@phnx-labs/agents-cli 1.22.34 → 1.22.37

package/dist/lib/devices/config-migration.d.ts

@@ -0,0 +1,42 @@
+/**
+ * One-time migration: fold per-device config from the legacy stores into the
+ * central `fleet.devices.<name>.config` block of `~/.agents/agents.yaml`.
+ *
+ * Only SHARED-visibility keys move — the ones a peer reads. Machine-visibility
+ * keys (see lib/config-machine-keys.ts) stay in the per-device doc, which is
+ * exactly where the machine-local read path now looks for them.
+ *
+ * Legacy sources (both pre-unification):
+ *   - `~/.agents/devices/<name>/agents.yaml` — the `config:` map and the
+ *     top-level `defaultBrowserProfile:` field. Agent pins (`agents:`,
+ *     `isolatedAgents:`), `routines:`, and machine-visibility config STAY in the
+ *     per-device doc — only shared operator config moves.
+ *   - `~/.agents/.history/devices/auto-launch.json` — AGI EXT auto-launch
+ *     enabled/preferred flags, becoming `autoLaunchEnabled` /
+ *     `autoLaunchPreferred` config keys.
+ *
+ * The fold is ADDITIVE: the central block is written and the legacy stores are
+ * left exactly as they were, so a box still on the previous CLI keeps reading
+ * what it always read. The central-wins merge makes a re-run a byte no-op.
+ *
+ * Invoked only from a lifecycle entry point — `runMigration()` (fresh installs)
+ * and daemon boot. It must NEVER hang off a config read or write: agents.yaml is
+ * tracked and shared by the whole fleet, so a migration on the read path lets an
+ * ordinary `agents config get` dirty it on every machine.
+ */
+import type { FleetDeviceOverride, FleetManifest } from '../fleet/types.js';
+/**
+ * The `fleet.devices` map a config write should edit. A missing block starts
+ * empty; the literal `'all'` upgrades to an explicit map of the
+ * currently-registered roster so a config write never silently narrows what
+ * `agents apply` targets. (The dynamic "new devices join automatically"
+ * semantics of `'all'` do not survive the upgrade — per-device config is
+ * inherently a map.)
+ */
+export declare function fleetDevicesMapForWrite(fleet: FleetManifest | undefined): Record<string, FleetDeviceOverride>;
+/**
+ * Fold the legacy per-device config stores into the central
+ * `fleet.devices.<name>.config` block. Safe to call on every boot / config
+ * access: cheap no-op once the legacy stores are stripped.
+ */
+export declare function migrateDeviceConfigToCentral(): void;

package/dist/lib/devices/config-migration.js

@@ -0,0 +1,203 @@
+/**
+ * One-time migration: fold per-device config from the legacy stores into the
+ * central `fleet.devices.<name>.config` block of `~/.agents/agents.yaml`.
+ *
+ * Only SHARED-visibility keys move — the ones a peer reads. Machine-visibility
+ * keys (see lib/config-machine-keys.ts) stay in the per-device doc, which is
+ * exactly where the machine-local read path now looks for them.
+ *
+ * Legacy sources (both pre-unification):
+ *   - `~/.agents/devices/<name>/agents.yaml` — the `config:` map and the
+ *     top-level `defaultBrowserProfile:` field. Agent pins (`agents:`,
+ *     `isolatedAgents:`), `routines:`, and machine-visibility config STAY in the
+ *     per-device doc — only shared operator config moves.
+ *   - `~/.agents/.history/devices/auto-launch.json` — AGI EXT auto-launch
+ *     enabled/preferred flags, becoming `autoLaunchEnabled` /
+ *     `autoLaunchPreferred` config keys.
+ *
+ * The fold is ADDITIVE: the central block is written and the legacy stores are
+ * left exactly as they were, so a box still on the previous CLI keeps reading
+ * what it always read. The central-wins merge makes a re-run a byte no-op.
+ *
+ * Invoked only from a lifecycle entry point — `runMigration()` (fresh installs)
+ * and daemon boot. It must NEVER hang off a config read or write: agents.yaml is
+ * tracked and shared by the whole fleet, so a migration on the read path lets an
+ * ordinary `agents config get` dirty it on every machine.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'yaml';
+import { getDevicesAutoLaunchPath, getUserAgentsDir, updateMeta, } from '../state.js';
+import { loadDevicesSync } from './registry.js';
+import { MACHINE_LOCAL_YAML_KEYS } from '../config-machine-keys.js';
+/**
+ * The `fleet.devices` map a config write should edit. A missing block starts
+ * empty; the literal `'all'` upgrades to an explicit map of the
+ * currently-registered roster so a config write never silently narrows what
+ * `agents apply` targets. (The dynamic "new devices join automatically"
+ * semantics of `'all'` do not survive the upgrade — per-device config is
+ * inherently a map.)
+ */
+export function fleetDevicesMapForWrite(fleet) {
+    if (fleet && fleet.devices !== 'all')
+        return { ...fleet.devices };
+    if (fleet?.devices !== 'all')
+        return {};
+    // devices === 'all': expand to the registered roster.
+    const roster = loadDevicesSync();
+    const devices = {};
+    for (const name of Object.keys(roster))
+        devices[name] = {};
+    return devices;
+}
+function mergeFold(folds, device, values) {
+    folds[device] = { ...folds[device], ...values };
+}
+/**
+ * Read every legacy device doc, returning the config to fold per device.
+ * A doc that fails to parse is LOUDLY skipped (and left untouched) so the next
+ * run retries — never silently emptied, same corruption contract the device
+ * registry keeps.
+ */
+function collectDeviceDocFolds(devicesRoot) {
+    const folds = {};
+    const docs = [];
+    let entries;
+    try {
+        entries = fs.readdirSync(devicesRoot, { withFileTypes: true });
+    }
+    catch {
+        return { folds, docs }; // no devices/ tree — nothing to fold
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const docPath = path.join(devicesRoot, entry.name, 'agents.yaml');
+        if (!fs.existsSync(docPath))
+            continue;
+        let parsed;
+        try {
+            parsed = yaml.parse(fs.readFileSync(docPath, 'utf-8'));
+        }
+        catch (err) {
+            console.error(`device config migration: could not parse ${docPath} (${err.message}); leaving it for a later retry`);
+            continue;
+        }
+        if (parsed === null || parsed === undefined)
+            continue; // empty doc
+        if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+            console.error(`device config migration: ${docPath} is not a YAML map; leaving it for manual repair`);
+            continue;
+        }
+        const doc = parsed;
+        const config = {};
+        if (doc.config !== undefined) {
+            if (typeof doc.config !== 'object' || doc.config === null || Array.isArray(doc.config)) {
+                console.error(`device config migration: ${docPath} has a non-map config: block; leaving it for manual repair`);
+                continue;
+            }
+            Object.assign(config, doc.config);
+        }
+        if (typeof doc.defaultBrowserProfile === 'string') {
+            config.defaultBrowserProfile = doc.defaultBrowserProfile;
+        }
+        // Machine-visibility keys are NOT folded. Two reasons, both load-bearing:
+        //
+        //  1. They already live exactly where they belong. `config:` in this doc is
+        //     the machine-local store the new read path uses (state.ts overlays it
+        //     as `deviceConfig`), so folding would only copy them into the shared
+        //     file this whole change exists to keep clean.
+        //  2. Copying a PEER's would be a leak. `browserRemoteControl` is a consent
+        //     flag gating whether other machines may drive that box's browser;
+        //     hoisting one box's opt-in into the synced file spreads it to the fleet.
+        //     Each machine keeps its own, in its own doc.
+        for (const key of Object.keys(config)) {
+            if (MACHINE_LOCAL_YAML_KEYS.has(key))
+                delete config[key];
+        }
+        if (Object.keys(config).length === 0)
+            continue;
+        mergeFold(folds, entry.name, config);
+        docs.push({ name: entry.name, path: docPath, doc });
+    }
+    return { folds, docs };
+}
+/** Read the legacy auto-launch.json, returning the flags to fold per device. */
+function collectAutoLaunchFolds(autoLaunchPath) {
+    const folds = {};
+    let raw;
+    try {
+        raw = fs.readFileSync(autoLaunchPath, 'utf-8');
+    }
+    catch {
+        return folds; // absent — nothing to fold
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        console.error(`device config migration: could not parse ${autoLaunchPath} (${err.message}); leaving it for a later retry`);
+        return folds;
+    }
+    const devices = parsed?.devices;
+    if (devices && typeof devices === 'object' && !Array.isArray(devices)) {
+        for (const [name, pref] of Object.entries(devices)) {
+            const config = {};
+            if (pref?.enabled === false)
+                config.autoLaunchEnabled = false;
+            if (pref?.preferred === true)
+                config.autoLaunchPreferred = true;
+            if (Object.keys(config).length > 0)
+                mergeFold(folds, name, config);
+        }
+    }
+    return folds;
+}
+/**
+ * Fold the legacy per-device config stores into the central
+ * `fleet.devices.<name>.config` block. Safe to call on every boot / config
+ * access: cheap no-op once the legacy stores are stripped.
+ */
+export function migrateDeviceConfigToCentral() {
+    const devicesRoot = path.join(getUserAgentsDir(), 'devices');
+    const autoLaunchPath = getDevicesAutoLaunchPath();
+    const { folds: docFolds, docs } = collectDeviceDocFolds(devicesRoot);
+    const autoFolds = collectAutoLaunchFolds(autoLaunchPath);
+    const folds = {};
+    for (const [name, config] of Object.entries(docFolds))
+        mergeFold(folds, name, config);
+    for (const [name, config] of Object.entries(autoFolds))
+        mergeFold(folds, name, config);
+    if (Object.keys(folds).length === 0)
+        return;
+    // 1. Central write FIRST. A `fleet.devices: all` declaration upgrades to an
+    //    explicit map of the currently-registered roster so `agents apply` keeps
+    //    targeting the same devices. A key already present centrally WINS over
+    //    the legacy value — a re-fold after a mid-migration crash is then a
+    //    no-op, and a value written by a newer CLI is never clobbered.
+    updateMeta((m) => {
+        const devices = fleetDevicesMapForWrite(m.fleet);
+        for (const [name, config] of Object.entries(folds)) {
+            const prev = devices[name] ?? {};
+            devices[name] = { ...prev, config: { ...config, ...prev.config } };
+        }
+        const fleet = { ...m.fleet, devices };
+        return { ...m, fleet };
+    });
+    // 2. The legacy stores are deliberately LEFT IN PLACE.
+    //
+    //    This migration used to delete them — `fs.rmSync` on the device doc and
+    //    `fs.rmdirSync` on its directory. Deleting is what made the fold unsafe
+    //    to run anywhere: it had to win a race against every other machine's copy
+    //    of the same shared file, and a box on an older CLI that re-created the
+    //    doc would be stripped again on the next command.
+    //
+    //    An additive fold has neither problem. The central block is written; the
+    //    source is untouched; a box still running the previous CLI keeps reading
+    //    what it always read. The now-redundant legacy copy is pruned in a later
+    //    release by one explicit operator command, not by 13 machines each
+    //    deciding to delete on their own schedule.
+    void docs;
+    void autoLaunchPath;
+}

package/dist/lib/devices/connect.js

@@ -22,6 +22,7 @@ import { homeRemainder, remoteCdPrefix } from '../project-root.js';
 import { getCacheDir } from '../state.js';
 import { hostKeyCheckingOpts } from './known-hosts.js';
 import { hostNameFor } from './ssh-config.js';
+import { resolveDeviceProfile } from './resolve-profile.js';
 /** Env var the askpass shim reads to know which bundle holds the password. */
 export const ASKPASS_BUNDLE_ENV = 'AGENTS_SSH_BUNDLE';
 /** Env var the askpass shim reads to know which key in the bundle is the password. */
@@ -39,11 +40,12 @@ export const ASKPASS_AGENT_ONLY_ENV = 'AGENTS_SSH_AGENT_ONLY';
  * it against the shared injection guard. Throws if the device has no address.
  */
 export function sshTargetFor(device) {
-    const host = hostNameFor(device);
+    const resolved = resolveDeviceProfile(device);
+    const host = hostNameFor(resolved);
     if (!host) {
-        throw new Error(`Device '${device.name}' has no address (dnsName/ip). Run \`agents devices sync\` or \`agents devices add\`.`);
+        throw new Error(`Device '${resolved.name}' has no address (dnsName/ip). Run \`agents devices sync\` or \`agents devices add\`.`);
     }
-    const target = device.user ? `${device.user}@${host}` : host;
+    const target = resolved.user ? `${resolved.user}@${host}` : host;
     assertValidSshTarget(target);
     return target;
 }
@@ -64,7 +66,8 @@ export function fleetDialTarget(device) {
         return sshTargetFor(device);
     }
     catch {
-        return device.user ? `${device.user}@${device.name}` : device.name;
+        const resolved = resolveDeviceProfile(device);
+        return resolved.user ? `${resolved.user}@${resolved.name}` : resolved.name;
     }
 }
 /**
@@ -127,8 +130,9 @@ export function buildInteractiveShellCommand(device, mirrorCwd) {
 }
 /** OpenSSH argv that makes an explicit device key authoritative. */
 export function deviceIdentityArgs(device) {
-    return device.auth?.method === 'key' && device.auth.identityFile
-        ? ['-i', device.auth.identityFile, '-o', 'IdentitiesOnly=yes']
+    const resolved = resolveDeviceProfile(device);
+    return resolved.auth?.method === 'key' && resolved.auth.identityFile
+        ? ['-i', resolved.auth.identityFile, '-o', 'IdentitiesOnly=yes']
         : [];
 }
 /**
@@ -154,6 +158,9 @@ export function deviceIdentityArgs(device) {
  * behavior unchanged (RUSH-2412).
  */
 export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, opts = {}) {
+    // The effective profile: central config (ssh.*/platform/user) overlaid on
+    // the registry's discovery record.
+    device = resolveDeviceProfile(device);
     const target = sshTargetFor(device);
     // No cmd ⇒ interactive login. It may still carry a derived cd+login-shell
     // wrapper (interactiveCwd), which is an interactive login too and still needs
@@ -169,7 +176,7 @@ export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, o
     ];
     if (device.auth.method === 'password') {
         if (!device.auth.bundle) {
-            throw new Error(`Device '${device.name}' uses password auth but has no secrets bundle. Set one with \`agents devices set ${device.name} --bundle <name>\`.`);
+            throw new Error(`Device '${device.name}' uses password auth but has no secrets bundle. Set one with \`agents devices config ${device.name} ssh.bundle <name>\`.`);
         }
         env.SSH_ASKPASS = askpassShimPath;
         env.SSH_ASKPASS_REQUIRE = 'force';

package/dist/lib/devices/doctor-findings.d.ts

@@ -1,5 +1,6 @@
 import type { AgentId } from '../types.js';
 import type { DuplicateVersionHook } from '../hooks.js';
+import type { AgentsBinaryShadow } from '../binary-shadow.js';
 import type { RcSecretFinding } from '../secrets/rc-hygiene.js';
 import type { OwnerSinkStatus } from '../channels/owner-sink.js';
 import { type WindowsSshEnrollmentAudit } from './windows-ssh-enrollment.js';
@@ -12,7 +13,7 @@ export type FindingSeverity = 'critical' | 'warning';
  *  the JSON consumer group by kind. */
 /** Every finding class. Severity is NOT annotated here — {@link FINDING_SEVERITY}
  *  below owns it, and a second copy in these comments is a fourth place to drift. */
-export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "hook-runtime-broken", "hook-runtime-visibility-unavailable", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "ssh-key-enrollment", "stale-cli", "owner-sink-unreachable"];
+export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "hook-runtime-broken", "hook-runtime-visibility-unavailable", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "ssh-key-enrollment", "stale-cli", "binary-shadow", "owner-sink-unreachable"];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
  * the builders below and asserted against both prose rubrics by
@@ -117,6 +118,8 @@ export interface LocalFindingInputs {
      *  `rush` transport, so it stays out of this pure module). Absent → no probe ran
      *  → no finding. */
     ownerSink?: OwnerSinkStatus;
+    /** `agents` binaries that shadow the currently running CLI (RUSH-2431). */
+    binaryShadows?: AgentsBinaryShadow[];
 }
 /**
  * Fold this machine's signals into findings. Missing hooks/plugins and unwired

package/dist/lib/devices/doctor-findings.js

@@ -26,7 +26,8 @@
  *              never-synced · stale · repo-behind · repo-drift · version-skew ·
  *              fleet-resource-gap · hook-runtime-visibility-unavailable · orphan · duplicate-hook ·
  *              duplicate-hook-drift · host-cli-missing · host-cli-invalid ·
- *              rc-secret-export · env-secret-export · exec-policy · stale-cli.
+ *              rc-secret-export · env-secret-export · exec-policy · stale-cli ·
+ *              binary-shadow.
  *   (RUSH-2162 moved never-synced and duplicate-hook-drift to WARNING: both are
  *   stale-sync states one `agents sync` resolves, not "needs you now".)
  *
@@ -104,6 +105,7 @@ export const ALL_FINDING_KINDS = [
     'exec-policy', // Windows execution policy blocks agents.ps1
     'ssh-key-enrollment', // Windows OpenSSH public-key path/content/ACL is invalid
     'stale-cli',
+    'binary-shadow', // another agents binary on PATH or in a well-known dir shadows the running copy
     'owner-sink-unreachable', // the feed/notify owner-delivery lane can't reach the owner from this box
 ];
 /**
@@ -151,6 +153,7 @@ export const FINDING_SEVERITY = {
     'exec-policy': 'warning',
     'ssh-key-enrollment': 'critical',
     'stale-cli': 'warning',
+    'binary-shadow': 'warning',
 };
 function agentName(agent) {
     return AGENT_NAMES[agent] || agent;
@@ -272,6 +275,8 @@ export function remediationFor(finding) {
             return 'repair the reported AuthorizedKeysFile, then rerun agents doctor';
         case 'stale-cli':
             return 'upgrade';
+        case 'binary-shadow':
+            return 'remove or repoint the shadowing agents install(s)';
         case 'owner-sink-unreachable':
             // The lane delivers over the rush-backed owner channel, which needs rush on
             // PATH AND a usable session in THIS context. Non-interactive shells miss a
@@ -531,6 +536,18 @@ export function buildLocalFindings(input) {
     // (warning). Signed-in versions produce no finding — the accounts line shows
     // them. Agents that can't be inspected never yield a logout finding.
     out.push(...signInToFindings(device, input.signIn));
+    // agents binary shadows (warning) — another install could be resolved by a
+    // scheduled routine or by a different shell PATH, running stale code.
+    const shadows = input.binaryShadows ?? [];
+    if (shadows.length > 0) {
+        const examples = shadows.slice(0, 2).map((s) => `${s.path}${s.version ? ` (${s.version})` : ''}`).join(', ');
+        out.push(finding({
+            severity: FINDING_SEVERITY['binary-shadow'], kind: 'binary-shadow', device,
+            message: shadows.length === 1
+                ? `agents binary shadowed by ${examples}`
+                : `${shadows.length} agents binaries may shadow the running copy (incl. ${examples})`,
+        }));
+    }
     return collapseAcrossVersions(out, new Set(input.isolatedVersions ?? []));
 }
 /**
@@ -1013,6 +1030,8 @@ function warningSubject(f) {
     // so a self-referential subject reads as the local machine in fleet mode.
     if (f.kind === 'stale-cli')
         return 'agents-cli';
+    if (f.kind === 'binary-shadow')
+        return 'agents-cli';
     if (f.kind === 'orphan')
         return 'orphans';
     if (f.kind === 'rc-secret-export')

package/dist/lib/devices/harness-inventory.d.ts

@@ -1,3 +1,4 @@
+import { type AccountInfo } from '../agents.js';
 import type { AgentId } from '../types.js';
 import { type UsageSnapshot } from '../usage.js';
 /** An account's usage headroom rolled into one glanceable summary. */
@@ -6,11 +7,19 @@ export interface QuotaSummary {
      * `available` / `rate_limited` from the live usage windows, or `null` when
      * there is no snapshot at all (no data yet, or the agent has no usage source).
      */
-    status: 'available' | 'rate_limited' | null;
+    status: 'available' | 'rate_limited' | 'out_of_credits' | null;
+    /** Canonical launch verdict. Kept separate from utilization for JSON clients. */
+    verdict: 'available' | 'rate_limited' | 'out_of_credits' | 'unavailable';
     /** Max utilization across blocking windows (0-100, rounded), or null when unknown. */
     usedPercent: number | null;
     /** True when the snapshot is a cached `last_seen`, not a fresh `live` read. */
     stale: boolean;
+    /** ISO-8601 timestamp for the underlying usage observation. */
+    capturedAt: string | null;
+    /** Earliest reset across blocking windows, ISO-8601. */
+    resetsAt: string | null;
+    /** Why quota could not be evaluated; null when a verdict is available. */
+    unavailableReason: string | null;
 }
 /** One installed (agent, version) on a host, fully resolved. */
 export interface HarnessRow {
@@ -55,7 +64,7 @@ export interface AccountGroup {
  * `sonnet_week` sub-limit is excluded so hitting it doesn't read as a throttled
  * account) and takes the highest utilization across those windows. Pure.
  */
-export declare function summarizeQuota(snapshot: UsageSnapshot | null | undefined): QuotaSummary;
+export declare function summarizeQuota(snapshot: UsageSnapshot | null | undefined, unavailableReason?: string | null, accountStatus?: AccountInfo['usageStatus']): QuotaSummary;
 /**
  * "Ready" = signed in AND not rate-limited. A missing quota snapshot does NOT
  * block readiness: the account is signed in and usable, we just have no live

package/dist/lib/devices/health.d.ts

@@ -8,7 +8,7 @@
  * of blocking the whole table.
  *
  * The parsers are pure and unit-tested (health.test.ts). They mirror the ones in
- * the Factory extension (apps/factory/src/core/deviceHealth.ts) — kept as a
+ * AGI EXT (apps/ext/src/core/deviceHealth.ts) — kept as a
  * separate copy on purpose: the CLI does not import across packages.
  */
 import type { DeviceProfile } from './registry.js';

package/dist/lib/devices/health.js

@@ -8,7 +8,7 @@
  * of blocking the whole table.
  *
  * The parsers are pure and unit-tested (health.test.ts). They mirror the ones in
- * the Factory extension (apps/factory/src/core/deviceHealth.ts) — kept as a
+ * AGI EXT (apps/ext/src/core/deviceHealth.ts) — kept as a
  * separate copy on purpose: the CLI does not import across packages.
  */
 import { execFile } from 'child_process';

package/dist/lib/devices/pending.d.ts

@@ -2,14 +2,35 @@ export interface PendingDevice {
     name: string;
     platform: string;
 }
+/**
+ * Drop pending sentinels for devices that are already registered or ignored.
+ * Safe without a live tailscale probe — only removes names we know are no
+ * longer "new". Used when soft-fail discovery cannot recompute the full
+ * pending set, so a test leak or race cannot leave registered fleet boxes in
+ * the menu bar's NEW DEVICES section forever.
+ */
+export declare function pruneDismissedPendingSentinels(): Promise<void>;
 /**
  * Make the sentinel dir exactly match `pending`: create a file per pending
  * device (content = platform), and delete any leftover sentinel whose device is
  * no longer pending (it got registered, ignored, or left the tailnet). Best-
  * effort — a filesystem error here must never crash the daemon, so callers pass
  * this through their existing try/catch.
+ *
+ * The sentinel writer is the single authoritative choke point every discovery
+ * path flows through (the daemon device-probe timer and `agents sync`), so it
+ * re-subtracts the persisted ignore-list AND the registered roster rather than
+ * trusting the caller's `pending` set. That closes two races:
+ *   - probe/ignore (RUSH-2495): a probe that computed `pending` BEFORE the user
+ *     pressed "Ignore" would otherwise re-create the just-dismissed device's
+ *     sentinel and the menu bar would re-surface it.
+ *   - registry-empty pollution: a process that had AGENTS_DEVICES_DIR redirected
+ *     (tests / hermetic runs) but still wrote the live devices-pending dir
+ *     treated every tailnet node as new — including already-registered fleet
+ *     boxes. Re-subtracting the live registry means those phantoms are never
+ *     written and are removed if they already exist.
  */
-export declare function reconcilePendingSentinels(pending: PendingDevice[]): void;
+export declare function reconcilePendingSentinels(pending: PendingDevice[]): Promise<void>;
 /** Remove one device's pending sentinel (after the user registers or ignores it).
  * No-op if it doesn't exist. */
 export declare function clearPendingSentinel(name: string): void;

package/dist/lib/devices/pending.js

@@ -16,21 +16,86 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { getDevicesPendingDir } from '../state.js';
+import { loadDevices, loadIgnored } from './registry.js';
 /** Device-name sentinels must be safe filenames (no path traversal). The device
  * name charset is already the ssh-alias set, but guard defensively. */
 function isSafeName(name) {
     return /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name);
 }
+/**
+ * Best-effort load of names that must never appear as "NEW DEVICES": the
+ * ignore-list and the registered roster. A corrupted registry/ignore file
+ * (both throw by design) must not crash the daemon loop — treat it as empty
+ * and let the next probe recover once the file is fixed.
+ */
+async function loadDismissedNames() {
+    const out = new Set();
+    try {
+        for (const name of await loadIgnored())
+            out.add(name);
+    }
+    catch { /* treat as nothing ignored */ }
+    try {
+        for (const name of Object.keys(await loadDevices()))
+            out.add(name);
+    }
+    catch { /* treat as nothing registered */ }
+    return out;
+}
+/**
+ * Drop pending sentinels for devices that are already registered or ignored.
+ * Safe without a live tailscale probe — only removes names we know are no
+ * longer "new". Used when soft-fail discovery cannot recompute the full
+ * pending set, so a test leak or race cannot leave registered fleet boxes in
+ * the menu bar's NEW DEVICES section forever.
+ */
+export async function pruneDismissedPendingSentinels() {
+    const dir = getDevicesPendingDir();
+    const dismissed = await loadDismissedNames();
+    if (dismissed.size === 0)
+        return;
+    let existing;
+    try {
+        existing = fs.readdirSync(dir).filter((n) => !n.startsWith('.'));
+    }
+    catch {
+        return;
+    }
+    for (const name of existing) {
+        if (!dismissed.has(name))
+            continue;
+        try {
+            fs.unlinkSync(path.join(dir, name));
+        }
+        catch { /* already gone */ }
+    }
+}
 /**
  * Make the sentinel dir exactly match `pending`: create a file per pending
  * device (content = platform), and delete any leftover sentinel whose device is
  * no longer pending (it got registered, ignored, or left the tailnet). Best-
  * effort — a filesystem error here must never crash the daemon, so callers pass
  * this through their existing try/catch.
+ *
+ * The sentinel writer is the single authoritative choke point every discovery
+ * path flows through (the daemon device-probe timer and `agents sync`), so it
+ * re-subtracts the persisted ignore-list AND the registered roster rather than
+ * trusting the caller's `pending` set. That closes two races:
+ *   - probe/ignore (RUSH-2495): a probe that computed `pending` BEFORE the user
+ *     pressed "Ignore" would otherwise re-create the just-dismissed device's
+ *     sentinel and the menu bar would re-surface it.
+ *   - registry-empty pollution: a process that had AGENTS_DEVICES_DIR redirected
+ *     (tests / hermetic runs) but still wrote the live devices-pending dir
+ *     treated every tailnet node as new — including already-registered fleet
+ *     boxes. Re-subtracting the live registry means those phantoms are never
+ *     written and are removed if they already exist.
  */
-export function reconcilePendingSentinels(pending) {
+export async function reconcilePendingSentinels(pending) {
     const dir = getDevicesPendingDir();
-    const want = new Map(pending.filter((p) => isSafeName(p.name)).map((p) => [p.name, p.platform]));
+    const dismissed = await loadDismissedNames();
+    const want = new Map(pending
+        .filter((p) => isSafeName(p.name) && !dismissed.has(p.name))
+        .map((p) => [p.name, p.platform]));
     // Whole body is best-effort: a filesystem error here must never propagate into
     // the daemon loop or `agents sync`. The top-level mkdir/readdir are guarded
     // too, so no caller needs its own try/catch.

package/dist/lib/devices/registry.d.ts

@@ -158,28 +158,3 @@ export declare function addIgnored(name: string): Promise<Set<string>>;
 /** Remove a node name from the ignore-list (un-ignore). Returns false if it was
  * not ignored. */
 export declare function removeIgnored(name: string): Promise<boolean>;
-/**
- * Auto-launch preferences: which registered devices are eligible for Factory's
- * auto-host selection, and which are preferred. Stored as a sibling to the
- * registry and ignore-list under ~/.agents/.history/devices/.
- */
-export interface AutoLaunchPreference {
-    enabled?: boolean;
-    preferred?: boolean;
-}
-export interface AutoLaunchPreferences {
-    devices: Record<string, AutoLaunchPreference>;
-    updatedAt: string;
-}
-/** Load auto-launch preferences. Missing or malformed file => empty map. */
-export declare function loadAutoLaunchPreferences(): Promise<Record<string, AutoLaunchPreference>>;
-/** True if the device is enabled for auto-launch. Missing entry defaults to true. */
-export declare function isAutoLaunchEnabled(name: string): Promise<boolean>;
-/** Set whether a device is enabled for auto-launch. Setting to the default
- * (enabled) removes the entry to keep the file minimal. */
-export declare function setAutoLaunchEnabled(name: string, enabled: boolean): Promise<void>;
-/** True if the device is preferred for auto-launch ranking. */
-export declare function isAutoLaunchPreferred(name: string): Promise<boolean>;
-/** Set whether a device is preferred for auto-launch. Setting to the default
- * (not preferred) removes the flag to keep the file minimal. */
-export declare function setAutoLaunchPreferred(name: string, preferred: boolean): Promise<void>;