@phnx-labs/agents-cli 1.22.116 → 1.22.118

package/dist/lib/channels/owner-sink.js

@@ -2,99 +2,46 @@
  * Owner-delivery-sink reachability probe (RUSH-2262).
  *
  * The feed/notify owner-delivery lane (`agents send --to owner`, `agents feed post
- * --level important` / `--blocked`) reaches the owner over the rush-backed owner
- * channel (iMessage via `rush message send`). That transport can only deliver
- * from a context that BOTH finds the `rush` CLI on PATH and can read its
- * keychain-bound session. So a headless Linux fleet box (no rush) or a non-GUI
- * SSH session on a mac (login keychain locked) structurally cannot escalate —
- * and the failure is silent until a block is filed, surfacing only as the
- * after-the-fact `owner failed: …` line. `agents doctor` had no signal for it,
- * which is exactly the gap RUSH-2258 / RUSH-2262 flagged.
+ * --level important` / `--blocked`) reaches the owner through the channel
+ * providers registered for each configured channel in humans.yaml.
  *
- * At runtime the owner-delivery lane no longer strands this failure: when local
- * delivery fails on a box that structurally cannot reach the owner,
- * `forwardOwnerNotifyToPeer` (owner-forward.ts) hands it to a capable macOS peer
- * over SSH (PHNX-3303). This finding still stands as a diagnostic — the forward
- * is best-effort and only lands when a reachable mac peer exists, so a box that
- * cannot deliver locally is worth surfacing regardless.
+ * Transport capabilities differ by channel and platform:
+ *   - **imessage:** macOS only (osascript → Messages.app). Linux boxes rely on
+ *     the peer-forward in owner-forward.ts to reach a macOS peer.
+ *   - **slack:** requires a `SLACK_BOT_TOKEN` in env or the `webhooks` secrets
+ *     bundle. Platform-independent.
+ *   - **telegram / discord:** requires the Rush daemon (removed); only
+ *     openclaw-telegram is available as a Telegram alternative.
  *
- * This probes the SAME transport the lane uses, from the SAME context doctor runs
- * in, so `agents doctor` can fail loud when this box cannot reach the owner. It is
- * deliberately honest about context: `rush whoami` is what tells a real signed-in
- * session apart from a keychain that is present but unreadable HERE. The session
- * token is a keychain item, NOT `~/.rush/user.yaml` (RUSH-2262), so this never
- * reads that file — checking it is the mistake that made a signed-in box look
- * signed out.
- *
- * `agents send --to owner --dry-run` is NOT this probe: it short-circuits before the
- * `which rush` preflight (`providers/rush.ts`), so it reports `ok:true` on a box
- * with no rush at all. Resolvability (does the envelope build?) and reachability
- * (can this box actually deliver?) are different questions; this answers the
- * second.
+ * `agents send --to owner --dry-run` is NOT this probe: dry-run short-circuits
+ * before the capability check. Resolvability (does the envelope build?) and
+ * reachability (can this box actually deliver?) are different questions; this
+ * answers the second.
  */
-import { execFile } from 'child_process';
-import { promisify } from 'util';
+import { platform } from 'os';
 import { readOwnerDest } from './send.js';
-import { RUSH_CHANNELS } from './providers/rush.js';
-const execFileAsync = promisify(execFile);
-async function rushOnPath() {
-    try {
-        await execFileAsync('which', ['rush'], { timeout: 4000 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Signed-in state from `rush whoami`, read with THIS context's keychain access.
- *  'unknown' (a timeout or output we can't classify) is treated as reachable by
- *  the caller — a slow or unexpected probe must not cry wolf and paint a false
- *  critical. Only a definitive "not logged in" is reported as signed out. */
-async function rushSignedIn() {
-    const classify = (s) => {
-        const out = s.toLowerCase();
-        if (/not (logged in|signed in)/.test(out))
-            return 'no';
-        if (/logged in as|session:\s*valid/.test(out))
-            return 'yes';
-        return 'unknown';
-    };
-    try {
-        const { stdout, stderr } = await execFileAsync('rush', ['whoami'], { timeout: 5000 });
-        return classify(`${stdout}\n${stderr}`);
-    }
-    catch (err) {
-        const e = err;
-        if (e.killed)
-            return 'unknown'; // timed out — do not conclude signed-out
-        // A signed-out rush commonly exits non-zero; trust an explicit message only.
-        return classify(`${e.stdout ?? ''}\n${e.stderr ?? ''}`);
-    }
-}
-/**
- * Probe whether THIS box can deliver an owner notification right now. Returns
- * `configured:false` (and the caller emits no finding) when the fleet has no
- * owner channel configured — an un-opted-in box is not broken. When configured,
- * reports whether the resolved transport can actually deliver from here.
- *
- * Only the concrete rush-backed failure the lane hits is reported as unreachable;
- * non-rush transports (desktop / mailbox / …) deliver locally and are treated as
- * reachable rather than probed, so this never invents a critical it cannot back.
- */
+import { RUSH_CHANNELS, resolveSlackToken } from './providers/rush.js';
 export async function probeOwnerSink(meta) {
     const dest = readOwnerDest(meta);
     if (!dest)
         return { configured: false, reachable: false };
     const channel = dest.channel;
     const transport = meta.notify?.transports?.[channel] ?? channel;
-    if (RUSH_CHANNELS.includes(transport)) {
-        if (!(await rushOnPath())) {
-            return { configured: true, reachable: false, channel, transport, reason: 'rush-not-on-path' };
-        }
-        if ((await rushSignedIn()) === 'no') {
-            return { configured: true, reachable: false, channel, transport, reason: 'rush-signed-out' };
+    if (!RUSH_CHANNELS.includes(transport)) {
+        return { configured: true, reachable: true, channel, transport };
+    }
+    if (transport === 'imessage') {
+        if (platform() !== 'darwin') {
+            return { configured: true, reachable: false, channel, transport, reason: 'imessage-not-macos' };
         }
         return { configured: true, reachable: true, channel, transport };
     }
-    return { configured: true, reachable: true, channel, transport };
+    if (transport === 'slack') {
+        if (resolveSlackToken()) {
+            return { configured: true, reachable: true, channel, transport };
+        }
+        return { configured: true, reachable: false, channel, transport, reason: 'slack-no-token' };
+    }
+    // telegram / discord — daemon removed, no direct transport.
+    return { configured: true, reachable: false, channel, transport, reason: 'channel-unsupported' };
 }

package/dist/lib/channels/providers/rush.d.ts

@@ -1,9 +1,9 @@
-import type { ChannelProvider, SendOptions } from '../registry.js';
-type RushChannel = 'telegram' | 'imessage' | 'slack' | 'discord';
+import type { ChannelProvider } from '../registry.js';
+export type RushChannel = 'telegram' | 'imessage' | 'slack' | 'discord';
 export declare const RUSH_CHANNELS: RushChannel[];
-/** Build the `rush send` argv (exported for tests). */
-export declare function buildRushSendArgs(channel: RushChannel, text: string, opts: SendOptions): string[];
-/** Build the owner-scoped iMessage argv. */
-export declare function buildRushOwnerMessageArgs(text: string): string[];
+/** Build the osascript argv for sending an iMessage. */
+export declare function buildImessageOsascriptArgs(text: string, phone: string): string[];
+export declare function resolveSlackToken(): string | undefined;
+/** Build the Slack chat.postMessage payload (exported for tests). */
+export declare function buildSlackPayload(channel: string, text: string, thread?: string): Record<string, string>;
 export declare const rushProviders: ChannelProvider[];
-export {};

package/dist/lib/channels/providers/rush.js

@@ -1,70 +1,140 @@
 /**
- * Rush channel providers — telegram / imessage / slack / discord.
+ * Channel providers formerly backed by the Rush daemon's live gateways.
  *
- * Addressable channels use `rush send`, which routes through the daemon's live
- * gateways. Owner-scoped iMessage uses `rush message send`; it is backed by the
- * verified Rush owner account and does not require a daemon channel registration.
+ * The desktop-era `rush message send` (iMessage) and `rush send --channel`
+ * (Slack/Telegram/Discord) commands were removed with the daemon in the
+ * thin-client trim (PHNX-3839/3933). This module now delivers directly:
+ *
+ *   - **imessage:** `osascript` → Messages.app (macOS only; Linux boxes
+ *     rely on the peer-forward in owner-forward.ts to reach a macOS peer).
+ *   - **slack:** Slack Web API `chat.postMessage` via `fetch()`, reading
+ *     `SLACK_BOT_TOKEN` from env or the `webhooks` secrets bundle.
+ *   - **telegram / discord:** error — no direct transport; openclaw-telegram
+ *     is available as a separate provider for Telegram.
  */
 import { execFile } from 'child_process';
+import { platform } from 'os';
 import { promisify } from 'util';
 const execFileAsync = promisify(execFile);
 export const RUSH_CHANNELS = ['telegram', 'imessage', 'slack', 'discord'];
-/** Build the `rush send` argv (exported for tests). */
-export function buildRushSendArgs(channel, text, opts) {
-    const args = ['send', text, '--channel', channel, '--id', opts.target, '--json'];
-    if (opts.thread)
-        args.push('--thread', opts.thread);
-    for (const a of opts.attachments ?? [])
-        args.push('--attachment', a);
-    return args;
+// ── iMessage via osascript ──────────────────────────────────────────────
+function escapeAppleScript(s) {
+    return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+/** Build the osascript argv for sending an iMessage. */
+export function buildImessageOsascriptArgs(text, phone) {
+    const escapedText = escapeAppleScript(text);
+    const escapedPhone = escapeAppleScript(phone);
+    const script = [
+        'tell application "Messages"',
+        `  set targetBuddy to buddy "${escapedPhone}" of (first account whose service type is iMessage)`,
+        `  send "${escapedText}" to targetBuddy`,
+        'end tell',
+    ].join('\n');
+    return ['-e', script];
+}
+async function sendImessage(text, opts) {
+    const channel = 'imessage';
+    if (opts.dryRun)
+        return { ok: true, channel, id: opts.target };
+    if (platform() !== 'darwin') {
+        return { ok: false, channel, id: opts.target, error: 'iMessage requires macOS (peer-forward handles Linux delivery)' };
+    }
+    if ((opts.attachments?.length ?? 0) > 0) {
+        return { ok: false, channel, id: opts.target, error: 'iMessage attachments not supported via osascript' };
+    }
+    try {
+        await execFileAsync('osascript', buildImessageOsascriptArgs(text, opts.target), { timeout: 10_000 });
+        return { ok: true, channel, id: opts.target };
+    }
+    catch (err) {
+        return { ok: false, channel, id: opts.target, error: err.message };
+    }
+}
+// ── Slack via Web API ───────────────────────────────────────────────────
+export function resolveSlackToken() {
+    // 1. Environment variable (set by `secrets exec` or the daemon).
+    if (process.env.SLACK_BOT_TOKEN) {
+        return process.env.SLACK_BOT_TOKEN;
+    }
+    // 2. Secrets bundle — the webhook receiver bundle carries SLACK_BOT_TOKEN
+    //    when a Slack app is configured for this fleet.
+    try {
+        // Dynamic import to avoid a hard dependency on the secrets subsystem in
+        // contexts where it is unavailable (CI, containers without a secrets store).
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { readAndResolveBundleEnvSync } = require('../../secrets-client.js');
+        const { env } = readAndResolveBundleEnvSync('webhooks', { caller: 'slack-provider', agentOnly: true });
+        if (env.SLACK_BOT_TOKEN) {
+            return env.SLACK_BOT_TOKEN;
+        }
+    }
+    catch {
+        // Bundle missing, store locked, or secrets CLI not available — not fatal.
+    }
+    return undefined;
+}
+/** Build the Slack chat.postMessage payload (exported for tests). */
+export function buildSlackPayload(channel, text, thread) {
+    const payload = { channel, text };
+    if (thread)
+        payload.thread_ts = thread;
+    return payload;
 }
-/** Build the owner-scoped iMessage argv. */
-export function buildRushOwnerMessageArgs(text) {
-    return ['message', 'send', '--text', text];
+async function sendSlack(text, opts) {
+    const channel = 'slack';
+    if (opts.dryRun)
+        return { ok: true, channel, id: opts.target };
+    const token = resolveSlackToken();
+    if (!token) {
+        return {
+            ok: false,
+            channel,
+            id: opts.target,
+            error: 'No SLACK_BOT_TOKEN — set it in env or the webhooks secrets bundle',
+        };
+    }
+    try {
+        const payload = buildSlackPayload(opts.target, text, opts.thread);
+        const res = await fetch('https://slack.com/api/chat.postMessage', {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${token}`,
+                'Content-Type': 'application/json; charset=utf-8',
+            },
+            body: JSON.stringify(payload),
+        });
+        const body = await res.json();
+        if (!body.ok) {
+            return { ok: false, channel, id: opts.target, error: `Slack API: ${body.error ?? 'unknown error'}` };
+        }
+        return { ok: true, channel, id: opts.target };
+    }
+    catch (err) {
+        return { ok: false, channel, id: opts.target, error: err.message };
+    }
 }
-function rushProvider(channel) {
+// ── Unsupported (daemon-era only) ───────────────────────────────────────
+function unsupportedProvider(name) {
     return {
-        name: channel,
-        async send(text, opts) {
-            if (opts.dryRun) {
-                return { ok: true, channel, id: opts.target, attachments: opts.attachments };
-            }
-            // Preflight: rush must be on PATH (mirrors notify.ts's openclaw check).
-            try {
-                await execFileAsync('which', ['rush']);
-            }
-            catch {
-                return { ok: false, channel, id: opts.target, error: 'rush CLI not found on PATH' };
-            }
-            try {
-                if (channel === 'imessage' && opts.ownerScoped) {
-                    if ((opts.attachments?.length ?? 0) > 0) {
-                        return {
-                            ok: false,
-                            channel,
-                            id: opts.target,
-                            error: 'owner-scoped iMessage does not support attachments',
-                        };
-                    }
-                    await execFileAsync('rush', buildRushOwnerMessageArgs(text));
-                    return { ok: true, channel, id: opts.target };
-                }
-                const { stdout } = await execFileAsync('rush', buildRushSendArgs(channel, text, opts));
-                const parsed = JSON.parse(stdout);
-                return {
-                    ok: parsed.ok === true,
-                    channel,
-                    id: opts.target,
-                    attachments: parsed.attachments,
-                    error: parsed.ok === true ? undefined : 'rush send returned ok=false',
-                };
-            }
-            catch (err) {
-                // Daemon down surfaces here as the exec error (ErrDaemonDown), as does a
-                // non-JSON stdout (parse throw). Fail loud — never silently reroute.
-                return { ok: false, channel, id: opts.target, error: err.message };
-            }
+        name,
+        async send(_text, opts) {
+            if (opts.dryRun)
+                return { ok: true, channel: name, id: opts.target };
+            return {
+                ok: false,
+                channel: name,
+                id: opts.target,
+                error: `${name} delivery requires the Rush daemon (removed); use openclaw-telegram for Telegram`,
+            };
         },
     };
 }
-export const rushProviders = RUSH_CHANNELS.map(rushProvider);
+// ── Provider registry ───────────────────────────────────────────────────
+const PROVIDERS = {
+    imessage: { name: 'imessage', send: sendImessage },
+    slack: { name: 'slack', send: sendSlack },
+    telegram: unsupportedProvider('telegram'),
+    discord: unsupportedProvider('discord'),
+};
+export const rushProviders = RUSH_CHANNELS.map((ch) => PROVIDERS[ch]);

package/dist/lib/claude-statusline.d.ts

@@ -30,7 +30,7 @@ interface ClaudeStatusLinePayload {
         };
     };
 }
-export declare function ingestClaudeStatusLineUsage(payload: ClaudeStatusLinePayload, identity: ClaudeHomeIdentity | null): boolean;
+export declare function ingestClaudeStatusLineUsage(payload: ClaudeStatusLinePayload, identity: ClaudeHomeIdentity | null, versionHome?: string | null): boolean;
 /**
  * Where the running Claude keeps the config this render attributes to: the version
  * home when the launch shim set CLAUDE_CONFIG_DIR, otherwise the real HOME — the

package/dist/lib/claude-statusline.js

@@ -9,6 +9,7 @@ import { mergeClaudeUsageCacheWindows } from './accounting/usage.js';
 import { loadReminders, pickReminderForSession } from './reminders.js';
 import { readMeta } from './state.js';
 import { machineId } from './machine-id.js';
+import { recordRunAuthOutcome } from './auth-health.js';
 export const CLAUDE_STATUSLINE_COMMAND = 'agents __claude-statusline';
 const DELEGATE_FILE = path.join('.agents', 'claude-statusline-delegate');
 // The private subcommand this feature runs. It is only ever invoked internally,
@@ -64,7 +65,7 @@ function windowFromNative(key, value) {
         windowMinutes: key === 'session' ? 300 : 10_080,
     };
 }
-export function ingestClaudeStatusLineUsage(payload, identity) {
+export function ingestClaudeStatusLineUsage(payload, identity, versionHome) {
     if (!identity?.usageKey || !payload.rate_limits)
         return false;
     const windows = [
@@ -80,8 +81,19 @@ export function ingestClaudeStatusLineUsage(payload, identity) {
         windows,
         freshness: { source: 'statusline', poller: machineId() },
     });
+    // A status-line payload with rate_limits IS a real inference response — the
+    // token authenticated moments ago. Record that as the per-account auth FACT
+    // (`last used ok`), keyed to the account this box actually ran (PHNX-4116).
+    recordRunAuthOutcome({
+        agent: 'claude',
+        accountId: resolveNativeAccount(identity)?.id ?? null,
+        home: versionHome ?? null,
+        outcome: { ok: true },
+    });
+    // Keep this box's own state file current so the next placement probe or
+    // usage-sync fan-out carries this reading; the file is local, no transport.
     void import('./accounting/usage-sync.js')
-        .then((mod) => mod.pushUsageSnapshotNow())
+        .then((mod) => mod.publishUsageSnapshotToSharedStore())
         .catch(() => { });
     return true;
 }
@@ -211,7 +223,7 @@ export async function runClaudeStatusLine() {
     const versionHome = versionHomeFromEnv(process.env);
     const identity = readClaudeIdentity(claudeHomeFromEnv(process.env));
     if (versionHome)
-        ingestClaudeStatusLineUsage(payload, identity);
+        ingestClaudeStatusLineUsage(payload, identity, versionHome);
     process.stdout.write(renderClaudeStatusLine(payload, undefined, versionHome ? renderDelegate(raw, versionHome) : '', resolveReminderPart(payload.session_id), formatAccountPart(identity, resolveNativeAccount(identity))));
     return 0;
 }

package/dist/lib/commands.js

@@ -571,7 +571,7 @@ function commandContentMatches(agentId, commandName, sourcePath) {
  * Get the project-scoped commands directory for an agent.
  * Claude: .claude/commands/
  * Codex: .codex/prompts/
- * Gemini: .gemini/commands/
+ * Cursor: .cursor/commands/
  */
 function getProjectCommandsDirs(agentId, cwd = process.cwd()) {
     const agent = AGENTS[agentId];

package/dist/lib/crabbox/lease.js

@@ -145,7 +145,7 @@ export function buildBootstrapScript(opts) {
     // Runs regardless of --keep-box (it's in the box body, not teardown), so a kept
     // box still loses the token after the run — minimizing the credential window.
     const shredPaths = credentialRuntimes.flatMap((id) => {
-        const paths = { claude: ['.claude.json', CLAUDE_TOKEN_REMOTE], codex: ['.codex/auth.json'], gemini: ['.gemini/google_accounts.json'], grok: ['.grok/auth.json'] }[id];
+        const paths = { claude: ['.claude.json', CLAUDE_TOKEN_REMOTE], codex: ['.codex/auth.json'], grok: ['.grok/auth.json'] }[id];
         return paths ?? [];
     });
     if (opts.dispatchProfile)

package/dist/lib/crabbox/runtimes.js

@@ -22,13 +22,12 @@ import { listInstalledVersions, getVersionHomePath } from '../installations/vers
 export const LEASE_RUNTIMES = [
     { id: 'claude', label: 'Claude Code', localCandidates: ['.claude/.claude.json', '.claude.json'], remote: '.claude.json' },
     { id: 'codex', label: 'Codex CLI', localCandidates: ['.codex/auth.json'], remote: '.codex/auth.json' },
-    { id: 'gemini', label: 'Gemini CLI', localCandidates: ['.gemini/google_accounts.json'], remote: '.gemini/google_accounts.json' },
     { id: 'grok', label: 'Grok CLI', localCandidates: ['.grok/auth.json'], remote: '.grok/auth.json' },
 ];
 /**
  * Every runtime whose login this module can serialize (`LEASE_RUNTIMES`) is a
  * native, rotating OAuth / session credential (Claude OAuth token, codex/grok
- * `auth.json`, gemini `google_accounts.json`). The fleet-auth contract forbids
+ * `auth.json`). The fleet-auth contract forbids
  * copying any of them between devices — including to an ephemeral leased box —
  * because a shared refresh token rotates server-side on the next refresh and
  * invalidates every other copy (`docs/specifications.md` SING-1b,
@@ -142,7 +141,6 @@ const PROFILE_AUTH_ENV_KEYS_BY_RUNTIME = {
         'ANTHROPIC_FOUNDRY_API_KEY',
     ],
     codex: ['OPENAI_API_KEY'],
-    gemini: ['GEMINI_API_KEY', 'GOOGLE_API_KEY'],
     grok: ['XAI_API_KEY', 'GROK_API_KEY'],
 };
 /** True when a profile already carries auth for its host runtime via env. */

package/dist/lib/daemon/account-state-daemon-service.js

@@ -175,6 +175,7 @@ function verdictRank(verdict) {
         case 'rate_limited': return 5;
         case 'live': return 4;
         case 'unverified': return 3;
+        case 'no_evidence': return 3;
         case 'error': return 2;
         case 'unconfigured': return 1;
     }

package/dist/lib/daemon/auth-sync-service.d.ts

@@ -3,25 +3,28 @@
  *
  * This tick owns only the NON-git duties of auth sync: it materializes worker
  * slots from durable keys already on the box, then (on the elected headed
- * publisher) provisions peers whose LAST-DELIVERED verdict says `missing` by
- * pushing the credential over SSH. The secret never enters Git.
+ * publisher) provisions peers missing a reserved key by pushing the credential
+ * over SSH. The secret never enters Git.
  *
- * It no longer runs its own `syncFleetSharedStateRepo` (PHNX-4051). The verdict
- * this tick's decisions read is published and delivered by the single git
- * committer, the usage-sync tick — folding both publishes into one caller is
- * what stops the two ticks (30 s apart) from contending for the one shared-repo
- * lock and starving the usage snapshot workers depend on. This tick keeps its
- * own deadline and circuit breaker, so a hung peer SSH push parks only auth-sync
- * and never the usage delivery. The pushes read the peer verdicts the last
- * usage-sync exchange wrote into the local checkout; they are idempotent
- * (push only when a peer is missing a key), so acting on at-most-one-tick-old
- * data converges exactly as the in-tick exchange did. To keep "at-most-one-tick-
- * old" true, the pushes are gated on the exchange's freshness marker
- * (`readLastSuccessfulExchangeMs`): when the last usage-sync exchange is missing
- * or older than one usage-sync tick interval (`USAGE_SYNC_TICK_MS`, the
- * producer's cadence — not this service's own `AUTH_SYNC_TICK_MS`), this tick
- * skips the pushes and WARNs instead of acting on peer state that may no longer
- * hold.
+ * It runs no transport of its own (PHNX-4051): the per-account readiness
+ * verdicts it reads are published and delivered by the usage-sync tick's SSH
+ * exchange, which stores each peer's reply at `devices/<peer>/daemon-state.json`
+ * stamped `receivedAt`. This tick keeps its own deadline and circuit breaker, so
+ * a hung peer SSH push parks only auth-sync and never the usage delivery.
+ *
+ * The pushes read each peer's OWN reply file (PHNX-4116 PR 5): a peer reporting
+ * a `missing` verdict for an account is pushed that account's key; a peer that
+ * has never sent a reply (no file), or whose reply carries no `accounts.rows`
+ * field (an older CLI — fail closed), is skipped this tick and logged at INFO.
+ * Presence is also gated on a delivered-fingerprint match, so a re-mint
+ * (`accounts login` bumps `workerCredential.mintedAt` while the old token still
+ * authenticates) re-pushes the rotated key within a tick instead of reading
+ * `present` forever. The push is idempotent, so a stale reply is harmless — a
+ * stale "has key" is fine, a stale "missing key" costs one redundant push —
+ * which is why the per-peer `receivedAt` replaced the old global freshness gate
+ * (`readLastSuccessfulExchangeMs`) that skipped EVERY push when the newest
+ * exchange across the fleet went stale. The reply file is first-hand and
+ * timestamped, so acting on it needs no such fleet-wide gate.
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';

package/dist/lib/daemon/auth-sync-service.js

@@ -3,28 +3,30 @@
  *
  * This tick owns only the NON-git duties of auth sync: it materializes worker
  * slots from durable keys already on the box, then (on the elected headed
- * publisher) provisions peers whose LAST-DELIVERED verdict says `missing` by
- * pushing the credential over SSH. The secret never enters Git.
+ * publisher) provisions peers missing a reserved key by pushing the credential
+ * over SSH. The secret never enters Git.
  *
- * It no longer runs its own `syncFleetSharedStateRepo` (PHNX-4051). The verdict
- * this tick's decisions read is published and delivered by the single git
- * committer, the usage-sync tick — folding both publishes into one caller is
- * what stops the two ticks (30 s apart) from contending for the one shared-repo
- * lock and starving the usage snapshot workers depend on. This tick keeps its
- * own deadline and circuit breaker, so a hung peer SSH push parks only auth-sync
- * and never the usage delivery. The pushes read the peer verdicts the last
- * usage-sync exchange wrote into the local checkout; they are idempotent
- * (push only when a peer is missing a key), so acting on at-most-one-tick-old
- * data converges exactly as the in-tick exchange did. To keep "at-most-one-tick-
- * old" true, the pushes are gated on the exchange's freshness marker
- * (`readLastSuccessfulExchangeMs`): when the last usage-sync exchange is missing
- * or older than one usage-sync tick interval (`USAGE_SYNC_TICK_MS`, the
- * producer's cadence — not this service's own `AUTH_SYNC_TICK_MS`), this tick
- * skips the pushes and WARNs instead of acting on peer state that may no longer
- * hold.
+ * It runs no transport of its own (PHNX-4051): the per-account readiness
+ * verdicts it reads are published and delivered by the usage-sync tick's SSH
+ * exchange, which stores each peer's reply at `devices/<peer>/daemon-state.json`
+ * stamped `receivedAt`. This tick keeps its own deadline and circuit breaker, so
+ * a hung peer SSH push parks only auth-sync and never the usage delivery.
+ *
+ * The pushes read each peer's OWN reply file (PHNX-4116 PR 5): a peer reporting
+ * a `missing` verdict for an account is pushed that account's key; a peer that
+ * has never sent a reply (no file), or whose reply carries no `accounts.rows`
+ * field (an older CLI — fail closed), is skipped this tick and logged at INFO.
+ * Presence is also gated on a delivered-fingerprint match, so a re-mint
+ * (`accounts login` bumps `workerCredential.mintedAt` while the old token still
+ * authenticates) re-pushes the rotated key within a tick instead of reading
+ * `present` forever. The push is idempotent, so a stale reply is harmless — a
+ * stale "has key" is fine, a stale "missing key" costs one redundant push —
+ * which is why the per-peer `receivedAt` replaced the old global freshness gate
+ * (`readLastSuccessfulExchangeMs`) that skipped EVERY push when the newest
+ * exchange across the fleet went stale. The reply file is first-hand and
+ * timestamped, so acting on it needs no such fleet-wide gate.
  */
 import { BasePeriodicService } from './service.js';
-import { USAGE_SYNC_TICK_MS } from './usage-sync-service.js';
 export const AUTH_SYNC_TICK_MS = 15 * 60_000;
 const AUTH_SYNC_DEADLINE_MS = 2 * 60_000;
 export const AUTH_SYNC_KICKOFF_MS = 60_000;
@@ -40,7 +42,7 @@ export class AuthSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, } = await import('../secrets-policy.js');
+        const { reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, SKIP_REASON_NO_PEER_REPLY, SKIP_REASON_NO_ACCOUNT_ROWS, } = await import('../secrets-policy.js');
         // Worker-side slot materialization FIRST (PHNX-3940 T6): for each registered
         // account whose durable key is already on this box, create the HOME-shaped
         // slot the picker and spawn read. It touches only local state — the registry
@@ -67,29 +69,12 @@ export class AuthSyncService extends BasePeriodicService {
         catch (err) {
             ctx.log('WARN', `auth-sync: worker slot reconcile: ${err.message}`);
         }
-        // The verdict this tick's pushes read is published by the usage-sync tick,
-        // the single git committer (PHNX-4051), and delivered into the local checkout
-        // by its exchange. The pushes below act on that last-delivered peer state, so
-        // they are only sound while that state is fresh. Gate them on the exchange's
-        // freshness: if the last successful usage-sync exchange is missing or older
-        // than one tick interval, the delivered peer verdicts may be stale — a peer
-        // that already received the key still reads `missing`, or a cleared `missing`
-        // still reads stale — so skip the pushes and WARN rather than pushing off it.
-        // The worker-slot reconcile above is NOT gated: it reads only local durable
-        // keys, never delivered peer verdicts.
-        const { readLastSuccessfulExchangeMs } = await import('../fleet-shared-repo-sync.js');
-        const lastExchangeMs = readLastSuccessfulExchangeMs();
-        const ageMs = lastExchangeMs === null ? null : Date.now() - lastExchangeMs;
-        // The threshold is the PRODUCER's cadence (USAGE_SYNC_TICK_MS), not this
-        // service's own AUTH_SYNC_TICK_MS: the delivered peer verdicts are refreshed
-        // once per usage-sync exchange, so "stale" is measured against that tick, not
-        // this one. The two constants are equal today, but sourcing it here keeps the
-        // gate tracking the usage-sync cadence if either is ever retuned alone.
-        if (ageMs === null || ageMs > USAGE_SYNC_TICK_MS) {
-            const age = ageMs === null ? 'never completed' : `last completed ${Math.round(ageMs / 1000)}s ago`;
-            ctx.log('WARN', `auth-sync: skipping credential push — usage-sync exchange ${age} (need one within ${Math.round(USAGE_SYNC_TICK_MS / 1000)}s); peer verdicts may be stale`);
-            return;
-        }
+        // The pushes read each peer's OWN daemon-state reply, first-hand and
+        // timestamped, so they run every tick with no fleet-wide freshness gate: a
+        // peer that has replied is planned off its verdict (any age — the push is
+        // idempotent), and a peer that has never replied is skipped and logged at
+        // INFO below. The worker-slot reconcile above reads only local durable keys,
+        // never peer verdicts, so it was never gated either.
         const result = await syncReservedAuthBundle();
         if (result.pushed.length > 0) {
             ctx.log('INFO', `auth-sync: pushed auth to ${result.pushed.join(', ')}`);
@@ -107,6 +92,15 @@ export class AuthSyncService extends BasePeriodicService {
                 ctx.log('INFO', `auth-sync: adopted ${stores.adopted.length} legacy reserved item(s) into their bundle: ${stores.adopted.map((a) => `${a.bundle} ${a.key}`).join(', ')}`);
             for (const p of stores.pushed)
                 ctx.log('INFO', `auth-sync: pushed ${p.bundle} (${p.keys.length} key(s)) to ${p.device}`);
+            // A peer with no reply yet — or a reply with no account rows (older CLI,
+            // fail-closed) — is informational, not a warning: a brand-new or never-
+            // dialed worker legitimately has none on an early tick, and the no-rows
+            // skip is transient during a rolling upgrade. One line per such peer per tick.
+            for (const s of stores.skipped) {
+                if (s.reason === SKIP_REASON_NO_PEER_REPLY || s.reason === SKIP_REASON_NO_ACCOUNT_ROWS) {
+                    ctx.log('INFO', `auth-sync: ${s.device}: ${s.reason}`);
+                }
+            }
             for (const err of stores.errors)
                 ctx.log('WARN', `auth-sync: reserved-store ${err.device}: ${err.message}`);
         }