@phnx-labs/agents-cli 1.22.41 → 1.22.43

package/dist/lib/browser/drivers/local.d.ts

@@ -1,8 +1,14 @@
 import { CDPClient } from '../cdp.js';
-import type { BrowserProfile } from '../types.js';
+import type { BrowserProfile, ConnectionKey } from '../types.js';
 export interface LocalConnection {
     cdp: CDPClient;
     port: number;
     pid: number;
 }
-export declare function connectLocal(endpoint: string, profile: BrowserProfile): Promise<LocalConnection>;
+export declare function connectLocal(endpoint: string, profile: BrowserProfile, 
+/**
+ * Runtime key (`<profile>@<endpoint>`) the launched browser's user-data-dir,
+ * pid, and port files are stored under. Separate from `profile.name`, which
+ * stays the bare user-facing name and appears only in messages (RUSH-2709).
+ */
+key: ConnectionKey): Promise<LocalConnection>;

package/dist/lib/browser/drivers/local.js

@@ -31,7 +31,13 @@ const TUNNEL_PROCESS_NAMES = new Set(['ssh', 'autossh', 'mosh-client', 'socat'])
 function isTunnelProcess(command) {
     return TUNNEL_PROCESS_NAMES.has(command.toLowerCase());
 }
-export async function connectLocal(endpoint, profile) {
+export async function connectLocal(endpoint, profile, 
+/**
+ * Runtime key (`<profile>@<endpoint>`) the launched browser's user-data-dir,
+ * pid, and port files are stored under. Separate from `profile.name`, which
+ * stays the bare user-facing name and appears only in messages (RUSH-2709).
+ */
+key) {
     const url = new URL(endpoint);
     if (url.protocol !== 'cdp:') {
         throw new Error(`Invalid local endpoint: ${endpoint}`);
@@ -91,7 +97,7 @@ export async function connectLocal(endpoint, profile) {
         const chromeOpts = { ...profile.chrome, viewport: profile.viewport };
         let launched;
         try {
-            launched = await launchBrowser(profile.name, profile.browser, newPort, chromeOpts, profile.secrets, profile.binary, profile.electron === true);
+            launched = await launchBrowser(key, profile.browser, newPort, chromeOpts, profile.secrets, profile.binary, profile.electron === true);
         }
         catch (launchErr) {
             const reason = launchErr instanceof Error ? launchErr.message : String(launchErr);

package/dist/lib/browser/drivers/ssh.d.ts

@@ -1,5 +1,5 @@
 import { CDPClient } from '../cdp.js';
-import type { BrowserProfile } from '../types.js';
+import type { BrowserProfile, ConnectionKey } from '../types.js';
 import { shellQuote } from '../../ssh-exec.js';
 export { shellQuote };
 export interface SSHConnection {
@@ -16,7 +16,13 @@ export interface SSHConnection {
  * strings differ (no `&` backgrounding, no `lsof`, `.exe` instead of `.app`).
  */
 export type RemoteOs = 'windows' | 'posix';
-export declare function connectSSH(endpoint: string, profile: BrowserProfile): Promise<SSHConnection>;
+export declare function connectSSH(endpoint: string, profile: BrowserProfile, 
+/**
+ * Runtime key (`<profile>@<endpoint>`) this connection is stored under. It
+ * keys the tunnel's runtime record; `profile.name` is the bare, user-facing
+ * name and appears only in messages (RUSH-2709).
+ */
+key: ConnectionKey): Promise<SSHConnection>;
 /**
  * Wrap a PowerShell script as a `-EncodedCommand` invocation. Base64 of the
  * UTF-16LE bytes is a single quote-free token, so it rides through Node spawn

package/dist/lib/browser/drivers/ssh.js

@@ -11,9 +11,15 @@ export { shellQuote };
 // The `ssh -L` tunnel spawn is shared with `agents computer --device`; it lives in
 // the single ssh-tunnel helper. Calling it with no options preserves this
 // driver's original foreground, stderr-captured behavior exactly.
-import { startSSHTunnel } from '../../ssh-tunnel.js';
+import { startSSHTunnel } from '../../computer/ssh-tunnel.js';
 import { encodePwshBase64 } from '../../pwsh.js';
-export async function connectSSH(endpoint, profile) {
+export async function connectSSH(endpoint, profile, 
+/**
+ * Runtime key (`<profile>@<endpoint>`) this connection is stored under. It
+ * keys the tunnel's runtime record; `profile.name` is the bare, user-facing
+ * name and appears only in messages (RUSH-2709).
+ */
+key) {
     const url = new URL(endpoint);
     if (url.protocol !== 'ssh:') {
         throw new Error(`Invalid SSH endpoint: ${endpoint}`);
@@ -88,7 +94,7 @@ export async function connectSSH(endpoint, profile) {
     // browser process.
     const tunnelPid = tunnel.pid ?? 0;
     if (tunnelPid > 0) {
-        writeProfileRuntime(profile.name, {
+        writeProfileRuntime(key, {
             pid: 0,
             port: localPort,
             command: 'ssh',
@@ -108,7 +114,7 @@ export async function connectSSH(endpoint, profile) {
             // stays synchronous, and killRemoteBrowser never rejects.
             killRemoteBrowser(user, host, remoteOs, remotePort).catch(() => { });
             tunnel.kill();
-            clearProfileRuntime(profile.name);
+            clearProfileRuntime(key);
         },
     };
 }

package/dist/lib/browser/hygiene.d.ts

@@ -1,5 +1,5 @@
 import { type PidSessionEntry } from '../session/pid-registry.js';
-import type { ReapResult, Task } from './types.js';
+import { type ReapResult, type Task } from './types.js';
 /** Default idle window before an untouched task is reaped. */
 export declare const DEFAULT_IDLE_MS: number;
 /**

package/dist/lib/browser/hygiene.js

@@ -28,6 +28,7 @@
  */
 import { isPidAlive, isSessionIdLiveOnProcessTable } from '../session/active.js';
 import { listPidSessionEntries, sessionIdFromLivePid } from '../session/pid-registry.js';
+import { parseConnectionKey } from './types.js';
 /** Default idle window before an untouched task is reaped. */
 export const DEFAULT_IDLE_MS = 30 * 60_000;
 /**
@@ -131,7 +132,10 @@ export async function reapAbandonedTasks(service, opts = {}) {
             continue;
         }
         if (opts.dryRun) {
-            closed.push({ task: task.name, profile, reason });
+            // Report the BARE profile, exactly as the real run does below — `profile`
+            // here is the runtime key from `listTasks()`, and printing the two shapes
+            // in one column made `gc --dry-run` and `gc` disagree (RUSH-2709).
+            closed.push({ task: task.name, profile: parseConnectionKey(profile).profile, reason });
             continue;
         }
         const result = await service.stop(task.name);

package/dist/lib/browser/profiles.d.ts

@@ -1,6 +1,30 @@
 import type { BrowserProfile } from './types.js';
 export type { BrowserProfile } from './types.js';
-export declare const DEFAULT_BROWSER_PROFILE_NAME = "default";
+/**
+ * Name of the profile `ensureDefaultBrowserProfile` auto-detects and pins.
+ *
+ * It is `auto-chrome`, NOT `default`, since RUSH-2709: `default` used to be
+ * both this concrete profile AND the alias meaning "whatever profile the user
+ * configured", so `--profile default` landed on a literal auto-detected Chrome
+ * on one command and on the user's configured Comet on another. The alias now
+ * lives alone in {@link DEFAULT_PROFILE_ALIAS} and resolves in exactly one
+ * place ({@link resolveProfileRef}).
+ */
+export declare const DEFAULT_BROWSER_PROFILE_NAME = "auto-chrome";
+/**
+ * What older builds named the auto-detected profile. Still honored everywhere:
+ * a user whose machine already carries a `default` profile keeps using it (and
+ * its running browser + runtime dirs) rather than having a second one created
+ * beside it.
+ */
+export declare const LEGACY_DEFAULT_BROWSER_PROFILE_NAME = "default";
+/**
+ * The reserved ALIAS. `--profile default` (and a `browser.profile` config value
+ * of `default`) means "the configured default profile", not a profile called
+ * `default` — unless a profile literally named `default` exists, which still
+ * wins, so no existing config breaks.
+ */
+export declare const DEFAULT_PROFILE_ALIAS = "default";
 /**
  * Where a profile is stored, and therefore who sees it:
  *   - `local` — this machine's `devices/<machine>/agents.yaml` (`deviceBrowser`)
@@ -75,6 +99,55 @@ export declare function isProfileLaunchableHere(profile: BrowserProfile): boolea
  * that no longer exists, or can't launch here, warns and falls through — never a
  * hard fail.
  */
+/**
+ * The auto-detected profile this machine already carries, under either name —
+ * the current `auto-chrome` or the `default` an older build wrote. Callers that
+ * ask "is a default profile set up here?" MUST use this rather than probing one
+ * name, or a machine that predates the RUSH-2709 rename grows a second one.
+ */
+export declare function getAutoDetectedProfile(): Promise<BrowserProfile | null>;
+/**
+ * Resolve what a caller typed after `--profile` to a real, BARE profile name.
+ * Every command — stop, status, navigate, tab, use, and (through
+ * {@link resolveProfileRefForStart}) start — routes through this one function,
+ * which is the whole point: before RUSH-2709 only `start` honored the reserved
+ * `default` alias, so `--profile default` meant three different profiles across
+ * three commands.
+ *
+ * Order:
+ *   1. A profile that literally bears the given name always wins — including
+ *      one a user genuinely named `default`, which resolves to itself.
+ *   2. `default` (the alias) or no argument at all → the configured
+ *      `browser.profile` for this machine, if it names a profile that exists.
+ *   3. → the auto-detected profile ({@link DEFAULT_BROWSER_PROFILE_NAME}), or
+ *      its legacy `default`-named predecessor when that is what is on disk.
+ *   4. Otherwise the input is returned unchanged (so the caller reports its own
+ *      `Profile "x" not found`), or `undefined` when nothing was passed.
+ *
+ * It never creates a profile, never warns, and never checks whether the profile
+ * can launch HERE. That is deliberate: for most callers `--profile` is a FILTER
+ * (`status`, `tasks`, `navigate --task`), where an absent flag means "no filter"
+ * and rewriting or warning about the user's config would be wrong. Note the
+ * corollary at those call sites — pass a ref only when the user gave one; do not
+ * resolve `undefined` into a concrete profile, or an unscoped listing silently
+ * becomes a scoped one.
+ */
+export declare function resolveProfileRef(ref?: string): Promise<string | undefined>;
+/**
+ * `start`'s resolver. Same order as {@link resolveProfileRef} for an explicit
+ * name, but the IMPLICIT path (no `--profile`, or the bare `default` alias with
+ * no profile of that name) goes through {@link ensureDefaultBrowserProfile} —
+ * which additionally verifies the resolved default can launch on THIS machine,
+ * warns and falls through when it can't, and regenerates or creates one.
+ *
+ * `start` is the only command that launches a browser, so it is the only one
+ * that may do those things; routing a filter-only command through this would
+ * warn about, and rewrite, config the user never asked it to touch.
+ *
+ * Throws when no profile exists and no supported browser is installed —
+ * `ensureDefaultBrowserProfile`'s actionable "install one of …" error.
+ */
+export declare function resolveProfileRefForStart(ref?: string): Promise<string>;
 export declare function ensureDefaultBrowserProfile(): Promise<BrowserProfile>;
 /**
  * Compute the LOCAL port a profile will occupy at runtime:

package/dist/lib/browser/profiles.js

@@ -3,7 +3,31 @@ import { getBrowserRuntimeDir as getBrowserRuntimeDirRoot, readMeta, updateMeta,
 import { getConfigValue } from '../device-config.js';
 import { findBrowserPath, findFirstInstalledBrowser, isPortInUse } from './chrome.js';
 import { DEFAULT_VIEWPORT } from './devices.js';
-export const DEFAULT_BROWSER_PROFILE_NAME = 'default';
+/**
+ * Name of the profile `ensureDefaultBrowserProfile` auto-detects and pins.
+ *
+ * It is `auto-chrome`, NOT `default`, since RUSH-2709: `default` used to be
+ * both this concrete profile AND the alias meaning "whatever profile the user
+ * configured", so `--profile default` landed on a literal auto-detected Chrome
+ * on one command and on the user's configured Comet on another. The alias now
+ * lives alone in {@link DEFAULT_PROFILE_ALIAS} and resolves in exactly one
+ * place ({@link resolveProfileRef}).
+ */
+export const DEFAULT_BROWSER_PROFILE_NAME = 'auto-chrome';
+/**
+ * What older builds named the auto-detected profile. Still honored everywhere:
+ * a user whose machine already carries a `default` profile keeps using it (and
+ * its running browser + runtime dirs) rather than having a second one created
+ * beside it.
+ */
+export const LEGACY_DEFAULT_BROWSER_PROFILE_NAME = 'default';
+/**
+ * The reserved ALIAS. `--profile default` (and a `browser.profile` config value
+ * of `default`) means "the configured default profile", not a profile called
+ * `default` — unless a profile literally named `default` exists, which still
+ * wins, so no existing config breaks.
+ */
+export const DEFAULT_PROFILE_ALIAS = 'default';
 /**
  * True for a profile whose contents only make sense on THIS machine, so it must
  * live in the per-machine doc rather than the fleet-synced agents.yaml.
@@ -21,7 +45,7 @@ export const DEFAULT_BROWSER_PROFILE_NAME = 'default';
  * into central from being written back there by {@link updateProfile}.
  */
 function isMachineLocalProfile(name) {
-    return name === DEFAULT_BROWSER_PROFILE_NAME;
+    return name === DEFAULT_BROWSER_PROFILE_NAME || name === LEGACY_DEFAULT_BROWSER_PROFILE_NAME;
 }
 /**
  * The device-local configured default profile name (set via
@@ -178,9 +202,86 @@ export function isProfileLaunchableHere(profile) {
  * that no longer exists, or can't launch here, warns and falls through — never a
  * hard fail.
  */
+/**
+ * The auto-detected profile this machine already carries, under either name —
+ * the current `auto-chrome` or the `default` an older build wrote. Callers that
+ * ask "is a default profile set up here?" MUST use this rather than probing one
+ * name, or a machine that predates the RUSH-2709 rename grows a second one.
+ */
+export async function getAutoDetectedProfile() {
+    return ((await getProfile(DEFAULT_BROWSER_PROFILE_NAME)) ??
+        (await getProfile(LEGACY_DEFAULT_BROWSER_PROFILE_NAME)));
+}
+/**
+ * Resolve what a caller typed after `--profile` to a real, BARE profile name.
+ * Every command — stop, status, navigate, tab, use, and (through
+ * {@link resolveProfileRefForStart}) start — routes through this one function,
+ * which is the whole point: before RUSH-2709 only `start` honored the reserved
+ * `default` alias, so `--profile default` meant three different profiles across
+ * three commands.
+ *
+ * Order:
+ *   1. A profile that literally bears the given name always wins — including
+ *      one a user genuinely named `default`, which resolves to itself.
+ *   2. `default` (the alias) or no argument at all → the configured
+ *      `browser.profile` for this machine, if it names a profile that exists.
+ *   3. → the auto-detected profile ({@link DEFAULT_BROWSER_PROFILE_NAME}), or
+ *      its legacy `default`-named predecessor when that is what is on disk.
+ *   4. Otherwise the input is returned unchanged (so the caller reports its own
+ *      `Profile "x" not found`), or `undefined` when nothing was passed.
+ *
+ * It never creates a profile, never warns, and never checks whether the profile
+ * can launch HERE. That is deliberate: for most callers `--profile` is a FILTER
+ * (`status`, `tasks`, `navigate --task`), where an absent flag means "no filter"
+ * and rewriting or warning about the user's config would be wrong. Note the
+ * corollary at those call sites — pass a ref only when the user gave one; do not
+ * resolve `undefined` into a concrete profile, or an unscoped listing silently
+ * becomes a scoped one.
+ */
+export async function resolveProfileRef(ref) {
+    if (ref && ref !== DEFAULT_PROFILE_ALIAS) {
+        return ref;
+    }
+    if (ref === DEFAULT_PROFILE_ALIAS && (await getProfile(ref))) {
+        // A profile the user literally named `default` outranks the alias.
+        return ref;
+    }
+    const configured = getConfiguredDefaultProfileName();
+    if (configured && configured !== DEFAULT_PROFILE_ALIAS && (await getProfile(configured))) {
+        return configured;
+    }
+    if (await getProfile(DEFAULT_BROWSER_PROFILE_NAME))
+        return DEFAULT_BROWSER_PROFILE_NAME;
+    if (await getProfile(LEGACY_DEFAULT_BROWSER_PROFILE_NAME)) {
+        return LEGACY_DEFAULT_BROWSER_PROFILE_NAME;
+    }
+    return ref;
+}
+/**
+ * `start`'s resolver. Same order as {@link resolveProfileRef} for an explicit
+ * name, but the IMPLICIT path (no `--profile`, or the bare `default` alias with
+ * no profile of that name) goes through {@link ensureDefaultBrowserProfile} —
+ * which additionally verifies the resolved default can launch on THIS machine,
+ * warns and falls through when it can't, and regenerates or creates one.
+ *
+ * `start` is the only command that launches a browser, so it is the only one
+ * that may do those things; routing a filter-only command through this would
+ * warn about, and rewrite, config the user never asked it to touch.
+ *
+ * Throws when no profile exists and no supported browser is installed —
+ * `ensureDefaultBrowserProfile`'s actionable "install one of …" error.
+ */
+export async function resolveProfileRefForStart(ref) {
+    if (ref && ref !== DEFAULT_PROFILE_ALIAS)
+        return ref;
+    // A profile the user literally named `default` still outranks the alias.
+    if (ref === DEFAULT_PROFILE_ALIAS && (await getProfile(ref)))
+        return ref;
+    return (await ensureDefaultBrowserProfile()).name;
+}
 export async function ensureDefaultBrowserProfile() {
     const configured = getConfiguredDefaultProfileName();
-    if (configured) {
+    if (configured && configured !== DEFAULT_PROFILE_ALIAS) {
         const chosen = await getProfile(configured);
         if (chosen && isProfileLaunchableHere(chosen))
             return chosen;
@@ -191,7 +292,12 @@ export async function ensureDefaultBrowserProfile() {
             : `warning: configured default browser profile "${configured}" no longer exists; ` +
                 `falling back to auto-detect. Fix with: agents browser use <name>  (or --unset)`);
     }
-    const existing = await getProfile(DEFAULT_BROWSER_PROFILE_NAME);
+    // Prefer whichever auto-detected profile this machine already carries: the
+    // current `auto-chrome`, else the `default` an older build wrote. Reusing the
+    // legacy one is what keeps a currently-running browser (and its runtime dirs,
+    // keyed `default@endpoint-0`) attached after the rename.
+    const existing = (await getProfile(DEFAULT_BROWSER_PROFILE_NAME)) ??
+        (await getProfile(LEGACY_DEFAULT_BROWSER_PROFILE_NAME));
     if (existing && isProfileLaunchableHere(existing))
         return existing;
     const detected = findFirstInstalledBrowser();
@@ -204,7 +310,10 @@ export async function ensureDefaultBrowserProfile() {
     }
     const freePort = await findFreeProfilePort();
     const profile = {
-        name: DEFAULT_BROWSER_PROFILE_NAME,
+        // Regenerate under the name that is already on disk when there is one, so a
+        // stale legacy `default` is repaired in place instead of leaving the user
+        // with two auto-detected profiles.
+        name: existing?.name ?? DEFAULT_BROWSER_PROFILE_NAME,
         description: `Auto-detected ${detected.browserType} profile`,
         browser: detected.browserType,
         binary: detected.binary,

package/dist/lib/browser/runtime-state.d.ts

@@ -1,4 +1,5 @@
 import { type ProfileScope } from './profiles.js';
+import { type ProfileName } from './types.js';
 /**
  * Per-profile runtime files we persist under
  * `~/.agents/.cache/browser/<composite>/`:
@@ -55,12 +56,16 @@ export declare function clearProfileRuntime(profileName: string): void;
  */
 export declare function removeProfileCache(profileName: string): void;
 /**
- * Find every cache directory belonging to a given profile. The composite
- * naming (`<name>@<endpoint>`) means a single agents-cli profile can have
- * multiple runtime dirs side by side; this finds them all plus the legacy
+ * Find every cache directory belonging to a given profile. A runtime dir name
+ * IS a connection key (`<name>@<endpoint>[.<fork>]`), so a single agents-cli
+ * profile can have several side by side; this finds them all, plus the legacy
  * non-composite dir from older builds.
+ *
+ * Membership is decided by {@link keyBelongsToProfile} — the same single rule
+ * `status`, `stopProfile`, and `findTask` use (RUSH-2709), so a fork dir is no
+ * longer missed here while being matched there.
  */
-export declare function listProfileCacheDirs(profileName: string): string[];
+export declare function listProfileCacheDirs(profileName: ProfileName): string[];
 /**
  * `process.kill(pid, 0)` answers "is a process with this id alive?" — but
  * pid reuse is real on long-uptime machines, and a stale cache pointing
@@ -162,7 +167,8 @@ export declare const PRUNE_REASON_TEXT: Record<PruneReason, string>;
  *   - **in use** — a live browser, SSH tunnel, or open task on any of its dirs.
  *   - **the configured default** — this machine resolves a bare
  *     `agents browser start` to it; removing it breaks that command.
- *   - **`default`** — auto-regenerated by `ensureDefaultBrowserProfile`, so
+ *   - **the auto-detected profile** (`auto-chrome`, or the `default` an older
+ *     build wrote) — auto-regenerated by `ensureDefaultBrowserProfile`, so
  *     pruning it is pure churn.
  *   - **fleet-synced** — deleting one removes it from EVERY machine, so it takes
  *     the explicit `includeFleet` opt-in.

package/dist/lib/browser/runtime-state.js

@@ -1,7 +1,8 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
-import { getProfileRuntimeDir, getBrowserRuntimeDir, listProfilesWithScope, getConfiguredDefaultProfileName, isProfileLaunchableHere, deleteProfile, DEFAULT_BROWSER_PROFILE_NAME, } from './profiles.js';
+import { getProfileRuntimeDir, getBrowserRuntimeDir, listProfilesWithScope, getConfiguredDefaultProfileName, isProfileLaunchableHere, deleteProfile, DEFAULT_BROWSER_PROFILE_NAME, LEGACY_DEFAULT_BROWSER_PROFILE_NAME, } from './profiles.js';
+import { keyBelongsToProfile } from './types.js';
 const PID_FILE = 'pid';
 const PORT_FILE = 'port';
 const COMMAND_FILE = 'command';
@@ -106,10 +107,14 @@ export function removeProfileCache(profileName) {
     catch { /* gone */ }
 }
 /**
- * Find every cache directory belonging to a given profile. The composite
- * naming (`<name>@<endpoint>`) means a single agents-cli profile can have
- * multiple runtime dirs side by side; this finds them all plus the legacy
+ * Find every cache directory belonging to a given profile. A runtime dir name
+ * IS a connection key (`<name>@<endpoint>[.<fork>]`), so a single agents-cli
+ * profile can have several side by side; this finds them all, plus the legacy
  * non-composite dir from older builds.
+ *
+ * Membership is decided by {@link keyBelongsToProfile} — the same single rule
+ * `status`, `stopProfile`, and `findTask` use (RUSH-2709), so a fork dir is no
+ * longer missed here while being matched there.
  */
 export function listProfileCacheDirs(profileName) {
     const root = getBrowserRuntimeDir();
@@ -117,9 +122,7 @@ export function listProfileCacheDirs(profileName) {
         return [];
     const matches = [];
     for (const entry of fs.readdirSync(root)) {
-        if (entry === profileName)
-            matches.push(path.join(root, entry));
-        else if (entry.startsWith(`${profileName}@`))
+        if (keyBelongsToProfile(entry, profileName))
             matches.push(path.join(root, entry));
     }
     return matches;
@@ -292,7 +295,8 @@ export const PRUNE_REASON_TEXT = {
  *   - **in use** — a live browser, SSH tunnel, or open task on any of its dirs.
  *   - **the configured default** — this machine resolves a bare
  *     `agents browser start` to it; removing it breaks that command.
- *   - **`default`** — auto-regenerated by `ensureDefaultBrowserProfile`, so
+ *   - **the auto-detected profile** (`auto-chrome`, or the `default` an older
+ *     build wrote) — auto-regenerated by `ensureDefaultBrowserProfile`, so
  *     pruning it is pure churn.
  *   - **fleet-synced** — deleting one removes it from EVERY machine, so it takes
  *     the explicit `includeFleet` opt-in.
@@ -310,7 +314,7 @@ export function planProfilePrune(profiles, opts = {}) {
             keep('fleet-synced (pass --fleet to include it)');
             continue;
         }
-        if (name === DEFAULT_BROWSER_PROFILE_NAME) {
+        if (name === DEFAULT_BROWSER_PROFILE_NAME || name === LEGACY_DEFAULT_BROWSER_PROFILE_NAME) {
             keep('the auto-detected default profile');
             continue;
         }

package/dist/lib/browser/service.d.ts

@@ -1,6 +1,6 @@
 import { CDPClient } from './cdp.js';
 import { type ResolvedDomainSkill } from './domain-skills.js';
-import { type Task, type TabInfo, type ProfileStatus, type BrowserType, type HistoricalTask, type ReapResult } from './types.js';
+import { type Task, type TabInfo, type ProfileStatus, type BrowserType, type HistoricalTask, type ReapResult, type ProfileName, type ConnectionKey } from './types.js';
 import { type ReapOptions } from './hygiene.js';
 import { type RefOpts, type RefNode } from './refs.js';
 import type { TargetFilter } from './types.js';
@@ -60,19 +60,15 @@ interface ProfileConnection {
     /** Raw `url:<v>` / `title:<v>` filter copied from the profile config. */
     targetFilter?: string;
     /**
-     * The composite key this connection is registered under in `this.connections`
-     * (`<profile>` / `<profile>@<endpoint>` / `<profile>.<fork>`). It is the same
-     * name used to key the profile's runtime dir, so downloads and session
-     * captures land under `.cache/browser/<profileName>/`. Set at registration.
+     * The runtime key this connection is registered under in `this.connections`
+     * (`<profile>@<endpoint>`, plus `.<fork>` for an Electron fork; a bare name
+     * for a legacy pre-composite dir). Also keys the profile's runtime dir, so
+     * downloads and session captures land under `.cache/browser/<key>/`.
      */
-    profileName?: string;
-    /**
-     * Bare YAML profile name without the `@<endpoint>` suffix. Kept so
-     * `status --profile comet-local` matches the composite connection key
-     * `comet-local@endpoint-0` without prefix-matching wrong browsers.
-     */
-    bareName?: string;
-    forkedFrom?: string;
+    key?: ConnectionKey;
+    /** The bare, user-facing profile name this connection belongs to. */
+    profile?: ProfileName;
+    forkedFrom?: ConnectionKey;
     tasks: Map<string, Task>;
     windowId?: string;
     targetCache?: {
@@ -104,12 +100,6 @@ export declare function deriveTaskLabel(opts: {
     url?: string;
     existing?: string;
 }): string;
-/**
- * True when `key` is the bare profile name or one of its composite endpoint
- * keys (`name@endpoint`). Used by status/stop so `comet-local` matches
- * `comet-local@endpoint-0`.
- */
-export declare function connectionKeyMatchesProfile(key: string, profileName: string): boolean;
 type TargetInfo = {
     targetId: string;
     url?: string;
@@ -142,6 +132,12 @@ export declare function resolveTaskIdentity(forwarded: {
 };
 export declare class BrowserService {
     private static readonly SOURCE_PREFIX;
+    /**
+     * Live browsers, keyed by {@link ConnectionKey} — NOT by profile name. The
+     * branded key type is what makes `connections.get(someProfileName)` (the
+     * RUSH-2709 miss that made `status --profile <name>` return empty for a
+     * running `<name>@endpoint-0`) fail to compile.
+     */
     private connections;
     private forkingProfiles;
     private consoleLogs;
@@ -172,7 +168,10 @@ export declare class BrowserService {
         name: string;
         tabId?: string;
         windowId?: string;
-        profile: string;
+        /** BARE profile name — what the caller asked for, never the runtime key. */
+        profile: ProfileName;
+        /** Runtime key the task actually landed on (`<profile>@<endpoint>`). */
+        key: ConnectionKey;
         skill?: ResolvedDomainSkill;
     }>;
     /**
@@ -207,6 +206,25 @@ export declare class BrowserService {
      * page that has since redirected elsewhere simply does not match, and the
      * caller opens a tab as before.
      */
+    /** Is this CDP target already registered to any task on the connection? */
+    private targetIsClaimed;
+    /**
+     * The CDP targets a task may CLOSE — its own tabs minus any it merely
+     * borrowed. A borrowed tab existed before the task did (see `Task.borrowedTabs`),
+     * so closing it would remove something the task never opened.
+     */
+    private closeableTargetIds;
+    /**
+     * A page target that `navigate` may take over on a browser which cannot create
+     * tabs (Arc). Deliberately narrow: only a tab ALREADY showing the requested URL
+     * -- re-showing that document there is what the caller asked for -- or an empty
+     * new-tab page. A target any task already owns is left alone. Note the honest
+     * limit: reusing a matching tab still RELOADS it, discarding scroll position and
+     * unsaved form state. Arc cannot open a tab at all, so some intrusion is
+     * unavoidable to show the document; a reload is the smallest one, and the tab is
+     * borrowed rather than owned so it is never closed.
+     */
+    private pickReusableTargetWithoutCreate;
     private adoptTabShowing;
     /**
      * Every live task across every connected profile — the reaper's input
@@ -214,7 +232,7 @@ export declare class BrowserService {
      * daemon's live state, so callers only read it and act through `stop`.
      */
     listTasks(): Array<{
-        profile: string;
+        profile: ConnectionKey;
         task: Task;
     }>;
     /**
@@ -231,13 +249,13 @@ export declare class BrowserService {
         ok: boolean;
         profile?: string;
     }>;
-    stopProfile(profileName: string): Promise<void>;
-    navigate(taskId: string, url: string, profileName?: string): Promise<{
+    stopProfile(profileRef: ProfileName | ConnectionKey): Promise<void>;
+    navigate(taskId: string, url: string, profileRef?: ProfileName | ConnectionKey): Promise<{
         tabId: string;
         url: string;
         created: boolean;
     }>;
-    tabAdd(taskId: string, url: string, profileName?: string): Promise<{
+    tabAdd(taskId: string, url: string, profileRef?: ProfileName | ConnectionKey): Promise<{
         tabId: string;
         url: string;
     }>;
@@ -253,7 +271,7 @@ export declare class BrowserService {
     private resolveTabHint;
     private resolveCurrentTab;
     private getCdpTargetId;
-    tabs(taskId?: string, profileName?: string): Promise<TabInfo[]>;
+    tabs(taskId?: string, profileRef?: ProfileName | ConnectionKey): Promise<TabInfo[]>;
     tabClose(taskId: string, tabHint?: string): Promise<void>;
     evaluate(taskId: string, tabHint: string | undefined, expression: string): Promise<unknown>;
     screenshot(taskId: string, tabHint?: string, outputPath?: string, quality?: 'compressed' | 'raw'): Promise<{
@@ -335,7 +353,25 @@ export declare class BrowserService {
     stageUpload(source: string): {
         path: string;
     };
-    status(profileName?: string): Promise<ProfileStatus[]>;
+    /**
+     * Status for one profile (bare name) or every live profile.
+     *
+     * `profileName` is a {@link ProfileName} — a BARE name, never a runtime key.
+     * Every candidate is selected by the one rule ({@link keyBelongsToProfile}),
+     * and a scoped query that finds no live connection falls through to disk, so
+     * `status --profile comet-local` reports the LIVE `comet-local@endpoint-0`
+     * instead of the empty list it used to return (RUSH-2709).
+     */
+    status(profileRef?: ProfileName | ConnectionKey): Promise<ProfileStatus[]>;
+    /**
+     * Rebuild a profile's status from its runtime dirs when no live connection is
+     * registered — a daemon that never connected this profile, or a browser
+     * started by an earlier daemon.
+     *
+     * Takes a BARE profile name and walks every runtime key that belongs to it
+     * ({@link listProfileCacheDirs}), including the legacy pre-composite dir named
+     * exactly the profile.
+     */
     private reconcileFromDisk;
     private profileStatusFromDisk;
     setViewport(taskId: string, width: number, height: number, options?: {
@@ -400,9 +436,10 @@ export declare class BrowserService {
      * already resolved the endpoint and built the `effectiveProfile` with
      * the per-endpoint binary/targetFilter overrides applied; we just use it.
      *
-     * `effectiveProfile.name` is the composite identifier (`<profile>@<endpoint>`)
-     * so per-endpoint pid/port files don't collide when the same app runs
-     * locally and remotely at the same time.
+     * `key` is the runtime key (`<profile>@<endpoint>`) and is what every on-disk
+     * lookup uses, so per-endpoint pid/port files don't collide when the same app
+     * runs locally and remotely at the same time. It is a SEPARATE argument
+     * because `effectiveProfile.name` stays the bare, user-facing name (RUSH-2709).
      */
     private connectProfile;
     private connectEndpoint;
@@ -443,7 +480,7 @@ export declare class BrowserService {
     }): Promise<{
         conn: ProfileConnection;
         task: Task;
-        profileName: string;
+        key: ConnectionKey;
         created: boolean;
     } | null>;
     private listTasksForCaller;
@@ -491,6 +528,7 @@ export declare class BrowserService {
      */
     private rehydrateTaskFromDisk;
     private getTabsForTask;
+    /** Live status for ONE registered connection, addressed by its runtime key. */
     private getProfileStatus;
     private getTarget;
     private getSessionId;