@phnx-labs/agents-cli 1.22.26 → 1.22.27

package/dist/commands/ssh.js

@@ -31,7 +31,7 @@ import { resolveDeviceTarget, splitUserHost } from '../lib/devices/resolve-targe
 import { clearPendingSentinel } from '../lib/devices/pending.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
-import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, fleetDialTarget, writeAskpassShim, } from '../lib/devices/connect.js';
+import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, deviceIdentityArgs, fleetDialTarget, writeAskpassShim, } from '../lib/devices/connect.js';
 import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
 import { shouldSyncTerminfo, syncTerminfoToDevice, terminfoHostKey } from '../lib/devices/terminfo.js';
 import { fanOutDevices, fleetHealthSkip, planFleetTargets, remoteFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
@@ -44,6 +44,7 @@ import { checkAllClis } from '../lib/teams/agents.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
+import { collectLocalHarnessInventory, groupByAccount, renderAccountsMatrix, renderHarnessMatrix, } from '../lib/devices/harness-inventory.js';
 import { crabboxList, crabboxFind, crabboxSshArgv } from '../lib/crabbox/cli.js';
 import { boxAddress, boxStatus, fmtIdleShort, fmtExpiresShort } from './lease.js';
 import { authCellColor, formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, readAuthHealthCache, summarizeHostAuth, summarizeVerdicts, verdictColor, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
@@ -351,7 +352,7 @@ async function probeRemoteFleetStatus(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
     const cmd = buildRemoteAgentsInvocation(['devices', 'status', '--local', '--json'], undefined, isWin ? 'windows' : undefined, env);
-    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true });
+    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: target.extraSshArgs });
     if (res.code !== 0) {
         throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
     }
@@ -361,10 +362,10 @@ async function probeRemoteHealth(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
     const versionCmd = buildRemoteAgentsInvocation(['--version'], undefined, isWin ? 'windows' : undefined, env);
-    const versionRes = await sshExecAsync(target.dialTarget, versionCmd, { timeoutMs: 15000, multiplex: true });
+    const versionRes = await sshExecAsync(target.dialTarget, versionCmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: target.extraSshArgs });
     const version = versionRes.code === 0 ? versionRes.stdout.trim().split(/\s+/)[0] || null : null;
     const doctorCmd = buildRemoteAgentsInvocation(['doctor', '--json'], undefined, isWin ? 'windows' : undefined, env);
-    const doctorRes = await sshExecAsync(target.dialTarget, doctorCmd, { timeoutMs: 30000, multiplex: true });
+    const doctorRes = await sshExecAsync(target.dialTarget, doctorCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs: target.extraSshArgs });
     if (doctorRes.code !== 0) {
         throw new Error(doctorRes.timedOut ? 'timed out' : (doctorRes.stderr.trim() || `exit ${doctorRes.code ?? 'unknown'}`));
     }
@@ -425,6 +426,7 @@ async function runFleetStatus(opts) {
         // this is trusted on the default path, not just under `--refresh`.
         skip: fleetHealthSkip(t.skip, statsMap.get(t.device.name)),
         dialTarget: fleetDialTarget(t.device),
+        extraSshArgs: deviceIdentityArgs(t.device),
     }));
     const remote = await fanOutDevices(remoteTargets, probeRemoteHealth);
     for (const result of remote) {
@@ -533,7 +535,7 @@ async function probeRemoteAuth(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
     const cmd = buildRemoteAgentsInvocation(['devices', 'ping', '--local', '--json'], undefined, isWin ? 'windows' : undefined, env);
-    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true });
+    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: target.extraSshArgs });
     if (res.code !== 0) {
         throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
     }
@@ -601,6 +603,7 @@ async function runFleetPing(opts) {
         platform: t.device.platform,
         skip: t.skip,
         dialTarget: fleetDialTarget(t.device),
+        extraSshArgs: deviceIdentityArgs(t.device),
     }));
     const probeable = remoteTargets.filter((t) => !t.skip).length;
     const spinner = isInteractiveTerminal() && !opts.json
@@ -645,6 +648,118 @@ async function runFleetPing(opts) {
     if (opts.strict && anyBad)
         process.exitCode = 1;
 }
+/** SSH into a host and read its raw harness rows (the `--local --json` worker). */
+async function probeRemoteHarnesses(target, refresh) {
+    const isWin = /^win/i.test((target.platform ?? '').trim());
+    const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
+    const args = ['devices', 'harnesses', '--local', '--json'];
+    if (refresh)
+        args.push('--refresh');
+    const cmd = buildRemoteAgentsInvocation(args, undefined, isWin ? 'windows' : undefined, env);
+    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: target.extraSshArgs });
+    if (res.code !== 0) {
+        throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
+    }
+    const parsed = JSON.parse(res.stdout);
+    return parsed.rows ?? [];
+}
+/**
+ * Gather harness rows across the fleet: THIS host in process, every reachable
+ * peer over SSH. Shared by both `harnesses` and `accounts` (they differ only in
+ * how the rows are rendered). Honors an optional `--device` allowlist on both
+ * the local and remote rows. Bounded by the same per-device + overall deadlines
+ * as `fleet ping`, so one unreachable box can never stall the glance.
+ */
+async function collectFleetHarnesses(opts) {
+    const self = machineId();
+    const want = opts.devices?.length ? new Set(opts.devices) : null;
+    const results = [];
+    if (!want || want.has(self)) {
+        const localRows = await collectLocalHarnessInventory({ agents: opts.agents, refresh: opts.refresh });
+        results.push({ host: self, rows: localRows });
+    }
+    const reg = await loadDevices();
+    const planned = planFleetTargets(reg);
+    let remoteTargets = remoteFleetTargets(planned, self).map((t) => ({
+        name: t.device.name,
+        platform: t.device.platform,
+        skip: t.skip,
+        dialTarget: fleetDialTarget(t.device),
+        extraSshArgs: deviceIdentityArgs(t.device),
+    }));
+    if (want)
+        remoteTargets = remoteTargets.filter((t) => want.has(t.name));
+    if (remoteTargets.length > 0) {
+        const probeable = remoteTargets.filter((t) => !t.skip).length;
+        const spinner = isInteractiveTerminal() && !opts.json
+            ? ora(`Probing ${probeable} device${probeable === 1 ? '' : 's'}…`).start()
+            : undefined;
+        let remote;
+        try {
+            const fanOut = fanOutDevices(remoteTargets, (t) => probeRemoteHarnesses(t, !!opts.refresh), { perDeviceTimeoutMs: 15_000 });
+            remote = await raceFleetPingDeadline(fanOut, remoteTargets, 30_000);
+        }
+        finally {
+            spinner?.stop();
+        }
+        for (const r of remote) {
+            if (r.status === 'ok' && r.value) {
+                results.push({ host: r.name, rows: r.value });
+            }
+            else {
+                results.push({
+                    host: r.name,
+                    rows: [],
+                    error: r.error,
+                    skipped: r.reason ? String(r.reason) : undefined,
+                });
+            }
+        }
+    }
+    return results;
+}
+async function runDevicesHarnesses(opts) {
+    if (opts.local) {
+        const rows = await collectLocalHarnessInventory({ agents: opts.agents, refresh: opts.refresh });
+        if (opts.json)
+            console.log(JSON.stringify({ host: machineId(), rows }));
+        else
+            for (const line of renderHarnessMatrix([{ host: machineId(), rows }]))
+                console.log(line);
+        return;
+    }
+    const results = await collectFleetHarnesses(opts);
+    if (opts.json)
+        console.log(JSON.stringify(results, null, 2));
+    else
+        for (const line of renderHarnessMatrix(results))
+            console.log(line);
+}
+async function runDevicesAccounts(opts) {
+    if (opts.local) {
+        const rows = await collectLocalHarnessInventory({ agents: opts.agents, refresh: opts.refresh });
+        if (opts.json)
+            console.log(JSON.stringify({ host: machineId(), accounts: groupByAccount(rows) }));
+        else
+            for (const line of renderAccountsMatrix([{ host: machineId(), rows }]))
+                console.log(line);
+        return;
+    }
+    const results = await collectFleetHarnesses(opts);
+    if (opts.json) {
+        const grouped = results.map((r) => ({
+            host: r.host,
+            error: r.error,
+            skipped: r.skipped,
+            accounts: groupByAccount(r.rows),
+        }));
+        console.log(JSON.stringify(grouped, null, 2));
+    }
+    else {
+        for (const line of renderAccountsMatrix(results))
+            console.log(line);
+    }
+}
 /** Resolve an {@link AuthCellColor} to a chalk painter. Single map for cells + labels. */
 const CELL_PAINT = {
     green: chalk.green,
@@ -777,6 +892,7 @@ Typical workflow:
   agents devices configure mac-mini --max-agents 4 --scheduler off
   agents devices note mac-mini "runs the releases — don't reboot"
   agents devices set win-mini --auth password --bundle muqsit
+  agents devices set worker --auth key --identity-file ~/.ssh/worker_ed25519
   agents devices render --write  # write ~/.ssh/config.d/agents include
   agents fleet update            # roll out latest agents-cli to every online device
   agents fleet run uname -a      # run a command on every online device
@@ -1219,6 +1335,59 @@ Typical workflow:
         const verbose = opts.verbose ?? Boolean(cmd.optsWithGlobals().verbose);
         await runFleetPing({ ...opts, verbose });
     });
+    const csvList = (s) => s ? s.split(',').map((x) => x.trim()).filter(Boolean) : undefined;
+    const harnessInvOpts = (opts) => ({
+        agents: csvList(opts.agents),
+        devices: csvList(opts.device ?? opts.devices),
+        refresh: opts.refresh || opts.live,
+        json: opts.json,
+        local: opts.local,
+    });
+    const harnessesCmd = devicesCmd
+        .command('harnesses')
+        .description('Per device, one row per installed agent@version: account, signed-in, quota, and a single ready verdict. SSH-probes each online box.')
+        .option('--json', 'output machine-readable JSON (per-host rows)')
+        .option('--agents <csv>', 'only these agents (comma-separated)')
+        .option('--device <csv>', 'only these devices (comma-separated); default: every online box')
+        .option('--refresh', 'fetch live quota instead of the cached snapshot (slower)')
+        .option('--live', 'alias of --refresh')
+        .option('--local', "this host only: emit THIS box's rows (the per-host worker the fan-out reads over ssh)")
+        .action(async (opts) => {
+        await runDevicesHarnesses(harnessInvOpts(opts));
+    });
+    setHelpSections(harnessesCmd, {
+        examples: `
+agents devices harnesses                 # every box: agent@version · account · signed · quota · ready
+agents devices harnesses --agents claude,codex   # just these harnesses
+agents devices harnesses --device zion   # one box
+agents devices harnesses --refresh       # live quota (bypass the cached snapshot)
+agents devices harnesses --json          # machine-readable, per-host rows`,
+        notes: `
+"ready" = signed in AND not rate-limited — usable for a run right now.
+Quota is the cached usage snapshot (the daemon warms it); --refresh fetches live.
+Use \`agents devices accounts\` for the same data grouped by account.`,
+    });
+    const accountsCmd = devicesCmd
+        .command('accounts')
+        .description('Per device, one row per account: which harnesses share it, signed-in, quota, and ready. The identity lens on `agents devices harnesses`.')
+        .option('--json', 'output machine-readable JSON (per-host account groups)')
+        .option('--agents <csv>', 'only these agents (comma-separated)')
+        .option('--device <csv>', 'only these devices (comma-separated); default: every online box')
+        .option('--refresh', 'fetch live quota instead of the cached snapshot (slower)')
+        .option('--live', 'alias of --refresh')
+        .option('--local', "this host only: emit THIS box's account groups")
+        .action(async (opts) => {
+        await runDevicesAccounts(harnessInvOpts(opts));
+    });
+    setHelpSections(accountsCmd, {
+        examples: `
+agents devices accounts                  # every box: account · agents · signed · quota · ready
+agents devices accounts --device mac-mini
+agents devices accounts --json           # machine-readable, per-host account groups`,
+        notes: `
+Collapses the installs that share one account (e.g. five claude versions on one
+email) into a single row. Use \`agents devices harnesses\` for the per-install view.`,
+    });
     devicesCmd
         .command('login')
         .description('Log agent CLIs into fleet boxes over SSH: drive each box\'s device-code OAuth, scrape the URL + code, and surface every pending login in one local browser page. Default drives all codes at once; --interactive walks one box at a time (codes requested just-in-time so they don\'t expire).')
@@ -1281,15 +1450,19 @@ Typical workflow:
         .option('--auth <method>', 'key | password')
         .option('--bundle <bundle>', 'secrets bundle holding the password (for --auth password)')
         .option('--bundle-key <key>', "key within the bundle (default 'password')")
+        .option('--identity-file <path>', 'private-key path for --auth key')
+        .option('--clear-identity-file', 'return key auth to ssh-agent/default-key discovery')
         .action(async (name, opts) => {
         try {
             const existing = await mustGetDevice(name);
-            const auth = opts.auth || opts.bundle || opts.bundleKey
-                ? {
-                    method: opts.auth ?? existing.auth.method,
-                    bundle: opts.bundle ?? existing.auth.bundle,
-                    bundleKey: opts.bundleKey ?? existing.auth.bundleKey,
-                }
+            const nextMethod = opts.auth ?? existing.auth.method;
+            if (opts.identityFile && nextMethod !== 'key') {
+                throw new Error('--identity-file requires key auth; pass --auth key in the same command.');
+            }
+            const auth = opts.auth || opts.bundle || opts.bundleKey || opts.identityFile || opts.clearIdentityFile
+                ? nextMethod === 'key'
+                    ? { method: nextMethod, identityFile: opts.clearIdentityFile ? undefined : (opts.identityFile ?? existing.auth.identityFile) }
+                    : { method: nextMethod, bundle: opts.bundle ?? existing.auth.bundle, bundleKey: opts.bundleKey ?? existing.auth.bundleKey }
                 : undefined;
             const d = await upsertDevice(name, {
                 platform: opts.platform ?? undefined,

package/dist/commands/teams.js

@@ -17,7 +17,7 @@ import { createTeam, ensureTeam, getTeam, loadTeams, removeTeam, teamExists, } f
 import { setHelpSections } from '../lib/help.js';
 import { createWorktree, isGitRepo, hasUncommittedChanges, removeWorktree, } from '../lib/teams/worktree.js';
 import { resolveHost } from '../lib/hosts/registry.js';
-import { isDeviceAuto, resolveDeviceAffinity } from '../lib/smart-launch.js';
+import { isDeviceAuto, resolveDeviceAuto } from '../lib/smart-launch.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
 import { ensureHostReady } from '../lib/hosts/ready.js';
 import { remoteShellFor } from '../lib/hosts/remote-cmd.js';
@@ -1354,12 +1354,12 @@ export function registerTeamsCommands(program) {
             }
             return h ?? d ?? null;
         })();
-        // `auto` is the same affinity sentinel `agents run --device auto` resolves
+        // `auto` is the same live fleet sentinel `agents run --device auto` resolves
         // (RUSH-2185) — pick the concrete device name up front so the local-machine
         // check right below (and every dieFriction message further down) sees the
         // real target instead of the literal string "auto".
         if (explicitDevice && isDeviceAuto(explicitDevice)) {
-            const plan = resolveDeviceAffinity({});
+            const plan = await resolveDeviceAuto(parseTeammate(teammate).agent);
             const picked = plan.host ?? machineId();
             process.stderr.write(chalk.gray(`[teams] device=auto → ${picked === machineId() ? 'local' : picked}\n`));
             explicitDevice = picked;

package/dist/index.js

@@ -94,7 +94,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadExport, loadPackages, loadRoutines, loadMonitors, loadProjects, loadRun, loadFork, loadDefaults, loadSet, loadModels, loadModes, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadStatus, loadSnapshot, loadProfiles, loadHarness, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadFactory, loadUsage, loadCost, loadInsights, loadPerf, loadTrends, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadHumans, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadShare, loadSend, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadExport, loadPackages, loadRoutines, loadMonitors, loadProjects, loadRun, loadFork, loadDefaults, loadSet, loadModels, loadModes, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadStatus, loadSnapshot, loadProfiles, loadHarness, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadFactory, loadUsage, loadCost, loadInsights, loadPerf, loadTrends, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadHumans, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadBench, loadShare, loadSend, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { getCliLaunch } from './lib/cli-entry.js';
@@ -392,15 +392,15 @@ async function showWhatsNew(fromVersion, toVersion) {
 const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 import { getUpdateCheckPath, getMigratedSentinelPath, getUserAgentsDir, getRuntimeStateDir } from './lib/state.js';
 import { resolveBrandName, disabledCommandsForActiveBrand } from './lib/brand.js';
-import { readUpdateCache, saveUpdateCheck, dismissUpdateVersion, shouldPromptUpgrade, findAgentsCliInstalls, resolveRunningPackageRoot, } from './lib/self-update.js';
+import { readUpdateCache, saveUpdateCheck, dismissUpdateVersion, shouldPromptUpgrade, buildMultiInstallInventory, findAgentsCliInstalls, resolveRunningPackageRoot, } from './lib/self-update.js';
 const UPDATE_CHECK_FILE = getUpdateCheckPath();
 /**
- * Warn once when PATH resolves `agents` to a different agents-cli install
- * than the copy that is currently running (or to several). Divergent installs
+ * Warn once when this machine contains a different agents-cli install than the
+ * copy that is currently running (or several). Divergent installs
  * are how self-updates "succeed" without changing the command the user types.
- * The warning re-fires only when the set of install roots changes; dev builds
- * (0.0.0-dev) are ignored because side-by-side dev installs are a supported
- * workflow.
+ * The warning re-fires only when the set of install roots or their helper-copy
+ * safety changes. Dev builds are included because old dev copies can still
+ * overwrite the shared macOS helper bundle non-atomically.
  */
 function maybeWarnMultiInstall() {
     const sentinel = path.join(getRuntimeStateDir(), 'multi-install-warned');
@@ -414,31 +414,26 @@ function maybeWarnMultiInstall() {
         // "/$bunfs" install. This warning is advisory — stay silent instead.
         return;
     }
-    const byRoot = new Map();
-    byRoot.set(runningRoot, { version: VERSION, note: 'running' });
-    for (const install of findAgentsCliInstalls(process.env.PATH || '')) {
-        if (install.version.startsWith('0.0.0-dev'))
-            continue;
-        if (!byRoot.has(install.packageRoot)) {
-            byRoot.set(install.packageRoot, { version: install.version, note: `agents on PATH: ${install.binPath}` });
-        }
-    }
-    if (byRoot.size < 2) {
+    const inventory = buildMultiInstallInventory(runningRoot, VERSION, findAgentsCliInstalls(process.env.PATH || ''));
+    if (inventory.length < 2) {
         try {
             fs.unlinkSync(sentinel);
         }
         catch { /* nothing recorded */ }
         return;
     }
-    const key = [...byRoot.keys()].sort().join('\n');
+    const key = inventory
+        .map((info) => `${info.packageRoot}\t${info.version}\t${info.note}`)
+        .sort()
+        .join('\n');
     try {
         if (fs.readFileSync(sentinel, 'utf-8') === key)
             return;
     }
     catch { /* not warned for this set yet */ }
     console.error(chalk.yellow('Multiple agents-cli installs detected:'));
-    for (const [root, info] of byRoot) {
-        console.error(chalk.gray(`  ${root}  ${info.version}  (${info.note})`));
+    for (const info of inventory) {
+        console.error(chalk.gray(`  ${info.packageRoot}  ${info.version}  (${info.note})`));
     }
     console.error(chalk.gray('Upgrades apply to the running copy. Remove a stale copy with: npm uninstall -g --prefix <prefix> @phnx-labs/agents-cli'));
     try {
@@ -967,6 +962,7 @@ async function registerAllEagerCommands() {
     await reg(loadCost);
     await reg(loadInsights);
     await reg(loadPerf);
+    await reg(loadBench);
     await reg(loadTrends);
     await reg(loadOutput);
     await reg(loadBudget);

package/dist/lib/auth-health.d.ts

@@ -156,10 +156,54 @@ export interface AuthProbeRow {
     account?: string;
     health: AuthHealth;
 }
+/** One installed (agent, version) home, tagged with its resolved account label. */
+export interface FleetAuthInstall {
+    agent: AgentId;
+    version: string;
+    /** Human account label from {@link authAccountLabel}, or undefined when none resolves. */
+    account: string | undefined;
+}
+/**
+ * A set of installs that share one provider account and MUST be probed once.
+ * The live probe runs against `probe` (the representative home); every entry in
+ * `members` — the representative included — then receives that one verdict.
+ */
+export interface FleetAuthProbeGroup<T extends FleetAuthInstall> {
+    probe: T;
+    members: T[];
+}
 /**
- * Enumerate every installed (agent, version) on THIS host, probe each in
- * parallel, and return the rows (installs with no credential at all are
- * dropped). Shared by `agents fleet ping --local` and the daemon refresh.
+ * Collapse installs so a live auth probe fires ONCE per (agent, account) rather
+ * than once per version home.
+ *
+ * Several version homes signed into the same provider account share one OAuth
+ * rate limit, so probing each of them concurrently — which the daemon did every
+ * three minutes across every installed home (RUSH-2111) — raced that limit into
+ * a 429 storm that then parked the whole box behind a `Retry-After` penalty (the
+ * incident {@link file:./usage-backoff.ts} was written to survive; this removes
+ * its cause). Grouping by account means N homes on one account issue ONE request.
+ *
+ * `isMergeable` scopes the dedup to the installs it actually helps: only agents
+ * that make a network probe ({@link LIVE_PROBE_AGENTS}) can 429, so only they are
+ * merged. A best-effort agent (its verdict is a cheap local file read, no rate
+ * limit) is left per-install — collapsing it would gain nothing and could
+ * silently override one home's local `signedIn` verdict with another's. Installs
+ * with no resolvable account label, or that `isMergeable` rejects, are never
+ * merged: each becomes its own group keyed by version, preserving the old
+ * per-install probe (also the `unconfigured` case dropped downstream). Pure: no
+ * fs, no network, so the dedup decision is unit-tested directly.
+ */
+export declare function groupFleetAuthInstalls<T extends FleetAuthInstall>(installs: readonly T[], isMergeable?: (install: T) => boolean): FleetAuthProbeGroup<T>[];
+/**
+ * Enumerate every installed (agent, version) on THIS host and return one row per
+ * install (installs with no credential at all are dropped). Shared by
+ * `agents fleet ping --local` and the daemon refresh.
+ *
+ * The live network probe is deduped by account: homes sharing one provider
+ * account are probed ONCE and the verdict is fanned out to each home's row, so
+ * the daemon's every-3-minute refresh can no longer fire concurrent same-account
+ * requests and self-inflict a 429 (RUSH-2111). Each home still gets its own cache
+ * row (the cache key is per-version by design — see {@link authCacheKey}).
  */
 export declare function probeLocalFleetAuth(opts?: {
     cliVersion?: string | null;

package/dist/lib/auth-health.js

@@ -283,28 +283,87 @@ export async function probeAuthHealth(agent, home, opts) {
     return { verdict: info?.signedIn ? 'unverified' : 'unconfigured', checkedAt };
 }
 /**
- * Enumerate every installed (agent, version) on THIS host, probe each in
- * parallel, and return the rows (installs with no credential at all are
- * dropped). Shared by `agents fleet ping --local` and the daemon refresh.
+ * Collapse installs so a live auth probe fires ONCE per (agent, account) rather
+ * than once per version home.
+ *
+ * Several version homes signed into the same provider account share one OAuth
+ * rate limit, so probing each of them concurrently — which the daemon did every
+ * three minutes across every installed home (RUSH-2111) — raced that limit into
+ * a 429 storm that then parked the whole box behind a `Retry-After` penalty (the
+ * incident {@link file:./usage-backoff.ts} was written to survive; this removes
+ * its cause). Grouping by account means N homes on one account issue ONE request.
+ *
+ * `isMergeable` scopes the dedup to the installs it actually helps: only agents
+ * that make a network probe ({@link LIVE_PROBE_AGENTS}) can 429, so only they are
+ * merged. A best-effort agent (its verdict is a cheap local file read, no rate
+ * limit) is left per-install — collapsing it would gain nothing and could
+ * silently override one home's local `signedIn` verdict with another's. Installs
+ * with no resolvable account label, or that `isMergeable` rejects, are never
+ * merged: each becomes its own group keyed by version, preserving the old
+ * per-install probe (also the `unconfigured` case dropped downstream). Pure: no
+ * fs, no network, so the dedup decision is unit-tested directly.
+ */
+export function groupFleetAuthInstalls(installs, isMergeable = () => true) {
+    const groups = new Map();
+    for (const inst of installs) {
+        // The `acct:` / `ver:` tokens make the two branches disjoint, so an account
+        // label can never collide with a version fallback key no matter its content.
+        const key = inst.account && isMergeable(inst)
+            ? `${inst.agent} acct:${inst.account}`
+            : `${inst.agent} ver:${inst.version}`;
+        const existing = groups.get(key);
+        if (existing)
+            existing.members.push(inst);
+        else
+            groups.set(key, { probe: inst, members: [inst] });
+    }
+    return [...groups.values()];
+}
+/**
+ * Enumerate every installed (agent, version) on THIS host and return one row per
+ * install (installs with no credential at all are dropped). Shared by
+ * `agents fleet ping --local` and the daemon refresh.
+ *
+ * The live network probe is deduped by account: homes sharing one provider
+ * account are probed ONCE and the verdict is fanned out to each home's row, so
+ * the daemon's every-3-minute refresh can no longer fire concurrent same-account
+ * requests and self-inflict a 429 (RUSH-2111). Each home still gets its own cache
+ * row (the cache key is per-version by design — see {@link authCacheKey}).
  */
 export async function probeLocalFleetAuth(opts) {
     const agentIds = opts?.agents ?? ALL_AGENT_IDS;
-    const tasks = [];
+    // Enumerate every install, then resolve its account label. getAccountInfo is a
+    // local credential-file read (no network), so this fan-out is cheap and cannot
+    // contribute to the rate limit the probe grouping below exists to avoid.
+    const installs = [];
     for (const agent of agentIds) {
         for (const version of listInstalledVersions(agent)) {
-            const home = getVersionHomePath(agent, version);
-            tasks.push((async () => {
-                const info = await getAccountInfo(agent, home).catch(() => null);
-                const health = await probeAuthHealth(agent, home, { cliVersion: opts?.cliVersion, info });
-                health.account = authAccountLabel(info);
-                if (health.verdict === 'unconfigured')
-                    return null;
-                return { agent, version, account: health.account, health };
-            })());
+            installs.push({ agent, version, home: getVersionHomePath(agent, version), info: null, account: undefined });
         }
     }
-    const settled = await Promise.all(tasks);
-    return settled.filter((r) => r !== null);
+    await Promise.all(installs.map(async (inst) => {
+        inst.info = await getAccountInfo(inst.agent, inst.home).catch(() => null);
+        inst.account = authAccountLabel(inst.info);
+    }));
+    // Probe once per (agent, account) — but only for the network-probing agents
+    // that can actually 429; best-effort agents stay per-install (see
+    // groupFleetAuthInstalls). Groups run in parallel: they target distinct
+    // accounts, so no same-account concurrency is left to trip the throttle.
+    const perGroup = await Promise.all(groupFleetAuthInstalls(installs, (inst) => LIVE_PROBE_AGENTS.has(inst.agent)).map(async (group) => {
+        const rep = group.probe;
+        const health = await probeAuthHealth(rep.agent, rep.home, { cliVersion: opts?.cliVersion, info: rep.info });
+        health.account = authAccountLabel(rep.info);
+        if (health.verdict === 'unconfigured')
+            return [];
+        return group.members.map((inst) => ({
+            agent: inst.agent,
+            version: inst.version,
+            account: health.account,
+            // A distinct object per row so a later mutation of one can't bleed across.
+            health: { ...health },
+        }));
+    }));
+    return perGroup.flat();
 }
 /** Persist a host's probed rows into the cache (keyed by host+agent+version). */
 export function writeFleetAuthRows(host, rows) {

package/dist/lib/bench/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export * from "./schema.js";
+export * from "./storage.js";
+export * from "./runner.js";

package/dist/lib/bench/index.js

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export * from "./schema.js";
+export * from "./storage.js";
+export * from "./runner.js";

package/dist/lib/bench/runner.d.ts

@@ -0,0 +1,16 @@
+import type { BenchCell, BenchCellResult, BenchRunResult, BenchTask } from "./types.js";
+export interface CellExecutionRequest extends BenchCell {
+    prompt: string;
+    cwd: string;
+}
+export type CellExecutor = (request: CellExecutionRequest) => Promise<Omit<BenchCellResult, keyof BenchCell | "wall_ms" | "status">>;
+export declare function extractTokenCount(stdout: string, stderr: string): number | undefined;
+export declare function executeCellViaAgentsRun(request: CellExecutionRequest): ReturnType<CellExecutor>;
+export declare function runCells(options: {
+    task?: BenchTask;
+    prompt: string;
+    cells: BenchCell[];
+    concurrency: number;
+    execute?: CellExecutor;
+    tempRoot?: string;
+}): Promise<BenchRunResult>;