@phnx-labs/agents-cli 1.22.38 → 1.22.40

package/dist/lib/exec.js

@@ -10,11 +10,11 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { ALL_MODES } from './types.js';
 import { AGENTS, findInPath } from './agents.js';
-import { parseTimeout } from './routines.js';
-import { compareVersions, getBinaryPath, getVersionHomePath, isVersionInstalled, listInstalledVersions, resolveVersion } from './versions.js';
+import { parseTimeout } from './scheduling/routines.js';
+import { compareVersions, getBinaryPath, getVersionHomePath, isVersionInstalled, listInstalledVersions, resolveVersion } from './installations/versions.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { isTierToken, resolveTier } from './model-tiers.js';
-import { createTimer, redactPrompt, redactArgs } from './events.js';
+import { createTimer, redactPrompt, redactArgs } from './feed/events.js';
 import { sanitizeProcessEnv } from './secrets/bundles.js';
 import { resolveActor, actorEnv } from './actor.js';
 import { expandLocalHome } from './project-root.js';
@@ -29,6 +29,8 @@ import { recordRunName } from './session/run-names.js';
 import { mailboxDir, isValidMailboxId } from './mailbox.js';
 import { composeWin32CommandLine } from './platform/index.js';
 import { isTmuxInstalled } from './tmux/binary.js';
+import { isTmuxEnabled } from './device-config.js';
+import { machineId } from './machine-id.js';
 import { shellQuote } from './ssh-exec.js';
 import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
@@ -257,10 +259,10 @@ export function parseExecEnv(entries) {
  * alongside the agent's real session id (terminals/sessions/<pid>.json), so it
  * is what maps a launch to its exact session even when the hook runs under a
  * different pid (tmux pane leaf / cmd.exe wrapper) — and, across an SSH hop, what
- * lets a `--host` launcher resolve the remote-coined id for agents that never
+ * lets a `--device` launcher resolve the remote-coined id for agents that never
  * accept a forced `--session-id`.
  *
- * ADOPT a caller-supplied `AGENT_LAUNCH_ID` (a `--host` launcher forwards one via
+ * ADOPT a caller-supplied `AGENT_LAUNCH_ID` (a `--device` launcher forwards one via
  * `--env` so it controls the key end-to-end); MINT a fresh one otherwise (every
  * local run, which passes none). A malformed inbound value is ignored in favour
  * of a fresh mint — the key must be a real correlation id, never an empty string.
@@ -471,7 +473,7 @@ export function buildExecEnv(options) {
     // (events.ts::resolveProvenance) reads AGENTS_PARENT_SESSION_ID and stamps it on
     // every event the child emits. `options.sessionId` is the CHILD's id, so read the
     // spawner from the live env; guard a same-session resume from naming itself parent.
-    // Local-spawn scope here; forwarding it across the `--host` SSH hop is Phase 4.
+    // Local-spawn scope here; forwarding it across the `--device` SSH hop is Phase 4.
     const spawnerSessionId = process.env.AGENTS_SESSION_ID || process.env.AGENT_SESSION_ID;
     if (spawnerSessionId && spawnerSessionId !== options.sessionId) {
         result.AGENTS_PARENT_SESSION_ID = spawnerSessionId;
@@ -1292,7 +1294,7 @@ export function shouldRecapDeadPane(status, interactive) {
  * Why this is not `status ?? 0`: an interactive run whose tmux server died mid-
  * work landed on exactly those unknown branches and returned 0, so `agents run`
  * printed a failure banner while handing its caller a success code. The same
- * "1 if unknown" rule already governs the `--host` follow path
+ * "1 if unknown" rule already governs the `--device` follow path
  * (`docs/specifications.md` §Agent execution, exit-code table).
  *
  * @param pane       What `paneExitStatus` read back for the agent pane.
@@ -1327,12 +1329,13 @@ export function isPaneKnownAliveFromQueryResult(code, stdout) {
  * focus` re-attach a live session without forking it. Pure so the gate is unit-
  * tested independently of the (side-effecting) spawn.
  *
- * All five guards must pass:
+ * All seven guards must pass:
  *   - interactive     — a headless `-p` run has no TTY to attach; keep bare spawn.
  *   - not Windows     — no tmux path on win32.
  *   - not already in tmux — nesting tmux-in-tmux is pointless and confusing.
  *   - not --raw       — explicit opt-out.
  *   - not AGENTS_NO_TMUX=1 — env opt-out (CI, scripts, the shim passthrough path).
+ *   - tmux.enabled    — this device's durable opt-out, for a box whose tmux is broken.
  *   - tmux installed  — otherwise there is nothing to wrap with.
  */
 export function shouldWrapInTmux(ctx) {
@@ -1346,6 +1349,8 @@ export function shouldWrapInTmux(ctx) {
         return false;
     if (ctx.noTmuxEnv)
         return false;
+    if (!ctx.configEnabled)
+        return false;
     if (!ctx.tmuxAvailable)
         return false;
     return true;
@@ -1459,7 +1464,7 @@ async function runInTmux(options, executable, args) {
     const idSeed = (options.sessionId ?? randomUUID()).slice(0, 8);
     const name = slugifyName(`ag-${options.agent}-${idSeed}`);
     const RED = '\x1b[31m', GRAY = '\x1b[90m', OFF = '\x1b[0m';
-    const NO_TMUX_TIP = `${GRAY}  Tip: re-run with --no-tmux to launch the agent directly and see its full output.${OFF}\n\n`;
+    const NO_TMUX_TIP = `${GRAY}  Tip: re-run with --no-tmux to launch the agent directly and see its full output.\n  If tmux is broken on this machine, turn the wrap off for good: agents config set devices.${machineId()}.tmux off${OFF}\n\n`;
     // Recap a dead pane's tail into THIS shell's stderr. The pane-died hook
     // detaches the client the instant the agent exits, so a fast failure (a
     // gutted install that dies with ENOENT, a bad flag, a crash on startup) would
@@ -1530,7 +1535,7 @@ async function runInTmux(options, executable, args) {
         // agent finished or was killed. MUST NOT be reported as success: a caller
         // scripting `agents run` would count a run killed mid-work as a clean
         // finish. Tear down so no orphan session is left, say so, and exit non-zero
-        // — the same "1 if unknown" rule the `--host` follow path already uses.
+        // — the same "1 if unknown" rule the `--device` follow path already uses.
         await killSession(name, socket).catch(() => { });
         // One computation feeds both the banner and the return value — printing a
         // code the caller does not receive is the same defect in miniature.
@@ -1658,7 +1663,7 @@ async function runInTmux(options, executable, args) {
     return resolveAfterAttach(pane);
 }
 /**
- * Print the run's resolved session id as a one-line stdout sentinel so a `--host`
+ * Print the run's resolved session id as a one-line stdout sentinel so a `--device`
  * launcher can relate the remote-created session back to itself (see the
  * `emitSessionId` option and hosts/session-marker.ts).
  *
@@ -1731,7 +1736,7 @@ async function spawnAgent(options) {
     // That id is the join key that reconciles this launch's pid-registry entry
     // with the hook's authoritative session id even when the hook runs under a
     // different pid (tmux pane leaf / cmd.exe wrapper) — see pid-registry.ts and
-    // session/hook-sessions.ts. ADOPT a launch id a `--host` launcher already
+    // session/hook-sessions.ts. ADOPT a launch id a `--device` launcher already
     // forwarded (via `--env AGENT_LAUNCH_ID=…`) so ONE correlation key spans the
     // SSH hop and the launcher can resolve this run's real session id for every
     // agent, not just Claude (RUSH-2034); mint a fresh one for every local run.
@@ -1766,6 +1771,7 @@ async function spawnAgent(options) {
         inTmux: !!process.env.TMUX,
         raw: options.raw === true,
         noTmuxEnv: process.env.AGENTS_NO_TMUX === '1',
+        configEnabled: isTmuxEnabled(),
         tmuxAvailable: isTmuxInstalled(),
     })) {
         timer.mark('startup');
@@ -1913,7 +1919,7 @@ async function spawnAgent(options) {
             // Budget kill resolves with a DISTINCT non-zero exit so CI/headless and
             // teams/cloud can tell a budget termination apart from a normal failure.
             const exitCode = budgetKilled ? BUDGET_KILL_EXIT_CODE : (code ?? 0);
-            // Relate the session id back to a `--host` launcher (see the emitSessionId
+            // Relate the session id back to a `--device` launcher (see the emitSessionId
             // doc). Claude's id is the one we forced; every other agent coined its own,
             // which the SessionStart hook recorded under this run's launchId — resolve
             // and print it as a one-line sentinel that rides the followed log home.

package/dist/lib/factory/snapshot.d.ts

@@ -1,5 +1,5 @@
 import { type ActiveSession } from '../session/active.js';
-import { serializeActiveSessionsForJson } from '../../commands/sessions.js';
+import { serializeActiveSessionsForJson } from '../session/active.js';
 import { readAuthHealthCache, type AuthVerdict } from '../auth-health.js';
 import { readStatsCache } from '../devices/stats-cache.js';
 export declare const FACTORY_PROJECTS: readonly [{

package/dist/lib/factory/snapshot.js

@@ -17,7 +17,7 @@ import { execFile as execFileCallback } from 'child_process';
 import { promisify } from 'util';
 import * as yaml from 'yaml';
 import { getActiveSessions } from '../session/active.js';
-import { serializeActiveSessionsForJson } from '../../commands/sessions.js';
+import { serializeActiveSessionsForJson } from '../session/active.js';
 import { readAuthHealthCache } from '../auth-health.js';
 import { readStatsCache } from '../devices/stats-cache.js';
 const execFile = promisify(execFileCallback);

package/dist/lib/{activity.d.ts → feed/activity.d.ts}

@@ -1,4 +1,4 @@
-import type { ActorKind } from './actor.js';
+import type { ActorKind } from '../actor.js';
 import type { EventRecord } from './events.js';
 /** Recognizable milestone events, ordered first in any activity lane. */
 export type MilestoneEvent = 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created'

package/dist/lib/{activity.js → feed/activity.js}

@@ -20,14 +20,14 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
-import { stringifyDoc } from './yaml-io.js';
+import { stringifyDoc } from '../yaml-io.js';
 import chalk from 'chalk';
-import { relTime, truncate } from './format.js';
-import { getActivityDir, getUserAgentsDir } from './state.js';
-import { normalizeHost } from './machine-id.js';
-import { projectKeyFromCwd } from './project-key.js';
-import { stampProvenance } from './event-provenance.js';
-import { pythonToolRegistryLiteral, pythonValueFlagsLiteral, } from './session/bash-command.js';
+import { relTime, truncate } from '../format.js';
+import { getActivityDir, getUserAgentsDir } from '../state.js';
+import { normalizeHost } from '../machine-id.js';
+import { projectKeyFromCwd } from '../project-key.js';
+import { stampProvenance } from '../event-provenance.js';
+import { pythonToolRegistryLiteral, pythonValueFlagsLiteral, } from '../session/bash-command.js';
 /** The set of milestone events, for tier classification and ordering. */
 export const MILESTONE_EVENTS = [
     'plan.created',

package/dist/lib/{events.d.ts → feed/events.d.ts}

@@ -11,9 +11,9 @@
  * - Permissions: logs dir is 0700, files are 0600 (owner-only)
  * - Performance tracking: withTiming() wrapper for any async function
  */
-import type { ActorKind } from './actor.js';
+import type { ActorKind } from '../actor.js';
 export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'run.dispatched' | 'daemon.start' | 'daemon.stop' | 'daemon.error' | 'daemon.info' | 'routine.start' | 'routine.end' | 'watchdog.action' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'run.dispatched' | 'daemon.start' | 'daemon.stop' | 'daemon.error' | 'daemon.info' | 'routine.start' | 'routine.end' | 'watchdog.action' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'computer.action' | 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'webhook.received' | 'webhook.authorized' | 'webhook.rejected' | 'webhook.matched' | 'webhook.fired' | 'webhook.failed' | 'webhook.handler.start' | 'webhook.handler.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'factory.command' | 'factory.action' | 'factory.uri' | 'factory.launch' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
 /** Every known event kind. Derived from {@link EVENT_TYPE_TABLE}, never hand-listed. */
 export declare const EVENT_TYPES: readonly EventType[];
 /** Runtime guard for an event kind arriving from outside this process. */

package/dist/lib/{events.js → feed/events.js}

@@ -16,14 +16,14 @@ import * as path from 'path';
 import * as os from 'os';
 import { createHash } from 'node:crypto';
 import { gzipSync, gunzipSync } from 'node:zlib';
-import { ensureLockTarget, withFileLock } from './fs-atomic.js';
-import { getUserAgentsDir } from './state.js';
-import { stampProvenance, resetEventProvenanceForTest } from './event-provenance.js';
+import { ensureLockTarget, withFileLock } from '../fs-atomic.js';
+import { getUserAgentsDir } from '../state.js';
+import { stampProvenance, resetEventProvenanceForTest } from '../event-provenance.js';
 /** Lazy perf warehouse write — avoids a hard cycle at module load. */
 function recordPerfTiming(payload) {
     try {
         // Dynamic import keeps events.ts free of a load-time dependency on perf/db.
-        void import('./perf/spool.js').then(({ recordSample }) => {
+        void import('../perf/spool.js').then(({ recordSample }) => {
             recordSample({
                 kind: 'perf.timing',
                 label: payload.label,
@@ -128,7 +128,7 @@ const EVENT_TYPE_TABLE = {
     'perf.timing': true,
     'session.start': true, 'session.end': true,
     'webhook.received': true, 'webhook.authorized': true, 'webhook.rejected': true, 'webhook.matched': true,
-    'webhook.fired': true, 'webhook.handler.start': true, 'webhook.handler.end': true,
+    'webhook.fired': true, 'webhook.failed': true, 'webhook.handler.start': true, 'webhook.handler.end': true,
     'plan.created': true, 'pr.opened': true, 'pr.merged': true, 'worktree.created': true,
     'worktree.removed': true, 'commit.created': true, 'pushed': true, 'subagent.spawned': true,
     'artifact.created': true, 'task.completed': true, 'checklist.created': true, 'status.posted': true,

package/dist/lib/{feed.js → feed/feed.js}

@@ -24,10 +24,10 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
-import { stringifyDoc } from './yaml-io.js';
-import { getFeedDir, getUserAgentsDir } from './state.js';
-import { isAdmin, isHighConsequenceAllowed, isKnownOperator } from './operator.js';
-import { projectKeyFromCwd } from './project-key.js';
+import { stringifyDoc } from '../yaml-io.js';
+import { getFeedDir, getUserAgentsDir } from '../state.js';
+import { isAdmin, isHighConsequenceAllowed, isKnownOperator } from '../operator.js';
+import { projectKeyFromCwd } from '../project-key.js';
 /**
  * Stable block id for a session. One block per session -- a new question
  * replaces the previous one (the agent can only ask one question at a time).

package/dist/lib/feed-outcome.d.ts

@@ -1,4 +1,4 @@
-import type { OpenBlock } from './feed.js';
+import type { OpenBlock } from './feed/feed.js';
 export type OutcomeKind = 'ticket' | 'pr' | 'worktree' | 'unassigned';
 /** Stable attribution of a block (or agent) to one deliverable. */
 export interface OutcomeRef {

package/dist/lib/feed-policy.d.ts

@@ -1,4 +1,4 @@
-import { type OpenBlock, type AnswerRecord } from './feed.js';
+import { type OpenBlock, type AnswerRecord } from './feed/feed.js';
 export type BlockClass = 'approval' | 'decision';
 export interface ClassPolicy {
     timeoutMinutes: number;

package/dist/lib/feed-policy.js

@@ -16,7 +16,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { getUserAgentsDir } from './state.js';
-import { recordAnswer, recordDefaulted, recordMessageReceipt, recordParked, } from './feed.js';
+import { recordAnswer, recordDefaulted, recordMessageReceipt, recordParked, } from './feed/feed.js';
 import { enqueue, mailboxDir } from './mailbox.js';
 const POLICY_FILE = 'feed-policy.yaml';
 const COST_RANK = { low: 0, medium: 1, high: 2 };

package/dist/lib/feed-post.d.ts

@@ -1,4 +1,4 @@
-import { type ActivityEvent, type Attachment } from './activity.js';
+import { type ActivityEvent, type Attachment } from './feed/activity.js';
 import { type PidSessionEntry } from './session/pid-registry.js';
 /** Soft cap so a runaway agent can't flood the activity lane with essays. */
 export declare const STATUS_POST_MAX_CHARS = 500;

package/dist/lib/feed-post.js

@@ -16,7 +16,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { spawnSync } from 'child_process';
-import { appendActivityEvent, readRecentActivity, } from './activity.js';
+import { appendActivityEvent, readRecentActivity, } from './feed/activity.js';
 import { resolveProjectNameForCwd, listProjectDefs } from './projects.js';
 import { getHistoryDir } from './state.js';
 import { machineId } from './machine-id.js';

package/dist/lib/feed-ranking.d.ts

@@ -1,4 +1,4 @@
-import type { OpenBlock, FeedAskStats } from './feed.js';
+import type { OpenBlock, FeedAskStats } from './feed/feed.js';
 import type { Classification } from './ask-classifier.js';
 import type { ActiveSession } from './session/active.js';
 import type { SessionMeta } from './session/types.js';

package/dist/lib/fleet/apply.d.ts

@@ -45,12 +45,6 @@ export interface SourceAuth {
     /** The captured file payloads, keyed by agent. */
     filesByAgent: Map<string, AuthFilePayload[]>;
 }
-/**
- * Can we propagate `agent`'s login to a target on `targetPlatform`? False when
- * the agent has no portable file, the source can't provide it (bound / not
- * signed in), or the target consumes credentials from its own keychain.
- */
-export declare function canPushLogin(agent: string, targetPlatform: string | undefined, src: SourceAuth): boolean;
 export interface DiffContext {
     /** agents-cli version the source is on — the fleet target version. */
     targetCliVersion: string;

package/dist/lib/fleet/apply.js

@@ -13,7 +13,7 @@ import { deviceIdentityArgs, sshTargetFor } from '../devices/connect.js';
 import { readyProbe, bootstrapAgentsCli } from '../hosts/ready.js';
 import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
 import { sshExec } from '../ssh-exec.js';
-import { isPropagatableAgent, hasPortableAuthFiles, isCredentialSafeToPropagate, KEYCHAIN_BOUND_ON_MAC, buildAuthBundle, } from './auth-sync.js';
+import { hasPortableAuthFiles } from './auth-sync.js';
 /** Strip a version suffix from an agent spec: `claude@latest` -> `claude`. */
 export function agentIdOf(spec) {
     return spec.split('@')[0].trim();
@@ -88,20 +88,6 @@ export function parseInstalledVersions(stdout) {
         return undefined;
     }
 }
-/**
- * Can we propagate `agent`'s login to a target on `targetPlatform`? False when
- * the agent has no portable file, the source can't provide it (bound / not
- * signed in), or the target consumes credentials from its own keychain.
- */
-export function canPushLogin(agent, targetPlatform, src) {
-    if (!isPropagatableAgent(agent))
-        return false;
-    if (src.bound.has(agent))
-        return false;
-    if (targetPlatform === 'macos' && KEYCHAIN_BOUND_ON_MAC.has(agent))
-        return false;
-    return src.available.has(agent);
-}
 /** Pure: desired vs probed -> per-device diff + flat action list. */
 export function diffFleet(desired, probes, ctx) {
     const devices = [];
@@ -143,28 +129,24 @@ export function diffFleet(desired, probes, ctx) {
                 rowActions.push({ device: d.device, kind: 'sync-config', detail: `sync config (${d.sync.join(', ')})` });
             }
             // login — per agent id, not per spec: `claude@all` names one id many times,
-            // but login propagates once per agent (its credential is version-shared).
+            // but a login is established once per agent (its credential is version-shared).
             if (d.login === 'sync') {
                 for (const id of [...new Set(d.agents.map(agentIdOf))]) {
-                    if (canPushLogin(id, probe.platform, ctx.sourceAuth)) {
-                        rowActions.push({ device: d.device, kind: 'push-login', agent: id, detail: `propagate ${id} login` });
-                    }
-                    else if (hasPortableAuthFiles(id) && !isCredentialSafeToPropagate(id)) {
-                        // Single-use rotating refresh tokens (e.g. droid/WorkOS) must never be
-                        // copied across boxes — the first refresh invalidates every other copy.
-                        // Surface per-machine login guidance instead of silently propagating.
-                        loginBlocked.push(id);
-                        rowActions.push({ device: d.device, kind: 'needs-login', agent: id, detail: `${id} login uses a single-use rotating refresh token — log in on ${d.device} itself` });
-                    }
-                    else if (isPropagatableAgent(id) &&
-                        (ctx.sourceAuth.bound.has(id) || (probe.platform === 'macos' && KEYCHAIN_BOUND_ON_MAC.has(id)))) {
-                        // A login-propagation candidate we still can't push: the source token
-                        // is keychain-bound (unextractable), or the macOS target consumes its
-                        // own keychain. Surface those as manual — don't fake. Agents that were
-                        // never propagation candidates (no portable file), or a source that
-                        // simply isn't signed in, are silently skipped the same on every OS.
+                    // SING-1b: a native OAuth / session login MUST NOT be copied between
+                    // devices — a rotating token invalidates the fleet on its next refresh
+                    // (droid/WorkOS collapsed 10 boxes to 1 overnight). `apply` therefore no
+                    // longer propagates any login; it surfaces per-box login / portable
+                    // provider-account guidance for every agent that has a login to
+                    // establish. An agent with no portable login file, or a source that
+                    // isn't signed in, is silently skipped the same on every OS.
+                    if (hasPortableAuthFiles(id)) {
                         loginBlocked.push(id);
-                        rowActions.push({ device: d.device, kind: 'needs-login', agent: id, detail: `${id} needs a manual login` });
+                        rowActions.push({
+                            device: d.device,
+                            kind: 'needs-login',
+                            agent: id,
+                            detail: `${id}: a native OAuth login can't be copied between devices (SING-1b) — log in on ${d.device} itself, or sync a portable provider account (agents accounts sync)`,
+                        });
                     }
                 }
             }
@@ -414,17 +396,8 @@ export function reconcileDevice(row, device, ctx) {
         steps.push({ kind: 'sync-config', ok: syncOk, detail: `sync config (${row.desired.sync.join(', ') || 'default'})` });
         ok = ok && syncOk;
     }
-    // 4. login propagation — one bundle for all pushable agents on this device.
-    const pushAgents = [...new Set(row.actions.filter((a) => a.kind === 'push-login').map((a) => a.agent))];
-    if (pushAgents.length > 0) {
-        const files = [];
-        for (const agent of pushAgents)
-            files.push(...(ctx.sourceAuth.filesByAgent.get(agent) ?? []));
-        const bundle = buildAuthBundle(ctx.source, files);
-        const r = sshAgents(['apply', '--recv-auth'], JSON.stringify(bundle));
-        steps.push({ kind: 'push-login', ok: r.code === 0, detail: `propagate login: ${pushAgents.join(', ')}` });
-        ok = ok && r.code === 0;
-    }
+    // 4. Native login materialization does not exist. Every agent that needs a login is surfaced as
+    // `needs-login` (per-box login / portable-account guidance) in the diff above.
     // 5. secrets provisioning — LAST, and deliberately so. It is the most
     // sensitive mutation apply performs (credential VALUES crossing to another
     // machine), so every lower-risk step above is already recorded before we

package/dist/lib/fleet/auth-sync.d.ts

@@ -1,19 +1,13 @@
 /**
- * Login/token propagation — the "one login instead of ~48 OAuth flows" core of
- * `agents apply`.
- *
- * A source machine that is already signed in to a set of harnesses has portable
- * credential files on disk (verified per-agent locations below). `snapshotAuth`
- * captures those; `materializeAuth` writes them into the corresponding paths on
- * a target device. Transport is the caller's job — `apply` streams the bundle
- * over the existing (encrypted, authenticated) SSH channel via `sshExec`'s
- * stdin `input`, so no app-layer crypto is layered on top of SSH here.
+ * Native-login inventory for `agents apply` and `agents fleet login`.
+ * Native OAuth/session files are identified only to report device readiness;
+ * agents-cli never serializes or materializes them on another device.
  *
  * Honest boundary: on macOS, claude and antigravity keep their tokens in the
  * login keychain, ACL-bound to the harness process — unreadable by us. Those are
  * classified `bound` and surfaced for a one-time manual login, never faked.
  */
-import type { AuthFilePayload, AuthBundle, AuthSnapshotResult } from './types.js';
+import type { AuthSnapshotResult } from './types.js';
 /** A portable credential file location, relative to $HOME. */
 interface AuthFileSpec {
     rel: string;
@@ -37,10 +31,18 @@ export declare const KEYCHAIN_BOUND_ON_MAC: ReadonlySet<string>;
  * made. See also `remote-login.ts` and `usage.ts` for the per-machine-login policy.
  */
 export declare const SINGLE_USE_ROTATING_REFRESH_AGENTS: ReadonlySet<string>;
-/** True when `agent`'s portable credential file(s) are safe to copy between
- *  machines. Single-use rotating refresh tokens are never safe; keychain-bound
- *  tokens are handled separately by the caller via {@link KEYCHAIN_BOUND_ON_MAC}. */
-export declare function isCredentialSafeToPropagate(agent: string): boolean;
+/**
+ * Whether `agent`'s login may be copied between machines by `apply`. Always
+ * **false** now (RUSH-2527): every `FLEET_AUTH_FILES` entry is a native,
+ * rotating OAuth / session login, and the fleet-auth contract forbids copying any
+ * of them between devices (`docs/specifications.md` SING-1b) — not just the
+ * single-use-rotating subset (`SINGLE_USE_ROTATING_REFRESH_AGENTS`) that first
+ * motivated this gate. `apply` therefore never propagates a login; it surfaces
+ * per-box login / portable-account guidance instead. `snapshotAuth` reads no
+ * credential file as a result, so a native login never leaves its origin box.
+ * The `agent` parameter is retained for the stable call signature.
+ */
+export declare function isCredentialSafeToPropagate(_agent: string): boolean;
 /** True when the agent stores credentials in portable files we can read. This
  *  does NOT mean it is safe to propagate — check {@link isCredentialSafeToPropagate}. */
 export declare function hasPortableAuthFiles(agent: string): boolean;
@@ -113,25 +115,4 @@ export interface SnapshotOptions {
  * propagate, not an error.
  */
 export declare function snapshotAuth(agents: string[], opts: SnapshotOptions): AuthSnapshotResult;
-/** Assemble the plaintext bundle shipped to a target. */
-export declare function buildAuthBundle(source: string, files: AuthFilePayload[]): AuthBundle;
-export interface MaterializeOptions {
-    /** Home directory to write credential files into. */
-    home: string;
-}
-export interface MaterializeResult {
-    /** Agent ids that received at least one file. */
-    written: string[];
-    /** `rel: reason` for any file that failed. */
-    errors: string[];
-}
-/**
- * Write a captured auth bundle into a target home. Parent dirs are created; the
- * captured POSIX mode is restored (0600 for credentials). Writing through an
- * existing symlink lands in the agent's active version home, which is exactly
- * what per-version credential carry-forward expects.
- */
-export declare function materializeAuth(bundle: AuthBundle, opts: MaterializeOptions): MaterializeResult;
-/** Parse + validate a bundle received on stdin (the remote `--_recv-auth` path). */
-export declare function parseAuthBundle(raw: string): AuthBundle;
 export {};

package/dist/lib/fleet/auth-sync.js

@@ -1,13 +1,7 @@
 /**
- * Login/token propagation — the "one login instead of ~48 OAuth flows" core of
- * `agents apply`.
- *
- * A source machine that is already signed in to a set of harnesses has portable
- * credential files on disk (verified per-agent locations below). `snapshotAuth`
- * captures those; `materializeAuth` writes them into the corresponding paths on
- * a target device. Transport is the caller's job — `apply` streams the bundle
- * over the existing (encrypted, authenticated) SSH channel via `sshExec`'s
- * stdin `input`, so no app-layer crypto is layered on top of SSH here.
+ * Native-login inventory for `agents apply` and `agents fleet login`.
+ * Native OAuth/session files are identified only to report device readiness;
+ * agents-cli never serializes or materializes them on another device.
  *
  * Honest boundary: on macOS, claude and antigravity keep their tokens in the
  * login keychain, ACL-bound to the harness process — unreadable by us. Those are
@@ -44,11 +38,19 @@ export const KEYCHAIN_BOUND_ON_MAC = new Set(['claude', 'antigravity']);
  * made. See also `remote-login.ts` and `usage.ts` for the per-machine-login policy.
  */
 export const SINGLE_USE_ROTATING_REFRESH_AGENTS = new Set(['droid']);
-/** True when `agent`'s portable credential file(s) are safe to copy between
- *  machines. Single-use rotating refresh tokens are never safe; keychain-bound
- *  tokens are handled separately by the caller via {@link KEYCHAIN_BOUND_ON_MAC}. */
-export function isCredentialSafeToPropagate(agent) {
-    return !SINGLE_USE_ROTATING_REFRESH_AGENTS.has(agent);
+/**
+ * Whether `agent`'s login may be copied between machines by `apply`. Always
+ * **false** now (RUSH-2527): every `FLEET_AUTH_FILES` entry is a native,
+ * rotating OAuth / session login, and the fleet-auth contract forbids copying any
+ * of them between devices (`docs/specifications.md` SING-1b) — not just the
+ * single-use-rotating subset (`SINGLE_USE_ROTATING_REFRESH_AGENTS`) that first
+ * motivated this gate. `apply` therefore never propagates a login; it surfaces
+ * per-box login / portable-account guidance instead. `snapshotAuth` reads no
+ * credential file as a result, so a native login never leaves its origin box.
+ * The `agent` parameter is retained for the stable call signature.
+ */
+export function isCredentialSafeToPropagate(_agent) {
+    return false;
 }
 /** True when the agent stores credentials in portable files we can read. This
  *  does NOT mean it is safe to propagate — check {@link isCredentialSafeToPropagate}. */
@@ -185,64 +187,3 @@ export function snapshotAuth(agents, opts) {
     }
     return { files, bound };
 }
-/** Assemble the plaintext bundle shipped to a target. */
-export function buildAuthBundle(source, files) {
-    return { v: 1, source, files };
-}
-/**
- * Write a captured auth bundle into a target home. Parent dirs are created; the
- * captured POSIX mode is restored (0600 for credentials). Writing through an
- * existing symlink lands in the agent's active version home, which is exactly
- * what per-version credential carry-forward expects.
- */
-export function materializeAuth(bundle, opts) {
-    const written = new Set();
-    const errors = [];
-    for (const f of bundle.files) {
-        const abs = path.join(opts.home, f.rel);
-        try {
-            fs.mkdirSync(path.dirname(abs), { recursive: true });
-            fs.writeFileSync(abs, Buffer.from(f.contentB64, 'base64'));
-            fs.chmodSync(abs, f.mode || 0o600);
-            written.add(f.agent);
-        }
-        catch (e) {
-            errors.push(`${f.rel}: ${e.message}`);
-        }
-    }
-    return { written: [...written], errors };
-}
-/** Parse + validate a bundle received on stdin (the remote `--_recv-auth` path). */
-export function parseAuthBundle(raw) {
-    let doc;
-    try {
-        doc = JSON.parse(raw);
-    }
-    catch (e) {
-        throw new Error(`auth bundle is not valid JSON: ${e.message}`);
-    }
-    if (typeof doc !== 'object' || doc === null)
-        throw new Error('auth bundle must be an object.');
-    const o = doc;
-    if (o.v !== 1)
-        throw new Error(`unsupported auth bundle version ${JSON.stringify(o.v)}.`);
-    if (typeof o.source !== 'string')
-        throw new Error('auth bundle missing source.');
-    if (!Array.isArray(o.files))
-        throw new Error('auth bundle missing files[].');
-    for (const f of o.files) {
-        if (typeof f !== 'object' || f === null ||
-            typeof f.agent !== 'string' ||
-            typeof f.rel !== 'string' ||
-            typeof f.contentB64 !== 'string' ||
-            typeof f.mode !== 'number') {
-            throw new Error('auth bundle has a malformed file entry.');
-        }
-        // Reject path traversal — rel must stay under $HOME.
-        const rel = f.rel;
-        if (rel.startsWith('/') || rel.split('/').includes('..')) {
-            throw new Error(`auth bundle rejected unsafe path: ${rel}`);
-        }
-    }
-    return doc;
-}

package/dist/lib/fleet/capture.js

@@ -28,12 +28,11 @@ export function captureFleet(prev, inputs) {
     // when the manifest didn't already pin one for that device.
     //
     // A device absent from `inputs.devices` drops OUT of the roster — that is the
-    // intended "live state is the source of truth for WHICH devices exist". But
-    // `fleet.devices.<name>.config` is also the operator-config store, and a
-    // capture run from a box whose registry has not seen a peer would silently
-    // erase that peer's settings. Observed for real: capturing on yosemite-s0
-    // deleted zion's whole config block from the shared agents.yaml. So carry a
-    // dropped device's `config:` forward — config only, never its roster fields.
+    // intended "live state is the source of truth for WHICH devices exist". A
+    // leftover `config:` on an override is the LEGACY #2458 store (folded into
+    // per-device docs by migrateDeviceConfigStores). Carry it forward so a
+    // capture from a box that has not seen a peer cannot re-strip a not-yet-
+    // migrated peer's settings. Config only, never its roster fields.
     const devices = {};
     for (const [name, prevOverride] of Object.entries(prevDevices)) {
         if (inputs.devices.includes(name))
@@ -56,6 +55,9 @@ export function captureFleet(prev, inputs) {
         defaults: prev?.defaults ?? inputs.defaults ?? {},
         devices,
     };
+    if (prev?.discovery && Object.keys(prev.discovery).length > 0) {
+        manifest.discovery = { ...prev.discovery };
+    }
     const bundles = inputs.secretsBundles ?? prev?.secrets?.bundles;
     if (bundles && bundles.length > 0)
         manifest.secrets = { bundles: [...bundles].sort() };