@phnx-labs/agents-cli 1.22.113 → 1.22.115

package/dist/lib/devices/connect.js

@@ -18,12 +18,14 @@ import * as path from 'path';
 import { assertValidSshTarget, shellQuote } from '../ssh-exec.js';
 import { resolveActor, actorEnv } from '../actor.js';
 import { getCliLaunch } from '../cli-entry.js';
-import { encodePwshBase64 } from '../pwsh.js';
+import { encodePwshBase64, pwshLiteral, pwshNativeExecStatements } from '../pwsh.js';
+import { quoteWin32ExecArg } from '../platform/exec.js';
 import { homeRemainder, remoteCdPrefix } from '../project-root.js';
 import { getCacheDir } from '../state.js';
 import { hostKeyCheckingOpts } from './known-hosts.js';
 import { hostNameFor } from './ssh-config.js';
 import { resolveDeviceProfile } from './resolve-profile.js';
+import { renderPowershellCommand, windowsAgentsInvocation } from '../hosts/remote-cmd.js';
 /** Env var the askpass shim reads to know which bundle holds the password. */
 export const ASKPASS_BUNDLE_ENV = 'AGENTS_SSH_BUNDLE';
 /** Env var the askpass shim reads to know which key in the bundle is the password. */
@@ -72,20 +74,139 @@ export function fleetDialTarget(device) {
     }
 }
 /**
- * Wrap a remote command for the device's shell. Windows devices speak
- * PowerShell, so a bare command is run through `powershell -NoProfile
- * -EncodedCommand`; POSIX devices get the command verbatim (the remote login
- * shell parses it). Returns undefined when no command was given (interactive
+ * Render `cmd` as the single command string ssh sends to the peer.
+ *
+ * Windows devices speak PowerShell, so the result is run through
+ * `powershell -NoProfile -EncodedCommand`; POSIX devices get it as the remote
+ * login shell sees it. Returns undefined when no command was given (interactive
  * login).
+ *
+ * TWO MODES, and the difference is load-bearing rather than a convenience.
+ *
+ * The default joins the tokens RAW. That is not a bug to be tidied away: every
+ * existing caller of `agents ssh` relies on the remote shell interpreting what it
+ * is handed — `agents ssh box 'bash -lc "cd x && make"'` arrives as ONE token
+ * whose pipeline, globs and redirections the peer's shell must expand. Quoting
+ * that would ship the whole line as a literal argument and break it.
+ *
+ * `{ argv: true }` is for a caller that genuinely holds an argv ARRAY and needs
+ * each element delivered as exactly one token. Joining those raw destroys any
+ * token containing a space or a metacharacter — `['--title', 'two words']`
+ * arrives as three tokens, and `'a & b'` arrives as a backgrounded command — which
+ * is what a native client hitting this path actually hit.
+ *
+ * So fidelity is opt-in at the call site that knows which shape it has, and the
+ * quoting itself reuses the canonical helpers (`shellQuote`, {@link pwshQuote})
+ * rather than introducing a third escaping scheme.
  */
-export function wrapRemoteCommand(device, cmd) {
+export function wrapRemoteCommand(device, cmd, opts = {}) {
     if (cmd.length === 0)
         return undefined;
-    const joined = cmd.join(' ');
+    const prelude = opts.prelude ?? [];
+    let script;
+    if (opts.argv) {
+        // Quote EACH caller token so the peer receives it byte-for-byte, then prefix
+        // the prelude VERBATIM — it is already shell syntax and re-quoting it would
+        // break it (see `fleetRemotePrelude`).
+        if (device.shell === 'powershell') {
+            script = pwshExactArgvScript(cmd, prelude);
+        }
+        else {
+            script = [...prelude, ...cmd.map(shellQuote)].join(' ');
+        }
+    }
+    else {
+        // The default joins raw, which is what lets a caller hand the remote shell
+        // something to interpret. See the docblock above for why both must exist.
+        script = [...prelude, ...cmd].join(' ');
+    }
     if (device.shell === 'powershell') {
-        return `powershell -NoProfile -EncodedCommand ${encodePwshBase64(joined)}`;
+        // Same renderer the Windows `agents` launcher uses, so a long script gets the
+        // compressed representation here too rather than only on that path. The
+        // interactive login route (`buildInteractiveShellCommand`, -NoExit) is
+        // deliberately left alone: it must stay an interactive session.
+        return renderPowershellCommand(script);
     }
-    return joined;
+    return script;
+}
+/**
+ * Single-quote one token for PowerShell's OWN parser. Inside a single-quoted pwsh
+ * string the only special character is `'`, escaped by doubling.
+ *
+ * This is correct for a value PowerShell itself consumes, and NOT sufficient for
+ * an argument handed on to a native program — see the Win32 note below.
+ */
+export function pwshQuote(token) {
+    return `'${token.replace(/'/g, "''")}'`;
+}
+/**
+ * Emit a PowerShell script that runs `cmd` with EXACT argv, for either kind of
+ * target a Windows peer can name.
+ *
+ * Windows has no argv array: a process receives ONE string and splits it itself.
+ * PowerShell 5.1 rebuilds that string when it invokes a native program, and its
+ * serializer is lossy — measured on a real peer, an EMPTY argument is dropped and
+ * an embedded `"` is discarded, so the callee's argv silently shifts.
+ *
+ * The obvious fix, the `--%` stop-parsing token, is NOT used, because measurement
+ * killed it three ways:
+ *   - it only applies to a NATIVE command, and `agents` on Windows resolves to
+ *     `agents.ps1`, so a script target received `--%` as a literal argument and
+ *     the whole remainder as one string;
+ *   - a token containing a NEWLINE terminates the directive, producing a parser
+ *     error;
+ *   - it performs cmd-style `%VAR%` expansion, so a literal `%PATH%` became six
+ *     arguments — the exact opposite of exact argv.
+ *
+ * So the script branches on what the peer's own command discovery finds:
+ *
+ *   - **native executable** — launched through `System.Diagnostics.Process` with a
+ *     pre-built `Arguments` string escaped by {@link quoteWin32ExecArg}. .NET hands
+ *     that string to `CreateProcess` essentially verbatim, so the child's
+ *     `CommandLineToArgvW` reconstructs the tokens exactly; no shell sees it, so
+ *     no `%VAR%` expansion and no newline sensitivity. `UseShellExecute = $false`
+ *     with no redirection leaves the child on the inherited handles, which is what
+ *     lets a binary stdout stream through unchanged.
+ *   - **anything else** (a `.ps1`/`.cmd` launcher, a function, a cmdlet, an alias)
+ *     — invoked with a splatted PowerShell array. That is an in-process call, so
+ *     the native serializer is never involved and every token survives as itself.
+ *
+ * The exit code is propagated in both branches; a script launcher that sets no
+ * `$LASTEXITCODE` is left alone rather than forced to 0.
+ */
+function pwshExactArgvScript(cmd, prelude) {
+    // The Agents CLI gets the canonical launcher, not the generic dispatch. On
+    // Windows `agents` is an npm `agents.ps1` whose own body splats `$args` into
+    // native node.exe — the PowerShell 5.1 lossy path — so even a perfectly
+    // splatted call into that script loses an embedded quote one layer deeper.
+    // `windowsAgentsInvocation` resolves the package's declared entry and runs it
+    // directly, which is the only way the real Agents parser sees exact tokens.
+    const bin = cmd[0];
+    if (bin === 'agents' || bin === 'ag') {
+        // `windowsAgentsInvocation` leaves the child's code in `$zq`.
+        return [...prelude, windowsAgentsInvocation(cmd.slice(1), bin), 'exit $zq'].join('\n');
+    }
+    const program = pwshQuote(cmd[0]);
+    const rest = cmd.slice(1);
+    const splat = rest.length > 0 ? `@(${rest.map(pwshQuote).join(', ')})` : '@()';
+    return [
+        ...prelude,
+        `$ErrorActionPreference='Stop'`,
+        `$__c = Get-Command -Name ${program} -ErrorAction Stop`,
+        `if ($__c.CommandType -eq 'Application') {`,
+        // One emitter for the .NET native-exec block, shared with the Windows
+        // `agents` launcher in `hosts/remote-cmd.ts`; a second copy would drift.
+        ...pwshNativeExecStatements('$__c.Source', pwshLiteral(rest.map(quoteWin32ExecArg).join(' '))).map((line) => `  ${line}`),
+        // `pwshNativeExecStatements` names the process handle `$zp`.
+        `  exit $zp.ExitCode`,
+        `}`,
+        // `@__a` SPLATS the array into separate arguments. `& $__c @(...)` on an
+        // array LITERAL does not splat — it passes one array-valued argument, which
+        // a real peer reported back as every token collapsed into one.
+        `$__a = ${splat}`,
+        `& $__c @__a`,
+        `if ($null -ne $LASTEXITCODE) { exit $LASTEXITCODE }`,
+    ].join('\n');
 }
 /**
  * True when `cmd` is a browser drive: `agents browser …`, `ag browser …`, or
@@ -123,22 +244,43 @@ export function isAgentsBrowserDrive(cmd) {
  * fan-out stamps the marker before {@link buildSshInvocation}) is left unchanged
  * so nothing is doubled.
  */
-export function markFleetRemote(cmd, device, provenanceEnv = actorEnv(resolveActor())) {
+/**
+ * The provenance prefix as READY SHELL SYNTAX for the device's shell.
+ *
+ * These tokens are already quoted/escaped for their target shell — a POSIX
+ * `K=V` pair is `shellQuote`d here, and a PowerShell assignment is a complete
+ * statement with its own doubled quotes. That matters because argv mode quotes
+ * every token it is handed: quoting THESE again turns
+ * `'AGENTS_ACTOR=Some Name'` into `''\''AGENTS_ACTOR=Some Name'\'''` and turns a
+ * pwsh assignment into an inert string literal. So the prelude is composed
+ * SEPARATELY from the caller's argv rather than concatenated into it, and this is
+ * the single definition both paths use.
+ */
+export function fleetRemotePrelude(device, provenanceEnv = actorEnv(resolveActor())) {
     if (device.shell === 'powershell') {
-        // Exact-match guard, symmetric with the POSIX branch below: the marker token
-        // is always this literal, so `startsWith` would only loosen it for no gain.
-        if (cmd[0] === `$env:AGENTS_FLEET_REMOTE='1';`)
-            return cmd;
-        const prelude = [
+        return [
             `$env:AGENTS_FLEET_REMOTE='1';`,
             ...Object.entries(provenanceEnv).map(([k, v]) => `$env:${k}='${v.replace(/'/g, "''")}';`),
         ];
-        return [...prelude, ...cmd];
     }
-    if (cmd[0] === 'env' && cmd[1] === 'AGENTS_FLEET_REMOTE=1')
+    return [
+        'env',
+        'AGENTS_FLEET_REMOTE=1',
+        ...Object.entries(provenanceEnv).map(([k, v]) => shellQuote(`${k}=${v}`)),
+    ];
+}
+/** True when `cmd` already carries the prelude {@link fleetRemotePrelude} emits. */
+function alreadyMarked(cmd, device) {
+    if (device.shell === 'powershell')
+        return cmd[0] === `$env:AGENTS_FLEET_REMOTE='1';`;
+    return cmd[0] === 'env' && cmd[1] === 'AGENTS_FLEET_REMOTE=1';
+}
+export function markFleetRemote(cmd, device, provenanceEnv = actorEnv(resolveActor())) {
+    // Exact-match guard: the marker token is always this literal, so `startsWith`
+    // would only loosen it for no gain.
+    if (alreadyMarked(cmd, device))
         return cmd;
-    const actorTokens = Object.entries(provenanceEnv).map(([k, v]) => shellQuote(`${k}=${v}`));
-    return ['env', 'AGENTS_FLEET_REMOTE=1', ...actorTokens, ...cmd];
+    return [...fleetRemotePrelude(device, provenanceEnv), ...cmd];
 }
 /**
  * Build the remote command that starts an INTERACTIVE LOGIN shell inside a
@@ -229,10 +371,16 @@ export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, o
     // Stamp the consent marker on the REMOTE command, not the local ssh env:
     // SSH_ASKPASS lives on this side; AGENTS_FLEET_REMOTE must be visible to the
     // process that runs on the peer.
-    const remoteCmd = !interactive && isAgentsBrowserDrive(cmd) ? markFleetRemote(cmd, device) : cmd;
+    // Provenance is composed as a PRELUDE, not prepended to the argv array. In argv
+    // mode every token handed to `wrapRemoteCommand` is quoted, and the prelude is
+    // already shell syntax — mixing them in meant the actor pairs were quoted twice
+    // (breaking any value with a space or a quote) and the pwsh assignments became
+    // inert string literals.
+    const needsProvenance = !interactive && isAgentsBrowserDrive(cmd) && !alreadyMarked(cmd, device);
+    const prelude = needsProvenance ? fleetRemotePrelude(device) : [];
     const remote = interactive
         ? buildInteractiveShellCommand(device, opts.interactiveCwd)
-        : wrapRemoteCommand(device, remoteCmd);
+        : wrapRemoteCommand(device, cmd, { ...(opts.argv ? { argv: true } : {}), ...(prelude.length > 0 ? { prelude } : {}) });
     const env = {};
     const args = [
         ...hostKeyCheckingOpts(hostKey.pinned ?? false, hostKey.knownHostsFile),

package/dist/lib/devices/discovery-policy.d.ts

@@ -1,5 +1,5 @@
-export type DeviceDiscoveryStatus = 'approved' | 'ignored';
-export interface DeviceDiscoveryReconcileResult {
+type DeviceDiscoveryStatus = 'approved' | 'ignored';
+interface DeviceDiscoveryReconcileResult {
     approved: string[];
     ignored: string[];
     registered: string[];
@@ -40,3 +40,4 @@ export declare function loadDeviceDiscoveryPolicies(): Map<string, DeviceDiscove
 export declare function reconcileDeviceDiscoveryPolicies(): Promise<DeviceDiscoveryReconcileResult>;
 /** Complete reconciliation from real `tailscale status --json` output. */
 export declare function registerApprovedDevicesFromTailscale(json: string, approved: string[], ignored: string[], missing: string[]): Promise<DeviceDiscoveryReconcileResult>;
+export {};

package/dist/lib/devices/doctor-findings.js

@@ -244,7 +244,7 @@ export function remediationFor(finding) {
         case 'content-drift':
         case 'stale':
             // doctor diagnoses; `agents sync` fixes (the superset of the old
-            // `doctor --fix`). A bare `agents sync <agent>` hits only the default
+            // `agents sync`). A bare `agents sync <agent>` hits only the default
             // version, so an agent-only row collapsed across versions must ask for
             // @all to reach every one it covers.
             if (agent && version)

package/dist/lib/devices/doctor-overview-cache.d.ts

@@ -1,7 +1,7 @@
 /** Serve a cached snapshot without recomputing while it is younger than this. */
 export declare const DOCTOR_OVERVIEW_FRESH_MS = 90000;
 /** Injectable IO + clock so tests exercise the real fs at a temp dir, no mocks. */
-export interface DoctorOverviewCacheDeps {
+interface DoctorOverviewCacheDeps {
     /** Cache directory (default: the real `~/.agents/.cache`). */
     dir?: string;
     /** Clock (default: {@link Date.now}). */
@@ -29,7 +29,7 @@ export declare function invalidateDoctorOverviewCache(deps?: DoctorOverviewCache
  *    the way out. Call `release()` in a `finally` so a compute that throws still
  *    frees the lock promptly (idempotent).
  */
-export interface OverviewGate {
+interface OverviewGate {
     cached: string | null;
     release?: () => void;
 }
@@ -50,3 +50,4 @@ export declare function enterDoctorOverviewGate(opts?: {
     forceRefresh?: boolean;
     freshMs?: number;
 }, deps?: DoctorOverviewCacheDeps): Promise<OverviewGate>;
+export {};

package/dist/lib/devices/fleet-divergence.d.ts

@@ -111,7 +111,7 @@ export interface FleetDivergence {
     /** Human-readable one-liner, ready for the warnings list. */
     message: string;
 }
-export interface FleetDivergenceReport {
+interface FleetDivergenceReport {
     /** Name of the device used as the comparison baseline (the local machine). */
     baseline: string;
     divergences: FleetDivergence[];
@@ -132,3 +132,4 @@ export interface FleetDivergenceReport {
  * JSON output — and the tests — are stable.
  */
 export declare function compareFleetInventories(devices: DeviceInventory[], baselineName: string): FleetDivergenceReport;
+export {};

package/dist/lib/devices/fleet.d.ts

@@ -10,8 +10,6 @@
 import type { DeviceProfile, DeviceRegistry } from './registry.js';
 import type { DeviceStats } from './health.js';
 export type FleetSkipReason = 'offline' | 'no-address';
-/** npm dist-tags / semver pins only — rejects shell metacharacters. */
-export declare const FLEET_VERSION_RE: RegExp;
 export interface FleetTarget {
     device: DeviceProfile;
     /** When set, this device is not reached (skip with reason). */
@@ -112,7 +110,7 @@ export declare function runLocalCommand(cmd: string[], opts?: {
  * cannot inject shell metacharacters into the remote command line.
  */
 export declare function upgradeCommand(version?: string): string[];
-export interface RunFleetOptions {
+interface RunFleetOptions {
     /**
      * Name of THIS machine. Its target runs the command **locally** (no ssh) — a
      * box can't reliably ssh to itself and doesn't need to. Omit to ssh every
@@ -132,7 +130,7 @@ export interface RunFleetOptions {
  * recorded as `failed` so one bad device never aborts the rest.
  */
 export declare function runFleet(targets: FleetTarget[], cmd: string[], opts?: RunFleetOptions): FleetRunResult[];
-export interface FanOutDeviceOptions {
+interface FanOutDeviceOptions {
     /**
      * Per-device deadline in milliseconds. When set, any probe that does not
      * settle within this window is abandoned via `Promise.race` against a
@@ -149,3 +147,4 @@ export interface FanOutDeviceOptions {
 }
 /** Run one async probe per device in parallel, preserving input order. */
 export declare function fanOutDevices<T, Target extends FanOutDeviceTarget = FanOutDeviceTarget>(targets: Target[], probe: (target: Target) => Promise<T>, opts?: FanOutDeviceOptions): Promise<FanOutDeviceResult<T>[]>;
+export {};

package/dist/lib/devices/fleet.js

@@ -11,7 +11,7 @@ import { spawnSync } from 'child_process';
 import { isSelfHost } from './self-host.js';
 import { buildSshInvocation, sshTargetFor, writeAskpassShim } from './connect.js';
 /** npm dist-tags / semver pins only — rejects shell metacharacters. */
-export const FLEET_VERSION_RE = /^[A-Za-z0-9._-]+$/;
+const FLEET_VERSION_RE = /^[A-Za-z0-9._-]+$/;
 /**
  * Classify each registered device for a fleet operation.
  *

package/dist/lib/devices/harness-inventory.d.ts

@@ -51,7 +51,7 @@ export interface HostHarnessResult {
     skipped?: string;
 }
 /** An account collapsed across the installs on one host that share it. */
-export interface AccountGroup {
+interface AccountGroup {
     /** Account display label, or null for the signed-out bucket. */
     account: string | null;
     /** Distinct agent ids using this account, sorted. */
@@ -130,7 +130,7 @@ export declare function renderHarnessMatrix(results: HostHarnessResult[]): strin
  * account (installs sharing it collapsed), showing which harnesses use it. Pure.
  */
 export declare function renderAccountsMatrix(results: HostHarnessResult[]): string[];
-export interface AccountFleetMatrixRow {
+interface AccountFleetMatrixRow {
     harness: AgentId;
     name: string | null;
     identityLabel: string;
@@ -147,3 +147,4 @@ export interface AccountFleetMatrixRow {
 export declare function renderAccountFleetMatrix(rows: AccountFleetMatrixRow[], opts?: {
     uncoveredDevices?: string[];
 }): string[];
+export {};

package/dist/lib/devices/health-report.d.ts

@@ -52,7 +52,7 @@ export interface FleetHealthRow {
      *  Undefined when no row has been published for the host yet. */
     agents?: FleetAgentCounts;
 }
-export interface FleetWarning {
+interface FleetWarning {
     kind: 'unreachable' | 'drift' | 'cli' | 'version-skew' | 'divergence';
     devices: string[];
     message: string;
@@ -82,7 +82,7 @@ export declare function freshnessFooter(rows: FleetHealthRow[], now?: number): s
 export declare function shortVersion(version: string | null | undefined): string;
 /** OS bucket label for grouping. Anything unrecognized falls under "Other". */
 export declare function platformGroupLabel(platform: string | undefined): 'macOS' | 'Linux' | 'Windows' | 'Other';
-export interface FleetAttentionItem {
+interface FleetAttentionItem {
     /** Leading mark: `○` offline, `⚠` config/CLI/version issue. */
     glyph: 'offline' | 'warn';
     subject: string;
@@ -106,3 +106,4 @@ export declare function renderFleetSummary(report: FleetHealthReport, opts?: {
     self?: string;
     now?: number;
 }): string[];
+export {};

package/dist/lib/devices/health.d.ts

@@ -49,13 +49,6 @@ export declare function probeBudgetMs(device: DeviceProfile): number;
 export declare const WIN_PROBE_TIMEOUT_MS = 6000;
 /** One-shot remote snapshot: load, memory, core count, then root filesystem. */
 export declare const PROBE_SNIPPET = "uptime; echo ---AGSTAT---; (vm_stat 2>/dev/null || cat /proc/meminfo 2>/dev/null); echo ---AGSTAT---; (nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null); echo ---AGSTAT---; df -Pk / 2>/dev/null | tail -1";
-/** Windows equivalent, one labeled line via CIM. PowerShell 5.1-safe: no `||`
- * chaining, plain string concatenation. `LoadPercentage` is $null on some
- * hosts/VMs, which concatenates to an empty field — the parser treats that as
- * "no load signal" and headroom falls back to memory pressure alone.
- * wrapRemoteCommand base64-encodes this for powershell-shell devices, so the
- * quoting survives ssh intact. */
-export declare const WIN_PROBE_SNIPPET = "$os = Get-CimInstance Win32_OperatingSystem; $cpu = (Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average; $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\"; Write-Output ('AGWINSTAT load=' + $cpu + ' freeKb=' + $os.FreePhysicalMemory + ' totalKb=' + $os.TotalVisibleMemorySize + ' ncpu=' + $env:NUMBER_OF_PROCESSORS + ' diskFreeKb=' + ($disk.FreeSpace / 1KB) + ' diskTotalKb=' + ($disk.Size / 1KB))";
 export declare function localProbeInvocation(platform: NodeJS.Platform): {
     file: string;
     args: string[];
@@ -114,7 +107,7 @@ export declare function parseProbeOutput(host: string, stdout: string, fetchedAt
  * (e.g. CIM unavailable) keeps `reachable: true` — ssh answered — with no
  * numbers, mirroring how garbage POSIX output degrades. */
 export declare function parseWinProbeOutput(host: string, stdout: string, fetchedAt: number): DeviceStats;
-export interface FleetCapacity {
+interface FleetCapacity {
     reachable: number;
     cores: number;
     memTotalBytes: number;

package/dist/lib/devices/health.js

@@ -63,7 +63,7 @@ export const PROBE_SNIPPET = `uptime; echo ${SEP}; (vm_stat 2>/dev/null || cat /
  * "no load signal" and headroom falls back to memory pressure alone.
  * wrapRemoteCommand base64-encodes this for powershell-shell devices, so the
  * quoting survives ssh intact. */
-export const WIN_PROBE_SNIPPET = `$os = Get-CimInstance Win32_OperatingSystem; $cpu = (Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average; $disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'"; Write-Output ('AGWINSTAT load=' + $cpu + ' freeKb=' + $os.FreePhysicalMemory + ' totalKb=' + $os.TotalVisibleMemorySize + ' ncpu=' + $env:NUMBER_OF_PROCESSORS + ' diskFreeKb=' + ($disk.FreeSpace / 1KB) + ' diskTotalKb=' + ($disk.Size / 1KB))`;
+const WIN_PROBE_SNIPPET = `$os = Get-CimInstance Win32_OperatingSystem; $cpu = (Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average; $disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'"; Write-Output ('AGWINSTAT load=' + $cpu + ' freeKb=' + $os.FreePhysicalMemory + ' totalKb=' + $os.TotalVisibleMemorySize + ' ncpu=' + $env:NUMBER_OF_PROCESSORS + ' diskFreeKb=' + ($disk.FreeSpace / 1KB) + ' diskTotalKb=' + ($disk.Size / 1KB))`;
 export function localProbeInvocation(platform) {
     return platform === 'win32'
         ? { file: 'powershell', args: ['-NoProfile', '-Command', WIN_PROBE_SNIPPET] }

package/dist/lib/devices/interactive-host.d.ts

@@ -1,5 +1,3 @@
-/** The reserved `--device` value meaning the box the human is at. */
-export declare const INTERACTIVE_DEVICE_SENTINEL = "interactive";
 /** True when a host flag value is the interactive sentinel. */
 export declare function isDeviceInteractive(value: string | undefined | null): boolean;
 /**

package/dist/lib/devices/interactive-host.js

@@ -19,7 +19,7 @@
 import { getConfigValue } from '../device-config.js';
 import { RESERVED_DEVICE_NAMES } from './registry.js';
 /** The reserved `--device` value meaning the box the human is at. */
-export const INTERACTIVE_DEVICE_SENTINEL = 'interactive';
+const INTERACTIVE_DEVICE_SENTINEL = 'interactive';
 /** True when a host flag value is the interactive sentinel. */
 export function isDeviceInteractive(value) {
     return typeof value === 'string' && value.trim().toLowerCase() === INTERACTIVE_DEVICE_SENTINEL;

package/dist/lib/devices/known-hosts.d.ts

@@ -3,8 +3,6 @@ import type { DeviceProfile } from './registry.js';
 export declare function managedKnownHostsPath(): string;
 /** Ensure the parent directory of the managed store exists (mode 0700). */
 export declare function ensureManagedKnownHostsDir(file?: string): void;
-/** Read the managed store, or '' when it does not exist yet. */
-export declare function readManagedKnownHosts(file?: string): string;
 /**
  * True if `host` has at least one pinned key line in `content`. Pure (content
  * in) so the match logic is unit-testable without touching disk. Matching is
@@ -44,7 +42,7 @@ export declare function hostKeyCheckingOpts(pinned: boolean, file?: string): str
  * contract is unit-testable without spawning ssh-keyscan.
  */
 export declare function newKnownHostsLines(existing: string, scanned: string): string[];
-export interface PinResult {
+interface PinResult {
     /** True if the host is pinned in the managed store after this call. */
     pinned: boolean;
     /** How many new key lines were appended. */
@@ -58,20 +56,4 @@ export interface PinResult {
  * network (the spawn stays in `pinHostKey`).
  */
 export declare function recordScannedKeys(host: string, scanned: string, file?: string): PinResult;
-/**
- * `ssh-keyscan` a host at a trusted moment and append any new key lines to the
- * managed store, idempotently. This is the explicit pin path; the implicit one
- * is a normal `accept-new` connection whose learned key lands in the same store.
- * Returns whether the host is pinned afterward.
- *
- * Host-name-agnostic: it scans whatever address it is handed, so it also pins a
- * host `agents ssh` can't reach — notably a bare `~/.ssh/config` `Host` alias,
- * which is not a registered device. The `--copy-creds` gate (commands/exec.ts)
- * calls this for exactly that case so the credential copy is usable for
- * ssh-config-alias hosts (RUSH-1767).
- */
-export declare function pinHostKey(host: string, opts?: {
-    file?: string;
-    timeoutMs?: number;
-    port?: number;
-}): PinResult;
+export {};

package/dist/lib/devices/known-hosts.js

@@ -32,7 +32,7 @@ export function ensureManagedKnownHostsDir(file = managedKnownHostsPath()) {
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
 }
 /** Read the managed store, or '' when it does not exist yet. */
-export function readManagedKnownHosts(file = managedKnownHostsPath()) {
+function readManagedKnownHosts(file = managedKnownHostsPath()) {
     try {
         return fs.readFileSync(file, 'utf-8');
     }
@@ -135,7 +135,7 @@ export function recordScannedKeys(host, scanned, file = managedKnownHostsPath())
  * calls this for exactly that case so the credential copy is usable for
  * ssh-config-alias hosts (RUSH-1767).
  */
-export function pinHostKey(host, opts = {}) {
+function pinHostKey(host, opts = {}) {
     // Same injection guard as sshExec: a host starting with `-` (or carrying shell
     // metacharacters) must never reach ssh-keyscan as a bare argv where it could
     // be parsed as a flag.

package/dist/lib/devices/pool.d.ts

@@ -30,7 +30,7 @@
  * ranker ({@link autoLaunchPreferredSet}, applied by `pickBestDevice`).
  */
 import { type AutoLaunchPreference, type AutoPoolMode, type ConfiguredDeviceRole } from '../device-config.js';
-export interface AutoPoolOptions {
+interface AutoPoolOptions {
     /** Pool mode; defaults to the configured `auto.pool`. */
     mode?: AutoPoolMode;
     /** Configured roles by device name; defaults to the fleet-shared block. */
@@ -77,3 +77,4 @@ export declare function listWorkerDevices(opts?: Pick<AutoPoolOptions, 'roles'>)
  * callers can append it unconditionally.
  */
 export declare function describeAutoPool(opts?: AutoPoolOptions): string;
+export {};

package/dist/lib/devices/resolve-target.d.ts

@@ -3,14 +3,14 @@ import { type DeviceProfile } from './registry.js';
 export { splitUserHost };
 /** A dialable peer: the ssh target, the machine id used to tag its rows, a
  * display name, and the OS family that picks the remote shell dialect. */
-export interface ResolvedSshTarget {
+interface ResolvedSshTarget {
     target: string;
     machine: string;
     name: string;
     os?: string;
     extraSshArgs?: string[];
 }
-export interface ResolvedExplicitTargetSet {
+interface ResolvedExplicitTargetSet {
     targets: ResolvedSshTarget[];
     unresolved: string[];
 }

package/dist/lib/devices/rollout-verify.d.ts

@@ -43,7 +43,7 @@ import { runLocalCommand, runOnDevice, type FleetRunResult, type FleetTarget } f
  * falling back to the unresolved path where `readlink -f` is unavailable.
  */
 export declare function rolloutVerifyCommand(): string[];
-export interface RolloutProbe {
+interface RolloutProbe {
     /** Path the box's own `agents` resolves to, symlinks followed. */
     resolvedPath?: string;
     /** Version that resolved copy reports. */
@@ -81,7 +81,7 @@ export declare function isRolloutSuccess(verdict: RolloutVerdict): boolean;
 export declare function resolveRolloutTarget(explicitVersion: string | undefined, probes: RolloutProbe[]): string | undefined;
 /** Classify one box's probe against the rollout target. */
 export declare function classifyRolloutVerification(probe: RolloutProbe, targetVersion: string | undefined): RolloutVerification;
-export interface VerifyFleetRolloutOptions {
+interface VerifyFleetRolloutOptions {
     /** Name of THIS machine; its target is probed locally, mirroring `runFleet`. */
     self?: string;
     /** Injectable ssh runner (tests). */
@@ -99,3 +99,4 @@ export interface VerifyFleetRolloutOptions {
  * "we could not check" and "it is upgraded" are different answers.
  */
 export declare function verifyFleetRollout(targets: FleetTarget[], results: FleetRunResult[], explicitVersion: string | undefined, opts?: VerifyFleetRolloutOptions): Map<string, RolloutVerification>;
+export {};

package/dist/lib/devices/stats-cache.d.ts

@@ -42,7 +42,7 @@ export declare function writeStatsCache(entries: Record<string, DeviceStats>): v
 export declare function removeStatsCacheEntry(name: string): void;
 /** Immutable cache pruning primitive, exported for lifecycle regression tests. */
 export declare function pruneStatsCache(entries: Record<string, DeviceStats>, name: string): Record<string, DeviceStats>;
-export interface FleetStatsResult {
+interface FleetStatsResult {
     /** name → stats for every requested device (cache-served + freshly probed). */
     stats: Map<string, DeviceStats>;
     /** Oldest `fetchedAt` among the returned rows, or null when empty. Drives the
@@ -51,7 +51,7 @@ export interface FleetStatsResult {
     /** True when at least one row was served from cache rather than probed this call. */
     servedFromCache: boolean;
 }
-export interface LoadFleetStatsOptions {
+interface LoadFleetStatsOptions {
     /** Skip the cache and live-probe every device (the `--refresh`/`--live` path). */
     forceRefresh?: boolean;
     /** Device name of THIS machine — always probed locally (no ssh), never cached-served. */
@@ -70,3 +70,4 @@ export interface LoadFleetStatsOptions {
  * `reachable: false` row exactly as the live probe does.
  */
 export declare function loadFleetStats(devices: DeviceProfile[], opts?: LoadFleetStatsOptions): Promise<FleetStatsResult>;
+export {};

package/dist/lib/devices/sync.d.ts

@@ -34,8 +34,8 @@ export declare function withDefaultUser(input: DeviceInput, prevUser: string | u
  *   through the menu-bar "NEW DEVICES → Register / Ignore" gate instead of
  *   silently landing in the registry.
  */
-export type DeviceSyncMode = 'bootstrap' | 'refresh';
-export interface DeviceSyncResult {
+type DeviceSyncMode = 'bootstrap' | 'refresh';
+interface DeviceSyncResult {
     /** False when discovery could not run (e.g. tailscale absent) in soft mode. */
     ok: boolean;
     /** Number of tailscale nodes upserted into the registry. */
@@ -89,7 +89,7 @@ export declare function runDeviceSync(opts?: {
     soft?: boolean;
     mode?: DeviceSyncMode;
 }): Promise<DeviceSyncResult>;
-export interface EnsureDevicesResult {
+interface EnsureDevicesResult {
     /** Names newly resolved from Tailscale and upserted into the registry. */
     registered: string[];
     /** Names that could not be resolved (not on the tailnet / tailscale absent). */
@@ -102,7 +102,7 @@ export interface EnsureDevicesResult {
  * registered names need nothing. Pure so the bootstrap's filter matrix is
  * unit-testable without a tailnet or registry writes.
  */
-export interface WantedPartition {
+interface WantedPartition {
     toRegister: string[];
     unresolved: string[];
 }
@@ -127,10 +127,11 @@ export declare function ensureDevicesRegistered(wantedNames: string[]): Promise<
  * => remove from the registry if it was there, and ignore it so auto-sync never
  * re-adds it.
  */
-export interface DeviceReconciliation {
+interface DeviceReconciliation {
     toRegister: string[];
     toUnignore: string[];
     toRemove: string[];
     toIgnore: string[];
 }
 export declare function planDeviceReconciliation(allNames: Iterable<string>, keep: Iterable<string>, registered: Iterable<string>, ignored: Iterable<string>): DeviceReconciliation;
+export {};