@phnx-labs/agents-cli 1.20.77 → 1.20.78

package/dist/lib/session/digest.js

@@ -99,31 +99,136 @@ export function toolHistogram(toolCounts, top = 8) {
         .sort((a, b) => b.count - a.count || a.tool.localeCompare(b.tool))
         .slice(0, top);
 }
-/** Recognized test/build runners → the label we show. */
+/**
+ * Recognized test/build runners → the label we show.
+ *
+ * These match a *real invocation* of a runner, not any command that merely
+ * contains a runner token. In particular we must NOT fire on npm-script
+ * sub-targets like `bun test:setup`, `npm run test:watch`, or `pnpm test:ci` —
+ * those are setup/watch/CI-orchestration scripts, not a test run whose output we
+ * can scrape for a pass/fail verdict. A `test` token followed by `:something` is
+ * a distinct script name and is excluded via the `(?![:\w-])` guard.
+ */
 const TEST_RUNNERS = [
-    { re: /\b((?:bun|npm|yarn|pnpm)\s+(?:run\s+)?test|vitest|jest)\b/, label: 'tests' },
-    { re: /\bpytest\b/, label: 'pytest' },
-    { re: /\bgo\s+test\b/, label: 'go test' },
-    { re: /\bcargo\s+test\b/, label: 'cargo test' },
-    { re: /\b(tsc|tsc\s+--noEmit)\b/, label: 'tsc' },
+    // Package-manager `test` script: `bun test`, `npm test`, `npm run test`,
+    // `yarn test`, `pnpm test`. The negative lookahead `(?![:\w-])` rejects
+    // `test:watch` / `test-ci` / `testfoo` — only the bare `test` target counts.
+    { re: /\b(?:bun|npm|yarn|pnpm)\s+(?:run\s+)?test(?![:\w-])/, label: 'tests' },
+    // Direct binaries — `vitest`, `jest`, `mocha` (optionally via a runner). These
+    // are real invocations; a trailing subcommand like `vitest run` is fine.
+    { re: /\b(?:vitest|jest|mocha)(?![:\w-])/, label: 'tests' },
+    { re: /\bpytest(?![:\w-])/, label: 'pytest' },
+    { re: /\bgo\s+test(?![:\w-])/, label: 'go test' },
+    { re: /\bcargo\s+test(?![:\w-])/, label: 'cargo test' },
+    { re: /\btsc(?:\s+--noEmit)?(?![:\w-])/, label: 'tsc' },
 ];
+/**
+ * Anchored summary-line extractors, per runner family. Each returns a pass/fail
+ * verdict ONLY when it matches that runner's authoritative summary construct —
+ * never an arbitrary `\d+ pass`-shaped substring elsewhere in stdout. This is
+ * what stops `442 passwords generated`, `442 files`, or `442 passes/sec` from
+ * being reported as `442 pass`.
+ */
+function parseSummaryLine(output) {
+    const lines = output.split(/\r?\n/);
+    // vitest: ` Tests  1 failed | 2 passed (3)` (mixed) or ` Tests  2 passed (2)`
+    // (all green). Leading indent + the `Tests` / `Test Files` label + double
+    // space is the summary row. Prefer the ` Tests ` row (test count) over the
+    // ` Test Files ` row (file count).
+    for (const label of ['Tests', 'Test Files']) {
+        for (const line of lines) {
+            const row = new RegExp(`^\\s*${label}\\s{2,}(.+)$`).exec(line);
+            if (!row)
+                continue;
+            const seg = row[1];
+            const passed = /(\d+)\s+passed/.exec(seg);
+            const failed = /(\d+)\s+failed/.exec(seg);
+            // Only accept a vitest row that actually reports a pass/fail count.
+            if (passed || failed) {
+                return {
+                    passed: passed ? +passed[1] : undefined,
+                    failed: failed ? +failed[1] : 0,
+                };
+            }
+        }
+    }
+    // jest: `Tests:       1 failed, 2 passed, 3 total`. The `Tests:` label anchors
+    // it; order of failed/passed varies.
+    for (const line of lines) {
+        const row = /^\s*Tests:\s+(.+)$/.exec(line);
+        if (!row)
+            continue;
+        const seg = row[1];
+        const passed = /(\d+)\s+passed/.exec(seg);
+        const failed = /(\d+)\s+failed/.exec(seg);
+        if (passed || failed) {
+            return { passed: passed ? +passed[1] : undefined, failed: failed ? +failed[1] : 0 };
+        }
+    }
+    // pytest: the summary rule line `==== 3 passed, 1 failed in 0.12s ====`. The
+    // surrounding `=` rule and the ` in <dur>s` tail anchor it to the real footer,
+    // not a stray `N passed` in captured stdout.
+    for (const line of lines) {
+        if (!/={3,}.*\bin\s+[\d.]+s\b.*={3,}/.test(line) && !/^={3,}.*={3,}$/.test(line))
+            continue;
+        if (!/\bin\s+[\d.]+m?s\b/.test(line))
+            continue;
+        const passed = /(\d+)\s+passed/.exec(line);
+        const failed = /(\d+)\s+failed/.exec(line);
+        const errors = /(\d+)\s+error/.exec(line);
+        if (passed || failed || errors) {
+            const failCount = (failed ? +failed[1] : 0) + (errors ? +errors[1] : 0);
+            return { passed: passed ? +passed[1] : undefined, failed: failed || errors ? failCount : 0 };
+        }
+    }
+    // bun test: a summary block of ` N pass` / ` N fail` lines (each its own line,
+    // leading-indented), closed by `Ran N tests across M files.`. Require the
+    // `Ran … tests` sentinel to be present so we only read bun's real summary
+    // block — bun also prints inline `(pass)`/`(fail)` per-test lines we ignore.
+    if (/^Ran\s+\d+\s+tests?\b/m.test(output)) {
+        let passed;
+        let failed;
+        for (const line of lines) {
+            const p = /^\s*(\d+)\s+pass$/.exec(line);
+            const f = /^\s*(\d+)\s+fail$/.exec(line);
+            if (p)
+                passed = +p[1];
+            if (f)
+                failed = +f[1];
+        }
+        if (passed !== undefined || failed !== undefined) {
+            return { passed, failed: failed ?? 0 };
+        }
+    }
+    // mocha: ` 2 passing` / ` 1 failing` (leading-indented, own line). The
+    // `passing`/`failing` gerund is mocha-specific and won't match `442 passwords`.
+    {
+        let passed;
+        let failed;
+        for (const line of lines) {
+            const p = /^\s*(\d+)\s+passing\b/.exec(line);
+            const f = /^\s*(\d+)\s+failing\b/.exec(line);
+            if (p)
+                passed = +p[1];
+            if (f)
+                failed = +f[1];
+        }
+        if (passed !== undefined || failed !== undefined) {
+            return { passed, failed: failed ?? 0 };
+        }
+    }
+    return undefined;
+}
 /** Parse pass/fail counts from common runner output. */
 function parseTestOutput(runner, output) {
-    // vitest/jest/bun: "N passed", "N failed"; pytest: "N passed, N failed".
-    // Take the LAST occurrence — runners print a per-file line first, then the
-    // authoritative aggregate ("Tests 4 failed | 294 passed") at the end.
-    const lastNum = (re) => {
-        let m;
-        let val;
-        const g = new RegExp(re.source, 'gi');
-        while ((m = g.exec(output)) !== null)
-            val = +m[1];
-        return val;
-    };
-    const passed = lastNum(/(\d+)\s+pass(?:ed)?/);
-    const failed = lastNum(/(\d+)\s+fail(?:ed|ures?)?/);
-    if (passed !== undefined || failed !== undefined) {
-        return { passed, failed, ok: true };
+    // Anchor to a recognized runner summary construct (vitest ` Tests `, jest
+    // `Tests:`, pytest `=== N passed in Xs ===`, bun's `N pass`/`N fail` block,
+    // mocha `N passing`) — never a blanket `\d+ pass`-shaped scrape over stdout.
+    // That blanket scrape used to report `442 passwords`, `442 files passed
+    // validation`, or a `442 passes/sec` benchmark as `442 pass`.
+    const summary = parseSummaryLine(output);
+    if (summary) {
+        return { ...summary, ok: true };
     }
     // tsc: no news is good news; "error TSxxxx" means failure.
     if (runner === 'tsc') {

package/dist/lib/session/discover.d.ts

@@ -7,6 +7,7 @@
  * subsequent queries are served entirely from the cache.
  */
 import type { SessionAgentId, SessionEvent, SessionMeta, TodoProgress } from './types.js';
+export { machineForSessionFile } from './origin-machine.js';
 import { type ScanStamp } from './db.js';
 /** Options controlling which sessions to discover and how to report progress. */
 export interface DiscoverOptions {
@@ -148,7 +149,6 @@ export declare function scanAgentsBounded<T>(items: readonly T[], run: (item: T)
  * `agents add --isolated`, where the whole point was to keep the two apart.
  */
 export declare function isManagedSessionFile(filePath: string): boolean;
-export declare function machineForSessionFile(filePath: string, agent: string): string;
 /**
  * Count sessions in scope without running an incremental scan. Assumes the DB
  * is already fresh (typically true because `discoverSessions` ran first this
@@ -194,6 +194,20 @@ export declare function _normalizeCwdForTest(cwd?: string): string;
  * ids, whose charset is too permissive to distinguish from a search phrase.
  */
 export declare function isCompleteSessionId(query: string): boolean;
+/**
+ * Whether a query should be treated as a session id rather than a search phrase
+ * — the one canonical id-shaped test, shared by every session-id resolver.
+ *
+ * True for a complete id (`isCompleteSessionId`) AND for a bare hex short-id or
+ * prefix (`d3470b57`), which the complete-id check rejects. Any id-shaped query
+ * resolves by id ONLY (exact -> prefix -> `findSessionsById` index) and must
+ * never fall back to fuzzy content search: a short id like `d3470b57` otherwise
+ * surfaces every transcript that merely MENTIONS the string (a resume prompt
+ * echoes the parent id into the body of many later sessions). The hex test
+ * catches the bare short-id/prefix; `isCompleteSessionId` additionally catches
+ * the prefixed whole ids (`session_…`, `ses_…`) that the hex test rejects.
+ */
+export declare function looksLikeSessionId(query: string): boolean;
 /**
  * Resolve a session by full or short ID. Accepts a pre-loaded session list
  * (fast path from discoverSessions) and falls back to a DB lookup for the
@@ -653,4 +667,3 @@ export declare function readGrokMeta(filePath: string, currentVersion?: string):
 } | null;
 /** Parse a time filter string (relative like '7d' or ISO timestamp) into epoch milliseconds. */
 export declare function parseTimeFilter(input: string): number;
-export {};

package/dist/lib/session/discover.js

@@ -26,7 +26,8 @@ import { extractSessionTopic } from './prompt.js';
 import { parseAntigravity } from './parse.js';
 import { extractPrUrl, detectWorktree, detectTicket, isPrCreateCommand, detectSpawnedTeam, isTicketCreateTool, extractCreatedTicket, extractRecentDirectoriesTouched, extractTodoProgressFromEvents } from './state.js';
 import { costOfUsage } from '../pricing/index.js';
-import { machineId } from './sync/config.js';
+import { machineForSessionFile } from './origin-machine.js';
+export { machineForSessionFile } from './origin-machine.js';
 import { mapBounded } from '../concurrency.js';
 import { getDB, getScanStampByPath, getScanStampsForPaths, getParserStatesForPaths, getDirLedgerForPaths, recordDirScans, recordScans, syncLabels, seedLabelsFromNames, syncTopics, upsertSessionsBatch, querySessions, countSessions, ftsSearch, tryClaimScan, releaseScan, cacheLinearProject, } from './db.js';
 import { buildRunNameMap } from './run-names.js';
@@ -223,7 +224,6 @@ function dispatchAgentScan(agent, onProgress) {
         default: return Promise.resolve();
     }
 }
-let _localMachineId;
 /**
  * The machine a discovered session originated on. Cross-machine sync mirrors a
  * remote transcript to backups/<agent>/<machine>/<subdir>/… (see mirrorPath in
@@ -270,15 +270,6 @@ export function isManagedSessionFile(filePath) {
         return !!realRoot && real.startsWith(realRoot + path.sep);
     });
 }
-export function machineForSessionFile(filePath, agent) {
-    const base = path.join(getHistoryDir(), 'backups', agent) + path.sep;
-    if (filePath.startsWith(base)) {
-        const seg = filePath.slice(base.length).split(path.sep)[0];
-        if (seg)
-            return seg;
-    }
-    return (_localMachineId ??= machineId());
-}
 /**
  * Count sessions in scope without running an incremental scan. Assumes the DB
  * is already fresh (typically true because `discoverSessions` ran first this
@@ -388,6 +379,23 @@ export function isCompleteSessionId(query) {
     const q = query.trim().toLowerCase();
     return UUID_36.test(q.replace(SESSION_UUID_PREFIX, '')) || SES_ULID.test(q);
 }
+/**
+ * Whether a query should be treated as a session id rather than a search phrase
+ * — the one canonical id-shaped test, shared by every session-id resolver.
+ *
+ * True for a complete id (`isCompleteSessionId`) AND for a bare hex short-id or
+ * prefix (`d3470b57`), which the complete-id check rejects. Any id-shaped query
+ * resolves by id ONLY (exact -> prefix -> `findSessionsById` index) and must
+ * never fall back to fuzzy content search: a short id like `d3470b57` otherwise
+ * surfaces every transcript that merely MENTIONS the string (a resume prompt
+ * echoes the parent id into the body of many later sessions). The hex test
+ * catches the bare short-id/prefix; `isCompleteSessionId` additionally catches
+ * the prefixed whole ids (`session_…`, `ses_…`) that the hex test rejects.
+ */
+export function looksLikeSessionId(query) {
+    const trimmed = query.trim();
+    return /^[0-9a-f-]{6,}$/i.test(trimmed) || isCompleteSessionId(trimmed);
+}
 /**
  * Resolve a session by full or short ID. Accepts a pre-loaded session list
  * (fast path from discoverSessions) and falls back to a DB lookup for the

package/dist/lib/session/origin-machine.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Resolve which machine a session transcript originated on.
+ *
+ * Cross-machine sync mirrors a remote transcript to
+ * `backups/<agent>/<machine>/<subdir>/…`. Every other transcript is a live-home
+ * file on this box, so the origin is the local machine id.
+ *
+ * Kept in a leaf module (no session/db imports) so both discovery and the
+ * sessions DB upsert path can stamp `machine` without circular deps.
+ */
+/** Local machine id, cached for the process lifetime. */
+export declare function localMachineId(): string;
+/**
+ * The machine a discovered session originated on.
+ * When the path sits under the agent's backups root, the first segment below it
+ * is the origin machine id; otherwise it's the local machine.
+ */
+export declare function machineForSessionFile(filePath: string, agent: string): string;

package/dist/lib/session/origin-machine.js

@@ -0,0 +1,34 @@
+/**
+ * Resolve which machine a session transcript originated on.
+ *
+ * Cross-machine sync mirrors a remote transcript to
+ * `backups/<agent>/<machine>/<subdir>/…`. Every other transcript is a live-home
+ * file on this box, so the origin is the local machine id.
+ *
+ * Kept in a leaf module (no session/db imports) so both discovery and the
+ * sessions DB upsert path can stamp `machine` without circular deps.
+ */
+import * as path from 'path';
+import { getHistoryDir } from '../state.js';
+import { machineId } from '../machine-id.js';
+let _localMachineId;
+/** Local machine id, cached for the process lifetime. */
+export function localMachineId() {
+    return (_localMachineId ??= machineId());
+}
+/**
+ * The machine a discovered session originated on.
+ * When the path sits under the agent's backups root, the first segment below it
+ * is the origin machine id; otherwise it's the local machine.
+ */
+export function machineForSessionFile(filePath, agent) {
+    if (!filePath)
+        return localMachineId();
+    const base = path.join(getHistoryDir(), 'backups', agent) + path.sep;
+    if (filePath.startsWith(base)) {
+        const seg = filePath.slice(base.length).split(path.sep)[0];
+        if (seg)
+            return seg;
+    }
+    return localMachineId();
+}

package/dist/lib/session/state.d.ts

@@ -130,6 +130,7 @@ export declare function extractTodoProgress(args?: Record<string, any>): TodoPro
 export declare function extractTodoProgressFromEvents(events: SessionEvent[]): TodoProgress | undefined;
 /** Derive a recency-ordered, de-duplicated list of directories touched by tools. */
 export declare function extractRecentDirectoriesTouched(events: SessionEvent[], cwd?: string): string[] | undefined;
+export declare const WORKTREE_RE: RegExp;
 /** Detect a worktree from the session cwd, per the `.agents/worktrees/<slug>/` convention. */
 export declare function detectWorktree(cwd?: string, branch?: string): DetectedWorktree | undefined;
 /** Detect a tracker ticket from free text (prompt/topic) then a branch name. */

package/dist/lib/session/state.js

@@ -188,7 +188,7 @@ const TICKET_BRANCH_RE = /(?:^|[/_-])([a-z]{2,6})-(\d{2,6})(?=[/_-]|$)/;
 /** Keys that look like tickets but aren't — avoid false positives from branches. */
 const TICKET_DENYLIST = new Set(['UTF', 'SHA', 'ISO', 'RFC', 'IPV', 'X86', 'ARM', 'MP', 'H']);
 const PR_URL_RE = /https:\/\/github\.com\/[^\s"'()<>]+\/pull\/(\d+)/;
-const WORKTREE_RE = /\/\.agents\/worktrees\/([^/]+)/;
+export const WORKTREE_RE = /\/\.agents\/worktrees\/([^/]+)/;
 /** gh invocations that create/open a PR. */
 const GH_PR_CREATE_RE = /\bgh\s+pr\s+(?:create|new)\b/;
 /** gh invocation that opens an issue — the created number is read from its result. */

package/dist/lib/session/sync/config.js

@@ -15,8 +15,8 @@ function resolveR2Config() {
     // The daemon monitor loop is headless by construction (no TTY, ever), so
     // isHeadlessSecretsContext() is true here and this resolves broker-only — a
     // broker miss can never pop an unattended Touch ID sheet on the user's screen
-    // (same rationale as daemon.ts readDaemonClaudeOAuthToken). Using the shared
-    // predicate rather than a literal keeps it consistent with the other callers
+    // (the same broker-only-when-headless rationale the secrets readers use). Using
+    // the shared predicate rather than a literal keeps it consistent with the other callers
     // and lets any interactive caller of loadR2Config still prompt.
     const { env } = readAndResolveBundleEnv(SYNC_BUNDLE, { caller: 'sessions-sync', agentOnly: isHeadlessSecretsContext() });
     const accountId = env.R2_ACCOUNT_ID?.trim();

package/dist/lib/smart-launch.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Device affinity for `--device auto` / `--host auto`.
+ *
+ * Picks a host from 14d session usage (launches by machine), weighted sample
+ * among online devices. Most-used has highest probability — not a hard lock.
+ * Account selection is separate (`--strategy balanced` / rotate.ts).
+ */
+import { type AffinityRow } from './session/db.js';
+/** Peakiness of usage weights; >1 amplifies the most-used option. */
+export declare const DEFAULT_AFFINITY_ALPHA = 1.3;
+export interface WeightedCandidate {
+    key: string;
+    launches: number;
+    weight: number;
+}
+/**
+ * Convert affinity rows into positive weights: launches^α (floor 1 for any
+ * row with launches > 0 so a single-use host still participates).
+ */
+export declare function affinityWeights(rows: AffinityRow[], alpha?: number): WeightedCandidate[];
+/**
+ * Weighted random sample. Returns null when candidates is empty.
+ * Pure — inject `rng` for tests.
+ */
+export declare function sampleWeighted(candidates: WeightedCandidate[], rng?: () => number): string | null;
+/** Online device names from the local registry (+ always include local). */
+export declare function listOnlineDeviceNames(localName?: string): string[];
+export interface DeviceAffinityOptions {
+    sinceDays?: number;
+    alpha?: number;
+    /**
+     * Eligible hosts (normalized). Defaults to online devices + local.
+     * Empty after filter → fall back to local.
+     */
+    eligibleHosts?: string[];
+    localMachine?: string;
+    /** Injected affinity (tests). When omitted, reads sessions.db. */
+    deviceAffinity?: AffinityRow[];
+    rng?: () => number;
+    project?: string;
+}
+export interface DeviceAffinityPlan {
+    /** null means run locally (do not pass --host). */
+    host: string | null;
+    deviceCandidates: WeightedCandidate[];
+    pickedDeviceKey: string | null;
+}
+/**
+ * Resolve host for `--device auto`. Does NOT pick harness or accounts.
+ */
+export declare function resolveDeviceAffinity(opts?: DeviceAffinityOptions): DeviceAffinityPlan;
+/** True when a host flag value means affinity pick. */
+export declare function isDeviceAuto(value: string | undefined | null): boolean;
+export type DeviceAutoHostOptions = {
+    host?: string;
+    device?: string;
+    on?: string;
+    computer?: string;
+    /** @deprecated Hidden alias for `--device auto`. */
+    smart?: boolean;
+    balanced?: boolean;
+    strategy?: string;
+};
+export type DeviceAutoApplyResult = {
+    /** True when affinity ran (success or degrade-to-local). */
+    attempted: boolean;
+    /** True when deprecated `--smart` was seen. */
+    deprecationSmart: boolean;
+    /** Affinity threw: host slots cleared → local; message for stderr. */
+    skipped?: string;
+    /** Present when affinity resolved without error. */
+    banner?: {
+        hostLabel: string;
+        deviceHint: string;
+        acctNote: string;
+    };
+};
+/**
+ * Apply `--device auto` / `--host auto` (and deprecated `--smart`) onto run options.
+ * Mutates `options` in place. On affinity failure, clears auto slots (local) and
+ * returns `skipped` — never throws; callers must not hard-exit.
+ */
+export declare function applyDeviceAutoToOptions(options: DeviceAutoHostOptions, deps?: {
+    resolve?: () => DeviceAffinityPlan;
+    accountPickerRequested?: boolean;
+}): DeviceAutoApplyResult;

package/dist/lib/smart-launch.js

@@ -0,0 +1,172 @@
+/**
+ * Device affinity for `--device auto` / `--host auto`.
+ *
+ * Picks a host from 14d session usage (launches by machine), weighted sample
+ * among online devices. Most-used has highest probability — not a hard lock.
+ * Account selection is separate (`--strategy balanced` / rotate.ts).
+ */
+import { queryAffinityRollup } from './session/db.js';
+import { localMachineId } from './session/origin-machine.js';
+import { loadDevicesSync } from './devices/registry.js';
+import { normalizeHost } from './machine-id.js';
+/** Peakiness of usage weights; >1 amplifies the most-used option. */
+export const DEFAULT_AFFINITY_ALPHA = 1.3;
+/**
+ * Convert affinity rows into positive weights: launches^α (floor 1 for any
+ * row with launches > 0 so a single-use host still participates).
+ */
+export function affinityWeights(rows, alpha = DEFAULT_AFFINITY_ALPHA) {
+    return rows
+        .filter((r) => r.launches > 0 && r.key && r.key !== '(unknown)')
+        .map((r) => ({
+        key: r.key,
+        launches: r.launches,
+        weight: Math.max(1, Math.pow(r.launches, alpha)),
+    }));
+}
+/**
+ * Weighted random sample. Returns null when candidates is empty.
+ * Pure — inject `rng` for tests.
+ */
+export function sampleWeighted(candidates, rng = Math.random) {
+    if (candidates.length === 0)
+        return null;
+    const total = candidates.reduce((s, c) => s + c.weight, 0);
+    if (total <= 0)
+        return candidates[0].key;
+    let roll = rng() * total;
+    for (const c of candidates) {
+        roll -= c.weight;
+        if (roll <= 0)
+            return c.key;
+    }
+    return candidates[candidates.length - 1].key;
+}
+/** Online device names from the local registry (+ always include local). */
+export function listOnlineDeviceNames(localName = localMachineId()) {
+    const names = new Set([normalizeHost(localName)]);
+    try {
+        const reg = loadDevicesSync();
+        for (const [name, d] of Object.entries(reg)) {
+            if (!d || typeof d !== 'object')
+                continue;
+            const online = d.tailscale?.online;
+            // No tailscale snapshot → treat as candidate (registry-only box).
+            if (online === false)
+                continue;
+            names.add(normalizeHost(name));
+        }
+    }
+    catch {
+        /* registry missing — local only */
+    }
+    return [...names];
+}
+/**
+ * Resolve host for `--device auto`. Does NOT pick harness or accounts.
+ */
+export function resolveDeviceAffinity(opts = {}) {
+    const local = normalizeHost(opts.localMachine ?? localMachineId());
+    const alpha = opts.alpha ?? DEFAULT_AFFINITY_ALPHA;
+    const rng = opts.rng ?? Math.random;
+    const sinceDays = opts.sinceDays ?? 14;
+    const sinceMs = Date.now() - sinceDays * 24 * 60 * 60 * 1000;
+    const eligible = new Set((opts.eligibleHosts ?? listOnlineDeviceNames(local)).map(normalizeHost));
+    if (eligible.size === 0)
+        eligible.add(local);
+    const deviceRows = opts.deviceAffinity ??
+        queryAffinityRollup({
+            groupBy: 'machine',
+            sinceMs,
+            excludeTeamOrigin: true,
+            onlyCli: true,
+            project: opts.project,
+        });
+    // Hosts with history get launches^α; online hosts with no history explore at weight 1.
+    const launchesByHost = new Map();
+    for (const r of deviceRows) {
+        const k = normalizeHost(r.key);
+        if (!eligible.has(k) || k === '(unknown)')
+            continue;
+        launchesByHost.set(k, (launchesByHost.get(k) ?? 0) + r.launches);
+    }
+    let deviceWeights = [...eligible].map((key) => {
+        const launches = launchesByHost.get(key) ?? 0;
+        return {
+            key,
+            launches,
+            weight: launches > 0 ? Math.max(1, Math.pow(launches, alpha)) : 1,
+        };
+    });
+    if (deviceWeights.length === 0) {
+        deviceWeights = [{ key: local, launches: 1, weight: 1 }];
+    }
+    const pickedDeviceKey = sampleWeighted(deviceWeights, rng);
+    const hostNorm = pickedDeviceKey ? normalizeHost(pickedDeviceKey) : local;
+    const host = hostNorm === local ? null : hostNorm;
+    return {
+        host,
+        deviceCandidates: deviceWeights,
+        pickedDeviceKey,
+    };
+}
+/** True when a host flag value means affinity pick. */
+export function isDeviceAuto(value) {
+    return typeof value === 'string' && value.trim().toLowerCase() === 'auto';
+}
+const HOST_SLOTS = ['host', 'device', 'on', 'computer'];
+/**
+ * Apply `--device auto` / `--host auto` (and deprecated `--smart`) onto run options.
+ * Mutates `options` in place. On affinity failure, clears auto slots (local) and
+ * returns `skipped` — never throws; callers must not hard-exit.
+ */
+export function applyDeviceAutoToOptions(options, deps = {}) {
+    let deprecationSmart = false;
+    if (options.smart) {
+        const anyHost = HOST_SLOTS.some((k) => typeof options[k] === 'string' && options[k].trim() !== '');
+        if (!anyHost)
+            options.device = 'auto';
+        deprecationSmart = true;
+    }
+    const hasAuto = HOST_SLOTS.some((k) => isDeviceAuto(options[k]));
+    if (!hasAuto) {
+        return { attempted: false, deprecationSmart };
+    }
+    try {
+        const plan = (deps.resolve ?? (() => resolveDeviceAffinity({})))();
+        const concrete = plan.host; // null = local
+        for (const k of HOST_SLOTS) {
+            if (isDeviceAuto(options[k])) {
+                options[k] = concrete ?? undefined;
+            }
+        }
+        const accountPickerRequested = deps.accountPickerRequested ?? false;
+        if (!accountPickerRequested && !options.strategy && !options.balanced) {
+            options.balanced = true;
+        }
+        const hostLabel = concrete ?? 'local';
+        const deviceHint = plan.deviceCandidates
+            .slice(0, 4)
+            .map((c) => `${c.key}:${c.launches}`)
+            .join(', ');
+        const acctNote = accountPickerRequested ? 'accounts=picker' : 'accounts=balanced';
+        return {
+            attempted: true,
+            deprecationSmart,
+            banner: { hostLabel, deviceHint, acctNote },
+        };
+    }
+    catch (err) {
+        // Graceful degrade: clear auto slots so the run continues locally.
+        for (const k of HOST_SLOTS) {
+            if (isDeviceAuto(options[k])) {
+                options[k] = undefined;
+            }
+        }
+        return {
+            attempted: true,
+            deprecationSmart,
+            skipped: err.message,
+        };
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.77",
+  "version": "1.20.78",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",

package/dist/lib/secrets/account-token.d.ts

@@ -1,20 +0,0 @@
-/** The `CLAUDE_CODE_OAUTH_TOKEN_<slug>` env key for a given account email/id. */
-export declare function accountTokenKey(account: string): string;
-/**
- * Read the signed-in account email for a Claude version home from
- * `oauthAccount.emailAddress`. Sync, no keychain, no network. Tries both stores
- * the canonical resolver uses (agents.ts getAccountInfo): the shim-set
- * `CLAUDE_CONFIG_DIR` location `<home>/.claude/.claude.json` first, then the
- * home-level `<home>/.claude.json` (an account signed in via the IDE / direct
- * binary without the shim writes there). Returns null when neither has a usable
- * email.
- */
-export declare function readClaudeAccountEmail(home: string): string | null;
-/**
- * Resolve the per-account setup-token for the account pinned to `home`, looking
- * it up in the provided env (the daemon injects the `claude` bundle's
- * `CLAUDE_CODE_OAUTH_TOKEN_*` keys). Returns null when the home has no known
- * account, or no matching per-account token is present — callers then leave the
- * existing ambient/interactive credential untouched (a safe no-op).
- */
-export declare function resolveAccountSetupToken(env: Record<string, string | undefined>, home: string): string | null;