@phnx-labs/agents-cli 1.20.62 → 1.20.64

package/dist/lib/crabbox/cli.js

@@ -12,7 +12,8 @@
  * from a secrets bundle when one is configured (see `crabboxEnv`).
  */
 import { spawn, spawnSync } from 'child_process';
-import { readAndResolveBundleEnv } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv, listBundles, bundleExists } from '../secrets/bundles.js';
+import { readMeta, writeMeta } from '../state.js';
 /** Locate the crabbox binary, or throw an actionable error. */
 export function findCrabbox() {
     const r = spawnSync('crabbox', ['--help'], { encoding: 'utf-8' });
@@ -21,21 +22,95 @@ export function findCrabbox() {
     }
     return 'crabbox';
 }
+/**
+ * Env keys that mark a secrets bundle as usable for `--lease` — the provider
+ * tokens crabbox reads to reach a cloud API. Matching a bundle needs only its
+ * declared key NAMES; only the matched key's VALUE is ever injected (see
+ * `crabboxEnv`), so an auto-detected bundle can't leak its other secrets.
+ */
+export const LEASE_PROVIDER_TOKEN_KEYS = ['HCLOUD_TOKEN', 'AWS_ACCESS_KEY_ID', 'DIGITALOCEAN_TOKEN', 'DO_TOKEN'];
+/** The first bundle that declares a provider token key, or undefined. Pure over `bundles`. */
+export function pickLeaseBundleFromList(bundles) {
+    for (const b of bundles) {
+        if (Object.keys(b.vars ?? {}).some((k) => LEASE_PROVIDER_TOKEN_KEYS.includes(k)))
+            return b.name;
+    }
+    return undefined;
+}
+/**
+ * The secrets bundle to feed crabbox, resolved in priority order:
+ *   1. `AGENTS_LEASE_SECRETS_BUNDLE` env var          — explicit, no keychain
+ *   2. `lease.secretsBundle` config (set by `lease setup`) — explicit, no keychain
+ *   3. auto-detect: the first keychain bundle DECLARING a provider token key
+ *
+ * Tiers 1–2 are the frictionless steady state (env + config are plain, no keychain
+ * read). Tier 3 is a fallback that DOES read bundle metadata via `listBundles()`
+ * (one batched keychain unlock, ~7-day broker cache) — so it only runs when
+ * neither env nor config is set, and `crabboxEnv` memoizes the result for the
+ * process (it is called several times per lease, and we don't want a scan each
+ * time). Once `lease setup` persists the choice (tier 2), tier 3 never runs.
+ * Returns undefined when nothing matches — crabbox then falls back to `crabbox login`.
+ */
+export function resolveLeaseBundle() {
+    const env = process.env.AGENTS_LEASE_SECRETS_BUNDLE;
+    if (env)
+        return { name: env };
+    try {
+        const configured = readMeta().lease?.secretsBundle;
+        if (configured && bundleExists(configured))
+            return { name: configured };
+    }
+    catch {
+        /* config unreadable — fall through to auto-detect */
+    }
+    try {
+        const bundles = listBundles();
+        const name = pickLeaseBundleFromList(bundles);
+        if (name) {
+            const b = bundles.find((x) => x.name === name);
+            const keys = LEASE_PROVIDER_TOKEN_KEYS.filter((k) => !!b && k in (b.vars ?? {}));
+            return { name, keys };
+        }
+    }
+    catch {
+        /* secrets unreadable — no auto-detect */
+    }
+    return undefined;
+}
+/** Process-lifetime memo so the tier-3 `listBundles()` scan runs at most once. */
+let leaseBundleMemo;
+function resolveLeaseBundleMemo() {
+    if (!leaseBundleMemo)
+        leaseBundleMemo = { value: resolveLeaseBundle() };
+    return leaseBundleMemo.value;
+}
+/** Persist `lease.secretsBundle` in agents config so `--lease` needs no env var. */
+export function setLeaseSecretsBundle(name) {
+    const meta = readMeta();
+    writeMeta({ ...meta, lease: { ...meta.lease, secretsBundle: name } });
+    leaseBundleMemo = undefined; // invalidate so the next resolve sees the new config
+}
 /** Build the child env for crabbox, injecting a secrets bundle when configured. */
 export function crabboxEnv(opts) {
-    const bundle = opts.secretsBundle ?? process.env.AGENTS_LEASE_SECRETS_BUNDLE;
-    if (!bundle)
+    const resolved = opts.secretsBundle
+        ? { name: opts.secretsBundle }
+        : resolveLeaseBundleMemo();
+    if (!resolved)
         return process.env;
     try {
-        // Reuse the same resolver `agents secrets exec` uses so a keychain-backed
-        // bundle (e.g. hetzner.com → HCLOUD_TOKEN) reaches crabbox without ever
-        // touching disk.
-        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents run --lease (crabbox)' });
+        // Auto-detected bundle → inject ONLY the provider token key(s) (least
+        // privilege; an unrelated bundle can't leak its other secrets into crabbox).
+        // An explicitly-named bundle (env/config or `opts.secretsBundle`) injects
+        // whole — the user chose it. Same resolver `agents secrets exec` uses.
+        const { env } = readAndResolveBundleEnv(resolved.name, {
+            caller: 'agents run --lease (crabbox)',
+            keys: resolved.keys,
+        });
         return { ...process.env, ...env };
     }
     catch (e) {
-        throw new Error(`Could not load secrets bundle "${bundle}" for crabbox: ${e.message}. ` +
-            `Fix the bundle (agents secrets view ${bundle}) or unset lease.secretsBundle to use crabbox's own login.`);
+        throw new Error(`Could not load secrets bundle "${resolved.name}" for crabbox: ${e.message}. ` +
+            `Fix the bundle (agents secrets view ${resolved.name}) or unset lease.secretsBundle to use crabbox's own login.`);
     }
 }
 function normalizeBox(raw) {
@@ -46,6 +121,12 @@ function normalizeBox(raw) {
     const status = String(raw.status ?? '');
     const state = String(labels.state ?? '');
     const publicNet = (raw.public_net ?? {});
+    const num = (v) => {
+        if (v === undefined || v === '')
+            return null;
+        const n = Number(v);
+        return Number.isFinite(n) ? n : null;
+    };
     return {
         name: String(raw.name ?? ''),
         status,
@@ -56,6 +137,11 @@ function normalizeBox(raw) {
         profile: labels.profile,
         class: labels.class,
         ready: status === 'running' && state === 'ready',
+        keep: labels.keep === 'true',
+        createdAt: num(labels.created_at),
+        expiresAt: num(labels.expires_at),
+        lastTouchedAt: num(labels.last_touched_at),
+        idleTimeoutSecs: num(labels.idle_timeout_secs ?? labels.idle_timeout),
     };
 }
 /** All crabbox machines the broker knows about. */
@@ -113,6 +199,24 @@ export async function crabboxWarmup(opts = {}) {
     });
     if (r.status !== 0) {
         const detail = (r.stderr || r.stdout || '').trim();
+        // A provider `server_limit` / `resource_limit_exceeded` 403 means the account's
+        // box quota is full. Turn the raw 403 into an actionable message that names the
+        // reap-safe orphans + the one-command fix, instead of a generic failure.
+        if (/server_limit|resource_limit_exceeded/i.test(detail)) {
+            let hint = ' Stop unused boxes (`crabbox list`) or raise your provider server limit.';
+            try {
+                const orphans = reapSafeOrphans(crabboxList(opts), Math.floor(Date.now() / 1000));
+                if (orphans.length) {
+                    hint =
+                        ` ${orphans.length} expired, idle box(es) are holding the quota — free them with ` +
+                            `\`agents lease gc\` (or \`crabbox stop ${orphans[0].slug}\`).`;
+                }
+            }
+            catch {
+                /* best-effort hint; fall back to the generic guidance above */
+            }
+            throw new Error(`crabbox warmup failed: provider server limit reached.${hint}`);
+        }
         throw new Error(`crabbox warmup failed: ${detail || 'unknown error'}. ` +
             `Check provider access with \`crabbox doctor\`; a missing cloud token often means \`crabbox login\` or a lease.secretsBundle is needed.`);
     }
@@ -229,3 +333,48 @@ export function crabboxStop(slug, opts = {}) {
         return false;
     }
 }
+/** Never reap a box touched within this many seconds, regardless of idle-timeout. */
+export const REAP_MIN_IDLE_SECS = 3600;
+/**
+ * Whether a box is a genuine orphan that is safe to reap.
+ *
+ * Reap-safe ONLY when BOTH hold: the lease has already expired (`expiresAt` in the
+ * past) AND the box has not been touched for a safety window of
+ * `max(2 × idleTimeout, 1h)`. The freshness guard is what makes this safe against
+ * a TOCTOU race: a box a concurrent run just reused (`cbx_acquire_box`) has a
+ * recent `lastTouchedAt` and is never eligible. Reaping by `profile`/`ready` alone
+ * — as `crabbox cleanup` cannot (it skips `keep=true`, which every real orphan is)
+ * — would kill in-use boxes. Boxes with unknown age (`expiresAt`/`lastTouchedAt`
+ * null) are never reaped. `nowSecs` is injected so tests don't wall-clock.
+ */
+export function isReapSafe(box, nowSecs) {
+    if (box.expiresAt === null || box.lastTouchedAt === null)
+        return false;
+    if (box.expiresAt > nowSecs)
+        return false;
+    const window = Math.max((box.idleTimeoutSecs ?? 0) * 2, REAP_MIN_IDLE_SECS);
+    return nowSecs - box.lastTouchedAt >= window;
+}
+/** The reap-safe orphans among `boxes`, most-stale (oldest touch) first. */
+export function reapSafeOrphans(boxes, nowSecs) {
+    return boxes
+        .filter((b) => isReapSafe(b, nowSecs))
+        .sort((a, b) => (a.lastTouchedAt ?? 0) - (b.lastTouchedAt ?? 0));
+}
+/**
+ * List reap-safe orphans and (unless `dryRun`) stop them. Returns the candidates
+ * considered and the slugs actually stopped. Best-effort per box — a stop failure
+ * is skipped, never thrown. Backs `agents lease gc` and the 403 auto-reap opt-in.
+ */
+export function reapOrphans(opts = {}) {
+    const nowSecs = opts.nowSecs ?? Math.floor(Date.now() / 1000);
+    const candidates = reapSafeOrphans(crabboxList(opts), nowSecs);
+    if (opts.dryRun)
+        return { candidates, reaped: [] };
+    const reaped = [];
+    for (const b of candidates) {
+        if (crabboxStop(b.slug, opts))
+            reaped.push(b.slug);
+    }
+    return { candidates, reaped };
+}

package/dist/lib/crabbox/runtimes.d.ts

@@ -47,6 +47,19 @@ export declare function pickRuntimes(detected: DetectedRuntime[], prompt?: (choi
     checked: boolean;
     disabled: boolean | string;
 }[]) => Promise<AgentId[]>): Promise<AgentId[]>;
+/**
+ * The lease runtime to provision for a headless run of `agentName`.
+ *
+ * When the agent is itself a lease-capable runtime (claude/codex/gemini/grok)
+ * that IS the runtime to install. Otherwise fall back to the single signed-in
+ * lease runtime (preferring claude), or null when none is signed in. This is the
+ * non-interactive replacement for the runtime checkbox picker: `--lease` requires
+ * a prompt, so it is headless by contract and must never block on a TTY.
+ *
+ * Profile-dispatch agents (kimi/deepseek) and custom workflow agents that run
+ * under a non-obvious runtime are resolved separately — see RUSH-1725.
+ */
+export declare function inferLeaseRuntime(agentName: string, detected: DetectedRuntime[]): AgentId | null;
 /**
  * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
  * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token

package/dist/lib/crabbox/runtimes.js

@@ -79,6 +79,30 @@ export async function pickRuntimes(detected, prompt) {
     const { checkbox } = await import('@inquirer/prompts');
     return checkbox({ message: 'Provision which runtime(s) on the leased box?', choices });
 }
+/**
+ * The lease runtime to provision for a headless run of `agentName`.
+ *
+ * When the agent is itself a lease-capable runtime (claude/codex/gemini/grok)
+ * that IS the runtime to install. Otherwise fall back to the single signed-in
+ * lease runtime (preferring claude), or null when none is signed in. This is the
+ * non-interactive replacement for the runtime checkbox picker: `--lease` requires
+ * a prompt, so it is headless by contract and must never block on a TTY.
+ *
+ * Profile-dispatch agents (kimi/deepseek) and custom workflow agents that run
+ * under a non-obvious runtime are resolved separately — see RUSH-1725.
+ */
+export function inferLeaseRuntime(agentName, detected) {
+    const signedIn = detected.filter((d) => d.signedIn && d.credPath);
+    // The agent names a lease runtime directly: require that runtime to be signed
+    // in — never silently substitute a different one for an explicit `run <runtime>`
+    // (that would lease a billable box only to boot it "Not logged in"). Not signed
+    // in → null, so the caller exits with "sign into it locally first".
+    if (LEASE_RUNTIMES.some((c) => c.id === agentName)) {
+        return signedIn.find((d) => d.id === agentName)?.id ?? null;
+    }
+    // Custom/workflow agent: fall back to the signed-in runtime (preferring claude).
+    return signedIn.find((d) => d.id === 'claude')?.id ?? signedIn[0]?.id ?? null;
+}
 // A long random sentinel makes an accidental (or malicious) collision with a
 // token's contents effectively impossible, so the quoted heredoc can never be
 // closed early by the credential body.

package/dist/lib/daemon.js

@@ -329,7 +329,12 @@ export async function runDaemon() {
         log('WARN', `Secrets broker host skipped: ${err.message}`);
     }
     const scheduler = new JobScheduler(async (config) => {
-        log('INFO', `Triggering job '${config.name}' (agent: ${config.agent})`);
+        const jobLabel = config.command
+            ? 'command'
+            : config.workflow
+                ? `workflow: ${config.workflow}`
+                : `agent: ${config.agent}`;
+        log('INFO', `Triggering job '${config.name}' (${jobLabel})`);
         try {
             const meta = await executeJobDetached(config);
             log('INFO', `Job '${config.name}' spawned (run: ${meta.runId}, PID: ${meta.pid})`);
@@ -419,6 +424,8 @@ export async function runDaemon() {
                 log('INFO', `sessions sync: pushed ${r.pushed}, pulled ${r.pulled}, merged ${r.merged}` +
                     (r.errors.length ? `, ${r.errors.length} error(s): ${r.errors[0]}` : ''));
             }
+            if (r.warnings.length)
+                log('WARN', `sessions sync: ${r.warnings[0]}`);
         }
         catch (err) {
             log('ERROR', `sessions sync failed: ${err.message}`);

package/dist/lib/devices/fleet.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Fleet-wide device operations — pick online targets and run a command on each.
+ *
+ * Used by `agents fleet update` / `agents fleet run` (aliases of the same
+ * subcommands under `agents devices`). Offline devices are skipped with a
+ * reason so a single dead node never blocks the rest of the rollout. Per-device
+ * throws (misconfigured auth, etc.) become `failed` rows — they never abort
+ * the remaining devices.
+ */
+import type { DeviceProfile, DeviceRegistry } from './registry.js';
+export type FleetSkipReason = 'offline' | 'no-address';
+/** npm dist-tags / semver pins only — rejects shell metacharacters. */
+export declare const FLEET_VERSION_RE: RegExp;
+export interface FleetTarget {
+    device: DeviceProfile;
+    /** When set, this device is not reached (skip with reason). */
+    skip?: FleetSkipReason;
+}
+export interface FleetRunResult {
+    name: string;
+    status: 'ok' | 'failed' | 'skipped';
+    code: number | null;
+    reason?: FleetSkipReason | string;
+    /** Truncated combined stderr/stdout for failures. */
+    detail?: string;
+}
+/**
+ * Classify each registered device for a fleet operation.
+ *
+ * - Tailscale-offline → skip `offline`
+ * - No address → skip `no-address`
+ * - Everything else is a target (including this machine, reached over ssh when
+ *   it has a registry address — same path as any other box).
+ */
+export declare function planFleetTargets(reg: DeviceRegistry): FleetTarget[];
+/** Human label for a skip reason. */
+export declare function skipLabel(reason: FleetSkipReason): string;
+/**
+ * Run `cmd` on one device via the same ssh path as `agents ssh <name> …`.
+ * Captures stdout/stderr (not inherited) so the fleet table can summarize.
+ * Throws from buildSshInvocation are returned as a non-zero result so a single
+ * misconfigured device cannot abort the fleet loop.
+ */
+export declare function runOnDevice(device: DeviceProfile, cmd: string[], opts?: {
+    timeoutMs?: number;
+}): {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Build `agents upgrade --yes` argv, optionally pinned to a version/dist-tag.
+ * Rejects anything that is not a plain npm version/tag token so a version pin
+ * cannot inject shell metacharacters into the remote command line.
+ */
+export declare function upgradeCommand(version?: string): string[];
+/**
+ * Execute a command across planned targets. Pure orchestration over
+ * {@link runOnDevice}; testable by injecting `runner`. Per-device throws from
+ * the runner are recorded as `failed` so one bad device never aborts the rest.
+ */
+export declare function runFleet(targets: FleetTarget[], cmd: string[], runner?: typeof runOnDevice): FleetRunResult[];

package/dist/lib/devices/fleet.js

@@ -0,0 +1,128 @@
+/**
+ * Fleet-wide device operations — pick online targets and run a command on each.
+ *
+ * Used by `agents fleet update` / `agents fleet run` (aliases of the same
+ * subcommands under `agents devices`). Offline devices are skipped with a
+ * reason so a single dead node never blocks the rest of the rollout. Per-device
+ * throws (misconfigured auth, etc.) become `failed` rows — they never abort
+ * the remaining devices.
+ */
+import { spawnSync } from 'child_process';
+import { buildSshInvocation, sshTargetFor, writeAskpassShim } from './connect.js';
+/** npm dist-tags / semver pins only — rejects shell metacharacters. */
+export const FLEET_VERSION_RE = /^[A-Za-z0-9._-]+$/;
+/**
+ * Classify each registered device for a fleet operation.
+ *
+ * - Tailscale-offline → skip `offline`
+ * - No address → skip `no-address`
+ * - Everything else is a target (including this machine, reached over ssh when
+ *   it has a registry address — same path as any other box).
+ */
+export function planFleetTargets(reg) {
+    const names = Object.keys(reg).sort();
+    return names.map((name) => {
+        const device = reg[name];
+        if (device.tailscale && !device.tailscale.online) {
+            return { device, skip: 'offline' };
+        }
+        try {
+            sshTargetFor(device);
+        }
+        catch {
+            return { device, skip: 'no-address' };
+        }
+        return { device };
+    });
+}
+/** Human label for a skip reason. */
+export function skipLabel(reason) {
+    switch (reason) {
+        case 'offline':
+            return 'offline';
+        case 'no-address':
+            return 'no address';
+    }
+}
+/**
+ * Run `cmd` on one device via the same ssh path as `agents ssh <name> …`.
+ * Captures stdout/stderr (not inherited) so the fleet table can summarize.
+ * Throws from buildSshInvocation are returned as a non-zero result so a single
+ * misconfigured device cannot abort the fleet loop.
+ */
+export function runOnDevice(device, cmd, opts = {}) {
+    try {
+        const shim = writeAskpassShim();
+        const { args, env } = buildSshInvocation(device, cmd, shim);
+        const res = spawnSync('ssh', args, {
+            encoding: 'utf-8',
+            env: { ...process.env, ...env },
+            timeout: opts.timeoutMs ?? 600_000,
+        });
+        return {
+            code: res.status,
+            stdout: res.stdout?.toString() ?? '',
+            stderr: (res.stderr?.toString() ?? '') + (res.error ? String(res.error.message) : ''),
+        };
+    }
+    catch (err) {
+        return {
+            code: 1,
+            stdout: '',
+            stderr: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+/**
+ * Build `agents upgrade --yes` argv, optionally pinned to a version/dist-tag.
+ * Rejects anything that is not a plain npm version/tag token so a version pin
+ * cannot inject shell metacharacters into the remote command line.
+ */
+export function upgradeCommand(version) {
+    if (version !== undefined && version !== '') {
+        if (!FLEET_VERSION_RE.test(version)) {
+            throw new Error(`Invalid version '${version}'. Use a semver or dist-tag (letters, digits, . _ - only).`);
+        }
+        return ['agents', 'upgrade', version, '--yes'];
+    }
+    return ['agents', 'upgrade', '--yes'];
+}
+/**
+ * Execute a command across planned targets. Pure orchestration over
+ * {@link runOnDevice}; testable by injecting `runner`. Per-device throws from
+ * the runner are recorded as `failed` so one bad device never aborts the rest.
+ */
+export function runFleet(targets, cmd, runner = runOnDevice) {
+    const results = [];
+    for (const t of targets) {
+        if (t.skip) {
+            results.push({
+                name: t.device.name,
+                status: 'skipped',
+                code: null,
+                reason: t.skip,
+            });
+            continue;
+        }
+        try {
+            const res = runner(t.device, cmd);
+            const ok = res.code === 0;
+            const detail = (res.stderr || res.stdout).trim().slice(0, 200);
+            results.push({
+                name: t.device.name,
+                status: ok ? 'ok' : 'failed',
+                code: res.code,
+                detail: ok ? undefined : detail || undefined,
+            });
+        }
+        catch (err) {
+            results.push({
+                name: t.device.name,
+                status: 'failed',
+                code: 1,
+                detail: (err instanceof Error ? err.message : String(err)).slice(0, 200),
+            });
+        }
+    }
+    return results;
+}

package/dist/lib/devices/health.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Device resource probing for `agents devices list`.
+ *
+ * One SSH round-trip per device gathers load average, memory pressure, and core
+ * count (mac + linux), parsed into a {@link DeviceStats}. Probes run in parallel
+ * with a bounded timeout so the list stays responsive — a slow or hung box
+ * degrades to "no stats" instead of blocking the whole table.
+ *
+ * The parsers are pure and unit-tested (health.test.ts). They mirror the ones in
+ * the Factory extension (apps/factory/src/core/deviceHealth.ts) — kept as a
+ * separate copy on purpose: the CLI does not import across packages.
+ */
+import type { DeviceProfile } from './registry.js';
+/** Default per-device probe budget. Short enough that the list never hangs on a
+ * wedged box, long enough for a cold relayed SSH handshake. */
+export declare const PROBE_TIMEOUT_MS = 2500;
+export interface DeviceStats {
+    host: string;
+    reachable: boolean;
+    loadAvg1?: number;
+    ncpu?: number;
+    /** loadAvg1 / ncpu * 100 — load normalized to core count (the "has room" number). */
+    loadPercent?: number;
+    memPercent?: number;
+    memTotalBytes?: number;
+    memFreeBytes?: number;
+    fetchedAt: number;
+}
+/** Compact human byte size: 512M, 64G, 1.5T (binary units, ≤1 decimal). */
+export declare function fmtBytes(bytes: number | undefined): string;
+export declare function parseUptime(out: string): {
+    loadAvg1?: number;
+};
+interface MemStats {
+    memPercent?: number;
+    memTotalBytes?: number;
+    memFreeBytes?: number;
+}
+export declare function parseVmStat(out: string): MemStats;
+export declare function parseLinuxMemInfo(out: string): MemStats;
+export declare function parseNcpu(out: string): {
+    ncpu?: number;
+};
+/** Assemble a DeviceStats from the three snippet sections. */
+export declare function parseProbeOutput(host: string, stdout: string, fetchedAt: number): DeviceStats;
+export interface FleetCapacity {
+    reachable: number;
+    cores: number;
+    memTotalBytes: number;
+    memFreeBytes: number;
+}
+/** Sum cores and memory across reachable devices for the summary footer. */
+export declare function fleetCapacity(statsList: Iterable<DeviceStats>): FleetCapacity;
+/** Headroom bucket from the worst of normalized-load and memory. */
+export type Headroom = 'idle' | 'light' | 'busy' | 'loaded' | 'unknown';
+export declare function headroom(stats: DeviceStats | undefined): Headroom;
+/** Probe one device over the same ssh path as `agents ssh <name>`. Never throws;
+ * an unreachable/slow/misconfigured device resolves to `reachable: false`. */
+export declare function probeDeviceStats(device: DeviceProfile, opts?: {
+    timeoutMs?: number;
+    now?: number;
+}): Promise<DeviceStats>;
+/** Probe the local machine directly (no ssh round-trip) — used for the "this
+ * machine" row so it always shows real numbers even if it isn't ssh-reachable
+ * from itself. */
+export declare function probeLocalStats(host: string, opts?: {
+    timeoutMs?: number;
+    now?: number;
+}): Promise<DeviceStats>;
+/** Probe many devices concurrently; returns a name→stats map. Bounded by the
+ * per-probe timeout, so total wall time ≈ the slowest single probe. The device
+ * named `selfName` is probed locally instead of over ssh. */
+export declare function probeFleetStats(devices: DeviceProfile[], opts?: {
+    timeoutMs?: number;
+    selfName?: string;
+}): Promise<Map<string, DeviceStats>>;
+export {};