@phnx-labs/agents-cli 1.20.64 → 1.20.66

package/dist/lib/cloud/host.js

@@ -0,0 +1,224 @@
+/**
+ * Host cloud provider — your own machines as a task-execution backend.
+ *
+ * A thin adapter over the hosts subsystem (lib/hosts/*): `agents cloud run
+ * --provider host --host <name>` dispatches through the SAME detached-SSH
+ * launch as `agents run --host`, and the resulting task shows up in BOTH
+ * `agents cloud ps` and `agents hosts ps` — one store (the host-task sidecars
+ * under ~/.agents/.cache/hosts/), two views. No new transport, no relay: SSH
+ * is the only wire, exactly like the rest of the hosts design (docs/hosts.md).
+ *
+ * Status semantics follow reconcile.ts's prime rule: completion is only ever
+ * CONFIRMED from the remote `.exit` file — an unreachable host leaves a task
+ * `running`, never guessed as failed. The cloud SQLite store row is a cached
+ * index (the `cloud list` refresh loop upserts what `status()` returns); the
+ * sidecar stays the source of truth. Reachability is memoized per target for
+ * the life of the process so a down host costs ONE short timeout, not one per
+ * task ("care around the cloud status-refresh path", lib/hosts/tasks.ts).
+ */
+import { MissingTargetError, resolveDispatchRepos } from './types.js';
+import { listTasks, loadTask, terminalPatch, updateTask } from '../hosts/tasks.js';
+import { readRemoteExit } from '../hosts/reconcile.js';
+import { sshReachable } from '../ssh-exec.js';
+import { fetchProgress } from '../hosts/progress.js';
+import { dispatchPromptToHost, resolveHostRunTarget } from '../hosts/run-target.js';
+import { listAllHosts } from '../hosts/registry.js';
+import { terminateDispatchedTask } from '../hosts/dispatch.js';
+/** Host-task lifecycle → canonical cloud enum. `unknown` stays `running`
+ *  (completion is confirmed, never guessed — reconcile.ts's rule). */
+function toCloudStatus(status) {
+    switch (status) {
+        case 'completed': return 'completed';
+        case 'failed': return 'failed';
+        case 'running':
+        case 'unknown':
+        default:
+            return 'running';
+    }
+}
+/** Project a host-task sidecar into the cloud task shape. */
+export function hostTaskToCloudTask(task) {
+    return {
+        id: task.id,
+        provider: 'host',
+        status: toCloudStatus(task.status),
+        agent: task.agent,
+        prompt: task.prompt,
+        createdAt: task.createdAt,
+        updatedAt: task.finishedAt ?? task.createdAt,
+        summary: `on ${task.host}${task.name ? ` as "${task.name}"` : ''}`,
+    };
+}
+export class HostCloudProvider {
+    id = 'host';
+    name = 'Host (your machines)';
+    targetKind = 'host';
+    /**
+     * Reachability memo, per target, for the life of this process. The cloud
+     * refresh loop calls `status()` once per active task; without the memo a
+     * down host would cost one ~6s ssh timeout PER task instead of one total.
+     * CLI processes are short-lived, so staleness is bounded by the invocation.
+     */
+    reachable = new Map();
+    capabilities() {
+        return {
+            available: true, // ssh is the only dependency; per-host reachability is probed at dispatch
+            dispatch: true,
+            status: true,
+            list: true,
+            stream: true,
+            cancel: true,
+            message: true, // gated per task: needs the sessionId only Claude runs carry
+            multiRepo: false,
+            skills: false,
+            images: false,
+        };
+    }
+    async dispatch(options) {
+        const hostName = options.providerOptions?.host;
+        if (!hostName) {
+            throw new MissingTargetError('host', 'No host given. Pass --host <name> (a registered host, a device, a capability tag, or user@host).', 'List your machines: agents hosts list  ·  register more: agents devices sync / agents hosts add');
+        }
+        if (resolveDispatchRepos(options).length > 0) {
+            throw new Error('--repo has no meaning for --provider host — the run executes in a directory on the machine, not a cloned repo. ' +
+                'Pass the working directory via providerOptions.remoteCwd (CLI: --remote-cwd) instead.');
+        }
+        if (options.branch) {
+            throw new Error('--branch has no meaning for --provider host (no clone step). Check out the branch on the host, or use --remote-cwd.');
+        }
+        // DeviceOffloadUnsupportedError / HostResolutionError propagate — both carry
+        // actionable messages the CLI prints verbatim.
+        const host = await resolveHostRunTarget(hostName, {
+            any: options.providerOptions?.any === true,
+        });
+        const { task } = await dispatchPromptToHost(host, {
+            agent: options.agent ?? 'claude',
+            prompt: options.prompt,
+            mode: options.providerOptions?.mode,
+            model: options.model,
+            timeout: options.timeout,
+            remoteCwd: options.providerOptions?.remoteCwd,
+            name: options.providerOptions?.name,
+            follow: false, // the cloud pipeline streams via stream(); never block dispatch
+        });
+        return hostTaskToCloudTask(task);
+    }
+    async status(taskId) {
+        const task = loadTask(taskId);
+        if (!task)
+            throw new Error(`Unknown host task: ${taskId}`);
+        return hostTaskToCloudTask(this.reconcileMemoized(task));
+    }
+    async list(filter) {
+        const tasks = listTasks().map((t) => hostTaskToCloudTask(this.reconcileMemoized(t)));
+        return filter?.status ? tasks.filter((t) => t.status === filter.status) : tasks;
+    }
+    /**
+     * `reconcileTask` with the per-process reachability memo folded in: probe a
+     * target at most once per process; a down host leaves its tasks `running`.
+     */
+    reconcileMemoized(task) {
+        if (task.status !== 'running')
+            return task;
+        if (!this.reachable.has(task.target)) {
+            this.reachable.set(task.target, sshReachable(task.target, 6000));
+        }
+        if (!this.reachable.get(task.target))
+            return task;
+        const st = readRemoteExit(task.target, task.remoteExit);
+        if (st.state !== 'done')
+            return task;
+        return updateTask(task.id, terminalPatch(st.code)) ?? task;
+    }
+    /**
+     * Offset-tail the remote log (the same one-round-trip fetch the `run --host`
+     * follow uses) and yield it as `text` events until the `.exit` file lands.
+     */
+    async *stream(taskId) {
+        const task = loadTask(taskId);
+        if (!task)
+            throw new Error(`Unknown host task: ${taskId}`);
+        if (task.status !== 'running') {
+            yield { type: 'status', status: toCloudStatus(task.status) };
+            yield { type: 'done', status: toCloudStatus(task.status) };
+            return;
+        }
+        let offset = 0;
+        const fastPollMs = 1500;
+        const maxPollMs = 6000;
+        let pollMs = fastPollMs;
+        for (;;) {
+            const fetched = fetchProgress(task.target, {
+                remoteLog: task.remoteLog,
+                remoteExit: task.remoteExit,
+                taskId: task.id,
+                offset,
+            });
+            if (fetched) {
+                if (fetched.logChunk.length > 0) {
+                    offset += fetched.logChunk.length;
+                    pollMs = fastPollMs; // output is flowing — snap back to the fast poll
+                    yield { type: 'text', content: fetched.logChunk.toString('utf8') };
+                }
+                else {
+                    pollMs = Math.min(Math.round(pollMs * 1.5), maxPollMs); // idle backoff
+                }
+                const exit = fetched.exit.trim();
+                if (exit !== '') {
+                    const code = Number.parseInt(exit, 10);
+                    const finished = updateTask(task.id, terminalPatch(Number.isFinite(code) ? code : 0));
+                    const status = toCloudStatus(finished?.status ?? (code === 0 ? 'completed' : 'failed'));
+                    yield { type: 'done', status };
+                    return;
+                }
+            }
+            await new Promise((r) => setTimeout(r, pollMs));
+        }
+    }
+    async cancel(taskId) {
+        const task = loadTask(taskId);
+        if (!task)
+            throw new Error(`Unknown host task: ${taskId}`);
+        terminateDispatchedTask(task);
+    }
+    /**
+     * Follow-up message = resume the run's session on the same host. Only runs
+     * that captured a session id (Claude — the one agent that takes
+     * `--session-id`) can be resumed; others get an actionable refusal.
+     */
+    async message(taskId, content) {
+        const task = loadTask(taskId);
+        if (!task)
+            throw new Error(`Unknown host task: ${taskId}`);
+        if (!task.sessionId) {
+            throw new Error(`Host task ${taskId} has no session id to resume (only Claude runs capture one). ` +
+                `Start a follow-up run instead: agents run ${task.agent} "<prompt>" --host ${task.host}`);
+        }
+        const host = await resolveHostRunTarget(task.host);
+        await dispatchPromptToHost(host, {
+            agent: task.agent,
+            prompt: content,
+            resume: task.sessionId,
+            name: task.name,
+            follow: false,
+        });
+    }
+    /** The unified host pool (enrolled hosts ∪ devices), dispatchable ones only. */
+    async listTargets() {
+        const hosts = await listAllHosts();
+        return hosts
+            .filter((h) => h.dispatchable !== false)
+            .map((h) => ({
+            id: h.name,
+            label: [
+                h.provider === 'devices' ? 'device' : h.source,
+                h.os,
+                h.status && h.status !== 'unknown' ? h.status : undefined,
+                h.caps?.length ? `caps: ${h.caps.join(',')}` : undefined,
+            ]
+                .filter(Boolean)
+                .join(' · '),
+            kind: 'host',
+        }));
+    }
+}

package/dist/lib/cloud/registry.js

@@ -11,6 +11,7 @@ import { RushCloudProvider } from './rush.js';
 import { CodexCloudProvider } from './codex.js';
 import { FactoryCloudProvider } from './factory.js';
 import { AntigravityCloudProvider } from './antigravity.js';
+import { HostCloudProvider } from './host.js';
 import { getUserAgentsDir } from '../state.js';
 import { AGENTS } from '../agents.js';
 const META_FILE = path.join(getUserAgentsDir(), 'agents.yaml');
@@ -43,6 +44,9 @@ function initProviders() {
     providers.set('codex', new CodexCloudProvider(config.providers?.codex));
     providers.set('factory', new FactoryCloudProvider(config.providers?.factory));
     providers.set('antigravity', new AntigravityCloudProvider(config.providers?.antigravity));
+    // Your own machines (agents hosts / agents devices) over SSH. No agent
+    // auto-routes here — it's always an explicit --provider host / --host choice.
+    providers.set('host', new HostCloudProvider());
 }
 /**
  * The cloud provider an agent dispatches to by default. Reads the canonical

package/dist/lib/cloud/types.d.ts

@@ -9,16 +9,18 @@ import type { JobTrigger } from '../routines.js';
 /**
  * Identifier for a supported cloud dispatch backend.
  *
- * Each id is one agent's *own* cloud:
+ * Each id is one agent's *own* cloud — plus your own machines:
  *   - `rush`        — Rush Cloud (runs Claude against a GitHub repo → PR)
  *   - `codex`       — OpenAI Codex Cloud (`codex cloud exec`)
  *   - `factory`     — Factory Droid Computers (`droid computer ssh` + remote `droid exec`)
  *   - `antigravity` — Google Gemini Managed Agents (Interactions API)
+ *   - `host`        — a machine you own (`agents hosts` / `agents devices`), over SSH
  *
  * Agents route to their native cloud automatically (see `cloudProvider` in the
- * agent registry); `--provider` overrides.
+ * agent registry); `--provider` overrides. Nothing auto-routes to `host` — it
+ * is always an explicit `--provider host` (or `--host <name>`) choice.
  */
-export type CloudProviderId = 'rush' | 'codex' | 'factory' | 'antigravity';
+export type CloudProviderId = 'rush' | 'codex' | 'factory' | 'antigravity' | 'host';
 /**
  * Lifecycle state of a cloud-dispatched task.
  *
@@ -219,7 +221,7 @@ export interface CloudTarget {
     kind: TargetKind;
 }
 /** Which dispatch option a provider's pre-provisioned target maps to. */
-export type TargetKind = 'env' | 'computer';
+export type TargetKind = 'env' | 'computer' | 'host';
 /**
  * Thrown by a provider's `dispatch()` when it needs a pre-provisioned target
  * (Codex env / Factory computer) and none was supplied. The CLI catches this

package/dist/lib/computer-rpc.js

@@ -341,7 +341,9 @@ class TcpClient extends BaseClient {
             this.failPending('helper_exited', 'tcp connection closed before reply');
         });
         // Kick off the auth handshake synchronously so its frame (id 1) is the
-        // first thing written. No token → daemon is open (tunnel-gated).
+        // first thing written. The Windows daemon now REQUIRES a token (it refuses to
+        // start without one); a null token here means no auth frame is sent, the
+        // daemon drops the connection, and the caller is told to re-run `setup`.
         this.authReady = token ? this.authenticate(token) : Promise.resolve();
     }
     async authenticate(token) {

package/dist/lib/crabbox/cli.js

@@ -12,7 +12,7 @@
  * from a secrets bundle when one is configured (see `crabboxEnv`).
  */
 import { spawn, spawnSync } from 'child_process';
-import { readAndResolveBundleEnv, listBundles, bundleExists } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv, isHeadlessSecretsContext, listBundles, bundleExists } from '../secrets/bundles.js';
 import { readMeta, writeMeta } from '../state.js';
 /** Locate the crabbox binary, or throw an actionable error. */
 export function findCrabbox() {
@@ -105,6 +105,10 @@ export function crabboxEnv(opts) {
         const { env } = readAndResolveBundleEnv(resolved.name, {
             caller: 'agents run --lease (crabbox)',
             keys: resolved.keys,
+            // --lease is headless by contract and crabboxEnv is called several times
+            // per run (list/wait/spawn/stop) — resolve broker-only so a keychain bundle
+            // can't pop repeated unwatched Touch ID sheets mid-lease.
+            agentOnly: isHeadlessSecretsContext(),
         });
         return { ...process.env, ...env };
     }

package/dist/lib/crabbox/runtimes.js

@@ -158,8 +158,17 @@ export async function resolveClaudeCredentialsBlob(opts) {
     if (process.platform === 'darwin') {
         // 1) Bare service — the default native (non-managed) install.
         const bare = tryRead(service(undefined));
-        if (bare)
-            return bare;
+        if (bare) {
+            if (!opts?.preferEmail)
+                return bare;
+            // preferEmail is set — verify the bare service belongs to the right account
+            // before handing it back; on mismatch fall through to managed installs.
+            const realHome = process.env.AGENTS_REAL_HOME || os.homedir();
+            const bareEmail = await accountEmail(realHome).catch(() => null);
+            if (bareEmail === opts.preferEmail)
+                return bare;
+            // email mismatch — fall through
+        }
         // 2) Managed installs — hash-suffixed service keyed to each version home.
         //    Prefer the version whose account email matches the copied config.
         let homes;

package/dist/lib/daemon.d.ts

@@ -81,10 +81,26 @@ export declare function readDaemonClaudeOAuthToken(opts?: {
  * embed long-lived credentials.
  */
 export declare function writeOwnerOnlyServiceManifest(filePath: string, content: string): void;
-/** Generate a macOS launchd plist for auto-starting the daemon. */
-export declare function generateLaunchdPlist(oauthToken?: string | null, agentsBin?: string): string;
-/** Generate a Linux systemd user unit for auto-starting the daemon. */
-export declare function generateSystemdUnit(oauthToken?: string | null, agentsBin?: string): string;
+/**
+ * Generate a macOS launchd plist for auto-starting the daemon.
+ *
+ * The plist never embeds the Claude OAuth token (RUSH-1759): a persisted service
+ * manifest is a plaintext credential on disk even at 0600. The daemon instead
+ * obtains the token at startup from the `claude` secrets bundle
+ * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the
+ * Keychain-backed secure store and never touches the unit file.
+ */
+export declare function generateLaunchdPlist(agentsBin?: string): string;
+/**
+ * Generate a Linux systemd user unit for auto-starting the daemon.
+ *
+ * The unit never embeds the Claude OAuth token (RUSH-1759): a persisted service
+ * manifest is a plaintext credential on disk even at 0600. The daemon instead
+ * obtains the token at startup from the `claude` secrets bundle
+ * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the secure
+ * store and never touches the unit file.
+ */
+export declare function generateSystemdUnit(agentsBin?: string): string;
 export declare function getAgentsBinPath(argv1?: string | undefined, execPath?: string): string;
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(agentsBin?: string): {

package/dist/lib/daemon.js

@@ -14,6 +14,7 @@ import { getDaemonDir as getDaemonDirRoot } from './state.js';
 import { isAlive, killTree, backgroundSpawnOptions } from './platform/index.js';
 import { listJobs as listAllJobs } from './routines.js';
 import { JobScheduler } from './scheduler.js';
+import { MonitorEngine } from './monitors/engine.js';
 import { executeJobDetached, monitorRunningJobs } from './runner.js';
 import { detectOverdueJobs, notifyOverdue } from './overdue.js';
 import { BrowserService } from './browser/service.js';
@@ -293,6 +294,21 @@ export async function runDaemon() {
         process.exit(0);
     }
     log('INFO', `Daemon started (PID: ${process.pid})`);
+    // RUSH-1759: the launchd plist / systemd unit no longer bake the Claude OAuth
+    // token onto disk. Obtain it here from the secure `claude` secrets bundle and
+    // inject into this process's env so every routine run this daemon spawns still
+    // receives it (via the sandbox allowlist), without the token ever being
+    // persisted in the service manifest. A read from a file-backed store (Linux)
+    // needs no prompt; on macOS it resolves broker-only from an unlocked
+    // secrets-agent and is otherwise absent (leaving the daemon on its existing
+    // interactive OAuth session), matching the detached-start path. Never blocks.
+    if (!process.env.CLAUDE_CODE_OAUTH_TOKEN) {
+        const oauthToken = readDaemonClaudeOAuthToken();
+        if (oauthToken) {
+            process.env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
+            log('INFO', 'Loaded Claude OAuth token from secrets bundle for routine runs');
+        }
+    }
     // Reap any stray duplicate daemon of this install that slipped past the start
     // lock or was orphaned by a hard-crash — before it can double-fire jobs.
     try {
@@ -349,6 +365,16 @@ export async function runDaemon() {
     for (const job of scheduled) {
         log('INFO', `  ${job.name} -> next: ${job.nextRun?.toISOString() || 'unknown'}`);
     }
+    // Monitor engine: event-triggered watchers, beside the cron scheduler. Same
+    // daemon, same dispatch seam — a monitor is a routine whose trigger is a
+    // watched source instead of a clock. Reloads on SIGHUP alongside the scheduler.
+    const monitorEngine = new MonitorEngine((level, message) => log(level, message));
+    try {
+        monitorEngine.start();
+    }
+    catch (err) {
+        log('ERROR', `Monitor engine failed to start: ${err.message}`);
+    }
     // Backlog detection: any enabled recurring job whose most-recent expected
     // fire is older than its most-recent recorded run is overdue. Happens when
     // the laptop was off or the daemon crashed through a scheduled fire.
@@ -603,6 +629,12 @@ export async function runDaemon() {
         scheduler.reloadAll();
         const reloaded = scheduler.listScheduled();
         log('INFO', `Reloaded ${reloaded.length} jobs`);
+        try {
+            monitorEngine.reload();
+        }
+        catch (err) {
+            log('ERROR', `Monitor engine reload failed: ${err.message}`);
+        }
         // Drop the memoized R2 config so rotated/added sync credentials are re-read
         // on the next cycle instead of waiting for a restart.
         void import('./session/sync/config.js').then(m => m.clearR2ConfigCache());
@@ -610,6 +642,7 @@ export async function runDaemon() {
     const handleShutdown = async () => {
         log('INFO', 'Daemon shutting down');
         scheduler.stopAll();
+        monitorEngine.stop();
         await browserIPC.stop();
         clearInterval(monitorInterval);
         clearInterval(syncInterval);
@@ -680,15 +713,18 @@ export function writeOwnerOnlyServiceManifest(filePath, content) {
     fs.rmSync(filePath, { force: true });
     fs.writeFileSync(filePath, content, { encoding: 'utf-8', mode: 0o600 });
 }
-/** Generate a macOS launchd plist for auto-starting the daemon. */
-export function generateLaunchdPlist(oauthToken = readDaemonClaudeOAuthToken(), agentsBin = getAgentsBinPath()) {
+/**
+ * Generate a macOS launchd plist for auto-starting the daemon.
+ *
+ * The plist never embeds the Claude OAuth token (RUSH-1759): a persisted service
+ * manifest is a plaintext credential on disk even at 0600. The daemon instead
+ * obtains the token at startup from the `claude` secrets bundle
+ * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the
+ * Keychain-backed secure store and never touches the unit file.
+ */
+export function generateLaunchdPlist(agentsBin = getAgentsBinPath()) {
     const launch = getDaemonLaunch(agentsBin);
     const logPath = getLogPath();
-    const oauthEntry = oauthToken
-        ? `
-    <key>${DAEMON_OAUTH_KEY}</key>
-    <string>${xmlEscape(oauthToken)}</string>`
-        : '';
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -710,7 +746,7 @@ ${[launch.command, ...launch.args].map((arg) => `    <string>${xmlEscape(arg)}</
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key>
-    <string>${daemonNodeBinDir()}:/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin:${os.homedir()}/.bun/bin</string>${oauthEntry}
+    <string>${daemonNodeBinDir()}:/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin:${os.homedir()}/.bun/bin</string>
   </dict>
 </dict>
 </plist>`;
@@ -719,13 +755,18 @@ ${[launch.command, ...launch.args].map((arg) => `    <string>${xmlEscape(arg)}</
 function systemdExecArg(value) {
     return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }
-/** Generate a Linux systemd user unit for auto-starting the daemon. */
-export function generateSystemdUnit(oauthToken = readDaemonClaudeOAuthToken(), agentsBin = getAgentsBinPath()) {
+/**
+ * Generate a Linux systemd user unit for auto-starting the daemon.
+ *
+ * The unit never embeds the Claude OAuth token (RUSH-1759): a persisted service
+ * manifest is a plaintext credential on disk even at 0600. The daemon instead
+ * obtains the token at startup from the `claude` secrets bundle
+ * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the secure
+ * store and never touches the unit file.
+ */
+export function generateSystemdUnit(agentsBin = getAgentsBinPath()) {
     const launch = getDaemonLaunch(agentsBin);
     const execStart = [launch.command, ...launch.args].map(systemdExecArg).join(' ');
-    const oauthLine = oauthToken
-        ? `\nEnvironment=${DAEMON_OAUTH_KEY}=${oauthToken}`
-        : '';
     return `[Unit]
 Description=Agents Daemon - Scheduled Job Runner
 After=network.target
@@ -735,7 +776,7 @@ Type=simple
 ExecStart=${execStart}
 Restart=always
 RestartSec=10
-Environment=PATH=${daemonNodeBinDir()}:/usr/local/bin:/usr/bin:/bin${oauthLine}
+Environment=PATH=${daemonNodeBinDir()}:/usr/local/bin:/usr/bin:/bin
 
 [Install]
 WantedBy=default.target`;
@@ -852,9 +893,10 @@ function startDaemonLocked(agentsBin) {
             if (!fs.existsSync(plistDir)) {
                 fs.mkdirSync(plistDir, { recursive: true });
             }
-            // The plist may embed a long-lived OAuth token in EnvironmentVariables;
-            // create owner-only atomically (no world-readable window before chmod).
-            writeOwnerOnlyServiceManifest(plistPath, generateLaunchdPlist(undefined, agentsBin));
+            // The plist carries no credential (RUSH-1759 — the daemon reads the OAuth
+            // token itself at startup); still create owner-only atomically to match the
+            // detached path and keep the log/PATH surface owner-private.
+            writeOwnerOnlyServiceManifest(plistPath, generateLaunchdPlist(agentsBin));
             try {
                 execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
             }
@@ -881,8 +923,9 @@ function startDaemonLocked(agentsBin) {
             if (!fs.existsSync(unitDir)) {
                 fs.mkdirSync(unitDir, { recursive: true });
             }
-            // May embed a long-lived OAuth token in an Environment= line; owner-only.
-            writeOwnerOnlyServiceManifest(unitPath, generateSystemdUnit(undefined, agentsBin));
+            // Carries no credential (RUSH-1759 — the daemon reads the OAuth token
+            // itself at startup); owner-only to keep the PATH/log surface private.
+            writeOwnerOnlyServiceManifest(unitPath, generateSystemdUnit(agentsBin));
             execFileSync('systemctl', ['--user', 'daemon-reload'], { encoding: 'utf-8' });
             execFileSync('systemctl', ['--user', 'enable', SYSTEMD_UNIT], { encoding: 'utf-8' });
             execFileSync('systemctl', ['--user', 'start', SYSTEMD_UNIT], { encoding: 'utf-8' });

package/dist/lib/devices/connect.d.ts

@@ -16,13 +16,30 @@ export declare function sshTargetFor(device: DeviceProfile): string;
  * login).
  */
 export declare function wrapRemoteCommand(device: DeviceProfile, cmd: string[]): string | undefined;
+/** Host-key posture for {@link buildSshInvocation}. */
+export interface SshHostKeyOptions {
+    /**
+     * True when the device's host key is already pinned in the managed
+     * known_hosts store — connections then verify with `StrictHostKeyChecking=yes`
+     * (a key swap is refused). False (the default) keeps `accept-new` for a
+     * genuine first enrollment, whose learned key lands in the managed store and
+     * pins the host for every subsequent connect. See {@link hostKeyCheckingOpts}.
+     */
+    pinned?: boolean;
+    /** Managed known_hosts path override (tests). Defaults to the CLI-managed store. */
+    knownHostsFile?: string;
+}
 /**
  * Build the argv (after the `ssh` program name) and the environment overlay
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at
  * the shim and disables pubkey + the host's interactive password prompt so the
  * shim is the only auth path. Pure (no spawn) so it is unit-testable.
+ *
+ * Host-key checking runs against the CLI-managed known_hosts store (never the
+ * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
+ * `accept-new` to learn+pin the key on first connect (RUSH-1767).
  */
-export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string): {
+export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions): {
     args: string[];
     env: Record<string, string>;
 };

package/dist/lib/devices/connect.js

@@ -18,6 +18,7 @@ import * as path from 'path';
 import { assertValidSshTarget, shellQuote } from '../ssh-exec.js';
 import { encodePwshBase64 } from '../pwsh.js';
 import { getCacheDir } from '../state.js';
+import { hostKeyCheckingOpts } from './known-hosts.js';
 import { hostNameFor } from './ssh-config.js';
 /** Env var the askpass shim reads to know which bundle holds the password. */
 export const ASKPASS_BUNDLE_ENV = 'AGENTS_SSH_BUNDLE';
@@ -57,12 +58,19 @@ export function wrapRemoteCommand(device, cmd) {
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at
  * the shim and disables pubkey + the host's interactive password prompt so the
  * shim is the only auth path. Pure (no spawn) so it is unit-testable.
+ *
+ * Host-key checking runs against the CLI-managed known_hosts store (never the
+ * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
+ * `accept-new` to learn+pin the key on first connect (RUSH-1767).
  */
-export function buildSshInvocation(device, cmd, askpassShimPath) {
+export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}) {
     const target = sshTargetFor(device);
     const remote = wrapRemoteCommand(device, cmd);
     const env = {};
-    const args = ['-o', 'StrictHostKeyChecking=accept-new', '-o', 'ConnectTimeout=10'];
+    const args = [
+        ...hostKeyCheckingOpts(hostKey.pinned ?? false, hostKey.knownHostsFile),
+        '-o', 'ConnectTimeout=10',
+    ];
     if (device.auth.method === 'password') {
         if (!device.auth.bundle) {
             throw new Error(`Device '${device.name}' uses password auth but has no secrets bundle. Set one with \`agents devices set ${device.name} --bundle <name>\`.`);

package/dist/lib/devices/fleet.d.ts

@@ -7,8 +7,8 @@
  * throws (misconfigured auth, etc.) become `failed` rows — they never abort
  * the remaining devices.
  */
-import type { DeviceProfile, DeviceRegistry } from './registry.js';
-export type FleetSkipReason = 'offline' | 'no-address';
+import { type DeviceProfile, type DeviceRegistry } from './registry.js';
+export type FleetSkipReason = 'offline' | 'no-address' | 'control';
 /** npm dist-tags / semver pins only — rejects shell metacharacters. */
 export declare const FLEET_VERSION_RE: RegExp;
 export interface FleetTarget {
@@ -27,6 +27,7 @@ export interface FleetRunResult {
 /**
  * Classify each registered device for a fleet operation.
  *
+ * - Control-only device (a cockpit, e.g. a paired iPhone) → skip `control`
  * - Tailscale-offline → skip `offline`
  * - No address → skip `no-address`
  * - Everything else is a target (including this machine, reached over ssh when

package/dist/lib/devices/fleet.js

@@ -8,12 +8,14 @@
  * the remaining devices.
  */
 import { spawnSync } from 'child_process';
+import { isControlDevice } from './registry.js';
 import { buildSshInvocation, sshTargetFor, writeAskpassShim } from './connect.js';
 /** npm dist-tags / semver pins only — rejects shell metacharacters. */
 export const FLEET_VERSION_RE = /^[A-Za-z0-9._-]+$/;
 /**
  * Classify each registered device for a fleet operation.
  *
+ * - Control-only device (a cockpit, e.g. a paired iPhone) → skip `control`
  * - Tailscale-offline → skip `offline`
  * - No address → skip `no-address`
  * - Everything else is a target (including this machine, reached over ssh when
@@ -23,6 +25,11 @@ export function planFleetTargets(reg) {
     const names = Object.keys(reg).sort();
     return names.map((name) => {
         const device = reg[name];
+        // A control device drives the fleet but never runs agents — never a target
+        // for update/run/stats, whatever its platform reads as.
+        if (isControlDevice(device)) {
+            return { device, skip: 'control' };
+        }
         if (device.tailscale && !device.tailscale.online) {
             return { device, skip: 'offline' };
         }
@@ -42,6 +49,8 @@ export function skipLabel(reason) {
             return 'offline';
         case 'no-address':
             return 'no address';
+        case 'control':
+            return 'control device';
     }
 }
 /**