@phnx-labs/agents-cli 1.22.25 → 1.22.27

package/dist/lib/browser/ipc.js

@@ -64,6 +64,92 @@ async function waitForSocket(_socketPath, timeoutMs) {
     }
     throw new Error('Timeout waiting for browser daemon socket');
 }
+/**
+ * One long-lived connection to the existing browser daemon. Requests are
+ * serialized so the daemon's newline-delimited responses always map to the
+ * caller that produced them, while the process and socket stay warm between
+ * actions.
+ */
+export class BrowserIPCConnection {
+    socket;
+    buffer = '';
+    pending;
+    tail = Promise.resolve();
+    closed = false;
+    constructor(socket) {
+        this.socket = socket;
+        socket.on('data', (data) => this.handleData(data));
+        socket.on('error', (error) => this.fail(error));
+        socket.on('close', () => {
+            this.fail(new Error('Browser daemon connection closed'));
+        });
+    }
+    request(request) {
+        const result = this.tail.then(() => this.requestOnce(request));
+        this.tail = result.then(() => undefined, () => undefined);
+        return result;
+    }
+    async close() {
+        await this.tail;
+        if (this.closed || this.socket.destroyed)
+            return;
+        await new Promise((resolve) => {
+            this.socket.once('close', resolve);
+            this.socket.end();
+        });
+    }
+    requestOnce(request) {
+        if (this.closed || this.socket.destroyed) {
+            return Promise.reject(new Error('Browser daemon connection is closed'));
+        }
+        return new Promise((resolve, reject) => {
+            this.pending = { resolve, reject };
+            this.socket.write(`${JSON.stringify(request)}\n`, (error) => {
+                if (!error)
+                    return;
+                if (this.pending?.reject === reject)
+                    this.pending = undefined;
+                reject(error);
+            });
+        });
+    }
+    handleData(data) {
+        this.buffer += data.toString();
+        while (true) {
+            const index = this.buffer.indexOf('\n');
+            if (index === -1)
+                return;
+            const line = this.buffer.slice(0, index);
+            this.buffer = this.buffer.slice(index + 1);
+            if (!line.trim())
+                continue;
+            const pending = this.pending;
+            if (!pending) {
+                this.socket.destroy();
+                this.fail(new Error('Browser daemon sent an unexpected response'));
+                return;
+            }
+            this.pending = undefined;
+            try {
+                pending.resolve(JSON.parse(line));
+            }
+            catch {
+                const error = new Error('Browser daemon returned invalid JSON');
+                pending.reject(error);
+                this.socket.destroy();
+                this.fail(error);
+            }
+        }
+    }
+    fail(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        const pending = this.pending;
+        this.pending = undefined;
+        pending?.reject(error);
+    }
+}
 export class BrowserIPCServer {
     server = null;
     service;
@@ -527,33 +613,35 @@ async function reconcileDaemonVersion(socketPath) {
 export async function sendIPCRequest(request, opts = {}) {
     return sendRawIPCRequest(request, opts);
 }
+/**
+ * Open one connection that can serve many browser operations. This uses the
+ * same daemon readiness and version-reconciliation path as sendIPCRequest;
+ * only the client process and IPC socket lifetime differ.
+ */
+export async function connectBrowserIPC(opts = {}) {
+    const autoStartDaemon = opts.autoStartDaemon ?? true;
+    await prepareIPC('status', opts);
+    return new Promise((resolve, reject) => {
+        const socket = net.createConnection(getIpcEndpoint());
+        const onError = (error) => {
+            socket.destroy();
+            if (!autoStartDaemon && (error.code === 'ENOENT' || error.code === 'ECONNREFUSED')) {
+                reject(new BrowserDaemonNotRunningError());
+                return;
+            }
+            reject(new Error(`IPC error: ${error.message}`));
+        };
+        socket.once('error', onError);
+        socket.once('connect', () => {
+            socket.off('error', onError);
+            resolve(new BrowserIPCConnection(socket));
+        });
+    });
+}
 async function sendRawIPCRequest(request, opts = {}) {
-    const socketPath = getSocketPath();
     const endpoint = getIpcEndpoint();
     const autoStartDaemon = opts.autoStartDaemon ?? true;
-    if (!(await isDaemonReachable())) {
-        if (!autoStartDaemon) {
-            throw new BrowserDaemonNotRunningError();
-        }
-        if (!IS_WINDOWS) {
-            await fs.promises.mkdir(path.dirname(socketPath), { recursive: true, mode: 0o700 });
-            await fs.promises.chmod(path.dirname(socketPath), 0o700);
-        }
-        startDaemon();
-        if (!(await isDaemonReachable())) {
-            await waitForSocket(socketPath, 6000);
-        }
-        if (!(await isDaemonReachable())) {
-            throw new Error('Failed to start browser daemon');
-        }
-        await new Promise((r) => setTimeout(r, 300));
-    }
-    // Before serving a real request, make sure the daemon isn't running stale
-    // code. Skips the internal `version` probe (avoids recursion) and callers
-    // that opt out of auto-start. No-ops once reconciled or when versions match.
-    if (request.action !== 'version' && autoStartDaemon) {
-        await reconcileDaemonVersion(socketPath);
-    }
+    await prepareIPC(request.action, opts);
     return new Promise((resolve, reject) => {
         const socket = net.createConnection(endpoint);
         let buffer = '';
@@ -583,3 +671,30 @@ async function sendRawIPCRequest(request, opts = {}) {
         });
     });
 }
+async function prepareIPC(action, opts) {
+    const socketPath = getSocketPath();
+    const autoStartDaemon = opts.autoStartDaemon ?? true;
+    if (!(await isDaemonReachable())) {
+        if (!autoStartDaemon) {
+            throw new BrowserDaemonNotRunningError();
+        }
+        if (!IS_WINDOWS) {
+            await fs.promises.mkdir(path.dirname(socketPath), { recursive: true, mode: 0o700 });
+            await fs.promises.chmod(path.dirname(socketPath), 0o700);
+        }
+        startDaemon();
+        if (!(await isDaemonReachable())) {
+            await waitForSocket(socketPath, 6000);
+        }
+        if (!(await isDaemonReachable())) {
+            throw new Error('Failed to start browser daemon');
+        }
+        await new Promise((r) => setTimeout(r, 300));
+    }
+    // Before serving a real request, make sure the daemon isn't running stale
+    // code. Skips the internal `version` probe (avoids recursion) and callers
+    // that opt out of auto-start. No-ops once reconciled or when versions match.
+    if (action !== 'version' && autoStartDaemon) {
+        await reconcileDaemonVersion(socketPath);
+    }
+}

package/dist/lib/browser/profiles.d.ts

@@ -26,6 +26,17 @@ export declare function getProfileDownloadsDir(name: string): string;
 export declare function getProfileSessionsDir(name: string, task: string): string;
 export declare function listProfiles(): Promise<BrowserProfile[]>;
 export declare function getProfile(name: string): Promise<BrowserProfile | null>;
+/**
+ * True when `profile` can actually launch or attach on THIS machine.
+ *
+ * A remote (`ssh://`) profile runs its browser on the far host, so a local
+ * binary check doesn't apply — assume launchable. A local profile must have its
+ * configured browser/binary present on disk here; a `default` profile
+ * auto-created on a different OS (e.g. a macOS Chrome path reused on Linux — the
+ * "Custom binary not found" failure) fails this check so the caller re-detects
+ * for the current machine.
+ */
+export declare function isProfileLaunchableHere(profile: BrowserProfile): boolean;
 /**
  * Resolve the profile `agents browser start` uses when no `--profile` is given.
  *

package/dist/lib/browser/profiles.js

@@ -105,7 +105,7 @@ export async function getProfile(name) {
  * "Custom binary not found" failure) fails this check so the caller re-detects
  * for the current machine.
  */
-function isProfileLaunchableHere(profile) {
+export function isProfileLaunchableHere(profile) {
     const remote = Object.values(getEndpointPresets(profile)).some((preset) => preset.target.startsWith('ssh://'));
     if (remote)
         return true;

package/dist/lib/browser/stream.d.ts

@@ -0,0 +1,14 @@
+import type { Readable, Writable } from 'stream';
+export interface BrowserIPCStreamOptions {
+    input: Readable;
+    output: Writable;
+    task?: string;
+    actor: string;
+    launchId?: string;
+    autoStartDaemon?: boolean;
+}
+/**
+ * Read browser IPC requests as NDJSON and write one NDJSON response per line.
+ * The Node process and daemon connection stay alive until input closes.
+ */
+export declare function runBrowserIPCStream(options: BrowserIPCStreamOptions): Promise<void>;

package/dist/lib/browser/stream.js

@@ -0,0 +1,71 @@
+import { createInterface } from 'readline';
+import { connectBrowserIPC } from './ipc.js';
+import { assertRemoteControlAllowed } from './remote-control.js';
+function parseRequest(line) {
+    const parsed = JSON.parse(line);
+    if (!parsed ||
+        typeof parsed !== 'object' ||
+        Array.isArray(parsed) ||
+        typeof parsed.action !== 'string') {
+        throw new Error('Each input line must be a JSON object with an action');
+    }
+    return parsed;
+}
+function writeResponse(output, response) {
+    output.write(`${JSON.stringify(response)}\n`);
+}
+function writeErrorResponse(output, error) {
+    writeResponse(output, {
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+    });
+}
+/**
+ * Read browser IPC requests as NDJSON and write one NDJSON response per line.
+ * The Node process and daemon connection stay alive until input closes.
+ */
+export async function runBrowserIPCStream(options) {
+    const client = await connectBrowserIPC({ autoStartDaemon: options.autoStartDaemon });
+    const lines = createInterface({ input: options.input, crlfDelay: Infinity });
+    let defaultTask = options.task;
+    try {
+        for await (const line of lines) {
+            if (!line.trim())
+                continue;
+            let request;
+            try {
+                request = parseRequest(line);
+            }
+            catch (error) {
+                writeErrorResponse(options.output, error);
+                continue;
+            }
+            if (request.action === 'start') {
+                try {
+                    assertRemoteControlAllowed();
+                }
+                catch (error) {
+                    writeErrorResponse(options.output, error);
+                    continue;
+                }
+                request = {
+                    ...request,
+                    taskName: request.taskName ?? defaultTask,
+                    actor: request.actor ?? options.actor,
+                    launchId: request.launchId ?? options.launchId,
+                };
+            }
+            else if (!request.task && defaultTask) {
+                request = { ...request, task: defaultTask };
+            }
+            const response = await client.request(request);
+            if (response.task)
+                defaultTask = response.task;
+            writeResponse(options.output, response);
+        }
+    }
+    finally {
+        lines.close();
+        await client.close();
+    }
+}

package/dist/lib/channels/owner-sink.d.ts

@@ -0,0 +1,27 @@
+import type { Meta } from '../types.js';
+/** Why the owner sink cannot deliver from this box. */
+export type OwnerSinkReason = 'rush-not-on-path' | 'rush-signed-out';
+export interface OwnerSinkStatus {
+    /** Owner delivery is configured for this fleet (humans.yaml / notify.owner).
+     *  When false, no finding is emitted — an un-opted-in box is not "broken". */
+    configured: boolean;
+    /** This box can actually deliver an owner notification right now. */
+    reachable: boolean;
+    /** Resolved owner channel (e.g. `imessage`). */
+    channel?: string;
+    /** Resolved transport after `notify.transports` mapping (usually === channel). */
+    transport?: string;
+    /** Set only when `reachable` is false. */
+    reason?: OwnerSinkReason;
+}
+/**
+ * Probe whether THIS box can deliver an owner notification right now. Returns
+ * `configured:false` (and the caller emits no finding) when the fleet has no
+ * owner channel configured — an un-opted-in box is not broken. When configured,
+ * reports whether the resolved transport can actually deliver from here.
+ *
+ * Only the concrete rush-backed failure the lane hits is reported as unreachable;
+ * non-rush transports (desktop / mailbox / …) deliver locally and are treated as
+ * reachable rather than probed, so this never invents a critical it cannot back.
+ */
+export declare function probeOwnerSink(meta: Meta): Promise<OwnerSinkStatus>;

package/dist/lib/channels/owner-sink.js

@@ -0,0 +1,93 @@
+/**
+ * Owner-delivery-sink reachability probe (RUSH-2262).
+ *
+ * The feed/notify owner-delivery lane (`agents notify`, `agents feed post
+ * --level important` / `--blocked`) reaches the owner over the rush-backed owner
+ * channel (iMessage via `rush message send`). That transport can only deliver
+ * from a context that BOTH finds the `rush` CLI on PATH and can read its
+ * keychain-bound session. So a headless Linux fleet box (no rush) or a non-GUI
+ * SSH session on a mac (login keychain locked) structurally cannot escalate —
+ * and the failure is silent until a block is filed, surfacing only as the
+ * after-the-fact `owner failed: …` line. `agents doctor` had no signal for it,
+ * which is exactly the gap RUSH-2258 / RUSH-2262 flagged.
+ *
+ * This probes the SAME transport the lane uses, from the SAME context doctor runs
+ * in, so `agents doctor` can fail loud when this box cannot reach the owner. It is
+ * deliberately honest about context: `rush whoami` is what tells a real signed-in
+ * session apart from a keychain that is present but unreadable HERE. The session
+ * token is a keychain item, NOT `~/.rush/user.yaml` (RUSH-2262), so this never
+ * reads that file — checking it is the mistake that made a signed-in box look
+ * signed out.
+ *
+ * `agents notify --dry-run` is NOT this probe: it short-circuits before the
+ * `which rush` preflight (`providers/rush.ts`), so it reports `ok:true` on a box
+ * with no rush at all. Resolvability (does the envelope build?) and reachability
+ * (can this box actually deliver?) are different questions; this answers the
+ * second.
+ */
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { readOwnerDest } from './send.js';
+import { RUSH_CHANNELS } from './providers/rush.js';
+const execFileAsync = promisify(execFile);
+async function rushOnPath() {
+    try {
+        await execFileAsync('which', ['rush'], { timeout: 4000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Signed-in state from `rush whoami`, read with THIS context's keychain access.
+ *  'unknown' (a timeout or output we can't classify) is treated as reachable by
+ *  the caller — a slow or unexpected probe must not cry wolf and paint a false
+ *  critical. Only a definitive "not logged in" is reported as signed out. */
+async function rushSignedIn() {
+    const classify = (s) => {
+        const out = s.toLowerCase();
+        if (/not (logged in|signed in)/.test(out))
+            return 'no';
+        if (/logged in as|session:\s*valid/.test(out))
+            return 'yes';
+        return 'unknown';
+    };
+    try {
+        const { stdout, stderr } = await execFileAsync('rush', ['whoami'], { timeout: 5000 });
+        return classify(`${stdout}\n${stderr}`);
+    }
+    catch (err) {
+        const e = err;
+        if (e.killed)
+            return 'unknown'; // timed out — do not conclude signed-out
+        // A signed-out rush commonly exits non-zero; trust an explicit message only.
+        return classify(`${e.stdout ?? ''}\n${e.stderr ?? ''}`);
+    }
+}
+/**
+ * Probe whether THIS box can deliver an owner notification right now. Returns
+ * `configured:false` (and the caller emits no finding) when the fleet has no
+ * owner channel configured — an un-opted-in box is not broken. When configured,
+ * reports whether the resolved transport can actually deliver from here.
+ *
+ * Only the concrete rush-backed failure the lane hits is reported as unreachable;
+ * non-rush transports (desktop / mailbox / …) deliver locally and are treated as
+ * reachable rather than probed, so this never invents a critical it cannot back.
+ */
+export async function probeOwnerSink(meta) {
+    const dest = readOwnerDest(meta);
+    if (!dest)
+        return { configured: false, reachable: false };
+    const channel = dest.channel;
+    const transport = meta.notify?.transports?.[channel] ?? channel;
+    if (RUSH_CHANNELS.includes(transport)) {
+        if (!(await rushOnPath())) {
+            return { configured: true, reachable: false, channel, transport, reason: 'rush-not-on-path' };
+        }
+        if ((await rushSignedIn()) === 'no') {
+            return { configured: true, reachable: false, channel, transport, reason: 'rush-signed-out' };
+        }
+        return { configured: true, reachable: true, channel, transport };
+    }
+    return { configured: true, reachable: true, channel, transport };
+}

package/dist/lib/claude-account-token.d.ts

@@ -1,3 +1,5 @@
+/** True only for a clean, single-line `sk-ant-oat01-…` token — see {@link SETUP_TOKEN_RE}. */
+export declare function isValidClaudeSetupToken(value: string): boolean;
 /** The per-account key an email maps to inside the `auth` bundle. */
 export declare function claudeAccountTokenKey(account: string): string;
 /** Signed-in account email for a version home, from `.claude.json` (no keychain). */

package/dist/lib/claude-account-token.js

@@ -11,6 +11,24 @@ import { bundleBackend, bundleExists, readAndResolveBundleEnv } from './secrets/
  * multi-account fleet.
  */
 const AUTH_BUNDLE = 'auth';
+/**
+ * A well-formed Claude OAuth setup-token: the `sk-ant-oat01-` prefix followed by
+ * token-safe characters only, on a single line. `claude setup-token` mints exactly
+ * this; nothing else is a token.
+ *
+ * The provisioning capture bug behind #1767 stored the raw `claude setup-token`
+ * TTY stream — the welcome banner, ANSI control sequences, box-drawing art, and the
+ * token buried inside — under a per-account key instead of the parsed value. That
+ * blob is not a token: injected as `Authorization: Bearer <blob>` it made Anthropic
+ * reject every request and the run crash. agents-cli only *consumes* these tokens
+ * (the mint itself is the Rush Cloud / mint-auth path), so this is the boundary
+ * where a corrupt bundle entry must be caught before it reaches the auth header.
+ */
+const SETUP_TOKEN_RE = /^sk-ant-oat01-[A-Za-z0-9_-]+$/;
+/** True only for a clean, single-line `sk-ant-oat01-…` token — see {@link SETUP_TOKEN_RE}. */
+export function isValidClaudeSetupToken(value) {
+    return SETUP_TOKEN_RE.test(value);
+}
 /** The per-account key an email maps to inside the `auth` bundle. */
 export function claudeAccountTokenKey(account) {
     const slug = account
@@ -55,7 +73,15 @@ export function resolveClaudeSetupToken(home) {
             return null;
         const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
         const v = (env[claudeAccountTokenKey(email)] ?? '').trim();
-        return v.length > 0 ? v : null;
+        if (v.length === 0)
+            return null;
+        // Reject a malformed stored value (e.g. a captured setup-token TTY blob, #1767)
+        // rather than let it become an `Authorization: Bearer <blob>` header that
+        // Anthropic rejects and crashes the run. A corrupt entry is treated as no
+        // usable file-based token, so the caller falls back to the normal login.
+        if (!isValidClaudeSetupToken(v))
+            return null;
+        return v;
     }
     catch {
         return null;

package/dist/lib/crabbox/cli.d.ts

@@ -186,6 +186,8 @@ export interface CrabboxRunOptions extends CrabboxOptions {
     onData?: (chunk: string) => void;
     /** Force a full remote resync before running. */
     fullResync?: boolean;
+    /** Refresh an existing lease with this idle window before running. */
+    renewIdleTimeoutSecs?: number;
 }
 /**
  * Run `remoteCmd` on the leased box via `crabbox run` (crabbox syncs the dirty

package/dist/lib/crabbox/cli.js

@@ -485,6 +485,8 @@ export function crabboxRun(slug, remoteCmd, opts = {}) {
 export function crabboxRunScript(slug, script, opts = {}) {
     findCrabbox();
     const args = ['run', '--id', slug, '--reclaim'];
+    if (opts.renewIdleTimeoutSecs !== undefined)
+        args.push('--idle-timeout', `${opts.renewIdleTimeoutSecs}s`);
     if (opts.fullResync)
         args.push('--full-resync');
     args.push('--script-stdin');

package/dist/lib/crabbox/lease.js

@@ -233,7 +233,9 @@ export function isExpiredPoolStray(box, opts) {
         return false;
     if (box.expiresAt === null || box.expiresAt > nowSecs)
         return false; // unexpired ⇒ reusable
-    if (box.lastTouchedAt !== null && nowSecs - box.lastTouchedAt < graceSecs)
+    if (box.lastTouchedAt === null)
+        return false; // unknown age is never reap-safe
+    if (nowSecs - box.lastTouchedAt < graceSecs)
         return false; // maybe active
     return true;
 }
@@ -329,9 +331,13 @@ export async function leaseAndRun(opts) {
     let exitCode = null;
     let toreDown = false;
     try {
+        const renewIdleTimeoutSecs = reused && !opts.reuseBox && box.idleTimeoutSecs !== null
+            ? box.idleTimeoutSecs
+            : undefined;
         exitCode = await crabboxRunScript(box.slug, script, {
             secretsBundle: opts.secretsBundle,
             onData: opts.onData,
+            renewIdleTimeoutSecs,
         });
     }
     finally {

package/dist/lib/daemon.js

@@ -20,6 +20,7 @@ import { executeJobDetached, monitorRunningJobs } from './runner.js';
 import { detectOverdueJobs, notifyOverdue } from './overdue.js';
 import { runCatchup } from './catchup.js';
 import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from './routine-notify.js';
+import { notifyOwnerRoutineFinish, notifyOwnerRoutineStartFailed } from './routine-notify-owner.js';
 import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { redactSecrets } from './redact.js';
@@ -516,6 +517,16 @@ export async function runDaemon() {
                         notifyRoutineFinish(final);
                     }
                     catch { /* best-effort */ }
+                    // RUSH-2288: a failed/timed-out routine also reaches the OWNER's phone
+                    // (in-process owner channel stack), not just the local desktop. Green
+                    // runs are silent — the builder returns early. Async + swallowed so a
+                    // delivery hiccup never blocks the finish path.
+                    void notifyOwnerRoutineFinish(final)
+                        .then((r) => {
+                        if (r.attempts.length && !r.delivered)
+                            log('WARN', `Owner failure-notify for '${config.name}' reached no channel (tried: ${r.attempts.map((a) => a.channel).join(', ')})`);
+                    })
+                        .catch(() => { });
                 },
             });
             log('INFO', `Job '${config.name}' spawned (run: ${meta.runId}, PID: ${meta.pid})`);
@@ -531,6 +542,15 @@ export async function runDaemon() {
                 notifyRoutineStartFailed(config, message);
             }
             catch { /* best-effort */ }
+            // RUSH-2288: the pre-spawn failure (e.g. auth_failed) is exactly the one the
+            // per-routine `agents notify` prompt can never send — its agent never ran —
+            // so the daemon reaches the owner directly.
+            void notifyOwnerRoutineStartFailed(config, message)
+                .then((r) => {
+                if (r.attempts.length && !r.delivered)
+                    log('WARN', `Owner start-failure notify for '${config.name}' reached no channel (tried: ${r.attempts.map((a) => a.channel).join(', ')})`);
+            })
+                .catch(() => { });
         }
     };
     let scheduler = null;

package/dist/lib/devices/connect.d.ts

@@ -50,6 +50,8 @@ export interface SshHostKeyOptions {
     /** Managed known_hosts path override (tests). Defaults to the CLI-managed store. */
     knownHostsFile?: string;
 }
+/** OpenSSH argv that makes an explicit device key authoritative. */
+export declare function deviceIdentityArgs(device: DeviceProfile): string[];
 /**
  * Build the argv (after the `ssh` program name) and the environment overlay
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at

package/dist/lib/devices/connect.js

@@ -82,6 +82,12 @@ export function wrapRemoteCommand(device, cmd) {
     }
     return joined;
 }
+/** OpenSSH argv that makes an explicit device key authoritative. */
+export function deviceIdentityArgs(device) {
+    return device.auth?.method === 'key' && device.auth.identityFile
+        ? ['-i', device.auth.identityFile, '-o', 'IdentitiesOnly=yes']
+        : [];
+}
 /**
  * Build the argv (after the `ssh` program name) and the environment overlay
  * for connecting to a device. For password auth this points `SSH_ASKPASS` at
@@ -118,6 +124,7 @@ export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, o
     }
     else {
         args.push('-o', 'BatchMode=yes');
+        args.push(...deviceIdentityArgs(device));
     }
     // An interactive login (no remote command) needs a real tty.
     if (!remote)

package/dist/lib/devices/doctor-findings.d.ts

@@ -1,6 +1,8 @@
 import type { AgentId } from '../types.js';
 import type { DuplicateVersionHook } from '../hooks.js';
 import type { RcSecretFinding } from '../secrets/rc-hygiene.js';
+import type { OwnerSinkStatus } from '../channels/owner-sink.js';
+import { type WindowsSshEnrollmentAudit } from './windows-ssh-enrollment.js';
 import type { SyncStatusRow, OrphanRow } from '../drift.js';
 import type { FetchStatusMarker } from '../auto-pull.js';
 import type { VersionResourceReport } from '../doctor-diff.js';
@@ -10,7 +12,7 @@ export type FindingSeverity = 'critical' | 'warning';
  *  the JSON consumer group by kind. */
 /** Every finding class. Severity is NOT annotated here — {@link FINDING_SEVERITY}
  *  below owns it, and a second copy in these comments is a fourth place to drift. */
-export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "stale-cli"];
+export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "ssh-key-enrollment", "stale-cli", "owner-sink-unreachable"];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
  * the builders below and asserted against both prose rubrics by
@@ -101,11 +103,18 @@ export interface LocalFindingInputs {
         platform: NodeJS.Platform;
         policy: string | null;
     };
+    /** Read-only Windows OpenSSH AuthorizedKeysFile/content/ACL audit. */
+    windowsSshEnrollment?: WindowsSshEnrollmentAudit | null;
     /** `<agent>@<version>` keys whose home is an isolated copy. Their findings are
      *  never collapsed across versions: the agent-wide `agents doctor <agent> --fix`
      *  sweep deliberately skips isolated copies, so a collapsed row would print a
      *  remediation that does not fix them. */
     isolatedVersions?: string[];
+    /** Whether the feed/notify owner-delivery lane can reach the owner from this box
+     *  (RUSH-2262). Collected by `probeOwnerSink` in the command (it spawns the real
+     *  `rush` transport, so it stays out of this pure module). Absent → no probe ran
+     *  → no finding. */
+    ownerSink?: OwnerSinkStatus;
 }
 /**
  * Fold this machine's signals into findings. Missing hooks/plugins and unwired