@phnx-labs/agents-cli 1.20.93 → 1.21.0

package/dist/lib/sync-umbrella.js

@@ -2,18 +2,17 @@
  * Umbrella `agents sync` orchestration — "make this machine current".
  *
  * Bare `agents sync` fetches the config repos then reconciles them into every
- * installed agent's version home. Secrets and sessions are opt-in stages
- * (`--secrets` / `--sessions`) — see `planUmbrellaStages` for why they're off by
- * default. Each stage is an existing exported library function; this module only
- * sequences them and decides — from the flags — which stages run. The planner is
- * pure so the flag matrix is unit-tested without any I/O.
+ * installed agent's version home. Secrets are an opt-in stage (`--secrets`) —
+ * see `planUmbrellaStages` for why it's off by default. Each stage is an
+ * existing exported library function; this module only sequences them and
+ * decides — from the flags — which stages run. The planner is pure so the
+ * flag matrix is unit-tested without any I/O.
  *
  * Stage backends:
  *   repos    -> git pull of ~/.agents + enabled ~/.agents-* extras (pullRepo)
  *   secrets  -> listRemoteBundles + pullBundle (needs a passphrase; skipped
  *               cleanly when none is available — tokenized non-interactive auth
  *               arrives with `agents login`, #366/#367)
- *   sessions -> syncSessions(), gated by the session-sync beta opt-in + isSyncConfigured(), like the daemon
  *   reconcile-> refresh({ skipPrompts }) — re-materialize resources into homes
  */
 import { pullRepo } from './git.js';
@@ -24,34 +23,31 @@ import { listRemoteBundles, pullBundle } from './secrets/sync.js';
  *   bare (no flags)        fetch repos, then reconcile
  *   --local                reconcile only, no fetch
  *   --cloud                fetch repos (or the selected subset), skip reconcile
- *   --repos/--secrets/...  fetch only the selected types, then reconcile
+ *   --repos/--secrets      fetch only the selected types, then reconcile
  * `--local` wins over everything; `--cloud` suppresses reconcile.
  *
- * Secrets and sessions are NOT part of the bare default — they are opt-in via
- * `--secrets` / `--sessions`. Pulling every secret bundle onto the machine on a
- * bare `agents sync` is more blast radius than the verb should carry by
- * default, and session transcripts are queryable on demand (`agents sessions
- * --host <machine>`) so they don't need eager mirroring.
+ * Secrets are NOT part of the bare default — they are opt-in via `--secrets`.
+ * Pulling every secret bundle onto the machine on a bare `agents sync` is more
+ * blast radius than the verb should carry by default.
  */
 export function planUmbrellaStages(f) {
     if (f.local) {
-        return { fetchRepos: false, fetchSecrets: false, fetchSessions: false, reconcile: true };
+        return { fetchRepos: false, fetchSecrets: false, reconcile: true };
     }
-    const anySelector = !!(f.repos || f.secrets || f.sessions);
+    const anySelector = !!(f.repos || f.secrets);
     if (anySelector) {
         return {
             fetchRepos: !!f.repos,
             fetchSecrets: !!f.secrets,
-            fetchSessions: !!f.sessions,
             reconcile: !f.cloud,
         };
     }
     // No per-type selector: bare = repos + reconcile; --cloud = repos, no
-    // reconcile. Secrets/sessions stay off unless explicitly selected above.
-    return { fetchRepos: true, fetchSecrets: false, fetchSessions: false, reconcile: !f.cloud };
+    // reconcile. Secrets stay off unless explicitly selected above.
+    return { fetchRepos: true, fetchSecrets: false, reconcile: !f.cloud };
 }
 /**
- * Execute the planned stages in order: repos -> secrets -> sessions -> reconcile.
+ * Execute the planned stages in order: repos -> secrets -> reconcile.
  * A failure in one fetch stage is recorded and does not abort the others or the
  * reconcile — `agents sync` should make as much current as it can in one pass.
  */
@@ -110,33 +106,6 @@ export async function runUmbrellaSync(args) {
             result.secrets = { pulled, skipped: false, errors };
         }
     }
-    if (plan.fetchSessions) {
-        // Gate exactly like the daemon: without the `session-sync` beta opt-in (or
-        // with a missing r2.backups bundle) this is a clean no-op, not an error that
-        // fails the whole sync.
-        const { isBetaEnabled } = await import('./beta.js');
-        const { isSyncConfigured } = await import('./session/sync/config.js');
-        if (isBetaEnabled('session-sync') && isSyncConfigured()) {
-            const { syncSessions } = await import('./session/sync/sync.js');
-            // Record a failure here instead of letting it throw: like the fetchSecrets
-            // block above, a failure in one fetch stage must not abort the others or
-            // the reconcile below (see this function's doc comment). Without this,
-            // syncSessions() throwing — e.g. via the C1 containment reject on a
-            // malicious peer manifest — would skip `plan.reconcile` entirely.
-            try {
-                const r = await syncSessions();
-                result.sessions = { ran: true, pushed: r.pushed, pulled: r.pulled, merged: r.merged };
-                log(`sessions: pushed ${r.pushed}, pulled ${r.pulled}, merged ${r.merged}`);
-            }
-            catch (err) {
-                result.sessions = { ran: false, pushed: 0, pulled: 0, merged: 0, error: err.message };
-                log(`sessions: failed — ${err.message}`);
-            }
-        }
-        else {
-            result.sessions = { ran: false, pushed: 0, pulled: 0, merged: 0 };
-        }
-    }
     if (plan.reconcile) {
         const { refresh } = await import('./refresh.js');
         await refresh({ skipPrompts: yes });

package/dist/lib/teams/agents.d.ts

@@ -218,13 +218,30 @@ export declare class AgentProcess {
      * Uses a per-wave batched snapshot (remotePollSnapshot) when the supervisor's
      * one-ssh-per-host pre-pass populated it; otherwise falls back to its own
      * round-trips so a bare `teams status`/`teams logs` is still correct.
+     *
+     * Only polls a teammate that is plausibly still RUNNING (RUSH-2118). Once a
+     * remote teammate reaches a terminal status, the poll that resolved it already
+     * mirrored the final log bytes and read the `.exit` sentinel in this SAME
+     * function (delta pulled before the exit check below) — the underlying process
+     * is gone and can never write more, so there is nothing left to fetch. Without
+     * this guard every finished remote teammate still cost one ssh round-trip on
+     * EVERY `--active`/`listAll` poll forever, which is what made `agents sessions
+     * --active --local` take ~4.3s on a box with 30 completed teammates.
      */
     private syncRemoteMirror;
     /** Reset the local stdout cursor for a newly truncated resume log. */
     resetLogReadPosition(): number;
     /** Restore the cursor when a resume transaction puts the prior log back. */
     restoreLogReadPosition(position: number): void;
-    readNewEvents(): Promise<void>;
+    /**
+     * @param opts.skipRemote A `--local` caller (RUSH-2118): never dial a
+     *   remote-host teammate, not even a still-RUNNING one — report its
+     *   last-persisted meta.json state as-is. A local-only query is by definition
+     *   this-machine-only, so it must not issue an ssh round-trip at all.
+     */
+    readNewEvents(opts?: {
+        skipRemote?: boolean;
+    }): Promise<void>;
     /**
      * Truncate the local mirror to its trailing REMOTE_MIRROR_MAX_BYTES and reset
      * lastReadPos to the new (smaller) size so the parser doesn't re-read the kept
@@ -244,7 +261,14 @@ export declare class AgentProcess {
     saveMeta(): Promise<void>;
     static loadFromDisk(agentId: string, baseDir?: string | null): Promise<AgentProcess | null>;
     isProcessAlive(): boolean;
-    updateStatusFromProcess(): Promise<void>;
+    /**
+     * @param opts.skipRemote A `--local` caller (RUSH-2118): a distributed
+     *   teammate is never dialed — its in-memory state (already loaded from
+     *   meta.json) stands as-is, no ssh, no re-save.
+     */
+    updateStatusFromProcess(opts?: {
+        skipRemote?: boolean;
+    }): Promise<void>;
     /**
      * Recover the teammate's exit status after its process is gone.
      *
@@ -298,8 +322,16 @@ export declare class AgentManager {
     private defaultMode;
     private initPromise;
     private cloudDispatcher;
+    /**
+     * A `--local` caller (RUSH-2118): every poll this manager issues skips the
+     * ssh round-trip for a distributed (remote-host) teammate, reporting its
+     * last-persisted meta.json state instead. Set once at construction so the
+     * INITIAL load in doInitialize()/loadExistingAgents() — which polls every
+     * teammate before listRunning()/listAll() ever run — honors it too.
+     */
+    private localOnly;
     private constructorAgentsDir;
-    constructor(maxAgents?: number, agentsDir?: string | null, defaultMode?: Mode | null, filterByCwd?: string | null, cleanupAgeDays?: number);
+    constructor(maxAgents?: number, agentsDir?: string | null, defaultMode?: Mode | null, filterByCwd?: string | null, cleanupAgeDays?: number, localOnly?: boolean);
     private initialize;
     private doInitialize;
     getDefaultMode(): Mode;

package/dist/lib/teams/agents.js

@@ -34,7 +34,9 @@ import { resolveRemoteOsSync } from '../hosts/remote-os.js';
 import { pullRemoteLogDelta, REMOTE_MIRROR_MAX_BYTES } from '../hosts/progress.js';
 import { createRemoteWorktree, ensureRemoteRepo } from './remoteWorktree.js';
 import { getTeam } from './registry.js';
-import { resolvePlacement } from './scheduler.js';
+import { resolvePlacement, cappedDevices } from './scheduler.js';
+import { readMaxConcurrentCaps } from '../device-config.js';
+import chalk from 'chalk';
 let lastMemoryWarnAt = 0;
 // On macOS, os.freemem() returns only the truly-free pool and ignores the
 // large inactive+purgeable cache the kernel will reclaim under pressure, so
@@ -669,10 +671,21 @@ export class AgentProcess {
      * Uses a per-wave batched snapshot (remotePollSnapshot) when the supervisor's
      * one-ssh-per-host pre-pass populated it; otherwise falls back to its own
      * round-trips so a bare `teams status`/`teams logs` is still correct.
+     *
+     * Only polls a teammate that is plausibly still RUNNING (RUSH-2118). Once a
+     * remote teammate reaches a terminal status, the poll that resolved it already
+     * mirrored the final log bytes and read the `.exit` sentinel in this SAME
+     * function (delta pulled before the exit check below) — the underlying process
+     * is gone and can never write more, so there is nothing left to fetch. Without
+     * this guard every finished remote teammate still cost one ssh round-trip on
+     * EVERY `--active`/`listAll` poll forever, which is what made `agents sessions
+     * --active --local` take ~4.3s on a box with 30 completed teammates.
      */
     async syncRemoteMirror() {
         if (!this.hostName || !this.hostTarget || !this.remoteLog)
             return;
+        if (this.status !== AgentStatus.RUNNING)
+            return;
         // Pull the new remote bytes and append them to the local mirror the parser
         // reads. One offset-tail round-trip; nothing to write when the log is quiet.
         const delta = pullRemoteLogDelta(this.hostTarget, {
@@ -729,7 +742,15 @@ export class AgentProcess {
     restoreLogReadPosition(position) {
         this.lastReadPos = position;
     }
-    async readNewEvents() {
+    /**
+     * @param opts.skipRemote A `--local` caller (RUSH-2118): never dial a
+     *   remote-host teammate, not even a still-RUNNING one — report its
+     *   last-persisted meta.json state as-is. A local-only query is by definition
+     *   this-machine-only, so it must not issue an ssh round-trip at all.
+     */
+    async readNewEvents(opts = {}) {
+        if (this.hostName && opts.skipRemote)
+            return;
         // Distributed teammate: mirror the host's new log bytes locally first, then
         // fall through to the identical local read+parse below.
         if (this.hostName) {
@@ -984,7 +1005,12 @@ export class AgentProcess {
         }
         return true;
     }
-    async updateStatusFromProcess() {
+    /**
+     * @param opts.skipRemote A `--local` caller (RUSH-2118): a distributed
+     *   teammate is never dialed — its in-memory state (already loaded from
+     *   meta.json) stands as-is, no ssh, no re-save.
+     */
+    async updateStatusFromProcess(opts = {}) {
         if (!this.pid) {
             // Distributed (remote-host) teammates have no local PID by design; their
             // lifecycle lives on the host. readNewEvents() mirrors the remote log and
@@ -992,6 +1018,8 @@ export class AgentProcess {
             // syncRemoteMirror), so we just persist and return — never the local
             // "RUNNING without a PID is impossible" fail path below.
             if (this.hostName) {
+                if (opts.skipRemote)
+                    return;
                 await this.readNewEvents();
                 if (this.status !== AgentStatus.RUNNING && !this.completedAt) {
                     this.completedAt = this.getLatestEventTime() || this.startedAt || new Date();
@@ -1160,12 +1188,21 @@ export class AgentManager {
     defaultMode;
     initPromise = null;
     cloudDispatcher = null;
+    /**
+     * A `--local` caller (RUSH-2118): every poll this manager issues skips the
+     * ssh round-trip for a distributed (remote-host) teammate, reporting its
+     * last-persisted meta.json state instead. Set once at construction so the
+     * INITIAL load in doInitialize()/loadExistingAgents() — which polls every
+     * teammate before listRunning()/listAll() ever run — honors it too.
+     */
+    localOnly;
     constructorAgentsDir = null;
-    constructor(maxAgents = 50, agentsDir = null, defaultMode = null, filterByCwd = null, cleanupAgeDays = 7) {
+    constructor(maxAgents = 50, agentsDir = null, defaultMode = null, filterByCwd = null, cleanupAgeDays = 7, localOnly = false) {
         this.maxAgents = maxAgents;
         this.constructorAgentsDir = agentsDir;
         this.filterByCwd = filterByCwd;
         this.cleanupAgeDays = cleanupAgeDays;
+        this.localOnly = localOnly;
         const resolvedDefaultMode = defaultMode ? normalizeModeValue(defaultMode) : defaultModeFromEnv();
         if (!resolvedDefaultMode) {
             throw new Error(`Invalid default_mode '${defaultMode}'. Use plan, edit, auto, or skip.`);
@@ -1272,7 +1309,7 @@ export class AgentManager {
                     continue;
                 }
             }
-            await agent.updateStatusFromProcess();
+            await agent.updateStatusFromProcess({ skipRemote: this.localOnly });
             this.agents.set(agentId, agent);
             loadedCount++;
         }
@@ -1726,7 +1763,14 @@ export class AgentManager {
         if (!teamMeta)
             return;
         const roster = await this.listByTask(taskName);
-        const { device } = resolvePlacement(teamMeta, null, roster);
+        const pool = teamMeta.devices ?? [];
+        const maxConcurrent = pool.length > 1 ? readMaxConcurrentCaps(pool) : undefined;
+        if (maxConcurrent) {
+            for (const c of cappedDevices(pool, roster, maxConcurrent)) {
+                console.error(chalk.dim(`[placement] '${c.device}' excluded from auto-pick — at its agents.max-concurrent cap (${c.running}/${c.cap} running)`));
+            }
+        }
+        const { device } = resolvePlacement(teamMeta, null, roster, { maxConcurrent });
         if (device)
             await this.resolveScheduledPlacement(agent, device, taskName);
     }
@@ -1990,8 +2034,8 @@ export class AgentManager {
         await this.initialize();
         const agents = Array.from(this.agents.values());
         for (const agent of agents) {
-            await agent.readNewEvents();
-            await agent.updateStatusFromProcess();
+            await agent.readNewEvents({ skipRemote: this.localOnly });
+            await agent.updateStatusFromProcess({ skipRemote: this.localOnly });
         }
         return agents;
     }

package/dist/lib/teams/scheduler.d.ts

@@ -2,6 +2,19 @@
 export interface PlacementTeam {
     devices?: string[];
 }
+/**
+ * Optional placement inputs beyond the team + roster. `maxConcurrent` maps a
+ * device name to its `agents.max-concurrent` cap (from the device doc — read
+ * locally via `readMaxConcurrentCaps`, never probed over SSH). Teams counts
+ * the team's OWN roster against the cap (device-global counting would need an
+ * SSH probe per candidate — out of the hot path; Factory auto-launch is the
+ * device-wide counter). Only the least-loaded AUTO-PICK (cascade step 3)
+ * honors caps: an explicit pin or a pool of one is the user's own choice and
+ * is never second-guessed.
+ */
+export interface PlacementOptions {
+    maxConcurrent?: Record<string, number>;
+}
 /**
  * A roster entry the load counter reads — the shape any teammate satisfies
  * (AgentProcess included). `status` is compared against `'running'` (the
@@ -11,19 +24,33 @@ export interface RosterEntry {
     hostName: string | null;
     status: string;
 }
+/**
+ * Pool devices excluded from auto-pick because they are at (or over) their
+ * `agents.max-concurrent` cap. Returned with the live counts so the caller can
+ * state the reason to the user instead of the device silently never winning.
+ */
+export declare function cappedDevices(devices: string[], roster: RosterEntry[], maxConcurrent: Record<string, number>): Array<{
+    device: string;
+    running: number;
+    cap: number;
+}>;
 /**
  * Pick the least-loaded device from the pool — the one with the fewest RUNNING
  * teammates currently assigned to it. Ties break by pool order (first wins), so
  * an empty pool fills round-robin-ish as teammates launch. Pure: counts the
  * roster, no I/O.
+ *
+ * With `maxConcurrent`, devices at their cap are excluded; if EVERY device is
+ * capped this throws naming each cap and the fix — a loud failure beats a
+ * teammate silently landing on a machine its operator capped.
  */
-export declare function pickLeastLoaded(devices: string[], roster: RosterEntry[]): string;
+export declare function pickLeastLoaded(devices: string[], roster: RosterEntry[], maxConcurrent?: Record<string, number>): string;
 /**
  * Resolve where a teammate runs. Returns `{ device: null }` for a local run
  * (no pin, no pool, or the chosen device is the local machine) and
  * `{ device: <name> }` for a remote placement. See the cascade in the module
  * header.
  */
-export declare function resolvePlacement(team: PlacementTeam, explicitDevice: string | null, roster: RosterEntry[]): {
+export declare function resolvePlacement(team: PlacementTeam, explicitDevice: string | null, roster: RosterEntry[], opts?: PlacementOptions): {
     device: string | null;
 };

package/dist/lib/teams/scheduler.js

@@ -11,6 +11,11 @@
  *   3. else the team pool has many devices           → least-loaded pick
  *   4. else (no pin, no pool)                         → null == run local
  *
+ * Step 3 is cap-aware: a device at its `agents.max-concurrent` cap (from the
+ * device doc, passed in via PlacementOptions) is excluded from the auto-pick,
+ * and an all-capped pool fails loud. Pins and pools of one are the user's own
+ * choice and are never second-guessed.
+ *
  * A device whose name equals the local machine id is treated as "local" — it
  * resolves to a null placement so the existing local spawn path runs unchanged,
  * letting the local machine participate in a pool as just another member.
@@ -20,31 +25,70 @@ import { machineId } from '../session/sync/config.js';
 function isLocalDevice(device) {
     return device.toLowerCase() === machineId();
 }
+/** Count RUNNING teammates per pool device. Pure. A null/empty hostName is a
+ * LOCAL teammate — it counts against the pool member that is this machine,
+ * otherwise a cap on the local device could never engage. */
+function loadByDevice(devices, roster) {
+    const load = new Map();
+    for (const d of devices)
+        load.set(d, 0);
+    for (const r of roster) {
+        if (r.status !== 'running')
+            continue;
+        const host = r.hostName ? r.hostName : devices.find((d) => isLocalDevice(d));
+        if (!host)
+            continue; // local teammate but this machine is not in the pool
+        if (load.has(host))
+            load.set(host, (load.get(host) ?? 0) + 1);
+    }
+    return load;
+}
+/**
+ * Pool devices excluded from auto-pick because they are at (or over) their
+ * `agents.max-concurrent` cap. Returned with the live counts so the caller can
+ * state the reason to the user instead of the device silently never winning.
+ */
+export function cappedDevices(devices, roster, maxConcurrent) {
+    const load = loadByDevice(devices, roster);
+    const capped = [];
+    for (const d of devices) {
+        const cap = maxConcurrent[d];
+        if (cap === undefined)
+            continue;
+        const running = load.get(d) ?? 0;
+        if (running >= cap)
+            capped.push({ device: d, running, cap });
+    }
+    return capped;
+}
 /**
  * Pick the least-loaded device from the pool — the one with the fewest RUNNING
  * teammates currently assigned to it. Ties break by pool order (first wins), so
  * an empty pool fills round-robin-ish as teammates launch. Pure: counts the
  * roster, no I/O.
+ *
+ * With `maxConcurrent`, devices at their cap are excluded; if EVERY device is
+ * capped this throws naming each cap and the fix — a loud failure beats a
+ * teammate silently landing on a machine its operator capped.
  */
-export function pickLeastLoaded(devices, roster) {
+export function pickLeastLoaded(devices, roster, maxConcurrent) {
     if (devices.length === 0) {
         throw new Error('pickLeastLoaded called with an empty device pool');
     }
-    const load = new Map();
-    for (const d of devices)
-        load.set(d, 0);
-    for (const r of roster) {
-        if (!r.hostName)
-            continue;
-        if (r.status !== 'running')
-            continue;
-        if (load.has(r.hostName))
-            load.set(r.hostName, (load.get(r.hostName) ?? 0) + 1);
+    const load = loadByDevice(devices, roster);
+    const capped = new Set(maxConcurrent ? cappedDevices(devices, roster, maxConcurrent).map((c) => c.device) : []);
+    const eligible = devices.filter((d) => !capped.has(d));
+    if (eligible.length === 0) {
+        const detail = devices
+            .map((d) => `${d} (${load.get(d) ?? 0}/${maxConcurrent[d]})`)
+            .join(', ');
+        throw new Error(`Every device in the pool is at its agents.max-concurrent cap: ${detail}. ` +
+            `Raise a cap with 'agents devices configure <name> --max-agents N' or add a device to the pool.`);
     }
     // Iterate the pool in declared order so the first device wins ties.
-    let best = devices[0];
+    let best = eligible[0];
     let bestLoad = load.get(best) ?? 0;
-    for (const d of devices) {
+    for (const d of eligible) {
         const l = load.get(d) ?? 0;
         if (l < bestLoad) {
             best = d;
@@ -59,7 +103,7 @@ export function pickLeastLoaded(devices, roster) {
  * `{ device: <name> }` for a remote placement. See the cascade in the module
  * header.
  */
-export function resolvePlacement(team, explicitDevice, roster) {
+export function resolvePlacement(team, explicitDevice, roster, opts) {
     // 1. Explicit pin wins — even without a pool.
     if (explicitDevice) {
         return { device: isLocalDevice(explicitDevice) ? null : explicitDevice };
@@ -72,7 +116,7 @@ export function resolvePlacement(team, explicitDevice, roster) {
     if (pool.length === 1) {
         return { device: isLocalDevice(pool[0]) ? null : pool[0] };
     }
-    // 3. Many → least-loaded across the pool.
-    const picked = pickLeastLoaded(pool, roster);
+    // 3. Many → least-loaded across the pool (cap-aware when caps are provided).
+    const picked = pickLeastLoaded(pool, roster, opts?.maxConcurrent);
     return { device: isLocalDevice(picked) ? null : picked };
 }

package/dist/lib/types.d.ts

@@ -62,7 +62,7 @@ export interface BudgetConfig {
     require_confirm_over?: number;
 }
 /** Preview features that users can opt into via `agents beta`. */
-export type BetaFeatureName = 'drive' | 'factory' | 'session-sync' | 'projects';
+export type BetaFeatureName = 'factory' | 'projects';
 /** Subset of chalk color names used for agent-specific terminal output. */
 export type ChalkColor = 'magenta' | 'green' | 'blue' | 'cyan' | 'yellowBright' | 'redBright' | 'whiteBright' | 'blueBright' | 'greenBright' | 'magentaBright' | 'cyanBright';
 /** Static configuration for a single agent -- paths, capabilities, and format conventions. */
@@ -845,6 +845,22 @@ export interface Meta {
      * `agents browser profiles set-default <name>`.
      */
     defaultBrowserProfile?: string;
+    /**
+     * User-scope config block (`config:` in central agents.yaml). Holds the
+     * user-scope keys from the device-config registry (`lib/device-config.ts`) —
+     * today just `interactiveHost`. Syncs fleet-wide via `agents repo push/pull`.
+     * Device-scope keys live in {@link Meta.deviceConfig} instead.
+     */
+    config?: Record<string, unknown>;
+    /**
+     * Device-scope config block, carried in memory under a distinct field so it
+     * can never leak into the central (synced) agents.yaml: `writeMetaUnlocked`
+     * routes it to `~/.agents/devices/<machine>/agents.yaml` under the `config:`
+     * key (mirroring how `defaultBrowserProfile` is routed), and
+     * `overlayMachineLocal` reads it back. Holds the device-scope keys from the
+     * device-config registry (`maxAgents`, `schedulerEnabled`, `notes`). Per-machine by design — unset = today's behavior.
+     */
+    deviceConfig?: Record<string, unknown>;
     /**
      * Agent-host registry keyed by host name (`agents hosts`). Portable user
      * config synced with `agents repo push/pull`. For `ssh-config` hosts this is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.93",
+  "version": "1.21.0",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -90,7 +90,6 @@
     "@xterm/headless": "6.0.0",
     "@zed-industries/agent-client-protocol": "0.4.5",
     "age-encryption": "0.3.0",
-    "aws4fetch": "1.0.20",
     "chalk": "5.6.2",
     "commander": "15.0.0",
     "croner": "10.0.1",

package/dist/commands/drive.d.ts

@@ -1,10 +0,0 @@
-/**
- * Drive sync commands.
- *
- * Registers the `agents drive` command tree for syncing agent session
- * history across machines via rsync. Supports pull, push, attach
- * (redirect agent homes to drive), and detach operations.
- */
-import type { Command } from 'commander';
-/** Register the `agents drive` command tree. */
-export declare function registerDriveCommands(program: Command): void;