@phnx-labs/agents-cli 1.20.74 → 1.20.76

package/dist/lib/daemon.js

@@ -16,7 +16,7 @@ import { listJobs as listAllJobs } from './routines.js';
 import { JobScheduler } from './scheduler.js';
 import { MonitorEngine } from './monitors/engine.js';
 import { executeJobDetached, monitorRunningJobs } from './runner.js';
-import { detectOverdueJobs, notifyOverdue } from './overdue.js';
+import { detectOverdueJobs, notifyOverdue, notifyDesktop } from './overdue.js';
 import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { readAndResolveBundleEnv } from './secrets/bundles.js';
@@ -320,6 +320,15 @@ export async function runDaemon() {
             process.env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
             log('INFO', 'Loaded Claude OAuth token from secrets bundle for routine runs');
         }
+        else {
+            // No token available (e.g. a headless macOS daemon whose keychain was
+            // locked at start resolves broker-only and gets nothing). Historically
+            // this was silent, so every Claude routine the daemon spawned failed auth
+            // with no signal. Make it loud: WARN in the log and fire a desktop alert.
+            log('WARN', 'No Claude OAuth token available — Claude routine runs will fail auth on this host. ' +
+                'Restart the daemon with the keychain unlocked, or unlock the `claude` secrets bundle.');
+            notifyDesktop('agents daemon: no Claude credential', 'Claude routines will fail auth on this host. Restart the daemon with the keychain unlocked.');
+        }
     }
     // Reap any stray duplicate daemon of this install that slipped past the start
     // lock or was orphaned by a hard-crash — before it can double-fire jobs.
@@ -623,9 +632,16 @@ export async function runDaemon() {
         checkingLaunchHealth = true;
         try {
             const { healBrokenDefaultLaunches } = await import('./versions.js');
-            const repaired = await healBrokenDefaultLaunches((m) => log('INFO', `launch-health: ${m}`));
+            // Unattended pass: repair the current default in place, but NEVER repoint
+            // the global default (allowDefaultSwitch: false). A background default
+            // switch installs a fresh version home → a fresh empty Claude credential
+            // scope, i.e. a silent logout uncorrelated with anything the user did.
+            const { repaired, unhealed } = await healBrokenDefaultLaunches((m) => log('INFO', `launch-health: ${m}`), { allowDefaultSwitch: false });
             if (repaired.length)
                 log('INFO', `launch-health: repaired ${repaired.join(', ')}`);
+            if (unhealed.length) {
+                log('WARN', `launch-health: ${unhealed.join(', ')} won't launch and will not be auto-switched — choose a version with \`agents use <agent> <version>\` or \`agents add <agent>@latest\``);
+            }
         }
         catch (err) {
             log('ERROR', `launch-health check failed: ${err.message}`);

package/dist/lib/devices/connect.d.ts

@@ -3,6 +3,14 @@ import { type DeviceProfile } from './registry.js';
 export declare const ASKPASS_BUNDLE_ENV = "AGENTS_SSH_BUNDLE";
 /** Env var the askpass shim reads to know which key in the bundle is the password. */
 export declare const ASKPASS_KEY_ENV = "AGENTS_SSH_KEY";
+/**
+ * Env var that forces the askpass bundle resolve to be broker-only (`agentOnly`)
+ * regardless of TTY. A read-only stats probe (`agents devices` load/mem columns)
+ * sets this so an uncached password-auth device resolves from the already-unlocked
+ * secrets broker or degrades to an unreachable row — never a foreground Touch ID
+ * sheet. See {@link buildSshInvocation}'s `agentOnly` option and `runAskpass`. (RUSH-1970)
+ */
+export declare const ASKPASS_AGENT_ONLY_ENV = "AGENTS_SSH_AGENT_ONLY";
 /**
  * Build the `user@host` (or bare `host`) ssh target for a device and validate
  * it against the shared injection guard. Throws if the device has no address.
@@ -51,8 +59,14 @@ export interface SshHostKeyOptions {
  * Host-key checking runs against the CLI-managed known_hosts store (never the
  * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
  * `accept-new` to learn+pin the key on first connect (RUSH-1767).
+ *
+ * `opts.agentOnly` marks the connection as a read-only probe: for password auth
+ * it sets {@link ASKPASS_AGENT_ONLY_ENV} in the overlay so the askpass resolve
+ * stays broker-only and never pops a foreground biometric (RUSH-1970).
  */
-export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions): {
+export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions, opts?: {
+    agentOnly?: boolean;
+}): {
     args: string[];
     env: Record<string, string>;
 };

package/dist/lib/devices/connect.js

@@ -25,6 +25,14 @@ import { hostNameFor } from './ssh-config.js';
 export const ASKPASS_BUNDLE_ENV = 'AGENTS_SSH_BUNDLE';
 /** Env var the askpass shim reads to know which key in the bundle is the password. */
 export const ASKPASS_KEY_ENV = 'AGENTS_SSH_KEY';
+/**
+ * Env var that forces the askpass bundle resolve to be broker-only (`agentOnly`)
+ * regardless of TTY. A read-only stats probe (`agents devices` load/mem columns)
+ * sets this so an uncached password-auth device resolves from the already-unlocked
+ * secrets broker or degrades to an unreachable row — never a foreground Touch ID
+ * sheet. See {@link buildSshInvocation}'s `agentOnly` option and `runAskpass`. (RUSH-1970)
+ */
+export const ASKPASS_AGENT_ONLY_ENV = 'AGENTS_SSH_AGENT_ONLY';
 /**
  * Build the `user@host` (or bare `host`) ssh target for a device and validate
  * it against the shared injection guard. Throws if the device has no address.
@@ -83,8 +91,12 @@ export function wrapRemoteCommand(device, cmd) {
  * Host-key checking runs against the CLI-managed known_hosts store (never the
  * user's `~/.ssh/known_hosts`): strict once `hostKey.pinned` is set, else
  * `accept-new` to learn+pin the key on first connect (RUSH-1767).
+ *
+ * `opts.agentOnly` marks the connection as a read-only probe: for password auth
+ * it sets {@link ASKPASS_AGENT_ONLY_ENV} in the overlay so the askpass resolve
+ * stays broker-only and never pops a foreground biometric (RUSH-1970).
  */
-export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}) {
+export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, opts = {}) {
     const target = sshTargetFor(device);
     const remote = wrapRemoteCommand(device, cmd);
     const env = {};
@@ -100,6 +112,8 @@ export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}) {
         env.SSH_ASKPASS_REQUIRE = 'force';
         env[ASKPASS_BUNDLE_ENV] = device.auth.bundle;
         env[ASKPASS_KEY_ENV] = device.auth.bundleKey ?? 'password';
+        if (opts.agentOnly)
+            env[ASKPASS_AGENT_ONLY_ENV] = '1';
         args.push('-o', 'PreferredAuthentications=password', '-o', 'PubkeyAuthentication=no', '-o', 'NumberOfPasswordPrompts=1');
     }
     else {

package/dist/lib/devices/fleet.d.ts

@@ -8,6 +8,7 @@
  * the remaining devices.
  */
 import { type DeviceProfile, type DeviceRegistry } from './registry.js';
+import type { DeviceStats } from './health.js';
 export type FleetSkipReason = 'offline' | 'no-address' | 'control';
 /** npm dist-tags / semver pins only — rejects shell metacharacters. */
 export declare const FLEET_VERSION_RE: RegExp;
@@ -55,6 +56,26 @@ export declare function planFleetTargets(reg: DeviceRegistry): FleetTarget[];
  * surface — so their `skip` reason still flows through as an `unreachable` row.
  */
 export declare function remoteFleetTargets(planned: FleetTarget[], self: string): FleetTarget[];
+/**
+ * Decide whether a fleet-health target should skip the expensive version+doctor
+ * dials (`agents fleet status`). The cheap stats probe (~2.5s, same registry
+ * address) has already tried this box one step earlier. If it came back
+ * unreachable, dialing `agents --version` (15s) + `agents doctor --json` (30s)
+ * would almost certainly fail the same way — just 45s slower — so one
+ * genuinely-offline box would stall the whole matrix (the ~60s hang, RUSH-1964).
+ *
+ * We trust the stats verdict on the DEFAULT path, not only under
+ * `--refresh`/`--live`: `probeDeviceStats` and the version/doctor dials share
+ * one ssh path (`fleetDialTarget`), so reachability is not per-probe. The
+ * verdict is either freshly probed this run or daemon-warmed (~3min) with the
+ * live write-back from RUSH-1965, so a box that came online in the last few
+ * minutes is the only false-negative window — it renders `unreachable` until the
+ * next stats warm, which beats letting it hang the status glance for 45s.
+ *
+ * An existing skip (control/offline/no-address from {@link planFleetTargets})
+ * always wins — those are classified before any probe.
+ */
+export declare function fleetHealthSkip(currentSkip: FleetSkipReason | string | undefined, stats: DeviceStats | undefined): FleetSkipReason | string | undefined;
 /** Human label for a skip reason. */
 export declare function skipLabel(reason: FleetSkipReason): string;
 /**

package/dist/lib/devices/fleet.js

@@ -54,6 +54,32 @@ export function planFleetTargets(reg) {
 export function remoteFleetTargets(planned, self) {
     return planned.filter((t) => t.device.name !== self && t.skip !== 'control');
 }
+/**
+ * Decide whether a fleet-health target should skip the expensive version+doctor
+ * dials (`agents fleet status`). The cheap stats probe (~2.5s, same registry
+ * address) has already tried this box one step earlier. If it came back
+ * unreachable, dialing `agents --version` (15s) + `agents doctor --json` (30s)
+ * would almost certainly fail the same way — just 45s slower — so one
+ * genuinely-offline box would stall the whole matrix (the ~60s hang, RUSH-1964).
+ *
+ * We trust the stats verdict on the DEFAULT path, not only under
+ * `--refresh`/`--live`: `probeDeviceStats` and the version/doctor dials share
+ * one ssh path (`fleetDialTarget`), so reachability is not per-probe. The
+ * verdict is either freshly probed this run or daemon-warmed (~3min) with the
+ * live write-back from RUSH-1965, so a box that came online in the last few
+ * minutes is the only false-negative window — it renders `unreachable` until the
+ * next stats warm, which beats letting it hang the status glance for 45s.
+ *
+ * An existing skip (control/offline/no-address from {@link planFleetTargets})
+ * always wins — those are classified before any probe.
+ */
+export function fleetHealthSkip(currentSkip, stats) {
+    if (currentSkip)
+        return currentSkip;
+    if (stats?.reachable === false)
+        return 'unreachable';
+    return undefined;
+}
 /** Human label for a skip reason. */
 export function skipLabel(reason) {
     switch (reason) {

package/dist/lib/devices/health-report.d.ts

@@ -1,5 +1,6 @@
 import { type DeviceStats } from './health.js';
 import { type HostAuthSummary } from '../auth-health.js';
+import type { OnlineState } from './reachability.js';
 export interface FleetCliStatus {
     installed: boolean;
     path: string | null;
@@ -32,6 +33,13 @@ export interface FleetHealthRow {
     /** Cached auth-health rollup for this host (the Auth column). Undefined when
      *  the host has never been probed (`agents fleet ping`) or the cache is cold. */
     auth?: HostAuthSummary;
+    /** Resolved online/offline verdict (from {@link deviceOnlineState}). Populated
+     *  by `runFleetStatus` for the summary view; undefined in the raw grid. */
+    online?: OnlineState;
+    /** When this box was last seen reachable (ISO), for the "last seen …" note on
+     *  an offline row. Sourced from the registry's tailscale snapshot / reachability
+     *  verdict. Undefined when never recorded. */
+    lastSeen?: string;
 }
 export interface FleetWarning {
     kind: 'unreachable' | 'drift' | 'cli' | 'version-skew';
@@ -55,3 +63,33 @@ export declare function renderFleetMatrix(report: FleetHealthReport): string[];
  * table carries no timestamped data at all (nothing to date).
  */
 export declare function freshnessFooter(rows: FleetHealthRow[], now?: number): string | null;
+/** Collapse a long dev build (`0.0.0-dev.<sha>[-dirty]`) to `dev`/`dev-dirty`;
+ *  released semver is shown verbatim. Keeps the version column narrow and stops
+ *  a single dev box from widening every row. */
+export declare function shortVersion(version: string | null | undefined): string;
+/** OS bucket label for grouping. Anything unrecognized falls under "Other". */
+export declare function platformGroupLabel(platform: string | undefined): 'macOS' | 'Linux' | 'Windows' | 'Other';
+export interface FleetAttentionItem {
+    /** Leading mark: `○` offline, `⚠` config/CLI/version issue. */
+    glyph: 'offline' | 'warn';
+    subject: string;
+    detail: string;
+    /** The exact command (or instruction) that fixes it. */
+    fix: string;
+}
+/**
+ * The actionable problems only — each with the command that fixes it. Order:
+ * offline boxes, CLI gaps, active-version config drift, then version skew.
+ * A healthy fleet returns `[]` (the caller prints an all-clear line).
+ */
+export declare function buildFleetAttentionItems(report: FleetHealthReport, now?: number): FleetAttentionItem[];
+/**
+ * The default `agents fleet status` view (RUSH-1966): a one-line rollup, a
+ * NEEDS ATTENTION list of only the actionable problems (each with its fix
+ * command), quiet per-device rows grouped by OS, and an honest footer. The full
+ * auth/CLI/sync grid moves behind `--verbose` ({@link renderFleetMatrix}).
+ */
+export declare function renderFleetSummary(report: FleetHealthReport, opts?: {
+    self?: string;
+    now?: number;
+}): string[];

package/dist/lib/devices/health-report.js

@@ -226,3 +226,217 @@ export function freshnessFooter(rows, now = Date.now()) {
         return null;
     return `  updated ${parts.join(' · ')} — pass --refresh (--live) for a live probe`;
 }
+// ---------------------------------------------------------------------------
+// Summary view (default): rollup + NEEDS ATTENTION + OS groups + footer.
+// The full grid above is kept for `--verbose`. (RUSH-1966)
+// ---------------------------------------------------------------------------
+/** Collapse a long dev build (`0.0.0-dev.<sha>[-dirty]`) to `dev`/`dev-dirty`;
+ *  released semver is shown verbatim. Keeps the version column narrow and stops
+ *  a single dev box from widening every row. */
+export function shortVersion(version) {
+    if (!version)
+        return '—';
+    const m = version.match(/-dev\b/);
+    if (m)
+        return /dirty/.test(version) ? 'dev-dirty' : 'dev';
+    return version;
+}
+/** OS bucket label for grouping. Anything unrecognized falls under "Other". */
+export function platformGroupLabel(platform) {
+    const p = (platform ?? '').toLowerCase();
+    if (p === 'macos' || p === 'darwin')
+        return 'macOS';
+    if (p === 'linux')
+        return 'Linux';
+    if (p.startsWith('win'))
+        return 'Windows';
+    return 'Other';
+}
+const GROUP_ORDER = ['macOS', 'Linux', 'Windows', 'Other'];
+/** Non-fresh sync rows for the ACTIVE (default) version only — the drift that a
+ *  running install actually feels, not stale/cold counts across old orphans. */
+function activeDriftRows(row) {
+    return row.sync.filter((s) => s.isDefault && s.status !== 'fresh');
+}
+function isOffline(row) {
+    // Prefer the resolved verdict; fall back to a probe error/skip when the caller
+    // didn't populate it (e.g. a raw report). Only a positive 'online' is "up".
+    if (row.online)
+        return row.online !== 'online';
+    return Boolean(row.error || row.skipped);
+}
+/** A box with a real offline verdict — as opposed to `unknown` (registered but
+ *  never addressed/probed). Only a genuine offline is a "check the box" item;
+ *  an unknown box is unconfigured, not down. */
+function isGenuinelyOffline(row) {
+    return row.online === 'offline' || (!row.online && Boolean(row.error || row.skipped));
+}
+/** A CLI count is only worth flagging when it's stark — the box is missing more
+ *  than two-thirds of the known agent CLIs (e.g. 1/9), which signals a
+ *  broken/half-set-up box. A normal partial install (a box that just doesn't run
+ *  every agent) is not a problem, so this deliberately does NOT fire at 4/9 or
+ *  6/9. The full count stays visible under `--verbose`. */
+function starkCliGap(row) {
+    const { installed, total } = installedCliCount(row);
+    return total > 0 && installed * 3 < total ? { installed, total } : null;
+}
+/**
+ * The actionable problems only — each with the command that fixes it. Order:
+ * offline boxes, CLI gaps, active-version config drift, then version skew.
+ * A healthy fleet returns `[]` (the caller prints an all-clear line).
+ */
+export function buildFleetAttentionItems(report, now = Date.now()) {
+    const items = [];
+    // 1) Genuinely-offline boxes (not `unknown`/unconfigured), each individually.
+    for (const row of report.devices) {
+        if (!isGenuinelyOffline(row))
+            continue;
+        const seen = row.lastSeen ? ` · last seen ${formatCheckedAge(Date.parse(row.lastSeen), now)}` : '';
+        items.push({ glyph: 'offline', subject: row.name, detail: `offline${seen}`, fix: 'check the box' });
+    }
+    // 2) Boxes that need `agents apply` — merge config drift and a stark CLI gap
+    // into ONE item per box (both are fixed by the same command, so don't
+    // double-list). An offline box's config/CLI is unknowable, so skip it.
+    for (const row of report.devices) {
+        if (isOffline(row))
+            continue;
+        const reasons = [];
+        if (activeDriftRows(row).length > 0)
+            reasons.push('config drift');
+        const stark = starkCliGap(row);
+        if (stark)
+            reasons.push(`only ${stark.installed} of ${stark.total} agent CLIs installed`);
+        if (reasons.length > 0) {
+            items.push({ glyph: 'warn', subject: row.name, detail: reasons.join(' · '), fix: `agents apply ${row.name}` });
+        }
+    }
+    // 3) Version skew across the fleet — one line.
+    const skew = report.warnings.find((w) => w.kind === 'version-skew');
+    if (skew) {
+        const counts = new Map();
+        for (const row of report.devices) {
+            if (!row.version)
+                continue;
+            const v = shortVersion(row.version);
+            counts.set(v, (counts.get(v) ?? 0) + 1);
+        }
+        const summary = Array.from(counts.entries())
+            .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+            .map(([v, n]) => `${n}× ${v}`)
+            .join(' · ');
+        items.push({ glyph: 'warn', subject: 'version skew', detail: summary, fix: 'agents upgrade --fleet' });
+    }
+    return items;
+}
+/** Right-aligned `<content>` on the same line as `left`, clamped so it never
+ *  overlaps the left text on a narrow terminal. */
+function alignRight(left, right, width) {
+    const gap = width - stringWidth(left) - stringWidth(right);
+    return gap > 1 ? `${left}${' '.repeat(gap)}${right}` : `${left}  ${right}`;
+}
+function headroomWord(row) {
+    if (isOffline(row))
+        return chalk.gray(row.online === 'unknown' ? 'unknown' : 'offline');
+    return headroomLabel(row);
+}
+function loadMemCell(row) {
+    if (isOffline(row) || !row.stats?.reachable)
+        return chalk.gray('—');
+    const load = row.stats.loadPercent === undefined ? '—' : `${Math.round(row.stats.loadPercent)}%`;
+    const mem = row.stats.memPercent === undefined ? '—' : `${Math.round(row.stats.memPercent)}%`;
+    return `${load} / ${mem}`;
+}
+function versionCell(row) {
+    if (isOffline(row))
+        return chalk.gray('—');
+    return shortVersion(row.version);
+}
+/**
+ * The default `agents fleet status` view (RUSH-1966): a one-line rollup, a
+ * NEEDS ATTENTION list of only the actionable problems (each with its fix
+ * command), quiet per-device rows grouped by OS, and an honest footer. The full
+ * auth/CLI/sync grid moves behind `--verbose` ({@link renderFleetMatrix}).
+ */
+export function renderFleetSummary(report, opts = {}) {
+    const now = opts.now ?? Date.now();
+    const width = terminalWidth();
+    const rows = report.devices;
+    if (rows.length === 0)
+        return [chalk.gray('No registered devices. Run `agents devices` to register some.')];
+    const online = rows.filter((r) => !isOffline(r)).length;
+    const offline = rows.length - online;
+    const oldestStats = oldestAcross(rows, (r) => r.stats?.fetchedAt);
+    const cachedAge = oldestStats != null ? `cached ${formatCheckedAge(oldestStats, now)}` : null;
+    const rollupRight = [opts.self, cachedAge].filter(Boolean).join(' · ');
+    const rollupLeft = `${chalk.bold('Fleet')}   ${chalk.green('●')} ${online} online   ${chalk.gray('○')} ${offline} offline`;
+    const lines = [rollupRight ? alignRight(rollupLeft, chalk.gray(rollupRight), width) : rollupLeft, ''];
+    const items = buildFleetAttentionItems(report, now);
+    if (items.length === 0) {
+        lines.push(chalk.green('Everything looks healthy.'), '');
+    }
+    else {
+        lines.push(chalk.bold(`NEEDS ATTENTION (${items.length})`));
+        const subjW = Math.max(...items.map((i) => i.subject.length));
+        const detailW = Math.max(...items.map((i) => stringWidth(i.detail)));
+        for (const it of items) {
+            const glyph = it.glyph === 'offline' ? chalk.gray('○') : chalk.yellow('⚠');
+            const subject = it.glyph === 'offline' ? chalk.gray(it.subject) : it.subject;
+            lines.push(`  ${glyph}  ${padToWidth(subject, subjW)}   ${padToWidth(it.detail, detailW)}   ${chalk.cyan(`→ ${it.fix}`)}`);
+        }
+        lines.push('');
+    }
+    // Per-device rows, grouped by OS. Within a group, this machine floats to the
+    // top; the rest stay alphabetical.
+    const nameW = Math.min(18, Math.max(6, ...rows.map((r) => r.name.length)));
+    const headW = Math.max(...rows.map((r) => stringWidth(headroomWord(r))));
+    const loadW = Math.max(...rows.map((r) => stringWidth(loadMemCell(r))));
+    const verW = Math.max(7, ...rows.map((r) => stringWidth(versionCell(r))));
+    const grouped = new Map();
+    for (const r of rows) {
+        const g = platformGroupLabel(r.platform);
+        (grouped.get(g) ?? grouped.set(g, []).get(g)).push(r);
+    }
+    for (const group of GROUP_ORDER) {
+        const members = grouped.get(group);
+        if (!members || members.length === 0)
+            continue;
+        members.sort((a, b) => (a.name === opts.self ? -1 : b.name === opts.self ? 1 : 0) || a.name.localeCompare(b.name));
+        lines.push(chalk.bold(group));
+        for (const row of members) {
+            const isSelf = row.name === opts.self;
+            const prefix = isSelf ? chalk.cyan('▸') : ' ';
+            const marks = [];
+            if (!isOffline(row)) {
+                const stark = starkCliGap(row);
+                if (stark)
+                    marks.push(chalk.yellow(`⚠ CLIs ${stark.installed}/${stark.total}`));
+            }
+            else if (isGenuinelyOffline(row) && row.lastSeen) {
+                marks.push(chalk.gray(`last seen ${formatCheckedAge(Date.parse(row.lastSeen), now)}`));
+            }
+            if (isSelf)
+                marks.push(chalk.cyan('← this machine'));
+            const note = marks.length ? `   ${marks.join('   ')}` : '';
+            lines.push(` ${prefix} ${padToWidth(truncateToWidth(row.name, nameW), nameW)}  ` +
+                `${padToWidth(headroomWord(row), headW)}  ` +
+                `${padToWidth(loadMemCell(row), loadW)}  ` +
+                `${padToWidth(versionCell(row), verW)}` +
+                note);
+        }
+        lines.push('');
+    }
+    // Footer: orphan-version nudge (a `prune` concern, not drift), then an honest
+    // freshness line naming the cache age and what --live/--verbose add.
+    const orphaned = rows.filter((r) => r.orphans.length > 0).length;
+    if (orphaned > 0) {
+        const subject = orphaned === 1 ? '1 device carries' : `${orphaned} devices carry`;
+        lines.push(chalk.gray(`${subject} orphaned versions · run  ${chalk.cyan('agents prune')}  to reclaim disk`));
+    }
+    const freshBits = [
+        cachedAge,
+        'pass --live to re-probe auth + reachability',
+        'pass --verbose for the auth/CLI/sync columns',
+    ].filter(Boolean);
+    lines.push(chalk.gray(freshBits.join(' · ')));
+    return lines;
+}

package/dist/lib/devices/health.js

@@ -182,7 +182,10 @@ export function probeDeviceStats(device, opts = {}) {
         // remote login shell, which evaluates the snippet's `;`/`||` directly — no
         // `sh -c` wrapper needed (and a wrapper would only re-quote the first token).
         // For powershell devices it base64-encodes the snippet instead.
-        ({ args, env } = buildSshInvocation(device, [isWin ? WIN_PROBE_SNIPPET : PROBE_SNIPPET], shim));
+        // agentOnly: this is a read-only stats probe. A password-auth device must
+        // resolve its bundle broker-only — never force a foreground Touch ID sheet
+        // just to render the load/mem columns of `agents devices` (RUSH-1970).
+        ({ args, env } = buildSshInvocation(device, [isWin ? WIN_PROBE_SNIPPET : PROBE_SNIPPET], shim, {}, { agentOnly: true }));
     }
     catch {
         return Promise.resolve({ host, reachable: false, fetchedAt });

package/dist/lib/devices/reachability.d.ts

@@ -0,0 +1,31 @@
+/**
+ * One reachability resolver for the fleet render (RUSH-1965).
+ *
+ * "Is this device online?" had three disagreeing answers: the live SSH probe
+ * (`DeviceStats.reachable`, display-only), the persisted registry verdict, and
+ * the cached `tailscale.online` snapshot that the online/offline word actually
+ * read. A box reachable every day but whose tailscale snapshot was stale (or a
+ * `via:"manual"` device that never got a tailscale field at all) rendered
+ * "offline forever". This module is the single ordering the render + the
+ * write-back both go through, so the word and the persisted truth agree.
+ */
+import type { DeviceProfile, DeviceReachability, DeviceRegistry } from './registry.js';
+import type { DeviceStats } from './health.js';
+export type OnlineState = 'online' | 'offline' | 'unknown';
+/**
+ * Resolve a device's online/offline state, preferring the freshest signal.
+ *
+ * Precedence: a live stat from THIS run (the probe that just ran) > the
+ * persisted reachability verdict written back by a prior probe > the cached
+ * `tailscale.online` snapshot. 'unknown' only when nothing at all is known.
+ */
+export declare function deviceOnlineState(d: DeviceProfile, stats?: DeviceStats): OnlineState;
+/** Build the reachability verdict to persist from a fresh probe stat. Pure. */
+export declare function reachabilityFromStats(d: DeviceProfile, stats: DeviceStats): DeviceReachability;
+/**
+ * Collect the reachability verdicts to write back for a fleet's freshly-read
+ * stats map. Only devices present in the registry are included (a stat for a
+ * name we don't track is dropped rather than resurrected). Pure — the caller
+ * hands the result to {@link writeReachability}.
+ */
+export declare function collectReachabilityWriteBacks(reg: DeviceRegistry, statsMap: Map<string, DeviceStats>): Record<string, DeviceReachability>;

package/dist/lib/devices/reachability.js

@@ -0,0 +1,40 @@
+/**
+ * Resolve a device's online/offline state, preferring the freshest signal.
+ *
+ * Precedence: a live stat from THIS run (the probe that just ran) > the
+ * persisted reachability verdict written back by a prior probe > the cached
+ * `tailscale.online` snapshot. 'unknown' only when nothing at all is known.
+ */
+export function deviceOnlineState(d, stats) {
+    if (stats)
+        return stats.reachable ? 'online' : 'offline';
+    if (d.reachability)
+        return d.reachability.reachable ? 'online' : 'offline';
+    if (d.tailscale)
+        return d.tailscale.online ? 'online' : 'offline';
+    return 'unknown';
+}
+/** Build the reachability verdict to persist from a fresh probe stat. Pure. */
+export function reachabilityFromStats(d, stats) {
+    return {
+        reachable: stats.reachable,
+        via: d.address?.via,
+        checkedAt: new Date(stats.fetchedAt).toISOString(),
+    };
+}
+/**
+ * Collect the reachability verdicts to write back for a fleet's freshly-read
+ * stats map. Only devices present in the registry are included (a stat for a
+ * name we don't track is dropped rather than resurrected). Pure — the caller
+ * hands the result to {@link writeReachability}.
+ */
+export function collectReachabilityWriteBacks(reg, statsMap) {
+    const out = {};
+    for (const [name, stats] of statsMap) {
+        const d = reg[name];
+        if (!d)
+            continue;
+        out[name] = reachabilityFromStats(d, stats);
+    }
+    return out;
+}

package/dist/lib/devices/registry.d.ts

@@ -40,6 +40,24 @@ export interface DeviceTailscale {
     relay?: string;
     lastSeen?: string;
 }
+/**
+ * Verdict of the last live SSH reachability probe (RUSH-1965).
+ *
+ * The live `agents devices` probe already learns whether a box answered right
+ * now; this persists that answer so the online/offline word is read from a
+ * fresh probe instead of the potentially-stale {@link DeviceTailscale.online}
+ * snapshot (which only `agents devices sync` / the daemon ever writes). A
+ * `via:"manual"` device — which never gets a tailscale peer entry — gets a
+ * reachability verdict this way too, so it stops rendering "offline forever".
+ */
+export interface DeviceReachability {
+    /** Whether the last live probe reached the device. */
+    reachable: boolean;
+    /** Transport the verdict came through — the address kind used to dial it. */
+    via?: DeviceAddress['via'];
+    /** ISO-8601 timestamp of the probe that produced this verdict. */
+    checkedAt: string;
+}
 /** A single registered device. */
 export interface DeviceProfile {
     name: string;
@@ -49,6 +67,10 @@ export interface DeviceProfile {
     address: DeviceAddress;
     auth: DeviceAuth;
     tailscale?: DeviceTailscale;
+    /** Last live SSH-probe reachability verdict (RUSH-1965). Preferred over the
+     * cached {@link DeviceTailscale.online} snapshot when rendering online/offline,
+     * because the live probe reflects whether the box answered right now. */
+    reachability?: DeviceReachability;
     /** What the device is for. Absent means `worker` (see {@link DeviceRole}). */
     role?: DeviceRole;
     createdAt: string;
@@ -88,6 +110,7 @@ export interface DeviceInput {
     address?: DeviceAddress;
     auth?: DeviceAuth;
     tailscale?: DeviceTailscale;
+    reachability?: DeviceReachability;
     role?: DeviceRole;
 }
 /**
@@ -96,6 +119,16 @@ export interface DeviceInput {
  * platform so the two can never drift. Returns the resulting profile.
  */
 export declare function upsertDevice(name: string, input: DeviceInput): Promise<DeviceProfile>;
+/**
+ * Persist live reachability verdicts for many devices in one locked pass
+ * (RUSH-1965). A no-op verdict (same `reachable` and not newer than what's
+ * stored) is skipped, so a cache-served `agents devices` render doesn't churn
+ * the registry every call; only a flip or a fresher probe writes. Unlike
+ * {@link upsertDevice} this does NOT bump `updatedAt` — reachability is
+ * transient liveness (like the tailscale snapshot), not a profile edit. Unknown
+ * device names are ignored. Returns the names actually updated.
+ */
+export declare function writeReachability(updates: Record<string, DeviceReachability>): Promise<string[]>;
 /** Remove a device. Returns false if it was not registered. */
 export declare function removeDevice(name: string): Promise<boolean>;
 /** Load the set of ignored node names. Missing file => empty set. A malformed

package/dist/lib/devices/registry.js

@@ -178,6 +178,7 @@ export async function upsertDevice(name, input) {
             address: input.address ?? prev?.address ?? { via: 'manual' },
             auth: input.auth ?? prev?.auth ?? { method: 'key' },
             tailscale: input.tailscale ?? prev?.tailscale,
+            reachability: input.reachability ?? prev?.reachability,
             role: input.role ?? prev?.role,
             createdAt: prev?.createdAt ?? now,
             updatedAt: now,
@@ -187,6 +188,42 @@ export async function upsertDevice(name, input) {
         return merged;
     });
 }
+/**
+ * Persist live reachability verdicts for many devices in one locked pass
+ * (RUSH-1965). A no-op verdict (same `reachable` and not newer than what's
+ * stored) is skipped, so a cache-served `agents devices` render doesn't churn
+ * the registry every call; only a flip or a fresher probe writes. Unlike
+ * {@link upsertDevice} this does NOT bump `updatedAt` — reachability is
+ * transient liveness (like the tailscale snapshot), not a profile edit. Unknown
+ * device names are ignored. Returns the names actually updated.
+ */
+export async function writeReachability(updates) {
+    const names = Object.keys(updates);
+    if (names.length === 0)
+        return [];
+    const p = registryPath();
+    return withRegistryLock(p, async () => {
+        const reg = await loadDevices();
+        const changed = [];
+        for (const name of names) {
+            const prev = reg[name];
+            if (!prev)
+                continue; // never resurrect a device the user removed
+            const next = updates[name];
+            const cur = prev.reachability;
+            if (cur &&
+                cur.reachable === next.reachable &&
+                Date.parse(cur.checkedAt) >= Date.parse(next.checkedAt)) {
+                continue; // unchanged verdict, no fresher timestamp — skip the write
+            }
+            reg[name] = { ...prev, reachability: next };
+            changed.push(name);
+        }
+        if (changed.length > 0)
+            await saveDevices(reg);
+        return changed;
+    });
+}
 /** Remove a device. Returns false if it was not registered. */
 export async function removeDevice(name) {
     const p = registryPath();