@phnx-labs/agents-cli 1.20.52 → 1.20.54

package/dist/lib/cloud/types.js

@@ -5,6 +5,87 @@
  * Factory) implement, plus the shared task and event types that flow through
  * the dispatch pipeline.
  */
+/**
+ * Normalize a provider's raw wire status into the canonical `CloudTaskStatus`.
+ *
+ * Each cloud backend speaks its own status vocabulary and had its own copy of
+ * this mapping, which had drifted. This dispatches per provider while keeping
+ * provider-specific defaults explicit:
+ *   - `rush`        — switch over the Factory Floor's known strings; includes
+ *                     `allocating` and stopped/resumable `idle` states, has no
+ *                     `queued`, default `running`.
+ *   - `codex`       — substring match on the lowercased CLI status; default
+ *                     `running`.
+ *   - `antigravity` — substring match on the (possibly `undefined`) Interactions
+ *                     API status; default `completed` (its synchronous response
+ *                     is terminal), and `undefined`-safe.
+ *
+ * Factory's `mapResultStatus` is structurally different (it maps a droid *exit*
+ * result, not a lifecycle string) and deliberately stays in `factory.ts`.
+ */
+export function normalizeProviderStatus(provider, wireStatus) {
+    switch (provider) {
+        case 'rush':
+            return normalizeRushStatus(wireStatus ?? '');
+        case 'codex':
+            return normalizeCodexStatus(wireStatus ?? '');
+        case 'antigravity':
+            return normalizeAntigravityStatus(wireStatus);
+    }
+}
+/** Rush Factory Floor status → canonical enum. Default `running`; no `queued`. */
+function normalizeRushStatus(s) {
+    switch (s) {
+        case 'allocating': return 'allocating';
+        case 'running': return 'running';
+        case 'idle':
+        case 'paused':
+        case 'needs_review': return 'idle';
+        case 'input_required': return 'input_required';
+        case 'completed': return 'completed';
+        case 'failed': return 'failed';
+        case 'cancelled': return 'cancelled';
+        default: return 'running';
+    }
+}
+/** Codex Cloud CLI status → canonical enum. Substring match; default `running`. */
+function normalizeCodexStatus(s) {
+    const lower = s.toLowerCase();
+    if (lower.includes('queued') || lower.includes('pending'))
+        return 'queued';
+    if (lower.includes('running') || lower.includes('in_progress'))
+        return 'running';
+    if (lower.includes('idle') || lower.includes('paused') || lower.includes('needs_review'))
+        return 'idle';
+    if (lower.includes('completed') || lower.includes('succeeded') || lower.includes('success'))
+        return 'completed';
+    if (lower.includes('failed') || lower.includes('error'))
+        return 'failed';
+    if (lower.includes('cancelled') || lower.includes('canceled'))
+        return 'cancelled';
+    return 'running';
+}
+/**
+ * Antigravity Interactions API status → canonical enum. Substring match,
+ * `undefined`-safe; default `completed` because the synchronous response is
+ * already terminal.
+ */
+function normalizeAntigravityStatus(s) {
+    const lower = (s ?? '').toLowerCase();
+    if (lower.includes('queue') || lower.includes('pending'))
+        return 'queued';
+    if (lower.includes('run') || lower.includes('progress'))
+        return 'running';
+    if (lower.includes('idle') || lower.includes('paused') || lower.includes('needs_review'))
+        return 'idle';
+    if (lower.includes('complete') || lower.includes('success'))
+        return 'completed';
+    if (lower.includes('fail') || lower.includes('error'))
+        return 'failed';
+    if (lower.includes('cancel'))
+        return 'cancelled';
+    return 'completed';
+}
 /** Maximum images allowed per dispatch (matches Cursor Background Agents). */
 export const MAX_IMAGES_PER_DISPATCH = 5;
 /**

package/dist/lib/crabbox/cli.d.ts

@@ -62,7 +62,7 @@ export interface WarmupOptions extends CrabboxOptions {
  * created even if warmup's stdout format changes — the new lease id is the one
  * that wasn't present before.
  */
-export declare function crabboxWarmup(opts?: WarmupOptions): CrabboxBox;
+export declare function crabboxWarmup(opts?: WarmupOptions): Promise<CrabboxBox>;
 /**
  * Poll until the box reports ready, or throw after timeoutMs.
  * `sleep` is injectable so tests don't wall-clock wait.

package/dist/lib/crabbox/cli.js

@@ -87,7 +87,7 @@ export function crabboxFind(slug, opts = {}) {
  * created even if warmup's stdout format changes — the new lease id is the one
  * that wasn't present before.
  */
-export function crabboxWarmup(opts = {}) {
+export async function crabboxWarmup(opts = {}) {
     findCrabbox();
     const env = crabboxEnv(opts);
     const before = new Set(crabboxList(opts).map((b) => b.lease));
@@ -100,7 +100,17 @@ export function crabboxWarmup(opts = {}) {
         args.push('--provider', opts.provider);
     if (opts.code)
         args.push('--code');
-    const r = spawnSync('crabbox', args, { encoding: 'utf-8', env, stdio: ['ignore', 'pipe', 'pipe'] });
+    // Async spawn (not spawnSync): provisioning takes 30-90s and a blocking call
+    // would freeze any caller's progress spinner. Output is captured, not streamed.
+    const r = await new Promise((resolve) => {
+        const proc = spawn('crabbox', args, { env, stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        proc.stdout.on('data', (c) => (stdout += c.toString('utf-8')));
+        proc.stderr.on('data', (c) => (stderr += c.toString('utf-8')));
+        proc.on('error', () => resolve({ status: null, stdout, stderr }));
+        proc.on('close', (code) => resolve({ status: code, stdout, stderr }));
+    });
     if (r.status !== 0) {
         const detail = (r.stderr || r.stdout || '').trim();
         throw new Error(`crabbox warmup failed: ${detail || 'unknown error'}. ` +

package/dist/lib/crabbox/lease.d.ts

@@ -9,6 +9,17 @@
 import type { AgentId } from '../types.js';
 import { type CrabboxBox } from './cli.js';
 import { type DetectedRuntime } from './runtimes.js';
+/** Phase signal for a lease run, so the command layer can drive a progress UI. */
+export type LeasePhase = {
+    kind: 'warmup';
+    backend?: string;
+} | {
+    kind: 'ready';
+    box: CrabboxBox;
+    elapsedMs: number;
+} | {
+    kind: 'teardown';
+};
 export interface LeaseRunOptions {
     agent: string;
     prompt: string;
@@ -24,6 +35,8 @@ export interface LeaseRunOptions {
     /** Secrets bundle providing crabbox's provider token. */
     secretsBundle?: string;
     onData?: (s: string) => void;
+    /** Progress phases (warmup → ready → teardown) for a command-layer spinner. */
+    onPhase?: (phase: LeasePhase) => void;
     /** Keep the box after the run instead of stopping it. */
     keep?: boolean;
     /**

package/dist/lib/crabbox/lease.js

@@ -8,6 +8,7 @@
  */
 import { crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop } from './cli.js';
 import { buildCredentialScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
+import { LEASE_AGENT_MARKER } from './progress.js';
 /** POSIX single-quote for safe embedding in the generated bootstrap script. */
 function q(s) {
     return "'" + s.replace(/'/g, "'\\''") + "'";
@@ -68,6 +69,9 @@ export function buildBootstrapScript(opts) {
         ENSURE_AGENTS_CLI,
         installRuntimes,
         credScript,
+        // Marker on its own line: the command layer shows everything before this as
+        // setup progress and everything after (the agent's output) verbatim.
+        `echo ${q(LEASE_AGENT_MARKER)}`,
         `${runParts.join(' ')}`,
         'rc=$?',
         shred,
@@ -77,13 +81,16 @@ export function buildBootstrapScript(opts) {
         .join('\n');
 }
 export async function leaseAndRun(opts) {
-    const box = crabboxWarmup({
+    const startedAt = Date.now();
+    opts.onPhase?.({ kind: 'warmup', backend: opts.backend });
+    const box = await crabboxWarmup({
         class: opts.boxClass,
         profile: opts.profile,
         provider: opts.backend,
         secretsBundle: opts.secretsBundle,
     });
     await crabboxWaitReady(box.slug, { secretsBundle: opts.secretsBundle });
+    opts.onPhase?.({ kind: 'ready', box, elapsedMs: Date.now() - startedAt });
     const script = buildBootstrapScript(opts);
     let exitCode = null;
     let toreDown = false;
@@ -96,8 +103,10 @@ export async function leaseAndRun(opts) {
     finally {
         // Always attempt teardown (bounds credential lifetime to the run) unless the
         // caller explicitly asked to keep the box.
-        if (!opts.keep)
+        if (!opts.keep) {
+            opts.onPhase?.({ kind: 'teardown' });
             toreDown = crabboxStop(box.slug, { secretsBundle: opts.secretsBundle });
+        }
     }
     return { box, exitCode, toreDown };
 }

package/dist/lib/crabbox/progress.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Progress routing for `agents run --lease`.
+ *
+ * The box-side bootstrap emits `LEASE_AGENT_MARKER` on its own line right before
+ * `agents run`. Everything the crabbox run streams BEFORE that marker is setup
+ * noise (sync bytes, node/agents install, `agents setup`) — shown as spinner
+ * text and captured for a failure dump. Everything AFTER is the agent's own
+ * output — printed through verbatim. The marker line itself is swallowed.
+ */
+/** Sentinel echoed on the box right before `agents run`. Distinctive + collision-proof. */
+export declare const LEASE_AGENT_MARKER = "___AGENTS_LEASE_AGENT_OUTPUT_b1f4c2___";
+export interface Spinner {
+    /** Begin animating a phase (renders `frame text` on one line, TTY only). */
+    start(text: string): void;
+    /** Change the text shown; rendered on the next throttled tick (no write itself). */
+    update(text: string): void;
+    /** Finalize the current line with a symbol (e.g. ✔) and a newline. */
+    stopAndPersist(symbol: string, text: string): void;
+    /** Clear the current animated line without persisting anything. */
+    stop(): void;
+    /** True while a phase is active. */
+    readonly active: boolean;
+}
+/**
+ * A deliberately minimal, self-throttled spinner. Unlike `ora`, it does NOT hook
+ * the stream's `write` to re-render on external output — it writes exactly one
+ * short line per fixed tick and nowhere else, so it is structurally incapable of
+ * a re-render feedback loop (the failure mode that made `ora` blow up when a
+ * lease streamed output past a live spinner). On a non-TTY it prints each phase
+ * label once and stays silent on `update`, so piped/CI output never floods.
+ *
+ * Only ever run ONE phase at a time, and never stream other output to the same
+ * stream while a phase is active — stop it first.
+ */
+export declare function createSpinner(opts?: {
+    stream?: {
+        write(s: string): unknown;
+        isTTY?: boolean;
+    };
+    enabled?: boolean;
+    intervalMs?: number;
+}): Spinner;
+export interface LeaseOutputRouter {
+    /** Feed a raw chunk of the crabbox run's combined stdout/stderr. */
+    push(chunk: string): void;
+    /** Flush any buffered partial line (call once the stream closes). */
+    end(): void;
+    /** True once the agent-output marker has been seen. */
+    sawAgent(): boolean;
+    /** The setup lines seen so far (for a failure dump). */
+    setupLines(): string[];
+}
+/**
+ * Split the crabbox run stream at `LEASE_AGENT_MARKER`. `onSetupLine` fires for
+ * each complete non-empty line before the marker; `onAgentChunk` fires with raw
+ * text after it (streamed promptly, not line-buffered, so agent output is live).
+ */
+export declare function createLeaseOutputRouter(cb: {
+    onSetupLine: (line: string) => void;
+    onAgentChunk: (chunk: string) => void;
+    marker?: string;
+}): LeaseOutputRouter;

package/dist/lib/crabbox/progress.js

@@ -0,0 +1,129 @@
+/**
+ * Progress routing for `agents run --lease`.
+ *
+ * The box-side bootstrap emits `LEASE_AGENT_MARKER` on its own line right before
+ * `agents run`. Everything the crabbox run streams BEFORE that marker is setup
+ * noise (sync bytes, node/agents install, `agents setup`) — shown as spinner
+ * text and captured for a failure dump. Everything AFTER is the agent's own
+ * output — printed through verbatim. The marker line itself is swallowed.
+ */
+/** Sentinel echoed on the box right before `agents run`. Distinctive + collision-proof. */
+export const LEASE_AGENT_MARKER = '___AGENTS_LEASE_AGENT_OUTPUT_b1f4c2___';
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+/**
+ * A deliberately minimal, self-throttled spinner. Unlike `ora`, it does NOT hook
+ * the stream's `write` to re-render on external output — it writes exactly one
+ * short line per fixed tick and nowhere else, so it is structurally incapable of
+ * a re-render feedback loop (the failure mode that made `ora` blow up when a
+ * lease streamed output past a live spinner). On a non-TTY it prints each phase
+ * label once and stays silent on `update`, so piped/CI output never floods.
+ *
+ * Only ever run ONE phase at a time, and never stream other output to the same
+ * stream while a phase is active — stop it first.
+ */
+export function createSpinner(opts = {}) {
+    const stream = opts.stream ?? process.stderr;
+    const enabled = opts.enabled ?? !!stream.isTTY;
+    const intervalMs = opts.intervalMs ?? 120;
+    const CLEAR = '\r\u001b[2K';
+    let text = '';
+    let frame = 0;
+    let timer;
+    let running = false;
+    const write = (s) => stream.write(s);
+    return {
+        start(t) {
+            text = t;
+            running = true;
+            if (!enabled) {
+                write(`${t}\n`);
+                return;
+            }
+            if (timer)
+                return;
+            frame = 0;
+            write(`${CLEAR}${SPINNER_FRAMES[0]} ${text}`);
+            timer = setInterval(() => {
+                frame = (frame + 1) % SPINNER_FRAMES.length;
+                write(`${CLEAR}${SPINNER_FRAMES[frame]} ${text}`);
+            }, intervalMs);
+        },
+        update(t) {
+            text = t; // next tick renders it; on a non-TTY we stay silent (no flood)
+        },
+        stopAndPersist(symbol, t) {
+            if (timer) {
+                clearInterval(timer);
+                timer = undefined;
+            }
+            running = false;
+            write(enabled ? `${CLEAR}${symbol} ${t}\n` : `${symbol} ${t}\n`);
+        },
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = undefined;
+                if (enabled)
+                    write(CLEAR);
+            }
+            running = false;
+        },
+        get active() {
+            return running;
+        },
+    };
+}
+/**
+ * Split the crabbox run stream at `LEASE_AGENT_MARKER`. `onSetupLine` fires for
+ * each complete non-empty line before the marker; `onAgentChunk` fires with raw
+ * text after it (streamed promptly, not line-buffered, so agent output is live).
+ */
+export function createLeaseOutputRouter(cb) {
+    const marker = cb.marker ?? LEASE_AGENT_MARKER;
+    let seen = false;
+    let buf = '';
+    const setup = [];
+    const emitLine = (line) => {
+        const t = line.replace(/\r$/, '');
+        if (t.trim()) {
+            setup.push(t);
+            cb.onSetupLine(t);
+        }
+    };
+    return {
+        push(chunk) {
+            if (seen) {
+                cb.onAgentChunk(chunk);
+                return;
+            }
+            buf += chunk;
+            let idx;
+            while ((idx = buf.indexOf('\n')) !== -1) {
+                const line = buf.slice(0, idx);
+                buf = buf.slice(idx + 1);
+                if (line.includes(marker)) {
+                    seen = true;
+                    // Anything already buffered past the marker is agent output.
+                    if (buf) {
+                        cb.onAgentChunk(buf);
+                        buf = '';
+                    }
+                    return;
+                }
+                emitLine(line);
+            }
+            // A trailing partial line stays in `buf` — it may be the marker forming.
+        },
+        end() {
+            if (!seen && buf)
+                emitLine(buf);
+            buf = '';
+        },
+        sawAgent() {
+            return seen;
+        },
+        setupLines() {
+            return setup;
+        },
+    };
+}

package/dist/lib/devices/resolve-target.d.ts

@@ -1,4 +1,4 @@
-import { type DeviceRegistry } from './registry.js';
+import { type DeviceProfile, type DeviceRegistry } from './registry.js';
 /** A dialable peer: the ssh target, the machine id used to tag its rows, a
  * display name, and the OS family that picks the remote shell dialect. */
 export interface ResolvedSshTarget {
@@ -7,14 +7,31 @@ export interface ResolvedSshTarget {
     name: string;
     os?: string;
 }
+/** Split a `user@host` / `host` token into its login user (if any) and host part. */
+export declare function splitUserHost(token: string): {
+    user?: string;
+    host: string;
+};
 /**
  * Resolve one `--host`/`--device` token to a concrete ssh target through the
  * registry. Registry hit → the device's real address + platform (so the machine
- * id, route, and OS all match the auto-discovery sweep). Miss → a literal
- * `user@host` fallback, its OS taken from the host overlay if enrolled. Returns
- * undefined only when the token fails the shared ssh-target injection guard.
+ * id, route, and OS all match the auto-discovery sweep), with any `user@`
+ * overriding the login account. Miss → a literal `user@host` fallback, its OS
+ * taken from the host overlay if enrolled. Returns undefined only when the token
+ * fails the shared ssh-target injection guard.
  */
 export declare function resolveSshTarget(token: string, reg: DeviceRegistry): ResolvedSshTarget | undefined;
+/**
+ * Resolve a target token to a full {@link DeviceProfile} for `agents ssh`. Same
+ * grammar as {@link resolveSshTarget}, but returns the whole profile (auth,
+ * shell, tailscale metadata) `buildSshInvocation` needs — not just a target
+ * string. A registered `name` or `user@device` yields that profile (with the
+ * login user overridden by any `user@`); an ad-hoc `user@host`/`host` literal
+ * yields a synthesized key-auth profile. A bare unregistered alias (no `@`/dot)
+ * returns undefined so the caller reports "Unknown device" rather than dialing a
+ * literal — the strict behaviour the interactive wrapper has always had.
+ */
+export declare function resolveDeviceTarget(token: string, reg: DeviceRegistry): DeviceProfile | undefined;
 /**
  * Resolve an explicit `--host`/`--device` list to dialable targets, reading the
  * registry once. A token that fails the injection guard is skipped with a

package/dist/lib/devices/resolve-target.js

@@ -13,8 +13,12 @@
  * `%C` hash → a cold dial every time) and could read a perfectly reachable box
  * as "unreachable" when only the non-Tailscale route was down.
  *
- * A raw `user@host` that matches no registered device falls back to a literal
- * target so ad-hoc boxes still work.
+ * The grammar is uniform across the fleet: `mac-mini` (device name), and
+ * `muqsit@mac-mini` (same device, login user overridden) both resolve through
+ * the registry to the device's Tailscale route — the `user@` form no longer
+ * short-circuits to a bare `ssh muqsit@mac-mini` (LAN DNS). A `user@host` that
+ * matches no registered device falls back to a literal target so ad-hoc boxes
+ * still work.
  */
 import chalk from 'chalk';
 import { assertValidSshTarget } from '../ssh-exec.js';
@@ -22,12 +26,28 @@ import { normalizeHost } from '../machine-id.js';
 import { resolveRemoteOsSync } from '../hosts/remote-os.js';
 import { sshTargetFor } from './connect.js';
 import { loadDevices } from './registry.js';
+/** Split a `user@host` / `host` token into its login user (if any) and host part. */
+export function splitUserHost(token) {
+    const at = token.indexOf('@');
+    return at === -1 ? { host: token } : { user: token.slice(0, at), host: token.slice(at + 1) };
+}
+/**
+ * Match a host part (the piece after any `user@`) to a registered device: exact
+ * registry key first, then a normalized-host match so `yosemite-s0` and
+ * `yosemite-s0.<tailnet>.ts.net` land on the same profile. The single source of
+ * truth both `resolveSshTarget` (fan-out) and `resolveDeviceTarget` (`agents
+ * ssh`) share, so a `user@device` can never resolve two different routes.
+ */
+function matchDevice(host, reg) {
+    return reg[host] ?? Object.values(reg).find((d) => normalizeHost(d.name) === normalizeHost(host));
+}
 /**
  * Resolve one `--host`/`--device` token to a concrete ssh target through the
  * registry. Registry hit → the device's real address + platform (so the machine
- * id, route, and OS all match the auto-discovery sweep). Miss → a literal
- * `user@host` fallback, its OS taken from the host overlay if enrolled. Returns
- * undefined only when the token fails the shared ssh-target injection guard.
+ * id, route, and OS all match the auto-discovery sweep), with any `user@`
+ * overriding the login account. Miss → a literal `user@host` fallback, its OS
+ * taken from the host overlay if enrolled. Returns undefined only when the token
+ * fails the shared ssh-target injection guard.
  */
 export function resolveSshTarget(token, reg) {
     try {
@@ -36,22 +56,70 @@ export function resolveSshTarget(token, reg) {
     catch {
         return undefined;
     }
-    const bare = token.split('@').pop() || token;
-    // An explicit `user@host` names an exact account/target — honour it literally.
-    // A bare alias (`yosemite-s0`) resolves through the registry to the device's
-    // real address, so it never diverges from the auto-discovery sweep.
-    const device = token.includes('@')
-        ? undefined
-        : reg[token] ?? Object.values(reg).find((d) => normalizeHost(d.name) === normalizeHost(bare));
+    const { user, host } = splitUserHost(token);
+    // A device and a `user@device` are the same box; resolve the host part through
+    // the registry so both dial the Tailscale route, and let an explicit `user@`
+    // override only the login account.
+    const device = matchDevice(host, reg);
     if (device) {
         try {
-            return { target: sshTargetFor(device), machine: normalizeHost(device.name), name: device.name, os: device.platform };
+            const effective = user ? { ...device, user } : device;
+            return { target: sshTargetFor(effective), machine: normalizeHost(device.name), name: device.name, os: device.platform };
         }
         catch {
             // Registered but has no address to dial — fall through to the literal token.
         }
     }
-    return { target: token, machine: normalizeHost(bare), name: token, os: resolveRemoteOsSync(token) };
+    return { target: token, machine: normalizeHost(host), name: token, os: resolveRemoteOsSync(token) };
+}
+/** Timestamps for a synthesized ad-hoc profile — never persisted, so a constant
+ * keeps the value deterministic (and side-effect free) without reading the clock. */
+const SYNTH_TS = '1970-01-01T00:00:00.000Z';
+/** True when a token is clearly a network target (a `user@`, or a dotted/IPv6
+ * host / IP) rather than a bare alias. A bare unknown word is a typo, so `agents
+ * ssh foo` still says "Unknown device" instead of dialing a literal `foo`. */
+function looksLikeHostLiteral(token) {
+    return token.includes('@') || token.includes('.') || token.includes(':');
+}
+/** Synthesize a throwaway device profile for an ad-hoc `user@host` / `host`
+ * literal so `agents ssh` can dial a box that was never registered. */
+function adHocDevice(token, host, user) {
+    const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+    return {
+        name: token,
+        platform: 'unknown',
+        shell: 'posix',
+        user,
+        address: { via: 'manual', dnsName: isIp ? undefined : host, ip: isIp ? host : undefined },
+        auth: { method: 'key' },
+        createdAt: SYNTH_TS,
+        updatedAt: SYNTH_TS,
+    };
+}
+/**
+ * Resolve a target token to a full {@link DeviceProfile} for `agents ssh`. Same
+ * grammar as {@link resolveSshTarget}, but returns the whole profile (auth,
+ * shell, tailscale metadata) `buildSshInvocation` needs — not just a target
+ * string. A registered `name` or `user@device` yields that profile (with the
+ * login user overridden by any `user@`); an ad-hoc `user@host`/`host` literal
+ * yields a synthesized key-auth profile. A bare unregistered alias (no `@`/dot)
+ * returns undefined so the caller reports "Unknown device" rather than dialing a
+ * literal — the strict behaviour the interactive wrapper has always had.
+ */
+export function resolveDeviceTarget(token, reg) {
+    try {
+        assertValidSshTarget(token);
+    }
+    catch {
+        return undefined;
+    }
+    const { user, host } = splitUserHost(token);
+    const device = matchDevice(host, reg);
+    if (device)
+        return user ? { ...device, user } : device;
+    if (looksLikeHostLiteral(token))
+        return adHocDevice(token, host, user);
+    return undefined;
 }
 /**
  * Resolve an explicit `--host`/`--device` list to dialable targets, reading the

package/dist/lib/devices/sync.d.ts

@@ -1,5 +1,23 @@
+import { type DeviceInput } from './registry.js';
 import { type TailscaleNode } from './tailscale.js';
 import type { PendingDevice } from './pending.js';
+/**
+ * The login user to stamp onto newly-synced devices. Tailscale status carries a
+ * node's OS and address but NOT the account you ssh in as, so we materialize the
+ * local operator's username — tailnet devices are overwhelmingly one person's
+ * boxes, and this is exactly the account ssh would already fall back to. Pinning
+ * it in the registry makes `--host <device>` dial that account no matter which
+ * machine launches the fan-out (a peer whose local user differs otherwise dials
+ * the wrong account). Returns undefined when the username isn't a safe ssh
+ * identifier, so a weird value never lands in the registry. */
+export declare function localLoginUser(): string | undefined;
+/**
+ * Fill in a device's login user during sync WITHOUT ever clobbering an account
+ * the user pinned. Precedence: an existing registered user wins; else the local
+ * operator's username; else leave it unset (ssh's implicit local default still
+ * applies). Pure so the "never overwrite an explicit user" guard is unit-tested
+ * without a tailnet. */
+export declare function withDefaultUser(input: DeviceInput, prevUser: string | undefined, localUser: string | undefined): DeviceInput;
 /**
  * bootstrap — register every non-ignored node (opt-out). First-run `agents
  *   setup` and manual `agents devices sync`, so the fleet is usable out of box.

package/dist/lib/devices/sync.js

@@ -14,8 +14,39 @@
  *   - soft (`soft: true`): auto-callers must never abort setup/sync because a
  *     machine has no tailscale — they get a result with `ok: false` instead.
  */
+import * as os from 'os';
 import { loadDevices, loadIgnored, upsertDevice, } from './registry.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from './tailscale.js';
+/**
+ * The login user to stamp onto newly-synced devices. Tailscale status carries a
+ * node's OS and address but NOT the account you ssh in as, so we materialize the
+ * local operator's username — tailnet devices are overwhelmingly one person's
+ * boxes, and this is exactly the account ssh would already fall back to. Pinning
+ * it in the registry makes `--host <device>` dial that account no matter which
+ * machine launches the fan-out (a peer whose local user differs otherwise dials
+ * the wrong account). Returns undefined when the username isn't a safe ssh
+ * identifier, so a weird value never lands in the registry. */
+export function localLoginUser() {
+    let u;
+    try {
+        u = os.userInfo().username;
+    }
+    catch {
+        u = process.env.USER || process.env.USERNAME || undefined;
+    }
+    return u && /^[a-zA-Z0-9._-]+$/.test(u) ? u : undefined;
+}
+/**
+ * Fill in a device's login user during sync WITHOUT ever clobbering an account
+ * the user pinned. Precedence: an existing registered user wins; else the local
+ * operator's username; else leave it unset (ssh's implicit local default still
+ * applies). Pure so the "never overwrite an explicit user" guard is unit-tested
+ * without a tailnet. */
+export function withDefaultUser(input, prevUser, localUser) {
+    if (input.user || prevUser || !localUser)
+        return input;
+    return { ...input, user: localUser };
+}
 /**
  * Node names present on the tailnet but neither already in the registry nor on
  * the ignore-list — i.e. genuinely new devices worth surfacing. Pure so the
@@ -68,8 +99,10 @@ export async function runDeviceSync(opts = {}) {
             platform: byName.get(name)?.platform ?? 'unknown',
         }));
         const toUpsert = selectNodesToUpsert(nodes, registered, ignored, mode);
+        const localUser = localLoginUser();
         for (const node of toUpsert) {
-            await upsertDevice(node.name, nodeToDeviceInput(node));
+            const input = withDefaultUser(nodeToDeviceInput(node), registeredBefore[node.name]?.user, localUser);
+            await upsertDevice(node.name, input);
         }
         return { ok: true, synced: toUpsert.length, pending };
     }

package/dist/lib/events.js

@@ -22,9 +22,12 @@ import { getUserAgentsDir } from './state.js';
 // ─── Constants ────────────────────────────────────────────────────────────────
 // Resolved lazily: events.ts is imported transitively by most CLI surfaces, and
 // import itself must stay side-effect free. Tests may override the exact path.
+// AGENTS_EVENTS_PATH redirects the sink — a test seam like AGENTS_SECRETS_AGENT_DIR:
+// unlike _resetForTest it survives a bare reset AND propagates to CLI subprocesses
+// a test spawns, so fixture events can never land in the user's real log (#910).
 let _eventsPath;
 function eventsPath() {
-    return (_eventsPath ??= path.join(getUserAgentsDir(), 'events.jsonl'));
+    return (_eventsPath ??= process.env.AGENTS_EVENTS_PATH || path.join(getUserAgentsDir(), 'events.jsonl'));
 }
 function eventsDir() {
     return path.dirname(eventsPath());