@phnx-labs/agents-cli 1.20.69 → 1.20.70

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.20.70
+
+- **Fix `agents setup computer` / `agents computer setup` refusing to install a
+  valid downloaded helper.** The signature check read `codesign -dv` from stdout,
+  but that command writes its details to **stderr** on success — so the Team-ID
+  check saw an empty string, found no `TeamIdentifier`, and rejected every
+  validly-signed, notarized helper with "signed by unexpected Team (none)". It now
+  reads both streams via `spawnSync`. Verified end-to-end against the real
+  published `v1.20.69` release asset (download → sha256 → extract → codesign +
+  Team `2HTP252L87` + `spctl` notarization → install). Source:
+  `apps/cli/src/lib/computer/download.ts`.
+
+- **The bundled macOS menu-bar helper is now a true universal binary on
+  Xcode-less release hosts.** `menubar/scripts/build.sh release` used
+  `swift build --arch arm64 --arch x86_64` (needs Xcode's xcbuild) and, on a
+  Command-Line-Tools-only host, silently fell back to a **single-arch** build —
+  shipping an arm64-only `MenubarHelper.app` in the tarball that could not run on
+  Intel Macs. It now builds each slice via `--triple` and `lipo`s them into one
+  universal binary, matching the computer helper. Source:
+  `apps/cli/menubar/scripts/build.sh`.
+
 ## 1.20.69
 
 - **Choose a safe account with `agents run <agent>@`.** A trailing `@` opens a

package/README.md

@@ -432,13 +432,15 @@ agents sync --host gpu-box              # make the remote machine current
 agents doctor --devices                 # readiness matrix for every registered device
 agents doctor --devices --json          # machine-readable fleet readiness
 agents doctor --device mac-mini         # same matrix, scoped to one device
-agents fleet status                     # warnings rollup + health/sync/version matrix
+agents fleet status                     # warnings rollup + health/sync/version/Auth matrix (cache-first)
+agents fleet status --live              # force a live resource probe (alias of --refresh)
 agents fleet status --json --strict     # scriptable fleet health gate
 agents check --devices                  # CI drift gate across every registered device
 
 # Your Tailscale fleet, auto-discovered
 agents devices sync                     # ingest `tailscale status`
-agents devices list                     # fleet + live headroom: load, mem, idle/busy — which box has room
+agents devices list                     # fleet + headroom: load, mem, idle/busy — which box has room (cache-first)
+agents devices list --live              # force a live probe of every device (alias of --refresh)
 agents devices list --full              # add per-device cores and free/total RAM
 agents devices list --no-stats          # instant: names/addresses only, skip the probe
 agents ssh mac-mini                     # hardened SSH: fails fast if offline,
@@ -453,11 +455,22 @@ agents cloud run "nightly benchmark" --host gpu-box --agent claude   # task in c
 agents routines add nightly -s "0 2 * * *" -a claude -p "run the sweep" --run-on gpu-box
 ```
 
-`agents devices list` probes every reachable box in parallel (bounded timeout, so a
-slow node degrades to `—` instead of hanging) and shows normalized load, memory
-pressure, and an idle/light/busy/loaded headroom badge, plus a fleet-capacity summary
+`agents devices list` shows normalized load, memory pressure, and an
+idle/light/busy/loaded headroom badge, plus a fleet-capacity summary
 (`164 cores · 421G free / 518G RAM`). It answers "which machine has room right now?" —
-the utilization signal the teammate scheduler doesn't yet see.
+the utilization signal the teammate scheduler doesn't yet see. It's **cache-first**:
+reads serve instantly from a stats cache the daemon warms (~every 3 min), probing only
+this machine locally plus any device missing from the cache; pass `--refresh` (or the
+shorter `--live`) to force a full live probe of every box. Cache-served output notes its
+age (`updated 2m ago — pass --refresh (--live) for a live probe`).
+
+`agents fleet status` adds an **Auth column** — which agent accounts are actually
+logged in, per device, read from the auth-health cache (no network). Four buckets keep
+it from crying wolf: `●live` (verified), `·present` (signed in but the agent has no
+live-probe endpoint — e.g. codex/grok — benign), `◐degraded` (soft/self-healing:
+expired-but-refreshing, rate-limited), and `○revoked` (server rejected — re-login now).
+Only `○` means a real re-login is needed. Run `agents fleet ping` to force a live
+re-verification across the fleet.
 
 **Hosts** (`agents hosts`) are git-synced dispatch targets in `agents.yaml`; **devices** (`agents devices`) are your Tailscale machines in a local registry. Both ride SSH and feed one host pool: devices appear in `agents hosts list` and capability routing without a second enrollment. On `--host` runs every `agents run` option is either forwarded (`--effort --env --timeout --loop …`), rejected loud (`--secrets` never crosses SSH implicitly), or consumed locally — nothing silently drops. See [docs/00-concepts.md](apps/cli/docs/00-concepts.md#devices--hosts).
 

package/dist/commands/doctor.js

@@ -14,6 +14,7 @@ import { getGlobalDefault, getVersionHomePath, isVersionInstalled, listInstalled
 import { loadManifest, isStale } from '../lib/staleness/index.js';
 import { diffVersionResources, DOCTOR_ALL_KINDS, } from '../lib/doctor-diff.js';
 import { checkSyncStatus, countOrphans } from '../lib/drift.js';
+import { readAuthHealthCache, summarizeHostAuth } from '../lib/auth-health.js';
 import { unifiedDiff, colorizeUnifiedDiff } from '../lib/diff-text.js';
 import { listCliStatus } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
@@ -741,6 +742,10 @@ export function registerDoctorCommand(program) {
                 console.log(JSON.stringify({
                     clis,
                     signIn,
+                    // Cached auth-health rollup for THIS host — lets `agents fleet status`
+                    // show a live-verified Auth column from the same fan-out it already
+                    // runs, without a separate fleet-wide `fleet ping`.
+                    auth: summarizeHostAuth(readAuthHealthCache(), machineId()),
                     sync: syncRows,
                     orphans: orphanRows,
                     hostClis: {

package/dist/commands/ssh.js

@@ -31,14 +31,15 @@ import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassSh
 import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
 import { shouldSyncTerminfo, syncTerminfoToDevice, terminfoHostKey } from '../lib/devices/terminfo.js';
 import { fanOutDevices, planFleetTargets, remoteFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
-import { fleetCapacity, fmtBytes, headroom, probeLocalStats, probeFleetStats, } from '../lib/devices/health.js';
+import { fleetCapacity, fmtBytes, headroom, } from '../lib/devices/health.js';
 import { buildFleetHealthReport, renderFleetMatrix, renderFleetWarnings, } from '../lib/devices/health-report.js';
+import { loadFleetStats, readStatsCache } from '../lib/devices/stats-cache.js';
 import { checkSyncStatus, countOrphans } from '../lib/drift.js';
 import { checkAllClis } from '../lib/teams/agents.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
-import { formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, summarizeVerdicts, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
+import { formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, readAuthHealthCache, summarizeHostAuth, summarizeVerdicts, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
  * command is running on so it stands out from the rest of the tailnet. */
 function deviceSummary(d, isSelf = false) {
@@ -256,19 +257,23 @@ async function probeRemoteHealth(target) {
         clis: parsed.clis ?? {},
         sync: parsed.sync ?? [],
         orphans: parsed.orphans ?? [],
+        // The remote self-reports its own cached auth rollup (fresh via its daemon),
+        // so the Auth column is current without a prior fleet-wide `fleet ping`.
+        // Older remotes that don't emit it fall back to this host's cache below.
+        auth: parsed.auth,
     };
 }
 async function runFleetStatus(opts) {
     const reg = await loadDevices();
     const self = machineId();
+    const forceRefresh = Boolean(opts.refresh || opts.live);
     const planned = planFleetTargets(reg);
     const probeable = planned.filter((t) => !t.skip).map((t) => t.device);
+    // Cache-first: serve remote stats from the daemon-warmed cache (instant),
+    // probe this machine locally, and only ssh out for missing/forced rows.
     const statsMap = opts.stats === false
         ? new Map()
-        : await probeFleetStats(probeable, { selfName: self });
-    if (opts.stats !== false && !statsMap.has(self)) {
-        statsMap.set(self, await probeLocalStats(self));
-    }
+        : (await loadFleetStats(probeable, { forceRefresh, selfName: self })).stats;
     const rows = [localHealthRow(self, statsMap.get(self))];
     const remoteTargets = remoteFleetTargets(planned, self)
         .map((t) => ({
@@ -300,6 +305,15 @@ async function runFleetStatus(opts) {
             });
         }
     }
+    // Auth column: remote rows already carry the host's self-reported rollup from
+    // its `doctor --json`. Fill the rest (this machine; older remotes that don't
+    // emit it) from this host's local cache — written by `agents fleet ping` and
+    // the daemon's local refresh. A never-probed host rolls up to "—". No network.
+    const authCache = readAuthHealthCache();
+    for (const row of rows) {
+        if (!row.auth)
+            row.auth = summarizeHostAuth(authCache, row.name);
+    }
     const report = buildFleetHealthReport(rows);
     if (opts.json) {
         console.log(JSON.stringify(report, null, 2));
@@ -550,6 +564,8 @@ Typical workflow:
         .description('List registered devices with platform, address, reachability, and live resource headroom.')
         .option('--json', 'output the registry as a JSON array (for scripts and hooks)')
         .option('--no-stats', 'skip the live resource probe (instant; names/addresses only)')
+        .option('--refresh', 'force a live probe of every device, bypassing the cache')
+        .option('--live', 'alias of --refresh (shorter to type)')
         .option('-f, --full', 'full mode: add per-device core count and free/total memory')
         .action(async (opts) => {
         const reg = await loadDevices();
@@ -564,18 +580,26 @@ Typical workflow:
             return;
         }
         const self = machineId();
+        const forceRefresh = Boolean(opts.refresh || opts.live);
         let statsMap;
+        let freshness;
         if (opts.stats !== false) {
-            // Probe only reachable devices, in parallel, bounded by the per-probe
-            // timeout — a slow box degrades to "—", it never hangs the table.
+            // Cache-first: serve remote devices from the daemon-warmed cache
+            // (instant), probe this machine locally, and only ssh out for missing or
+            // forced (--refresh/--live) rows — so a warm read never hangs on a box.
             const probeable = planFleetTargets(reg)
                 .filter((t) => !t.skip)
                 .map((t) => t.device);
-            const spinner = isInteractiveTerminal()
+            // Only spin when we'll actually ssh (forced, or a cold/partial cache).
+            const cache = readStatsCache();
+            const willSsh = forceRefresh || probeable.some((d) => d.name !== self && !cache[d.name]);
+            const spinner = willSsh && isInteractiveTerminal()
                 ? ora(`Probing ${probeable.length} device${probeable.length === 1 ? '' : 's'}…`).start()
                 : undefined;
             try {
-                statsMap = await probeFleetStats(probeable, { selfName: self });
+                const res = await loadFleetStats(probeable, { forceRefresh, selfName: self });
+                statsMap = res.stats;
+                freshness = res;
             }
             finally {
                 spinner?.stop();
@@ -584,6 +608,9 @@ Typical workflow:
         console.log(chalk.bold(`Devices (${names.length})`));
         for (const line of renderDeviceTable(reg, names, self, statsMap, opts.full))
             console.log(line);
+        if (freshness?.servedFromCache && freshness.oldestFetchedAt != null) {
+            console.log(chalk.gray(`  updated ${formatCheckedAge(freshness.oldestFetchedAt)} — pass --refresh (--live) for a live probe`));
+        }
     });
     devicesCmd
         .command('status')
@@ -591,6 +618,8 @@ Typical workflow:
         .option('--json', 'output machine-readable JSON')
         .option('--strict', 'exit non-zero when any device has drift or is unreachable')
         .option('--no-stats', 'skip the live resource probe')
+        .option('--refresh', 'force a live probe of every device, bypassing the cache')
+        .option('--live', 'alias of --refresh (shorter to type)')
         .action(async (opts) => {
         await runFleetStatus(opts);
     });

package/dist/commands/view.d.ts

@@ -123,6 +123,7 @@ export declare function viewAction(agentArg?: string, options?: {
     resources?: string | boolean;
     detailed?: boolean;
     refresh?: boolean;
+    live?: boolean;
 } & ViewSectionFilter): Promise<void>;
 /** Register the `agents view` command. */
 export declare function registerViewCommand(program: Command): void;

package/dist/commands/view.js

@@ -1400,6 +1400,8 @@ export async function pruneDuplicates(filterAgentId, yes, dryRun) {
  * Exported for use by deprecated aliases.
  */
 export async function viewAction(agentArg, options) {
+    // --live is a shorter-to-type alias of --refresh; both force a live probe.
+    const forceRefresh = options?.refresh === true || options?.live === true;
     // --resources / --detailed imply --json (they only shape structured output).
     const explicitResources = options?.detailed === true || options?.resources !== undefined;
     const json = options?.json === true || explicitResources;
@@ -1440,7 +1442,7 @@ export async function viewAction(agentArg, options) {
             return;
         }
         // No argument: show all installed versions
-        await showInstalledVersions(undefined, { forceRefresh: options?.refresh === true });
+        await showInstalledVersions(undefined, { forceRefresh });
         return;
     }
     // Parse agent@version syntax
@@ -1501,7 +1503,7 @@ export async function viewAction(agentArg, options) {
     }
     else {
         // Just agent name: show versions for that agent
-        await showInstalledVersions(agentId, { forceRefresh: options?.refresh === true });
+        await showInstalledVersions(agentId, { forceRefresh });
     }
 }
 /** Register the `agents view` command. */
@@ -1512,6 +1514,7 @@ export function registerViewCommand(program) {
         .option('--resources [sections]', 'In --json mode, include each version\'s resources: "all" (default) or a comma list (skills,plugins,mcp,commands,workflows,memory,hooks). Implies --json.')
         .option('--detailed', 'Include all resources in --json output (alias for --resources all). Implies --json.')
         .option('-r, --refresh', 'Force a live usage refresh, bypassing the cache (slower). Repopulates the S:/W: limit bars for every account whose token is reachable.')
+        .option('--live', 'Alias of --refresh (shorter to type).')
         .option('--prune', 'Remove older installed versions that share an account with a newer installed version. Skips the global default.')
         .option('--dry-run', 'With --prune, show duplicate versions without deleting')
         .option('-y, --yes', 'Skip the prune confirmation prompt.')

package/dist/lib/auth-health.d.ts

@@ -49,6 +49,44 @@ export interface VerdictSummary {
 export declare function summarizeVerdicts(verdicts: AuthVerdict[]): VerdictSummary;
 /** Verdicts that mean "this token was rejected by the server — re-login required". */
 export declare function isDeadVerdict(verdict: AuthVerdict): boolean;
+/**
+ * A host's rolled-up auth state for the `fleet status` Auth column.
+ *
+ * The four display buckets are deliberately finer-grained than
+ * {@link VerdictSummary}'s live/bad/warn: they separate "present but this agent
+ * has no live probe" (`unverified`) and "soft, self-healing expiry"
+ * (`expired`/`rate_limited`) from a genuine server rejection (`revoked`). The
+ * old three-bucket rollup lumped all of those into `warn` and the column painted
+ * them one alarming yellow — so a fleet of perfectly logged-in accounts on
+ * codex/grok/etc (which can NEVER be probed live) read as half-degraded. These
+ * buckets let the renderer show `unverified` as neutral and reserve red for the
+ * only verdict that actually means "re-login now" ({@link isDeadVerdict}).
+ */
+export interface HostAuthSummary {
+    /** Live-verified accounts (a real 2xx). */
+    live: number;
+    /** Signed in but this agent has no live-probe endpoint — benign, neutral. */
+    present: number;
+    /** Soft/degraded: expired (self-healing) / rate_limited / error. Mild warning. */
+    degraded: number;
+    /** Server rejected the token — genuinely needs re-login. */
+    revoked: number;
+    /** Total cached rows for this host (0 → the renderer shows "—"). */
+    total: number;
+    /** Oldest `checkedAt` (epoch ms) among this host's cached rows, or null when none. */
+    oldestCheckedAt: number | null;
+}
+/**
+ * Roll every cached (agent, version) row for one host into a {@link HostAuthSummary}
+ * plus the age of its stalest entry. Pure — reads the map the caller already
+ * loaded via {@link readAuthHealthCache}, so `fleet status` renders the Auth
+ * column without any network probe. A host with no cached rows yields an empty
+ * summary (total 0), which the renderer shows as "—".
+ *
+ * Keys are `host:agent:version` ({@link authCacheKey}); we match on the `host:`
+ * prefix so agent/version segments can never be mistaken for a host.
+ */
+export declare function summarizeHostAuth(cache: Record<string, AuthHealth>, host: string): HostAuthSummary;
 /** Human "3m ago" style age for a checkedAt timestamp. */
 export declare function formatCheckedAge(checkedAt: number, now?: number): string;
 /**

package/dist/lib/auth-health.js

@@ -5,9 +5,12 @@
  * The rest of the CLI reports "signed in" from a local heuristic — a credential
  * file is present and its email decodes — which cannot distinguish a good token
  * from a revoked-but-unexpired one. This module completes a real request per
- * (agent, account) and records the verdict in a small cache that `agents view`,
- * `agents fleet status`, and the run rotation all read. The daemon and
- * `agents fleet ping` are the writers; everyone else reads.
+ * (agent, account) and records the verdict in a small cache that `agents view`
+ * (per-version chip), `agents fleet status` (the per-host Auth column, via
+ * {@link summarizeHostAuth}), and the run rotation all read. The writers are
+ * the daemon (a periodic local refresh) and `agents fleet ping` (which also
+ * fans out to write remote hosts' rows into the local cache); everyone else
+ * reads.
  *
  * The network probes themselves live in lib/usage.ts (where the per-provider
  * token loaders + endpoints already are); this module classifies their result,
@@ -95,6 +98,48 @@ export function summarizeVerdicts(verdicts) {
 export function isDeadVerdict(verdict) {
     return verdict === 'revoked';
 }
+/**
+ * Roll every cached (agent, version) row for one host into a {@link HostAuthSummary}
+ * plus the age of its stalest entry. Pure — reads the map the caller already
+ * loaded via {@link readAuthHealthCache}, so `fleet status` renders the Auth
+ * column without any network probe. A host with no cached rows yields an empty
+ * summary (total 0), which the renderer shows as "—".
+ *
+ * Keys are `host:agent:version` ({@link authCacheKey}); we match on the `host:`
+ * prefix so agent/version segments can never be mistaken for a host.
+ */
+export function summarizeHostAuth(cache, host) {
+    const prefix = `${host}:`;
+    let live = 0, present = 0, degraded = 0, revoked = 0, total = 0;
+    let oldest = null;
+    for (const [key, health] of Object.entries(cache)) {
+        if (!key.startsWith(prefix))
+            continue;
+        // `unconfigured` = no credential at all — not a probed account. Writers
+        // already drop these before they reach the cache; skip here too so a stray
+        // one never counts toward total or the freshness age (belt-and-suspenders).
+        if (health.verdict === 'unconfigured')
+            continue;
+        total++;
+        switch (health.verdict) {
+            case 'live':
+                live++;
+                break;
+            case 'unverified':
+                present++;
+                break; // signed in, no probe — benign
+            case 'revoked':
+                revoked++;
+                break; // server said no — re-login
+            default:
+                degraded++;
+                break; // expired / rate_limited / error — soft
+        }
+        if (oldest === null || health.checkedAt < oldest)
+            oldest = health.checkedAt;
+    }
+    return { live, present, degraded, revoked, total, oldestCheckedAt: oldest };
+}
 /** Human "3m ago" style age for a checkedAt timestamp. */
 export function formatCheckedAge(checkedAt, now = Date.now()) {
     const secs = Math.max(0, Math.round((now - checkedAt) / 1000));

package/dist/lib/computer/download.d.ts

@@ -29,6 +29,9 @@ export declare function macHelperAssetUrls(version: string): {
     zip: string;
     sha256: string;
 };
+/** Extract `TeamIdentifier=XXXX` from `codesign -dv --verbose=4` output (which is
+ * emitted on stderr). Returns null when absent (ad-hoc / unsigned). */
+export declare function parseTeamId(codesignInfo: string): string | null;
 /**
  * Verify a helper `.app` bundle is intact, signed by the expected Developer ID
  * Team, and notarized (Gatekeeper-accepted). Throws with an actionable message

package/dist/lib/computer/download.js

@@ -13,7 +13,7 @@
  * A `.app` is a directory, so the asset is a zip (`ditto -c -k --keepParent`);
  * we extract it with `ditto -x -k` after the checksum passes.
  */
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -41,6 +41,11 @@ export function macHelperAssetUrls(version) {
     const base = `https://github.com/${HELPER_RELEASE_REPO}/releases/download/v${version}`;
     return { zip: `${base}/${MAC_HELPER_ASSET}`, sha256: `${base}/${MAC_HELPER_ASSET}.sha256` };
 }
+/** Extract `TeamIdentifier=XXXX` from `codesign -dv --verbose=4` output (which is
+ * emitted on stderr). Returns null when absent (ad-hoc / unsigned). */
+export function parseTeamId(codesignInfo) {
+    return codesignInfo.match(/TeamIdentifier=([A-Z0-9]+)/)?.[1] ?? null;
+}
 /**
  * Verify a helper `.app` bundle is intact, signed by the expected Developer ID
  * Team, and notarized (Gatekeeper-accepted). Throws with an actionable message
@@ -55,17 +60,13 @@ export function verifyMacHelper(appPath) {
         throw new Error(`code signature invalid for ${appPath}: ${e.message}`);
     }
     // 2. Team identity — must be our Developer ID, not some other valid signer.
-    let info = '';
-    try {
-        info = execFileSync('/usr/bin/codesign', ['-dv', '--verbose=4', appPath], { stdio: 'pipe' }).toString();
-    }
-    catch (e) {
-        // codesign -dv writes to stderr; capture whatever it emitted.
-        info = (e.stderr?.toString() ?? '') + (e.stdout?.toString() ?? '');
-        if (!info)
-            throw new Error(`could not read code signature of ${appPath}: ${e.message}`);
-    }
-    const team = info.match(/TeamIdentifier=([A-Z0-9]+)/)?.[1];
+    // `codesign -dv` writes its details to STDERR even on success (exit 0), so we
+    // must read stderr, not stdout. spawnSync captures both streams regardless of
+    // exit code; execFileSync would return only (empty) stdout and the Team check
+    // would falsely reject every validly-signed helper.
+    const dv = spawnSync('/usr/bin/codesign', ['-dv', '--verbose=4', appPath], { encoding: 'utf8' });
+    const info = `${dv.stdout ?? ''}${dv.stderr ?? ''}`;
+    const team = parseTeamId(info);
     if (team !== EXPECTED_TEAM_ID) {
         throw new Error(`helper signed by unexpected Team (${team ?? 'none'}), expected ${EXPECTED_TEAM_ID}. Refusing to install.`);
     }

package/dist/lib/daemon.js

@@ -625,6 +625,42 @@ export async function runDaemon() {
     };
     const launchHealthInterval = setInterval(() => { void runLaunchHealthCheck(); }, 6 * 60 * 60_000);
     const launchHealthKickoff = setTimeout(() => { void runLaunchHealthCheck(); }, 90_000);
+    // Fleet cache warm: keep the caches that `agents devices list`, `fleet status`,
+    // and `agents view` read cache-first actually fresh, so a default read never
+    // has to ssh out. Two cheap refreshes: (1) this host's auth-health verdicts
+    // (also feeds the `doctor --json` Auth rollup other hosts read), and (2) the
+    // fleet resource-stats cache (one bounded parallel probe of the tailnet). Both
+    // best-effort + overlap-guarded like the probes above. ~every 3 min, plus once
+    // ~60s after startup (staggered off launch).
+    let warmingFleetCache = false;
+    const runFleetCacheWarm = async () => {
+        if (warmingFleetCache)
+            return;
+        warmingFleetCache = true;
+        try {
+            const { machineId } = await import('./machine-id.js');
+            const self = machineId();
+            const { probeLocalFleetAuth, writeFleetAuthRows } = await import('./auth-health.js');
+            const { getCliVersion } = await import('./version.js');
+            const authRows = await probeLocalFleetAuth({ cliVersion: getCliVersion() });
+            writeFleetAuthRows(self, authRows);
+            const { loadDevices } = await import('./devices/registry.js');
+            const { planFleetTargets } = await import('./devices/fleet.js');
+            const { loadFleetStats } = await import('./devices/stats-cache.js');
+            const reg = await loadDevices();
+            const probeable = planFleetTargets(reg).filter((t) => !t.skip).map((t) => t.device);
+            const res = await loadFleetStats(probeable, { forceRefresh: true, selfName: self });
+            log('INFO', `fleet cache warm: ${authRows.length} auth row(s), ${res.stats.size} device stat(s)`);
+        }
+        catch (err) {
+            log('ERROR', `fleet cache warm failed: ${err.message}`);
+        }
+        finally {
+            warmingFleetCache = false;
+        }
+    };
+    const fleetCacheInterval = setInterval(() => { void runFleetCacheWarm(); }, 3 * 60_000);
+    const fleetCacheKickoff = setTimeout(() => { void runFleetCacheWarm(); }, 60_000);
     const handleReload = () => {
         log('INFO', 'Reloading jobs (SIGHUP)');
         scheduler.reloadAll();
@@ -657,6 +693,8 @@ export async function runDaemon() {
         clearTimeout(tmuxReconcileKickoff);
         clearInterval(launchHealthInterval);
         clearTimeout(launchHealthKickoff);
+        clearInterval(fleetCacheInterval);
+        clearTimeout(fleetCacheKickoff);
         hostedBroker?.close();
         removeDaemonPid();
         removeHeartbeat();

package/dist/lib/devices/health-report.d.ts

@@ -1,4 +1,5 @@
 import { type DeviceStats } from './health.js';
+import { type HostAuthSummary } from '../auth-health.js';
 export interface FleetCliStatus {
     installed: boolean;
     path: string | null;
@@ -28,6 +29,9 @@ export interface FleetHealthRow {
     clis: Record<string, FleetCliStatus>;
     sync: FleetSyncStatus[];
     orphans: FleetOrphanStatus[];
+    /** Cached auth-health rollup for this host (the Auth column). Undefined when
+     *  the host has never been probed (`agents fleet ping`) or the cache is cold. */
+    auth?: HostAuthSummary;
 }
 export interface FleetWarning {
     kind: 'unreachable' | 'drift' | 'cli' | 'version-skew';
@@ -44,3 +48,10 @@ export interface FleetHealthReport {
 export declare function buildFleetHealthReport(rows: FleetHealthRow[], now?: Date): FleetHealthReport;
 export declare function renderFleetWarnings(report: FleetHealthReport): string[];
 export declare function renderFleetMatrix(report: FleetHealthReport): string[];
+/**
+ * "as of …" line so cache-served output is honest about age and points at the
+ * refresh flag. Stats age comes from `stats.fetchedAt`, auth age from the
+ * cached rollup's `oldestCheckedAt`; either may be absent. Returns null when the
+ * table carries no timestamped data at all (nothing to date).
+ */
+export declare function freshnessFooter(rows: FleetHealthRow[], now?: number): string | null;

package/dist/lib/devices/health-report.js

@@ -1,6 +1,7 @@
 import chalk from 'chalk';
-import { padToWidth, terminalWidth, truncateToWidth } from '../session/width.js';
+import { padToWidth, stringWidth, terminalWidth, truncateToWidth } from '../session/width.js';
 import { fmtBytes, headroom } from './health.js';
+import { formatCheckedAge } from '../auth-health.js';
 function driftRows(row) {
     return row.sync.filter((s) => s.status !== 'fresh');
 }
@@ -121,6 +122,47 @@ function loadLabel(stats) {
     const mem = stats.memPercent === undefined ? '-' : `${Math.round(stats.memPercent)}%`;
     return `${load}/${mem}`;
 }
+/**
+ * Compact per-host auth cell. Four buckets, deliberately distinct so the column
+ * doesn't cry wolf on healthy accounts:
+ *   `●{live}`     green  — live-verified
+ *   `·{present}`  gray   — signed in but no live probe (codex/grok/…): benign
+ *   `◐{degraded}` yellow — soft/self-healing (expired/limited/error)
+ *   `○{revoked}`  red    — server rejected the token: re-login now
+ * A host with no cached auth rows shows "—"; an unreachable/skipped row shows
+ * "-" like the other probe columns.
+ */
+function authLabel(row) {
+    if (row.error || row.skipped)
+        return chalk.gray('-');
+    const s = row.auth;
+    if (!s || s.total === 0)
+        return chalk.gray('—');
+    const parts = [];
+    if (s.live > 0)
+        parts.push(chalk.green(`●${s.live}`));
+    if (s.present > 0)
+        parts.push(chalk.gray(`·${s.present}`));
+    if (s.degraded > 0)
+        parts.push(chalk.yellow(`◐${s.degraded}`));
+    if (s.revoked > 0)
+        parts.push(chalk.red(`○${s.revoked}`));
+    // All-zero can't happen (total > 0); but if only present/degraded exist we
+    // still lead with them — never show an empty cell for a probed host.
+    return parts.length > 0 ? parts.join(' ') : chalk.gray('—');
+}
+/** Oldest epoch-ms timestamp across rows for a field, or null when none present. */
+function oldestAcross(rows, pick) {
+    let oldest = null;
+    for (const row of rows) {
+        const t = pick(row);
+        if (t == null)
+            continue;
+        if (oldest === null || t < oldest)
+            oldest = t;
+    }
+    return oldest;
+}
 export function renderFleetWarnings(report) {
     if (report.warnings.length === 0)
         return [chalk.green('Fleet warnings: none')];
@@ -134,14 +176,19 @@ export function renderFleetMatrix(report) {
         return [chalk.gray('No registered devices. Run `agents devices` to register some.')];
     const nameW = Math.min(22, Math.max(6, ...report.devices.map((r) => r.name.length)));
     const versionW = Math.min(14, Math.max(7, ...report.devices.map((r) => (r.version ?? '-').length)));
+    // Auth cells are variable-length (up to four space-separated buckets, e.g.
+    // `●2 ·3 ◐1 ○1`); size the column to the widest so a mixed-auth row can't
+    // overflow the fixed slot and shove every later column out of alignment.
+    const authW = Math.max(9, ...report.devices.map((r) => stringWidth(authLabel(r))));
     const width = terminalWidth();
     // 4 = leading "  " + the per-row status glyph + its trailing space (rows prefix
     // `  ${statusGlyph} `; the header reserves the same 4 cols so every column lines up).
-    const fixed = 4 + nameW + 2 + 8 + 2 + 9 + 2 + 9 + 2 + versionW + 2 + 9 + 2 + 9;
+    // Columns: Device, OS(8), Health(9), Sync(9), CLI(9), Auth(authW), Version, Load/Mem(9), then Note.
+    const fixed = 4 + nameW + 2 + 8 + 2 + 9 + 2 + 9 + 2 + 9 + 2 + authW + 2 + versionW + 2 + 9;
     const noteW = Math.max(12, width - fixed);
     const lines = [
         chalk.bold('Fleet status'),
-        chalk.gray(`    ${padToWidth('Device', nameW)}  ${padToWidth('OS', 8)}  ${padToWidth('Health', 9)}  ${padToWidth('Sync', 9)}  ${padToWidth('CLI', 9)}  ${padToWidth('Version', versionW)}  ${padToWidth('Load/Mem', 9)}  Note`),
+        chalk.gray(`    ${padToWidth('Device', nameW)}  ${padToWidth('OS', 8)}  ${padToWidth('Health', 9)}  ${padToWidth('Sync', 9)}  ${padToWidth('CLI', 9)}  ${padToWidth('Auth', authW)}  ${padToWidth('Version', versionW)}  ${padToWidth('Load/Mem', 9)}  Note`),
     ];
     for (const row of report.devices) {
         const note = row.error ?? row.skipped ?? (row.orphans.length > 0 ? `${row.orphans.length} orphaned version${row.orphans.length === 1 ? '' : 's'}` : '');
@@ -150,10 +197,32 @@ export function renderFleetMatrix(report) {
             `${padToWidth(headroomLabel(row), 9)}  ` +
             `${padToWidth(driftLabel(row), 9)}  ` +
             `${padToWidth(cliLabel(row), 9)}  ` +
+            `${padToWidth(authLabel(row), authW)}  ` +
             `${padToWidth(truncateToWidth(row.version ?? '-', versionW), versionW)}  ` +
             `${padToWidth(loadLabel(row.stats), 9)}  ` +
             chalk.gray(truncateToWidth(note || `free ${fmtBytes(row.stats?.memFreeBytes)}`, noteW)));
     }
-    lines.push(chalk.gray('  ● fresh · ◐ drift · ○ unreachable/skipped'));
+    lines.push(chalk.gray('  ● fresh · ◐ drift · ○ unreachable/skipped · Auth ●live ·present ◐degraded ○revoked'));
+    const foot = freshnessFooter(report.devices);
+    if (foot)
+        lines.push(chalk.gray(foot));
     return lines;
 }
+/**
+ * "as of …" line so cache-served output is honest about age and points at the
+ * refresh flag. Stats age comes from `stats.fetchedAt`, auth age from the
+ * cached rollup's `oldestCheckedAt`; either may be absent. Returns null when the
+ * table carries no timestamped data at all (nothing to date).
+ */
+export function freshnessFooter(rows, now = Date.now()) {
+    const oldestStats = oldestAcross(rows, (r) => r.stats?.fetchedAt);
+    const oldestAuth = oldestAcross(rows, (r) => r.auth?.oldestCheckedAt);
+    const parts = [];
+    if (oldestStats != null)
+        parts.push(`stats ${formatCheckedAge(oldestStats, now)}`);
+    if (oldestAuth != null)
+        parts.push(`auth ${formatCheckedAge(oldestAuth, now)}`);
+    if (parts.length === 0)
+        return null;
+    return `  updated ${parts.join(' · ')} — pass --refresh (--live) for a live probe`;
+}

package/dist/lib/devices/stats-cache.d.ts

@@ -0,0 +1,36 @@
+import { probeFleetStats, probeLocalStats, type DeviceStats } from './health.js';
+import type { DeviceProfile } from './registry.js';
+/** Read the whole cache (best-effort; a missing/corrupt file yields an empty map). */
+export declare function readStatsCache(): Record<string, DeviceStats>;
+/**
+ * Merge freshly-probed rows into the on-disk cache (best-effort write). Rows for
+ * devices not in `entries` are preserved, so a partial probe (gap-fill, or a
+ * single-device refresh) never drops the rest of the fleet's cached stats.
+ */
+export declare function writeStatsCache(entries: Record<string, DeviceStats>): void;
+export interface FleetStatsResult {
+    /** name → stats for every requested device (cache-served + freshly probed). */
+    stats: Map<string, DeviceStats>;
+    /** Oldest `fetchedAt` among the returned rows, or null when empty. Drives the
+     *  "as of …" freshness note. */
+    oldestFetchedAt: number | null;
+    /** True when at least one row was served from cache rather than probed this call. */
+    servedFromCache: boolean;
+}
+export interface LoadFleetStatsOptions {
+    /** Skip the cache and live-probe every device (the `--refresh`/`--live` path). */
+    forceRefresh?: boolean;
+    /** Device name of THIS machine — always probed locally (no ssh), never cached-served. */
+    selfName?: string;
+    /** Injectable probes + cache IO for tests (default to the real ssh/local/disk ones). */
+    probeFleet?: typeof probeFleetStats;
+    probeLocal?: typeof probeLocalStats;
+    readCache?: typeof readStatsCache;
+    writeCache?: typeof writeStatsCache;
+}
+/**
+ * Load fleet stats cache-first. See the module doc for the default vs
+ * `--refresh` behaviour. Never throws — an unreachable box degrades to a
+ * `reachable: false` row exactly as the live probe does.
+ */
+export declare function loadFleetStats(devices: DeviceProfile[], opts?: LoadFleetStatsOptions): Promise<FleetStatsResult>;

package/dist/lib/devices/stats-cache.js

@@ -0,0 +1,115 @@
+/**
+ * Disk cache for fleet {@link DeviceStats} so `agents devices list` and
+ * `agents fleet status` render instantly from the last probe instead of
+ * live-SSHing every registered box on every invocation.
+ *
+ * The old behaviour probed the whole fleet over ssh on every call
+ * ({@link probeFleetStats}) — with a dozen devices, a few of them cold or
+ * timing out, that turned a status glance into a multi-second hang. This module
+ * makes the reads cache-first:
+ *
+ * - **Default:** serve remote devices from the cache (instant); always probe
+ *   *this* machine locally (no ssh, sub-ms) so the "this machine" row is live;
+ *   probe only the remote devices missing from the cache (first run / a
+ *   newly-added box), then persist them.
+ * - **`--refresh` / `--live`:** skip the cache and live-probe every device,
+ *   rewriting the cache.
+ *
+ * The daemon warms this cache (~every 3 min, see `lib/daemon.ts
+ * runFleetCacheWarm`), so in steady state a default read has zero
+ * remote ssh round-trips and returns immediately with data that is at most a
+ * few minutes old — surfaced to the user as an "as of …" freshness note.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { getCacheDir } from '../state.js';
+import { probeFleetStats, probeLocalStats } from './health.js';
+const CACHE_FILE = '.fleet-stats.json';
+function cacheFilePath() {
+    return path.join(getCacheDir(), CACHE_FILE);
+}
+/** Read the whole cache (best-effort; a missing/corrupt file yields an empty map). */
+export function readStatsCache() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(cacheFilePath(), 'utf-8'));
+        if (parsed && parsed.entries && typeof parsed.entries === 'object')
+            return parsed.entries;
+    }
+    catch {
+        // missing or corrupt — treat as empty
+    }
+    return {};
+}
+/**
+ * Merge freshly-probed rows into the on-disk cache (best-effort write). Rows for
+ * devices not in `entries` are preserved, so a partial probe (gap-fill, or a
+ * single-device refresh) never drops the rest of the fleet's cached stats.
+ */
+export function writeStatsCache(entries) {
+    try {
+        const dir = getCacheDir();
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        const merged = {
+            version: 1,
+            entries: { ...readStatsCache(), ...entries },
+        };
+        fs.writeFileSync(cacheFilePath(), JSON.stringify(merged, null, 2));
+    }
+    catch {
+        // best-effort; a failed write just means the next read falls back to a live probe
+    }
+}
+/**
+ * Load fleet stats cache-first. See the module doc for the default vs
+ * `--refresh` behaviour. Never throws — an unreachable box degrades to a
+ * `reachable: false` row exactly as the live probe does.
+ */
+export async function loadFleetStats(devices, opts = {}) {
+    const probeFleet = opts.probeFleet ?? probeFleetStats;
+    const probeLocal = opts.probeLocal ?? probeLocalStats;
+    const readCache = opts.readCache ?? readStatsCache;
+    const writeCache = opts.writeCache ?? writeStatsCache;
+    const self = opts.selfName;
+    const cache = opts.forceRefresh ? {} : readCache();
+    const stats = new Map();
+    const toProbe = [];
+    let servedFromCache = false;
+    for (const d of devices) {
+        if (d.name === self) {
+            // This machine is always probed locally — cheap, no ssh, always live.
+            toProbe.push(d);
+            continue;
+        }
+        const cached = cache[d.name];
+        if (cached) {
+            stats.set(d.name, cached);
+            servedFromCache = true;
+        }
+        else {
+            toProbe.push(d);
+        }
+    }
+    if (toProbe.length > 0) {
+        const probed = await probeFleet(toProbe, { selfName: self });
+        const fresh = {};
+        for (const [name, s] of probed) {
+            stats.set(name, s);
+            fresh[name] = s;
+        }
+        if (Object.keys(fresh).length > 0)
+            writeCache(fresh);
+    }
+    // Guarantee a row for this machine even when it isn't in the passed device
+    // list (e.g. self not registered as an ssh target) — matches the old callers'
+    // explicit local fallback.
+    if (self && !stats.has(self)) {
+        stats.set(self, await probeLocal(self));
+    }
+    let oldest = null;
+    for (const s of stats.values()) {
+        if (oldest === null || s.fetchedAt < oldest)
+            oldest = s.fetchedAt;
+    }
+    return { stats, oldestFetchedAt: oldest, servedFromCache };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.69",
+  "version": "1.20.70",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",