@phnx-labs/agents-cli 1.22.38 → 1.22.40

package/dist/lib/computer/actions.js

@@ -0,0 +1,162 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { randomUUID } from 'node:crypto';
+import { resolvePolicyPath } from '../computer-rpc.js';
+import { COMPUTER_INPUT_GATED_VERBS, formatComputerPermissionGrantHint } from '../permissions.js';
+import { emit as emitEvent } from '../feed/events.js';
+import { recordComputerSession } from '../session/db.js';
+import { resolveActor } from '../actor.js';
+function isComputerInputVerb(verb) {
+    return typeof verb === 'string' && COMPUTER_INPUT_GATED_VERBS.includes(verb);
+}
+function computerSessionId(env = process.env) {
+    return env.CODEX_THREAD_ID
+        || env.CLAUDE_CODE_SESSION_ID
+        || env.CLAUDE_SESSION_ID
+        || env.AGENTS_SESSION_ID
+        || env.AGENTS_RUN_ID
+        || null;
+}
+function admissionCachePath(env = process.env) {
+    if (env.AGENTS_COMPUTER_ADMISSION_CACHE)
+        return env.AGENTS_COMPUTER_ADMISSION_CACHE;
+    return path.join(path.dirname(resolvePolicyPath()), 'computer-target-admissions.json');
+}
+function targetSelector(opts) {
+    return opts.bundle ? `bundle:${opts.bundle}` : 'frontmost';
+}
+function readAdmissionCache(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        return Array.isArray(parsed.admissions) ? parsed.admissions.filter(isAdmission) : [];
+    }
+    catch {
+        return [];
+    }
+}
+function isAdmission(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    const r = v;
+    return r.sessionId !== undefined
+        && typeof r.sessionId === 'string'
+        && typeof r.selector === 'string'
+        && r.gateClass === 'input'
+        && typeof r.pid === 'number'
+        && typeof r.bundle_id === 'string'
+        && typeof r.name === 'string'
+        && typeof r.admittedAtMs === 'number'
+        && isComputerInputVerb(r.admittedByVerb);
+}
+function rememberAdmission(app, opts) {
+    const sessionId = computerSessionId(opts.env);
+    if (!sessionId)
+        return;
+    const filePath = admissionCachePath(opts.env);
+    const admissions = readAdmissionCache(filePath);
+    const next = {
+        sessionId,
+        selector: opts.selector,
+        gateClass: 'input',
+        pid: app.pid,
+        bundle_id: app.bundle_id,
+        name: app.name,
+        admittedAtMs: opts.nowMs ?? Date.now(),
+        admittedByVerb: opts.verb,
+    };
+    const filtered = admissions.filter((a) => !(a.sessionId === sessionId && a.selector === opts.selector && a.gateClass === 'input'));
+    filtered.push(next);
+    try {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, JSON.stringify({ admissions: filtered }, null, 2), { mode: 0o600 });
+    }
+    catch {
+        // Cache persistence is best-effort; the daemon remains the final gate.
+    }
+}
+function findAdmission(opts) {
+    const sessionId = computerSessionId(opts.env);
+    if (!sessionId)
+        return null;
+    const admissions = readAdmissionCache(admissionCachePath(opts.env));
+    const matches = admissions
+        .filter((a) => a.sessionId === sessionId && a.selector === opts.selector && a.gateClass === 'input')
+        .sort((a, b) => b.admittedAtMs - a.admittedAtMs);
+    return matches[0] ?? null;
+}
+export function pickTarget(list, opts) {
+    if (opts.pid != null) {
+        const app = list.find((a) => a.pid === opts.pid);
+        return { ok: true, app: app ?? { pid: opts.pid, name: '', bundle_id: '', active: false } };
+    }
+    if (opts.bundle) {
+        const app = list.find((a) => a.bundle_id === opts.bundle);
+        if (!app) {
+            return {
+                ok: false,
+                error: `bundle not in allow list (or not running): ${opts.bundle}\n${formatComputerPermissionGrantHint(opts.bundle)}`,
+            };
+        }
+        return { ok: true, app };
+    }
+    const active = list.find((a) => a.active);
+    if (!active) {
+        return {
+            ok: false,
+            error: `no active app found in allow list\n${formatComputerPermissionGrantHint()}`,
+        };
+    }
+    return { ok: true, app: active };
+}
+function unwrap(r) {
+    if (r.error) {
+        console.error(`error: ${r.error.code}: ${r.error.message}`);
+        process.exit(1);
+    }
+    return r.result ?? {};
+}
+export async function resolveTargetPidDecision(client, opts, gate) {
+    if (opts.pid != null)
+        return { ok: true, pid: opts.pid, source: 'pid' };
+    const apps = unwrap(await client.call('list_apps'));
+    const list = apps.apps || [];
+    const picked = pickTarget(list, opts);
+    const verb = gate?.verb;
+    const selector = targetSelector(opts);
+    if (picked.ok && isComputerInputVerb(verb)) {
+        rememberAdmission(picked.app, { selector, verb, env: gate?.env, nowMs: gate?.nowMs });
+    }
+    if (!picked.ok) {
+        if (isComputerInputVerb(verb)) {
+            const admitted = findAdmission({ selector, env: gate?.env });
+            if (admitted)
+                return { ok: true, pid: admitted.pid, source: 'session_admission' };
+        }
+        return { ok: false, error: picked.error };
+    }
+    return { ok: true, pid: picked.app.pid, source: 'list_apps' };
+}
+const COMPUTER_INVOCATION_ID = randomUUID();
+export function emitComputerAction(verb, targetPid, opts, extra = {}) {
+    emitEvent('computer.action', {
+        command: verb,
+        invocationId: COMPUTER_INVOCATION_ID,
+        targetPid,
+        bundle: opts.bundle,
+        device: opts.device,
+        ...extra,
+    });
+    try {
+        recordComputerSession({
+            invocationId: COMPUTER_INVOCATION_ID,
+            sessionId: process.env.AGENT_SESSION_ID || process.env.AGENTS_SESSION_ID,
+            launchId: process.env.AGENT_LAUNCH_ID,
+            actor: resolveActor().id,
+            actionCount: 1,
+            taskPreview: typeof extra.task === 'string' ? extra.task : undefined,
+        });
+    }
+    catch {
+        // Recording is best-effort; the action and its event are already done.
+    }
+}

package/dist/lib/computer/dispatch.d.ts

@@ -1,10 +1,10 @@
 import type { ComputerClient } from '../computer-rpc.js';
-import { type AppInfo } from '../../commands/computer-actions.js';
+import { type AppInfo } from './actions.js';
 import type { VerbDispatcher } from './loop.js';
 declare function rpcMethodFor(verb: string): string;
 declare function toRpcParams(verb: string, input: Record<string, unknown>, pid?: number): Record<string, unknown>;
 export declare function makeVerbDispatcher(client: ComputerClient, context?: {
-    host?: string;
+    device?: string;
 }): VerbDispatcher;
 export { rpcMethodFor, toRpcParams };
 export type { AppInfo };

package/dist/lib/computer/dispatch.js

@@ -5,7 +5,7 @@
 // it names the same RPC methods the explicit `agents computer <verb>` commands
 // call, so the external-agent verb surface is untouched. The daemon stays the
 // single authority on permissions and targeting.
-import { resolveTargetPidDecision, emitComputerAction } from '../../commands/computer-actions.js';
+import { resolveTargetPidDecision, emitComputerAction } from './actions.js';
 // CLI verb -> daemon RPC method. Only the rename cases need listing; the rest
 // pass through by name.
 const RPC_METHOD = {
@@ -125,7 +125,7 @@ export function makeVerbDispatcher(client, context = {}) {
         const res = await client.call(method, params);
         if (res.error)
             return { ok: false, error: `${res.error.code}: ${res.error.message}` };
-        emitComputerAction(verb, pid, { bundle: input.bundle, host: context.host });
+        emitComputerAction(verb, pid, { bundle: input.bundle, device: context.device });
         return { ok: true, result: res.result ?? {} };
     };
 }

package/dist/lib/computer/sessions-list.d.ts

@@ -17,7 +17,7 @@ export interface ComputerAction {
     /** The driven app's pid, when resolved. */
     targetPid?: number;
     bundle?: string;
-    /** `--host <device>` target when this action drove a remote daemon. */
+    /** `--device <device>` target when this action drove a remote daemon. */
     host?: string;
     /** Truncated `--task` text; only ever present on a `verb: 'run'` marker. */
     task?: string;
@@ -62,7 +62,7 @@ export interface ComputerRunRow {
      *  the driven one (see `remoteHost`). */
     machine: string;
     machineId?: string;
-    /** `--host <device>` target when the run drove a remote (Windows) daemon. */
+    /** `--device <device>` target when the run drove a remote (Windows) daemon. */
     remoteHost?: string;
     /** Best-known target app bundle across the run's actions. */
     bundle?: string;
@@ -90,7 +90,7 @@ export declare function groupIntoComputerRuns(actions: ComputerAction[], resolve
 /** Build task-first rows from the real ledger, resolving each row's owning
  *  session against the live indexes. The interactive picker's (and the
  *  flat/`--json` printer's) data source. `machine` narrows to rows whose
- *  invoking hostname, machineId, or `--host` target contains the substring. */
+ *  invoking hostname, machineId, or `--device` target contains the substring. */
 export declare function buildComputerSessionRows(opts?: {
     limit?: number;
     machine?: string;

package/dist/lib/computer/sessions-list.js

@@ -58,7 +58,7 @@
  * `sessionId` doesn't resolve (a rotated/unindexed session) but `launchId`
  * still does via the more authoritative pid registry.
  */
-import { query, truncate } from '../events.js';
+import { query, truncate } from '../feed/events.js';
 import { formatRelativeTime } from '../session/relative-time.js';
 import { getSessionById, listComputerSessionRecords, pruneToolSessions } from '../session/db.js';
 import { buildLaunchSessionIndex, resolveLaunchSession, } from '../browser/sessions-list.js';
@@ -237,7 +237,7 @@ function appendPrunedRunsFromDb(rows, limit) {
 /** Build task-first rows from the real ledger, resolving each row's owning
  *  session against the live indexes. The interactive picker's (and the
  *  flat/`--json` printer's) data source. `machine` narrows to rows whose
- *  invoking hostname, machineId, or `--host` target contains the substring. */
+ *  invoking hostname, machineId, or `--device` target contains the substring. */
 export function buildComputerSessionRows(opts = {}) {
     const actions = listComputerActions({ limit: opts.limit });
     const index = buildLaunchSessionIndex();

package/dist/lib/config-keys.d.ts

@@ -9,7 +9,7 @@
 import type { AgentId } from './types.js';
 import { type ModelTier } from './model-tiers.js';
 /** The top-level scope of a unified config key. */
-export type ConfigScope = 'run' | 'interactive' | 'usage' | 'browser' | 'project' | 'device';
+export type ConfigScope = 'run' | 'interactive' | 'usage' | 'auto' | 'browser' | 'project' | 'device';
 /** A run-time default key: model, mode, effort, or tier override. */
 export interface ParsedRunConfigKey {
     scope: 'run';
@@ -28,6 +28,11 @@ export interface ParsedUsageConfigKey {
     scope: 'usage';
     property: 'primary-host';
 }
+/** Which devices automatic placement (`--device auto`) may pick. */
+export interface ParsedAutoConfigKey {
+    scope: 'auto';
+    property: 'pool';
+}
 /** The default browser profile (device-scope, self or peer). */
 export interface ParsedBrowserConfigKey {
     scope: 'browser';
@@ -44,8 +49,8 @@ export interface ParsedDeviceConfigKey {
     device: string;
     property: DeviceConfigProperty;
 }
-export type ParsedConfigKey = ParsedRunConfigKey | ParsedInteractiveConfigKey | ParsedUsageConfigKey | ParsedBrowserConfigKey | ParsedProjectConfigKey | ParsedDeviceConfigKey;
-export type DeviceConfigProperty = 'max-agents' | 'scheduler' | 'daemon' | 'watchdog' | 'browser.remote-control' | 'notes' | 'browser.profile';
+export type ParsedConfigKey = ParsedRunConfigKey | ParsedInteractiveConfigKey | ParsedUsageConfigKey | ParsedAutoConfigKey | ParsedBrowserConfigKey | ParsedProjectConfigKey | ParsedDeviceConfigKey;
+export type DeviceConfigProperty = 'role' | 'max-agents' | 'scheduler' | 'daemon' | 'watchdog' | 'tmux' | 'browser.remote-control' | 'browser.task-idle-minutes' | 'notes' | 'browser.profile';
 /** Normalize agent@version to use `@` consistently. */
 export declare function formatAgentVersion(agent: AgentId, version: string): string;
 /**
@@ -58,13 +63,17 @@ export declare function formatAgentVersion(agent: AgentId, version: string): str
  *   run.<agent@version>.tier.<cheap|default|best|ultra>
  *   interactive.host
  *   usage.primary-host
+ *   auto.pool
  *   browser.profile
  *   project.root
+ *   devices.<name>.role
  *   devices.<name>.max-agents
  *   devices.<name>.scheduler
  *   devices.<name>.daemon
  *   devices.<name>.watchdog
+ *   devices.<name>.tmux
  *   devices.<name>.browser.remote-control
+ *   devices.<name>.browser.task-idle-minutes
  *   devices.<name>.notes
  *   devices.<name>.browser.profile
  */

package/dist/lib/config-keys.js

@@ -10,11 +10,14 @@ import { AGENTS } from './agents.js';
 import { MODEL_TIERS } from './model-tiers.js';
 import { VERSION_RE } from './run-defaults.js';
 const DEVICE_CONFIG_PROPERTIES = [
+    'role',
     'max-agents',
     'scheduler',
     'daemon',
     'watchdog',
+    'tmux',
     'browser.remote-control',
+    'browser.task-idle-minutes',
     'notes',
     'browser.profile',
 ];
@@ -45,13 +48,17 @@ export function formatAgentVersion(agent, version) {
  *   run.<agent@version>.tier.<cheap|default|best|ultra>
  *   interactive.host
  *   usage.primary-host
+ *   auto.pool
  *   browser.profile
  *   project.root
+ *   devices.<name>.role
  *   devices.<name>.max-agents
  *   devices.<name>.scheduler
  *   devices.<name>.daemon
  *   devices.<name>.watchdog
+ *   devices.<name>.tmux
  *   devices.<name>.browser.remote-control
+ *   devices.<name>.browser.task-idle-minutes
  *   devices.<name>.notes
  *   devices.<name>.browser.profile
  */
@@ -75,13 +82,16 @@ export function parseConfigKey(key) {
     if (raw === 'usage.primary-host') {
         return { scope: 'usage', property: 'primary-host' };
     }
+    if (raw === 'auto.pool') {
+        return { scope: 'auto', property: 'pool' };
+    }
     if (raw === 'browser.profile') {
         return { scope: 'browser', property: 'profile' };
     }
     if (raw === 'project.root') {
         return { scope: 'project', property: 'root' };
     }
-    const deviceMatch = raw.match(/^devices\.(.+)\.(max-agents|scheduler|daemon|watchdog|notes|browser\.remote-control|browser\.profile)$/);
+    const deviceMatch = raw.match(/^devices\.(.+)\.(role|max-agents|scheduler|daemon|watchdog|tmux|notes|browser\.remote-control|browser\.task-idle-minutes|browser\.profile)$/);
     if (deviceMatch) {
         return {
             scope: 'device',
@@ -99,6 +109,9 @@ export function parseConfigKey(key) {
     if (raw.startsWith('usage.')) {
         throw new Error(`Invalid usage config key '${key}'. Use usage.primary-host.`);
     }
+    if (raw.startsWith('auto.')) {
+        throw new Error(`Invalid auto config key '${key}'. Use auto.pool.`);
+    }
     if (raw.startsWith('browser.')) {
         throw new Error(`Invalid browser config key '${key}'. Use browser.profile.`);
     }
@@ -108,7 +121,7 @@ export function parseConfigKey(key) {
     if (raw.startsWith('devices.')) {
         throw new Error(`Invalid device config key '${key}'. Expected devices.<name>.<${DEVICE_CONFIG_PROPERTIES.join('|')}>.`);
     }
-    throw new Error(`Unknown config scope in '${key}'. Use one of: run, interactive, usage, browser, project, devices.`);
+    throw new Error(`Unknown config scope in '${key}'. Use one of: run, interactive, usage, auto, browser, project, devices.`);
 }
 /** Render a parsed key back to its canonical dotted string. */
 export function formatConfigKey(parsed) {
@@ -122,6 +135,8 @@ export function formatConfigKey(parsed) {
             return 'interactive.host';
         case 'usage':
             return 'usage.primary-host';
+        case 'auto':
+            return 'auto.pool';
         case 'browser':
             return parsed.device ? `devices.${parsed.device}.browser.profile` : 'browser.profile';
         case 'project':
@@ -137,7 +152,7 @@ export function listKnownConfigKeys() {
     for (const tier of MODEL_TIERS) {
         keys.push(`run.<agent@version>.tier.${tier}`);
     }
-    keys.push('interactive.host', 'usage.primary-host', 'browser.profile', 'project.root');
+    keys.push('interactive.host', 'usage.primary-host', 'auto.pool', 'browser.profile', 'project.root');
     for (const prop of DEVICE_CONFIG_PROPERTIES) {
         keys.push(`devices.<name>.${prop}`);
     }
@@ -150,6 +165,8 @@ export function listKnownConfigKeys() {
  */
 export function devicePropertyToConfigName(property) {
     switch (property) {
+        case 'role':
+            return 'role';
         case 'max-agents':
             return 'agents.max-concurrent';
         case 'scheduler':
@@ -158,8 +175,12 @@ export function devicePropertyToConfigName(property) {
             return 'daemon.enabled';
         case 'watchdog':
             return 'watchdog.enabled';
+        case 'tmux':
+            return 'tmux.enabled';
         case 'browser.remote-control':
             return 'browser.remote-control';
+        case 'browser.task-idle-minutes':
+            return 'browser.task-idle-minutes';
         case 'notes':
             return 'notes';
         case 'browser.profile':
@@ -181,13 +202,15 @@ export function configKeyStorageHint(parsed) {
             return 'config.interactiveHost';
         case 'usage':
             return 'config.usagePrimaryHost';
+        case 'auto':
+            return 'config.autoPool';
         case 'browser':
             return parsed.device
-                ? `fleet.devices.${parsed.device}.config.defaultBrowserProfile`
-                : 'fleet.devices.<self>.config.defaultBrowserProfile';
+                ? `devices/${parsed.device}/agents.yaml config.defaultBrowserProfile`
+                : 'devices/<self>/agents.yaml config.defaultBrowserProfile';
         case 'project':
             return 'devices.<self>.projectRoot';
         case 'device':
-            return `fleet.devices.${parsed.device}.config ${devicePropertyToConfigName(parsed.property)}`;
+            return `devices/${parsed.device}/agents.yaml config (${devicePropertyToConfigName(parsed.property)}; fleet default: fleet.defaults.config)`;
     }
 }

package/dist/lib/config-machine-keys.d.ts

@@ -1,7 +1,9 @@
 /**
  * The YAML keys of every machine-visibility config key — the ones that live in
- * the owning box's own `devices/<machine>/agents.yaml` and must never reach the
- * fleet-shared `agents.yaml`.
+ * the owning box's own `devices/<machine>/agents.yaml` and cannot be read or
+ * set for a peer. A fleet default may still live under
+ * `fleet.defaults.config` (the shared default layer); the peer restriction
+ * is about targeting another device, not about fleet policy.
  *
  * This is a ZERO-DEPENDENCY leaf on purpose. The authority is `CONFIG_KEYS` in
  * `lib/device-config.ts`, but that module imports `devices/config-migration.ts`,

package/dist/lib/config-machine-keys.js

@@ -1,7 +1,9 @@
 /**
  * The YAML keys of every machine-visibility config key — the ones that live in
- * the owning box's own `devices/<machine>/agents.yaml` and must never reach the
- * fleet-shared `agents.yaml`.
+ * the owning box's own `devices/<machine>/agents.yaml` and cannot be read or
+ * set for a peer. A fleet default may still live under
+ * `fleet.defaults.config` (the shared default layer); the peer restriction
+ * is about targeting another device, not about fleet policy.
  *
  * This is a ZERO-DEPENDENCY leaf on purpose. The authority is `CONFIG_KEYS` in
  * `lib/device-config.ts`, but that module imports `devices/config-migration.ts`,
@@ -14,4 +16,6 @@ export const MACHINE_LOCAL_YAML_KEYS = new Set([
     'browserRemoteControl', // browser.remote-control — a consent flag; syncing it is a leak
     'schedulerEnabled', // scheduler.enabled
     'daemonEnabled', // daemon.enabled
+    'tmuxEnabled', // tmux.enabled — whether an interactive run is tmux-wrapped on THIS box
+    'browserTaskIdleMinutes', // browser.task-idle-minutes — only THIS box's reaper reads it
 ]);

package/dist/lib/crabbox/lease.js

@@ -31,7 +31,7 @@
  */
 import { crabboxFind, crabboxList, crabboxStatusReady, crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop, poolReusableBoxes } from './cli.js';
 import * as yaml from 'yaml';
-import { buildCredentialScript, buildHomeFileWriteScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
+import { assertNoNativeOAuthTransfer, buildCredentialScript, buildHomeFileWriteScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
 import { LEASE_AGENT_MARKER, leasePhaseSentinel } from './progress.js';
 import { copySetupToBox } from './setup-copy.js';
 import { DEFAULT_CRABBOX_PROFILE } from './config.js';
@@ -262,6 +262,14 @@ function reapExpiredPoolStrays(opts, keepSlug) {
     return reaped;
 }
 export async function leaseAndRun(opts) {
+    // SING-1b, FAIL FAST: `buildBootstrapScript` below refuses to copy a native OAuth
+    // login (via `buildCredentialScript`), but that runs only AFTER a box has been
+    // leased — and a `--fresh` box would leak because the throw escapes the teardown
+    // `finally`. Refuse HERE, before any box is provisioned or paid for, mirroring how
+    // `--copy-creds` refuses before it opens an SSH connection.
+    assertNoNativeOAuthTransfer(opts.credentialRuntimes ?? opts.runtimes, opts.detected, {
+        claudeCredentialsJson: opts.claudeCredentialsJson,
+    });
     const startedAt = Date.now();
     let box;
     // A box this run did NOT provision — either the caller named it (`--box`) or

package/dist/lib/crabbox/runtimes.d.ts

@@ -26,6 +26,10 @@ interface RuntimeCred {
     remote: string;
 }
 export declare const LEASE_RUNTIMES: RuntimeCred[];
+/** True when `id` is a native OAuth / session login that MUST NOT be copied between devices (SING-1b). */
+export declare function isNativeOAuthRuntime(id: AgentId): boolean;
+/** The fail-loud message naming the forbidden runtimes and the portable path to use instead. */
+export declare function nativeOAuthTransferRefusal(nativeRuntimes: AgentId[]): string;
 export interface DetectedRuntime {
     id: AgentId;
     label: string;
@@ -96,15 +100,36 @@ export declare function resolveClaudeCredentialsBlob(opts?: {
     accountEmail?: (home: string) => Promise<string | null>;
 }): Promise<string | null>;
 /**
- * Build a bash snippet that writes each picked runtime's token file to the box's
- * home-level config path (0600), from the token contents read locally. Returns
- * `''` when no runtimes were selected. The snippet is meant to be embedded in
- * the `--script-stdin` body (never argv).
+ * The credential-provisioning snippet for a `--lease` box.
  *
- * `extras.claudeCredentialsJson` (the raw wrapped payload from
- * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
- * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
+ * Every runtime this could serialize is a native OAuth / session login
+ * (`LEASE_RUNTIMES`), and SING-1b forbids copying one to another device —
+ * including an ephemeral leased box, whose refresh of a shared rotating token
+ * invalidates every other holder. So this no longer writes a login: it REFUSES
+ * (throws, steering to the portable `agents accounts` path) whenever a picked
+ * runtime actually has a native credential to copy — signed in locally
+ * (`credPath`), or a Claude OAuth blob supplied. A picked runtime with nothing to
+ * copy is simply skipped, so `buildCredentialScript` returns `''` (a no-op box
+ * bootstrap) rather than throwing on a not-signed-in runtime.
  */
+/**
+ * The native OAuth runtimes among `picked` that actually have a credential to copy
+ * — signed in locally (`credPath`) or a Claude OAuth blob supplied — i.e. the ones
+ * a transfer would leak. A picked runtime with nothing to copy is not refused.
+ */
+export declare function refusedNativeOAuthRuntimes(picked: AgentId[], detected: DetectedRuntime[], extras?: {
+    claudeCredentialsJson?: string | null;
+}): AgentId[];
+/**
+ * Throw the SING-1b refusal if any picked runtime would transfer a native OAuth
+ * login. Callers should invoke this at a FAIL-FAST point — before any expensive or
+ * costly side effect (e.g. before `crabboxWarmup` leases a paid box) — so a refused
+ * `--lease` never leaks infra, mirroring how `--copy-creds` refuses before it opens
+ * an SSH connection.
+ */
+export declare function assertNoNativeOAuthTransfer(picked: AgentId[], detected: DetectedRuntime[], extras?: {
+    claudeCredentialsJson?: string | null;
+}): void;
 export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[], extras?: {
     claudeCredentialsJson?: string | null;
 }): string;

package/dist/lib/crabbox/runtimes.js

@@ -17,8 +17,8 @@ import * as path from 'path';
 import * as fs from 'fs';
 import { getAccountInfo } from '../agents.js';
 import { getKeychainToken } from '../secrets/index.js';
-import { getClaudeKeychainService } from '../usage.js';
-import { listInstalledVersions, getVersionHomePath } from '../versions.js';
+import { getClaudeKeychainService } from '../accounting/usage.js';
+import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
 import { readClaudeCredentialsBlob } from '../cloud/rush.js';
 export const LEASE_RUNTIMES = [
     { id: 'claude', label: 'Claude Code', localCandidates: ['.claude/.claude.json', '.claude.json'], remote: '.claude.json' },
@@ -26,6 +26,34 @@ export const LEASE_RUNTIMES = [
     { id: 'gemini', label: 'Gemini CLI', localCandidates: ['.gemini/google_accounts.json'], remote: '.gemini/google_accounts.json' },
     { id: 'grok', label: 'Grok CLI', localCandidates: ['.grok/auth.json'], remote: '.grok/auth.json' },
 ];
+/**
+ * Every runtime whose login this module can serialize (`LEASE_RUNTIMES`) is a
+ * native, rotating OAuth / session credential (Claude OAuth token, codex/grok
+ * `auth.json`, gemini `google_accounts.json`). The fleet-auth contract forbids
+ * copying any of them between devices — including to an ephemeral leased box —
+ * because a shared refresh token rotates server-side on the next refresh and
+ * invalidates every other copy (`docs/specifications.md` SING-1b,
+ * `docs/credential-management.md` invariant 2). The set is derived from
+ * `LEASE_RUNTIMES` so a newly-added runtime can never be silently exempted. This
+ * is the single canonical predicate; `--copy-creds` (`hosts/credentials.ts`) and
+ * `--lease` (this module's `buildCredentialScript`) both refuse against it.
+ */
+const NATIVE_OAUTH_RUNTIMES = new Set(LEASE_RUNTIMES.map((c) => c.id));
+/** True when `id` is a native OAuth / session login that MUST NOT be copied between devices (SING-1b). */
+export function isNativeOAuthRuntime(id) {
+    return NATIVE_OAUTH_RUNTIMES.has(id);
+}
+/** The fail-loud message naming the forbidden runtimes and the portable path to use instead. */
+export function nativeOAuthTransferRefusal(nativeRuntimes) {
+    return (`Refusing to copy native OAuth / session credentials to another device: ${nativeRuntimes.join(', ')}.\n` +
+        `A rotating harness login copied across machines is invalidated on its next server-side token ` +
+        `refresh — it logs the rest of the fleet out — so agents-cli never stores or transfers a harness's ` +
+        `interactive login (docs/specifications.md SING-1b).\n` +
+        `Use a portable provider account instead — a long-lived, non-rotating API key / setup-token that is ` +
+        `safe to reuse on many devices:\n` +
+        `    agents accounts add <name> --provider <provider> --auth <api-key|setup-token>\n` +
+        `    agents accounts sync <name> --device <host>`);
+}
 /** First existing candidate path under the real home, or null. */
 function findLocalCred(cred) {
     const home = process.env.AGENTS_REAL_HOME || os.homedir();
@@ -225,36 +253,50 @@ export async function resolveClaudeCredentialsBlob(opts) {
     return readClaudeCredentialsBlob(home);
 }
 /**
- * Build a bash snippet that writes each picked runtime's token file to the box's
- * home-level config path (0600), from the token contents read locally. Returns
- * `''` when no runtimes were selected. The snippet is meant to be embedded in
- * the `--script-stdin` body (never argv).
+ * The credential-provisioning snippet for a `--lease` box.
  *
- * `extras.claudeCredentialsJson` (the raw wrapped payload from
- * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
- * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
+ * Every runtime this could serialize is a native OAuth / session login
+ * (`LEASE_RUNTIMES`), and SING-1b forbids copying one to another device —
+ * including an ephemeral leased box, whose refresh of a shared rotating token
+ * invalidates every other holder. So this no longer writes a login: it REFUSES
+ * (throws, steering to the portable `agents accounts` path) whenever a picked
+ * runtime actually has a native credential to copy — signed in locally
+ * (`credPath`), or a Claude OAuth blob supplied. A picked runtime with nothing to
+ * copy is simply skipped, so `buildCredentialScript` returns `''` (a no-op box
+ * bootstrap) rather than throwing on a not-signed-in runtime.
  */
-export function buildCredentialScript(picked, detected, extras) {
+/**
+ * The native OAuth runtimes among `picked` that actually have a credential to copy
+ * — signed in locally (`credPath`) or a Claude OAuth blob supplied — i.e. the ones
+ * a transfer would leak. A picked runtime with nothing to copy is not refused.
+ */
+export function refusedNativeOAuthRuntimes(picked, detected, extras) {
     const byId = new Map(detected.map((d) => [d.id, d]));
-    const parts = [];
-    for (const id of picked) {
-        const d = byId.get(id);
-        const cred = LEASE_RUNTIMES.find((c) => c.id === id);
-        if (!d?.credPath || !cred)
-            continue;
-        let contents;
-        try {
-            contents = fs.readFileSync(d.credPath, 'utf-8');
-        }
-        catch {
-            continue;
-        }
-        parts.push(buildHomeFileWriteScript(cred.remote, contents));
-        // For claude the file above is config/state only; the OAuth token is a
-        // second artifact — without it the box comes up "Not logged in".
-        if (id === 'claude' && extras?.claudeCredentialsJson) {
-            parts.push(buildHomeFileWriteScript(CLAUDE_TOKEN_REMOTE, extras.claudeCredentialsJson));
-        }
+    return picked.filter((id) => {
+        if (!isNativeOAuthRuntime(id))
+            return false;
+        const hasLocalFile = !!byId.get(id)?.credPath && LEASE_RUNTIMES.some((c) => c.id === id);
+        const hasClaudeToken = id === 'claude' && !!extras?.claudeCredentialsJson;
+        return hasLocalFile || hasClaudeToken;
+    });
+}
+/**
+ * Throw the SING-1b refusal if any picked runtime would transfer a native OAuth
+ * login. Callers should invoke this at a FAIL-FAST point — before any expensive or
+ * costly side effect (e.g. before `crabboxWarmup` leases a paid box) — so a refused
+ * `--lease` never leaks infra, mirroring how `--copy-creds` refuses before it opens
+ * an SSH connection.
+ */
+export function assertNoNativeOAuthTransfer(picked, detected, extras) {
+    const refused = refusedNativeOAuthRuntimes(picked, detected, extras);
+    if (refused.length > 0) {
+        throw new Error(nativeOAuthTransferRefusal(refused));
     }
-    return parts.join('\n');
+}
+export function buildCredentialScript(picked, detected, extras) {
+    assertNoNativeOAuthTransfer(picked, detected, extras);
+    // Past the refusal there is nothing to serialize — every runtime this handles is
+    // native OAuth, so a non-refused set has no credential to copy. (Always '' today;
+    // the shape stays general in case a non-native runtime is ever added.)
+    return '';
 }