@phnx-labs/agents-cli 1.22.39 → 1.22.40

package/dist/lib/friction-heuristics.d.ts

@@ -6,7 +6,7 @@
  * yet. This is a starting point: one detector for the most actionable pattern,
  * an agent stuck retrying the SAME denied action instead of adapting.
  */
-import type { EventRecord } from './events.js';
+import type { EventRecord } from './feed/events.js';
 export interface RepeatedGuardBlockFinding {
     /** Session id the repeated blocks happened in, or 'unknown' when the
      *  friction event carried no session (e.g. a guard fired outside any

package/dist/lib/git.d.ts

@@ -207,6 +207,10 @@ export declare function isGitRepo(dir: string): boolean;
  * Shells out to `git rev-parse --show-toplevel`, so it resolves correctly from
  * any subdirectory and for linked worktrees (unlike the root-only, synchronous
  * {@link isGitRepo} above). Throws if `dir` is not inside a git repository.
+ *
+ * Git prints POSIX separators even on Windows (`C:/Users/...`); we fold them to
+ * the native separator so the result is a real filesystem path that compares
+ * equal to one built with `path.*`. On POSIX this is a no-op.
  */
 export declare function getGitRoot(dir: string): Promise<string>;
 /**
@@ -216,6 +220,10 @@ export declare function getGitRoot(dir: string): Promise<string>;
  * worktree: `--show-toplevel` there returns the worktree's own path, but the
  * common git dir (`--git-common-dir`) always points at the primary repo's
  * `.git`, whose parent is the main checkout. Throws if `dir` is not in a repo.
+ *
+ * Git prints POSIX separators even on Windows (`C:/Users/...`); we fold them to
+ * the native separator so the result is a real filesystem path that compares
+ * equal to one built with `path.*`. On POSIX this is a no-op.
  */
 export declare function getMainRepoRoot(dir: string): Promise<string>;
 /**
@@ -281,7 +289,22 @@ export declare function displayHomePath(dir: string): string;
  *   3. Genuinely diverged (local commits not on tracking) → `rebase` onto the
  *      tracking ref (same outcome as {@link syncRepoGit}, without a second pull).
  */
-export declare function pullRepo(dir: string): Promise<{
+export interface PullRepoOptions {
+    /**
+     * `'default-branch-fast-forward'` — strict mode for `projects pull`:
+     *   - Blocks immediately if the tree is dirty (no remote read needed).
+     *   - Fetches origin, resolves the remote default branch, and refuses if the
+     *     current branch is not the remote default.
+     *   - Refuses if HEAD is ahead of the upstream (local commits not on remote).
+     *   - Fast-forwards only (`merge --ff-only`). NEVER rebases.
+     *   - NEVER installs git hook symlinks (read-only model path).
+     *
+     * `'preserve-local'` (default) — the existing behavior: tolerates dirty trees
+     * when the incoming diff does not collide, and rebases a diverged branch.
+     */
+    mode?: 'preserve-local' | 'default-branch-fast-forward';
+}
+export declare function pullRepo(dir: string, options?: PullRepoOptions): Promise<{
     success: boolean;
     commit: string;
     error?: string;

package/dist/lib/git.js

@@ -10,7 +10,7 @@ import { execFileSync } from 'node:child_process';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { IS_WINDOWS, isWindowsAbsolutePath } from './platform/index.js';
+import { IS_WINDOWS, isWindowsAbsolutePath, toNativePath } from './platform/index.js';
 import { getPackageLocalPath } from './state.js';
 import { DEFAULT_SYSTEM_REPO, systemRepoSlug } from './types.js';
 /**
@@ -658,10 +658,14 @@ export function isGitRepo(dir) {
  * Shells out to `git rev-parse --show-toplevel`, so it resolves correctly from
  * any subdirectory and for linked worktrees (unlike the root-only, synchronous
  * {@link isGitRepo} above). Throws if `dir` is not inside a git repository.
+ *
+ * Git prints POSIX separators even on Windows (`C:/Users/...`); we fold them to
+ * the native separator so the result is a real filesystem path that compares
+ * equal to one built with `path.*`. On POSIX this is a no-op.
  */
 export async function getGitRoot(dir) {
     const root = await simpleGit(dir).revparse(['--show-toplevel']);
-    return root.trim();
+    return toNativePath(root.trim());
 }
 /**
  * Return the absolute path to the **main** working-tree root for `dir`.
@@ -670,10 +674,14 @@ export async function getGitRoot(dir) {
  * worktree: `--show-toplevel` there returns the worktree's own path, but the
  * common git dir (`--git-common-dir`) always points at the primary repo's
  * `.git`, whose parent is the main checkout. Throws if `dir` is not in a repo.
+ *
+ * Git prints POSIX separators even on Windows (`C:/Users/...`); we fold them to
+ * the native separator so the result is a real filesystem path that compares
+ * equal to one built with `path.*`. On POSIX this is a no-op.
  */
 export async function getMainRepoRoot(dir) {
     const common = await simpleGit(dir).raw(['rev-parse', '--path-format=absolute', '--git-common-dir']);
-    return path.dirname(common.trim());
+    return toNativePath(path.dirname(common.trim()));
 }
 /**
  * Initialize a git repo in an existing directory.
@@ -863,23 +871,8 @@ export function displayHomePath(dir) {
     const rel = dir.startsWith(home) ? '~' + dir.slice(home.length) : dir;
     return rel.replace(/\\/g, '/');
 }
-/**
- * Pull changes in an existing repo.
- * A dirty working tree no longer refuses outright: a fast-forward that touches
- * no uncommitted path still runs (see `dirtyTreeRefusal`). It refuses when the
- * branch has local commits to rebase, or when an incoming path is also dirty.
- *
- * Strategy (RUSH-2282):
- *   1. Fetch, then compare HEAD to the resolved tracking ref.
- *   2. Clean behind-only (HEAD is an ancestor of tracking) → `merge --ff-only`
- *      against the tracking ref. Never re-enter `git pull` after a bare fetch —
- *      multi-entry FETCH_HEAD (concurrent fetch, multi-branch remote) makes
- *      `git pull --rebase` die with "Cannot rebase onto multiple branches" even
- *      when the checkout is a pure fast-forward.
- *   3. Genuinely diverged (local commits not on tracking) → `rebase` onto the
- *      tracking ref (same outcome as {@link syncRepoGit}, without a second pull).
- */
-export async function pullRepo(dir) {
+export async function pullRepo(dir, options = {}) {
+    const strict = options.mode === 'default-branch-fast-forward';
     try {
         const git = simpleGit(dir);
         // A rebase left in progress by an earlier run must be reported as itself.
@@ -916,14 +909,24 @@ export async function pullRepo(dir) {
             };
         }
         const status = await git.status();
+        // Strict mode (projects pull): refuse a dirty tree immediately — no fetch
+        // needed to know the answer, and the caller must not risk touching staged
+        // or modified files with an incoming fast-forward.
+        const isDirty = !status.isClean();
+        if (strict && isDirty) {
+            return {
+                success: false,
+                commit: '',
+                error: `Blocked: dirty working tree. Commit or discard local changes before pulling.\n\n  cd ${displayHomePath(dir)} && git status`,
+            };
+        }
         // A dirty tree is not decided here: whether a fast-forward is safe depends
         // on what is actually incoming, and that needs a fetched upstream ref. The
         // gate therefore sits just before the integrate step below. The exception is
         // a repo with no remote at all — there is nothing to fast-forward from, so
         // the dirt is the whole answer and the resolution below would only fail
         // with a less useful message.
-        const isDirty = !status.isClean();
-        if (isDirty && (await git.getRemotes()).length === 0) {
+        if (!strict && isDirty && (await git.getRemotes()).length === 0) {
             return {
                 success: false,
                 commit: '',
@@ -931,13 +934,13 @@ export async function pullRepo(dir) {
             };
         }
         const branch = status.current || 'main';
-        // Resolve the upstream ref to fast-forward against. Prefer the local
-        // branch's tracking config; otherwise ask origin for its default branch.
+        // Resolve the upstream ref to fast-forward against.
+        // Strict mode: always fetch origin and resolve its default branch — then
+        // verify the current branch IS the remote default (refuse otherwise).
+        // Preserve-local mode: prefer the local branch's tracking config; only
+        // fetch when no tracking is set.
         let tracking = status.tracking;
-        if (!tracking) {
-            // No tracking config: fetch origin so its HEAD is known, then ask which
-            // branch it points at. This path only ever concerns origin — a branch with
-            // no upstream has no other remote to consult.
+        if (strict || !tracking) {
             try {
                 await git.fetch('origin');
                 await git.raw(['remote', 'set-head', 'origin', '--auto']);
@@ -948,6 +951,19 @@ export async function pullRepo(dir) {
                 tracking = `origin/${branch}`;
             }
         }
+        // Strict: the checkout must be on the remote default branch — never pull a
+        // feature branch across the fleet unattended.
+        if (strict) {
+            const sep = tracking.indexOf('/');
+            const expectedBranch = sep > 0 ? tracking.slice(sep + 1) : tracking;
+            if (branch !== expectedBranch) {
+                return {
+                    success: false,
+                    commit: '',
+                    error: `Blocked: HEAD is on "${branch}" but origin defaults to "${expectedBranch}". Switch to "${expectedBranch}" before pulling.`,
+                };
+            }
+        }
         // Split the remote-tracking ref (<remote>/<branch>) so callers/logs can name
         // the remote. Branch names may contain slashes, so split on the FIRST
         // separator only. The integrate step below uses `tracking` directly (not a
@@ -983,15 +999,32 @@ export async function pullRepo(dir) {
         // around that call would always report "can ff" (RUSH-2282).
         const aheadCount = parseInt((await git.raw(['rev-list', '--count', `${tracking}..HEAD`])).trim(), 10);
         const behindCount = parseInt((await git.raw(['rev-list', '--count', `HEAD..${tracking}`])).trim(), 10);
-        const canFastForward = Number.isFinite(aheadCount) &&
-            Number.isFinite(behindCount) &&
-            aheadCount === 0 &&
-            behindCount > 0;
-        // Dirty tree: same rule `syncRepoGit` applies, from the same function — a
-        // fast-forward that touches nothing the author is holding may proceed; a
-        // rebase or a colliding path may not. Refusing on any dirt at all is what
-        // used to strand merged changes on every box that had an unrelated edit.
-        if (isDirty) {
+        // Both counts are the ONLY inputs to the fast-forward decision, so a count
+        // we cannot read is a refusal, not a reason to guess. Fail here rather than
+        // downstream: an unreadable count used to fall through to the rebase arm in
+        // preserve-local mode, and to a "HEAD diverged" message in strict mode that
+        // named the wrong cause.
+        if (!Number.isFinite(aheadCount) || !Number.isFinite(behindCount)) {
+            return {
+                success: false,
+                commit: '',
+                error: `Could not read how far HEAD is from ${tracking} — 'git rev-list --count' returned no usable count. Check the checkout, then pull again:\n\n  cd ${displayHomePath(dir)} && git status`,
+            };
+        }
+        const canFastForward = aheadCount === 0 && behindCount > 0;
+        // Strict: block if HEAD has local commits not on the remote — fast-forward
+        // requires the local tip to be an ancestor of the remote tip.
+        if (strict && aheadCount > 0) {
+            return {
+                success: false,
+                commit: '',
+                error: `Blocked: HEAD is ${aheadCount} commit${aheadCount === 1 ? '' : 's'} ahead of ${tracking}. Push or discard local commits before pulling.`,
+            };
+        }
+        // Dirty tree (preserve-local only): same rule `syncRepoGit` applies —
+        // a fast-forward that touches nothing the author is holding may proceed; a
+        // rebase or a colliding path may not. Strict mode already refused above.
+        if (!strict && isDirty) {
             const refusal = await dirtyTreeRefusal(git, status, tracking);
             if (refusal) {
                 return {
@@ -1010,6 +1043,14 @@ export async function pullRepo(dir) {
                 // Diverged (or local-only commits). Rebase onto the tracking tip —
                 // same outcome as `git pull --rebase <remote> <branch>` without
                 // re-fetching or consulting FETCH_HEAD.
+                //
+                // PRESERVE-LOCAL ONLY — strict mode can never reach this arm, so the
+                // fleet pull never rewrites history. Strict has already returned for
+                // every case that leaves `canFastForward` false: an identical local and
+                // remote ref, `aheadCount > 0` (which is also what "diverged" means),
+                // and a count that would not parse. That leaves `aheadCount === 0` with
+                // a differing ref, i.e. `behindCount > 0` — a fast-forward. Keep those
+                // three returns above intact if you change this.
                 await git.raw(['rebase', tracking]);
             }
         }
@@ -1028,7 +1069,10 @@ export async function pullRepo(dir) {
                 error: `${verb} onto ${tracking} failed — the pull was rolled back, nothing changed.\n\nResolve the divergence, then pull again:\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}\n\n${err.message}`,
             };
         }
-        installGithooksSymlinks(dir);
+        // Strict mode never installs git hook symlinks — the command is a read-model
+        // operation (update pointers only; never reconfigure the checkout).
+        if (!strict)
+            installGithooksSymlinks(dir);
         const log = await git.log({ maxCount: 1 });
         return {
             success: true,

package/dist/lib/heal.js

@@ -23,10 +23,10 @@
  * `agents prune cleanup`, so a heal pass can never lose work.
  */
 import { ALL_AGENT_IDS } from './agents.js';
-import { syncResourcesToVersion, listInstalledVersions, isVersionIsolated, getVersionHomePath, getActuallySyncedResources, compareVersions, } from './versions.js';
+import { syncResourcesToVersion, listInstalledVersions, isVersionIsolated, getVersionHomePath, getActuallySyncedResources, compareVersions, } from './installations/versions.js';
 import { diffVersionResources, } from './doctor-diff.js';
-import { discoverPlugins, updatePlugin, readPluginSourceInfo, getUpstreamManifestVersion, } from './plugins.js';
-import { repairPluginManifestFile } from './plugin-marketplace.js';
+import { discoverPlugins, updatePlugin, readPluginSourceInfo, getUpstreamManifestVersion, } from './plugins/plugins.js';
+import { repairPluginManifestFile } from './plugins/plugin-marketplace.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';

package/dist/lib/hooks.d.ts

@@ -386,3 +386,21 @@ export declare function registerHooksToSettings(agentId: AgentId, versionHome: s
  * entries removed.
  */
 export declare function pruneVersionHomeHookEntriesFromSettings(settingsPath: string, agent: AgentId, removedVersion: string): number;
+export interface InstallSessionTrackerHookResult {
+    installed: boolean;
+    error?: string;
+}
+/**
+ * Install the shared SessionStart state-writer hook (`packages/session-tracker`)
+ * into the harness's native config. Gated by `supports(agent, 'hooks', version)`;
+ * unsupported agents return `installed: false` with a reason instead of throwing.
+ *
+ * This is the bridge that makes bare `claude` / `codex` / `kimi` launches write
+ * `~/.agents/.cache/terminals/sessions/<pid>.json`, not just `agents run` launches.
+ */
+export declare function installSessionTrackerHook(agent: AgentId, version?: string, home?: string): Promise<InstallSessionTrackerHookResult>;
+/**
+ * Synchronous variant for callers that cannot be made async (e.g.
+ * `syncResourcesToVersion`). Best-effort: failures are returned, not thrown.
+ */
+export declare function installSessionTrackerHookSync(agent: AgentId, version?: string, home?: string): InstallSessionTrackerHookResult;

package/dist/lib/hooks.js

@@ -13,6 +13,9 @@ import * as os from 'os';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import * as TOML from 'smol-toml';
+import { execFile, execFileSync } from 'child_process';
+import { promisify } from 'util';
+import { fileURLToPath } from 'url';
 import { AGENTS, agentConfigDirName, isAgentHardDeprecated } from './agents.js';
 import { supports, explainSkip, capableAgents } from './capabilities.js';
 import { getHooksDir as getSystemHooksDir, getUserHooksDir, getUserAgentsDir, getSystemAgentsDir, getProjectAgentsDir, getTrashHooksDir, getEnabledExtraRepos, getResolvedRulesDir, getUserRulesDir, getPerfDir } from './state.js';
@@ -264,7 +267,7 @@ function collapseVersionHookEntries(entries, activeVersionHome) {
         return true;
     });
 }
-import { getEffectiveHome, getGlobalDefault, getVersionHomePath, isVersionIsolated, listInstalledVersions, resolveVersion, } from './versions.js';
+import { getEffectiveHome, getGlobalDefault, getVersionHomePath, isVersionIsolated, listInstalledVersions, resolveVersion, } from './installations/versions.js';
 import { generateHookShim, getHookShimPath, isValidHookShimName, parseCacheConfig, removeHookShim } from './hooks/cache.js';
 import { getHookShimsDir } from './state.js';
 function hookContentHash(scriptPath) {
@@ -3244,3 +3247,112 @@ function registerHooksForHermes(versionHome, manifest, resolveScript, managedPre
     }
     return { registered, errors };
 }
+const execFileAsync = promisify(execFile);
+function resolveSessionTrackerRoot() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    // Built/installed layout: dist/lib/ -> dist/session-tracker
+    const built = path.resolve(here, '..', 'session-tracker');
+    if (fs.existsSync(path.join(built, 'dist', 'hook.sh'))) {
+        return built;
+    }
+    // Source layout: apps/cli/src/lib/ -> repo root -> packages/session-tracker
+    const source = path.resolve(here, '..', '..', '..', '..', 'packages', 'session-tracker');
+    if (fs.existsSync(path.join(source, 'src', 'hook.sh'))) {
+        return source;
+    }
+    return null;
+}
+function resolveTsxLoader(trackerRoot) {
+    const loader = path.join(trackerRoot, 'node_modules', 'tsx', 'dist', 'cli.mjs');
+    if (fs.existsSync(loader))
+        return loader;
+    return null;
+}
+function buildInstallHookInvocation(trackerRoot, agent) {
+    const distScript = path.join(trackerRoot, 'dist', 'install-hook.js');
+    if (fs.existsSync(distScript)) {
+        return { command: process.execPath, args: [distScript, agent] };
+    }
+    const loader = resolveTsxLoader(trackerRoot);
+    if (!loader)
+        return null;
+    return {
+        command: process.execPath,
+        args: [loader, path.join(trackerRoot, 'src', 'install-hook.ts'), agent],
+    };
+}
+/**
+ * Install the shared SessionStart state-writer hook (`packages/session-tracker`)
+ * into the harness's native config. Gated by `supports(agent, 'hooks', version)`;
+ * unsupported agents return `installed: false` with a reason instead of throwing.
+ *
+ * This is the bridge that makes bare `claude` / `codex` / `kimi` launches write
+ * `~/.agents/.cache/terminals/sessions/<pid>.json`, not just `agents run` launches.
+ */
+export async function installSessionTrackerHook(agent, version, home) {
+    const gate = supports(agent, 'hooks', version);
+    if (!gate.ok) {
+        return { installed: false, error: explainSkip(agent, 'hooks', gate, version) };
+    }
+    const trackerRoot = resolveSessionTrackerRoot();
+    if (!trackerRoot) {
+        return { installed: false, error: 'session-tracker package not found' };
+    }
+    const invocation = buildInstallHookInvocation(trackerRoot, agent);
+    if (!invocation) {
+        return { installed: false, error: 'session-tracker not built and tsx is unavailable' };
+    }
+    try {
+        await execFileAsync(invocation.command, invocation.args, {
+            env: { ...process.env, HOME: home ?? process.env.HOME },
+            encoding: 'utf8',
+        });
+        return { installed: true };
+    }
+    catch (err) {
+        return { installed: false, error: installFailureMessage(err) };
+    }
+}
+/**
+ * The child reports its refusal reason on stdout (its HOOK_SUPPORT table), not
+ * stderr — and a Buffer-typed empty stderr is truthy, so a bare `err.stderr ??
+ * err.message` surfaced an empty string. Prefer the first NON-EMPTY stream.
+ */
+function installFailureMessage(err) {
+    const e = err;
+    for (const stream of [e.stderr, e.stdout]) {
+        const text = stream == null ? '' : String(stream).trim();
+        if (text.length > 0)
+            return text;
+    }
+    return e.message;
+}
+/**
+ * Synchronous variant for callers that cannot be made async (e.g.
+ * `syncResourcesToVersion`). Best-effort: failures are returned, not thrown.
+ */
+export function installSessionTrackerHookSync(agent, version, home) {
+    const gate = supports(agent, 'hooks', version);
+    if (!gate.ok) {
+        return { installed: false, error: explainSkip(agent, 'hooks', gate, version) };
+    }
+    const trackerRoot = resolveSessionTrackerRoot();
+    if (!trackerRoot) {
+        return { installed: false, error: 'session-tracker package not found' };
+    }
+    const invocation = buildInstallHookInvocation(trackerRoot, agent);
+    if (!invocation) {
+        return { installed: false, error: 'session-tracker not built and tsx is unavailable' };
+    }
+    try {
+        execFileSync(invocation.command, invocation.args, {
+            env: { ...process.env, HOME: home ?? process.env.HOME },
+            stdio: ['ignore', 'pipe', 'pipe'],
+            encoding: 'utf8',
+        });
+        return { installed: true };
+    }
+    catch (err) {
+        return { installed: false, error: installFailureMessage(err) };
+    }
+}

package/dist/lib/hosts/credentials.d.ts

@@ -1,28 +1,48 @@
 /**
- * Credential provisioning for `agents run --host --copy-creds`.
+ * Credential provisioning for `agents run --device --copy-creds`.
  *
- * Reuses the lease flow's runtime detection + credential-script builder so a
- * persistent host can boot logged-in the same way an ephemeral leased box does.
- * Unlike `--lease`, a host is persistent, so copying tokens is strictly opt-in
- * per run and we shred the files after the run to bound the credential window.
+ * `--copy-creds` USED TO copy each signed-in runtime's native login to a
+ * persistent host — the Claude OAuth token (`.claude/.credentials.json`) plus
+ * codex/grok/gemini `auth.json`-style files — so the box booted logged-in. Every
+ * one of those is a **rotating, interactive OAuth / session credential**, and
+ * copying it between devices is forbidden by the fleet-auth contract
+ * (`docs/specifications.md` SING-1b, `docs/credential-management.md` invariant 2):
+ * a shared refresh token rotates server-side on the next refresh and invalidates
+ * every other copy — the "droid collapsed 10 boxes to 1 overnight" failure.
+ *
+ * So this module no longer serializes native logins at all. It REFUSES the
+ * transfer and steers to the portable path — a long-lived, non-rotating provider
+ * account (`agents accounts add` / `agents accounts sync`), whose bundle is
+ * policy-`never` and safe to reuse on many devices. That sync rides its own
+ * hardened SSH transport (RUSH-2527); it never touches this path.
  */
 import type { AgentId } from '../types.js';
-import { type DetectedRuntime } from '../crabbox/runtimes.js';
+import type { DetectedRuntime } from '../crabbox/runtimes.js';
+export { isNativeOAuthRuntime, nativeOAuthTransferRefusal } from '../crabbox/runtimes.js';
 export interface HostCredentials {
     runtimes: AgentId[];
     detected: DetectedRuntime[];
     claudeCredentialsJson?: string | null;
 }
 /**
- * Build the setup (write credential files) and teardown (shred them) scripts for
- * a host run. Returns shell snippets meant to be run on the remote host.
+ * Build the setup/teardown scripts for a `--copy-creds` host run.
+ *
+ * Every runtime `--copy-creds` handles is a native OAuth / session login, so this
+ * REFUSES rather than serialize one across the wire (SING-1b) — it throws with the
+ * concrete `agents accounts` steer. The refusal happens BEFORE anything is
+ * serialized, so a native credential can never reach a remote-write script. An
+ * empty runtime set is a no-op (nothing to provision, nothing forbidden).
  */
 export declare function buildHostCredentialScript(opts: HostCredentials): {
     setup: string;
     teardown: string;
 };
 /**
- * Wrap a remote command so credentials are written before it runs and shredded
- * after it exits, regardless of success or failure.
+ * Wrap a remote command with credential setup/teardown for a `--copy-creds` run.
+ *
+ * Delegates to {@link buildHostCredentialScript}, which now refuses to transfer a
+ * native OAuth login — so a `--copy-creds` run against a signed-in native runtime
+ * fails loudly here (before dispatch) with the `agents accounts sync` steer,
+ * rather than shipping a rotating token to another device.
  */
 export declare function wrapHostCommandWithCredentials(innerCommand: string, opts: HostCredentials): string;

package/dist/lib/hosts/credentials.js

@@ -1,37 +1,49 @@
 /**
- * Credential provisioning for `agents run --host --copy-creds`.
+ * Credential provisioning for `agents run --device --copy-creds`.
  *
- * Reuses the lease flow's runtime detection + credential-script builder so a
- * persistent host can boot logged-in the same way an ephemeral leased box does.
- * Unlike `--lease`, a host is persistent, so copying tokens is strictly opt-in
- * per run and we shred the files after the run to bound the credential window.
+ * `--copy-creds` USED TO copy each signed-in runtime's native login to a
+ * persistent host — the Claude OAuth token (`.claude/.credentials.json`) plus
+ * codex/grok/gemini `auth.json`-style files — so the box booted logged-in. Every
+ * one of those is a **rotating, interactive OAuth / session credential**, and
+ * copying it between devices is forbidden by the fleet-auth contract
+ * (`docs/specifications.md` SING-1b, `docs/credential-management.md` invariant 2):
+ * a shared refresh token rotates server-side on the next refresh and invalidates
+ * every other copy — the "droid collapsed 10 boxes to 1 overnight" failure.
+ *
+ * So this module no longer serializes native logins at all. It REFUSES the
+ * transfer and steers to the portable path — a long-lived, non-rotating provider
+ * account (`agents accounts add` / `agents accounts sync`), whose bundle is
+ * policy-`never` and safe to reuse on many devices. That sync rides its own
+ * hardened SSH transport (RUSH-2527); it never touches this path.
  */
-import { buildCredentialScript, CLAUDE_TOKEN_REMOTE } from '../crabbox/runtimes.js';
-function getShredPaths(runtimes) {
-    const pathsById = {
-        claude: ['.claude.json', CLAUDE_TOKEN_REMOTE],
-        codex: ['.codex/auth.json'],
-        gemini: ['.gemini/google_accounts.json'],
-        grok: ['.grok/auth.json'],
-    };
-    return runtimes.flatMap((id) => pathsById[id] ?? []);
-}
+import { isNativeOAuthRuntime, nativeOAuthTransferRefusal } from '../crabbox/runtimes.js';
+// The native-OAuth predicate + refusal are canonical in `crabbox/runtimes.ts`
+// (next to `LEASE_RUNTIMES`), so `--copy-creds` here and `--lease` there refuse
+// against exactly the same set. Re-export for this module's existing consumers.
+export { isNativeOAuthRuntime, nativeOAuthTransferRefusal } from '../crabbox/runtimes.js';
 /**
- * Build the setup (write credential files) and teardown (shred them) scripts for
- * a host run. Returns shell snippets meant to be run on the remote host.
+ * Build the setup/teardown scripts for a `--copy-creds` host run.
+ *
+ * Every runtime `--copy-creds` handles is a native OAuth / session login, so this
+ * REFUSES rather than serialize one across the wire (SING-1b) — it throws with the
+ * concrete `agents accounts` steer. The refusal happens BEFORE anything is
+ * serialized, so a native credential can never reach a remote-write script. An
+ * empty runtime set is a no-op (nothing to provision, nothing forbidden).
  */
 export function buildHostCredentialScript(opts) {
-    const setup = buildCredentialScript(opts.runtimes, opts.detected, {
-        claudeCredentialsJson: opts.claudeCredentialsJson,
-    });
-    const teardown = getShredPaths(opts.runtimes)
-        .map((p) => `rm -f "$HOME/${p}" 2>/dev/null || true`)
-        .join('\n');
-    return { setup, teardown };
+    const native = opts.runtimes.filter(isNativeOAuthRuntime);
+    if (native.length > 0) {
+        throw new Error(nativeOAuthTransferRefusal(native));
+    }
+    return { setup: '', teardown: '' };
 }
 /**
- * Wrap a remote command so credentials are written before it runs and shredded
- * after it exits, regardless of success or failure.
+ * Wrap a remote command with credential setup/teardown for a `--copy-creds` run.
+ *
+ * Delegates to {@link buildHostCredentialScript}, which now refuses to transfer a
+ * native OAuth login — so a `--copy-creds` run against a signed-in native runtime
+ * fails loudly here (before dispatch) with the `agents accounts sync` steer,
+ * rather than shipping a rotating token to another device.
  */
 export function wrapHostCommandWithCredentials(innerCommand, opts) {
     const { setup, teardown } = buildHostCredentialScript(opts);

package/dist/lib/hosts/dispatch.d.ts

@@ -5,7 +5,7 @@
  * remote log and its exit code to a sibling `.exit` file, so progress survives a
  * dropped connection (followed via offset-tail in progress.ts). This is the
  * offload win: the process/thread/file fan-out happens on the host, not the
- * laptop. `agents run` uses it; `agents teams start --watch --host` reuses the
+ * laptop. `agents run` uses it; `agents teams start --watch --device` reuses the
  * same core so a remote team supervisor keeps running after you disconnect.
  */
 import type { Host } from './types.js';
@@ -221,7 +221,7 @@ export declare function buildInteractiveRunForwardedArgs(opts: InteractiveDispat
  * tmux wrapping; the local machine is just the transport.
  */
 export declare function runInteractiveOnHost(host: Host, opts: InteractiveDispatchOptions): Promise<number>;
-/** Dispatch an `agents run <agent> "<prompt>"` onto a host (the `run --host` path). */
+/** Dispatch an `agents run <agent> "<prompt>"` onto a host (the `run --device` path). */
 export declare function dispatchToHost(host: Host, opts: DispatchOptions): Promise<DispatchResult>;
 export interface CommandDispatchOptions {
     /** `agents …` args (command name first), already stripped of routing flags. */
@@ -232,7 +232,7 @@ export interface CommandDispatchOptions {
 }
 /**
  * Dispatch an arbitrary long-running `agents <command>` onto a host detached —
- * used for `teams start --watch --host`, whose supervisor must outlive the SSH
+ * used for `teams start --watch --device`, whose supervisor must outlive the SSH
  * connection. Reachability is assumed (the caller has already resolved the host);
  * a launch failure surfaces the remote stderr.
  */

package/dist/lib/hosts/dispatch.js

@@ -5,7 +5,7 @@
  * remote log and its exit code to a sibling `.exit` file, so progress survives a
  * dropped connection (followed via offset-tail in progress.ts). This is the
  * offload win: the process/thread/file fan-out happens on the host, not the
- * laptop. `agents run` uses it; `agents teams start --watch --host` reuses the
+ * laptop. `agents run` uses it; `agents teams start --watch --device` reuses the
  * same core so a remote team supervisor keeps running after you disconnect.
  */
 import { randomUUID } from 'crypto';
@@ -499,7 +499,7 @@ export async function runInteractiveOnHost(host, opts) {
         extraSshArgs: hostIdentityArgs(host),
     });
 }
-/** Dispatch an `agents run <agent> "<prompt>"` onto a host (the `run --host` path). */
+/** Dispatch an `agents run <agent> "<prompt>"` onto a host (the `run --device` path). */
 export async function dispatchToHost(host, opts) {
     const target = sshTargetFor(host);
     // Concrete agent@version pins fail loud before we print "Dispatched" and
@@ -524,7 +524,7 @@ export async function dispatchToHost(host, opts) {
 }
 /**
  * Dispatch an arbitrary long-running `agents <command>` onto a host detached —
- * used for `teams start --watch --host`, whose supervisor must outlive the SSH
+ * used for `teams start --watch --device`, whose supervisor must outlive the SSH
  * connection. Reachability is assumed (the caller has already resolved the host);
  * a launch failure surfaces the remote stderr.
  */

package/dist/lib/hosts/option.d.ts

@@ -1,5 +1,5 @@
 /**
- * Shared `--host` option registrar. Every command that can run on a remote host
+ * Shared `--device` option registrar. Every command that can run on a remote device
  * declares the flag through here, so its spelling, help text, and companions
  * (`--remote-cwd`, `--no-tty`, `--any`) stay identical everywhere and show up in
  * each command's `--help`.
@@ -7,8 +7,8 @@
  * The flags are consumed centrally by `maybeRunOnHost` (passthrough.ts) *before*
  * commander parses, so for a real remote run the local action never sees them.
  * Registering them here still matters: it documents the flag and keeps the local
- * fall-through (e.g. `--host <this-machine>`) from erroring on an unknown option.
+ * fall-through (e.g. `--device <this-machine>`) from erroring on an unknown option.
  */
 import type { Command } from 'commander';
-/** Attach the standard `--host` flag family to a command and return it (chainable). */
+/** Attach the standard `--device` flag family to a command and return it (chainable). */
 export declare function addHostOption(cmd: Command): Command;