?? '-', 8), 9));
     const statusCol = statusColor(s.status)(padToWidth(truncateToWidth(activityLabel(s), 8), 9));
-    const badges = signalBadges(s);
+    const fork = s.pidCount && s.pidCount > 1 ? chalk.dim(`×${s.pidCount} `) : '';
+    const badges = (fork ? fork : '') + signalBadges(s);
     const desc = buildSessionDescription(s) || '-';
     // Fill the remaining width with the preview so nothing wraps under tmux/SSH.
     const fixed = stringWidth(indent) + 9 + 9 + 9 + 9 + (badges ? stringWidth(badges) + 1 : 0);
@@ -685,6 +686,13 @@ async function renderSession(session, mode, filters, options = {}) {
         const modelStr = stats.models.length > 0 ? chalk.yellow(`  ${stats.models.join(', ')}`) : '';
         const branchStr = session.gitBranch ? chalk.gray(` (${session.gitBranch})`) : '';
         const absTime = formatAbsoluteTime(session.timestamp);
+        // Auto-inferred title headline (user /rename > Claude ai-title > first-prompt
+        // topic) — the fastest way to recognize which task this session is.
+        const title = session.label || session.topic;
+        if (title) {
+            const badges = signalBadges(metaSignals(session));
+            console.log(chalk.bold.white(title) + (badges ? '  ' + badges : ''));
+        }
         console.log(agentColor(session.agent) +
             (session.version ? chalk.yellow(` ${session.version}`) : '') +
             modelStr +

package/dist/commands/setup.js

@@ -109,6 +109,14 @@ export async function runSetup(program, options = {}) {
             spinner.succeed(`Cloned ${systemRepoSlug(systemRepo)} (${result.commit})`);
         }
     }
+    // Populate the device registry from the tailnet on first setup. Soft mode is
+    // guaranteed non-throwing (no tailscale / corrupt file / lock contention all
+    // resolve to ok:false), so this can never block setup.
+    const { runDeviceSync } = await import('../lib/devices/sync.js');
+    const dev = await runDeviceSync({ soft: true });
+    if (dev.ok && dev.synced > 0) {
+        console.log(chalk.gray(`Discovered ${dev.synced} device${dev.synced === 1 ? '' : 's'} on your tailnet (agents devices list).`));
+    }
     // Offer to import existing unmanaged installations
     if (unmanaged.length > 0 && isInteractiveTerminal()) {
         console.log(chalk.bold('\nFound existing installations:\n'));

package/dist/commands/ssh.js

@@ -16,8 +16,11 @@ import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
-import { getDevice, loadDevices, removeDevice, upsertDevice, } from '../lib/devices/registry.js';
+import { machineId } from '../lib/session/sync/config.js';
+import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from '../lib/devices/tailscale.js';
+import { planDeviceReconciliation, runDeviceSync } from '../lib/devices/sync.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
 /** Parse `user@host` or `host` into pieces. */
@@ -27,8 +30,9 @@ function parseTarget(target) {
         return { host: target };
     return { user: target.slice(0, at), host: target.slice(at + 1) };
 }
-/** One-line summary of a device for `list`. */
-function deviceSummary(d) {
+/** One-line summary of a device for `list`. `isSelf` marks the machine this
+ * command is running on so it stands out from the rest of the tailnet. */
+function deviceSummary(d, isSelf = false) {
     const addr = hostNameFor(d) ?? chalk.gray('no address');
     const online = d.tailscale
         ? d.tailscale.online
@@ -36,7 +40,10 @@ function deviceSummary(d) {
             : chalk.gray('offline')
         : chalk.gray('unknown');
     const reach = d.tailscale?.online && !d.tailscale.direct ? chalk.yellow(' (relayed)') : '';
-    return `  ${chalk.bold(d.name.padEnd(16))} ${String(d.platform).padEnd(8)} ${(d.user ? d.user + '@' : '') + addr}  ${online}${reach}`;
+    const marker = isSelf ? chalk.cyan('▸ ') : '  ';
+    const name = isSelf ? chalk.bold.cyan(d.name.padEnd(16)) : chalk.bold(d.name.padEnd(16));
+    const here = isSelf ? chalk.cyan('  ← this machine') : '';
+    return `${marker}${name} ${String(d.platform).padEnd(8)} ${(d.user ? d.user + '@' : '') + addr}  ${online}${reach}${here}`;
 }
 /** Resolve a device or exit with a clear error. */
 async function mustGetDevice(name) {
@@ -47,6 +54,72 @@ async function mustGetDevice(name) {
     }
     return d;
 }
+/**
+ * Interactive `agents devices sync`: discover tailscale nodes, present a
+ * checkbox pre-checked with what's already registered, and reconcile the
+ * choice. Checked = registered (and un-ignored). Unchecked = removed from the
+ * registry AND added to the ignore-list, so auto-discovery never re-suggests
+ * it — this is the "click to register/unregister" surface, with dismissals that
+ * stick.
+ */
+async function runInteractiveDeviceSync() {
+    const spinner = ora('Reading tailscale status...').start();
+    let nodes;
+    try {
+        nodes = parseTailscaleStatus(tailscaleStatusJson());
+    }
+    catch (err) {
+        spinner.fail(err.message);
+        process.exit(1);
+    }
+    const [reg, ignored] = await Promise.all([loadDevices(), loadIgnored()]);
+    const registered = new Set(Object.keys(reg));
+    spinner.stop();
+    if (nodes.length === 0) {
+        console.log(chalk.gray('No tailscale nodes found.'));
+        return;
+    }
+    const { checkbox } = await import('@inquirer/prompts');
+    let selected;
+    try {
+        selected = await checkbox({
+            // Everything not already dismissed starts checked, so pressing Enter keeps
+            // the fleet as-is (matching what auto-sync would register). Unchecking a
+            // device removes it AND dismisses it so auto-sync never re-adds it.
+            message: 'Your fleet — uncheck a device to remove and stop suggesting it:',
+            pageSize: Math.min(nodes.length, 20),
+            choices: nodes.map((n) => {
+                const flags = [n.platform, n.online ? undefined : 'offline', ignored.has(n.name) ? 'ignored' : undefined]
+                    .filter(Boolean)
+                    .join(', ');
+                return { value: n.name, name: `${n.name}  ${chalk.gray(`(${flags})`)}`, checked: !ignored.has(n.name) };
+            }),
+        });
+    }
+    catch (err) {
+        if (isPromptCancelled(err)) {
+            console.log(chalk.gray('Cancelled — no changes.'));
+            return;
+        }
+        throw err;
+    }
+    const byName = new Map(nodes.map((n) => [n.name, n]));
+    const plan = planDeviceReconciliation(byName.keys(), selected, registered, ignored);
+    for (const name of plan.toRegister)
+        await upsertDevice(name, nodeToDeviceInput(byName.get(name)));
+    for (const name of plan.toUnignore)
+        await removeIgnored(name);
+    for (const name of plan.toRemove)
+        await removeDevice(name);
+    for (const name of plan.toIgnore)
+        await addIgnored(name);
+    const parts = [
+        chalk.green(`${plan.toRegister.length} registered`),
+        plan.toRemove.length ? chalk.yellow(`${plan.toRemove.length} removed`) : null,
+        plan.toIgnore.length ? chalk.gray(`${plan.toIgnore.length} ignored`) : null,
+    ].filter(Boolean);
+    console.log(parts.join(chalk.gray(' · ')));
+}
 /** Register the `agents devices` command tree. */
 function registerDevicesCommands(program) {
     const devicesCmd = program
@@ -54,43 +127,78 @@ function registerDevicesCommands(program) {
         .description('Registry of SSH device profiles (platform, user, address, auth), self-populated from Tailscale.')
         .addHelpText('after', `
 Typical workflow:
-  agents devices sync            # ingest tailscale nodes (auto-detect platform)
+  agents devices sync            # curate: pick which tailscale nodes to keep (TTY)
+  agents devices sync --yes      # non-interactive: register all non-ignored nodes
   agents devices list            # see what's registered
+  agents devices ignore ipad165  # dismiss a node so it's never re-suggested
   agents devices set win-mini --auth password --bundle muqsit
   agents devices render --write  # write ~/.ssh/config.d/agents include
 `);
     devicesCmd
         .command('sync')
-        .description('Ingest `tailscale status --json` and create/update device profiles (auto-detects platform, address, reachability).')
-        .action(async () => {
+        .description('Ingest `tailscale status --json` into device profiles. In a terminal, opens a checkbox to register/unregister nodes; with --yes, registers every non-ignored node.')
+        .option('--yes', 'skip the picker; register all discovered non-ignored nodes')
+        .action(async (opts) => {
+        if (isInteractiveTerminal() && !opts.yes) {
+            await runInteractiveDeviceSync();
+            return;
+        }
         const spinner = ora('Reading tailscale status...').start();
         try {
-            const nodes = parseTailscaleStatus(tailscaleStatusJson());
-            spinner.text = `Updating ${nodes.length} device${nodes.length === 1 ? '' : 's'}...`;
-            for (const node of nodes) {
-                await upsertDevice(node.name, nodeToDeviceInput(node));
-            }
-            spinner.succeed(`Synced ${nodes.length} device${nodes.length === 1 ? '' : 's'} from Tailscale`);
+            const res = await runDeviceSync();
+            const extra = res.pending.length ? chalk.gray(` (${res.pending.length} new)`) : '';
+            spinner.succeed(`Synced ${res.synced} device${res.synced === 1 ? '' : 's'} from Tailscale${extra}`);
         }
         catch (err) {
             spinner.fail(err.message);
             process.exit(1);
         }
     });
+    devicesCmd
+        .command('ignore <name>')
+        .description('Dismiss a node from auto-discovery so it is never re-suggested (and remove it from the registry if present).')
+        .action(async (name) => {
+        try {
+            await removeDevice(name);
+            await addIgnored(name);
+            console.log(chalk.green(`Ignored '${name}'`) + chalk.gray(" — it won't be suggested again. Undo with `agents devices unignore`."));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    devicesCmd
+        .command('unignore <name>')
+        .description('Undo `ignore`: allow a node to be discovered and registered again.')
+        .action(async (name) => {
+        const ok = await removeIgnored(name);
+        if (!ok) {
+            console.error(chalk.gray(`'${name}' was not ignored.`));
+            return;
+        }
+        console.log(chalk.green(`No longer ignoring '${name}'`) + chalk.gray(' — run `agents devices sync` to register it.'));
+    });
     devicesCmd
         .command('list')
         .alias('ls')
         .description('List registered devices with platform, address, and reachability.')
-        .action(async () => {
+        .option('--json', 'output the registry as a JSON array (for scripts and hooks)')
+        .action(async (opts) => {
         const reg = await loadDevices();
         const names = Object.keys(reg).sort();
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(names.map((n) => reg[n]), null, 2) + '\n');
+            return;
+        }
         if (names.length === 0) {
             console.log(chalk.gray("No devices. Run 'agents devices sync' or 'agents devices add <name> <user@host>'."));
             return;
         }
+        const self = machineId();
         console.log(chalk.bold(`Devices (${names.length})`));
         for (const name of names)
-            console.log(deviceSummary(reg[name]));
+            console.log(deviceSummary(reg[name], name === self));
     });
     devicesCmd
         .command('show <name>')

package/dist/lib/agents.js

@@ -802,6 +802,37 @@ function resolveAccountCredentialPath(base, ...segments) {
     }
     return null;
 }
+let cachedAgyKeychainSignedIn;
+/**
+ * Antigravity (`agy`, a Codeium/Windsurf-based CLI) stores its OAuth token in
+ * the macOS keychain — service `gemini`, account `antigravity` — NOT a file.
+ * The file path (`antigravity-oauth-token`) only exists on Linux, where the Go
+ * keyring falls back to disk. Probe the keychain for existence (metadata only;
+ * `-w` omitted so it never prompts). Cached per process — the keychain is
+ * account-global, so one probe covers every installed version. Returns false on
+ * non-macOS (the file path handles those).
+ */
+async function antigravityKeychainSignedIn() {
+    if (cachedAgyKeychainSignedIn !== undefined)
+        return cachedAgyKeychainSignedIn;
+    // Test isolation: the real macOS keychain can't be sandboxed per-test, so
+    // allow suites asserting "signed out" to opt out of the probe (same spirit as
+    // AGENTS_REAL_HOME). Not cached, so tests can toggle it.
+    if (process.env.AGENTS_NO_KEYCHAIN_PROBE === '1')
+        return false;
+    if (process.platform !== 'darwin') {
+        cachedAgyKeychainSignedIn = false;
+        return false;
+    }
+    try {
+        await execFileAsync('security', ['find-generic-password', '-s', 'gemini', '-a', 'antigravity'], { timeout: 3000 });
+        cachedAgyKeychainSignedIn = true;
+    }
+    catch {
+        cachedAgyKeychainSignedIn = false;
+    }
+    return cachedAgyKeychainSignedIn;
+}
 export async function getAccountInfo(agentId, home) {
     const base = home || os.homedir();
     const empty = {
@@ -938,32 +969,52 @@ export async function getAccountInfo(agentId, home) {
                 return { ...empty, email, signedIn: !!email, lastActive };
             }
             case 'grok': {
-                // Grok stores auth in ~/.grok/auth.json
+                // Grok stores auth in ~/.grok/auth.json as a map keyed by
+                // "<oidc_issuer>::<client_id>" -> { email, user_id, refresh_token,
+                // create_time, expires_at, team_id, ... }. (Older builds wrote a flat
+                // object with a top-level email.) The old code only read a TOP-LEVEL
+                // `email`, so the current nested format always looked signed-out even
+                // when logged in. Read the newest account record: a refresh token means
+                // signed in, and we surface the email/ids like claude/codex.
+                const authPath = resolveAccountCredentialPath(base, '.grok', 'auth.json');
+                if (!authPath)
+                    return { ...empty, lastActive };
                 try {
-                    const authPath = path.join(base, '.grok', 'auth.json');
-                    if (fs.existsSync(authPath)) {
-                        const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
-                        const email = data.email || data.user?.email || data.account?.email || null;
-                        return { ...empty, email, signedIn: !!email, lastActive };
+                    const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
+                    const records = (data && typeof data === 'object' ? [data, ...Object.values(data)] : [])
+                        .filter((r) => !!r && typeof r === 'object');
+                    const account = records
+                        .filter(r => typeof r.refresh_token === 'string' || typeof r.email === 'string')
+                        .sort((a, b) => String(b.create_time || '').localeCompare(String(a.create_time || '')))[0];
+                    if (account) {
+                        const email = typeof account.email === 'string' ? account.email : null;
+                        const accountId = normalizeIdentityPart(account.user_id ?? account.principal_id);
+                        const organizationId = normalizeIdentityPart(account.team_id);
+                        const accountKey = buildIdentityKey(agentId, [['user', accountId], ['org', organizationId]]);
+                        return { ...empty, email, accountId, organizationId, accountKey, signedIn: true, lastActive };
                     }
                 }
                 catch { }
                 return { ...empty, lastActive };
             }
             case 'antigravity': {
-                // Antigravity (`agy`) stores a Google OAuth token at
-                // ~/.gemini/antigravity-cli/antigravity-oauth-token. It's a consumer
-                // OAuth grant (access + refresh token, no id_token), so there's no email
-                // claim to read locally — presence of a refresh token is the only
-                // signed-in signal we can derive without a network call.
+                // Antigravity (`agy`) stores a consumer Google OAuth grant (access +
+                // refresh token, no id_token) — presence of a refresh token is the only
+                // signed-in signal we can derive without a network call. Storage is
+                // platform-split: on Linux it's a file at
+                // ~/.gemini/antigravity-cli/antigravity-oauth-token; on macOS the Go
+                // keyring puts it in the keychain (service 'gemini', account
+                // 'antigravity'), so no file exists — check both.
                 const tokenPath = resolveAccountCredentialPath(base, '.gemini', 'antigravity-cli', 'antigravity-oauth-token');
-                if (!tokenPath)
-                    return { ...empty, lastActive };
-                const data = JSON.parse(await fs.promises.readFile(tokenPath, 'utf-8'));
-                const hasToken = typeof data?.token?.refresh_token === 'string' && !!data.token.refresh_token;
-                if (!hasToken)
-                    return { ...empty, lastActive };
-                return { ...empty, signedIn: true, lastActive };
+                if (tokenPath) {
+                    const data = JSON.parse(await fs.promises.readFile(tokenPath, 'utf-8'));
+                    if (typeof data?.token?.refresh_token === 'string' && data.token.refresh_token) {
+                        return { ...empty, signedIn: true, lastActive };
+                    }
+                }
+                if (await antigravityKeychainSignedIn())
+                    return { ...empty, signedIn: true, lastActive };
+                return { ...empty, lastActive };
             }
             case 'kimi': {
                 // Kimi Code stores OAuth credentials at

package/dist/lib/devices/registry.d.ts

@@ -76,3 +76,14 @@ export interface DeviceInput {
 export declare function upsertDevice(name: string, input: DeviceInput): Promise<DeviceProfile>;
 /** Remove a device. Returns false if it was not registered. */
 export declare function removeDevice(name: string): Promise<boolean>;
+/** Load the set of ignored node names. Missing file => empty set. A malformed
+ * file is a hard error for the same reason the registry is: silently returning
+ * [] would let the next write wipe the user's dismissals. */
+export declare function loadIgnored(): Promise<Set<string>>;
+/** True if `name` is on the ignore-list. */
+export declare function isIgnored(name: string): Promise<boolean>;
+/** Add a node name to the ignore-list. Idempotent. Returns the resulting set. */
+export declare function addIgnored(name: string): Promise<Set<string>>;
+/** Remove a node name from the ignore-list (un-ignore). Returns false if it was
+ * not ignored. */
+export declare function removeIgnored(name: string): Promise<boolean>;

package/dist/lib/devices/registry.js

@@ -18,7 +18,7 @@ import * as fsSync from 'fs';
 import * as path from 'path';
 import { randomBytes } from 'crypto';
 import lockfile from 'proper-lockfile';
-import { getDevicesRegistryPath } from '../state.js';
+import { getDevicesRegistryPath, getDevicesIgnoredPath } from '../state.js';
 function registryPath() {
     return getDevicesRegistryPath();
 }
@@ -166,3 +166,55 @@ export async function removeDevice(name) {
         return true;
     });
 }
+function ignoredPath() {
+    return getDevicesIgnoredPath();
+}
+/** Load the set of ignored node names. Missing file => empty set. A malformed
+ * file is a hard error for the same reason the registry is: silently returning
+ * [] would let the next write wipe the user's dismissals. */
+export async function loadIgnored() {
+    const p = ignoredPath();
+    let raw;
+    try {
+        raw = await fs.readFile(p, 'utf-8');
+    }
+    catch (err) {
+        if (err && err.code === 'ENOENT')
+            return new Set();
+        throw err;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return new Set(Array.isArray(parsed.ignored) ? parsed.ignored : []);
+    }
+    catch (err) {
+        throw new Error(`Device ignore-list corrupted at ${p}: ${err?.message ?? err}. Inspect and restore from backup.`);
+    }
+}
+/** True if `name` is on the ignore-list. */
+export async function isIgnored(name) {
+    return (await loadIgnored()).has(name);
+}
+/** Add a node name to the ignore-list. Idempotent. Returns the resulting set. */
+export async function addIgnored(name) {
+    assertValidDeviceName(name);
+    const p = ignoredPath();
+    return withRegistryLock(p, async () => {
+        const set = await loadIgnored();
+        set.add(name);
+        await atomicWriteJson(p, { ignored: [...set].sort(), updatedAt: new Date().toISOString() });
+        return set;
+    });
+}
+/** Remove a node name from the ignore-list (un-ignore). Returns false if it was
+ * not ignored. */
+export async function removeIgnored(name) {
+    const p = ignoredPath();
+    return withRegistryLock(p, async () => {
+        const set = await loadIgnored();
+        if (!set.delete(name))
+            return false;
+        await atomicWriteJson(p, { ignored: [...set].sort(), updatedAt: new Date().toISOString() });
+        return true;
+    });
+}

package/dist/lib/devices/sync.d.ts

@@ -0,0 +1,42 @@
+import { type TailscaleNode } from './tailscale.js';
+export interface DeviceSyncResult {
+    /** False when discovery could not run (e.g. tailscale absent) in soft mode. */
+    ok: boolean;
+    /** Number of tailscale nodes upserted into the registry. */
+    synced: number;
+    /** Node names discovered but neither registered-before nor ignored. */
+    pending: string[];
+    /** Populated when ok is false: why discovery was skipped. */
+    reason?: string;
+}
+/**
+ * Node names present on the tailnet but neither already in the registry nor on
+ * the ignore-list — i.e. genuinely new devices worth surfacing. Pure so the
+ * flag matrix is unit-testable without a live tailnet.
+ */
+export declare function computePendingDevices(nodes: TailscaleNode[], registered: Iterable<string>, ignored: Iterable<string>): string[];
+/**
+ * Ingest `tailscale status --json` into the registry. In soft mode a missing
+ * tailscale binary / unreachable daemon resolves to `{ ok: false }` instead of
+ * throwing, so callers wiring this into setup/sync never abort the whole run.
+ * The `pending` list is computed against the registry state BEFORE this sync so
+ * "new" means "not previously registered and not ignored".
+ */
+export declare function runDeviceSync(opts?: {
+    soft?: boolean;
+}): Promise<DeviceSyncResult>;
+/**
+ * The register/remove/ignore decision for the interactive curation picker.
+ * Pure so the highest-risk reconcile logic is unit-testable without a tailnet
+ * or a live prompt. `keep` is the set the user left checked; everything else is
+ * dismissed. Checked => register (and un-ignore if it was ignored). Unchecked
+ * => remove from the registry if it was there, and ignore it so auto-sync never
+ * re-adds it.
+ */
+export interface DeviceReconciliation {
+    toRegister: string[];
+    toUnignore: string[];
+    toRemove: string[];
+    toIgnore: string[];
+}
+export declare function planDeviceReconciliation(allNames: Iterable<string>, keep: Iterable<string>, registered: Iterable<string>, ignored: Iterable<string>): DeviceReconciliation;

package/dist/lib/devices/sync.js

@@ -0,0 +1,85 @@
+/**
+ * Reusable device discovery.
+ *
+ * `agents devices sync` was the only thing that ever populated the registry,
+ * and it was purely user-invoked — so the registry sat empty until someone
+ * remembered to run it. This module extracts the ingest so it can be triggered
+ * automatically (from `agents sync` and `agents setup`) without duplicating the
+ * tailscale-parse-and-upsert loop, and exposes the pure pending-device diff the
+ * curation picker and the menu-bar probe both need.
+ *
+ * Two failure modes, one function:
+ *   - hard (default): the CLI `agents devices sync` action wants a clear error
+ *     and a non-zero exit when tailscale is missing.
+ *   - soft (`soft: true`): auto-callers must never abort setup/sync because a
+ *     machine has no tailscale — they get a result with `ok: false` instead.
+ */
+import { loadDevices, loadIgnored, upsertDevice, } from './registry.js';
+import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from './tailscale.js';
+/**
+ * Node names present on the tailnet but neither already in the registry nor on
+ * the ignore-list — i.e. genuinely new devices worth surfacing. Pure so the
+ * flag matrix is unit-testable without a live tailnet.
+ */
+export function computePendingDevices(nodes, registered, ignored) {
+    const known = new Set(registered);
+    const skip = new Set(ignored);
+    return nodes
+        .map((n) => n.name)
+        .filter((name) => !known.has(name) && !skip.has(name));
+}
+/**
+ * Ingest `tailscale status --json` into the registry. In soft mode a missing
+ * tailscale binary / unreachable daemon resolves to `{ ok: false }` instead of
+ * throwing, so callers wiring this into setup/sync never abort the whole run.
+ * The `pending` list is computed against the registry state BEFORE this sync so
+ * "new" means "not previously registered and not ignored".
+ */
+export async function runDeviceSync(opts = {}) {
+    // Soft mode must be non-fatal for ANY failure, not just a missing tailscale:
+    // a corrupted registry/ignore file (both throw by design), a disk error, or
+    // registry lock contention (plausible when many agents SessionStart-autosync
+    // the same host at once) would otherwise abort the whole `agents sync`. The
+    // whole body is inside the guard so the "never a sync failure" promise holds.
+    try {
+        const nodes = parseTailscaleStatus(tailscaleStatusJson());
+        const [registeredBefore, ignored] = await Promise.all([loadDevices(), loadIgnored()]);
+        const pending = computePendingDevices(nodes, Object.keys(registeredBefore), ignored);
+        // Register/refresh every node the user has NOT dismissed. Skipping ignored
+        // nodes is what makes the "register all" default safe: a phone or someone
+        // else's laptop the user once dismissed never silently comes back.
+        let synced = 0;
+        for (const node of nodes) {
+            if (ignored.has(node.name))
+                continue;
+            await upsertDevice(node.name, nodeToDeviceInput(node));
+            synced++;
+        }
+        return { ok: true, synced, pending };
+    }
+    catch (err) {
+        if (opts.soft) {
+            return { ok: false, synced: 0, pending: [], reason: err?.message ?? String(err) };
+        }
+        throw err;
+    }
+}
+export function planDeviceReconciliation(allNames, keep, registered, ignored) {
+    const keepSet = new Set(keep);
+    const regSet = new Set(registered);
+    const ignSet = new Set(ignored);
+    const out = { toRegister: [], toUnignore: [], toRemove: [], toIgnore: [] };
+    for (const name of allNames) {
+        if (keepSet.has(name)) {
+            out.toRegister.push(name);
+            if (ignSet.has(name))
+                out.toUnignore.push(name);
+        }
+        else {
+            if (regSet.has(name))
+                out.toRemove.push(name);
+            out.toIgnore.push(name);
+        }
+    }
+    return out;
+}

package/dist/lib/session/active.d.ts

@@ -28,6 +28,8 @@ export interface ActiveSession {
     sessionFile?: string;
     startedAtMs?: number;
     status: ActiveStatus;
+    /** How many live PIDs resolve to this same session (subagents/forks). 1 unless collapsed. */
+    pidCount?: number;
     teamName?: string;
     agentId?: string;
     cloudProvider?: string;

package/dist/lib/session/active.js

@@ -536,5 +536,33 @@ export async function getActiveSessions(opts = {}) {
         if (s.pid)
             knownPids.add(s.pid);
     const unattributed = opts.skipHeadless ? [] : await listUnattributedActive(knownPids);
-    return [...teams, ...terminals, ...cloud, ...unattributed];
+    return dedupeBySession([...teams, ...terminals, ...cloud, ...unattributed]);
+}
+/**
+ * Collapse rows that resolve to the *same* session — a session with many
+ * subagent/fork PIDs (all matched to one transcript file) would otherwise print
+ * dozens of identical rows. Keyed by session id (falling back to the file), the
+ * first row wins and carries a `pidCount`. Rows with no session identity (cloud,
+ * unresolved headless) pass through untouched.
+ */
+function dedupeBySession(sessions) {
+    const out = [];
+    const byKey = new Map();
+    for (const s of sessions) {
+        const key = s.sessionId || s.sessionFile;
+        if (!key) {
+            out.push(s);
+            continue;
+        }
+        const existing = byKey.get(key);
+        if (existing) {
+            existing.pidCount = (existing.pidCount ?? 1) + 1;
+        }
+        else {
+            s.pidCount = 1;
+            byKey.set(key, s);
+            out.push(s);
+        }
+    }
+    return out;
 }

package/dist/lib/session/digest.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Catch-up digest extractors.
+ *
+ * Pure functions that turn a session's events into the signals a developer needs
+ * to reload a task fast when switching between many agents: which files changed
+ * and how (created / modified / deleted), which tools dominated the work, and the
+ * last test/build result. Consumed by the single-session view and the picker
+ * preview. No I/O — fully unit-testable.
+ */
+import type { SessionEvent } from './types.js';
+export type FileOp = 'created' | 'modified' | 'deleted';
+export interface FileChange {
+    path: string;
+    op: FileOp;
+}
+/** Extract file paths deleted by a shell command (rm / git rm / unlink). Conservative. */
+export declare function extractDeletedPaths(command: string): string[];
+/**
+ * Classify every touched file as created / modified / deleted from the event
+ * stream. Heuristics: a Write to a path never previously Read and not seen
+ * before is a *creation*; an Edit (or a Write to a known/read path) is a
+ * *modification*; a path in an `rm`/`git rm` command is a *deletion* (and wins
+ * over create/modify — a created-then-deleted file nets to gone). Plan files
+ * (`.claude/plans/*.md`) are excluded; they're surfaced by detectPlan.
+ */
+export declare function classifyFileChanges(events: SessionEvent[]): FileChange[];
+/** Net change summary: counts per op. */
+export declare function changeCounts(changes: FileChange[]): {
+    created: number;
+    modified: number;
+    deleted: number;
+};
+/** Tool histogram sorted highest-first, capped to `top` entries. */
+export declare function toolHistogram(toolCounts: Record<string, number>, top?: number): Array<{
+    tool: string;
+    count: number;
+}>;
+export interface TestResult {
+    runner: string;
+    passed?: number;
+    failed?: number;
+    /** True when we could parse a pass/fail verdict. */
+    ok: boolean;
+    ts: number;
+}
+/**
+ * The most recent test/build run and its verdict. Correlates a runner command
+ * (tool_use) with the next tool_result's output. Returns undefined if none ran.
+ */
+export declare function detectTestResult(events: SessionEvent[]): TestResult | undefined;

package/dist/lib/session/digest.js

@@ -0,0 +1,170 @@
+/**
+ * Catch-up digest extractors.
+ *
+ * Pure functions that turn a session's events into the signals a developer needs
+ * to reload a task fast when switching between many agents: which files changed
+ * and how (created / modified / deleted), which tools dominated the work, and the
+ * last test/build result. Consumed by the single-session view and the picker
+ * preview. No I/O — fully unit-testable.
+ */
+// Tool vocab mirrors parse.ts / render.ts so classification matches what those
+// modules already recognize across Claude/Codex/others.
+const READ_TOOLS = new Set(['Read', 'read_file', 'view_file', 'cat_file', 'get_file']);
+const WRITE_TOOLS = new Set(['Write', 'write_file', 'create_file']);
+const EDIT_TOOLS = new Set(['Edit', 'edit_file', 'replace', 'patch', 'MultiEdit', 'apply_patch']);
+/** Extract file paths deleted by a shell command (rm / git rm / unlink). Conservative. */
+export function extractDeletedPaths(command) {
+    const out = [];
+    // Split on && ; | to inspect each simple command separately.
+    for (const seg of command.split(/&&|\|\||;|\|/)) {
+        const m = seg.trim().match(/^(?:sudo\s+)?(?:git\s+rm|rm|unlink)\s+(.+)$/);
+        if (!m)
+            continue;
+        for (const tok of m[1].split(/\s+/)) {
+            if (tok.startsWith('-'))
+                continue; // flags (-r, -f, --force)
+            if (/[*?{}]/.test(tok))
+                continue; // globs — too imprecise to attribute
+            out.push(tok.replace(/^['"]|['"]$/g, '')); // unquote
+        }
+    }
+    return out;
+}
+/**
+ * Classify every touched file as created / modified / deleted from the event
+ * stream. Heuristics: a Write to a path never previously Read and not seen
+ * before is a *creation*; an Edit (or a Write to a known/read path) is a
+ * *modification*; a path in an `rm`/`git rm` command is a *deletion* (and wins
+ * over create/modify — a created-then-deleted file nets to gone). Plan files
+ * (`.claude/plans/*.md`) are excluded; they're surfaced by detectPlan.
+ */
+export function classifyFileChanges(events) {
+    const readBefore = new Set();
+    const created = new Set();
+    const modified = new Set();
+    const deleted = new Set();
+    const seen = new Set();
+    for (const e of events) {
+        if (e.type !== 'tool_use' || e._local)
+            continue;
+        if (e.command)
+            for (const d of extractDeletedPaths(e.command))
+                deleted.add(d);
+        const tool = e.tool || '';
+        const args = e.args || {};
+        const p = e.path || args.file_path || args.path || '';
+        if (!p)
+            continue;
+        if (p.includes('.claude/plans/') && p.endsWith('.md'))
+            continue;
+        if (READ_TOOLS.has(tool)) {
+            readBefore.add(p);
+        }
+        else if (WRITE_TOOLS.has(tool)) {
+            if (!seen.has(p) && !readBefore.has(p))
+                created.add(p);
+            else
+                modified.add(p);
+            seen.add(p);
+            deleted.delete(p); // a write after a delete recreates the file
+        }
+        else if (EDIT_TOOLS.has(tool)) {
+            modified.add(p);
+            seen.add(p);
+            deleted.delete(p);
+        }
+    }
+    const out = [];
+    for (const p of created)
+        if (!deleted.has(p))
+            out.push({ path: p, op: 'created' });
+    for (const p of modified)
+        if (!created.has(p) && !deleted.has(p))
+            out.push({ path: p, op: 'modified' });
+    for (const p of deleted)
+        out.push({ path: p, op: 'deleted' });
+    return out;
+}
+/** Net change summary: counts per op. */
+export function changeCounts(changes) {
+    const c = { created: 0, modified: 0, deleted: 0 };
+    for (const ch of changes)
+        c[ch.op]++;
+    return c;
+}
+/** Tool histogram sorted highest-first, capped to `top` entries. */
+export function toolHistogram(toolCounts, top = 8) {
+    return Object.entries(toolCounts)
+        .map(([tool, count]) => ({ tool, count }))
+        .sort((a, b) => b.count - a.count || a.tool.localeCompare(b.tool))
+        .slice(0, top);
+}
+/** Recognized test/build runners → the label we show. */
+const TEST_RUNNERS = [
+    { re: /\b((?:bun|npm|yarn|pnpm)\s+(?:run\s+)?test|vitest|jest)\b/, label: 'tests' },
+    { re: /\bpytest\b/, label: 'pytest' },
+    { re: /\bgo\s+test\b/, label: 'go test' },
+    { re: /\bcargo\s+test\b/, label: 'cargo test' },
+    { re: /\b(tsc|tsc\s+--noEmit)\b/, label: 'tsc' },
+];
+/** Parse pass/fail counts from common runner output. */
+function parseTestOutput(runner, output) {
+    // vitest/jest/bun: "N passed", "N failed"; pytest: "N passed, N failed".
+    // Take the LAST occurrence — runners print a per-file line first, then the
+    // authoritative aggregate ("Tests 4 failed | 294 passed") at the end.
+    const lastNum = (re) => {
+        let m;
+        let val;
+        const g = new RegExp(re.source, 'gi');
+        while ((m = g.exec(output)) !== null)
+            val = +m[1];
+        return val;
+    };
+    const passed = lastNum(/(\d+)\s+pass(?:ed)?/);
+    const failed = lastNum(/(\d+)\s+fail(?:ed|ures?)?/);
+    if (passed !== undefined || failed !== undefined) {
+        return { passed, failed, ok: true };
+    }
+    // tsc: no news is good news; "error TSxxxx" means failure.
+    if (runner === 'tsc') {
+        const errs = output.match(/error\s+TS\d+/gi);
+        return { failed: errs ? errs.length : 0, ok: true };
+    }
+    // go test: no pass/fail counts — uses `--- PASS/FAIL:` lines and an ok/FAIL
+    // summary. Count the per-test markers; fall back to the summary verdict.
+    if (runner === 'go test') {
+        const passCount = (output.match(/---\s+PASS/gi) || []).length;
+        const failCount = (output.match(/---\s+FAIL/gi) || []).length;
+        const sawFail = failCount > 0 || /(^|\s)FAIL($|\s)/.test(output);
+        const sawOk = /(^|\s)(ok|PASS)($|\s)/.test(output);
+        if (sawFail || sawOk) {
+            return { passed: passCount || undefined, failed: sawFail ? failCount || 1 : 0, ok: true };
+        }
+    }
+    return { ok: false };
+}
+/**
+ * The most recent test/build run and its verdict. Correlates a runner command
+ * (tool_use) with the next tool_result's output. Returns undefined if none ran.
+ */
+export function detectTestResult(events) {
+    let pending = null;
+    let last;
+    for (const e of events) {
+        const ts = new Date(e.timestamp).getTime() || 0;
+        if (e.type === 'tool_use' && e.command) {
+            const hit = TEST_RUNNERS.find(r => r.re.test(e.command));
+            pending = hit ? { runner: hit.label, ts } : pending;
+        }
+        else if (e.type === 'tool_result' && pending) {
+            const parsed = parseTestOutput(pending.runner, e.output || '');
+            last = { runner: pending.runner, ts: pending.ts, ...parsed };
+            pending = null;
+        }
+        else if (e.type === 'error' && pending) {
+            last = { runner: pending.runner, ts: pending.ts, ok: true, failed: 1 };
+            pending = null;
+        }
+    }
+    return last;
+}

package/dist/lib/session/render.d.ts

@@ -49,6 +49,8 @@ export interface SessionStats {
     userTurns: number;
     assistantTurns: number;
     toolCount: number;
+    /** Per-tool call counts (histogram), highest first when rendered. */
+    toolCounts: Record<string, number>;
     errorCount: number;
     outputTokens: number;
     cacheReadTokens: number;

package/dist/lib/session/render.js

@@ -11,6 +11,7 @@ import { summarizeToolUse } from './parse.js';
 import { cleanSessionPrompt, extractSessionTopic } from './prompt.js';
 import { renderMarkdown } from '../markdown.js';
 import { redactSecrets } from '../redact.js';
+import { classifyFileChanges, changeCounts, toolHistogram, detectTestResult } from './digest.js';
 // ── Path helpers ──────────────────────────────────────────────────────────────
 /**
  * Return absPath relative to cwd; fall back to ~/… then absolute.
@@ -153,6 +154,7 @@ export function collapseRetries(commands) {
 /** Compute aggregate statistics (turns, tools, tokens, duration) from session events. */
 export function computeSummaryStats(events) {
     const modelSet = new Set();
+    const toolCounts = {};
     let userTurns = 0;
     let assistantTurns = 0;
     let toolCount = 0;
@@ -177,6 +179,8 @@ export function computeSummaryStats(events) {
         }
         else if (e.type === 'tool_use' && !e._local) {
             toolCount++;
+            if (e.tool)
+                toolCounts[e.tool] = (toolCounts[e.tool] ?? 0) + 1;
         }
         else if (e.type === 'error') {
             errorCount++;
@@ -193,6 +197,7 @@ export function computeSummaryStats(events) {
         userTurns,
         assistantTurns,
         toolCount,
+        toolCounts,
         errorCount,
         outputTokens,
         cacheReadTokens,
@@ -426,6 +431,76 @@ function renderActivityLine(item) {
             return chalk.green('Msg  ') + ' ' + chalk.gray('"' + trim(item.label) + '"');
     }
 }
+// ── Catch-up digest sections ──────────────────────────────────────────────────
+const OP_GLYPH = {
+    created: (s) => chalk.green(s),
+    modified: (s) => chalk.yellow(s),
+    deleted: (s) => chalk.red(s),
+};
+const OP_MARK = { created: '+', modified: '~', deleted: '−' };
+/**
+ * Render the Changes section: files grouped by directory, each tagged with its
+ * create/modify/delete lifecycle, plus a `+N ~N −N` summary. Replaces the old
+ * flat "Modified" list. Returns true if anything was rendered.
+ */
+function renderChangesSection(lines, events, cwd) {
+    // In-project changes only; edits outside cwd (e.g. /tmp) keep their own
+    // "External edits" section so they don't clutter the project's changeset.
+    const inCwd = (p) => !cwd || !p.startsWith('/') || p.startsWith(cwd + '/');
+    const changes = classifyFileChanges(events).filter(ch => inCwd(ch.path));
+    if (changes.length === 0)
+        return false;
+    const c = changeCounts(changes);
+    const opByRel = new Map();
+    for (const ch of changes)
+        opByRel.set(relativeToCwd(ch.path, cwd), ch.op);
+    const summary = [
+        c.created ? chalk.green(`+${c.created}`) : '',
+        c.modified ? chalk.yellow(`~${c.modified}`) : '',
+        c.deleted ? chalk.red(`−${c.deleted}`) : '',
+    ].filter(Boolean).join(' ');
+    lines.push(chalk.bold('Changes') + chalk.gray(` (${changes.length})  `) + summary);
+    const groups = groupByParentDir(changes.map(ch => ch.path), cwd);
+    const single = groups.size === 1;
+    for (const [dir, files] of groups) {
+        // Single dir: show the full relative path per file (dir/base). Multiple
+        // dirs: a dir header, then bare filenames under it.
+        if (!single)
+            lines.push('  ' + chalk.dim(dir + '/'));
+        for (const f of files.sort()) {
+            const rel = dir === '.' ? f : `${dir}/${f}`;
+            const op = opByRel.get(rel) ?? 'modified';
+            const shown = single ? rel : f;
+            const name = op === 'deleted' ? chalk.strikethrough(chalk.gray(shown)) : shown;
+            lines.push((single ? '  ' : '    ') + OP_GLYPH[op](OP_MARK[op]) + ' ' + name);
+        }
+    }
+    lines.push('');
+    return true;
+}
+/** Render the tool histogram: `Edit 61 · Bash 48 · Read 35 …`. */
+function renderToolsSection(lines, stats) {
+    const hist = toolHistogram(stats.toolCounts, 8);
+    if (hist.length === 0)
+        return;
+    const parts = hist.map(h => `${chalk.white(h.tool)} ${chalk.gray(String(h.count))}`);
+    lines.push(chalk.bold('Tools') + '  ' + parts.join(chalk.gray(' · ')));
+    lines.push('');
+}
+/** Render the last test/build verdict, e.g. `Tests  tests: 294 pass · 4 fail`. */
+function renderTestsLine(lines, events) {
+    const r = detectTestResult(events);
+    if (!r || !r.ok)
+        return;
+    const bits = [];
+    if (r.passed !== undefined)
+        bits.push(chalk.green(`${r.passed} pass`));
+    if (r.failed !== undefined)
+        bits.push(r.failed > 0 ? chalk.red(`${r.failed} fail`) : chalk.gray('0 fail'));
+    const verdict = r.failed && r.failed > 0 ? chalk.red('✗') : chalk.green('✓');
+    lines.push(chalk.bold('Tests') + `  ${verdict} ${chalk.cyan(r.runner)} ${bits.join(chalk.gray(' · '))}`);
+    lines.push('');
+}
 // ── Main summary renderer ─────────────────────────────────────────────────────
 /**
  * Render session as an activity summary.
@@ -560,7 +635,6 @@ export function renderSummary(events, cwd) {
         }
         return m;
     };
-    const modifiedAbsMap = buildAbsMap(filesModifiedAbs);
     const readAbsMap = buildAbsMap(filesReadAbs);
     // ── Render sections ───────────────────────────────────────────────────────
     const lines = [''];
@@ -640,15 +714,14 @@ export function renderSummary(events, cwd) {
             chalk.gray(`: ${errors.length} failure${errors.length !== 1 ? 's' : ''} — first: ${firstDesc}`));
         lines.push('');
     }
-    // 6. Modified files
-    if (filesModifiedAbs.size > 0) {
-        lines.push(chalk.bold('Modified') + chalk.gray(` (${filesModifiedAbs.size})`));
-        const groups = groupByParentDir(filesModifiedAbs, cwd);
-        renderFileGroup(lines, groups, modifiedAbsMap);
-        lines.push('');
-    }
-    // 6b. External edits (files edited outside the project root — typically /tmp)
-    // Filter out plan files (already shown in Plan section)
+    // 6. Changes — files grouped by directory with create/modify/delete lifecycle
+    // (replaces the old flat "Modified" + "External edits" lists).
+    renderChangesSection(lines, events, cwd);
+    // 6b. Catch-up signals: last test/build verdict, then the tool histogram.
+    renderTestsLine(lines, events);
+    renderToolsSection(lines, computeSummaryStats(events));
+    // 6c. External edits (files edited outside the project root — typically /tmp).
+    // Filter out plan files (already shown in Plan section).
     const externalNonPlan = [...filesModifiedExternal].filter(p => !(p.includes('.claude/plans/') && p.endsWith('.md')));
     if (externalNonPlan.length > 0) {
         const externalList = externalNonPlan.sort();

package/dist/lib/state.d.ts

@@ -156,6 +156,8 @@ export declare function getTeamsAgentsDir(): string;
 export declare function getTeamsRegistryPath(): string;
 /** Path to the device registry — SSH device profiles with platform/auth metadata. Durable runtime, per-machine (host list + addresses are NOT pulled by `agents repo push`). */
 export declare function getDevicesRegistryPath(): string;
+/** Path to the device ignore-list — tailscale node names the user dismissed, so auto-discovery never re-suggests them. Per-machine, same dir as the registry. */
+export declare function getDevicesIgnoredPath(): string;
 /** Path to cloud dispatch cache (~/.agents/.cache/cloud/). */
 export declare function getCloudDir(): string;
 /** Path to terminal session metadata (~/.agents/.cache/terminals/). */

package/dist/lib/state.js

@@ -352,6 +352,8 @@ export function getTeamsAgentsDir() { return TEAMS_AGENTS_DIR; }
 export function getTeamsRegistryPath() { return path.join(HISTORY_DIR, 'teams', 'registry.json'); }
 /** Path to the device registry — SSH device profiles with platform/auth metadata. Durable runtime, per-machine (host list + addresses are NOT pulled by `agents repo push`). */
 export function getDevicesRegistryPath() { return path.join(HISTORY_DIR, 'devices', 'registry.json'); }
+/** Path to the device ignore-list — tailscale node names the user dismissed, so auto-discovery never re-suggests them. Per-machine, same dir as the registry. */
+export function getDevicesIgnoredPath() { return path.join(HISTORY_DIR, 'devices', 'ignored.json'); }
 /** Path to cloud dispatch cache (~/.agents/.cache/cloud/). */
 export function getCloudDir() { return CLOUD_DIR; }
 /** Path to terminal session metadata (~/.agents/.cache/terminals/). */

package/dist/lib/sync-umbrella.d.ts

@@ -57,6 +57,11 @@ export interface UmbrellaResult {
         pulled: number;
         merged: number;
     };
+    devices?: {
+        synced: number;
+        pending: number;
+        skipped: boolean;
+    };
     reconciled: boolean;
 }
 export interface RunUmbrellaArgs {

package/dist/lib/sync-umbrella.js

@@ -120,6 +120,16 @@ export async function runUmbrellaSync(args) {
         const { refresh } = await import('./refresh.js');
         await refresh({ skipPrompts: yes });
         result.reconciled = true;
+        // Keep the local device registry current with the tailnet. Soft: a machine
+        // without tailscale is a clean no-op, never a sync failure. This is the
+        // wiring that fixes the "registry stays empty until you remember to run
+        // `agents devices sync`" gap — the SessionStart autosync now populates it.
+        const { runDeviceSync } = await import('./devices/sync.js');
+        const dev = await runDeviceSync({ soft: true });
+        result.devices = { synced: dev.synced, pending: dev.pending.length, skipped: !dev.ok };
+        if (dev.ok) {
+            log(`devices: ${dev.synced} synced${dev.pending.length ? `, ${dev.pending.length} new` : ''}`);
+        }
     }
     return result;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.30",
+  "version": "1.20.31",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",