@phnx-labs/agents-cli 1.20.64 → 1.20.66

package/dist/commands/sessions.js

@@ -16,7 +16,7 @@ import { truncate, padRight } from '../lib/format.js';
 import ora from 'ora';
 import { SESSION_AGENTS } from '../lib/session/types.js';
 import { discoverArtifacts, readArtifact, resolveArtifact } from '../lib/session/artifacts.js';
-import { looksLikePath, toComparablePath, homeDir, needsWindowsShell, findExecutable } from '../lib/platform/index.js';
+import { looksLikePath, toComparablePath, homeDir, needsWindowsShell, findExecutable, composeWin32CommandLine } from '../lib/platform/index.js';
 import { getActiveSessions } from '../lib/session/active.js';
 import { enumerateGhosttyTabs, assignGhosttyTabs } from '../lib/session/ghostty-tabs.js';
 import { mapPanesToTargets, listClients } from '../lib/tmux/session.js';
@@ -25,6 +25,7 @@ import { machineId, normalizeHost } from '../lib/session/sync/config.js';
 import { gatherRemoteActive, NO_FANOUT_ENV } from '../lib/session/remote-active.js';
 import { gatherRemoteList, runOnPeer } from '../lib/session/remote-list.js';
 import { stringWidth, truncateToWidth, padToWidth, terminalWidth } from '../lib/session/width.js';
+import { inferSessionState } from '../lib/session/state.js';
 import { discoverSessions, countSessionsInScope, resolveSessionById, searchContentIndex, getSessionRoots } from '../lib/session/discover.js';
 import { filterTeamSessions } from '../lib/session/team-filter.js';
 import { parseSession } from '../lib/session/parse.js';
@@ -36,7 +37,7 @@ import { colorAgent, resolveAgentName } from '../lib/agents.js';
 import { fuzzyMatch, FUZZY_PRESETS } from '../lib/fuzzy.js';
 import { resolveVersionAliasLoose } from '../lib/versions.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-import { sessionPicker } from './sessions-picker.js';
+import { sessionPicker, buildPreview } from './sessions-picker.js';
 import { setHelpSections } from '../lib/help.js';
 import { registerSessionsTailCommand } from './sessions-tail.js';
 import { registerSessionsSyncCommand } from './sessions-sync.js';
@@ -789,6 +790,57 @@ async function renderActiveSessions(asJson, waitingOnly = false, opts = {}) {
 function printCrossMachineTip() {
     console.log(chalk.gray("\nTip: include sessions from your other machines — register them with 'ag devices sync', then rerun. Use --local to skip."));
 }
+/**
+ * True when the interactive session browser should open instead of a printed
+ * listing: a real TTY, no `--json`, and `--no-interactive` not set. The bare
+ * listing and `--active` both default to it; scripts/pipes/agents fall through
+ * to the existing printed/JSON paths.
+ */
+function useInteractiveBrowser(options) {
+    return options.interactive !== false && !options.json && isInteractiveTerminal();
+}
+/** The canonical `ag sessions …` command for a set of flags — the twin of the
+ * browser's `y` hotkey (see --print-cmd). Normalizes to the stable flag form. */
+function canonicalSessionsCommand(query, options) {
+    const a = ['sessions'];
+    if (options.active)
+        a.push('--active');
+    if (options.teams)
+        a.push('--teams');
+    if (options.agent)
+        a.push('-a', options.agent);
+    for (const h of options.host ?? [])
+        a.push('--device', h);
+    if (options.project)
+        a.push('--project', options.project);
+    if (options.all)
+        a.push('--all');
+    if (options.since)
+        a.push('--since', options.since);
+    if (options.until)
+        a.push('--until', options.until);
+    if (options.local)
+        a.push('--local');
+    if (options.waiting)
+        a.push('--waiting');
+    const q = (query ?? '').trim();
+    if (q)
+        a.push(JSON.stringify(q));
+    return 'ag ' + a.join(' ');
+}
+/** Resolve a session by id/query globally and print its compact preview (no pager).
+ * Backs `--preview` — the fast path for the "peek before resume" hot loop. */
+async function renderSessionPreview(query, scope) {
+    const discovered = await discoverSessions({ all: true, cwd: process.cwd(), limit: 5000 });
+    const pool = applyScopeFilters(discovered, scope);
+    const matches = resolveSessionById(pool, query);
+    const session = (matches.length > 0 ? matches : filterSessionsByQuery(pool, query))[0];
+    if (!session) {
+        console.log(chalk.gray(`No session matches "${query}".`));
+        return;
+    }
+    console.log(buildPreview(session));
+}
 /** Main action handler for `agents sessions`. Routes to picker, table, or single-session render. */
 async function sessionsAction(query, options) {
     // Explicit --query is interchangeable with the positional; it's how you search
@@ -801,6 +853,13 @@ async function sessionsAction(query, options) {
     if (options.device && options.device.length > 0) {
         options.host = [...(options.host ?? []), ...options.device];
     }
+    // --print-cmd: echo the canonical `ag sessions …` for the given flags and exit.
+    // The non-interactive twin of the browser's `y` hotkey — lets an agent compose
+    // (or a human copy) the exact command a view maps to.
+    if (options.printCmd) {
+        process.stdout.write(canonicalSessionsCommand(query, options) + '\n');
+        return;
+    }
     // --roots: emit the local session-scan directories, per agent, as JSON. A pure
     // machine-readable query (no listing/render) — external watchers (the Factory
     // extension's fs.watch) read it to track the same dirs the CLI scans, instead
@@ -829,7 +888,39 @@ async function sessionsAction(query, options) {
         }
         return;
     }
+    // --preview <id/query>: resolve one session and print its compact preview, then
+    // exit — checked before --active so `--active --preview <id>` peeks the id
+    // rather than being swallowed by the active listing.
+    if (options.preview) {
+        if (!query) {
+            console.error(chalk.red('--preview requires a session id or query.'));
+            process.exit(1);
+        }
+        await renderSessionPreview(query, { agent: options.agent, project: options.project });
+        return;
+    }
     if (options.active) {
+        // On a TTY (and not a scripting path), open the interactive browser seeded to
+        // running-only. --json / --waiting / --no-interactive / a peer fan-out keep the
+        // static dump untouched, so scripts and agents are unaffected. An explicit
+        // --since seeds the window; --until / --project (no browser field) or a
+        // multi-host scope fall through to the static dump that already honors them.
+        if (useInteractiveBrowser(options) &&
+            !options.waiting &&
+            !options.until &&
+            !options.project &&
+            !options.sort &&
+            (options.host?.length ?? 0) <= 1 &&
+            process.env.AGENTS_SESSIONS_LOCAL !== '1') {
+            const { runSessionBrowser, activeBrowserSeed } = await import('./sessions-browser.js');
+            await runSessionBrowser(activeBrowserSeed({
+                teams: options.teams,
+                agent: options.agent,
+                host: options.host,
+                since: options.since,
+            }), { local: options.local === true, hosts: options.host });
+            return;
+        }
         // AGENTS_SESSIONS_LOCAL is set by a parent fan-out invocation (see
         // remote-active.ts) so a peer answers for itself without recursing.
         const forceLocal = options.local === true || process.env.AGENTS_SESSIONS_LOCAL === '1';
@@ -843,6 +934,30 @@ async function sessionsAction(query, options) {
         await runCloudSessions(query, options);
         return;
     }
+    // Bare interactive listing → the interactive fleet browser (humans). A query,
+    // a render/filter flag, --flat/--tree, --json, --until, --project (a named-project
+    // filter the browser can't represent), or --no-interactive keep the existing
+    // printed/render paths (agents and scripts unaffected). An explicit --since seeds
+    // the browser's window so the flag is honored, not swallowed.
+    if (useInteractiveBrowser(options) &&
+        !query &&
+        !options.flat &&
+        !options.tree &&
+        !options.markdown &&
+        !options.until &&
+        !options.project &&
+        !options.sort &&
+        !options.artifacts &&
+        options.artifact === undefined) {
+        const { runSessionBrowser, bareBrowserSeed } = await import('./sessions-browser.js');
+        await runSessionBrowser(bareBrowserSeed({
+            teams: options.teams,
+            agent: options.agent,
+            all: options.all,
+            since: options.since,
+        }), { local: options.local === true, hosts: options.host });
+        return;
+    }
     let filterOpts;
     try {
         filterOpts = buildFilterOptions(options);
@@ -1323,9 +1438,9 @@ async function renderSession(session, mode, filters, options = {}) {
         return;
     }
     const spinner = ora(`Parsing ${session.agent} session...`).start();
-    let events = parseSession(session.filePath, session.agent);
+    const parsedEvents = parseSession(session.filePath, session.agent);
     spinner.stop();
-    events = filterEvents(events, filters);
+    let events = filterEvents(parsedEvents, filters);
     const agentColor = colorAgent(session.agent);
     console.log('');
     if (mode === 'summary') {
@@ -1367,7 +1482,11 @@ async function renderSession(session, mode, filters, options = {}) {
     // engine (plan text, PR, worktree, ticket). Pre-1.20.51 emitted a bare event
     // array; consumers that JSON.parse this now read `output.events` for the
     // array. See issue #743 (plan surfaced) and CHANGELOG for the shape change.
-    process.stdout.write(renderJson(events, session));
+    // `todos` (RUSH-1503) is computed from the UNFILTERED transcript so the
+    // checklist reflects true session state regardless of any `--include` filter;
+    // it lets the Factory panel read the CLI's checklist instead of re-parsing.
+    const todos = inferSessionState(parsedEvents, { cwd: session.cwd }).todos;
+    process.stdout.write(renderJson(events, todos ? { ...session, todos } : session));
 }
 function renderTopicCell(label, topic, query, visibleWidth, paddedWidth) {
     const lbl = (label ?? '').trim();
@@ -1554,7 +1673,7 @@ function warnNoPeerTarget(machine, session) {
     console.log(chalk.yellow(`Session ${session.shortId} lives on ${machine}, which isn't a reachable device right now.`));
     console.log(chalk.gray(`Register/wake it (ag devices), or run there: agents ssh ${machine}`));
 }
-async function handlePickedSession(picked) {
+export async function handlePickedSession(picked) {
     // A session on another machine is read/resumed ON that machine over SSH — its
     // transcript and agent binary live there. Both actions execute on the peer
     // (not a local `--host` hop, which would discover locally and dead-end for a
@@ -1613,11 +1732,35 @@ export async function resumeSessionInPlace(session) {
     }
     await spawnResumeCommand(resume, cwd);
 }
+/**
+ * Map a resume argv to the spawn(command, args, {shell}) triple.
+ *
+ * On Windows the agent launcher is a `.cmd`/PATHEXT shim and needs shell:true.
+ * With shell:true, Node concatenates args into the cmd.exe line unescaped
+ * (DEP0190 + injection). A session.id derived from a filename can carry
+ * metacharacters (`&|<>`); compose a fully-quoted line and pass an EMPTY args
+ * array so cmd.exe cannot reparse them (RUSH-1753). See composeWin32CommandLine.
+ *
+ * `platform` is injectable so the win32 shell path is unit-testable on any host.
+ */
+export function resumeSpawnInvocation(cmd, platform = process.platform) {
+    const shell = needsWindowsShell(cmd[0], platform);
+    if (shell) {
+        return {
+            command: composeWin32CommandLine(cmd[0], cmd.slice(1)),
+            args: [],
+            shell: true,
+        };
+    }
+    return { command: cmd[0], args: cmd.slice(1), shell: false };
+}
 /**
  * Spawn a resume command as a foreground takeover (inherited stdio), resolving
  * when it exits. On Windows the agent launcher is a `.cmd`/PATHEXT shim that
  * `spawn` can't exec directly — a bare-name `shell:false` spawn throws
  * `EFTYPE`/`ENOENT` there — so we go through the shell via `needsWindowsShell`.
+ * When shell:true, argv is composed via resumeSpawnInvocation (quoted line +
+ * empty args) so an untrusted session.id cannot inject through cmd.exe.
  * The spawn is guarded because such a failure can be thrown synchronously;
  * without the guard it would surface under an unrelated "Failed to discover
  * sessions" catch upstream instead of a truthful launch error.
@@ -1626,10 +1769,11 @@ function spawnResumeCommand(cmd, cwd) {
     return new Promise((resolve) => {
         let child;
         try {
-            child = spawn(cmd[0], cmd.slice(1), {
+            const { command, args, shell } = resumeSpawnInvocation(cmd);
+            child = spawn(command, args, {
                 cwd,
                 stdio: 'inherit',
-                shell: needsWindowsShell(cmd[0]),
+                shell,
             });
         }
         catch (err) {
@@ -2045,7 +2189,7 @@ export function registerSessionsCommands(program) {
         .option('--opencode', 'Shorthand for --agent opencode')
         .option('--all', 'Include sessions from every directory (not just current project)')
         .option('--teams', 'Include team-spawned sessions (hidden by default)')
-        .option('--project <name>', 'Filter by project name (searches across all directories)')
+        .option('-p, --project <name>', 'Filter by project name (searches across all directories)')
         .option('--since <time>', 'Only sessions newer than this (e.g., 2h, 7d, 4w, or ISO date)')
         .option('--until <time>', 'Only sessions older than this (ISO timestamp)')
         .option('-n, --limit <n>', 'Maximum number of sessions to return', '50')
@@ -2069,7 +2213,10 @@ export function registerSessionsCommands(program) {
         .option('--cloud', 'Source sessions from Rush Cloud (captured runs) instead of local disk')
         .option('-H, --host <target...>', 'Run this query on remote machine(s) over SSH (host alias or user@host; repeatable)')
         .option('--device <target...>', 'Alias for --host (device alias from `agents devices`; repeatable)')
-        .option('--browser', 'List browser-profile captures (screenshots, PDFs, recordings, downloads) instead of agent transcripts — alias of `agents browser sessions`');
+        .option('--browser', 'List browser-profile captures (screenshots, PDFs, recordings, downloads) instead of agent transcripts — alias of `agents browser sessions`')
+        .option('--no-interactive', 'Print the listing instead of opening the interactive browser (default on a TTY for the bare listing and --active)')
+        .option('--print-cmd', 'Print the canonical `ag sessions …` command for the given flags and exit (the twin of the browser’s `y` hotkey)')
+        .option('--preview', 'With a session id/query: print a compact preview and exit (no pager)');
     setHelpSections(sessionsCmd, {
         examples: `
       # Search prior sessions in this project by topic, file path, or command

package/dist/commands/share.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerShareCommands(program: Command): void;

package/dist/commands/share.js

@@ -0,0 +1,150 @@
+// `agents share` — publish an HTML file to your own Cloudflare R2 behind a tiny
+// Worker, and get a shareable link (~$0). See apps/cli/docs/share.md.
+import { existsSync } from 'node:fs';
+import chalk from 'chalk';
+import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_WORKER_NAME, generateWriteToken, readCloudflareCreds, readShareConfig, storeWriteToken, writeShareConfig, } from '../lib/share/config.js';
+import { addCustomDomain, createBucket, deployWorker, enableWorkersDev, findZoneId, } from '../lib/share/provision.js';
+import { publishFile } from '../lib/share/publish.js';
+import { renderWorkerScript } from '../lib/share/worker-template.js';
+export function registerShareCommands(program) {
+    const shareCmd = program
+        .command('share')
+        .description('Publish an HTML file to your own Cloudflare R2 and get a shareable link (~$0).')
+        .argument('[file]', 'file to publish (HTML or any static asset)')
+        .option('--slug <slug>', 'custom URL slug (default: <project>-<feature>-<hash>)')
+        .option('--expire <spec>', 'auto-expire, e.g. 30d, 12h, or 2026-08-01')
+        .option('--no-cover', 'skip the OG preview image (HTML pages get one by default)')
+        .action(async (file, opts) => {
+        if (!file) {
+            shareCmd.help();
+            return;
+        }
+        if (!existsSync(file)) {
+            console.error(chalk.red(`No such file: ${file}`));
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const { url, expiresAt, coverUrl } = await publishFile(file, {
+                slug: opts.slug,
+                expire: opts.expire,
+                cover: opts.cover,
+            });
+            console.log(chalk.green(url));
+            if (coverUrl)
+                console.log(chalk.dim(`  cover ${coverUrl}`));
+            if (expiresAt)
+                console.log(chalk.dim(`  expires ${new Date(expiresAt).toLocaleString()}`));
+        }
+        catch (e) {
+            console.error(chalk.red(e.message));
+            process.exitCode = 1;
+        }
+    });
+    shareCmd
+        .command('setup')
+        .description('One-time: provision an R2 bucket + Worker on your Cloudflare and save the config.')
+        .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
+        .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
+        .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
+        .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
+        .option('--token <t>', 'Cloudflare API token (else read from the --bundle)')
+        .option('--domain <host>', 'also map a custom domain (e.g. share.agents-cli.sh) if the token owns the zone')
+        .action(async (opts) => {
+        try {
+            await runSetup(opts);
+        }
+        catch (e) {
+            console.error(chalk.red(e.message));
+            process.exitCode = 1;
+        }
+    });
+    shareCmd
+        .command('join')
+        .description('Use an existing share endpoint (no provisioning) — pass the base URL and paste the write token.')
+        .argument('<baseUrl>', 'base URL of the endpoint, e.g. https://share.agents-cli.sh')
+        .action(async (baseUrl) => {
+        try {
+            await runJoin(baseUrl);
+        }
+        catch (e) {
+            console.error(chalk.red(e.message));
+            process.exitCode = 1;
+        }
+    });
+    shareCmd
+        .command('status')
+        .description('Show the configured share endpoint.')
+        .action(() => {
+        const cfg = readShareConfig();
+        if (!cfg) {
+            console.log(chalk.dim("Not configured. Run 'agents share setup' or 'agents share join'."));
+            return;
+        }
+        console.log(`${chalk.bold('endpoint')}  ${chalk.green(cfg.baseUrl)}`);
+        console.log(chalk.dim(`worker ${cfg.workerName} · bucket ${cfg.bucketName} · account ${cfg.accountId}`));
+    });
+}
+async function runSetup(opts) {
+    const { default: ora } = await import('ora');
+    const { input } = await import('@inquirer/prompts');
+    const { apiToken, accountId: acctFromBundle } = readCloudflareCreds(opts.bundle, {
+        apiToken: opts.token,
+        accountId: opts.account,
+    });
+    const accountId = opts.account || acctFromBundle || (await input({ message: 'Cloudflare account id' }));
+    if (!accountId)
+        throw new Error('A Cloudflare account id is required.');
+    const workerName = opts.worker;
+    const bucketName = opts.bucket;
+    const token = generateWriteToken();
+    const spin = ora('Provisioning on Cloudflare…').start();
+    try {
+        await createBucket(apiToken, accountId, bucketName);
+        spin.text = `R2 bucket '${bucketName}' ready`;
+        await deployWorker(apiToken, accountId, workerName, renderWorkerScript(), bucketName, token);
+        spin.text = `Worker '${workerName}' deployed`;
+        const subdomain = await enableWorkersDev(apiToken, accountId, workerName);
+        let baseUrl = `https://${workerName}.${subdomain}.workers.dev`;
+        let domain;
+        if (opts.domain) {
+            spin.text = `Mapping ${opts.domain}…`;
+            const zoneId = await findZoneId(apiToken, opts.domain);
+            if (zoneId) {
+                await addCustomDomain(apiToken, accountId, workerName, zoneId, opts.domain);
+                baseUrl = `https://${opts.domain}`;
+                domain = opts.domain;
+            }
+            else {
+                spin.warn(`Zone for ${opts.domain} not visible to this token — staying on workers.dev`);
+            }
+        }
+        spin.succeed('Provisioned');
+        const cfg = { baseUrl, accountId, workerName, bucketName, domain };
+        writeShareConfig(cfg);
+        storeWriteToken(token);
+        console.log(chalk.green(`\nShare endpoint ready → ${chalk.bold(baseUrl)}`));
+        console.log(chalk.dim('Publish with:  ') + chalk.cyan('agents share <file>'));
+        console.log(chalk.dim(`Fleet: push the token with 'agents secrets export share --host <box>' and pull config with 'agents repo pull'.`));
+    }
+    catch (e) {
+        spin.fail('Provisioning failed');
+        throw e;
+    }
+}
+async function runJoin(baseUrl) {
+    const { password, input } = await import('@inquirer/prompts');
+    const clean = baseUrl.replace(/\/+$/, '');
+    const workerName = await input({ message: 'Worker name', default: DEFAULT_WORKER_NAME });
+    const bucketName = await input({ message: 'Bucket name', default: DEFAULT_BUCKET_NAME });
+    const accountId = await input({ message: 'Cloudflare account id' });
+    const token = await password({ message: 'Write token (from the endpoint owner)', mask: true });
+    if (!token)
+        throw new Error('A write token is required to join.');
+    const domain = clean.startsWith('https://') && !clean.includes('.workers.dev')
+        ? clean.replace(/^https:\/\//, '')
+        : undefined;
+    writeShareConfig({ baseUrl: clean, accountId, workerName, bucketName, domain });
+    storeWriteToken(token);
+    console.log(chalk.green(`Joined ${chalk.bold(clean)} — publish with `) + chalk.cyan('agents share <file>'));
+}

package/dist/commands/ssh.js

@@ -15,9 +15,11 @@ import * as os from 'os';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
-import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
+import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../lib/secrets/bundles.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
+import { addControlToken } from '../lib/serve/token.js';
+import { DEFAULT_SERVE_PORT } from '../lib/serve/server.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from '../lib/devices/tailscale.js';
 import { localLoginUser, planDeviceReconciliation, runDeviceSync, withDefaultUser } from '../lib/devices/sync.js';
 import { resolveDeviceTarget, splitUserHost } from '../lib/devices/resolve-target.js';
@@ -25,6 +27,7 @@ import { clearPendingSentinel } from '../lib/devices/pending.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
+import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
 import { planFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
 import { fleetCapacity, fmtBytes, headroom, probeFleetStats, } from '../lib/devices/health.js';
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
@@ -400,6 +403,47 @@ Typical workflow:
             process.exit(1);
         }
     });
+    devicesCmd
+        .command('pair-ios [name]')
+        .description('Pair an iPhone/iPad cockpit (RUSH-1733): mint a control token for `agents serve --control` and mark the device control-only. The token is shown ONCE — enter it in the app. Run this on the anchor.')
+        .option('--port <n>', 'Anchor control port to advertise to the app', String(DEFAULT_SERVE_PORT))
+        .action(async (name, opts) => {
+        const label = (name || 'iphone').trim();
+        // Mint the bearer token — hash-only on disk, raw shown once (see serve/token.ts).
+        const { id, token } = addControlToken(label);
+        // If a device with this name is already registered (e.g. discovered over
+        // Tailscale as an `unknown`-platform node), mark it control-only so the
+        // fleet stops trying to dial it for sessions/placement.
+        let marked = false;
+        let unknownName = false;
+        if (name) {
+            const existing = await getDevice(name);
+            if (existing) {
+                await upsertDevice(name, { role: 'control' });
+                marked = true;
+            }
+            else {
+                unknownName = true;
+            }
+        }
+        const port = parseInt(opts.port ?? '', 10) || DEFAULT_SERVE_PORT;
+        console.log(chalk.green(`Paired cockpit '${label}'`) + chalk.gray(` (token id ${id})`));
+        if (marked)
+            console.log(chalk.gray(`Marked device '${name}' role=control — the fleet won't dial it.`));
+        if (unknownName) {
+            console.log(chalk.yellow(`Note: no registered device named '${name}' — token minted, but no device was marked role=control.`) +
+                chalk.gray(` Run \`agents devices sync\` first if this phone should appear in the fleet.`));
+        }
+        console.log();
+        console.log(chalk.bold('Control token (shown once — enter it in the app):'));
+        console.log('  ' + chalk.cyan(token));
+        console.log();
+        console.log('On the anchor, expose the control server on your tailnet:');
+        console.log(chalk.gray(`  agents serve --control --bind <anchor-tailnet-ip> --port ${port}`));
+        console.log('Then point the app at:');
+        console.log(chalk.gray(`  http://<anchor-tailnet-ip>:${port}   (Bearer: the token above)`));
+        console.log(chalk.yellow('Keep the control server on the tailnet — never public Funnel.'));
+    });
     devicesCmd
         .command('rm <name>')
         .alias('remove')
@@ -515,7 +559,14 @@ secrets bundle via an askpass shim — the password never touches argv.
         }
         try {
             const shim = writeAskpassShim();
-            const { args, env } = buildSshInvocation(device, cmd, shim);
+            // Pin the host key on first connect and verify strictly thereafter: the
+            // managed known_hosts store must exist before ssh writes the learned key
+            // into it, and a host already recorded there is checked with
+            // StrictHostKeyChecking=yes (RUSH-1767).
+            ensureManagedKnownHostsDir();
+            const addr = hostNameFor(device);
+            const pinned = addr ? isHostPinned(addr) : false;
+            const { args, env } = buildSshInvocation(device, cmd, shim, { pinned });
             const res = spawnSync('ssh', args, {
                 stdio: 'inherit',
                 env: { ...process.env, ...env },
@@ -544,7 +595,7 @@ async function runAskpass() {
         process.exit(1);
     }
     try {
-        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents ssh' });
+        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents ssh', agentOnly: isHeadlessSecretsContext() });
         const value = env[key];
         if (value === undefined) {
             console.error(`askpass: key '${key}' not found in bundle '${bundle}'`);

package/dist/commands/versions.js

@@ -4,7 +4,7 @@ import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
 import { select, confirm, checkbox } from '@inquirer/prompts';
-import { AGENTS, ALL_AGENT_IDS, getAccountEmail, getAccountInfo, agentLabel, warnAgentDeprecated, isSelfUpdatingAgent, } from '../lib/agents.js';
+import { AGENTS, ALL_AGENT_IDS, accountOrgBadge, getAccountEmail, getAccountInfo, agentLabel, warnAgentDeprecated, isSelfUpdatingAgent, } from '../lib/agents.js';
 import { formatUsageSummary, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, } from '../lib/usage.js';
 import { viewAction } from './view.js';
 import { readManifest, writeManifest, createDefaultManifest } from '../lib/manifest.js';
@@ -32,8 +32,12 @@ function fixSessionFilePaths(agent, version, oldVersionDir) {
 }
 function formatAccountHint(info, usage) {
     const parts = [];
-    if (info.email)
-        parts.push(info.email);
+    if (info.email) {
+        // Same-email accounts can live in different orgs (personal Max vs a Team
+        // seat) — the badge is what makes the picker disambiguate them.
+        const badge = accountOrgBadge(info);
+        parts.push(badge ? `${info.email} (${badge})` : info.email);
+    }
     const usageSummary = formatUsageSummary(info.plan, usage);
     if (usageSummary)
         parts.push(usageSummary);

package/dist/commands/view.d.ts

@@ -7,8 +7,23 @@
  * rules, hooks, and promptcuts synced to that version.
  */
 import type { Command } from 'commander';
+import type { AccountInfo } from '../lib/agents.js';
 import type { AgentId } from '../lib/types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
+/**
+ * Text for the account (email) column. Prefers the real email; otherwise, for a
+ * signed-in agent whose credential carries no email but does carry an opaque
+ * account id (Kimi's user_id), show `id:<user_id>` so distinct accounts read
+ * distinctly instead of a generic "signed in". Falls back to "signed in" when we
+ * have neither (Antigravity), and empty when signed out.
+ *
+ * When the account carries a Claude organizationType, the org badge is appended
+ * — "email (Turing Labs · Team)" — so two installs signed into the same email
+ * under different orgs (personal Max vs a Team seat) read distinctly. The
+ * suffix is plain text inside the label so the existing column-width pass
+ * measures and pads it for free.
+ */
+export declare function accountColumnLabel(info?: Pick<AccountInfo, 'email' | 'accountId' | 'signedIn' | 'organizationType' | 'organizationName'> | null): string;
 type SyncState = 'synced' | 'new' | 'modified' | 'deleted';
 /** Per-section filter flags. When any are true, only those sections render. */
 export interface ViewSectionFilter {
@@ -32,6 +47,8 @@ export interface ViewJsonVersion {
     signedIn: boolean;
     email: string | null;
     accountId?: string | null;
+    organizationType?: string | null;
+    organizationName?: string | null;
     plan: string | null;
     usageStatus: 'available' | 'rate_limited' | 'out_of_credits' | null;
     overageCredits?: {
@@ -86,6 +103,15 @@ export declare function parseResourceSections(options: {
     resources?: string | boolean;
     detailed?: boolean;
 } & ViewSectionFilter, jsonMode: boolean): Set<ResourceSection>;
+/**
+ * Identity key for duplicate-install detection. Prefers accountKey — which
+ * encodes account AND org — over the bare email: two installs can share an
+ * email yet belong to different orgs (a personal Max plan and a Team seat),
+ * and grouping those by email alone would propose pruning a live account.
+ * Falls back to the lowercased email for agents whose credentials expose no
+ * identity key. Null when there is no usable identity.
+ */
+export declare function pruneGroupKey(info: Pick<AccountInfo, 'accountKey' | 'email'>): string | null;
 /**
  * Prune older installed versions that share an email with a newer installed
  * version. Keeps the highest semver per email, skips the global default (with