@phnx-labs/agents-cli 1.20.63 → 1.20.65

package/dist/lib/cloud/registry.js

@@ -11,6 +11,7 @@ import { RushCloudProvider } from './rush.js';
 import { CodexCloudProvider } from './codex.js';
 import { FactoryCloudProvider } from './factory.js';
 import { AntigravityCloudProvider } from './antigravity.js';
+import { HostCloudProvider } from './host.js';
 import { getUserAgentsDir } from '../state.js';
 import { AGENTS } from '../agents.js';
 const META_FILE = path.join(getUserAgentsDir(), 'agents.yaml');
@@ -43,6 +44,9 @@ function initProviders() {
     providers.set('codex', new CodexCloudProvider(config.providers?.codex));
     providers.set('factory', new FactoryCloudProvider(config.providers?.factory));
     providers.set('antigravity', new AntigravityCloudProvider(config.providers?.antigravity));
+    // Your own machines (agents hosts / agents devices) over SSH. No agent
+    // auto-routes here — it's always an explicit --provider host / --host choice.
+    providers.set('host', new HostCloudProvider());
 }
 /**
  * The cloud provider an agent dispatches to by default. Reads the canonical

package/dist/lib/cloud/types.d.ts

@@ -9,16 +9,18 @@ import type { JobTrigger } from '../routines.js';
 /**
  * Identifier for a supported cloud dispatch backend.
  *
- * Each id is one agent's *own* cloud:
+ * Each id is one agent's *own* cloud — plus your own machines:
  *   - `rush`        — Rush Cloud (runs Claude against a GitHub repo → PR)
  *   - `codex`       — OpenAI Codex Cloud (`codex cloud exec`)
  *   - `factory`     — Factory Droid Computers (`droid computer ssh` + remote `droid exec`)
  *   - `antigravity` — Google Gemini Managed Agents (Interactions API)
+ *   - `host`        — a machine you own (`agents hosts` / `agents devices`), over SSH
  *
  * Agents route to their native cloud automatically (see `cloudProvider` in the
- * agent registry); `--provider` overrides.
+ * agent registry); `--provider` overrides. Nothing auto-routes to `host` — it
+ * is always an explicit `--provider host` (or `--host <name>`) choice.
  */
-export type CloudProviderId = 'rush' | 'codex' | 'factory' | 'antigravity';
+export type CloudProviderId = 'rush' | 'codex' | 'factory' | 'antigravity' | 'host';
 /**
  * Lifecycle state of a cloud-dispatched task.
  *
@@ -219,7 +221,7 @@ export interface CloudTarget {
     kind: TargetKind;
 }
 /** Which dispatch option a provider's pre-provisioned target maps to. */
-export type TargetKind = 'env' | 'computer';
+export type TargetKind = 'env' | 'computer' | 'host';
 /**
  * Thrown by a provider's `dispatch()` when it needs a pre-provisioned target
  * (Codex env / Factory computer) and none was supplied. The CLI catches this

package/dist/lib/comms-render.d.ts

@@ -0,0 +1,37 @@
+import type { CommsMsg } from './mailbox.js';
+export type { CommsMsg } from './mailbox.js';
+export declare const GLYPH: {
+    readonly live: "●";
+    readonly idle: "○";
+    readonly ask: "▲";
+    readonly delivered: "✓";
+    readonly pending: "⏳";
+    readonly route: "→";
+    readonly stream: "─→";
+    readonly thread: "⇄";
+};
+export type Accent = 'cyan' | 'amber';
+/** Render the shared one-line comms header, with `right` aligned to the terminal edge. */
+export declare function masthead(o: {
+    title: string;
+    host: string;
+    accent: Accent;
+    right?: string;
+    stats?: string[];
+}): string;
+/** Normalize non-negative counts across the eight Unicode sparkline levels. */
+export declare function sparkline(counts: number[]): string;
+/** Flatten mailbox histories into one newest-first communication stream. */
+export declare function aggregate(boxes: {
+    id: string;
+    label: string;
+    messages: import('./mailbox.js').StoredMessage[];
+}[]): CommsMsg[];
+/** Count messages in rolling one-hour buckets, ordered oldest to newest. */
+export declare function hourlyCounts(msgs: CommsMsg[], hours: number, now?: Date): number[];
+/** Aggregate the human-readable sender-to-recipient routes, busiest first. */
+export declare function graphEdges(msgs: CommsMsg[]): {
+    from: string;
+    to: string;
+    count: number;
+}[];

package/dist/lib/comms-render.js

@@ -0,0 +1,89 @@
+import chalk from 'chalk';
+import { stringWidth, terminalWidth } from './session/width.js';
+export const GLYPH = {
+    live: '●',
+    idle: '○',
+    ask: '▲',
+    delivered: '✓',
+    pending: '⏳',
+    route: '→',
+    stream: '─→',
+    thread: '⇄',
+};
+/** Render the shared one-line comms header, with `right` aligned to the terminal edge. */
+export function masthead(o) {
+    const accent = o.accent === 'cyan' ? chalk.cyan : chalk.yellow;
+    const title = `${accent('⌁')} ${chalk.bold(accent(o.title))}`;
+    const host = chalk.dim(` · ${o.host}`);
+    const stats = o.stats?.length ? `   ${o.stats.join(chalk.dim(' · '))}` : '';
+    const left = `${title}${host}${stats}`;
+    if (!o.right)
+        return left;
+    const right = chalk.dim(o.right);
+    const gap = Math.max(1, terminalWidth() - stringWidth(left) - stringWidth(right));
+    return `${left}${' '.repeat(gap)}${right}`;
+}
+const SPARK_LEVELS = '▁▂▃▄▅▆▇█';
+/** Normalize non-negative counts across the eight Unicode sparkline levels. */
+export function sparkline(counts) {
+    if (counts.length === 0)
+        return ' ';
+    const normalized = counts.map((count) => Number.isFinite(count) ? Math.max(0, count) : 0);
+    const max = Math.max(...normalized);
+    if (max === 0)
+        return ' '.repeat(counts.length);
+    return normalized
+        .map((count) => SPARK_LEVELS[Math.round((count / max) * (SPARK_LEVELS.length - 1))])
+        .join('');
+}
+/** Flatten mailbox histories into one newest-first communication stream. */
+export function aggregate(boxes) {
+    return boxes
+        .flatMap((box) => {
+        const toLabel = box.label || box.id.slice(0, 8);
+        return box.messages.map((message) => ({
+            from: message.from || 'operator',
+            to: message.to,
+            toLabel,
+            ts: message.ts,
+            text: message.text,
+            state: message.state,
+            box: box.id,
+        }));
+    })
+        .sort((a, b) => compareText(b.ts, a.ts));
+}
+const HOUR_MS = 60 * 60 * 1_000;
+/** Count messages in rolling one-hour buckets, ordered oldest to newest. */
+export function hourlyCounts(msgs, hours, now = new Date()) {
+    const bucketCount = Number.isFinite(hours) ? Math.max(0, Math.floor(hours)) : 0;
+    const counts = Array.from({ length: bucketCount }, () => 0);
+    const nowMs = now.getTime();
+    if (bucketCount === 0 || !Number.isFinite(nowMs))
+        return counts;
+    for (const message of msgs) {
+        const timestamp = Date.parse(message.ts);
+        const age = nowMs - timestamp;
+        if (!Number.isFinite(timestamp) || age < 0 || age >= bucketCount * HOUR_MS)
+            continue;
+        const bucket = bucketCount - 1 - Math.floor(age / HOUR_MS);
+        counts[bucket]++;
+    }
+    return counts;
+}
+/** Aggregate the human-readable sender-to-recipient routes, busiest first. */
+export function graphEdges(msgs) {
+    const edges = new Map();
+    for (const message of msgs) {
+        const key = JSON.stringify([message.from, message.toLabel]);
+        const existing = edges.get(key);
+        if (existing)
+            existing.count++;
+        else
+            edges.set(key, { from: message.from, to: message.toLabel, count: 1 });
+    }
+    return [...edges.values()].sort((a, b) => b.count - a.count || compareText(a.from, b.from) || compareText(a.to, b.to));
+}
+function compareText(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}

package/dist/lib/computer-rpc.js

@@ -341,7 +341,9 @@ class TcpClient extends BaseClient {
             this.failPending('helper_exited', 'tcp connection closed before reply');
         });
         // Kick off the auth handshake synchronously so its frame (id 1) is the
-        // first thing written. No token → daemon is open (tunnel-gated).
+        // first thing written. The Windows daemon now REQUIRES a token (it refuses to
+        // start without one); a null token here means no auth frame is sent, the
+        // daemon drops the connection, and the caller is told to re-run `setup`.
         this.authReady = token ? this.authenticate(token) : Promise.resolve();
     }
     async authenticate(token) {

package/dist/lib/crabbox/cli.d.ts

@@ -11,6 +11,7 @@
  * needs a provider token (e.g. HCLOUD_TOKEN) in the environment. We inject it
  * from a secrets bundle when one is configured (see `crabboxEnv`).
  */
+import { type SecretsBundle } from '../secrets/bundles.js';
 /** A crabbox machine as reported by `crabbox list --json`. */
 export interface CrabboxBox {
     /** Provider machine name, e.g. `crabbox-blue-hermit-1039689b`. */
@@ -29,6 +30,16 @@ export interface CrabboxBox {
     class?: string;
     /** True when running + bootstrap-complete. */
     ready: boolean;
+    /** crabbox `keep` label — a kept box survives `crabbox cleanup` past its TTL. */
+    keep: boolean;
+    /** Unix seconds the box was created, or null when the label is absent. */
+    createdAt: number | null;
+    /** Unix seconds the lease expires, or null. */
+    expiresAt: number | null;
+    /** Unix seconds the box was last touched (reused / run against), or null. */
+    lastTouchedAt: number | null;
+    /** Idle-timeout window in seconds, or null. */
+    idleTimeoutSecs: number | null;
 }
 export interface CrabboxOptions {
     /**
@@ -41,6 +52,38 @@ export interface CrabboxOptions {
 }
 /** Locate the crabbox binary, or throw an actionable error. */
 export declare function findCrabbox(): string;
+/**
+ * Env keys that mark a secrets bundle as usable for `--lease` — the provider
+ * tokens crabbox reads to reach a cloud API. Matching a bundle needs only its
+ * declared key NAMES; only the matched key's VALUE is ever injected (see
+ * `crabboxEnv`), so an auto-detected bundle can't leak its other secrets.
+ */
+export declare const LEASE_PROVIDER_TOKEN_KEYS: string[];
+/** The first bundle that declares a provider token key, or undefined. Pure over `bundles`. */
+export declare function pickLeaseBundleFromList(bundles: SecretsBundle[]): string | undefined;
+/** A resolved lease bundle: its name, plus (auto-detect only) the exact keys to inject. */
+export interface ResolvedLeaseBundle {
+    name: string;
+    /** When set (auto-detect), inject ONLY these keys — not the whole bundle. */
+    keys?: string[];
+}
+/**
+ * The secrets bundle to feed crabbox, resolved in priority order:
+ *   1. `AGENTS_LEASE_SECRETS_BUNDLE` env var          — explicit, no keychain
+ *   2. `lease.secretsBundle` config (set by `lease setup`) — explicit, no keychain
+ *   3. auto-detect: the first keychain bundle DECLARING a provider token key
+ *
+ * Tiers 1–2 are the frictionless steady state (env + config are plain, no keychain
+ * read). Tier 3 is a fallback that DOES read bundle metadata via `listBundles()`
+ * (one batched keychain unlock, ~7-day broker cache) — so it only runs when
+ * neither env nor config is set, and `crabboxEnv` memoizes the result for the
+ * process (it is called several times per lease, and we don't want a scan each
+ * time). Once `lease setup` persists the choice (tier 2), tier 3 never runs.
+ * Returns undefined when nothing matches — crabbox then falls back to `crabbox login`.
+ */
+export declare function resolveLeaseBundle(): ResolvedLeaseBundle | undefined;
+/** Persist `lease.secretsBundle` in agents config so `--lease` needs no env var. */
+export declare function setLeaseSecretsBundle(name: string): void;
 /** Build the child env for crabbox, injecting a secrets bundle when configured. */
 export declare function crabboxEnv(opts: CrabboxOptions): NodeJS.ProcessEnv;
 /** All crabbox machines the broker knows about. */
@@ -96,3 +139,32 @@ export declare function crabboxRun(slug: string, remoteCmd: string, opts?: Crabb
 export declare function crabboxRunScript(slug: string, script: string, opts?: CrabboxRunOptions): Promise<number | null>;
 /** Release the lease / delete the box. Best-effort; never throws. */
 export declare function crabboxStop(slug: string, opts?: CrabboxOptions): boolean;
+/** Never reap a box touched within this many seconds, regardless of idle-timeout. */
+export declare const REAP_MIN_IDLE_SECS = 3600;
+/**
+ * Whether a box is a genuine orphan that is safe to reap.
+ *
+ * Reap-safe ONLY when BOTH hold: the lease has already expired (`expiresAt` in the
+ * past) AND the box has not been touched for a safety window of
+ * `max(2 × idleTimeout, 1h)`. The freshness guard is what makes this safe against
+ * a TOCTOU race: a box a concurrent run just reused (`cbx_acquire_box`) has a
+ * recent `lastTouchedAt` and is never eligible. Reaping by `profile`/`ready` alone
+ * — as `crabbox cleanup` cannot (it skips `keep=true`, which every real orphan is)
+ * — would kill in-use boxes. Boxes with unknown age (`expiresAt`/`lastTouchedAt`
+ * null) are never reaped. `nowSecs` is injected so tests don't wall-clock.
+ */
+export declare function isReapSafe(box: CrabboxBox, nowSecs: number): boolean;
+/** The reap-safe orphans among `boxes`, most-stale (oldest touch) first. */
+export declare function reapSafeOrphans(boxes: CrabboxBox[], nowSecs: number): CrabboxBox[];
+/**
+ * List reap-safe orphans and (unless `dryRun`) stop them. Returns the candidates
+ * considered and the slugs actually stopped. Best-effort per box — a stop failure
+ * is skipped, never thrown. Backs `agents lease gc` and the 403 auto-reap opt-in.
+ */
+export declare function reapOrphans(opts?: CrabboxOptions & {
+    nowSecs?: number;
+    dryRun?: boolean;
+}): {
+    candidates: CrabboxBox[];
+    reaped: string[];
+};

package/dist/lib/crabbox/cli.js

@@ -12,7 +12,8 @@
  * from a secrets bundle when one is configured (see `crabboxEnv`).
  */
 import { spawn, spawnSync } from 'child_process';
-import { readAndResolveBundleEnv } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv, isHeadlessSecretsContext, listBundles, bundleExists } from '../secrets/bundles.js';
+import { readMeta, writeMeta } from '../state.js';
 /** Locate the crabbox binary, or throw an actionable error. */
 export function findCrabbox() {
     const r = spawnSync('crabbox', ['--help'], { encoding: 'utf-8' });
@@ -21,21 +22,99 @@ export function findCrabbox() {
     }
     return 'crabbox';
 }
+/**
+ * Env keys that mark a secrets bundle as usable for `--lease` — the provider
+ * tokens crabbox reads to reach a cloud API. Matching a bundle needs only its
+ * declared key NAMES; only the matched key's VALUE is ever injected (see
+ * `crabboxEnv`), so an auto-detected bundle can't leak its other secrets.
+ */
+export const LEASE_PROVIDER_TOKEN_KEYS = ['HCLOUD_TOKEN', 'AWS_ACCESS_KEY_ID', 'DIGITALOCEAN_TOKEN', 'DO_TOKEN'];
+/** The first bundle that declares a provider token key, or undefined. Pure over `bundles`. */
+export function pickLeaseBundleFromList(bundles) {
+    for (const b of bundles) {
+        if (Object.keys(b.vars ?? {}).some((k) => LEASE_PROVIDER_TOKEN_KEYS.includes(k)))
+            return b.name;
+    }
+    return undefined;
+}
+/**
+ * The secrets bundle to feed crabbox, resolved in priority order:
+ *   1. `AGENTS_LEASE_SECRETS_BUNDLE` env var          — explicit, no keychain
+ *   2. `lease.secretsBundle` config (set by `lease setup`) — explicit, no keychain
+ *   3. auto-detect: the first keychain bundle DECLARING a provider token key
+ *
+ * Tiers 1–2 are the frictionless steady state (env + config are plain, no keychain
+ * read). Tier 3 is a fallback that DOES read bundle metadata via `listBundles()`
+ * (one batched keychain unlock, ~7-day broker cache) — so it only runs when
+ * neither env nor config is set, and `crabboxEnv` memoizes the result for the
+ * process (it is called several times per lease, and we don't want a scan each
+ * time). Once `lease setup` persists the choice (tier 2), tier 3 never runs.
+ * Returns undefined when nothing matches — crabbox then falls back to `crabbox login`.
+ */
+export function resolveLeaseBundle() {
+    const env = process.env.AGENTS_LEASE_SECRETS_BUNDLE;
+    if (env)
+        return { name: env };
+    try {
+        const configured = readMeta().lease?.secretsBundle;
+        if (configured && bundleExists(configured))
+            return { name: configured };
+    }
+    catch {
+        /* config unreadable — fall through to auto-detect */
+    }
+    try {
+        const bundles = listBundles();
+        const name = pickLeaseBundleFromList(bundles);
+        if (name) {
+            const b = bundles.find((x) => x.name === name);
+            const keys = LEASE_PROVIDER_TOKEN_KEYS.filter((k) => !!b && k in (b.vars ?? {}));
+            return { name, keys };
+        }
+    }
+    catch {
+        /* secrets unreadable — no auto-detect */
+    }
+    return undefined;
+}
+/** Process-lifetime memo so the tier-3 `listBundles()` scan runs at most once. */
+let leaseBundleMemo;
+function resolveLeaseBundleMemo() {
+    if (!leaseBundleMemo)
+        leaseBundleMemo = { value: resolveLeaseBundle() };
+    return leaseBundleMemo.value;
+}
+/** Persist `lease.secretsBundle` in agents config so `--lease` needs no env var. */
+export function setLeaseSecretsBundle(name) {
+    const meta = readMeta();
+    writeMeta({ ...meta, lease: { ...meta.lease, secretsBundle: name } });
+    leaseBundleMemo = undefined; // invalidate so the next resolve sees the new config
+}
 /** Build the child env for crabbox, injecting a secrets bundle when configured. */
 export function crabboxEnv(opts) {
-    const bundle = opts.secretsBundle ?? process.env.AGENTS_LEASE_SECRETS_BUNDLE;
-    if (!bundle)
+    const resolved = opts.secretsBundle
+        ? { name: opts.secretsBundle }
+        : resolveLeaseBundleMemo();
+    if (!resolved)
         return process.env;
     try {
-        // Reuse the same resolver `agents secrets exec` uses so a keychain-backed
-        // bundle (e.g. hetzner.com → HCLOUD_TOKEN) reaches crabbox without ever
-        // touching disk.
-        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents run --lease (crabbox)' });
+        // Auto-detected bundle → inject ONLY the provider token key(s) (least
+        // privilege; an unrelated bundle can't leak its other secrets into crabbox).
+        // An explicitly-named bundle (env/config or `opts.secretsBundle`) injects
+        // whole — the user chose it. Same resolver `agents secrets exec` uses.
+        const { env } = readAndResolveBundleEnv(resolved.name, {
+            caller: 'agents run --lease (crabbox)',
+            keys: resolved.keys,
+            // --lease is headless by contract and crabboxEnv is called several times
+            // per run (list/wait/spawn/stop) — resolve broker-only so a keychain bundle
+            // can't pop repeated unwatched Touch ID sheets mid-lease.
+            agentOnly: isHeadlessSecretsContext(),
+        });
         return { ...process.env, ...env };
     }
     catch (e) {
-        throw new Error(`Could not load secrets bundle "${bundle}" for crabbox: ${e.message}. ` +
-            `Fix the bundle (agents secrets view ${bundle}) or unset lease.secretsBundle to use crabbox's own login.`);
+        throw new Error(`Could not load secrets bundle "${resolved.name}" for crabbox: ${e.message}. ` +
+            `Fix the bundle (agents secrets view ${resolved.name}) or unset lease.secretsBundle to use crabbox's own login.`);
     }
 }
 function normalizeBox(raw) {
@@ -46,6 +125,12 @@ function normalizeBox(raw) {
     const status = String(raw.status ?? '');
     const state = String(labels.state ?? '');
     const publicNet = (raw.public_net ?? {});
+    const num = (v) => {
+        if (v === undefined || v === '')
+            return null;
+        const n = Number(v);
+        return Number.isFinite(n) ? n : null;
+    };
     return {
         name: String(raw.name ?? ''),
         status,
@@ -56,6 +141,11 @@ function normalizeBox(raw) {
         profile: labels.profile,
         class: labels.class,
         ready: status === 'running' && state === 'ready',
+        keep: labels.keep === 'true',
+        createdAt: num(labels.created_at),
+        expiresAt: num(labels.expires_at),
+        lastTouchedAt: num(labels.last_touched_at),
+        idleTimeoutSecs: num(labels.idle_timeout_secs ?? labels.idle_timeout),
     };
 }
 /** All crabbox machines the broker knows about. */
@@ -113,6 +203,24 @@ export async function crabboxWarmup(opts = {}) {
     });
     if (r.status !== 0) {
         const detail = (r.stderr || r.stdout || '').trim();
+        // A provider `server_limit` / `resource_limit_exceeded` 403 means the account's
+        // box quota is full. Turn the raw 403 into an actionable message that names the
+        // reap-safe orphans + the one-command fix, instead of a generic failure.
+        if (/server_limit|resource_limit_exceeded/i.test(detail)) {
+            let hint = ' Stop unused boxes (`crabbox list`) or raise your provider server limit.';
+            try {
+                const orphans = reapSafeOrphans(crabboxList(opts), Math.floor(Date.now() / 1000));
+                if (orphans.length) {
+                    hint =
+                        ` ${orphans.length} expired, idle box(es) are holding the quota — free them with ` +
+                            `\`agents lease gc\` (or \`crabbox stop ${orphans[0].slug}\`).`;
+                }
+            }
+            catch {
+                /* best-effort hint; fall back to the generic guidance above */
+            }
+            throw new Error(`crabbox warmup failed: provider server limit reached.${hint}`);
+        }
         throw new Error(`crabbox warmup failed: ${detail || 'unknown error'}. ` +
             `Check provider access with \`crabbox doctor\`; a missing cloud token often means \`crabbox login\` or a lease.secretsBundle is needed.`);
     }
@@ -229,3 +337,48 @@ export function crabboxStop(slug, opts = {}) {
         return false;
     }
 }
+/** Never reap a box touched within this many seconds, regardless of idle-timeout. */
+export const REAP_MIN_IDLE_SECS = 3600;
+/**
+ * Whether a box is a genuine orphan that is safe to reap.
+ *
+ * Reap-safe ONLY when BOTH hold: the lease has already expired (`expiresAt` in the
+ * past) AND the box has not been touched for a safety window of
+ * `max(2 × idleTimeout, 1h)`. The freshness guard is what makes this safe against
+ * a TOCTOU race: a box a concurrent run just reused (`cbx_acquire_box`) has a
+ * recent `lastTouchedAt` and is never eligible. Reaping by `profile`/`ready` alone
+ * — as `crabbox cleanup` cannot (it skips `keep=true`, which every real orphan is)
+ * — would kill in-use boxes. Boxes with unknown age (`expiresAt`/`lastTouchedAt`
+ * null) are never reaped. `nowSecs` is injected so tests don't wall-clock.
+ */
+export function isReapSafe(box, nowSecs) {
+    if (box.expiresAt === null || box.lastTouchedAt === null)
+        return false;
+    if (box.expiresAt > nowSecs)
+        return false;
+    const window = Math.max((box.idleTimeoutSecs ?? 0) * 2, REAP_MIN_IDLE_SECS);
+    return nowSecs - box.lastTouchedAt >= window;
+}
+/** The reap-safe orphans among `boxes`, most-stale (oldest touch) first. */
+export function reapSafeOrphans(boxes, nowSecs) {
+    return boxes
+        .filter((b) => isReapSafe(b, nowSecs))
+        .sort((a, b) => (a.lastTouchedAt ?? 0) - (b.lastTouchedAt ?? 0));
+}
+/**
+ * List reap-safe orphans and (unless `dryRun`) stop them. Returns the candidates
+ * considered and the slugs actually stopped. Best-effort per box — a stop failure
+ * is skipped, never thrown. Backs `agents lease gc` and the 403 auto-reap opt-in.
+ */
+export function reapOrphans(opts = {}) {
+    const nowSecs = opts.nowSecs ?? Math.floor(Date.now() / 1000);
+    const candidates = reapSafeOrphans(crabboxList(opts), nowSecs);
+    if (opts.dryRun)
+        return { candidates, reaped: [] };
+    const reaped = [];
+    for (const b of candidates) {
+        if (crabboxStop(b.slug, opts))
+            reaped.push(b.slug);
+    }
+    return { candidates, reaped };
+}

package/dist/lib/crabbox/runtimes.d.ts

@@ -47,6 +47,19 @@ export declare function pickRuntimes(detected: DetectedRuntime[], prompt?: (choi
     checked: boolean;
     disabled: boolean | string;
 }[]) => Promise<AgentId[]>): Promise<AgentId[]>;
+/**
+ * The lease runtime to provision for a headless run of `agentName`.
+ *
+ * When the agent is itself a lease-capable runtime (claude/codex/gemini/grok)
+ * that IS the runtime to install. Otherwise fall back to the single signed-in
+ * lease runtime (preferring claude), or null when none is signed in. This is the
+ * non-interactive replacement for the runtime checkbox picker: `--lease` requires
+ * a prompt, so it is headless by contract and must never block on a TTY.
+ *
+ * Profile-dispatch agents (kimi/deepseek) and custom workflow agents that run
+ * under a non-obvious runtime are resolved separately — see RUSH-1725.
+ */
+export declare function inferLeaseRuntime(agentName: string, detected: DetectedRuntime[]): AgentId | null;
 /**
  * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
  * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token

package/dist/lib/crabbox/runtimes.js

@@ -79,6 +79,30 @@ export async function pickRuntimes(detected, prompt) {
     const { checkbox } = await import('@inquirer/prompts');
     return checkbox({ message: 'Provision which runtime(s) on the leased box?', choices });
 }
+/**
+ * The lease runtime to provision for a headless run of `agentName`.
+ *
+ * When the agent is itself a lease-capable runtime (claude/codex/gemini/grok)
+ * that IS the runtime to install. Otherwise fall back to the single signed-in
+ * lease runtime (preferring claude), or null when none is signed in. This is the
+ * non-interactive replacement for the runtime checkbox picker: `--lease` requires
+ * a prompt, so it is headless by contract and must never block on a TTY.
+ *
+ * Profile-dispatch agents (kimi/deepseek) and custom workflow agents that run
+ * under a non-obvious runtime are resolved separately — see RUSH-1725.
+ */
+export function inferLeaseRuntime(agentName, detected) {
+    const signedIn = detected.filter((d) => d.signedIn && d.credPath);
+    // The agent names a lease runtime directly: require that runtime to be signed
+    // in — never silently substitute a different one for an explicit `run <runtime>`
+    // (that would lease a billable box only to boot it "Not logged in"). Not signed
+    // in → null, so the caller exits with "sign into it locally first".
+    if (LEASE_RUNTIMES.some((c) => c.id === agentName)) {
+        return signedIn.find((d) => d.id === agentName)?.id ?? null;
+    }
+    // Custom/workflow agent: fall back to the signed-in runtime (preferring claude).
+    return signedIn.find((d) => d.id === 'claude')?.id ?? signedIn[0]?.id ?? null;
+}
 // A long random sentinel makes an accidental (or malicious) collision with a
 // token's contents effectively impossible, so the quoted heredoc can never be
 // closed early by the credential body.
@@ -134,8 +158,17 @@ export async function resolveClaudeCredentialsBlob(opts) {
     if (process.platform === 'darwin') {
         // 1) Bare service — the default native (non-managed) install.
         const bare = tryRead(service(undefined));
-        if (bare)
-            return bare;
+        if (bare) {
+            if (!opts?.preferEmail)
+                return bare;
+            // preferEmail is set — verify the bare service belongs to the right account
+            // before handing it back; on mismatch fall through to managed installs.
+            const realHome = process.env.AGENTS_REAL_HOME || os.homedir();
+            const bareEmail = await accountEmail(realHome).catch(() => null);
+            if (bareEmail === opts.preferEmail)
+                return bare;
+            // email mismatch — fall through
+        }
         // 2) Managed installs — hash-suffixed service keyed to each version home.
         //    Prefer the version whose account email matches the copied config.
         let homes;

package/dist/lib/daemon.d.ts

@@ -81,10 +81,26 @@ export declare function readDaemonClaudeOAuthToken(opts?: {
  * embed long-lived credentials.
  */
 export declare function writeOwnerOnlyServiceManifest(filePath: string, content: string): void;
-/** Generate a macOS launchd plist for auto-starting the daemon. */
-export declare function generateLaunchdPlist(oauthToken?: string | null, agentsBin?: string): string;
-/** Generate a Linux systemd user unit for auto-starting the daemon. */
-export declare function generateSystemdUnit(oauthToken?: string | null, agentsBin?: string): string;
+/**
+ * Generate a macOS launchd plist for auto-starting the daemon.
+ *
+ * The plist never embeds the Claude OAuth token (RUSH-1759): a persisted service
+ * manifest is a plaintext credential on disk even at 0600. The daemon instead
+ * obtains the token at startup from the `claude` secrets bundle
+ * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the
+ * Keychain-backed secure store and never touches the unit file.
+ */
+export declare function generateLaunchdPlist(agentsBin?: string): string;
+/**
+ * Generate a Linux systemd user unit for auto-starting the daemon.
+ *
+ * The unit never embeds the Claude OAuth token (RUSH-1759): a persisted service
+ * manifest is a plaintext credential on disk even at 0600. The daemon instead
+ * obtains the token at startup from the `claude` secrets bundle
+ * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the secure
+ * store and never touches the unit file.
+ */
+export declare function generateSystemdUnit(agentsBin?: string): string;
 export declare function getAgentsBinPath(argv1?: string | undefined, execPath?: string): string;
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(agentsBin?: string): {