@phnx-labs/agents-cli 1.20.66 → 1.20.68

package/dist/lib/daemon.d.ts

@@ -6,6 +6,7 @@
  * (macOS), systemd (Linux), or as a plain detached process. PID tracking,
  * log output, reload (SIGHUP), and graceful shutdown are handled here.
  */
+import { getAgentsBinPath } from './cli-entry.js';
 /** Read the stored daemon PID from disk. Returns null if not present or invalid. */
 export declare function readDaemonPid(): number | null;
 /** Write the daemon PID to the pid file. */
@@ -101,7 +102,7 @@ export declare function generateLaunchdPlist(agentsBin?: string): string;
  * store and never touches the unit file.
  */
 export declare function generateSystemdUnit(agentsBin?: string): string;
-export declare function getAgentsBinPath(argv1?: string | undefined, execPath?: string): string;
+export { getAgentsBinPath };
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(agentsBin?: string): {
     pid: number | null;
@@ -201,4 +202,3 @@ export declare function getDaemonStatus(): {
 export declare function readDaemonLog(lines?: number): string;
 /** Send SIGHUP to the daemon to trigger a job reload. */
 export declare function signalDaemonReload(): boolean;
-export {};

package/dist/lib/daemon.js

@@ -21,6 +21,7 @@ import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { readAndResolveBundleEnv } from './secrets/bundles.js';
 import { redactSecrets } from './redact.js';
+import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from './cli-entry.js';
 const PID_FILE = 'daemon.pid';
 const LOCK_FILE = 'daemon.lock';
 const LOG_FILE = 'logs.jsonl';
@@ -781,47 +782,11 @@ Environment=PATH=${daemonNodeBinDir()}:/usr/local/bin:/usr/bin:/bin
 [Install]
 WantedBy=default.target`;
 }
-const BUN_VIRTUAL_ROOT = /[/\\]\$bunfs[/\\]root[/\\]/;
-function resolveBunStandaloneEntry(entry, execPath) {
-    if (!BUN_VIRTUAL_ROOT.test(entry))
-        return entry;
-    if (!execPath || BUN_VIRTUAL_ROOT.test(execPath) || !fs.existsSync(execPath)) {
-        throw new Error(`Cannot resolve agents CLI: Bun standalone executable not found at ${execPath || '(empty path)'}`);
-    }
-    return execPath;
-}
-export function getAgentsBinPath(argv1 = process.argv[1], execPath = process.execPath) {
-    // Prefer the binary actively executing this code. `which agents` returns
-    // whatever happens to be first on PATH, which means a side-by-side dev
-    // build at ~/.local/bin would silently spawn the registry-installed
-    // daemon and run stale code. For a JS install, process.argv[1] is the
-    // absolute entrypoint the user actually invoked. A Bun standalone instead
-    // exposes its embedded /$bunfs/root entry at argv[1] and its physical signed
-    // executable at process.execPath; Bun reports both as existing paths.
-    const runningEntry = argv1 ? resolveBunStandaloneEntry(argv1, execPath) : undefined;
-    if (runningEntry && fs.existsSync(runningEntry)) {
-        // The package's browser/computer entrypoints are sibling shims without a
-        // `daemon` command. A daemon started as their IPC side effect must launch
-        // through the main agents entrypoint instead of replaying the shim path.
-        const entryName = path.basename(runningEntry);
-        const compiledShim = /^(browser|computer)\.(c|m)?js$/.test(entryName);
-        const installedShim = /^(browser|computer)$/.test(entryName);
-        if (compiledShim || installedShim) {
-            const agentsEntry = path.join(path.dirname(runningEntry), compiledShim ? 'index.js' : 'agents');
-            if (!fs.existsSync(agentsEntry)) {
-                throw new Error(`Cannot start agents daemon: main CLI entry not found at ${agentsEntry}`);
-            }
-            return agentsEntry;
-        }
-        return runningEntry;
-    }
-    try {
-        return execFileSync('which', ['agents'], { encoding: 'utf-8' }).trim();
-    }
-    catch {
-        return 'agents';
-    }
-}
+// Binary-resolution helpers (getAgentsBinPath / isNodeScriptEntry / getCliLaunch)
+// live in ./cli-entry.js — a leaf module the secrets broker also imports without
+// forming a cycle. Re-exported so existing `from './daemon.js'` importers of
+// getAgentsBinPath keep resolving.
+export { getAgentsBinPath };
 /**
  * Ask the service manager for the daemon's live PID. Used as a fallback when
  * the daemon hasn't yet written its pid file but launchd/systemd already report
@@ -980,49 +945,7 @@ export function getDaemonLaunch(agentsBin = getAgentsBinPath()) {
     const { warnings } = validateDaemonBinary(agentsBin);
     for (const w of warnings)
         process.stderr.write(`[agents] ${w}\n`);
-    if (isNodeScriptEntry(agentsBin)) {
-        return { command: process.execPath, args: [agentsBin, 'daemon', '_run'] };
-    }
-    return { command: agentsBin, args: ['daemon', '_run'] };
-}
-/**
- * A daemon entry must be launched through the Node runtime when it is a Node
- * script — a `.js`/`.cjs`/`.mjs` file, OR a symlink/extension-less shim whose
- * shebang names `node`. Package installs link `bin/agents` to a `dist/index.js`
- * (a symlink) or drop an extension-less `#!/usr/bin/env node` shim, so an
- * extension check alone misses them and they get run directly. Executing such an
- * entry then relies on the shebang resolving `node` off the daemon's PATH — and
- * when that PATH points at a pruned nvm version (or an ancient system node), the
- * daemon crash-loops at import (`node:util` has no `styleText` on Node 18). A
- * real compiled binary (Mach-O/ELF/PE) has no `#!node` shebang, so it takes the
- * direct branch and owns its own runtime resolution.
- */
-function isNodeScriptEntry(agentsBin) {
-    let resolved = agentsBin;
-    try {
-        resolved = fs.realpathSync(agentsBin);
-    }
-    catch {
-        // Unresolvable (e.g. a template path that does not exist on this box): fall
-        // back to the extension check on the path as given.
-    }
-    if (/\.(c|m)?js$/.test(resolved))
-        return true;
-    try {
-        const fd = fs.openSync(resolved, 'r');
-        try {
-            const buf = Buffer.alloc(128);
-            const n = fs.readSync(fd, buf, 0, 128, 0);
-            const firstLine = buf.toString('utf-8', 0, n).split('\n', 1)[0];
-            return firstLine.startsWith('#!') && /\bnode\b/.test(firstLine);
-        }
-        finally {
-            fs.closeSync(fd);
-        }
-    }
-    catch {
-        return false;
-    }
+    return getCliLaunch(['daemon', '_run'], agentsBin);
 }
 /**
  * The directory of the Node runtime that generated this service manifest, kept
@@ -1050,11 +973,7 @@ function daemonNodeBinDir() {
  * getAgentsBinPath() resolves that virtual entry to the physical process.execPath.
  */
 export function getAgentsInvocation(subArgs, agentsBin = getAgentsBinPath()) {
-    const resolvedBin = resolveBunStandaloneEntry(agentsBin, process.execPath);
-    if (/\.(c|m)?js$/.test(resolvedBin)) {
-        return { command: process.execPath, args: [resolvedBin, ...subArgs] };
-    }
-    return { command: resolvedBin, args: subArgs };
+    return getCliLaunch(subArgs, agentsBin);
 }
 export function validateDaemonBinary(binPath) {
     const warnings = [];

package/dist/lib/devices/fleet.d.ts

@@ -24,6 +24,17 @@ export interface FleetRunResult {
     /** Truncated combined stderr/stdout for failures. */
     detail?: string;
 }
+export interface FanOutDeviceTarget {
+    name: string;
+    skip?: FleetSkipReason | string;
+}
+export interface FanOutDeviceResult<T> {
+    name: string;
+    status: 'ok' | 'failed' | 'skipped';
+    value?: T;
+    error?: string;
+    reason?: FleetSkipReason | string;
+}
 /**
  * Classify each registered device for a fleet operation.
  *
@@ -34,6 +45,16 @@ export interface FleetRunResult {
  *   it has a registry address — same path as any other box).
  */
 export declare function planFleetTargets(reg: DeviceRegistry): FleetTarget[];
+/**
+ * Remote fan-out targets for the fleet health/drift gates (`fleet status`,
+ * `check --devices`): every planned device except this machine and control-only
+ * cockpits. A control device never runs agents (mirrors doctor's fan-out, which
+ * drops it via `isControlDevice`), so counting it as unreachable/drift would make
+ * the CI gate fail on every run for a fleet that merely has a cockpit registered.
+ * Offline / no-address devices are kept — those are genuine faults a gate should
+ * surface — so their `skip` reason still flows through as an `unreachable` row.
+ */
+export declare function remoteFleetTargets(planned: FleetTarget[], self: string): FleetTarget[];
 /** Human label for a skip reason. */
 export declare function skipLabel(reason: FleetSkipReason): string;
 /**
@@ -61,3 +82,5 @@ export declare function upgradeCommand(version?: string): string[];
  * the runner are recorded as `failed` so one bad device never aborts the rest.
  */
 export declare function runFleet(targets: FleetTarget[], cmd: string[], runner?: typeof runOnDevice): FleetRunResult[];
+/** Run one async probe per device in parallel, preserving input order. */
+export declare function fanOutDevices<T, Target extends FanOutDeviceTarget = FanOutDeviceTarget>(targets: Target[], probe: (target: Target) => Promise<T>): Promise<FanOutDeviceResult<T>[]>;

package/dist/lib/devices/fleet.js

@@ -42,6 +42,18 @@ export function planFleetTargets(reg) {
         return { device };
     });
 }
+/**
+ * Remote fan-out targets for the fleet health/drift gates (`fleet status`,
+ * `check --devices`): every planned device except this machine and control-only
+ * cockpits. A control device never runs agents (mirrors doctor's fan-out, which
+ * drops it via `isControlDevice`), so counting it as unreachable/drift would make
+ * the CI gate fail on every run for a fleet that merely has a cockpit registered.
+ * Offline / no-address devices are kept — those are genuine faults a gate should
+ * surface — so their `skip` reason still flows through as an `unreachable` row.
+ */
+export function remoteFleetTargets(planned, self) {
+    return planned.filter((t) => t.device.name !== self && t.skip !== 'control');
+}
 /** Human label for a skip reason. */
 export function skipLabel(reason) {
     switch (reason) {
@@ -135,3 +147,29 @@ export function runFleet(targets, cmd, runner = runOnDevice) {
     }
     return results;
 }
+/** Run one async probe per device in parallel, preserving input order. */
+export async function fanOutDevices(targets, probe) {
+    return Promise.all(targets.map(async (target) => {
+        if (target.skip) {
+            return {
+                name: target.name,
+                status: 'skipped',
+                reason: target.skip,
+            };
+        }
+        try {
+            return {
+                name: target.name,
+                status: 'ok',
+                value: await probe(target),
+            };
+        }
+        catch (err) {
+            return {
+                name: target.name,
+                status: 'failed',
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }));
+}

package/dist/lib/devices/health-report.d.ts

@@ -0,0 +1,46 @@
+import { type DeviceStats } from './health.js';
+export interface FleetCliStatus {
+    installed: boolean;
+    path: string | null;
+    error: string | null;
+}
+export interface FleetSyncStatus {
+    agent: string;
+    version: string;
+    status: 'fresh' | 'stale' | 'never-synced';
+    isDefault: boolean;
+    divergence?: string[];
+}
+export interface FleetOrphanStatus {
+    agent: string;
+    version: string;
+    commands: number;
+    skills: number;
+    hooks: number;
+}
+export interface FleetHealthRow {
+    name: string;
+    platform?: string;
+    version?: string | null;
+    stats?: DeviceStats;
+    error?: string;
+    skipped?: string;
+    clis: Record<string, FleetCliStatus>;
+    sync: FleetSyncStatus[];
+    orphans: FleetOrphanStatus[];
+}
+export interface FleetWarning {
+    kind: 'unreachable' | 'drift' | 'cli' | 'version-skew';
+    devices: string[];
+    message: string;
+}
+export interface FleetHealthReport {
+    generatedAt: string;
+    devices: FleetHealthRow[];
+    warnings: FleetWarning[];
+    hasWarnings: boolean;
+    hasDrift: boolean;
+}
+export declare function buildFleetHealthReport(rows: FleetHealthRow[], now?: Date): FleetHealthReport;
+export declare function renderFleetWarnings(report: FleetHealthReport): string[];
+export declare function renderFleetMatrix(report: FleetHealthReport): string[];

package/dist/lib/devices/health-report.js

@@ -0,0 +1,159 @@
+import chalk from 'chalk';
+import { padToWidth, terminalWidth, truncateToWidth } from '../session/width.js';
+import { fmtBytes, headroom } from './health.js';
+function driftRows(row) {
+    return row.sync.filter((s) => s.status !== 'fresh');
+}
+function installedCliCount(row) {
+    const statuses = Object.values(row.clis);
+    return {
+        installed: statuses.filter((s) => s.installed).length,
+        total: statuses.length,
+    };
+}
+export function buildFleetHealthReport(rows, now = new Date()) {
+    const warnings = [];
+    const unreachable = rows
+        .filter((r) => r.error || r.skipped)
+        .map((r) => r.name);
+    if (unreachable.length > 0) {
+        warnings.push({
+            kind: 'unreachable',
+            devices: unreachable,
+            message: `${unreachable.length} device${unreachable.length === 1 ? '' : 's'} unreachable or skipped`,
+        });
+    }
+    const drifted = rows.filter((r) => driftRows(r).length > 0).map((r) => r.name);
+    if (drifted.length > 0) {
+        warnings.push({
+            kind: 'drift',
+            devices: drifted,
+            message: `${drifted.length} device${drifted.length === 1 ? '' : 's'} have sync drift`,
+        });
+    }
+    const cliIssues = rows
+        .filter((r) => {
+        const counts = installedCliCount(r);
+        return counts.total > 0 && counts.installed < counts.total;
+    })
+        .map((r) => r.name);
+    if (cliIssues.length > 0) {
+        warnings.push({
+            kind: 'cli',
+            devices: cliIssues,
+            message: `${cliIssues.length} device${cliIssues.length === 1 ? ' is' : 's are'} missing one or more agent CLIs`,
+        });
+    }
+    const versions = new Map();
+    for (const row of rows) {
+        if (!row.version)
+            continue;
+        const list = versions.get(row.version) ?? [];
+        list.push(row.name);
+        versions.set(row.version, list);
+    }
+    if (versions.size > 1) {
+        warnings.push({
+            kind: 'version-skew',
+            devices: rows.filter((r) => r.version).map((r) => r.name),
+            message: `agents-cli version skew: ${Array.from(versions.keys()).sort().join(', ')}`,
+        });
+    }
+    return {
+        generatedAt: now.toISOString(),
+        devices: rows,
+        warnings,
+        hasWarnings: warnings.length > 0,
+        hasDrift: drifted.length > 0 || unreachable.length > 0,
+    };
+}
+function statusGlyph(row) {
+    if (row.error || row.skipped)
+        return chalk.red('○');
+    if (driftRows(row).length > 0)
+        return chalk.yellow('◐');
+    return chalk.green('●');
+}
+function headroomLabel(row) {
+    const h = headroom(row.stats);
+    switch (h) {
+        case 'idle':
+            return chalk.green('idle');
+        case 'light':
+            return chalk.green('light');
+        case 'busy':
+            return chalk.yellow('busy');
+        case 'loaded':
+            return chalk.red('loaded');
+        case 'unknown':
+            return chalk.gray('unknown');
+    }
+}
+function driftLabel(row) {
+    if (row.error)
+        return chalk.red('probe failed');
+    if (row.skipped)
+        return chalk.gray(row.skipped);
+    const drift = driftRows(row);
+    if (drift.length === 0)
+        return chalk.green('fresh');
+    const stale = drift.filter((r) => r.status === 'stale').length;
+    const cold = drift.filter((r) => r.status === 'never-synced').length;
+    const parts = [];
+    if (stale)
+        parts.push(`${stale} stale`);
+    if (cold)
+        parts.push(`${cold} cold`);
+    return chalk.yellow(parts.join(' · '));
+}
+function cliLabel(row) {
+    if (row.error || row.skipped)
+        return chalk.gray('-');
+    const { installed, total } = installedCliCount(row);
+    if (total === 0)
+        return chalk.gray('none');
+    return installed === total ? chalk.green(`${installed}/${total}`) : chalk.yellow(`${installed}/${total}`);
+}
+function loadLabel(stats) {
+    if (!stats?.reachable)
+        return chalk.gray('-');
+    const load = stats.loadPercent === undefined ? '-' : `${Math.round(stats.loadPercent)}%`;
+    const mem = stats.memPercent === undefined ? '-' : `${Math.round(stats.memPercent)}%`;
+    return `${load}/${mem}`;
+}
+export function renderFleetWarnings(report) {
+    if (report.warnings.length === 0)
+        return [chalk.green('Fleet warnings: none')];
+    return [
+        chalk.bold(`Fleet warnings (${report.warnings.length})`),
+        ...report.warnings.map((w) => `  ${chalk.yellow(w.kind.padEnd(12))} ${w.message} ${chalk.gray(`(${w.devices.join(', ')})`)}`),
+    ];
+}
+export function renderFleetMatrix(report) {
+    if (report.devices.length === 0)
+        return [chalk.gray('No registered devices. Run `agents devices` to register some.')];
+    const nameW = Math.min(22, Math.max(6, ...report.devices.map((r) => r.name.length)));
+    const versionW = Math.min(14, Math.max(7, ...report.devices.map((r) => (r.version ?? '-').length)));
+    const width = terminalWidth();
+    // 4 = leading "  " + the per-row status glyph + its trailing space (rows prefix
+    // `  ${statusGlyph} `; the header reserves the same 4 cols so every column lines up).
+    const fixed = 4 + nameW + 2 + 8 + 2 + 9 + 2 + 9 + 2 + versionW + 2 + 9 + 2 + 9;
+    const noteW = Math.max(12, width - fixed);
+    const lines = [
+        chalk.bold('Fleet status'),
+        chalk.gray(`    ${padToWidth('Device', nameW)}  ${padToWidth('OS', 8)}  ${padToWidth('Health', 9)}  ${padToWidth('Sync', 9)}  ${padToWidth('CLI', 9)}  ${padToWidth('Version', versionW)}  ${padToWidth('Load/Mem', 9)}  Note`),
+    ];
+    for (const row of report.devices) {
+        const note = row.error ?? row.skipped ?? (row.orphans.length > 0 ? `${row.orphans.length} orphaned version${row.orphans.length === 1 ? '' : 's'}` : '');
+        lines.push(`  ${statusGlyph(row)} ${padToWidth(truncateToWidth(row.name, nameW), nameW)}  ` +
+            `${padToWidth(truncateToWidth(row.platform ?? '-', 8), 8)}  ` +
+            `${padToWidth(headroomLabel(row), 9)}  ` +
+            `${padToWidth(driftLabel(row), 9)}  ` +
+            `${padToWidth(cliLabel(row), 9)}  ` +
+            `${padToWidth(truncateToWidth(row.version ?? '-', versionW), versionW)}  ` +
+            `${padToWidth(loadLabel(row.stats), 9)}  ` +
+            chalk.gray(truncateToWidth(note || `free ${fmtBytes(row.stats?.memFreeBytes)}`, noteW)));
+    }
+    lines.push(chalk.gray('  ● fresh · ◐ drift · ○ unreachable/skipped'));
+    return lines;
+}

package/dist/lib/devices/health.d.ts

@@ -2,9 +2,10 @@
  * Device resource probing for `agents devices list`.
  *
  * One SSH round-trip per device gathers load average, memory pressure, and core
- * count (mac + linux), parsed into a {@link DeviceStats}. Probes run in parallel
- * with a bounded timeout so the list stays responsive — a slow or hung box
- * degrades to "no stats" instead of blocking the whole table.
+ * count (mac + linux via a POSIX snippet, windows via a CIM one-liner), parsed
+ * into a {@link DeviceStats}. Probes run in parallel with a bounded timeout so
+ * the list stays responsive — a slow or hung box degrades to "no stats" instead
+ * of blocking the whole table.
  *
  * The parsers are pure and unit-tested (health.test.ts). They mirror the ones in
  * the Factory extension (apps/factory/src/core/deviceHealth.ts) — kept as a
@@ -14,12 +15,17 @@ import type { DeviceProfile } from './registry.js';
 /** Default per-device probe budget. Short enough that the list never hangs on a
  * wedged box, long enough for a cold relayed SSH handshake. */
 export declare const PROBE_TIMEOUT_MS = 2500;
+/** Windows probe budget. The first CIM query of a PowerShell session pays a
+ * "Preparing modules for first use" cost on top of PowerShell startup, which
+ * routinely blows the 2.5s POSIX budget on a relayed connection. */
+export declare const WIN_PROBE_TIMEOUT_MS = 6000;
 export interface DeviceStats {
     host: string;
     reachable: boolean;
     loadAvg1?: number;
     ncpu?: number;
-    /** loadAvg1 / ncpu * 100 — load normalized to core count (the "has room" number). */
+    /** Load normalized to core count (the "has room" number): loadAvg1 / ncpu *
+     * 100 on mac/linux, CPU utilization % directly on windows (no loadAvg1). */
     loadPercent?: number;
     memPercent?: number;
     memTotalBytes?: number;
@@ -43,6 +49,10 @@ export declare function parseNcpu(out: string): {
 };
 /** Assemble a DeviceStats from the three snippet sections. */
 export declare function parseProbeOutput(host: string, stdout: string, fetchedAt: number): DeviceStats;
+/** Assemble a DeviceStats from the windows one-liner. A missing marker line
+ * (e.g. CIM unavailable) keeps `reachable: true` — ssh answered — with no
+ * numbers, mirroring how garbage POSIX output degrades. */
+export declare function parseWinProbeOutput(host: string, stdout: string, fetchedAt: number): DeviceStats;
 export interface FleetCapacity {
     reachable: number;
     cores: number;

package/dist/lib/devices/health.js

@@ -2,9 +2,10 @@
  * Device resource probing for `agents devices list`.
  *
  * One SSH round-trip per device gathers load average, memory pressure, and core
- * count (mac + linux), parsed into a {@link DeviceStats}. Probes run in parallel
- * with a bounded timeout so the list stays responsive — a slow or hung box
- * degrades to "no stats" instead of blocking the whole table.
+ * count (mac + linux via a POSIX snippet, windows via a CIM one-liner), parsed
+ * into a {@link DeviceStats}. Probes run in parallel with a bounded timeout so
+ * the list stays responsive — a slow or hung box degrades to "no stats" instead
+ * of blocking the whole table.
  *
  * The parsers are pure and unit-tested (health.test.ts). They mirror the ones in
  * the Factory extension (apps/factory/src/core/deviceHealth.ts) — kept as a
@@ -15,10 +16,21 @@ import { buildSshInvocation, writeAskpassShim } from './connect.js';
 /** Default per-device probe budget. Short enough that the list never hangs on a
  * wedged box, long enough for a cold relayed SSH handshake. */
 export const PROBE_TIMEOUT_MS = 2_500;
+/** Windows probe budget. The first CIM query of a PowerShell session pays a
+ * "Preparing modules for first use" cost on top of PowerShell startup, which
+ * routinely blows the 2.5s POSIX budget on a relayed connection. */
+export const WIN_PROBE_TIMEOUT_MS = 6_000;
 const SEP = '---AGSTAT---';
 /** One-shot remote snapshot: load, then memory (mac vm_stat else linux
  * meminfo), then core count (linux nproc else mac hw.ncpu). */
 const PROBE_SNIPPET = `uptime; echo ${SEP}; (vm_stat 2>/dev/null || cat /proc/meminfo 2>/dev/null); echo ${SEP}; (nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null)`;
+/** Windows equivalent, one labeled line via CIM. PowerShell 5.1-safe: no `||`
+ * chaining, plain string concatenation. `LoadPercentage` is $null on some
+ * hosts/VMs, which concatenates to an empty field — the parser treats that as
+ * "no load signal" and headroom falls back to memory pressure alone.
+ * wrapRemoteCommand base64-encodes this for powershell-shell devices, so the
+ * quoting survives ssh intact. */
+const WIN_PROBE_SNIPPET = `$os = Get-CimInstance Win32_OperatingSystem; $cpu = (Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average; Write-Output ('AGWINSTAT load=' + $cpu + ' freeKb=' + $os.FreePhysicalMemory + ' totalKb=' + $os.TotalVisibleMemorySize + ' ncpu=' + $env:NUMBER_OF_PROCESSORS)`;
 /** Compact human byte size: 512M, 64G, 1.5T (binary units, ≤1 decimal). */
 export function fmtBytes(bytes) {
     if (bytes === undefined || !Number.isFinite(bytes) || bytes < 0)
@@ -106,6 +118,28 @@ export function parseProbeOutput(host, stdout, fetchedAt) {
         fetchedAt,
     };
 }
+/** Assemble a DeviceStats from the windows one-liner. A missing marker line
+ * (e.g. CIM unavailable) keeps `reachable: true` — ssh answered — with no
+ * numbers, mirroring how garbage POSIX output degrades. */
+export function parseWinProbeOutput(host, stdout, fetchedAt) {
+    const m = stdout.match(/AGWINSTAT load=([0-9.]*) freeKb=([0-9]+) totalKb=([0-9]+) ncpu=([0-9]+)/);
+    if (!m)
+        return { host, reachable: true, fetchedAt };
+    const loadPercent = m[1] === '' ? undefined : parseFloat(m[1]);
+    const freeKb = parseInt(m[2], 10);
+    const totalKb = parseInt(m[3], 10);
+    const ncpu = parseInt(m[4], 10);
+    return {
+        host,
+        reachable: true,
+        ncpu: Number.isFinite(ncpu) && ncpu > 0 ? ncpu : undefined,
+        loadPercent: loadPercent !== undefined && Number.isFinite(loadPercent) ? loadPercent : undefined,
+        memPercent: totalKb > 0 ? Math.max(0, Math.min(100, ((totalKb - freeKb) / totalKb) * 100)) : undefined,
+        memTotalBytes: totalKb > 0 ? totalKb * 1024 : undefined,
+        memFreeBytes: totalKb > 0 ? freeKb * 1024 : undefined,
+        fetchedAt,
+    };
+}
 /** Sum cores and memory across reachable devices for the summary footer. */
 export function fleetCapacity(statsList) {
     const cap = { reachable: 0, cores: 0, memTotalBytes: 0, memFreeBytes: 0 };
@@ -139,6 +173,7 @@ export function headroom(stats) {
 export function probeDeviceStats(device, opts = {}) {
     const host = device.name;
     const fetchedAt = opts.now ?? Date.now();
+    const isWin = device.shell === 'powershell';
     let args;
     let env;
     try {
@@ -146,16 +181,21 @@ export function probeDeviceStats(device, opts = {}) {
         // buildSshInvocation joins the cmd with spaces and hands the string to the
         // remote login shell, which evaluates the snippet's `;`/`||` directly — no
         // `sh -c` wrapper needed (and a wrapper would only re-quote the first token).
-        ({ args, env } = buildSshInvocation(device, [PROBE_SNIPPET], shim));
+        // For powershell devices it base64-encodes the snippet instead.
+        ({ args, env } = buildSshInvocation(device, [isWin ? WIN_PROBE_SNIPPET : PROBE_SNIPPET], shim));
     }
     catch {
         return Promise.resolve({ host, reachable: false, fetchedAt });
     }
     return new Promise((resolve) => {
-        execFile('ssh', args, { encoding: 'utf-8', env: { ...process.env, ...env }, timeout: opts.timeoutMs ?? PROBE_TIMEOUT_MS }, (err, stdout) => {
+        execFile('ssh', args, {
+            encoding: 'utf-8',
+            env: { ...process.env, ...env },
+            timeout: opts.timeoutMs ?? (isWin ? WIN_PROBE_TIMEOUT_MS : PROBE_TIMEOUT_MS),
+        }, (err, stdout) => {
             if (err || !stdout)
                 return resolve({ host, reachable: false, fetchedAt });
-            resolve(parseProbeOutput(host, stdout, fetchedAt));
+            resolve(isWin ? parseWinProbeOutput(host, stdout, fetchedAt) : parseProbeOutput(host, stdout, fetchedAt));
         });
     });
 }
@@ -164,11 +204,12 @@ export function probeDeviceStats(device, opts = {}) {
  * from itself. */
 export function probeLocalStats(host, opts = {}) {
     const fetchedAt = opts.now ?? Date.now();
+    const isWin = process.platform === 'win32';
     return new Promise((resolve) => {
-        execFile('sh', ['-c', PROBE_SNIPPET], { encoding: 'utf-8', timeout: opts.timeoutMs ?? PROBE_TIMEOUT_MS }, (err, stdout) => {
+        execFile(isWin ? 'powershell' : 'sh', isWin ? ['-NoProfile', '-Command', WIN_PROBE_SNIPPET] : ['-c', PROBE_SNIPPET], { encoding: 'utf-8', timeout: opts.timeoutMs ?? (isWin ? WIN_PROBE_TIMEOUT_MS : PROBE_TIMEOUT_MS) }, (err, stdout) => {
             if (err || !stdout)
                 return resolve({ host, reachable: false, fetchedAt });
-            resolve(parseProbeOutput(host, stdout, fetchedAt));
+            resolve(isWin ? parseWinProbeOutput(host, stdout, fetchedAt) : parseProbeOutput(host, stdout, fetchedAt));
         });
     });
 }

package/dist/lib/exec.d.ts

@@ -52,6 +52,21 @@ export declare function headlessPlanStallCommand(args: {
  *   explicitly asked to bypass permissions; pretending we did is unsafe.
  */
 export declare function resolveMode(agent: AgentId, requested: Mode): Mode;
+/**
+ * Resolve a requested mode for a run, honoring whether the run is HEADLESS.
+ *
+ * Wraps resolveMode with one extra rule: an agent may list `plan` in its modes
+ * (so interactive plan works) yet declare `capabilities.headlessPlan === false`
+ * because plan is broken in a headless `--prompt`/`-p` run — kimi refuses
+ * `--prompt` + `--plan`, and grok's `--permission-mode plan` silently stalls at
+ * its ExitPlanMode gate. For those agents, a headless plan request degrades to
+ * `auto` (kimi -p auto-runs; grok maps auto→edit via resolveMode) with a visible
+ * one-line stderr warning, mirroring the graceful plan→edit degrade cursor and
+ * antigravity get for having no plan flag at all. Interactive runs are never
+ * downgraded. This is the single source of truth shared by buildExecCommand
+ * (agents run / teams) and the routine runner.
+ */
+export declare function resolveHeadlessMode(agent: AgentId, requested: Mode, interactive: boolean): Mode;
 /**
  * The mode an agent should run in when the caller has no preference.
  *