@phnx-labs/agents-cli 1.22.117 → 1.22.118

package/dist/lib/account-catalog.js

@@ -8,7 +8,9 @@ import { readSlots } from './accounts/slots.js';
 import { harnessWorkerIsPerDevice } from './harness-auth-capabilities.js';
 import { hasKeychainTokenSync, isSecretsTransportError } from './secrets-client.js';
 import { isLaunchableSignedIn as isCredentialLaunchable } from './accounting/rotate.js';
-import { authCacheKey, readAuthHealthCache, slotAuthVersionKey } from './auth-health.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { authCacheKey, formatAuthFact, readAuthHealthCache, slotAuthVersionKey } from './auth-health.js';
 import { readFleetSharedDeviceStates } from './fleet-shared-state.js';
 import { machineId } from './machine-id.js';
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
@@ -180,15 +182,21 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
             state: signedIn ? 'connected' : 'reconnect-needed',
             identityLabel: email ?? account?.name ?? group.identityKey,
             provisioning: provisioningFor(group.agent),
-            verdict: signedIn ? 'unverified' : 'missing',
+            // A credential is present but nothing has probed or run it here yet — that
+            // is `no_evidence` ("we did not look"), not `unverified` (PHNX-4116). The
+            // real per-box verdict is recomputed in loadAccountCatalog; the display is
+            // a fact (token + run outcomes), never this word.
+            verdict: signedIn ? 'no_evidence' : 'missing',
             checkedAt: null,
             devices: [],
             usage: null,
             usageSnapshot: null,
             usageError: null,
+            token: 'no token',
+            lastAuth: 'not used on this box yet',
             fix: fixFor({
                 agent: group.agent,
-                verdict: signedIn ? 'unverified' : 'missing',
+                verdict: signedIn ? 'no_evidence' : 'missing',
                 name: account?.name,
                 version: home,
                 provisioning: provisioningFor(group.agent),
@@ -204,6 +212,54 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
 function provisioningFor(agent) {
     return harnessWorkerIsPerDevice(agent) ? 'per-device' : 'portable';
 }
+const TOKEN_FACT_MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+/** `Sep 16` — the credential file's date, the only mutable part of the token fact. */
+function tokenFileDate(mtimeMs) {
+    const d = new Date(mtimeMs);
+    return `${TOKEN_FACT_MONTHS[d.getMonth()]} ${d.getDate()}`;
+}
+/**
+ * The non-secret scheme prefix of a Claude token — `sk-ant-oat01` for a
+ * setup-token, `sk-ant` for another Claude scheme, `token` otherwise. NEVER the
+ * secret body: only a fixed, publicly-documented prefix is returned so the fact
+ * can be printed and fleet-synced safely (root AGENTS.md §Security).
+ */
+function safeTokenPrefix(raw) {
+    const value = raw.trim();
+    if (value.startsWith('sk-ant-oat01'))
+        return 'sk-ant-oat01';
+    if (value.startsWith('sk-ant'))
+        return 'sk-ant';
+    return 'token';
+}
+/**
+ * The token FACT for a Claude account ON THIS BOX (PHNX-4116): the slot/home
+ * `.claude/.oauth_token` scheme prefix + its file date, else a present native
+ * credential, else `no token`. For non-Claude native rows it reports credential
+ * presence generically. `dir` is the slot dir when the account has one, else the
+ * local version home. A fact, never a verdict.
+ */
+export function readTokenFact(agent, dir) {
+    if (!dir)
+        return 'no token';
+    if (agent === 'claude') {
+        const oauth = path.join(dir, '.claude', '.oauth_token');
+        try {
+            const stat = fs.statSync(oauth);
+            const prefix = safeTokenPrefix(fs.readFileSync(oauth, 'utf-8'));
+            return `${prefix} (${tokenFileDate(stat.mtimeMs)})`;
+        }
+        catch { /* fall through to the native-credential check */ }
+        try {
+            const creds = path.join(dir, '.claude', '.credentials.json');
+            const stat = fs.statSync(creds);
+            return `native login (${tokenFileDate(stat.mtimeMs)})`;
+        }
+        catch { /* no credential file */ }
+        return 'no token';
+    }
+    return credentialPresence(agent, dir).perVersion ? 'credential present' : 'no token';
+}
 export function toProviderRow(account, meta) {
     const harnesses = ALL_AGENT_IDS.filter((agent) => providerAuthenticatesHarness(account.provider, account.auth, agent));
     const defaults = meta.accounts?.defaults ?? {};
@@ -286,6 +342,13 @@ export async function loadAccountCatalog() {
         const inv = localHome ? inventoryByHome.get(`${row.agent}:${localHome.label}`) : undefined;
         row.usageSnapshot = inv?.snapshot ?? null;
         row.usageError = inv?.usageError ?? null;
+        // The per-box FACTS (PHNX-4116): the token file on disk and the recorded run
+        // (or probe) outcome — never a verdict word. `cached` is the same row the
+        // observation used (slot key first, then the version-home label), so the
+        // fact and the internal verdict read the same evidence.
+        const credentialDir = slot?.slotDir ?? (localHome ? getVersionHomePath(row.agent, localHome.label) : null);
+        row.token = readTokenFact(row.agent, credentialDir);
+        row.lastAuth = formatAuthFact(cached ?? null);
         row.fix = fixFor({
             agent: row.agent,
             verdict: row.verdict,
@@ -326,6 +389,10 @@ function providerListEntry(row, harness) {
         checkedAt: null,
         devices: [],
         usage: null,
+        // A durable provider credential is a key, not a run-tracked login: state its
+        // presence as the token fact; there is no per-run auth evidence to render.
+        token: row.verdict === 'ready' ? 'api key (present)' : 'no key',
+        lastAuth: 'not used on this box yet',
         fix: row.fix,
     };
 }
@@ -361,6 +428,8 @@ export function accountListJson(native, providers = [], harness) {
                 usage: row.usage,
                 ...(row.usageSnapshot ? { usageSnapshot: row.usageSnapshot } : {}),
                 ...((() => { const v = usageErrorForDisplay(row.usageError); return v ? { usageError: v } : {}; })()),
+                token: row.token,
+                lastAuth: row.lastAuth,
                 fix: row.fix,
             })),
             ...providers.flatMap((row) => providerJsonEntries(row, harness)),
@@ -403,7 +472,7 @@ export function coverageNote(row, localDevice) {
         return absent.length > 0 && absent.length < row.devices.length ? `not on ${absent.join(', ')}` : null;
     }
     const provisioned = row.devices.filter((device) => device.verdict !== 'missing').length;
-    const usable = row.devices.filter((device) => device.verdict === 'live' || device.verdict === 'rate_limited' || device.verdict === 'unverified').length;
+    const usable = row.devices.filter((device) => device.verdict === 'live' || device.verdict === 'rate_limited' || device.verdict === 'unverified' || device.verdict === 'no_evidence').length;
     if (usable === 0 || usable === provisioned)
         return null;
     return `usable on ${usable} of ${provisioned} boxes`;
@@ -416,10 +485,19 @@ export const OVERVIEW_MAX_USAGE_WINDOWS = 2;
  * cannot drift.
  */
 export const ACCOUNT_LISTING_LEGEND = '* stale usage · a healthy account carries no state · identity + per-box state: agents accounts list --fleet';
+/**
+ * When a usage reading arrived from ANOTHER box's poller over the fleet store,
+ * name its origin — `(from zion)` — so the number reads as a synced fact, not a
+ * local capture (PHNX-4116). Local captures (statusline/poll) carry no suffix.
+ */
+function usageOriginSuffix(snapshot) {
+    const poller = snapshot?.freshness?.source === 'sync' ? snapshot.freshness.poller : undefined;
+    return poller ? ` ${chalk.gray(`(from ${poller})`)}` : '';
+}
 function usageText(row, maxWindows) {
     if (row.usageSnapshot) {
         const usageInfo = { snapshot: row.usageSnapshot, error: row.usageError ?? null };
-        return formatUsageSummary(null, usageInfo.snapshot, 3, viewUsageSummaryOptions(row.agent, row.state === 'connected', usageInfo, maxWindows));
+        return formatUsageSummary(null, usageInfo.snapshot, 3, viewUsageSummaryOptions(row.agent, row.state === 'connected', usageInfo, maxWindows)) + usageOriginSuffix(row.usageSnapshot);
     }
     if (row.usage?.status === 'rate_limited' && (row.usage.usedPercent === null || row.usage.usedPercent === undefined)) {
         return 'limited';
@@ -432,31 +510,32 @@ function usageText(row, maxWindows) {
     return `${renderBar(row.usage.usedPercent, LISTING_USAGE_BAR_LEN)} ${percent}`;
 }
 /**
- * True only when the USAGE cell is certain to print a throttle marker, so the
- * `rate-limited` note would say the same thing twice. Mirrors `usageText`
- * branch for branch: with a snapshot, `formatUsageSummary` appends
- * 'out of credits' or 'session-limited (…)' exactly for these `unavailable`
- * reasons; without one, `usageText` prints 'limited' or 'no credits'. A verdict
- * thrown by a maxed WINDOW is deliberately NOT here: the overview caps the cell
- * at `OVERVIEW_MAX_USAGE_WINDOWS`, so the window that tripped it can be hidden
- * behind the `+N` count with no color at all, and the note is the only signal.
+ * Colour the auth FACT by what it states (PHNX-4116): a recent success is green,
+ * a server rejection red, a throttle yellow, and "not used on this box yet" the
+ * neutral gray of a fact that carries no alarm.
  */
-function usageCellNamesThrottle(row) {
-    if (row.usageSnapshot) {
-        const unavailable = row.usageSnapshot.unavailable;
-        return unavailable?.reason === 'out_of_credits'
-            || (unavailable?.reason === 'session_limit' && !!unavailable.resetsAt);
-    }
-    return row.usage?.status === 'out_of_credits'
-        || (row.usage?.status === 'rate_limited' && (row.usage.usedPercent === null || row.usage.usedPercent === undefined));
+export function authFactNote(lastAuth) {
+    if (lastAuth.startsWith('last used ok'))
+        return chalk.green(lastAuth);
+    if (lastAuth.startsWith('last auth failure'))
+        return chalk.red(lastAuth);
+    if (lastAuth.startsWith('rate-limited'))
+        return chalk.yellow(lastAuth);
+    return chalk.gray(lastAuth);
 }
 function nativeLine(row, localDevice, maxWindows) {
     return {
         // A discovered login nobody has named is still identified by what it is:
         // the row no longer carries an IDENTITY column, so the identity IS the name.
         name: row.name ?? row.identityLabel,
+        // FACTS, in order: the token on disk, what happened when it was last used, a
+        // signed-out flag when there is no credential at all, fleet coverage, then the
+        // repair. The auth fact already carries a throttle/failure with its time, so
+        // there is no separate verdict word (PHNX-4116).
         notes: [
-            usageCellNamesThrottle(row) && row.verdict === 'rate_limited' ? null : verdictNote(row.verdict),
+            chalk.gray(row.token),
+            authFactNote(row.lastAuth),
+            row.verdict === 'missing' ? chalk.red('signed out') : null,
             coverageNote(row, localDevice),
             row.fix ? chalk.gray(`fix: ${row.fix}`) : null,
         ].filter((note) => !!note),
@@ -565,7 +644,7 @@ export function readSharedAccountVerdicts(userAgentsDir) {
                 continue;
             if (!['native', 'durable', 'per-device'].includes(row.authMode))
                 continue;
-            if (!['live', 'expired', 'revoked', 'rate_limited', 'unverified', 'missing'].includes(row.verdict))
+            if (!['live', 'expired', 'revoked', 'rate_limited', 'unverified', 'no_evidence', 'missing'].includes(row.verdict))
                 continue;
             const key = `${row.harness}:${row.accountId}`;
             const values = out.get(key) ?? [];
@@ -600,11 +679,14 @@ function normalizeAuthVerdict(verdict, signedIn) {
     // result — the daemon never publishes it (probeLocalFleetAuth drops those
     // rows). So it says nothing about the credential on disk; the live signedIn
     // read of the slot decides, exactly as it does when no verdict exists at all.
+    // No probe row, or one that says nothing about the credential: a present
+    // credential with no evidence either way is `no_evidence`, never a word that
+    // claims we looked (PHNX-4116).
     if (verdict === 'unconfigured')
-        return signedIn ? 'unverified' : 'missing';
+        return signedIn ? 'no_evidence' : 'missing';
     if (verdict === 'error')
-        return signedIn ? 'unverified' : 'missing';
-    return verdict ?? (signedIn ? 'unverified' : 'missing');
+        return signedIn ? 'no_evidence' : 'missing';
+    return verdict ?? (signedIn ? 'no_evidence' : 'missing');
 }
 /**
  * Merge the two writers of the same local truth — the T1 slot store and the
@@ -650,6 +732,8 @@ export function aggregateAccountVerdict(provisioning, devices, localQuota) {
         return 'live';
     if (verdicts.includes('unverified'))
         return 'unverified';
+    if (verdicts.includes('no_evidence'))
+        return 'no_evidence';
     return provisioning === 'per-device' ? 'per-device' : 'missing';
 }
 function newestCheckedAt(devices) {

package/dist/lib/account-provider-registry.js

@@ -38,7 +38,7 @@ const ADAPTERS = new Map([
     ['deepinfra', fixed('deepinfra', ['api-key'], { codex: 'OPENAI_API_KEY' }, { codex: { OPENAI_BASE_URL: 'https://api.deepinfra.com/v1/openai' } })],
     ['openai', fixed('openai', ['api-key'], { codex: 'OPENAI_API_KEY', opencode: 'OPENAI_API_KEY' }, {}, { codex: 'OPENAI_BASE_URL', opencode: 'OPENAI_BASE_URL' })],
     ['xai', fixed('xai', ['api-key'], { grok: 'XAI_API_KEY', claude: 'ANTHROPIC_AUTH_TOKEN' })],
-    ['google', fixed('google', ['api-key'], { gemini: 'GEMINI_API_KEY', antigravity: 'ANTIGRAVITY_API_KEY' })],
+    ['google', fixed('google', ['api-key'], { antigravity: 'ANTIGRAVITY_API_KEY' })],
     ['opencode', fixed('opencode', ['api-key'], { opencode: 'OPENCODE_API_KEY' })],
     ['proxy', fixed('proxy', ['api-key', 'bearer-token'], { claude: 'ANTHROPIC_AUTH_TOKEN', codex: 'OPENAI_API_KEY' }, {}, { claude: 'ANTHROPIC_BASE_URL', codex: 'OPENAI_BASE_URL' })],
     ['truefoundry', fixed('truefoundry', ['api-key', 'bearer-token'], { claude: 'ANTHROPIC_AUTH_TOKEN' }, {}, { claude: 'ANTHROPIC_BASE_URL' })],

package/dist/lib/account-registry.d.ts

@@ -22,7 +22,7 @@ interface ResolvedCredentialAccount {
 export interface NativeAccount extends NativeAccountRecord {
     kind: 'native';
 }
-export { recordSlot, readSlots } from './accounts/slots.js';
+export { recordSlot, readSlots, dropSlots } from './accounts/slots.js';
 export { registeredNativeAccountForEmail, parseNativeIdentityKey } from './native-accounts.js';
 export type UnifiedAccount = (CredentialAccount & {
     kind: 'provider';

package/dist/lib/account-registry.js

@@ -27,7 +27,9 @@ import { isAgentId } from './types.js';
 import { bundleExistsSync, deleteBundleSync, deleteKeychainTokenSync, getKeychainTokenSync, hasKeychainTokenSync, listBundlesSync, readAndResolveBundleEnvSync, readBundleSync, renameBundleSync, writeBundleWithItemsSync, } from './secrets-client.js';
 import { getAccountProvider } from './account-provider-registry.js';
 import { accountSecretItem, buildAccountBundle, parseAccountBundle, secretVarFor } from './account-schema.js';
-export { recordSlot, readSlots } from './accounts/slots.js';
+import { readClaudeHomeConfig } from './agent-spec/agents.js';
+import { getVersionHomePath, listInstalledVersions } from './installations/store.js';
+export { recordSlot, readSlots, dropSlots } from './accounts/slots.js';
 export { registeredNativeAccountForEmail, parseNativeIdentityKey } from './native-accounts.js';
 const NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 const NATIVE_LABEL = /^[a-zA-Z0-9][a-zA-Z0-9@._+-]*$/;
@@ -663,6 +665,35 @@ export function resolveCredentialAccount(name, host, expectedProvider, base = ge
         env: { ...connectionEnv, [envVar]: secret },
     };
 }
+/**
+ * Sync fallback: scan installed version homes to discover a native identity
+ * that matches the given email, for accounts that predate the registration
+ * system (empty `accounts.native`). Returns a synthetic SpawnAccount or null.
+ */
+function discoverUnregisteredNativeAccount(email, agent) {
+    if (agent !== 'claude')
+        return null;
+    const needle = email.toLowerCase();
+    for (const label of listInstalledVersions(agent)) {
+        const home = getVersionHomePath(agent, label);
+        if (!fs.existsSync(home))
+            continue;
+        const config = readClaudeHomeConfig(home);
+        if (!config?.identity?.email)
+            continue;
+        if (config.identity.email.toLowerCase() === needle) {
+            return {
+                kind: 'native',
+                id: email,
+                name: email,
+                agent,
+                identityKey: config.identity.accountKey ?? email.toLowerCase(),
+                scope: 'version',
+            };
+        }
+    }
+    return null;
+}
 /**
  * Resolve the account a run should launch under, following the binding order
  * (explicit → exact `agent@version` → device-scoped `agent` → per-harness
@@ -689,7 +720,10 @@ export function resolveSpawnAccount(explicit, agent, version, meta, opts = {}) {
     // Scope the lookup to the harness being launched: a bare identity selector
     // (`claude#muqsitnawaz@gmail.com`) matches every harness that identity is signed
     // into, and only this one can authenticate the spawn.
-    const unified = findUnifiedAccount(selection.id, meta, undefined, agent);
+    let unified = findUnifiedAccount(selection.id, meta, undefined, agent);
+    if (!unified && selection.source === 'explicit' && selection.id.includes('@')) {
+        unified = discoverUnregisteredNativeAccount(selection.id, agent);
+    }
     if (!unified) {
         // A stale per-harness default is a preference, not a hard requirement: the
         // machine stays runnable by falling back to balanced rotation. Bindings and

package/dist/lib/accounting/rotate.js

@@ -212,9 +212,18 @@ export function hasStaleUsage(candidate, nowMs = Date.now()) {
     const capturedAt = snapshot?.capturedAt;
     if (!capturedAt || !snapshot?.windows.length)
         return false;
+    // A row that arrived via sync (D1, PHNX-4116) cannot be refreshed on THIS box —
+    // the account's poller lives on the headed device that published it, not here.
+    // Its age is shown, never used to refuse: a blind synced pool takes a
+    // floor-weight pick (capacityWeight → UNVERIFIED_WEIGHT) and
+    // rotationFailoverChain handles a real 429. Only a locally-captured reading a
+    // broken poller left hours old is genuinely "stale" for a refusal. See the
+    // GWT-E5d amendment.
+    if (snapshot.freshness?.source === 'sync')
+        return false;
     return nowMs - capturedAt.getTime() > USAGE_STALE_REFUSAL_MAX_AGE_MS;
 }
-function hasUsageAvailable(candidate) {
+function hasUsageAvailable(candidate, now = Date.now()) {
     const snapshot = candidate.usageSnapshot;
     if (snapshot) {
         // Eligibility mirrors the `agents view` throttle badge exactly
@@ -225,7 +234,7 @@ function hasUsageAvailable(candidate) {
         // stayed "eligible" and the router kept launching into it while `ag view`
         // showed it rate-limited. Capacity *weighting* still ranks eligible accounts
         // by weekly headroom; this gate only decides can-it-run-right-now.
-        const status = deriveUsageStatusFromSnapshot(snapshot);
+        const status = deriveUsageStatusFromSnapshot(snapshot, now);
         if (status !== null)
             return status !== 'rate_limited';
     }
@@ -279,11 +288,11 @@ export function readinessFromCandidate(candidate, now = Date.now(), model) {
             return { ready: false, reason: 'model_limited', email: candidate.email };
         }
     }
-    if (hasUsageAvailable(candidate)) {
+    if (hasUsageAvailable(candidate, now)) {
         return { ready: true };
     }
     const snap = candidate.usageSnapshot;
-    const snapRateLimited = !!snap && snap.windows.length > 0 && deriveUsageStatusFromSnapshot(snap) === 'rate_limited';
+    const snapRateLimited = !!snap && snap.windows.length > 0 && deriveUsageStatusFromSnapshot(snap, now) === 'rate_limited';
     const reason = !snapRateLimited && candidate.usageStatus === 'out_of_credits' ? 'out_of_credits' : 'rate_limited';
     return { ready: false, reason, email: candidate.email };
 }
@@ -573,11 +582,11 @@ export function pickAvailableCandidate(candidates, preferredVersion, nowMs = Dat
 export function classifyHarnessCandidates(byHarness, nowMs = Date.now()) {
     const summaries = [];
     for (const [agent, candidates] of byHarness) {
-        const eligible = candidates.filter((c) => isRotationEligible(c));
+        const eligible = candidates.filter((c) => isRotationEligible(c, nowMs));
         if (eligible.length === 0) {
             const counts = new Map();
             for (const c of candidates) {
-                const readiness = readinessFromCandidate(c);
+                const readiness = readinessFromCandidate(c, nowMs);
                 const reason = readiness.ready ? 'ineligible' : readiness.reason;
                 counts.set(reason, (counts.get(reason) ?? 0) + 1);
             }
@@ -668,7 +677,7 @@ export function formatNoHealthyAccountError(agent, strategy, excluded, nowMs = D
     const excludedStr = excluded.length === 0
         ? 'no installed versions'
         : excluded.map((c) => {
-            const readiness = readinessFromCandidate(c);
+            const readiness = readinessFromCandidate(c, nowMs);
             const reason = readiness.ready ? 'ineligible' : readiness.reason;
             return `${c.version} (${reason})`;
         }).join(', ');
@@ -700,7 +709,12 @@ export function formatNoVerifiedUsageError(agent, strategy, candidates, nowMs =
         ? 'no signed-in accounts'
         : candidates.map((c) => {
             const age = snapshotAgeMinutes(c, nowMs);
-            const staleness = age === null ? 'no usage snapshot' : `usage ${age}m old`;
+            // A synced row's age never drives a refusal (see hasStaleUsage), so name
+            // it as synced rather than letting the operator read it as the culprit.
+            const synced = c.usageSnapshot?.freshness?.source === 'sync';
+            const staleness = age === null
+                ? 'no usage snapshot'
+                : `usage ${age}m old${synced ? ', synced' : ''}`;
             return `${c.version} (${staleness})`;
         }).join(', ');
     const maxAgeMin = Math.round(USAGE_STALE_REFUSAL_MAX_AGE_MS / 60_000);

package/dist/lib/accounting/usage-ingest.d.ts

@@ -1 +1,6 @@
-export declare function runUsageIngest(): Promise<number>;
+/** Stdin grew past {@link REMOTE_STDOUT_MAX_BYTES}; the payload was refused unread. */
+export declare class UsageIngestInputTooLargeError extends Error {
+    readonly limitBytes: number;
+    constructor(limitBytes: number);
+}
+export declare function runUsageIngest(argv?: string[]): Promise<number>;

package/dist/lib/accounting/usage-ingest.js

@@ -1,35 +1,80 @@
 /**
- * The `agents __usage-ingest` receiver (PHNX-3392 usage-sync).
+ * The `agents __usage-ingest` receiver — the worker side of the usage exchange
+ * (PHNX-3392 usage-sync, PHNX-4116 transport over SSH).
  *
- * A legacy headed peer may pipe a {@link UsageSyncPayload} JSON envelope to our
- * stdin; we merge its identity-keyed rows into the local usage cache newest-wins
- * ({@link ingestPeerClaudeUsageRows}). Hidden internal verb — intercepted in
- * index.ts before bootstrap, so it never triggers an update check or a detached
- * sync, and it writes NOTHING to stdout (the caller only reads the exit code).
+ * A headed peer pipes its daemon-state envelope ({@link FleetStateExchangePayload},
+ * v2) to our stdin. We store it as that peer's `devices/<peer>/daemon-state.json`
+ * (stamped `receivedAt`) and merge its usage rows into the local cache
+ * newest-wins ({@link applyPeerFleetState}). With `--reply` we then refresh our
+ * own fields (session digests, reserved-auth verdict, and usage if this box is
+ * headed) and print our own envelope to stdout after a marker line, so the
+ * headed box holds this device's state without a second round-trip. Without
+ * `--reply` nothing is written to stdout: the ready probe runs this verb ahead
+ * of `agents --version`/`agents view --json` in one shell and parses that
+ * stdout, so a silent ingest is what keeps the probe parseable.
  *
- * Exit codes: 0 = merged (or nothing to merge — an empty payload is not an error),
- * 2 = malformed input. It fails loud on a bad envelope rather than silently
- * accepting a wrong shape, but a busy cache lock degrades to best-effort inside
- * `ingestPeerClaudeUsageRows` like every other cache writer.
+ * The legacy v1 envelope (`{v:1, rows}`) from an older headed peer is still
+ * merged. Hidden internal verb — intercepted in index.ts before bootstrap, so
+ * it never triggers an update check or a detached sync.
  *
- * New daemon ticks use the fleet-shared store instead. This compatibility
- * receiver remains for older installed versions. The payload arrives on stdin,
- * EXCEPT on a Windows receiver: the `agents.ps1`
- * shim does not forward ssh-piped stdin to the node process, so the pusher writes
- * the payload to a temp file and passes `agents __usage-ingest --from <path>`
- * (the same workaround the secrets push uses — `buildWindowsStdinImportCommand`).
+ * Exit codes: 0 = applied (or nothing to apply — an empty payload is not an
+ * error), 2 = malformed or oversized input. It fails loud on a bad envelope
+ * rather than silently accepting a wrong shape, but a busy cache lock degrades
+ * to best-effort inside `ingestPeerClaudeUsageRows` like every other cache
+ * writer. Stdin is bounded at {@link REMOTE_STDOUT_MAX_BYTES} — the same ceiling
+ * the dialer puts on a peer's reply — so a runaway pusher cannot grow this
+ * every-15-min receiver's heap; an overflow stops the read, exits 2, and writes
+ * nothing.
+ *
+ * The payload arrives on stdin, EXCEPT on a Windows receiver: the `agents.ps1`
+ * shim does not forward ssh-piped stdin to the node process, so the pusher
+ * writes the payload to a temp file and passes `--from <path>`
+ * (`buildWindowsStdinAgentsCommand`).
  */
 import * as fs from 'fs';
+import { REMOTE_STDOUT_MAX_BYTES, RemoteUtf8Accumulator } from '../ssh-exec.js';
 import { ingestPeerClaudeUsageRows } from './usage.js';
-function readStdin() {
-    return new Promise((resolve) => {
-        let buf = '';
-        process.stdin.setEncoding('utf-8');
+import { applyPeerFleetState, buildFleetStatePayload, formatFleetStateReply, parseFleetStateExchangeInput, publishOwnFleetState, } from './usage-sync.js';
+/** Stdin grew past {@link REMOTE_STDOUT_MAX_BYTES}; the payload was refused unread. */
+export class UsageIngestInputTooLargeError extends Error {
+    limitBytes;
+    constructor(limitBytes) {
+        super(`stdin payload exceeds ${limitBytes} bytes (${limitBytes / (1024 * 1024)} MiB); refusing it unread`);
+        this.limitBytes = limitBytes;
+        this.name = 'UsageIngestInputTooLargeError';
+    }
+}
+/**
+ * Read stdin to EOF, bounded at {@link REMOTE_STDOUT_MAX_BYTES}. On overflow the
+ * stream is destroyed so the pusher gets EPIPE instead of a full drain, and the
+ * promise rejects with {@link UsageIngestInputTooLargeError} — the caller exits
+ * 2 without parsing or writing anything.
+ */
+function readStdin(limitBytes = REMOTE_STDOUT_MAX_BYTES) {
+    return new Promise((resolve, reject) => {
+        const acc = new RemoteUtf8Accumulator();
+        let bytes = 0;
+        let settled = false;
         process.stdin.on('data', (chunk) => {
-            buf += chunk;
+            if (settled)
+                return;
+            bytes += chunk.byteLength;
+            if (bytes > limitBytes) {
+                settled = true;
+                process.stdin.destroy();
+                reject(new UsageIngestInputTooLargeError(limitBytes));
+                return;
+            }
+            acc.write(chunk);
         });
-        process.stdin.on('end', () => resolve(buf));
-        process.stdin.on('error', () => resolve(buf));
+        process.stdin.on('end', () => { if (!settled) {
+            settled = true;
+            resolve(acc.end());
+        } });
+        process.stdin.on('error', () => { if (!settled) {
+            settled = true;
+            resolve(acc.end());
+        } });
     });
 }
 /** `--from <path>` reads the payload from a file instead of stdin (Windows path). */
@@ -37,8 +82,9 @@ function fromFileArg(argv) {
     const i = argv.indexOf('--from');
     return i !== -1 && argv[i + 1] ? argv[i + 1] : null;
 }
-export async function runUsageIngest() {
-    const fromPath = fromFileArg(process.argv.slice(3));
+export async function runUsageIngest(argv = process.argv.slice(3)) {
+    const reply = argv.includes('--reply');
+    const fromPath = fromFileArg(argv);
     let source;
     if (fromPath) {
         try {
@@ -50,28 +96,52 @@ export async function runUsageIngest() {
         }
     }
     else {
-        source = await readStdin();
+        try {
+            source = await readStdin();
+        }
+        catch (err) {
+            if (!(err instanceof UsageIngestInputTooLargeError))
+                throw err;
+            process.stderr.write(`[agents] __usage-ingest: ${err.name}: ${err.message}\n`);
+            return 2;
+        }
     }
     const raw = source.trim();
-    if (!raw)
-        return 0; // nothing piped — a no-op tick, not a failure.
-    let payload;
-    try {
-        payload = JSON.parse(raw);
-    }
-    catch {
-        process.stderr.write('[agents] __usage-ingest: malformed JSON payload\n');
-        return 2;
-    }
-    if (!payload ||
-        payload.v !== 1 ||
-        typeof payload.rows !== 'object' ||
-        payload.rows === null ||
-        Array.isArray(payload.rows) // `typeof [] === 'object'` — an array is NOT a rows map
-    ) {
-        process.stderr.write('[agents] __usage-ingest: unrecognized usage-sync payload shape\n');
-        return 2;
+    const errors = [];
+    if (raw) {
+        let payload;
+        try {
+            payload = parseFleetStateExchangeInput(raw);
+        }
+        catch (err) {
+            process.stderr.write(`[agents] __usage-ingest: ${err.message}\n`);
+            return 2;
+        }
+        if (payload.v === 1) {
+            await ingestPeerClaudeUsageRows(payload.rows);
+        }
+        else {
+            try {
+                await applyPeerFleetState(payload.state);
+            }
+            catch (err) {
+                // A well-formed envelope we refuse (it names this device) is the
+                // sender's mistake, not malformed input: say so on stderr and in the
+                // reply, and still answer so the sender learns what this box holds.
+                const message = err.message;
+                process.stderr.write(`[agents] __usage-ingest: ${message}\n`);
+                errors.push(`ingest: ${message}`);
+                if (!reply)
+                    return 2;
+            }
+        }
     }
-    ingestPeerClaudeUsageRows(payload.rows);
+    if (!reply)
+        return 0;
+    const published = await publishOwnFleetState();
+    errors.push(...published.errors);
+    for (const message of published.errors)
+        process.stderr.write(`[agents] __usage-ingest: ${message}\n`);
+    process.stdout.write(formatFleetStateReply(buildFleetStatePayload({ errors })));
     return 0;
 }