@phnx-labs/agents-cli 1.22.42 → 1.22.44

package/dist/lib/session/watch.js

@@ -1,242 +1,3 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { createInterface } from 'node:readline';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { loadDevices, isControlDevice, isDialableDevice } from '../devices/registry.js';
-import { deviceIdentityArgs, sshTargetFor } from '../devices/connect.js';
-import { machineId, normalizeHost } from '../machine-id.js';
-import { SSH_OPTS, controlOpts, shellQuote } from '../ssh-exec.js';
-import { buildWindowsAgentsCommand, remoteShellFor } from '../hosts/remote-cmd.js';
-import { activeSessionsJournalPath, activeSessionJournalIdentity, readActiveSessionsCache, } from './session-cache.js';
-export const SESSION_WATCH_VERSION = 1;
-export const SESSION_WATCH_HEARTBEAT_MS = 15_000;
-/** Stable, opaque identity for one row within one device scope. */
-export function sessionWatchRowKey(scope, row) {
-    const identity = activeSessionJournalIdentity(row);
-    return createHash('sha256').update(`${scope}\0${identity}`).digest('base64url').slice(0, 22);
-}
-export function toSessionWatchRow(scope, row) {
-    const rowKey = sessionWatchRowKey(scope, row);
-    const resumable = Boolean(row.sessionId);
-    const viewingIn = row.viewingIn
-        ? [row.viewingIn.app, row.viewingIn.tab ? `tab ${row.viewingIn.tab}` : undefined].filter(Boolean).join(' ')
-        : null;
-    return {
-        ...row,
-        rowKey,
-        sourceDevice: scope,
-        resumable,
-        unwatched: !viewingIn,
-        viewingIn,
-        recovery: resumable
-            ? { command: 'agents', args: ['sessions', 'resume', row.sessionId, '--device', scope], ...(row.cwd ? { cwd: row.cwd } : {}) }
-            : null,
-    };
-}
-function sameRow(a, b) {
-    return JSON.stringify(a) === JSON.stringify(b);
-}
-/** Stream-local sequencer and convergent row diff. */
-export class SessionWatchState {
-    streamId;
-    sequence = 0;
-    rows = new Map();
-    constructor(streamId = randomUUID()) { this.streamId = streamId; }
-    base(type) {
-        return { version: SESSION_WATCH_VERSION, type, streamId: this.streamId, sequence: ++this.sequence, capturedAt: Date.now() };
-    }
-    reset(scope, sourceRows) {
-        const rows = sourceRows.map((row) => toSessionWatchRow(scope, row));
-        this.rows.set(scope, new Map(rows.map((row) => [row.rowKey, row])));
-        return { ...this.base('reset'), scope, rows };
-    }
-    update(scope, sourceRows) {
-        const previous = this.rows.get(scope) ?? new Map();
-        const nextRows = sourceRows.map((row) => toSessionWatchRow(scope, row));
-        const next = new Map(nextRows.map((row) => [row.rowKey, row]));
-        const events = [];
-        for (const [rowKey, row] of next) {
-            if (!previous.has(rowKey) || !sameRow(previous.get(rowKey), row)) {
-                events.push({ ...this.base('upsert'), scope, rowKey, row });
-            }
-        }
-        for (const rowKey of previous.keys()) {
-            if (!next.has(rowKey))
-                events.push({ ...this.base('remove'), scope, rowKey });
-        }
-        this.rows.set(scope, next);
-        return events;
-    }
-    patch(scope, upserts, removes) {
-        const current = new Map(this.rows.get(scope) ?? []);
-        const events = [];
-        for (const source of upserts) {
-            const row = toSessionWatchRow(scope, source);
-            if (!current.has(row.rowKey) || !sameRow(current.get(row.rowKey), row)) {
-                current.set(row.rowKey, row);
-                events.push({ ...this.base('upsert'), scope, rowKey: row.rowKey, row });
-            }
-        }
-        for (const identity of removes) {
-            const rowKey = createHash('sha256').update(`${scope}\0${identity}`).digest('base64url').slice(0, 22);
-            if (current.delete(rowKey))
-                events.push({ ...this.base('remove'), scope, rowKey });
-        }
-        this.rows.set(scope, current);
-        return events;
-    }
-    scope(scope, status, reason) {
-        // Deliberately retain rows while unavailable. A reconnecting scope replaces
-        // them with a reset; transient fleet loss must not look like session death.
-        return { ...this.base('scope'), scope, status, ...(reason ? { reason } : {}) };
-    }
-    heartbeat(scope, capturedAt = Date.now()) {
-        return { ...this.base('heartbeat'), scope, capturedAt };
-    }
-}
-/**
- * Keep one local subscription alive. Startup reads one canonical reset snapshot;
- * steady state tails the canonical writer journal and never invokes a gather.
- */
-export async function watchLocalSessions(options) {
-    const state = new SessionWatchState();
-    const readCache = options.readCache ?? readActiveSessionsCache;
-    const journal = options.journalPath ?? activeSessionsJournalPath();
-    const heartbeatMs = options.heartbeatMs ?? SESSION_WATCH_HEARTBEAT_MS;
-    let offset = 0;
-    try {
-        offset = fs.statSync(journal).size;
-    }
-    catch { /* first publication */ }
-    const initial = readCache('local');
-    options.emit(state.reset(options.scope, initial?.sessions ?? []));
-    options.emit(state.scope(options.scope, initial ? 'available' : 'unavailable', initial ? undefined : 'awaiting publisher'));
-    if (options.signal.aborted)
-        return;
-    await new Promise((resolve) => {
-        let partial = '';
-        let reading = false;
-        const readAppended = () => {
-            if (reading || options.signal.aborted)
-                return;
-            reading = true;
-            try {
-                const size = fs.statSync(journal).size;
-                if (size < offset) {
-                    offset = 0;
-                    partial = '';
-                }
-                if (size === offset)
-                    return;
-                const fd = fs.openSync(journal, 'r');
-                try {
-                    const buffer = Buffer.alloc(size - offset);
-                    fs.readSync(fd, buffer, 0, buffer.length, offset);
-                    offset = size;
-                    const lines = (partial + buffer.toString('utf8')).split('\n');
-                    partial = lines.pop() ?? '';
-                    for (const line of lines) {
-                        if (!line)
-                            continue;
-                        try {
-                            const record = JSON.parse(line);
-                            if (record.version !== 1 || record.scope !== 'local' || !Array.isArray(record.upserts) || !Array.isArray(record.removes))
-                                continue;
-                            for (const event of state.patch(options.scope, record.upserts, record.removes))
-                                options.emit(event);
-                            options.emit(state.scope(options.scope, 'available'));
-                        }
-                        catch { /* partial/corrupt journal lines are not state */ }
-                    }
-                }
-                finally {
-                    fs.closeSync(fd);
-                }
-            }
-            catch { /* journal may not exist until the first publisher write */ }
-            finally {
-                reading = false;
-            }
-        };
-        fs.mkdirSync(path.dirname(journal), { recursive: true });
-        const journalListener = () => readAppended();
-        fs.watchFile(journal, { interval: options.journalPollMs ?? 250 }, journalListener);
-        const heartbeatTimer = setInterval(() => options.emit(state.heartbeat(options.scope)), heartbeatMs);
-        const stop = () => { fs.unwatchFile(journal, journalListener); clearInterval(heartbeatTimer); resolve(); };
-        options.signal.addEventListener('abort', stop, { once: true });
-        // Close the offset/read/watch handoff: a publisher may append after the
-        // startup offset is captured but before watchFile is registered.
-        readAppended();
-    });
-}
-function remoteWatchCommand(os) {
-    const args = ['sessions', 'watch', '--json', '--local'];
-    return remoteShellFor(os) === 'powershell'
-        ? buildWindowsAgentsCommand({ args })
-        : `bash -lc ${shellQuote(`agents ${args.map(shellQuote).join(' ')}`)}`;
-}
-/**
- * Subscribe to every dialable compute device with one persistent SSH process.
- * A peer disconnect emits `scope: unavailable` but no removes; reconnecting
- * peer resets only its own scope. There is no recurring fleet list command.
- */
-export async function watchFleetSessions(options) {
-    const local = watchLocalSessions({ scope: machineId(), signal: options.signal, emit: options.emit });
-    let devices;
-    try {
-        devices = await loadDevices();
-    }
-    catch {
-        await local;
-        return;
-    }
-    const self = machineId();
-    const peers = Object.values(devices).filter((device) => isDialableDevice(device)
-        && !isControlDevice(device)
-        && normalizeHost(device.name) !== self
-        && ['windows', 'linux', 'macos'].includes(device.platform));
-    const reconnectMs = options.reconnectMs ?? 2_000;
-    const peerTasks = peers.map(async (device) => {
-        const scope = normalizeHost(device.name);
-        const state = new SessionWatchState();
-        while (!options.signal.aborted) {
-            let target;
-            try {
-                target = sshTargetFor(device);
-            }
-            catch (error) {
-                options.emit(state.scope(scope, 'unavailable', error instanceof Error ? error.message : String(error)));
-                break;
-            }
-            const child = spawn('ssh', [
-                ...SSH_OPTS, ...controlOpts(), ...deviceIdentityArgs(device), target, remoteWatchCommand(device.platform),
-            ], { stdio: ['ignore', 'pipe', 'ignore'] });
-            const stop = () => child.kill('SIGTERM');
-            options.signal.addEventListener('abort', stop, { once: true });
-            const reader = createInterface({ input: child.stdout });
-            reader.on('line', (line) => {
-                try {
-                    const event = JSON.parse(line);
-                    if (event.version === SESSION_WATCH_VERSION && typeof event.sequence === 'number')
-                        options.emit(event);
-                }
-                catch { /* incomplete/non-protocol peer output is not state */ }
-            });
-            const code = await new Promise((resolve) => {
-                child.once('error', () => resolve(null));
-                child.once('close', resolve);
-            });
-            reader.close();
-            options.signal.removeEventListener('abort', stop);
-            if (options.signal.aborted)
-                break;
-            options.emit(state.scope(scope, 'unavailable', code === null ? 'ssh failed' : `ssh exited ${code}`));
-            await new Promise((resolve) => {
-                const timer = setTimeout(resolve, reconnectMs);
-                options.signal.addEventListener('abort', () => { clearTimeout(timer); resolve(); }, { once: true });
-            });
-        }
-    });
-    await Promise.all([local, ...peerTasks]);
-}
+// Moved to ./remote/watch.ts (move 4 of the core-module refactor).
+// Kept as a re-export shim so existing importers don't break.
+export * from './remote/watch.js';

package/dist/lib/session/width.d.ts

@@ -1,29 +1 @@
-/**
- * Terminal display-width helpers.
- *
- * `String.length` is the wrong ruler for a terminal: it over-counts ANSI colour
- * escapes (chalk output) and under-counts wide glyphs (CJK, emoji) which occupy
- * two cells. The result is the drifting, wrapping session-table line users see
- * under tmux and over `--device` SSH. Every renderer that sizes a session-table
- * cell measures and truncates through this module so alignment is computed once,
- * correctly, from the same source of truth.
- */
-/** Strip SGR colour + OSC-8 hyperlink escapes so width is measured on visible characters only. */
-export declare function stripAnsi(s: string): string;
-/** Visible display width of a string, ANSI-aware and wide-char-aware. */
-export declare function stringWidth(s: string): number;
-/**
- * Truncate to a target display width, appending '…' when shortened. Operates on
- * the visible (ANSI-stripped) string; callers colour the result afterwards so
- * the ellipsis is never inserted mid-escape.
- */
-export declare function truncateToWidth(s: string, max: number): string;
-/** Right-pad with spaces to a target display width. Never truncates. */
-export declare function padToWidth(s: string, width: number): string;
-/**
- * Effective terminal width. Reads `$COLUMNS` first so it survives tmux and
- * `--device` SSH (where `process.stdout.columns` is unset or wrong), falls back to
- * the TTY's reported width, then to `fallback`. Clamped to a sane band so a
- * bogus value can't produce a 0-wide or absurdly long table.
- */
-export declare function terminalWidth(fallback?: number): number;
+export * from '../text/width.js';

package/dist/lib/session/width.js

@@ -1,101 +1,4 @@
-/**
- * Terminal display-width helpers.
- *
- * `String.length` is the wrong ruler for a terminal: it over-counts ANSI colour
- * escapes (chalk output) and under-counts wide glyphs (CJK, emoji) which occupy
- * two cells. The result is the drifting, wrapping session-table line users see
- * under tmux and over `--device` SSH. Every renderer that sizes a session-table
- * cell measures and truncates through this module so alignment is computed once,
- * correctly, from the same source of truth.
- */
-/** SGR colour sequences emitted by chalk (e.g. `\x1b[32m`). */
-const SGR_REGEX = /\x1b\[[0-9;]*m/g;
-/**
- * OSC-8 hyperlink sequences (`\x1b]8;;<url>\x1b\\` … `\x1b]8;;\x1b\\`, or with a
- * BEL `\x07` terminator) emitted by `osc8()` in render.ts for clickable
- * ticket/PR/path badges. These carry the URL, which is NOT visible — leaving it
- * in over-counts width and, worse, lets a truncation land *inside* the escape and
- * corrupt it. Stripping both the opener and closer leaves only the visible label
- * between them, so width is measured on what the user sees and `truncateToWidth`
- * can never cut a hyperlink in half.
- */
-const OSC8_REGEX = /\x1b\]8;[^;]*;.*?(?:\x1b\\|\x07)/g;
-/** Strip SGR colour + OSC-8 hyperlink escapes so width is measured on visible characters only. */
-export function stripAnsi(s) {
-    return s.replace(OSC8_REGEX, '').replace(SGR_REGEX, '');
-}
-/**
- * Display cells for one code point: 0 for zero-width combining/ZWJ/variation
- * selectors, 2 for East-Asian-wide and emoji ranges, 1 otherwise. Compact and
- * dependency-free — covers the glyphs that actually show up in prompts/titles.
- */
-function charWidth(cp) {
-    if (cp === 0)
-        return 0;
-    // Zero-width: combining marks, zero-width joiner, variation selectors.
-    if ((cp >= 0x0300 && cp <= 0x036f) ||
-        cp === 0x200b || cp === 0x200d ||
-        (cp >= 0xfe00 && cp <= 0xfe0f))
-        return 0;
-    // Wide (2 cells): CJK, Hangul, fullwidth forms, emoji & pictographs.
-    if ((cp >= 0x1100 && cp <= 0x115f) || // Hangul Jamo
-        (cp >= 0x2e80 && cp <= 0xa4cf) || // CJK radicals … Yi
-        (cp >= 0xac00 && cp <= 0xd7a3) || // Hangul syllables
-        (cp >= 0xf900 && cp <= 0xfaff) || // CJK compatibility ideographs
-        (cp >= 0xfe30 && cp <= 0xfe4f) || // CJK compatibility forms
-        (cp >= 0xff00 && cp <= 0xff60) || // Fullwidth forms
-        (cp >= 0xffe0 && cp <= 0xffe6) || // Fullwidth signs
-        (cp >= 0x1f300 && cp <= 0x1faff) || // emoji & symbols
-        (cp >= 0x20000 && cp <= 0x3fffd) // CJK Ext-B and beyond
-    )
-        return 2;
-    return 1;
-}
-/** Visible display width of a string, ANSI-aware and wide-char-aware. */
-export function stringWidth(s) {
-    const plain = stripAnsi(s);
-    let w = 0;
-    for (const ch of plain)
-        w += charWidth(ch.codePointAt(0));
-    return w;
-}
-/**
- * Truncate to a target display width, appending '…' when shortened. Operates on
- * the visible (ANSI-stripped) string; callers colour the result afterwards so
- * the ellipsis is never inserted mid-escape.
- */
-export function truncateToWidth(s, max) {
-    if (max <= 0)
-        return '';
-    const plain = stripAnsi(s);
-    if (stringWidth(plain) <= max)
-        return plain;
-    let w = 0;
-    let out = '';
-    for (const ch of plain) {
-        const cw = charWidth(ch.codePointAt(0));
-        if (w + cw > max - 1)
-            break; // reserve one cell for the ellipsis
-        out += ch;
-        w += cw;
-    }
-    return out + '…';
-}
-/** Right-pad with spaces to a target display width. Never truncates. */
-export function padToWidth(s, width) {
-    const pad = width - stringWidth(s);
-    return pad > 0 ? s + ' '.repeat(pad) : s;
-}
-/**
- * Effective terminal width. Reads `$COLUMNS` first so it survives tmux and
- * `--device` SSH (where `process.stdout.columns` is unset or wrong), falls back to
- * the TTY's reported width, then to `fallback`. Clamped to a sane band so a
- * bogus value can't produce a 0-wide or absurdly long table.
- */
-export function terminalWidth(fallback = 100) {
-    const env = Number.parseInt(process.env.COLUMNS ?? '', 10);
-    const raw = Number.isFinite(env) && env > 0
-        ? env
-        : (process.stdout.columns || fallback);
-    return Math.max(60, Math.min(200, raw));
-}
+// Moved to ../text/width.ts (move 1 of the core-module refactor — see
+// .agents/artifacts/2026-08-20/plan-*.md). Kept as a re-export shim so
+// existing importers don't break.
+export * from '../text/width.js';

package/dist/lib/share/config.d.ts

@@ -22,9 +22,19 @@ export declare const DEFAULT_BUCKET_NAME = "agents-share";
 export declare const DEFAULT_SHARE_DOMAIN = "share.agents-cli.sh";
 /** The write token may be injected ephemerally into fleet/cloud agents. */
 export declare function readWriteTokenEnv(env?: NodeJS.ProcessEnv): string | null;
-/** Read the persisted endpoint config, or null if `agents artifacts setup` / `agents artifacts share join` never ran. */
+/**
+ * Read the persisted endpoint config, or null if there is no `share.baseUrl`.
+ *
+ * Publish talks only to `baseUrl` with `WRITE_TOKEN`. `accountId` / worker /
+ * bucket are provisioning metadata for `setup`/`update`. Requiring all four
+ * (and treating `accountId: ""` as missing) made `status` and publish both
+ * report "not set up" on an endpoint that still worked — RUSH-2837.
+ */
 export declare function readShareConfig(): ShareConfig | null;
-/** Persist the endpoint config to `agents.yaml` (syncs across the fleet). */
+/** Persist the endpoint config to `agents.yaml` (syncs across the fleet).
+ * Empty strings never overwrite a previously stored value and are not written
+ * back as `accountId: ""` (that form made {@link readShareConfig} return null
+ * under the old all-fields-required check, and it is still useless). */
 export declare function writeShareConfig(cfg: ShareConfig): void;
 /** A fresh 32-byte hex write token. */
 export declare function generateWriteToken(): string;

package/dist/lib/share/config.js

@@ -23,24 +23,60 @@ export function readWriteTokenEnv(env = process.env) {
     const token = env[SHARE_TOKEN_ENV_KEY]?.trim();
     return token ? token : null;
 }
-/** Read the persisted endpoint config, or null if `agents artifacts setup` / `agents artifacts share join` never ran. */
+/** Trim; empty / whitespace-only strings are absent. */
+function nonempty(v) {
+    const t = v?.trim();
+    return t ? t : undefined;
+}
+/**
+ * Read the persisted endpoint config, or null if there is no `share.baseUrl`.
+ *
+ * Publish talks only to `baseUrl` with `WRITE_TOKEN`. `accountId` / worker /
+ * bucket are provisioning metadata for `setup`/`update`. Requiring all four
+ * (and treating `accountId: ""` as missing) made `status` and publish both
+ * report "not set up" on an endpoint that still worked — RUSH-2837.
+ */
 export function readShareConfig() {
     const s = readMeta().share;
-    if (!s?.baseUrl || !s.accountId || !s.workerName || !s.bucketName)
+    const baseUrl = nonempty(s?.baseUrl)?.replace(/\/+$/, '');
+    if (!baseUrl)
         return null;
     return {
-        baseUrl: s.baseUrl.replace(/\/+$/, ''),
-        accountId: s.accountId,
-        workerName: s.workerName,
-        bucketName: s.bucketName,
-        domain: s.domain,
-        analyticsToken: s.analyticsToken,
-        templateHash: s.templateHash,
+        baseUrl,
+        accountId: nonempty(s?.accountId) ?? '',
+        workerName: nonempty(s?.workerName) ?? DEFAULT_WORKER_NAME,
+        bucketName: nonempty(s?.bucketName) ?? DEFAULT_BUCKET_NAME,
+        domain: nonempty(s?.domain),
+        analyticsToken: nonempty(s?.analyticsToken),
+        templateHash: nonempty(s?.templateHash),
     };
 }
-/** Persist the endpoint config to `agents.yaml` (syncs across the fleet). */
+/** Persist the endpoint config to `agents.yaml` (syncs across the fleet).
+ * Empty strings never overwrite a previously stored value and are not written
+ * back as `accountId: ""` (that form made {@link readShareConfig} return null
+ * under the old all-fields-required check, and it is still useless). */
 export function writeShareConfig(cfg) {
-    updateMeta((meta) => ({ ...meta, share: { ...meta.share, ...cfg } }));
+    updateMeta((meta) => {
+        const prev = meta.share ?? {};
+        const next = { ...prev };
+        const assign = (key, incoming) => {
+            const v = nonempty(incoming);
+            if (v)
+                next[key] = v;
+        };
+        assign('baseUrl', cfg.baseUrl);
+        assign('accountId', cfg.accountId);
+        assign('workerName', cfg.workerName);
+        assign('bucketName', cfg.bucketName);
+        assign('domain', cfg.domain);
+        assign('analyticsToken', cfg.analyticsToken);
+        assign('templateHash', cfg.templateHash);
+        for (const key of Object.keys(next)) {
+            if (typeof next[key] === 'string' && !nonempty(next[key]))
+                delete next[key];
+        }
+        return { ...meta, share: next };
+    });
 }
 /** A fresh 32-byte hex write token. */
 export function generateWriteToken() {

package/dist/lib/share/delete.js

@@ -1,4 +1,4 @@
-// The delete path for `agents artifacts share delete` / `agents unshare` — an authed DELETE
+// The delete path for `agents artifacts share delete` / `agents artifacts unshare` — an authed DELETE
 // to the Worker, which already implements it (worker-template.ts). Mirrors
 // publish.ts: pure target-resolution logic is exported for tests, the network
 // calls (a status check + a delete) sit behind an injectable DI seam.

package/dist/lib/share/publish.js

@@ -459,7 +459,7 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
     // strings unless --force. Runs on the raw file body AND on every piece of
     // free-text metadata that lands in public customMetadata — --label (explicit
     // or derived) and every --meta value. Metadata is visible in the gallery,
-    // `share list --json`, and `share revisions` just like the page itself, so a
+    // `share list --list-json`, and `share revisions` just like the page itself, so a
     // credential smuggled in there is exactly as exposed as one in the body; it
     // must not have a free pass around this gate. Runs before analytics/cover
     // mutation so a beacon injection never triggers a false positive on the body

package/dist/lib/share/worker-template.js

@@ -21,8 +21,8 @@
 //   - GET  /<slug>             — backward-compat flat slug (legacy shares before
 //     per-user namespaces).
 //
-// Emitted as a string (mirrors src/lib/serve/page.ts `renderPage()`), so it compiles
-// into `dist/**` and ships with no package.json#files change. `provision.ts` uploads
+// Emitted as a string, so it compiles into `dist/**` and ships with no
+// package.json#files change. `provision.ts` uploads
 // this verbatim as an ES-module Worker with a BUCKET (R2) binding + a WRITE_TOKEN secret.
 /**
  * Render the Worker source. Pure — the R2 binding + token are wired at deploy time.

package/dist/lib/smart-launch.d.ts

@@ -34,9 +34,7 @@ export declare function sampleWeighted(candidates: WeightedCandidate[], rng?: ()
  * paths (`resolveDeviceAuto`, `resolveDeviceAffinity`) get their candidates, so
  * marking workers moves every `--device auto` at once instead of one surface.
  *
- * Paired cockpits (`role: control` in the device registry) are dropped here,
- * where the registry is already being read — they are control surfaces, not
- * compute. It CAN return an empty list — a fleet where every marked worker is
+ * It CAN return an empty list — a fleet where every marked worker is
  * offline, or where this box is the only candidate and is marked `personal`. That is a
  * real answer, and both callers fail loud on it rather than falling back to the
  * local machine (which would be the exact box the operator marked personal to
@@ -94,6 +92,8 @@ export declare function formatNoHealthyDeviceError(pool: string[], signals: Map<
 export declare function resolveDeviceAuto(agent?: string, opts?: {
     eligibleHosts?: string[];
     localMachine?: string;
+    /** Route only to devices with a row the interactive account picker can launch. */
+    accountPicker?: boolean;
     probe?: (pool: string[], agent?: AgentType) => Promise<Map<string, DevicePlacementSignal>>;
 }): Promise<DeviceAutoPlan>;
 /**
@@ -136,7 +136,7 @@ export type DeviceAutoApplyResult = {
  * `auto`, so callers fail loud instead of silently launching locally.
  */
 export declare function applyDeviceAutoToOptions(options: DeviceAutoHostOptions, deps?: {
-    resolve?: () => DeviceAutoPlan | Promise<DeviceAutoPlan>;
+    resolve?: (accountPicker: boolean) => DeviceAutoPlan | Promise<DeviceAutoPlan>;
     agent?: string;
     accountPickerRequested?: boolean;
 }): Promise<DeviceAutoApplyResult>;

package/dist/lib/smart-launch.js

@@ -7,12 +7,11 @@
  */
 import { queryAffinityRollup } from './session/db.js';
 import { localMachineId } from './session/origin-machine.js';
-import { isControlDevice, loadDevicesSync } from './devices/registry.js';
+import { loadDevicesSync } from './devices/registry.js';
 import { describeAutoPool, filterAutoPool, isAutoPoolMember } from './devices/pool.js';
 import { normalizeHost } from './machine-id.js';
 import { probePoolSignals } from './teams/placement-probe.js';
 import { pickBestDevice } from './teams/scheduler.js';
-import { getAccountInfo } from './agents.js';
 /** Peakiness of usage weights; >1 amplifies the most-used option. */
 export const DEFAULT_AFFINITY_ALPHA = 1.3;
 /**
@@ -55,9 +54,7 @@ export function sampleWeighted(candidates, rng = Math.random) {
  * paths (`resolveDeviceAuto`, `resolveDeviceAffinity`) get their candidates, so
  * marking workers moves every `--device auto` at once instead of one surface.
  *
- * Paired cockpits (`role: control` in the device registry) are dropped here,
- * where the registry is already being read — they are control surfaces, not
- * compute. It CAN return an empty list — a fleet where every marked worker is
+ * It CAN return an empty list — a fleet where every marked worker is
  * offline, or where this box is the only candidate and is marked `personal`. That is a
  * real answer, and both callers fail loud on it rather than falling back to the
  * local machine (which would be the exact box the operator marked personal to
@@ -74,10 +71,6 @@ export function listOnlineDeviceNames(localName = localMachineId()) {
             // No tailscale snapshot → treat as candidate (registry-only box).
             if (online === false)
                 continue;
-            // A paired cockpit (iPhone/iPad) is a control surface, not compute — it
-            // is never dialed for a session, so it is never a placement candidate.
-            if (isControlDevice(d))
-                continue;
             names.add(normalizeHost(name));
         }
     }
@@ -147,18 +140,15 @@ export async function resolveDeviceAuto(agent, opts = {}) {
                 signals.set(key, { ...current, installed: accountEligible, signedIn: accountEligible });
         }
     }
-    if (agent && !opts.probe && signals.has(local)) {
-        const info = await getAccountInfo(agent).catch(() => null);
-        const eligible = !!info?.signedIn && info.usageStatus !== 'rate_limited' && info.usageStatus !== 'out_of_credits';
-        signals.set(local, { ...signals.get(local), signedIn: eligible });
-    }
     const eligiblePool = pool.filter((key) => {
         const signal = signals.get(key);
         if (signal?.reachable !== true || signal.headroom === 'loaded')
             return false;
         if (!agent)
             return opts.probe ? true : signal.installed === true && signal.signedIn === true;
-        return signal.installed === true && signal.signedIn === true;
+        return signal.installed === true && (opts.accountPicker === true
+            ? signal.pickerEligible === true
+            : signal.signedIn === true);
     });
     if (eligiblePool.length === 0) {
         throw new Error(formatNoHealthyDeviceError(pool, signals, agent));
@@ -260,15 +250,15 @@ export async function applyDeviceAutoToOptions(options, deps = {}) {
     if (!hasAuto) {
         return { attempted: false, deprecationSmart };
     }
-    const resolve = deps.resolve ?? (() => resolveDeviceAuto(deps.agent));
-    const plan = await resolve();
+    const accountPickerRequested = deps.accountPickerRequested ?? false;
+    const resolve = deps.resolve ?? ((accountPicker) => resolveDeviceAuto(deps.agent, { accountPicker }));
+    const plan = await resolve(accountPickerRequested);
     const concrete = plan.host; // null = local
     for (const k of HOST_SLOTS) {
         if (isDeviceAuto(options[k])) {
             options[k] = concrete ?? undefined;
         }
     }
-    const accountPickerRequested = deps.accountPickerRequested ?? false;
     if (!accountPickerRequested && !options.strategy && !options.balanced) {
         options.balanced = true;
     }

package/dist/lib/snapshot.d.ts

@@ -8,7 +8,7 @@
  *
  * That is N+2 process starts per poll tick. This module gathers the same
  * shapes in one invocation so poll count drops to 1 without redefining
- * `agents status` (which stays the UnifiedSyncStatus sync contract).
+ * `agents sync status` (which stays the UnifiedSyncStatus sync contract).
  *
  * Stores are not merged — inventory still comes from view, active rows from
  * sessions, blocks from feed. Only the reader is consolidated.
@@ -63,7 +63,7 @@ export interface FleetSnapshot {
     agents: FleetAgentCounts;
     /** Present when --with-feed. */
     feed?: SnapshotFeedSummary;
-    /** Present when --with-sync (UnifiedSyncStatus; does not replace `agents status`). */
+    /** Present when --with-sync (UnifiedSyncStatus; does not replace `agents sync status`). */
     sync?: UnifiedSyncStatus;
 }
 export interface ComputeSnapshotOptions {

package/dist/lib/snapshot.js

@@ -8,7 +8,7 @@
  *
  * That is N+2 process starts per poll tick. This module gathers the same
  * shapes in one invocation so poll count drops to 1 without redefining
- * `agents status` (which stays the UnifiedSyncStatus sync contract).
+ * `agents sync status` (which stays the UnifiedSyncStatus sync contract).
  *
  * Stores are not merged — inventory still comes from view, active rows from
  * sessions, blocks from feed. Only the reader is consolidated.

package/dist/lib/staleness/index.d.ts

@@ -4,7 +4,9 @@
  *
  *   - `buildManifest(agent, version, cwd)` — snapshot current state.
  *   - `isStale(manifest, agent, version, cwd)` — true when any tracked
- *     resource has drifted from its stored fingerprint.
+ *     resource has drifted from its stored fingerprint, or when an artifact
+ *     the last full sync wrote (`writtenTargets`) has been deleted from the
+ *     version home (#2398).
  *
  * `loadManifest` / `saveManifest` round-trip the on-disk JSON. The format
  * version stays at 1; new optional fields (workflows, plugins) on old files