@phnx-labs/agents-cli 1.20.30 → 1.20.32

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 1.20.31
+
+**`agents sessions <id>`: a catch-up digest for switching between many agents (#502)**
+
+- Opening a single session now leads with its auto-inferred title (user `/rename` > Claude `ai-title` > first-prompt topic) and PR / worktree / ticket badges, then a **Changes** section that groups touched files by directory and tags each as created / modified / deleted (with a `+N ~N -N` summary) instead of the old flat "Modified" list, a **Tools** histogram (per-tool call counts), and a **Tests** verdict parsed from the last `vitest` / `jest` / `pytest` / `go test` / `cargo test` / `tsc` run. The same signals are folded into the interactive picker preview.
+- `agents sessions --active` now collapses the many subagent/fork PIDs of one session into a single row with a `×N` count instead of printing dozens of identical lines. Source: `src/lib/session/digest.ts`, `src/lib/session/render.ts`, `src/lib/session/active.ts`, `src/commands/sessions.ts`, `src/commands/sessions-picker.ts`.
+
+## 1.20.30
+
+**`agents sessions` live state engine: waiting / PR / worktree / ticket detection + reliable preview (#494)**
+
+- `agents sessions --active` infers real activity from each transcript's tail — **working** / **waiting** / **idle** — rather than the old mtime-only running/idle guess, using structural signals (Claude `ExitPlanMode` / `AskUserQuestion`) plus a question + mtime heuristic for Codex. It detects and badges a PR opened during the session (`gh pr create` + the resulting pull URL), a git worktree (`.agents/worktrees/<slug>/`), and a Linear/Jira ticket (from the prompt or branch), and shows the latest turn as the preview instead of the first prompt.
+- `--waiting` filters `--active` to only sessions blocked on your input and exits non-zero (a scriptable gate); `--tree` groups the listing by directory, dropping the id/version columns while keeping the short-id handle.
+- The preview line is now width-correct: measurement is ANSI- and wide-char-aware and reads `$COLUMNS` first, so it no longer wraps or drifts under tmux or over `--host` SSH (the remote is handed the caller's width). Session index schema v7 persists the PR / worktree / ticket signals so historical listings carry them too. Source: `src/lib/session/state.ts`, `src/lib/session/tail.ts`, `src/lib/session/width.ts`, `src/lib/session/{discover,db,active}.ts`, `src/commands/sessions.ts`.
+
 **`agents sessions --host <machine>`: query a remote machine's sessions live over SSH**
 
 - `agents sessions "<query>" --host <alias|user@host>` runs the same session query on a remote machine's own index over SSH and streams the result back — repeat `--host` (or pass several) to fan out across machines. SSH access is the only auth; there's no daemon or shared store. Targets are validated against a strict allowlist (`SSH_TARGET_RE`) to block flag-smuggling, and the forwarded invocation is double-quoted (`shellQuote`) so a query like `$(whoami)` survives as a literal string on both shell layers. Source: `src/lib/session/remote.ts`, `src/commands/sessions.ts`, `docs/05-sessions.md`.

package/dist/commands/sessions-picker.js

@@ -11,6 +11,7 @@ import { cleanSessionPrompt, extractSessionTopic } from '../lib/session/prompt.j
 import { linkPath, relativeToCwd } from '../lib/session/render.js';
 import { renderMarkdown } from '../lib/markdown.js';
 import { itemPicker } from '../lib/picker.js';
+import { classifyFileChanges, changeCounts, toolHistogram, detectTestResult } from '../lib/session/digest.js';
 /**
  * SessionMeta originates in discover.ts (gitBranch, cwd, label, etc. read from
  * untrusted session files). parseSession sanitizes event payloads at its
@@ -176,8 +177,8 @@ const TODOS_MAX_ITEMS = 5;
 function formatCompactPreview(events, session) {
     let firstUser = '';
     let lastAssistant = '';
-    const filesModified = new Set();
     const filesRead = new Set();
+    const toolCounts = {};
     let toolCalls = 0;
     let planFile = '';
     let latestTodos = null;
@@ -195,10 +196,7 @@ function formatCompactPreview(events, session) {
         else if (event.type === 'tool_use' && !event._local) {
             const tool = event.tool || '';
             const p = event.path || event.args?.file_path || event.args?.path || '';
-            if (['Write', 'Edit', 'write_file', 'edit_file', 'create_file', 'replace', 'patch'].includes(tool) && p) {
-                filesModified.add(p);
-            }
-            else if (['Read', 'read_file', 'view_file', 'cat_file', 'get_file'].includes(tool) && p) {
+            if (['Read', 'read_file', 'view_file', 'cat_file', 'get_file'].includes(tool) && p) {
                 filesRead.add(p);
             }
             if (!planFile && p && /\/plans\/[^/]+\.md$/.test(p)) {
@@ -207,9 +205,14 @@ function formatCompactPreview(events, session) {
             if (tool === 'TodoWrite' && Array.isArray(event.args?.todos)) {
                 latestTodos = event.args.todos;
             }
+            if (tool)
+                toolCounts[tool] = (toolCounts[tool] ?? 0) + 1;
             toolCalls++;
         }
     }
+    // Digest signals folded into the preview: change lifecycle, tool mix, tests.
+    const changes = classifyFileChanges(events);
+    const chg = changeCounts(changes);
     const lines = [];
     const termWidth = process.stdout.columns || 80;
     if (firstUser) {
@@ -219,14 +222,36 @@ function formatCompactPreview(events, session) {
         }
     }
     const activity = [];
-    if (filesModified.size)
-        activity.push(`${filesModified.size} modified`);
+    const changed = chg.created + chg.modified + chg.deleted;
+    if (changed) {
+        const parts = [
+            chg.created ? chalk.green(`+${chg.created}`) : '',
+            chg.modified ? chalk.yellow(`~${chg.modified}`) : '',
+            chg.deleted ? chalk.red(`−${chg.deleted}`) : '',
+        ].filter(Boolean).join(' ');
+        activity.push(`${parts} ${chalk.gray('changed')}`);
+    }
     if (filesRead.size)
-        activity.push(`${filesRead.size} read`);
+        activity.push(chalk.gray(`${filesRead.size} read`));
     if (toolCalls)
-        activity.push(`${toolCalls} tool${toolCalls === 1 ? '' : 's'}`);
+        activity.push(chalk.gray(`${toolCalls} tool${toolCalls === 1 ? '' : 's'}`));
     if (activity.length) {
-        lines.push(chalk.cyan('Activity: ') + chalk.gray(activity.join(' · ')));
+        lines.push(chalk.cyan('Changes:  ') + activity.join(chalk.gray(' · ')));
+    }
+    // Tool mix (top 4) — what kind of work this was.
+    const hist = toolHistogram(toolCounts, 4);
+    if (hist.length) {
+        lines.push(chalk.cyan('Tools:    ') + chalk.gray(hist.map(h => `${h.tool} ${h.count}`).join(' · ')));
+    }
+    // Last test/build verdict.
+    const test = detectTestResult(events);
+    if (test?.ok) {
+        const bits = [
+            test.passed !== undefined ? chalk.green(`${test.passed} pass`) : '',
+            test.failed ? chalk.red(`${test.failed} fail`) : '',
+        ].filter(Boolean).join(chalk.gray(' · '));
+        const mark = test.failed ? chalk.red('✗') : chalk.green('✓');
+        lines.push(chalk.cyan('Tests:    ') + `${mark} ${test.runner}${bits ? ' ' + bits : ''}`);
     }
     if (planFile) {
         const basename = planFile.split('/').pop() || planFile;

package/dist/commands/sessions.js

@@ -227,7 +227,8 @@ function printActiveRow(s, indent) {
     const kindCol = colorAgent(s.kind)(padToWidth(truncateToWidth(s.kind, 8), 9));
     const hostCol = chalk.gray(padToWidth(truncateToWidth(s.host ?? '-', 8), 9));
     const statusCol = statusColor(s.status)(padToWidth(truncateToWidth(activityLabel(s), 8), 9));
-    const badges = signalBadges(s);
+    const fork = s.pidCount && s.pidCount > 1 ? chalk.dim(`×${s.pidCount} `) : '';
+    const badges = (fork ? fork : '') + signalBadges(s);
     const desc = buildSessionDescription(s) || '-';
     // Fill the remaining width with the preview so nothing wraps under tmux/SSH.
     const fixed = stringWidth(indent) + 9 + 9 + 9 + 9 + (badges ? stringWidth(badges) + 1 : 0);
@@ -685,6 +686,13 @@ async function renderSession(session, mode, filters, options = {}) {
         const modelStr = stats.models.length > 0 ? chalk.yellow(`  ${stats.models.join(', ')}`) : '';
         const branchStr = session.gitBranch ? chalk.gray(` (${session.gitBranch})`) : '';
         const absTime = formatAbsoluteTime(session.timestamp);
+        // Auto-inferred title headline (user /rename > Claude ai-title > first-prompt
+        // topic) — the fastest way to recognize which task this session is.
+        const title = session.label || session.topic;
+        if (title) {
+            const badges = signalBadges(metaSignals(session));
+            console.log(chalk.bold.white(title) + (badges ? '  ' + badges : ''));
+        }
         console.log(agentColor(session.agent) +
             (session.version ? chalk.yellow(` ${session.version}`) : '') +
             modelStr +

package/dist/commands/setup.js

@@ -109,6 +109,14 @@ export async function runSetup(program, options = {}) {
             spinner.succeed(`Cloned ${systemRepoSlug(systemRepo)} (${result.commit})`);
         }
     }
+    // Populate the device registry from the tailnet on first setup. Soft mode is
+    // guaranteed non-throwing (no tailscale / corrupt file / lock contention all
+    // resolve to ok:false), so this can never block setup.
+    const { runDeviceSync } = await import('../lib/devices/sync.js');
+    const dev = await runDeviceSync({ soft: true });
+    if (dev.ok && dev.synced > 0) {
+        console.log(chalk.gray(`Discovered ${dev.synced} device${dev.synced === 1 ? '' : 's'} on your tailnet (agents devices list).`));
+    }
     // Offer to import existing unmanaged installations
     if (unmanaged.length > 0 && isInteractiveTerminal()) {
         console.log(chalk.bold('\nFound existing installations:\n'));

package/dist/commands/ssh.js

@@ -16,8 +16,12 @@ import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
-import { getDevice, loadDevices, removeDevice, upsertDevice, } from '../lib/devices/registry.js';
+import { machineId } from '../lib/session/sync/config.js';
+import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from '../lib/devices/tailscale.js';
+import { planDeviceReconciliation, runDeviceSync } from '../lib/devices/sync.js';
+import { clearPendingSentinel } from '../lib/devices/pending.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
 /** Parse `user@host` or `host` into pieces. */
@@ -27,8 +31,9 @@ function parseTarget(target) {
         return { host: target };
     return { user: target.slice(0, at), host: target.slice(at + 1) };
 }
-/** One-line summary of a device for `list`. */
-function deviceSummary(d) {
+/** One-line summary of a device for `list`. `isSelf` marks the machine this
+ * command is running on so it stands out from the rest of the tailnet. */
+function deviceSummary(d, isSelf = false) {
     const addr = hostNameFor(d) ?? chalk.gray('no address');
     const online = d.tailscale
         ? d.tailscale.online
@@ -36,7 +41,10 @@ function deviceSummary(d) {
             : chalk.gray('offline')
         : chalk.gray('unknown');
     const reach = d.tailscale?.online && !d.tailscale.direct ? chalk.yellow(' (relayed)') : '';
-    return `  ${chalk.bold(d.name.padEnd(16))} ${String(d.platform).padEnd(8)} ${(d.user ? d.user + '@' : '') + addr}  ${online}${reach}`;
+    const marker = isSelf ? chalk.cyan('▸ ') : '  ';
+    const name = isSelf ? chalk.bold.cyan(d.name.padEnd(16)) : chalk.bold(d.name.padEnd(16));
+    const here = isSelf ? chalk.cyan('  ← this machine') : '';
+    return `${marker}${name} ${String(d.platform).padEnd(8)} ${(d.user ? d.user + '@' : '') + addr}  ${online}${reach}${here}`;
 }
 /** Resolve a device or exit with a clear error. */
 async function mustGetDevice(name) {
@@ -47,6 +55,72 @@ async function mustGetDevice(name) {
     }
     return d;
 }
+/**
+ * Interactive `agents devices sync`: discover tailscale nodes, present a
+ * checkbox pre-checked with what's already registered, and reconcile the
+ * choice. Checked = registered (and un-ignored). Unchecked = removed from the
+ * registry AND added to the ignore-list, so auto-discovery never re-suggests
+ * it — this is the "click to register/unregister" surface, with dismissals that
+ * stick.
+ */
+async function runInteractiveDeviceSync() {
+    const spinner = ora('Reading tailscale status...').start();
+    let nodes;
+    try {
+        nodes = parseTailscaleStatus(tailscaleStatusJson());
+    }
+    catch (err) {
+        spinner.fail(err.message);
+        process.exit(1);
+    }
+    const [reg, ignored] = await Promise.all([loadDevices(), loadIgnored()]);
+    const registered = new Set(Object.keys(reg));
+    spinner.stop();
+    if (nodes.length === 0) {
+        console.log(chalk.gray('No tailscale nodes found.'));
+        return;
+    }
+    const { checkbox } = await import('@inquirer/prompts');
+    let selected;
+    try {
+        selected = await checkbox({
+            // Everything not already dismissed starts checked, so pressing Enter keeps
+            // the fleet as-is (matching what auto-sync would register). Unchecking a
+            // device removes it AND dismisses it so auto-sync never re-adds it.
+            message: 'Your fleet — uncheck a device to remove and stop suggesting it:',
+            pageSize: Math.min(nodes.length, 20),
+            choices: nodes.map((n) => {
+                const flags = [n.platform, n.online ? undefined : 'offline', ignored.has(n.name) ? 'ignored' : undefined]
+                    .filter(Boolean)
+                    .join(', ');
+                return { value: n.name, name: `${n.name}  ${chalk.gray(`(${flags})`)}`, checked: !ignored.has(n.name) };
+            }),
+        });
+    }
+    catch (err) {
+        if (isPromptCancelled(err)) {
+            console.log(chalk.gray('Cancelled — no changes.'));
+            return;
+        }
+        throw err;
+    }
+    const byName = new Map(nodes.map((n) => [n.name, n]));
+    const plan = planDeviceReconciliation(byName.keys(), selected, registered, ignored);
+    for (const name of plan.toRegister)
+        await upsertDevice(name, nodeToDeviceInput(byName.get(name)));
+    for (const name of plan.toUnignore)
+        await removeIgnored(name);
+    for (const name of plan.toRemove)
+        await removeDevice(name);
+    for (const name of plan.toIgnore)
+        await addIgnored(name);
+    const parts = [
+        chalk.green(`${plan.toRegister.length} registered`),
+        plan.toRemove.length ? chalk.yellow(`${plan.toRemove.length} removed`) : null,
+        plan.toIgnore.length ? chalk.gray(`${plan.toIgnore.length} ignored`) : null,
+    ].filter(Boolean);
+    console.log(parts.join(chalk.gray(' · ')));
+}
 /** Register the `agents devices` command tree. */
 function registerDevicesCommands(program) {
     const devicesCmd = program
@@ -54,43 +128,100 @@ function registerDevicesCommands(program) {
         .description('Registry of SSH device profiles (platform, user, address, auth), self-populated from Tailscale.')
         .addHelpText('after', `
 Typical workflow:
-  agents devices sync            # ingest tailscale nodes (auto-detect platform)
+  agents devices sync            # curate: pick which tailscale nodes to keep (TTY)
+  agents devices sync --yes      # non-interactive: register all non-ignored nodes
   agents devices list            # see what's registered
+  agents devices ignore ipad165  # dismiss a node so it's never re-suggested
   agents devices set win-mini --auth password --bundle muqsit
   agents devices render --write  # write ~/.ssh/config.d/agents include
 `);
     devicesCmd
         .command('sync')
-        .description('Ingest `tailscale status --json` and create/update device profiles (auto-detects platform, address, reachability).')
-        .action(async () => {
+        .description('Ingest `tailscale status --json` into device profiles. In a terminal, opens a checkbox to register/unregister nodes; with --yes, registers every non-ignored node.')
+        .option('--yes', 'skip the picker; register all discovered non-ignored nodes')
+        .action(async (opts) => {
+        if (isInteractiveTerminal() && !opts.yes) {
+            await runInteractiveDeviceSync();
+            return;
+        }
         const spinner = ora('Reading tailscale status...').start();
+        try {
+            const res = await runDeviceSync();
+            const extra = res.pending.length ? chalk.gray(` (${res.pending.length} new)`) : '';
+            spinner.succeed(`Synced ${res.synced} device${res.synced === 1 ? '' : 's'} from Tailscale${extra}`);
+        }
+        catch (err) {
+            spinner.fail(err.message);
+            process.exit(1);
+        }
+    });
+    devicesCmd
+        .command('register <name>')
+        .description('Register a discovered (pending) node by name — used by the menu-bar "NEW DEVICES → Register" action.')
+        .action(async (name) => {
         try {
             const nodes = parseTailscaleStatus(tailscaleStatusJson());
-            spinner.text = `Updating ${nodes.length} device${nodes.length === 1 ? '' : 's'}...`;
-            for (const node of nodes) {
-                await upsertDevice(node.name, nodeToDeviceInput(node));
+            const node = nodes.find((n) => n.name === name);
+            if (!node) {
+                console.error(chalk.red(`'${name}' is not a current tailscale node. See 'agents devices sync'.`));
+                process.exit(1);
             }
-            spinner.succeed(`Synced ${nodes.length} device${nodes.length === 1 ? '' : 's'} from Tailscale`);
+            await removeIgnored(name); // a re-registered node is no longer dismissed
+            const d = await upsertDevice(name, nodeToDeviceInput(node));
+            clearPendingSentinel(name); // drop the notification immediately
+            console.log(chalk.green(`Registered '${name}'`) + chalk.gray(` (${d.platform})`));
         }
         catch (err) {
-            spinner.fail(err.message);
+            console.error(chalk.red(err.message));
             process.exit(1);
         }
     });
+    devicesCmd
+        .command('ignore <name>')
+        .description('Dismiss a node from auto-discovery so it is never re-suggested (and remove it from the registry if present).')
+        .action(async (name) => {
+        try {
+            await removeDevice(name);
+            await addIgnored(name);
+            clearPendingSentinel(name); // drop the notification immediately
+            console.log(chalk.green(`Ignored '${name}'`) + chalk.gray(" — it won't be suggested again. Undo with `agents devices unignore`."));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    devicesCmd
+        .command('unignore <name>')
+        .description('Undo `ignore`: allow a node to be discovered and registered again.')
+        .action(async (name) => {
+        const ok = await removeIgnored(name);
+        if (!ok) {
+            console.error(chalk.gray(`'${name}' was not ignored.`));
+            return;
+        }
+        console.log(chalk.green(`No longer ignoring '${name}'`) + chalk.gray(' — run `agents devices sync` to register it.'));
+    });
     devicesCmd
         .command('list')
         .alias('ls')
         .description('List registered devices with platform, address, and reachability.')
-        .action(async () => {
+        .option('--json', 'output the registry as a JSON array (for scripts and hooks)')
+        .action(async (opts) => {
         const reg = await loadDevices();
         const names = Object.keys(reg).sort();
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(names.map((n) => reg[n]), null, 2) + '\n');
+            return;
+        }
         if (names.length === 0) {
             console.log(chalk.gray("No devices. Run 'agents devices sync' or 'agents devices add <name> <user@host>'."));
             return;
         }
+        const self = machineId();
         console.log(chalk.bold(`Devices (${names.length})`));
         for (const name of names)
-            console.log(deviceSummary(reg[name]));
+            console.log(deviceSummary(reg[name], name === self));
     });
     devicesCmd
         .command('show <name>')

package/dist/commands/view.js

@@ -5,7 +5,7 @@ import * as path from 'path';
 import { AGENTS, ALL_AGENT_IDS, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
 import { deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, } from '../lib/usage.js';
 import { readManifest } from '../lib/manifest.js';
-import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, resolveVersionAlias, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, syncResourcesToVersion, removeVersion, printTrashFooter, } from '../lib/versions.js';
+import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, resolveVersionAlias, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, syncResourcesToVersion, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, } from '../lib/versions.js';
 import { ensureVersionedAliasCurrent, removeShim, } from '../lib/shims.js';
 import { getAgentResources } from '../lib/resources.js';
 import { listCliStatus } from '../lib/cli-resources.js';
@@ -1262,6 +1262,16 @@ export async function viewAction(agentArg, options) {
         cli: options?.cli,
     };
     const filterIsSet = SECTION_KEYS.some((k) => filter[k]);
+    // RUSH-1320: fold any stale literal `latest` version-home into its concrete
+    // version before rendering, so it stops appearing as a bogus "version" next
+    // to the real ones. Best-effort — must never break `agents view`. Scoped to
+    // the queried agent when one is given (cheap no-op for agents with no
+    // `latest` dir, i.e. almost all of them).
+    {
+        const target = agentArg ? resolveAgentName(agentArg.split('@')[0]) : null;
+        const toReconcile = agentArg ? (target ? [target] : []) : ALL_AGENT_IDS;
+        await Promise.all(toReconcile.map((a) => reconcileStaleLatestForAgent(a).catch(() => { })));
+    }
     if (!agentArg) {
         if (prune) {
             await pruneDuplicates(undefined, yes, dryRun);

package/dist/lib/agents.js

@@ -802,6 +802,37 @@ function resolveAccountCredentialPath(base, ...segments) {
     }
     return null;
 }
+let cachedAgyKeychainSignedIn;
+/**
+ * Antigravity (`agy`, a Codeium/Windsurf-based CLI) stores its OAuth token in
+ * the macOS keychain — service `gemini`, account `antigravity` — NOT a file.
+ * The file path (`antigravity-oauth-token`) only exists on Linux, where the Go
+ * keyring falls back to disk. Probe the keychain for existence (metadata only;
+ * `-w` omitted so it never prompts). Cached per process — the keychain is
+ * account-global, so one probe covers every installed version. Returns false on
+ * non-macOS (the file path handles those).
+ */
+async function antigravityKeychainSignedIn() {
+    if (cachedAgyKeychainSignedIn !== undefined)
+        return cachedAgyKeychainSignedIn;
+    // Test isolation: the real macOS keychain can't be sandboxed per-test, so
+    // allow suites asserting "signed out" to opt out of the probe (same spirit as
+    // AGENTS_REAL_HOME). Not cached, so tests can toggle it.
+    if (process.env.AGENTS_NO_KEYCHAIN_PROBE === '1')
+        return false;
+    if (process.platform !== 'darwin') {
+        cachedAgyKeychainSignedIn = false;
+        return false;
+    }
+    try {
+        await execFileAsync('security', ['find-generic-password', '-s', 'gemini', '-a', 'antigravity'], { timeout: 3000 });
+        cachedAgyKeychainSignedIn = true;
+    }
+    catch {
+        cachedAgyKeychainSignedIn = false;
+    }
+    return cachedAgyKeychainSignedIn;
+}
 export async function getAccountInfo(agentId, home) {
     const base = home || os.homedir();
     const empty = {
@@ -938,32 +969,52 @@ export async function getAccountInfo(agentId, home) {
                 return { ...empty, email, signedIn: !!email, lastActive };
             }
             case 'grok': {
-                // Grok stores auth in ~/.grok/auth.json
+                // Grok stores auth in ~/.grok/auth.json as a map keyed by
+                // "<oidc_issuer>::<client_id>" -> { email, user_id, refresh_token,
+                // create_time, expires_at, team_id, ... }. (Older builds wrote a flat
+                // object with a top-level email.) The old code only read a TOP-LEVEL
+                // `email`, so the current nested format always looked signed-out even
+                // when logged in. Read the newest account record: a refresh token means
+                // signed in, and we surface the email/ids like claude/codex.
+                const authPath = resolveAccountCredentialPath(base, '.grok', 'auth.json');
+                if (!authPath)
+                    return { ...empty, lastActive };
                 try {
-                    const authPath = path.join(base, '.grok', 'auth.json');
-                    if (fs.existsSync(authPath)) {
-                        const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
-                        const email = data.email || data.user?.email || data.account?.email || null;
-                        return { ...empty, email, signedIn: !!email, lastActive };
+                    const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
+                    const records = (data && typeof data === 'object' ? [data, ...Object.values(data)] : [])
+                        .filter((r) => !!r && typeof r === 'object');
+                    const account = records
+                        .filter(r => typeof r.refresh_token === 'string' || typeof r.email === 'string')
+                        .sort((a, b) => String(b.create_time || '').localeCompare(String(a.create_time || '')))[0];
+                    if (account) {
+                        const email = typeof account.email === 'string' ? account.email : null;
+                        const accountId = normalizeIdentityPart(account.user_id ?? account.principal_id);
+                        const organizationId = normalizeIdentityPart(account.team_id);
+                        const accountKey = buildIdentityKey(agentId, [['user', accountId], ['org', organizationId]]);
+                        return { ...empty, email, accountId, organizationId, accountKey, signedIn: true, lastActive };
                     }
                 }
                 catch { }
                 return { ...empty, lastActive };
             }
             case 'antigravity': {
-                // Antigravity (`agy`) stores a Google OAuth token at
-                // ~/.gemini/antigravity-cli/antigravity-oauth-token. It's a consumer
-                // OAuth grant (access + refresh token, no id_token), so there's no email
-                // claim to read locally — presence of a refresh token is the only
-                // signed-in signal we can derive without a network call.
+                // Antigravity (`agy`) stores a consumer Google OAuth grant (access +
+                // refresh token, no id_token) — presence of a refresh token is the only
+                // signed-in signal we can derive without a network call. Storage is
+                // platform-split: on Linux it's a file at
+                // ~/.gemini/antigravity-cli/antigravity-oauth-token; on macOS the Go
+                // keyring puts it in the keychain (service 'gemini', account
+                // 'antigravity'), so no file exists — check both.
                 const tokenPath = resolveAccountCredentialPath(base, '.gemini', 'antigravity-cli', 'antigravity-oauth-token');
-                if (!tokenPath)
-                    return { ...empty, lastActive };
-                const data = JSON.parse(await fs.promises.readFile(tokenPath, 'utf-8'));
-                const hasToken = typeof data?.token?.refresh_token === 'string' && !!data.token.refresh_token;
-                if (!hasToken)
-                    return { ...empty, lastActive };
-                return { ...empty, signedIn: true, lastActive };
+                if (tokenPath) {
+                    const data = JSON.parse(await fs.promises.readFile(tokenPath, 'utf-8'));
+                    if (typeof data?.token?.refresh_token === 'string' && data.token.refresh_token) {
+                        return { ...empty, signedIn: true, lastActive };
+                    }
+                }
+                if (await antigravityKeychainSignedIn())
+                    return { ...empty, signedIn: true, lastActive };
+                return { ...empty, lastActive };
             }
             case 'kimi': {
                 // Kimi Code stores OAuth credentials at

package/dist/lib/daemon.js

@@ -290,6 +290,36 @@ export async function runDaemon() {
     };
     const healInterval = setInterval(() => { void runHealCheck(); }, 6 * 60 * 60_000);
     const healKickoff = setTimeout(() => { void runHealCheck(); }, 30_000);
+    // Device probe: refresh registered devices' reachability and detect newly
+    // appeared tailnet nodes, dropping a sentinel per pending device so the
+    // menu-bar helper can surface "NEW DEVICES → Register / Ignore". Refresh mode
+    // never auto-registers a newcomer. Soft + overlap-guarded like session sync;
+    // a machine without tailscale is a clean no-op. ~every 3 min.
+    let probingDevices = false;
+    const runDeviceProbe = async () => {
+        if (probingDevices)
+            return;
+        probingDevices = true;
+        try {
+            const { runDeviceSync } = await import('./devices/sync.js');
+            const { reconcilePendingSentinels } = await import('./devices/pending.js');
+            const dev = await runDeviceSync({ soft: true, mode: 'refresh' });
+            if (dev.ok) {
+                reconcilePendingSentinels(dev.pending);
+                if (dev.pending.length) {
+                    log('INFO', `devices: ${dev.pending.length} new pending (${dev.pending.map((p) => p.name).join(', ')})`);
+                }
+            }
+        }
+        catch (err) {
+            log('ERROR', `device probe failed: ${err.message}`);
+        }
+        finally {
+            probingDevices = false;
+        }
+    };
+    const deviceProbeInterval = setInterval(() => { void runDeviceProbe(); }, 3 * 60_000);
+    const deviceProbeKickoff = setTimeout(() => { void runDeviceProbe(); }, 15_000);
     const handleReload = () => {
         log('INFO', 'Reloading jobs (SIGHUP)');
         scheduler.reloadAll();
@@ -307,6 +337,8 @@ export async function runDaemon() {
         clearInterval(syncInterval);
         clearInterval(healInterval);
         clearTimeout(healKickoff);
+        clearInterval(deviceProbeInterval);
+        clearTimeout(deviceProbeKickoff);
         removeDaemonPid();
         process.exit(0);
     };

package/dist/lib/devices/pending.d.ts

@@ -0,0 +1,18 @@
+export interface PendingDevice {
+    name: string;
+    platform: string;
+}
+/**
+ * Make the sentinel dir exactly match `pending`: create a file per pending
+ * device (content = platform), and delete any leftover sentinel whose device is
+ * no longer pending (it got registered, ignored, or left the tailnet). Best-
+ * effort — a filesystem error here must never crash the daemon, so callers pass
+ * this through their existing try/catch.
+ */
+export declare function reconcilePendingSentinels(pending: PendingDevice[]): void;
+/** Remove one device's pending sentinel (after the user registers or ignores it).
+ * No-op if it doesn't exist. */
+export declare function clearPendingSentinel(name: string): void;
+/** Read the current pending sentinels (name + platform). Used by tests and any
+ * TS-side consumer; the menu-bar helper reads the dir directly in Swift. */
+export declare function readPendingSentinels(): PendingDevice[];