@phnx-labs/agents-cli 1.20.65 → 1.20.66

package/dist/commands/ssh.js

@@ -27,6 +27,7 @@ import { clearPendingSentinel } from '../lib/devices/pending.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
+import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
 import { planFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
 import { fleetCapacity, fmtBytes, headroom, probeFleetStats, } from '../lib/devices/health.js';
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
@@ -558,7 +559,14 @@ secrets bundle via an askpass shim — the password never touches argv.
         }
         try {
             const shim = writeAskpassShim();
-            const { args, env } = buildSshInvocation(device, cmd, shim);
+            // Pin the host key on first connect and verify strictly thereafter: the
+            // managed known_hosts store must exist before ssh writes the learned key
+            // into it, and a host already recorded there is checked with
+            // StrictHostKeyChecking=yes (RUSH-1767).
+            ensureManagedKnownHostsDir();
+            const addr = hostNameFor(device);
+            const pinned = addr ? isHostPinned(addr) : false;
+            const { args, env } = buildSshInvocation(device, cmd, shim, { pinned });
             const res = spawnSync('ssh', args, {
                 stdio: 'inherit',
                 env: { ...process.env, ...env },

package/dist/index.js

@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadShare, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -667,6 +667,7 @@ async function registerEagerForRequest(name) {
  */
 async function registerAllEagerCommands() {
     await reg(loadView);
+    await reg(loadShare);
     await reg(loadInspect);
     await reg(loadFeedback);
     await reg(loadCommands);

package/dist/lib/agents.d.ts

@@ -164,6 +164,34 @@ export interface DroidAuthPayload {
  * in usage.ts.
  */
 export declare function decryptDroidAuthPayload(base: string): DroidAuthPayload | null;
+/**
+ * Decrypt a Droid `auth.v2.file` (AES-256-GCM `ivB64:tagB64:ctB64`) using the
+ * raw 32-byte key stored base64 in `auth.v2.key`, given the EXACT paths to both.
+ * Same crypto as decryptDroidAuthPayload but without the account-global HOME
+ * fallback, so the identity of a SPECIFIC version home resolves against only
+ * that home's files (carryForwardAuthFiles needs per-dir identity). Returns null
+ * on any failure (missing file/key, wrong key length, bad GCM tag, malformed
+ * JSON). Never throws.
+ */
+export declare function decryptDroidAuthFile(filePath: string, keyPath: string): DroidAuthPayload | null;
+/**
+ * Stable account identity for a *file-auth* agent's credential directory
+ * (droid / kimi / antigravity), or null when the directory holds no decodable
+ * account claim. Unlike a naive top-level JSON key-scan (which matched NO real
+ * credential file), this decrypts / decodes each agent's REAL on-disk format so
+ * the identity resolves against production credentials:
+ *   - droid: AES-256-GCM auth.v2.file (+ auth.v2.key) -> WorkOS access-token JWT
+ *     -> email / org_id / sub.
+ *   - kimi: credentials/kimi-code.json -> access-token JWT -> user_id / sub.
+ *   - antigravity: antigravity-oauth-token -> token.refresh_token -> JWT sub
+ *     when the token is a JWT, else the raw refresh-token value (opaque Google
+ *     consumer tokens are stable per login).
+ * Two directories for the SAME account compare equal; two DIFFERENT accounts
+ * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
+ * account's login with a credential that belongs to a DIFFERENT account
+ * (RUSH-1764). Never throws.
+ */
+export declare function readAuthAccountIdentity(agent: AgentId, configDir: string): string | null;
 /**
  * Antigravity (`agy`) stores its OAuth token via the Go keyring library
  * (zalando/go-keyring), which is platform-split:

package/dist/lib/agents.js

@@ -1036,6 +1036,18 @@ export function decryptDroidAuthPayload(base) {
     const keyPath = resolveAccountCredentialPath(base, '.factory', 'auth.v2.key');
     if (!filePath || !keyPath)
         return null;
+    return decryptDroidAuthFile(filePath, keyPath);
+}
+/**
+ * Decrypt a Droid `auth.v2.file` (AES-256-GCM `ivB64:tagB64:ctB64`) using the
+ * raw 32-byte key stored base64 in `auth.v2.key`, given the EXACT paths to both.
+ * Same crypto as decryptDroidAuthPayload but without the account-global HOME
+ * fallback, so the identity of a SPECIFIC version home resolves against only
+ * that home's files (carryForwardAuthFiles needs per-dir identity). Returns null
+ * on any failure (missing file/key, wrong key length, bad GCM tag, malformed
+ * JSON). Never throws.
+ */
+export function decryptDroidAuthFile(filePath, keyPath) {
     try {
         const blob = fs.readFileSync(filePath, 'utf-8').trim();
         const key = Buffer.from(fs.readFileSync(keyPath, 'utf-8').trim(), 'base64');
@@ -1057,6 +1069,62 @@ export function decryptDroidAuthPayload(base) {
         return null;
     }
 }
+/**
+ * Stable account identity for a *file-auth* agent's credential directory
+ * (droid / kimi / antigravity), or null when the directory holds no decodable
+ * account claim. Unlike a naive top-level JSON key-scan (which matched NO real
+ * credential file), this decrypts / decodes each agent's REAL on-disk format so
+ * the identity resolves against production credentials:
+ *   - droid: AES-256-GCM auth.v2.file (+ auth.v2.key) -> WorkOS access-token JWT
+ *     -> email / org_id / sub.
+ *   - kimi: credentials/kimi-code.json -> access-token JWT -> user_id / sub.
+ *   - antigravity: antigravity-oauth-token -> token.refresh_token -> JWT sub
+ *     when the token is a JWT, else the raw refresh-token value (opaque Google
+ *     consumer tokens are stable per login).
+ * Two directories for the SAME account compare equal; two DIFFERENT accounts
+ * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
+ * account's login with a credential that belongs to a DIFFERENT account
+ * (RUSH-1764). Never throws.
+ */
+export function readAuthAccountIdentity(agent, configDir) {
+    try {
+        switch (agent) {
+            case 'droid': {
+                const payload = decryptDroidAuthFile(path.join(configDir, 'auth.v2.file'), path.join(configDir, 'auth.v2.key'));
+                const claims = typeof payload?.access_token === 'string' ? decodeJwtPayload(payload.access_token) : null;
+                if (!claims)
+                    return null;
+                return buildIdentityKey(agent, [
+                    ['email', normalizeIdentityPart(claims.email)],
+                    ['org', normalizeIdentityPart(claims.org_id ?? payload?.active_organization_id)],
+                    ['sub', normalizeIdentityPart(claims.sub)],
+                ]);
+            }
+            case 'kimi': {
+                const data = JSON.parse(fs.readFileSync(path.join(configDir, 'credentials', 'kimi-code.json'), 'utf-8'));
+                const accessToken = data?.access_token;
+                const claims = typeof accessToken === 'string' ? decodeJwtPayload(accessToken) : null;
+                return buildIdentityKey(agent, [
+                    ['user', normalizeIdentityPart(claims?.user_id ?? claims?.sub)],
+                ]);
+            }
+            case 'antigravity': {
+                const data = JSON.parse(fs.readFileSync(path.join(configDir, 'antigravity-oauth-token'), 'utf-8'));
+                const refreshToken = data?.token?.refresh_token;
+                if (typeof refreshToken !== 'string' || !refreshToken)
+                    return null;
+                const claims = decodeJwtPayload(refreshToken);
+                const sub = normalizeIdentityPart(claims?.sub ?? claims?.user_id);
+                return buildIdentityKey(agent, [['sub', sub ?? refreshToken]]);
+            }
+            default:
+                return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Derive Droid account identity from the decrypted credential. The
  * `access_token` is a WorkOS JWT carrying an `email` claim (plus org_id /

package/dist/lib/devices/connect.d.ts

@@ -16,13 +16,30 @@ export declare function sshTargetFor(device: DeviceProfile): string;
  * login).
  */
 export declare function wrapRemoteCommand(device: DeviceProfile, cmd: string[]): string | undefined;
+/** Host-key posture for {@link buildSshInvocation}. */
+export interface SshHostKeyOptions {
+    /**
+     * True when the device's host key is already pinned in the managed
+     * known_hosts store — connections then verify with `StrictHostKeyChecking=yes`
+     * (a key swap is refused). False (the default) keeps `accept-new` for a
+     * genuine first enrollment, whose learned key lands in the managed store and
+     * pins the host for every subsequent connect. See {@link hostKeyCheckingOpts}.
+     */
+    pinned?: boolean;
+    /** Managed known_hosts path override (tests). Defaults to the CLI-managed store. */
+    knownHostsFile?: string;
+}
 /**
  * Build the argv (after the `ssh` program name) and the environment overlay
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at
  * the shim and disables pubkey + the host's interactive password prompt so the
  * shim is the only auth path. Pure (no spawn) so it is unit-testable.
+ *
+ * Host-key checking runs against the CLI-managed known_hosts store (never the
+ * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
+ * `accept-new` to learn+pin the key on first connect (RUSH-1767).
  */
-export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string): {
+export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions): {
     args: string[];
     env: Record<string, string>;
 };

package/dist/lib/devices/connect.js

@@ -18,6 +18,7 @@ import * as path from 'path';
 import { assertValidSshTarget, shellQuote } from '../ssh-exec.js';
 import { encodePwshBase64 } from '../pwsh.js';
 import { getCacheDir } from '../state.js';
+import { hostKeyCheckingOpts } from './known-hosts.js';
 import { hostNameFor } from './ssh-config.js';
 /** Env var the askpass shim reads to know which bundle holds the password. */
 export const ASKPASS_BUNDLE_ENV = 'AGENTS_SSH_BUNDLE';
@@ -57,12 +58,19 @@ export function wrapRemoteCommand(device, cmd) {
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at
  * the shim and disables pubkey + the host's interactive password prompt so the
  * shim is the only auth path. Pure (no spawn) so it is unit-testable.
+ *
+ * Host-key checking runs against the CLI-managed known_hosts store (never the
+ * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
+ * `accept-new` to learn+pin the key on first connect (RUSH-1767).
  */
-export function buildSshInvocation(device, cmd, askpassShimPath) {
+export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}) {
     const target = sshTargetFor(device);
     const remote = wrapRemoteCommand(device, cmd);
     const env = {};
-    const args = ['-o', 'StrictHostKeyChecking=accept-new', '-o', 'ConnectTimeout=10'];
+    const args = [
+        ...hostKeyCheckingOpts(hostKey.pinned ?? false, hostKey.knownHostsFile),
+        '-o', 'ConnectTimeout=10',
+    ];
     if (device.auth.method === 'password') {
         if (!device.auth.bundle) {
             throw new Error(`Device '${device.name}' uses password auth but has no secrets bundle. Set one with \`agents devices set ${device.name} --bundle <name>\`.`);

package/dist/lib/devices/known-hosts.d.ts

@@ -0,0 +1,62 @@
+/** Path to the CLI-managed known_hosts store (created lazily, mode 0600). */
+export declare function managedKnownHostsPath(): string;
+/** Ensure the parent directory of the managed store exists (mode 0700). */
+export declare function ensureManagedKnownHostsDir(file?: string): void;
+/** Read the managed store, or '' when it does not exist yet. */
+export declare function readManagedKnownHosts(file?: string): string;
+/**
+ * True if `host` has at least one pinned key line in `content`. Pure (content
+ * in) so the match logic is unit-testable without touching disk. Matching is
+ * case-insensitive on the hostname, as OpenSSH does.
+ */
+export declare function isHostPinnedIn(content: string, host: string): boolean;
+/** True if `host` is pinned in the managed store on disk. */
+export declare function isHostPinned(host: string, file?: string): boolean;
+/**
+ * The host-key-checking ssh options for a connection.
+ *
+ * Always points `UserKnownHostsFile` at the managed store so learned and pinned
+ * keys live in exactly one CLI-owned file. `StrictHostKeyChecking` is `yes` once
+ * the host is pinned (a key swap is refused) and `accept-new` before that
+ * (genuine first enrollment learns the key into the managed store, which pins it
+ * for every subsequent connect). Pure given `pinned`, so the policy is testable.
+ */
+export declare function hostKeyCheckingOpts(pinned: boolean, file?: string): string[];
+/**
+ * The key lines in `scanned` (ssh-keyscan output) not already present in
+ * `existing`. Comments and blank lines are dropped; whitespace is normalized so
+ * a re-scan of an already-pinned key is a no-op. Pure, so the idempotent-append
+ * contract is unit-testable without spawning ssh-keyscan.
+ */
+export declare function newKnownHostsLines(existing: string, scanned: string): string[];
+export interface PinResult {
+    /** True if the host is pinned in the managed store after this call. */
+    pinned: boolean;
+    /** How many new key lines were appended. */
+    added: number;
+}
+/**
+ * Merge `ssh-keyscan` output for `host` into the managed store at `file`,
+ * idempotently, and report whether `host` is pinned afterward. Split out from
+ * {@link pinHostKey} so the store-write half — the part that decides a scanned
+ * key now counts as pinned — is unit-testable with real keyscan text and no
+ * network (the spawn stays in `pinHostKey`).
+ */
+export declare function recordScannedKeys(host: string, scanned: string, file?: string): PinResult;
+/**
+ * `ssh-keyscan` a host at a trusted moment and append any new key lines to the
+ * managed store, idempotently. This is the explicit pin path; the implicit one
+ * is a normal `accept-new` connection whose learned key lands in the same store.
+ * Returns whether the host is pinned afterward.
+ *
+ * Host-name-agnostic: it scans whatever address it is handed, so it also pins a
+ * host `agents ssh` can't reach — notably a bare `~/.ssh/config` `Host` alias,
+ * which is not a registered device. The `--copy-creds` gate (commands/exec.ts)
+ * calls this for exactly that case so the credential copy is usable for
+ * ssh-config-alias hosts (RUSH-1767).
+ */
+export declare function pinHostKey(host: string, opts?: {
+    file?: string;
+    timeoutMs?: number;
+    port?: number;
+}): PinResult;

package/dist/lib/devices/known-hosts.js

@@ -0,0 +1,137 @@
+/**
+ * Managed known_hosts pinning for the device fleet (RUSH-1767).
+ *
+ * The shared SSH baseline uses `StrictHostKeyChecking=accept-new`
+ * (trust-on-first-use): it silently accepts whatever key answers on the FIRST
+ * connect, so a machine-in-the-middle present in that window is trusted forever
+ * and never re-checked. This module gives the CLI its own known_hosts store,
+ * kept apart from the user's `~/.ssh/known_hosts`, so a device's host key can be
+ * *pinned*: once a key is recorded here, connections verify against it with
+ * `StrictHostKeyChecking=yes`, so a later key swap is refused instead of
+ * silently re-accepted.
+ *
+ * The learn-then-pin flow: the first `agents ssh`/fleet connection to a host is
+ * still `accept-new`, but it writes the learned key into THIS store, which pins
+ * it for every subsequent connect. Credential copies (`run --host --copy-creds`)
+ * refuse to run against a host that isn't pinned here — see
+ * `commands/exec.ts` — so tokens never ride an unverified first connect.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { spawnSync } from 'child_process';
+import { getCacheDir } from '../state.js';
+import { assertValidSshTarget } from '../ssh-exec.js';
+import { parseKnownHosts } from '../hosts/ssh-config.js';
+/** Path to the CLI-managed known_hosts store (created lazily, mode 0600). */
+export function managedKnownHostsPath() {
+    return path.join(getCacheDir(), 'devices', 'known_hosts');
+}
+/** Ensure the parent directory of the managed store exists (mode 0700). */
+export function ensureManagedKnownHostsDir(file = managedKnownHostsPath()) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+}
+/** Read the managed store, or '' when it does not exist yet. */
+export function readManagedKnownHosts(file = managedKnownHostsPath()) {
+    try {
+        return fs.readFileSync(file, 'utf-8');
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * True if `host` has at least one pinned key line in `content`. Pure (content
+ * in) so the match logic is unit-testable without touching disk. Matching is
+ * case-insensitive on the hostname, as OpenSSH does.
+ */
+export function isHostPinnedIn(content, host) {
+    const needle = host.trim().toLowerCase();
+    if (!needle)
+        return false;
+    return parseKnownHosts(content).some((h) => h.toLowerCase() === needle);
+}
+/** True if `host` is pinned in the managed store on disk. */
+export function isHostPinned(host, file = managedKnownHostsPath()) {
+    return isHostPinnedIn(readManagedKnownHosts(file), host);
+}
+/**
+ * The host-key-checking ssh options for a connection.
+ *
+ * Always points `UserKnownHostsFile` at the managed store so learned and pinned
+ * keys live in exactly one CLI-owned file. `StrictHostKeyChecking` is `yes` once
+ * the host is pinned (a key swap is refused) and `accept-new` before that
+ * (genuine first enrollment learns the key into the managed store, which pins it
+ * for every subsequent connect). Pure given `pinned`, so the policy is testable.
+ */
+export function hostKeyCheckingOpts(pinned, file = managedKnownHostsPath()) {
+    return [
+        '-o', `UserKnownHostsFile=${file}`,
+        '-o', `StrictHostKeyChecking=${pinned ? 'yes' : 'accept-new'}`,
+    ];
+}
+/**
+ * The key lines in `scanned` (ssh-keyscan output) not already present in
+ * `existing`. Comments and blank lines are dropped; whitespace is normalized so
+ * a re-scan of an already-pinned key is a no-op. Pure, so the idempotent-append
+ * contract is unit-testable without spawning ssh-keyscan.
+ */
+export function newKnownHostsLines(existing, scanned) {
+    const have = new Set(existing.split('\n').map((l) => l.trim()).filter(Boolean));
+    const seen = new Set();
+    const fresh = [];
+    for (const raw of scanned.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || have.has(line) || seen.has(line))
+            continue;
+        seen.add(line);
+        fresh.push(line);
+    }
+    return fresh;
+}
+/**
+ * Merge `ssh-keyscan` output for `host` into the managed store at `file`,
+ * idempotently, and report whether `host` is pinned afterward. Split out from
+ * {@link pinHostKey} so the store-write half — the part that decides a scanned
+ * key now counts as pinned — is unit-testable with real keyscan text and no
+ * network (the spawn stays in `pinHostKey`).
+ */
+export function recordScannedKeys(host, scanned, file = managedKnownHostsPath()) {
+    ensureManagedKnownHostsDir(file);
+    const existing = readManagedKnownHosts(file);
+    const fresh = newKnownHostsLines(existing, scanned);
+    if (fresh.length > 0) {
+        const prefix = existing && !existing.endsWith('\n') ? '\n' : '';
+        fs.appendFileSync(file, prefix + fresh.join('\n') + '\n', { mode: 0o600 });
+    }
+    return { pinned: isHostPinned(host, file), added: fresh.length };
+}
+/**
+ * `ssh-keyscan` a host at a trusted moment and append any new key lines to the
+ * managed store, idempotently. This is the explicit pin path; the implicit one
+ * is a normal `accept-new` connection whose learned key lands in the same store.
+ * Returns whether the host is pinned afterward.
+ *
+ * Host-name-agnostic: it scans whatever address it is handed, so it also pins a
+ * host `agents ssh` can't reach — notably a bare `~/.ssh/config` `Host` alias,
+ * which is not a registered device. The `--copy-creds` gate (commands/exec.ts)
+ * calls this for exactly that case so the credential copy is usable for
+ * ssh-config-alias hosts (RUSH-1767).
+ */
+export function pinHostKey(host, opts = {}) {
+    // Same injection guard as sshExec: a host starting with `-` (or carrying shell
+    // metacharacters) must never reach ssh-keyscan as a bare argv where it could
+    // be parsed as a flag.
+    assertValidSshTarget(host);
+    const file = opts.file ?? managedKnownHostsPath();
+    const timeoutMs = opts.timeoutMs ?? 8000;
+    ensureManagedKnownHostsDir(file);
+    const args = ['-T', String(Math.max(1, Math.ceil(timeoutMs / 1000)))];
+    if (opts.port)
+        args.push('-p', String(opts.port));
+    args.push(host);
+    const res = spawnSync('ssh-keyscan', args, { encoding: 'utf-8', timeout: timeoutMs });
+    if (res.status !== 0 || !res.stdout) {
+        return { pinned: isHostPinned(host, file), added: 0 };
+    }
+    return recordScannedKeys(host, res.stdout, file);
+}

package/dist/lib/hosts/dispatch.js

@@ -17,6 +17,7 @@ import { resolveRemoteOsSync } from './remote-os.js';
 import { saveTask, updateTask, terminalPatch } from './tasks.js';
 import { followHostTask } from './progress.js';
 import { wrapHostCommandWithCredentials } from './credentials.js';
+import { hostKeyCheckingOpts } from '../devices/known-hosts.js';
 // Use $HOME (not ~) so the path is correct whether or not it's quoted and
 // regardless of the run's cwd. Task ids are 8 hex chars, so these paths are
 // injection-safe to interpolate unquoted into remote commands.
@@ -180,10 +181,19 @@ async function launchDetached(host, target, opts) {
     if (opts.copyCreds) {
         inner = wrapHostCommandWithCredentials(inner, opts.copyCreds);
     }
+    // When credentials ride this launch, verify the host key strictly against the
+    // managed pin (the gate in exec.ts already required the host to be pinned) and
+    // force a fresh connection — reusing a control socket opened by an earlier
+    // accept-new connection would bypass the strict check (RUSH-1767).
+    const credHostKeyOpts = opts.copyCreds ? hostKeyCheckingOpts(true) : undefined;
     // Outer: ensure dir, launch the login-shell wrapper as a new process-group
     // leader, and print that leader PID.
     const launch = `mkdir -p ${REMOTE_DIR}; ${buildDetachedLaunchCommand(inner)}`;
-    const res = sshExec(target, launch, { timeoutMs: 30000, multiplex: true });
+    const res = sshExec(target, launch, {
+        timeoutMs: 30000,
+        multiplex: !opts.copyCreds,
+        hostKeyOpts: credHostKeyOpts,
+    });
     if (res.code !== 0) {
         throw new Error(`Failed to launch on "${host.name}": ${(res.stderr || res.stdout).trim() || 'ssh error'}`);
     }
@@ -362,7 +372,15 @@ export async function runInteractiveOnHost(host, opts) {
     if (opts.copyCreds) {
         remoteCmd = wrapHostCommandWithCredentials(remoteCmd, opts.copyCreds);
     }
-    return sshStream(target, remoteCmd, { tty: process.stdin.isTTY, multiplex: true });
+    // Credentials ride this stream when --copy-creds is set: verify the host key
+    // strictly against the managed pin and force a fresh connection so a stale
+    // accept-new control socket can't bypass the check (RUSH-1767).
+    const credHostKeyOpts = opts.copyCreds ? hostKeyCheckingOpts(true) : undefined;
+    return sshStream(target, remoteCmd, {
+        tty: process.stdin.isTTY,
+        multiplex: !opts.copyCreds,
+        hostKeyOpts: credHostKeyOpts,
+    });
 }
 /** Dispatch an `agents run <agent> "<prompt>"` onto a host (the `run --host` path). */
 export async function dispatchToHost(host, opts) {

package/dist/lib/hosts/remote-cmd.js

@@ -227,12 +227,16 @@ export function buildWindowsAgentsCommand(cmd) {
  */
 export function buildWindowsStdinImportCommand(bundle, opts = {}) {
     const force = opts.force ? ' --force' : '';
+    // Create AND write the temp file INSIDE the try so its finally always cleans
+    // up: if GetTempFileName succeeds but WriteAllText (or the import) then throws,
+    // the secret-bearing temp file would otherwise be left behind (RUSH-1764). $tmp
+    // starts null so a GetTempFileName that itself throws leaves nothing to remove.
     const script = [
         '$in = [Console]::In.ReadToEnd()',
-        '$tmp = [System.IO.Path]::GetTempFileName()',
-        '[System.IO.File]::WriteAllText($tmp, $in)',
-        `try { & agents secrets import ${powershellQuote(bundle)} --from $tmp${force}; $code = $LASTEXITCODE } ` +
-            `finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }`,
+        '$tmp = $null',
+        `try { $tmp = [System.IO.Path]::GetTempFileName(); [System.IO.File]::WriteAllText($tmp, $in); ` +
+            `& agents secrets import ${powershellQuote(bundle)} --from $tmp${force}; $code = $LASTEXITCODE } ` +
+            `finally { if ($tmp) { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue } }`,
         'if ($null -eq $code) { $code = 1 }',
         'exit $code',
     ].join('; ');

package/dist/lib/monitors/engine.js

@@ -170,6 +170,10 @@ export class MonitorEngine {
             const windowMs = parseInterval(monitor.rateLimit.per) ?? 60_000;
             fireTimes = recordFireTime(monitor.name, now, windowMs);
             if (fireTimes.length > monitor.rateLimit.max) {
+                // Record the tripped event in fire history too, so `agents monitors runs`
+                // reflects what `view`'s `lastFiredAt` shows — the firehose event the guard
+                // exists to surface must not be invisible in the fire log.
+                writeFireRecord(event, { action: monitor.action.type, ok: false, error: 'rate limited — auto-paused' });
                 writeState(monitor.name, decision.value, decision.dedupeKey, { lastFiredAt: event.firedAt, fireTimes });
                 try {
                     setMonitorEnabled(monitor.name, false);

package/dist/lib/monitors/sources/device.js

@@ -18,9 +18,19 @@ export async function evaluate(source) {
     const registry = await loadDevices();
     const wanted = normalizeHost(name);
     const entry = Object.entries(registry).find(([k]) => normalizeHost(k) === wanted);
-    const stats = entry && normalizeHost(entry[0]) !== machineId()
-        ? await probeDeviceStats(entry[1])
-        : await probeLocalStats(name);
+    // An unregistered / removed device must NOT silently fall back to the local
+    // machine's stats — that would watch the wrong box under the requested name
+    // (the "no fallback logic" convention). `add` validates --watch-device up
+    // front, so this catches the device-removed-after-creation case at eval time.
+    if (!entry) {
+        return {
+            raw: `error\tdevice not registered: ${name}`,
+            meta: { error: true, reachable: false, device: name },
+        };
+    }
+    const stats = normalizeHost(entry[0]) === machineId()
+        ? await probeLocalStats(name)
+        : await probeDeviceStats(entry[1]);
     const bucket = headroom(stats);
     return {
         raw: `${stats.reachable ? 'reachable' : 'unreachable'}\t${bucket}`,

package/dist/lib/picker.d.ts

@@ -52,3 +52,56 @@ export declare function itemPicker<T>(config: PickerConfig<T>): Promise<PickedIt
  * row, so a quick single-pick still works.
  */
 export declare function multiItemPicker<T>(config: MultiPickerConfig<T>): Promise<T[] | null>;
+/** Configuration for the dynamic (async-refetch) picker prompt. */
+export interface DynamicPickerConfig<T, F> {
+    message: string;
+    /** The initial filter state. Changing it (via a keybinding) re-runs {@link load}. */
+    initialFilter: F;
+    /** Async loader for the current filter state. Its result is the row pool. */
+    load: (filter: F) => Promise<T[]>;
+    labelFor: (item: T, query: string) => string;
+    /** Stable identity for an item (used for the active-row cursor across reloads). */
+    keyFor: (item: T) => string;
+    /** Client-side text filter over the loaded pool (the `S` search). */
+    matches?: (item: T, query: string) => boolean;
+    buildPreview?: (item: T) => string;
+    /** Dim summary of the current filter state, rendered in the header. */
+    headerFor?: (filter: F) => string;
+    /** The hotkey-legend help line; receives the mode so it can adapt. */
+    helpFor?: (filter: F, mode: 'nav' | 'search') => string;
+    /**
+     * Single-key bindings (by key name) that transform the filter. Returning the
+     * SAME reference is a no-op; a new object triggers a reload.
+     */
+    keyBindings?: Record<string, (filter: F) => F>;
+    /**
+     * Side-effecting keys that don't change the filter (e.g. `y` copies a command).
+     * Receives the live search `query` so the effect can be search-aware. Return a
+     * short string to flash under the list.
+     */
+    onKey?: (name: string, filter: F, active: T | undefined, query: string) => string | void;
+    /** Key that enters search mode (default `s`). */
+    searchKey?: string;
+    /** Key that toggles the preview pane (default `tab`). */
+    previewKey?: string;
+    pageSize?: number;
+    emptyMessage?: string;
+    loadingMessage?: string;
+    enterHint?: string;
+}
+/** The result returned when the user selects a row: the item plus the live filter. */
+export interface DynamicPicked<T, F> {
+    item: T;
+    filter: F;
+}
+/**
+ * Async-refetch variant of {@link itemPicker}. Holds a `filter` object in state and
+ * re-runs `load(filter)` whenever a keybinding mutates it (with a loading placeholder
+ * while the fetch — e.g. an SSH fleet fan-out — is in flight). A separate `S` search
+ * mode filters the loaded pool client-side. `enter` returns the active row + the live
+ * filter; `esc` cancels (from search mode, `esc` first exits search).
+ *
+ * Same render/pagination/preview machinery as the static pickers — only the data
+ * source and keymap are dynamic.
+ */
+export declare function dynamicPicker<T, F>(config: DynamicPickerConfig<T, F>): Promise<DynamicPicked<T, F> | null>;