@phnx-labs/agents-cli 1.22.39 → 1.22.41

package/dist/lib/{events.js → feed/events.js}

@@ -16,14 +16,14 @@ import * as path from 'path';
 import * as os from 'os';
 import { createHash } from 'node:crypto';
 import { gzipSync, gunzipSync } from 'node:zlib';
-import { ensureLockTarget, withFileLock } from './fs-atomic.js';
-import { getUserAgentsDir } from './state.js';
-import { stampProvenance, resetEventProvenanceForTest } from './event-provenance.js';
+import { ensureLockTarget, withFileLock } from '../fs-atomic.js';
+import { getUserAgentsDir } from '../state.js';
+import { stampProvenance, resetEventProvenanceForTest } from '../event-provenance.js';
 /** Lazy perf warehouse write — avoids a hard cycle at module load. */
 function recordPerfTiming(payload) {
     try {
         // Dynamic import keeps events.ts free of a load-time dependency on perf/db.
-        void import('./perf/spool.js').then(({ recordSample }) => {
+        void import('../perf/spool.js').then(({ recordSample }) => {
             recordSample({
                 kind: 'perf.timing',
                 label: payload.label,
@@ -128,7 +128,7 @@ const EVENT_TYPE_TABLE = {
     'perf.timing': true,
     'session.start': true, 'session.end': true,
     'webhook.received': true, 'webhook.authorized': true, 'webhook.rejected': true, 'webhook.matched': true,
-    'webhook.fired': true, 'webhook.handler.start': true, 'webhook.handler.end': true,
+    'webhook.fired': true, 'webhook.failed': true, 'webhook.handler.start': true, 'webhook.handler.end': true,
     'plan.created': true, 'pr.opened': true, 'pr.merged': true, 'worktree.created': true,
     'worktree.removed': true, 'commit.created': true, 'pushed': true, 'subagent.spawned': true,
     'artifact.created': true, 'task.completed': true, 'checklist.created': true, 'status.posted': true,

package/dist/lib/{feed.js → feed/feed.js}

@@ -24,10 +24,10 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
-import { stringifyDoc } from './yaml-io.js';
-import { getFeedDir, getUserAgentsDir } from './state.js';
-import { isAdmin, isHighConsequenceAllowed, isKnownOperator } from './operator.js';
-import { projectKeyFromCwd } from './project-key.js';
+import { stringifyDoc } from '../yaml-io.js';
+import { getFeedDir, getUserAgentsDir } from '../state.js';
+import { isAdmin, isHighConsequenceAllowed, isKnownOperator } from '../operator.js';
+import { projectKeyFromCwd } from '../project-key.js';
 /**
  * Stable block id for a session. One block per session -- a new question
  * replaces the previous one (the agent can only ask one question at a time).

package/dist/lib/feed-outcome.d.ts

@@ -1,4 +1,4 @@
-import type { OpenBlock } from './feed.js';
+import type { OpenBlock } from './feed/feed.js';
 export type OutcomeKind = 'ticket' | 'pr' | 'worktree' | 'unassigned';
 /** Stable attribution of a block (or agent) to one deliverable. */
 export interface OutcomeRef {

package/dist/lib/feed-policy.d.ts

@@ -1,4 +1,4 @@
-import { type OpenBlock, type AnswerRecord } from './feed.js';
+import { type OpenBlock, type AnswerRecord } from './feed/feed.js';
 export type BlockClass = 'approval' | 'decision';
 export interface ClassPolicy {
     timeoutMinutes: number;

package/dist/lib/feed-policy.js

@@ -16,7 +16,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { getUserAgentsDir } from './state.js';
-import { recordAnswer, recordDefaulted, recordMessageReceipt, recordParked, } from './feed.js';
+import { recordAnswer, recordDefaulted, recordMessageReceipt, recordParked, } from './feed/feed.js';
 import { enqueue, mailboxDir } from './mailbox.js';
 const POLICY_FILE = 'feed-policy.yaml';
 const COST_RANK = { low: 0, medium: 1, high: 2 };

package/dist/lib/feed-post.d.ts

@@ -1,4 +1,4 @@
-import { type ActivityEvent, type Attachment } from './activity.js';
+import { type ActivityEvent, type Attachment } from './feed/activity.js';
 import { type PidSessionEntry } from './session/pid-registry.js';
 /** Soft cap so a runaway agent can't flood the activity lane with essays. */
 export declare const STATUS_POST_MAX_CHARS = 500;

package/dist/lib/feed-post.js

@@ -16,7 +16,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { spawnSync } from 'child_process';
-import { appendActivityEvent, readRecentActivity, } from './activity.js';
+import { appendActivityEvent, readRecentActivity, } from './feed/activity.js';
 import { resolveProjectNameForCwd, listProjectDefs } from './projects.js';
 import { getHistoryDir } from './state.js';
 import { machineId } from './machine-id.js';

package/dist/lib/feed-ranking.d.ts

@@ -1,4 +1,4 @@
-import type { OpenBlock, FeedAskStats } from './feed.js';
+import type { OpenBlock, FeedAskStats } from './feed/feed.js';
 import type { Classification } from './ask-classifier.js';
 import type { ActiveSession } from './session/active.js';
 import type { SessionMeta } from './session/types.js';

package/dist/lib/fleet/apply.d.ts

@@ -45,12 +45,6 @@ export interface SourceAuth {
     /** The captured file payloads, keyed by agent. */
     filesByAgent: Map<string, AuthFilePayload[]>;
 }
-/**
- * Can we propagate `agent`'s login to a target on `targetPlatform`? False when
- * the agent has no portable file, the source can't provide it (bound / not
- * signed in), or the target consumes credentials from its own keychain.
- */
-export declare function canPushLogin(agent: string, targetPlatform: string | undefined, src: SourceAuth): boolean;
 export interface DiffContext {
     /** agents-cli version the source is on — the fleet target version. */
     targetCliVersion: string;

package/dist/lib/fleet/apply.js

@@ -13,7 +13,7 @@ import { deviceIdentityArgs, sshTargetFor } from '../devices/connect.js';
 import { readyProbe, bootstrapAgentsCli } from '../hosts/ready.js';
 import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
 import { sshExec } from '../ssh-exec.js';
-import { isPropagatableAgent, hasPortableAuthFiles, isCredentialSafeToPropagate, KEYCHAIN_BOUND_ON_MAC, buildAuthBundle, } from './auth-sync.js';
+import { hasPortableAuthFiles } from './auth-sync.js';
 /** Strip a version suffix from an agent spec: `claude@latest` -> `claude`. */
 export function agentIdOf(spec) {
     return spec.split('@')[0].trim();
@@ -88,20 +88,6 @@ export function parseInstalledVersions(stdout) {
         return undefined;
     }
 }
-/**
- * Can we propagate `agent`'s login to a target on `targetPlatform`? False when
- * the agent has no portable file, the source can't provide it (bound / not
- * signed in), or the target consumes credentials from its own keychain.
- */
-export function canPushLogin(agent, targetPlatform, src) {
-    if (!isPropagatableAgent(agent))
-        return false;
-    if (src.bound.has(agent))
-        return false;
-    if (targetPlatform === 'macos' && KEYCHAIN_BOUND_ON_MAC.has(agent))
-        return false;
-    return src.available.has(agent);
-}
 /** Pure: desired vs probed -> per-device diff + flat action list. */
 export function diffFleet(desired, probes, ctx) {
     const devices = [];
@@ -143,28 +129,24 @@ export function diffFleet(desired, probes, ctx) {
                 rowActions.push({ device: d.device, kind: 'sync-config', detail: `sync config (${d.sync.join(', ')})` });
             }
             // login — per agent id, not per spec: `claude@all` names one id many times,
-            // but login propagates once per agent (its credential is version-shared).
+            // but a login is established once per agent (its credential is version-shared).
             if (d.login === 'sync') {
                 for (const id of [...new Set(d.agents.map(agentIdOf))]) {
-                    if (canPushLogin(id, probe.platform, ctx.sourceAuth)) {
-                        rowActions.push({ device: d.device, kind: 'push-login', agent: id, detail: `propagate ${id} login` });
-                    }
-                    else if (hasPortableAuthFiles(id) && !isCredentialSafeToPropagate(id)) {
-                        // Single-use rotating refresh tokens (e.g. droid/WorkOS) must never be
-                        // copied across boxes — the first refresh invalidates every other copy.
-                        // Surface per-machine login guidance instead of silently propagating.
-                        loginBlocked.push(id);
-                        rowActions.push({ device: d.device, kind: 'needs-login', agent: id, detail: `${id} login uses a single-use rotating refresh token — log in on ${d.device} itself` });
-                    }
-                    else if (isPropagatableAgent(id) &&
-                        (ctx.sourceAuth.bound.has(id) || (probe.platform === 'macos' && KEYCHAIN_BOUND_ON_MAC.has(id)))) {
-                        // A login-propagation candidate we still can't push: the source token
-                        // is keychain-bound (unextractable), or the macOS target consumes its
-                        // own keychain. Surface those as manual — don't fake. Agents that were
-                        // never propagation candidates (no portable file), or a source that
-                        // simply isn't signed in, are silently skipped the same on every OS.
+                    // SING-1b: a native OAuth / session login MUST NOT be copied between
+                    // devices — a rotating token invalidates the fleet on its next refresh
+                    // (droid/WorkOS collapsed 10 boxes to 1 overnight). `apply` therefore no
+                    // longer propagates any login; it surfaces per-box login / portable
+                    // provider-account guidance for every agent that has a login to
+                    // establish. An agent with no portable login file, or a source that
+                    // isn't signed in, is silently skipped the same on every OS.
+                    if (hasPortableAuthFiles(id)) {
                         loginBlocked.push(id);
-                        rowActions.push({ device: d.device, kind: 'needs-login', agent: id, detail: `${id} needs a manual login` });
+                        rowActions.push({
+                            device: d.device,
+                            kind: 'needs-login',
+                            agent: id,
+                            detail: `${id}: a native OAuth login can't be copied between devices (SING-1b) — log in on ${d.device} itself, or sync a portable provider account (agents accounts sync)`,
+                        });
                     }
                 }
             }
@@ -414,17 +396,8 @@ export function reconcileDevice(row, device, ctx) {
         steps.push({ kind: 'sync-config', ok: syncOk, detail: `sync config (${row.desired.sync.join(', ') || 'default'})` });
         ok = ok && syncOk;
     }
-    // 4. login propagation — one bundle for all pushable agents on this device.
-    const pushAgents = [...new Set(row.actions.filter((a) => a.kind === 'push-login').map((a) => a.agent))];
-    if (pushAgents.length > 0) {
-        const files = [];
-        for (const agent of pushAgents)
-            files.push(...(ctx.sourceAuth.filesByAgent.get(agent) ?? []));
-        const bundle = buildAuthBundle(ctx.source, files);
-        const r = sshAgents(['apply', '--recv-auth'], JSON.stringify(bundle));
-        steps.push({ kind: 'push-login', ok: r.code === 0, detail: `propagate login: ${pushAgents.join(', ')}` });
-        ok = ok && r.code === 0;
-    }
+    // 4. Native login materialization does not exist. Every agent that needs a login is surfaced as
+    // `needs-login` (per-box login / portable-account guidance) in the diff above.
     // 5. secrets provisioning — LAST, and deliberately so. It is the most
     // sensitive mutation apply performs (credential VALUES crossing to another
     // machine), so every lower-risk step above is already recorded before we

package/dist/lib/fleet/auth-sync.d.ts

@@ -1,19 +1,13 @@
 /**
- * Login/token propagation — the "one login instead of ~48 OAuth flows" core of
- * `agents apply`.
- *
- * A source machine that is already signed in to a set of harnesses has portable
- * credential files on disk (verified per-agent locations below). `snapshotAuth`
- * captures those; `materializeAuth` writes them into the corresponding paths on
- * a target device. Transport is the caller's job — `apply` streams the bundle
- * over the existing (encrypted, authenticated) SSH channel via `sshExec`'s
- * stdin `input`, so no app-layer crypto is layered on top of SSH here.
+ * Native-login inventory for `agents apply` and `agents fleet login`.
+ * Native OAuth/session files are identified only to report device readiness;
+ * agents-cli never serializes or materializes them on another device.
  *
  * Honest boundary: on macOS, claude and antigravity keep their tokens in the
  * login keychain, ACL-bound to the harness process — unreadable by us. Those are
  * classified `bound` and surfaced for a one-time manual login, never faked.
  */
-import type { AuthFilePayload, AuthBundle, AuthSnapshotResult } from './types.js';
+import type { AuthSnapshotResult } from './types.js';
 /** A portable credential file location, relative to $HOME. */
 interface AuthFileSpec {
     rel: string;
@@ -37,10 +31,18 @@ export declare const KEYCHAIN_BOUND_ON_MAC: ReadonlySet<string>;
  * made. See also `remote-login.ts` and `usage.ts` for the per-machine-login policy.
  */
 export declare const SINGLE_USE_ROTATING_REFRESH_AGENTS: ReadonlySet<string>;
-/** True when `agent`'s portable credential file(s) are safe to copy between
- *  machines. Single-use rotating refresh tokens are never safe; keychain-bound
- *  tokens are handled separately by the caller via {@link KEYCHAIN_BOUND_ON_MAC}. */
-export declare function isCredentialSafeToPropagate(agent: string): boolean;
+/**
+ * Whether `agent`'s login may be copied between machines by `apply`. Always
+ * **false** now (RUSH-2527): every `FLEET_AUTH_FILES` entry is a native,
+ * rotating OAuth / session login, and the fleet-auth contract forbids copying any
+ * of them between devices (`docs/specifications.md` SING-1b) — not just the
+ * single-use-rotating subset (`SINGLE_USE_ROTATING_REFRESH_AGENTS`) that first
+ * motivated this gate. `apply` therefore never propagates a login; it surfaces
+ * per-box login / portable-account guidance instead. `snapshotAuth` reads no
+ * credential file as a result, so a native login never leaves its origin box.
+ * The `agent` parameter is retained for the stable call signature.
+ */
+export declare function isCredentialSafeToPropagate(_agent: string): boolean;
 /** True when the agent stores credentials in portable files we can read. This
  *  does NOT mean it is safe to propagate — check {@link isCredentialSafeToPropagate}. */
 export declare function hasPortableAuthFiles(agent: string): boolean;
@@ -113,25 +115,4 @@ export interface SnapshotOptions {
  * propagate, not an error.
  */
 export declare function snapshotAuth(agents: string[], opts: SnapshotOptions): AuthSnapshotResult;
-/** Assemble the plaintext bundle shipped to a target. */
-export declare function buildAuthBundle(source: string, files: AuthFilePayload[]): AuthBundle;
-export interface MaterializeOptions {
-    /** Home directory to write credential files into. */
-    home: string;
-}
-export interface MaterializeResult {
-    /** Agent ids that received at least one file. */
-    written: string[];
-    /** `rel: reason` for any file that failed. */
-    errors: string[];
-}
-/**
- * Write a captured auth bundle into a target home. Parent dirs are created; the
- * captured POSIX mode is restored (0600 for credentials). Writing through an
- * existing symlink lands in the agent's active version home, which is exactly
- * what per-version credential carry-forward expects.
- */
-export declare function materializeAuth(bundle: AuthBundle, opts: MaterializeOptions): MaterializeResult;
-/** Parse + validate a bundle received on stdin (the remote `--_recv-auth` path). */
-export declare function parseAuthBundle(raw: string): AuthBundle;
 export {};

package/dist/lib/fleet/auth-sync.js

@@ -1,13 +1,7 @@
 /**
- * Login/token propagation — the "one login instead of ~48 OAuth flows" core of
- * `agents apply`.
- *
- * A source machine that is already signed in to a set of harnesses has portable
- * credential files on disk (verified per-agent locations below). `snapshotAuth`
- * captures those; `materializeAuth` writes them into the corresponding paths on
- * a target device. Transport is the caller's job — `apply` streams the bundle
- * over the existing (encrypted, authenticated) SSH channel via `sshExec`'s
- * stdin `input`, so no app-layer crypto is layered on top of SSH here.
+ * Native-login inventory for `agents apply` and `agents fleet login`.
+ * Native OAuth/session files are identified only to report device readiness;
+ * agents-cli never serializes or materializes them on another device.
  *
  * Honest boundary: on macOS, claude and antigravity keep their tokens in the
  * login keychain, ACL-bound to the harness process — unreadable by us. Those are
@@ -44,11 +38,19 @@ export const KEYCHAIN_BOUND_ON_MAC = new Set(['claude', 'antigravity']);
  * made. See also `remote-login.ts` and `usage.ts` for the per-machine-login policy.
  */
 export const SINGLE_USE_ROTATING_REFRESH_AGENTS = new Set(['droid']);
-/** True when `agent`'s portable credential file(s) are safe to copy between
- *  machines. Single-use rotating refresh tokens are never safe; keychain-bound
- *  tokens are handled separately by the caller via {@link KEYCHAIN_BOUND_ON_MAC}. */
-export function isCredentialSafeToPropagate(agent) {
-    return !SINGLE_USE_ROTATING_REFRESH_AGENTS.has(agent);
+/**
+ * Whether `agent`'s login may be copied between machines by `apply`. Always
+ * **false** now (RUSH-2527): every `FLEET_AUTH_FILES` entry is a native,
+ * rotating OAuth / session login, and the fleet-auth contract forbids copying any
+ * of them between devices (`docs/specifications.md` SING-1b) — not just the
+ * single-use-rotating subset (`SINGLE_USE_ROTATING_REFRESH_AGENTS`) that first
+ * motivated this gate. `apply` therefore never propagates a login; it surfaces
+ * per-box login / portable-account guidance instead. `snapshotAuth` reads no
+ * credential file as a result, so a native login never leaves its origin box.
+ * The `agent` parameter is retained for the stable call signature.
+ */
+export function isCredentialSafeToPropagate(_agent) {
+    return false;
 }
 /** True when the agent stores credentials in portable files we can read. This
  *  does NOT mean it is safe to propagate — check {@link isCredentialSafeToPropagate}. */
@@ -185,64 +187,3 @@ export function snapshotAuth(agents, opts) {
     }
     return { files, bound };
 }
-/** Assemble the plaintext bundle shipped to a target. */
-export function buildAuthBundle(source, files) {
-    return { v: 1, source, files };
-}
-/**
- * Write a captured auth bundle into a target home. Parent dirs are created; the
- * captured POSIX mode is restored (0600 for credentials). Writing through an
- * existing symlink lands in the agent's active version home, which is exactly
- * what per-version credential carry-forward expects.
- */
-export function materializeAuth(bundle, opts) {
-    const written = new Set();
-    const errors = [];
-    for (const f of bundle.files) {
-        const abs = path.join(opts.home, f.rel);
-        try {
-            fs.mkdirSync(path.dirname(abs), { recursive: true });
-            fs.writeFileSync(abs, Buffer.from(f.contentB64, 'base64'));
-            fs.chmodSync(abs, f.mode || 0o600);
-            written.add(f.agent);
-        }
-        catch (e) {
-            errors.push(`${f.rel}: ${e.message}`);
-        }
-    }
-    return { written: [...written], errors };
-}
-/** Parse + validate a bundle received on stdin (the remote `--_recv-auth` path). */
-export function parseAuthBundle(raw) {
-    let doc;
-    try {
-        doc = JSON.parse(raw);
-    }
-    catch (e) {
-        throw new Error(`auth bundle is not valid JSON: ${e.message}`);
-    }
-    if (typeof doc !== 'object' || doc === null)
-        throw new Error('auth bundle must be an object.');
-    const o = doc;
-    if (o.v !== 1)
-        throw new Error(`unsupported auth bundle version ${JSON.stringify(o.v)}.`);
-    if (typeof o.source !== 'string')
-        throw new Error('auth bundle missing source.');
-    if (!Array.isArray(o.files))
-        throw new Error('auth bundle missing files[].');
-    for (const f of o.files) {
-        if (typeof f !== 'object' || f === null ||
-            typeof f.agent !== 'string' ||
-            typeof f.rel !== 'string' ||
-            typeof f.contentB64 !== 'string' ||
-            typeof f.mode !== 'number') {
-            throw new Error('auth bundle has a malformed file entry.');
-        }
-        // Reject path traversal — rel must stay under $HOME.
-        const rel = f.rel;
-        if (rel.startsWith('/') || rel.split('/').includes('..')) {
-            throw new Error(`auth bundle rejected unsafe path: ${rel}`);
-        }
-    }
-    return doc;
-}

package/dist/lib/fleet/capture.js

@@ -28,12 +28,11 @@ export function captureFleet(prev, inputs) {
     // when the manifest didn't already pin one for that device.
     //
     // A device absent from `inputs.devices` drops OUT of the roster — that is the
-    // intended "live state is the source of truth for WHICH devices exist". But
-    // `fleet.devices.<name>.config` is also the operator-config store, and a
-    // capture run from a box whose registry has not seen a peer would silently
-    // erase that peer's settings. Observed for real: capturing on yosemite-s0
-    // deleted zion's whole config block from the shared agents.yaml. So carry a
-    // dropped device's `config:` forward — config only, never its roster fields.
+    // intended "live state is the source of truth for WHICH devices exist". A
+    // leftover `config:` on an override is the LEGACY #2458 store (folded into
+    // per-device docs by migrateDeviceConfigStores). Carry it forward so a
+    // capture from a box that has not seen a peer cannot re-strip a not-yet-
+    // migrated peer's settings. Config only, never its roster fields.
     const devices = {};
     for (const [name, prevOverride] of Object.entries(prevDevices)) {
         if (inputs.devices.includes(name))
@@ -56,6 +55,9 @@ export function captureFleet(prev, inputs) {
         defaults: prev?.defaults ?? inputs.defaults ?? {},
         devices,
     };
+    if (prev?.discovery && Object.keys(prev.discovery).length > 0) {
+        manifest.discovery = { ...prev.discovery };
+    }
     const bundles = inputs.secretsBundles ?? prev?.secrets?.bundles;
     if (bundles && bundles.length > 0)
         manifest.secrets = { bundles: [...bundles].sort() };

package/dist/lib/fleet/manifest.js

@@ -34,10 +34,16 @@ function validateDefaults(v, where) {
     if (o.sync !== undefined && !isStringArray(o.sync)) {
         throw new Error(`fleet: ${where}.sync must be a list of scope names (e.g. [user]).`);
     }
+    if (o.config !== undefined && (typeof o.config !== 'object' || o.config === null || Array.isArray(o.config))) {
+        throw new Error(`fleet: ${where}.config must be a mapping of config keys to values.`);
+    }
     return {
         agents: o.agents,
         sync: o.sync,
         login: validateLogin(o.login, where),
+        // `config:` is operator config (`agents devices config`); inert to the
+        // reconcile engine but part of the manifest shape.
+        config: o.config,
     };
 }
 /** Validate a raw `fleet:` object (already YAML-parsed) into a typed manifest. */
@@ -58,17 +64,10 @@ export function parseFleetManifest(raw) {
         const map = {};
         for (const [name, ov] of Object.entries(o.devices)) {
             // An empty entry (`device: {}`) inherits defaults — represent as {}.
-            const merged = ov == null ? {} : validateDefaults(ov, `devices.${name}`);
-            // `config:` is the operator-config block (`agents devices config`) —
-            // inert to the reconcile engine but part of the manifest shape.
-            const cfg = ov != null ? ov.config : undefined;
-            if (cfg !== undefined) {
-                if (typeof cfg !== 'object' || cfg === null || Array.isArray(cfg)) {
-                    throw new Error(`fleet: devices.${name}.config must be a mapping of config keys to values.`);
-                }
-                merged.config = cfg;
-            }
-            map[name] = merged;
+            // (A per-device `config:` here is the LEGACY #2458 store — parsed through
+            // so reads stay lossless, folded into the per-device doc by the config
+            // migration, never written by current code.)
+            map[name] = ov == null ? {} : validateDefaults(ov, `devices.${name}`);
         }
         devices = map;
     }
@@ -76,6 +75,19 @@ export function parseFleetManifest(raw) {
         throw new Error(`fleet: devices must be the string 'all' or a mapping of device -> overrides (got ${JSON.stringify(o.devices)}).`);
     }
     const manifest = { defaults, devices };
+    if (o.discovery !== undefined) {
+        if (typeof o.discovery !== 'object' || o.discovery === null || Array.isArray(o.discovery)) {
+            throw new Error('fleet: discovery must be a mapping of device name to approved or ignored.');
+        }
+        const discovery = {};
+        for (const [name, status] of Object.entries(o.discovery)) {
+            if (status !== 'approved' && status !== 'ignored') {
+                throw new Error(`fleet: discovery.${name} must be approved or ignored.`);
+            }
+            discovery[name] = status;
+        }
+        manifest.discovery = discovery;
+    }
     // Additive, backward-compatible extras (captured by `agents fleet capture`).
     if (o.secrets !== undefined) {
         if (typeof o.secrets !== 'object' || o.secrets === null || Array.isArray(o.secrets)) {

package/dist/lib/fleet/types.d.ts

@@ -27,6 +27,14 @@ export interface FleetDefaults {
     sync?: string[];
     /** Login propagation strategy. Default `'sync'`. */
     login?: FleetLoginMode;
+    /**
+     * Fleet-wide config defaults (`agents devices config --fleet <key> <value>`)
+     * — the middle layer of the device-config store: built-in default <
+     * `fleet.defaults.config` < per-device `devices/<name>/agents.yaml`
+     * `config:`. Inert to the reconcile engine (apply never pushes it; it takes
+     * effect through the config read path). Names and non-secret values only.
+     */
+    config?: Record<string, unknown>;
 }
 /** Per-device override; any omitted field inherits from `defaults`. */
 export interface FleetDeviceOverride {
@@ -34,12 +42,10 @@ export interface FleetDeviceOverride {
     sync?: string[];
     login?: FleetLoginMode;
     /**
-     * Operator config for this device, written by `agents devices config <name>`
-     * — the device-scope keys of the `lib/device-config.ts` registry (maxAgents,
-     * schedulerEnabled, ssh*, autoLaunch*, notes, …). This is the ONE store for
-     * per-device settings: central, synced, and backed up with agents.yaml.
-     * LEAK-FREE like the rest of the manifest — names and non-secret values only
-     * (a secrets-bundle NAME is fine; a credential value never is).
+     * LEGACY home of per-device operator config (#2458); the current store is the
+     * per-device doc `devices/<name>/agents.yaml` `config:` block. Existing
+     * values are folded into the device doc by lib/devices/config-migration.ts
+     * and stripped here — current code never writes this field.
      */
     config?: Record<string, unknown>;
 }
@@ -68,6 +74,12 @@ export interface FleetManifest {
     };
     /** Routine NAMES that should be active on the fleet (files sync via the repo). */
     routines?: string[];
+    /**
+     * Portable user decisions for Tailscale discovery. A name maps to `approved`
+     * or `ignored`; absence means pending. Connection metadata remains in each
+     * machine's local device registry and is never committed.
+     */
+    discovery?: Record<string, 'approved' | 'ignored'>;
 }
 /**
  * A device's desired state after merging defaults with its override and
@@ -118,7 +130,7 @@ export interface DeviceProbe {
     note?: string;
 }
 /** One planned action against a device, in a single reconcile dimension. */
-export type FleetActionKind = 'install-cli' | 'upgrade-cli' | 'add-agent' | 'sync-config' | 'push-login' | 'needs-login'
+export type FleetActionKind = 'install-cli' | 'upgrade-cli' | 'add-agent' | 'sync-config' | 'needs-login'
 /** Push a declared secrets bundle to the device over SSH. Opt-in only
  * (`--provision-secrets`) and gated on a pinned host key, because this moves
  * credential VALUES to another machine (RUSH-1968). */

package/dist/lib/fleet-cache.d.ts

@@ -12,7 +12,7 @@
  * `runFleetStatusPublish` for the fleet-status mirror); this module is the read
  * side only.
  */
-import { type UsageSnapshot } from './usage.js';
+import { type UsageSnapshot } from './accounting/usage.js';
 import { type FleetStatusRow } from './fleet-status.js';
 /**
  * The fleet-status union the daemon publishes (own row) and the fleet-status

package/dist/lib/fleet-cache.js

@@ -12,7 +12,7 @@
  * `runFleetStatusPublish` for the fleet-status mirror); this module is the read
  * side only.
  */
-import { readClaudeUsageCache } from './usage.js';
+import { readClaudeUsageCache } from './accounting/usage.js';
 import { readHeadroomEntry } from './usage-refresh.js';
 import { readFleetStatus as readFleetStatusMirror } from './fleet-status.js';
 /**

package/dist/lib/format.d.ts

@@ -50,6 +50,25 @@ export declare function truncate(s: string, max: number): string;
 export declare function relTime(iso: string): string;
 /** Format a millisecond duration as "45s", "3m", "2h 5m", "1d 3h". */
 export declare function humanDuration(ms: number): string;
+/**
+ * Human-readable byte size. Previously copy-pasted into five files
+ * (`commands/prune.ts`, `commands/share.ts`, `commands/inspect.ts`,
+ * `commands/sessions.ts`, `lib/browser/sessions-list.ts`) — this is the
+ * canonical home.
+ */
+export declare function formatBytes(n: number): string;
+/**
+ * True when an error came from the user cancelling a prompt (Ctrl+C).
+ *
+ * Lives here rather than in `commands/utils.ts` so `lib/` callers
+ * (`drift-sync.ts`, `refresh.ts`) don't have to import upward out of `lib/`
+ * into the command layer. `commands/utils.ts` re-exports it.
+ */
+export declare function isPromptCancelled(err: unknown): boolean;
+/** True when stdin/stdout are attached to a real terminal. */
+export declare function isInteractiveTerminal(): boolean;
+/** Parse a comma-separated CLI list, trimming whitespace and dropping empties. */
+export declare function parseCommaSeparatedList(value: string | undefined): string[];
 /**
  * Visible column width of `s`, ignoring ANSI SGR color codes (e.g. chalk
  * wrappers). Matches the full CSI sequence including the `\x1b` escape.

package/dist/lib/format.js

@@ -9,7 +9,7 @@
  */
 import chalk from 'chalk';
 import { readSync } from 'node:fs';
-import { emitFriction } from './events.js';
+import { emitFriction } from './feed/events.js';
 /**
  * Render a fatal error to the right stream. Pure — no I/O, no `process.exit` — so
  * the human-vs-agent split is unit-testable. A `--json` caller gets
@@ -97,6 +97,49 @@ export function humanDuration(ms) {
     const hh = h % 24;
     return hh ? `${d}d ${hh}h` : `${d}d`;
 }
+/**
+ * Human-readable byte size. Previously copy-pasted into five files
+ * (`commands/prune.ts`, `commands/share.ts`, `commands/inspect.ts`,
+ * `commands/sessions.ts`, `lib/browser/sessions-list.ts`) — this is the
+ * canonical home.
+ */
+export function formatBytes(n) {
+    if (n < 1024)
+        return `${n} B`;
+    const units = ['KB', 'MB', 'GB', 'TB'];
+    let size = n / 1024;
+    let unit = 0;
+    while (size >= 1024 && unit < units.length - 1) {
+        size /= 1024;
+        unit++;
+    }
+    return `${size < 10 ? size.toFixed(1) : Math.round(size)} ${units[unit]}`;
+}
+/**
+ * True when an error came from the user cancelling a prompt (Ctrl+C).
+ *
+ * Lives here rather than in `commands/utils.ts` so `lib/` callers
+ * (`drift-sync.ts`, `refresh.ts`) don't have to import upward out of `lib/`
+ * into the command layer. `commands/utils.ts` re-exports it.
+ */
+export function isPromptCancelled(err) {
+    return err instanceof Error && (err.name === 'ExitPromptError' ||
+        err.message.includes('force closed') ||
+        err.message.includes('User force closed'));
+}
+/** True when stdin/stdout are attached to a real terminal. */
+export function isInteractiveTerminal() {
+    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+/** Parse a comma-separated CLI list, trimming whitespace and dropping empties. */
+export function parseCommaSeparatedList(value) {
+    if (!value)
+        return [];
+    return value
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
 /**
  * Visible column width of `s`, ignoring ANSI SGR color codes (e.g. chalk
  * wrappers). Matches the full CSI sequence including the `\x1b` escape.