@phnx-labs/agents-cli 1.22.39 → 1.22.41

package/dist/lib/computer/actions.js

@@ -0,0 +1,162 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { randomUUID } from 'node:crypto';
+import { resolvePolicyPath } from '../computer-rpc.js';
+import { COMPUTER_INPUT_GATED_VERBS, formatComputerPermissionGrantHint } from '../permissions.js';
+import { emit as emitEvent } from '../feed/events.js';
+import { recordComputerSession } from '../session/db.js';
+import { resolveActor } from '../actor.js';
+function isComputerInputVerb(verb) {
+    return typeof verb === 'string' && COMPUTER_INPUT_GATED_VERBS.includes(verb);
+}
+function computerSessionId(env = process.env) {
+    return env.CODEX_THREAD_ID
+        || env.CLAUDE_CODE_SESSION_ID
+        || env.CLAUDE_SESSION_ID
+        || env.AGENTS_SESSION_ID
+        || env.AGENTS_RUN_ID
+        || null;
+}
+function admissionCachePath(env = process.env) {
+    if (env.AGENTS_COMPUTER_ADMISSION_CACHE)
+        return env.AGENTS_COMPUTER_ADMISSION_CACHE;
+    return path.join(path.dirname(resolvePolicyPath()), 'computer-target-admissions.json');
+}
+function targetSelector(opts) {
+    return opts.bundle ? `bundle:${opts.bundle}` : 'frontmost';
+}
+function readAdmissionCache(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        return Array.isArray(parsed.admissions) ? parsed.admissions.filter(isAdmission) : [];
+    }
+    catch {
+        return [];
+    }
+}
+function isAdmission(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    const r = v;
+    return r.sessionId !== undefined
+        && typeof r.sessionId === 'string'
+        && typeof r.selector === 'string'
+        && r.gateClass === 'input'
+        && typeof r.pid === 'number'
+        && typeof r.bundle_id === 'string'
+        && typeof r.name === 'string'
+        && typeof r.admittedAtMs === 'number'
+        && isComputerInputVerb(r.admittedByVerb);
+}
+function rememberAdmission(app, opts) {
+    const sessionId = computerSessionId(opts.env);
+    if (!sessionId)
+        return;
+    const filePath = admissionCachePath(opts.env);
+    const admissions = readAdmissionCache(filePath);
+    const next = {
+        sessionId,
+        selector: opts.selector,
+        gateClass: 'input',
+        pid: app.pid,
+        bundle_id: app.bundle_id,
+        name: app.name,
+        admittedAtMs: opts.nowMs ?? Date.now(),
+        admittedByVerb: opts.verb,
+    };
+    const filtered = admissions.filter((a) => !(a.sessionId === sessionId && a.selector === opts.selector && a.gateClass === 'input'));
+    filtered.push(next);
+    try {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, JSON.stringify({ admissions: filtered }, null, 2), { mode: 0o600 });
+    }
+    catch {
+        // Cache persistence is best-effort; the daemon remains the final gate.
+    }
+}
+function findAdmission(opts) {
+    const sessionId = computerSessionId(opts.env);
+    if (!sessionId)
+        return null;
+    const admissions = readAdmissionCache(admissionCachePath(opts.env));
+    const matches = admissions
+        .filter((a) => a.sessionId === sessionId && a.selector === opts.selector && a.gateClass === 'input')
+        .sort((a, b) => b.admittedAtMs - a.admittedAtMs);
+    return matches[0] ?? null;
+}
+export function pickTarget(list, opts) {
+    if (opts.pid != null) {
+        const app = list.find((a) => a.pid === opts.pid);
+        return { ok: true, app: app ?? { pid: opts.pid, name: '', bundle_id: '', active: false } };
+    }
+    if (opts.bundle) {
+        const app = list.find((a) => a.bundle_id === opts.bundle);
+        if (!app) {
+            return {
+                ok: false,
+                error: `bundle not in allow list (or not running): ${opts.bundle}\n${formatComputerPermissionGrantHint(opts.bundle)}`,
+            };
+        }
+        return { ok: true, app };
+    }
+    const active = list.find((a) => a.active);
+    if (!active) {
+        return {
+            ok: false,
+            error: `no active app found in allow list\n${formatComputerPermissionGrantHint()}`,
+        };
+    }
+    return { ok: true, app: active };
+}
+function unwrap(r) {
+    if (r.error) {
+        console.error(`error: ${r.error.code}: ${r.error.message}`);
+        process.exit(1);
+    }
+    return r.result ?? {};
+}
+export async function resolveTargetPidDecision(client, opts, gate) {
+    if (opts.pid != null)
+        return { ok: true, pid: opts.pid, source: 'pid' };
+    const apps = unwrap(await client.call('list_apps'));
+    const list = apps.apps || [];
+    const picked = pickTarget(list, opts);
+    const verb = gate?.verb;
+    const selector = targetSelector(opts);
+    if (picked.ok && isComputerInputVerb(verb)) {
+        rememberAdmission(picked.app, { selector, verb, env: gate?.env, nowMs: gate?.nowMs });
+    }
+    if (!picked.ok) {
+        if (isComputerInputVerb(verb)) {
+            const admitted = findAdmission({ selector, env: gate?.env });
+            if (admitted)
+                return { ok: true, pid: admitted.pid, source: 'session_admission' };
+        }
+        return { ok: false, error: picked.error };
+    }
+    return { ok: true, pid: picked.app.pid, source: 'list_apps' };
+}
+const COMPUTER_INVOCATION_ID = randomUUID();
+export function emitComputerAction(verb, targetPid, opts, extra = {}) {
+    emitEvent('computer.action', {
+        command: verb,
+        invocationId: COMPUTER_INVOCATION_ID,
+        targetPid,
+        bundle: opts.bundle,
+        device: opts.device,
+        ...extra,
+    });
+    try {
+        recordComputerSession({
+            invocationId: COMPUTER_INVOCATION_ID,
+            sessionId: process.env.AGENT_SESSION_ID || process.env.AGENTS_SESSION_ID,
+            launchId: process.env.AGENT_LAUNCH_ID,
+            actor: resolveActor().id,
+            actionCount: 1,
+            taskPreview: typeof extra.task === 'string' ? extra.task : undefined,
+        });
+    }
+    catch {
+        // Recording is best-effort; the action and its event are already done.
+    }
+}

package/dist/lib/computer/dispatch.d.ts

@@ -1,10 +1,10 @@
 import type { ComputerClient } from '../computer-rpc.js';
-import { type AppInfo } from '../../commands/computer-actions.js';
+import { type AppInfo } from './actions.js';
 import type { VerbDispatcher } from './loop.js';
 declare function rpcMethodFor(verb: string): string;
 declare function toRpcParams(verb: string, input: Record<string, unknown>, pid?: number): Record<string, unknown>;
 export declare function makeVerbDispatcher(client: ComputerClient, context?: {
-    host?: string;
+    device?: string;
 }): VerbDispatcher;
 export { rpcMethodFor, toRpcParams };
 export type { AppInfo };

package/dist/lib/computer/dispatch.js

@@ -5,7 +5,7 @@
 // it names the same RPC methods the explicit `agents computer <verb>` commands
 // call, so the external-agent verb surface is untouched. The daemon stays the
 // single authority on permissions and targeting.
-import { resolveTargetPidDecision, emitComputerAction } from '../../commands/computer-actions.js';
+import { resolveTargetPidDecision, emitComputerAction } from './actions.js';
 // CLI verb -> daemon RPC method. Only the rename cases need listing; the rest
 // pass through by name.
 const RPC_METHOD = {
@@ -125,7 +125,7 @@ export function makeVerbDispatcher(client, context = {}) {
         const res = await client.call(method, params);
         if (res.error)
             return { ok: false, error: `${res.error.code}: ${res.error.message}` };
-        emitComputerAction(verb, pid, { bundle: input.bundle, host: context.host });
+        emitComputerAction(verb, pid, { bundle: input.bundle, device: context.device });
         return { ok: true, result: res.result ?? {} };
     };
 }

package/dist/lib/computer/sessions-list.d.ts

@@ -17,7 +17,7 @@ export interface ComputerAction {
     /** The driven app's pid, when resolved. */
     targetPid?: number;
     bundle?: string;
-    /** `--host <device>` target when this action drove a remote daemon. */
+    /** `--device <device>` target when this action drove a remote daemon. */
     host?: string;
     /** Truncated `--task` text; only ever present on a `verb: 'run'` marker. */
     task?: string;
@@ -62,7 +62,7 @@ export interface ComputerRunRow {
      *  the driven one (see `remoteHost`). */
     machine: string;
     machineId?: string;
-    /** `--host <device>` target when the run drove a remote (Windows) daemon. */
+    /** `--device <device>` target when the run drove a remote (Windows) daemon. */
     remoteHost?: string;
     /** Best-known target app bundle across the run's actions. */
     bundle?: string;
@@ -90,7 +90,7 @@ export declare function groupIntoComputerRuns(actions: ComputerAction[], resolve
 /** Build task-first rows from the real ledger, resolving each row's owning
  *  session against the live indexes. The interactive picker's (and the
  *  flat/`--json` printer's) data source. `machine` narrows to rows whose
- *  invoking hostname, machineId, or `--host` target contains the substring. */
+ *  invoking hostname, machineId, or `--device` target contains the substring. */
 export declare function buildComputerSessionRows(opts?: {
     limit?: number;
     machine?: string;

package/dist/lib/computer/sessions-list.js

@@ -58,7 +58,7 @@
  * `sessionId` doesn't resolve (a rotated/unindexed session) but `launchId`
  * still does via the more authoritative pid registry.
  */
-import { query, truncate } from '../events.js';
+import { query, truncate } from '../feed/events.js';
 import { formatRelativeTime } from '../session/relative-time.js';
 import { getSessionById, listComputerSessionRecords, pruneToolSessions } from '../session/db.js';
 import { buildLaunchSessionIndex, resolveLaunchSession, } from '../browser/sessions-list.js';
@@ -237,7 +237,7 @@ function appendPrunedRunsFromDb(rows, limit) {
 /** Build task-first rows from the real ledger, resolving each row's owning
  *  session against the live indexes. The interactive picker's (and the
  *  flat/`--json` printer's) data source. `machine` narrows to rows whose
- *  invoking hostname, machineId, or `--host` target contains the substring. */
+ *  invoking hostname, machineId, or `--device` target contains the substring. */
 export function buildComputerSessionRows(opts = {}) {
     const actions = listComputerActions({ limit: opts.limit });
     const index = buildLaunchSessionIndex();

package/dist/lib/config-keys.d.ts

@@ -50,7 +50,7 @@ export interface ParsedDeviceConfigKey {
     property: DeviceConfigProperty;
 }
 export type ParsedConfigKey = ParsedRunConfigKey | ParsedInteractiveConfigKey | ParsedUsageConfigKey | ParsedAutoConfigKey | ParsedBrowserConfigKey | ParsedProjectConfigKey | ParsedDeviceConfigKey;
-export type DeviceConfigProperty = 'role' | 'max-agents' | 'scheduler' | 'daemon' | 'watchdog' | 'tmux' | 'browser.remote-control' | 'notes' | 'browser.profile';
+export type DeviceConfigProperty = 'role' | 'max-agents' | 'scheduler' | 'daemon' | 'watchdog' | 'tmux' | 'browser.remote-control' | 'browser.task-idle-minutes' | 'notes' | 'browser.profile';
 /** Normalize agent@version to use `@` consistently. */
 export declare function formatAgentVersion(agent: AgentId, version: string): string;
 /**
@@ -73,6 +73,7 @@ export declare function formatAgentVersion(agent: AgentId, version: string): str
  *   devices.<name>.watchdog
  *   devices.<name>.tmux
  *   devices.<name>.browser.remote-control
+ *   devices.<name>.browser.task-idle-minutes
  *   devices.<name>.notes
  *   devices.<name>.browser.profile
  */

package/dist/lib/config-keys.js

@@ -17,6 +17,7 @@ const DEVICE_CONFIG_PROPERTIES = [
     'watchdog',
     'tmux',
     'browser.remote-control',
+    'browser.task-idle-minutes',
     'notes',
     'browser.profile',
 ];
@@ -57,6 +58,7 @@ export function formatAgentVersion(agent, version) {
  *   devices.<name>.watchdog
  *   devices.<name>.tmux
  *   devices.<name>.browser.remote-control
+ *   devices.<name>.browser.task-idle-minutes
  *   devices.<name>.notes
  *   devices.<name>.browser.profile
  */
@@ -89,7 +91,7 @@ export function parseConfigKey(key) {
     if (raw === 'project.root') {
         return { scope: 'project', property: 'root' };
     }
-    const deviceMatch = raw.match(/^devices\.(.+)\.(role|max-agents|scheduler|daemon|watchdog|tmux|notes|browser\.remote-control|browser\.profile)$/);
+    const deviceMatch = raw.match(/^devices\.(.+)\.(role|max-agents|scheduler|daemon|watchdog|tmux|notes|browser\.remote-control|browser\.task-idle-minutes|browser\.profile)$/);
     if (deviceMatch) {
         return {
             scope: 'device',
@@ -177,6 +179,8 @@ export function devicePropertyToConfigName(property) {
             return 'tmux.enabled';
         case 'browser.remote-control':
             return 'browser.remote-control';
+        case 'browser.task-idle-minutes':
+            return 'browser.task-idle-minutes';
         case 'notes':
             return 'notes';
         case 'browser.profile':
@@ -202,11 +206,11 @@ export function configKeyStorageHint(parsed) {
             return 'config.autoPool';
         case 'browser':
             return parsed.device
-                ? `fleet.devices.${parsed.device}.config.defaultBrowserProfile`
-                : 'fleet.devices.<self>.config.defaultBrowserProfile';
+                ? `devices/${parsed.device}/agents.yaml config.defaultBrowserProfile`
+                : 'devices/<self>/agents.yaml config.defaultBrowserProfile';
         case 'project':
             return 'devices.<self>.projectRoot';
         case 'device':
-            return `fleet.devices.${parsed.device}.config ${devicePropertyToConfigName(parsed.property)}`;
+            return `devices/${parsed.device}/agents.yaml config (${devicePropertyToConfigName(parsed.property)}; fleet default: fleet.defaults.config)`;
     }
 }

package/dist/lib/config-machine-keys.d.ts

@@ -1,7 +1,9 @@
 /**
  * The YAML keys of every machine-visibility config key — the ones that live in
- * the owning box's own `devices/<machine>/agents.yaml` and must never reach the
- * fleet-shared `agents.yaml`.
+ * the owning box's own `devices/<machine>/agents.yaml` and cannot be read or
+ * set for a peer. A fleet default may still live under
+ * `fleet.defaults.config` (the shared default layer); the peer restriction
+ * is about targeting another device, not about fleet policy.
  *
  * This is a ZERO-DEPENDENCY leaf on purpose. The authority is `CONFIG_KEYS` in
  * `lib/device-config.ts`, but that module imports `devices/config-migration.ts`,

package/dist/lib/config-machine-keys.js

@@ -1,7 +1,9 @@
 /**
  * The YAML keys of every machine-visibility config key — the ones that live in
- * the owning box's own `devices/<machine>/agents.yaml` and must never reach the
- * fleet-shared `agents.yaml`.
+ * the owning box's own `devices/<machine>/agents.yaml` and cannot be read or
+ * set for a peer. A fleet default may still live under
+ * `fleet.defaults.config` (the shared default layer); the peer restriction
+ * is about targeting another device, not about fleet policy.
  *
  * This is a ZERO-DEPENDENCY leaf on purpose. The authority is `CONFIG_KEYS` in
  * `lib/device-config.ts`, but that module imports `devices/config-migration.ts`,
@@ -15,4 +17,5 @@ export const MACHINE_LOCAL_YAML_KEYS = new Set([
     'schedulerEnabled', // scheduler.enabled
     'daemonEnabled', // daemon.enabled
     'tmuxEnabled', // tmux.enabled — whether an interactive run is tmux-wrapped on THIS box
+    'browserTaskIdleMinutes', // browser.task-idle-minutes — only THIS box's reaper reads it
 ]);

package/dist/lib/crabbox/lease.js

@@ -31,7 +31,7 @@
  */
 import { crabboxFind, crabboxList, crabboxStatusReady, crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop, poolReusableBoxes } from './cli.js';
 import * as yaml from 'yaml';
-import { buildCredentialScript, buildHomeFileWriteScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
+import { assertNoNativeOAuthTransfer, buildCredentialScript, buildHomeFileWriteScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
 import { LEASE_AGENT_MARKER, leasePhaseSentinel } from './progress.js';
 import { copySetupToBox } from './setup-copy.js';
 import { DEFAULT_CRABBOX_PROFILE } from './config.js';
@@ -262,6 +262,14 @@ function reapExpiredPoolStrays(opts, keepSlug) {
     return reaped;
 }
 export async function leaseAndRun(opts) {
+    // SING-1b, FAIL FAST: `buildBootstrapScript` below refuses to copy a native OAuth
+    // login (via `buildCredentialScript`), but that runs only AFTER a box has been
+    // leased — and a `--fresh` box would leak because the throw escapes the teardown
+    // `finally`. Refuse HERE, before any box is provisioned or paid for, mirroring how
+    // `--copy-creds` refuses before it opens an SSH connection.
+    assertNoNativeOAuthTransfer(opts.credentialRuntimes ?? opts.runtimes, opts.detected, {
+        claudeCredentialsJson: opts.claudeCredentialsJson,
+    });
     const startedAt = Date.now();
     let box;
     // A box this run did NOT provision — either the caller named it (`--box`) or

package/dist/lib/crabbox/runtimes.d.ts

@@ -26,6 +26,10 @@ interface RuntimeCred {
     remote: string;
 }
 export declare const LEASE_RUNTIMES: RuntimeCred[];
+/** True when `id` is a native OAuth / session login that MUST NOT be copied between devices (SING-1b). */
+export declare function isNativeOAuthRuntime(id: AgentId): boolean;
+/** The fail-loud message naming the forbidden runtimes and the portable path to use instead. */
+export declare function nativeOAuthTransferRefusal(nativeRuntimes: AgentId[]): string;
 export interface DetectedRuntime {
     id: AgentId;
     label: string;
@@ -96,15 +100,36 @@ export declare function resolveClaudeCredentialsBlob(opts?: {
     accountEmail?: (home: string) => Promise<string | null>;
 }): Promise<string | null>;
 /**
- * Build a bash snippet that writes each picked runtime's token file to the box's
- * home-level config path (0600), from the token contents read locally. Returns
- * `''` when no runtimes were selected. The snippet is meant to be embedded in
- * the `--script-stdin` body (never argv).
+ * The credential-provisioning snippet for a `--lease` box.
  *
- * `extras.claudeCredentialsJson` (the raw wrapped payload from
- * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
- * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
+ * Every runtime this could serialize is a native OAuth / session login
+ * (`LEASE_RUNTIMES`), and SING-1b forbids copying one to another device —
+ * including an ephemeral leased box, whose refresh of a shared rotating token
+ * invalidates every other holder. So this no longer writes a login: it REFUSES
+ * (throws, steering to the portable `agents accounts` path) whenever a picked
+ * runtime actually has a native credential to copy — signed in locally
+ * (`credPath`), or a Claude OAuth blob supplied. A picked runtime with nothing to
+ * copy is simply skipped, so `buildCredentialScript` returns `''` (a no-op box
+ * bootstrap) rather than throwing on a not-signed-in runtime.
  */
+/**
+ * The native OAuth runtimes among `picked` that actually have a credential to copy
+ * — signed in locally (`credPath`) or a Claude OAuth blob supplied — i.e. the ones
+ * a transfer would leak. A picked runtime with nothing to copy is not refused.
+ */
+export declare function refusedNativeOAuthRuntimes(picked: AgentId[], detected: DetectedRuntime[], extras?: {
+    claudeCredentialsJson?: string | null;
+}): AgentId[];
+/**
+ * Throw the SING-1b refusal if any picked runtime would transfer a native OAuth
+ * login. Callers should invoke this at a FAIL-FAST point — before any expensive or
+ * costly side effect (e.g. before `crabboxWarmup` leases a paid box) — so a refused
+ * `--lease` never leaks infra, mirroring how `--copy-creds` refuses before it opens
+ * an SSH connection.
+ */
+export declare function assertNoNativeOAuthTransfer(picked: AgentId[], detected: DetectedRuntime[], extras?: {
+    claudeCredentialsJson?: string | null;
+}): void;
 export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[], extras?: {
     claudeCredentialsJson?: string | null;
 }): string;

package/dist/lib/crabbox/runtimes.js

@@ -17,8 +17,8 @@ import * as path from 'path';
 import * as fs from 'fs';
 import { getAccountInfo } from '../agents.js';
 import { getKeychainToken } from '../secrets/index.js';
-import { getClaudeKeychainService } from '../usage.js';
-import { listInstalledVersions, getVersionHomePath } from '../versions.js';
+import { getClaudeKeychainService } from '../accounting/usage.js';
+import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
 import { readClaudeCredentialsBlob } from '../cloud/rush.js';
 export const LEASE_RUNTIMES = [
     { id: 'claude', label: 'Claude Code', localCandidates: ['.claude/.claude.json', '.claude.json'], remote: '.claude.json' },
@@ -26,6 +26,34 @@ export const LEASE_RUNTIMES = [
     { id: 'gemini', label: 'Gemini CLI', localCandidates: ['.gemini/google_accounts.json'], remote: '.gemini/google_accounts.json' },
     { id: 'grok', label: 'Grok CLI', localCandidates: ['.grok/auth.json'], remote: '.grok/auth.json' },
 ];
+/**
+ * Every runtime whose login this module can serialize (`LEASE_RUNTIMES`) is a
+ * native, rotating OAuth / session credential (Claude OAuth token, codex/grok
+ * `auth.json`, gemini `google_accounts.json`). The fleet-auth contract forbids
+ * copying any of them between devices — including to an ephemeral leased box —
+ * because a shared refresh token rotates server-side on the next refresh and
+ * invalidates every other copy (`docs/specifications.md` SING-1b,
+ * `docs/credential-management.md` invariant 2). The set is derived from
+ * `LEASE_RUNTIMES` so a newly-added runtime can never be silently exempted. This
+ * is the single canonical predicate; `--copy-creds` (`hosts/credentials.ts`) and
+ * `--lease` (this module's `buildCredentialScript`) both refuse against it.
+ */
+const NATIVE_OAUTH_RUNTIMES = new Set(LEASE_RUNTIMES.map((c) => c.id));
+/** True when `id` is a native OAuth / session login that MUST NOT be copied between devices (SING-1b). */
+export function isNativeOAuthRuntime(id) {
+    return NATIVE_OAUTH_RUNTIMES.has(id);
+}
+/** The fail-loud message naming the forbidden runtimes and the portable path to use instead. */
+export function nativeOAuthTransferRefusal(nativeRuntimes) {
+    return (`Refusing to copy native OAuth / session credentials to another device: ${nativeRuntimes.join(', ')}.\n` +
+        `A rotating harness login copied across machines is invalidated on its next server-side token ` +
+        `refresh — it logs the rest of the fleet out — so agents-cli never stores or transfers a harness's ` +
+        `interactive login (docs/specifications.md SING-1b).\n` +
+        `Use a portable provider account instead — a long-lived, non-rotating API key / setup-token that is ` +
+        `safe to reuse on many devices:\n` +
+        `    agents accounts add <name> --provider <provider> --auth <api-key|setup-token>\n` +
+        `    agents accounts sync <name> --device <host>`);
+}
 /** First existing candidate path under the real home, or null. */
 function findLocalCred(cred) {
     const home = process.env.AGENTS_REAL_HOME || os.homedir();
@@ -225,36 +253,50 @@ export async function resolveClaudeCredentialsBlob(opts) {
     return readClaudeCredentialsBlob(home);
 }
 /**
- * Build a bash snippet that writes each picked runtime's token file to the box's
- * home-level config path (0600), from the token contents read locally. Returns
- * `''` when no runtimes were selected. The snippet is meant to be embedded in
- * the `--script-stdin` body (never argv).
+ * The credential-provisioning snippet for a `--lease` box.
  *
- * `extras.claudeCredentialsJson` (the raw wrapped payload from
- * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
- * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
+ * Every runtime this could serialize is a native OAuth / session login
+ * (`LEASE_RUNTIMES`), and SING-1b forbids copying one to another device —
+ * including an ephemeral leased box, whose refresh of a shared rotating token
+ * invalidates every other holder. So this no longer writes a login: it REFUSES
+ * (throws, steering to the portable `agents accounts` path) whenever a picked
+ * runtime actually has a native credential to copy — signed in locally
+ * (`credPath`), or a Claude OAuth blob supplied. A picked runtime with nothing to
+ * copy is simply skipped, so `buildCredentialScript` returns `''` (a no-op box
+ * bootstrap) rather than throwing on a not-signed-in runtime.
  */
-export function buildCredentialScript(picked, detected, extras) {
+/**
+ * The native OAuth runtimes among `picked` that actually have a credential to copy
+ * — signed in locally (`credPath`) or a Claude OAuth blob supplied — i.e. the ones
+ * a transfer would leak. A picked runtime with nothing to copy is not refused.
+ */
+export function refusedNativeOAuthRuntimes(picked, detected, extras) {
     const byId = new Map(detected.map((d) => [d.id, d]));
-    const parts = [];
-    for (const id of picked) {
-        const d = byId.get(id);
-        const cred = LEASE_RUNTIMES.find((c) => c.id === id);
-        if (!d?.credPath || !cred)
-            continue;
-        let contents;
-        try {
-            contents = fs.readFileSync(d.credPath, 'utf-8');
-        }
-        catch {
-            continue;
-        }
-        parts.push(buildHomeFileWriteScript(cred.remote, contents));
-        // For claude the file above is config/state only; the OAuth token is a
-        // second artifact — without it the box comes up "Not logged in".
-        if (id === 'claude' && extras?.claudeCredentialsJson) {
-            parts.push(buildHomeFileWriteScript(CLAUDE_TOKEN_REMOTE, extras.claudeCredentialsJson));
-        }
+    return picked.filter((id) => {
+        if (!isNativeOAuthRuntime(id))
+            return false;
+        const hasLocalFile = !!byId.get(id)?.credPath && LEASE_RUNTIMES.some((c) => c.id === id);
+        const hasClaudeToken = id === 'claude' && !!extras?.claudeCredentialsJson;
+        return hasLocalFile || hasClaudeToken;
+    });
+}
+/**
+ * Throw the SING-1b refusal if any picked runtime would transfer a native OAuth
+ * login. Callers should invoke this at a FAIL-FAST point — before any expensive or
+ * costly side effect (e.g. before `crabboxWarmup` leases a paid box) — so a refused
+ * `--lease` never leaks infra, mirroring how `--copy-creds` refuses before it opens
+ * an SSH connection.
+ */
+export function assertNoNativeOAuthTransfer(picked, detected, extras) {
+    const refused = refusedNativeOAuthRuntimes(picked, detected, extras);
+    if (refused.length > 0) {
+        throw new Error(nativeOAuthTransferRefusal(refused));
     }
-    return parts.join('\n');
+}
+export function buildCredentialScript(picked, detected, extras) {
+    assertNoNativeOAuthTransfer(picked, detected, extras);
+    // Past the refusal there is nothing to serialize — every runtime this handles is
+    // native OAuth, so a non-refused set has no credential to copy. (Always '' today;
+    // the shape stays general in case a non-native runtime is ever added.)
+    return '';
 }

package/dist/lib/{daemon.d.ts → daemon/daemon.d.ts}

@@ -6,7 +6,43 @@
  * (macOS), systemd (Linux), or as a plain detached process. PID tracking,
  * log output, reload (SIGHUP), and graceful shutdown are handled here.
  */
-import { getAgentsBinPath } from './cli-entry.js';
+import { isolatedHomeSuffix } from '../service-manifest.js';
+import { getAgentsBinPath } from '../cli-entry.js';
+/**
+ * RUSH-2639 (residual): launchd/systemd route `unload`/`load`/`list` by the
+ * service identifier ALONE, never by the plist/unit file's path. Baking the
+ * caller's HOME into the plist content (the earlier RUSH-2639 fix, above)
+ * keeps the STARTED daemon inside its sandbox, but every hermetic-test
+ * instance and every real interactive install still share the one literal
+ * `PLIST_NAME`/`SYSTEMD_UNIT` string. `startDaemonLocked`'s own `unload`
+ * before `load` is written to be a no-op ("not loaded, expected") for a
+ * plist that has never been loaded — but confirmed on darwin: when a
+ * DIFFERENT plist is already loaded under that same label, `unload
+ * <this-instance's-own-never-loaded-path>` still tears down the OTHER job
+ * (verified directly against real launchctl with two throwaway plists
+ * sharing one label — the second job's own `unload` silently kills the
+ * first, still alive under a different path). On a machine running several
+ * hermetic test forks at once (CI) — or a developer's own suite next to
+ * their real always-on daemon — that "other job" is a live daemon with
+ * DIFFERENT baked-in state.
+ *
+ * Namespace the identifier itself whenever HOME has been redirected away
+ * from the account's real home. `os.userInfo().homedir` reads the OS/passwd
+ * record directly and ignores `$HOME` (unlike `os.homedir()`, which honors
+ * it), so comparing the two detects exactly this redirection — true for
+ * every hermetic test process, false for every real interactive/production
+ * invocation, so a real user's daemon keeps registering under the unchanged
+ * production identifier.
+ *
+ * The rule itself now lives in `service-manifest.ts` — the daemon was the first
+ * manifest to need it, not the only one — and is re-exported here because it is
+ * part of this module's published surface.
+ */
+export { isolatedHomeSuffix };
+/** launchd Label for this process's daemon — namespaced under a redirected HOME. */
+export declare function daemonServiceLabel(): string;
+/** systemd --user unit name for this process's daemon — namespaced under a redirected HOME. */
+export declare function daemonSystemdUnitName(): string;
 /**
  * How many consecutive failed daemon starts disable the *implicit* auto-start
  * (`ensureDaemonStarted`). Matches `DAEMON_START_LIMIT_BURST` so the two layers
@@ -194,6 +230,21 @@ export declare function writeOwnerOnlyServiceManifest(filePath: string, content:
  * credential at all. Routine runs authenticate through the per-account
  * CLAUDE_CONFIG_DIR login on this device, exactly like an interactive
  * `agents run`, so no credential ever touches the service manifest.
+ *
+ * RUSH-2639: launchd does NOT inherit `launchctl load`'s caller's process
+ * environment — a spawned daemon only ever sees the login session's default
+ * env plus whatever this dict adds/overrides. Before this fix the dict carried
+ * only PATH, so HOME resolved to the launchd session's own value regardless of
+ * what HOME the process that generated (and loaded) the plist was running
+ * under. In production that's a no-op (the login session's HOME already is the
+ * real HOME), but under a hermetic test harness that redirects HOME to a
+ * fork-private sandbox, a launchd-started daemon silently escaped the sandbox
+ * and bootstrapped `~/.agents` (.cache/.history/.system/routines) in the
+ * developer's/runner's REAL home. Baking HOME (and the AGENTS_REAL_HOME seam
+ * every version-home consumer honors, see tests/setup.ts) into the plist at
+ * generation time makes the launchd child inherit the SAME home the caller
+ * resolved, exactly like the plain detached-spawn path already does via
+ * `env: {...process.env}`.
  */
 export declare function generateLaunchdPlist(agentsBin?: string): string;
 /**
@@ -203,6 +254,13 @@ export declare function generateLaunchdPlist(agentsBin?: string): string;
  * credential at all. Routine runs authenticate through the per-account
  * CLAUDE_CONFIG_DIR login on this device, exactly like an interactive
  * `agents run`, so no credential ever touches the unit file.
+ *
+ * RUSH-2639: same seam as `generateLaunchdPlist` — a systemd --user unit is
+ * started by the user's systemd instance, not the process that generated the
+ * unit, so HOME is whatever that session provides unless this file pins it.
+ * Baking HOME (and AGENTS_REAL_HOME) in at generation time keeps a
+ * hermetic-test-started unit inside its sandbox instead of resolving against
+ * the real account home.
  */
 export declare function generateSystemdUnit(agentsBin?: string): string;
 export { getAgentsBinPath };