@phnx-labs/agents-cli 1.22.45 → 1.22.47

package/dist/lib/browser/service.js

@@ -4,6 +4,7 @@ import * as path from 'path';
 import { BrowserCdpConnectionError, CDPClient, discoverBrowserWsUrl, verifyBrowserIdentity, } from './cdp.js';
 import { getProfile, getProfileRuntimeDir, getProfileDownloadsDir, getProfileSessionsDir, getBrowserRuntimeDir, listProfiles, extractConfiguredPort, resolveEndpoint, parseEndpointUrl, } from './profiles.js';
 import { killChrome, getRunningChromeInfo, launchBrowser, allocatePort } from './chrome.js';
+import { assertRemoteControlAllowedForRequest } from './remote-control.js';
 import { connectLocal } from './drivers/local.js';
 import { connectSSH, shellQuote } from './drivers/ssh.js';
 import { clearProfileRuntime, listProfileCacheDirs, readProfileRuntimeMeta, isProcessAlive } from './runtime-state.js';
@@ -312,6 +313,11 @@ export class BrowserService {
     /** Coalescing window for the `touchTask` write. See {@link touchTask}. */
     static TOUCH_PERSIST_INTERVAL_MS = 60_000;
     async start(profileName, opts = {}) {
+        // Consent gate, before anything is resolved or launched. This is the
+        // authoritative one: gating only the `browser start` COMMAND left the ~18
+        // page verbs that create a browser implicitly (navigate, click, screenshot,
+        // …) able to open a browser on a machine whose owner never opted in.
+        assertRemoteControlAllowedForRequest(opts.fleetRemote, { actor: opts.actor });
         const profile = await getProfile(profileName);
         if (!profile) {
             throw new Error(`Profile "${profileName}" not found`);
@@ -345,22 +351,8 @@ export class BrowserService {
             taskName = taskId;
         }
         const taskLabel = deriveTaskLabel({ title: opts.title, url: opts.url });
-        let conn = this.connections.get(composite);
+        let conn = await this.reuseHealthyConnection(composite);
         let effectiveKey = composite;
-        // If we have a cached connection, confirm it's still usable before any
-        // caller relies on it. A browser killed externally (Cmd-Q, crash, or a
-        // user clearing the profile by hand) leaves a closed WebSocket here.
-        // Without this check the next `cdp.send` throws "CDP connection not
-        // open" and the user has no way to recover short of killing the daemon.
-        if (conn && !(await isConnHealthy(conn))) {
-            try {
-                conn.cdp.close();
-            }
-            catch { /* already closed */ }
-            conn.cleanup?.();
-            this.connections.delete(composite);
-            conn = undefined;
-        }
         if (conn && conn.electron && conn.tasks.size > 0) {
             if (this.forkingProfiles.has(composite)) {
                 while (this.forkingProfiles.has(composite)) {
@@ -388,11 +380,7 @@ export class BrowserService {
             }
         }
         else if (!conn) {
-            conn = await this.connectProfile(effectiveProfile, resolved.target, composite);
-            conn.key = composite;
-            conn.profile = profileName;
-            this.connections.set(composite, conn);
-            await this.applyDefaultDownloadBehavior(conn, composite);
+            conn = await this.openConnection(effectiveProfile, resolved.target, composite, profileName);
         }
         if (conn && !conn.profile)
             conn.profile = profileName;
@@ -2310,6 +2298,10 @@ export class BrowserService {
         // Zero matches for this caller.
         if (!opts.createIfMissing)
             return null;
+        // Refuse BEFORE ensureDefaultBrowserProfile() below, which probes local
+        // browser installs and may CREATE and persist an `auto-chrome` profile — a
+        // refused request must not leave state behind on the target machine.
+        assertRemoteControlAllowedForRequest(opts.fleetRemote, { actor: opts.actor });
         // Implicit start on the default / named profile.
         let profileName = opts.profile;
         if (!profileName) {
@@ -2318,6 +2310,7 @@ export class BrowserService {
             profileName = detected.name;
         }
         const started = await this.start(profileName, {
+            fleetRemote: opts.fleetRemote,
             url: opts.url,
             actor: opts.actor,
             launchId: opts.launchId,
@@ -2835,6 +2828,71 @@ export class BrowserService {
         history = history.slice(0, 50);
         await fs.promises.writeFile(historyFile, JSON.stringify(history, null, 2));
     }
+    /**
+     * The cached connection for `key`, or undefined — evicting it first if the
+     * browser died underneath us.
+     *
+     * A browser killed externally (Cmd-Q, crash, a user clearing the profile by
+     * hand) leaves a closed WebSocket in the map. Without this the next
+     * `cdp.send` throws "CDP connection not open" and there is no recovery short
+     * of killing the daemon.
+     */
+    async reuseHealthyConnection(key) {
+        const conn = this.connections.get(key);
+        if (!conn)
+            return undefined;
+        if (await isConnHealthy(conn))
+            return conn;
+        try {
+            conn.cdp.close();
+        }
+        catch { /* already closed */ }
+        conn.cleanup?.();
+        this.connections.delete(key);
+        return undefined;
+    }
+    /** Connect a profile at `target`, register it under `key`, and arm downloads. */
+    async openConnection(profile, target, key, profileName) {
+        const conn = await this.connectProfile(profile, target, key);
+        conn.key = key;
+        conn.profile = profileName;
+        this.connections.set(key, conn);
+        await this.applyDefaultDownloadBehavior(conn, key);
+        return conn;
+    }
+    /**
+     * Open a tab for a HUMAN to read, bound to no task.
+     *
+     * That is the entire difference from {@link start}, and it is the point. The
+     * abandoned-task reaper closes a task's tabs when the calling session dies or
+     * after the idle window, but it "deliberately never touches a tab that is not
+     * in `task.tabs`" (hygiene.ts) — so a viewer tab must not be in one, or the
+     * artifact the user is reading vanishes when the agent that rendered it exits.
+     *
+     * Consequently `stop`/`done` do not close it either, which is correct: it is
+     * the user's tab now.
+     */
+    async showUrl(profileName, url, opts = {}) {
+        // Same consent gate as start(): this opens a browser, so a fleet-remote
+        // caller needs the target machine's opt-in.
+        assertRemoteControlAllowedForRequest(opts.fleetRemote, { actor: opts.actor });
+        const profile = await getProfile(profileName);
+        if (!profile)
+            throw new Error(`Profile "${profileName}" not found`);
+        const resolved = resolveEndpoint(profile, opts.endpointName);
+        const key = connectionKey(profileName, resolved.name);
+        const effectiveProfile = {
+            ...profile,
+            binary: resolved.binary,
+            targetFilter: resolved.targetFilter,
+        };
+        const conn = (await this.reuseHealthyConnection(key)) ??
+            (await this.openConnection(effectiveProfile, resolved.target, key, profileName));
+        // createPageTarget refuses Arc with an actionable error rather than crashing it.
+        const created = await this.createPageTarget(conn, { url });
+        this.invalidateTargetCache(conn);
+        return { profile: profileName, key, tabId: created.targetId };
+    }
     async getHistory(limit = 10) {
         const historyFile = path.join(getBrowserRuntimeDir(), 'history.json');
         if (!fs.existsSync(historyFile))

package/dist/lib/browser/sessions-list.d.ts

@@ -32,8 +32,6 @@ export declare function renderBrowserSessions(groups: ProfileArtifacts[]): strin
  * substring match. Returns the absolute path, or null if nothing matched.
  */
 export declare function resolveArtifact(groups: ProfileArtifacts[], selector: string): string | null;
-/** Open a file in the OS default app. Returns true on success. */
-export declare function openArtifact(filePath: string): boolean;
 /** The identity fields this module cares about for one task. */
 export interface TaskIdentity {
     owner?: string;
@@ -139,4 +137,4 @@ export declare function runBrowserSessions(opts: {
     profile?: string;
     open?: string | boolean;
     json?: boolean;
-}): void;
+}): Promise<void>;

package/dist/lib/browser/sessions-list.js

@@ -14,12 +14,12 @@
  * problem (pid registry, the SessionStart hook index, the activity log; see
  * `feed-post.ts` `resolvePostIdentity`), never a second parser.
  */
+import { showFile } from '../open-url.js';
 import * as fs from 'fs';
 import { formatBytes } from '../format.js';
 // Re-exported for the picker, which lists artifacts from this module's rows.
 export { formatBytes };
 import * as path from 'path';
-import { spawnSync } from 'child_process';
 import { getBrowserRuntimeDir, getProfileRuntimeDir } from './profiles.js';
 import { formatRelativeTime } from '../session/relative-time.js';
 import { getSessionById, listBrowserSessionRecords, pruneToolSessions } from '../session/db.js';
@@ -158,19 +158,6 @@ export function resolveArtifact(groups, selector) {
     const hit = all.find((a) => a.name === selector) ?? all.find((a) => a.name.includes(selector));
     return hit ? hit.path : null;
 }
-/** Open a file in the OS default app. Returns true on success. */
-export function openArtifact(filePath) {
-    const openers = process.platform === 'darwin'
-        ? [['open', [filePath]]]
-        : process.platform === 'win32'
-            ? [['cmd', ['/c', 'start', '""', filePath]]]
-            : [['xdg-open', [filePath]], ['gnome-open', [filePath]]];
-    for (const [cmd, args] of openers) {
-        if (spawnSync(cmd, args, { stdio: 'ignore' }).status === 0)
-            return true;
-    }
-    return false;
-}
 /**
  * Read a profile's `tasks.json` for the identity of its CURRENTLY LIVE tasks,
  * keyed by task name. A task's entry is deleted on `agents browser stop` (see
@@ -380,7 +367,7 @@ export function matchesBrowserSessionRow(row, query) {
  * `open` is the Commander value for `--open [selector]`: undefined when the flag
  * is absent, `true` when passed bare (defaults to 'latest'), or the selector string.
  */
-export function runBrowserSessions(opts) {
+export async function runBrowserSessions(opts) {
     const groups = listBrowserSessions(opts.profile);
     if (opts.open !== undefined && opts.open !== false) {
         const selector = opts.open === true ? 'latest' : opts.open;
@@ -390,7 +377,7 @@ export function runBrowserSessions(opts) {
             process.exit(1);
         }
         console.log(target);
-        if (!openArtifact(target)) {
+        if ((await showFile(target)).via === 'none') {
             console.error(`Could not open ${target}`);
             process.exit(1);
         }

package/dist/lib/browser/types.d.ts

@@ -287,7 +287,7 @@ export interface ReapResult {
     /** Tasks left alone this pass: still live, still inside the idle window, or recording. */
     skipped: number;
 }
-export type IPCAction = 'start' | 'gc' | 'record-start' | 'record-stop' | 'done' | 'stop' | 'status' | 'history' | 'navigate' | 'tab-add' | 'tab-focus' | 'tab-close' | 'tab-list' | 'evaluate' | 'screenshot' | 'pdf' | 'refs' | 'click' | 'type' | 'press' | 'hover' | 'scroll' | 'set-viewport' | 'set-device' | 'console' | 'errors' | 'requests' | 'response-body' | 'wait' | 'set-download-path' | 'wait-download' | 'upload' | 'getAppLogs' | 'version';
+export type IPCAction = 'start' | 'show' | 'gc' | 'record-start' | 'record-stop' | 'done' | 'stop' | 'status' | 'history' | 'navigate' | 'tab-add' | 'tab-focus' | 'tab-close' | 'tab-list' | 'evaluate' | 'screenshot' | 'pdf' | 'refs' | 'click' | 'type' | 'press' | 'hover' | 'scroll' | 'set-viewport' | 'set-device' | 'console' | 'errors' | 'requests' | 'response-body' | 'wait' | 'set-download-path' | 'wait-download' | 'upload' | 'getAppLogs' | 'version';
 export interface IPCRequest {
     action: IPCAction;
     task?: string;
@@ -366,6 +366,17 @@ export interface IPCRequest {
      * for `computer.action` events, so both tool surfaces key on one signal.
      */
     sessionId?: string;
+    /**
+     * True when the CLI process that issued this request was itself dispatched to
+     * this machine by a fleet `--device` hop.
+     *
+     * Stamped client-side for the same reason actor/launchId are — and
+     * additionally because the daemon may have been auto-started BY a fleet-remote
+     * CLI and inherited AGENTS_FLEET_REMOTE for its whole life (startDetached
+     * passes `env: opts.env ?? process.env`). The daemon's own env is therefore
+     * not a truthful signal about the CURRENT caller; only the request is.
+     */
+    fleetRemote?: boolean;
 }
 /** Subset of IPCResponse describing a recording start result. */
 export interface RecordStartFields {

package/dist/lib/cli-resources.js

@@ -21,6 +21,7 @@ import * as path from 'path';
 import { spawnSync, execFile } from 'child_process';
 import * as yaml from 'yaml';
 import { listResources, resolveResource } from './resources.js';
+import { probeCapture } from './probe.js';
 import { composeWin32CommandLine } from './platform/index.js';
 import { localBinDir } from './platform/posixpath.js';
 // ─── Validation primitives ───────────────────────────────────────────────────
@@ -318,22 +319,23 @@ export function isCliInstalledAsync(manifest) {
         cmdExistsCache.delete(c.cmd);
         return Promise.resolve(hasCommand(c.cmd));
     }
-    return new Promise((resolve) => {
-        execFile(c.cmd, c.args, { timeout: 10_000 }, (err) => {
-            if (!err)
-                return resolve(true);
-            // A spawn failure (as opposed to a non-zero exit) surfaces as a string
-            // errno code (ENOENT/EINVAL); a non-zero exit surfaces as a numeric code.
-            // On Windows a `.cmd`/`.bat` shim spawn-fails without a shell — retry once
-            // through the shell, exactly as the sync path does.
-            const spawnFailed = typeof err.code === 'string';
-            if (process.platform === 'win32' && spawnFailed) {
-                const line = composeWin32CommandLine(c.cmd, c.args);
+    // probeCapture, not bare execFile: a checked CLI can fork children of its
+    // own (copilot's platform-binary downloader), and settling without reaping
+    // the probe's process group would orphan them mid-write (RUSH-3028).
+    return probeCapture(c.cmd, c.args, 10_000).then(() => true, (err) => {
+        // A spawn failure (as opposed to a non-zero exit) surfaces as a string
+        // errno code (ENOENT/EINVAL) on the rejection; a non-zero exit or
+        // timeout carries no errno. On Windows a `.cmd`/`.bat` shim spawn-fails
+        // without a shell — retry once through the shell, exactly as the sync
+        // path does.
+        const spawnFailed = typeof err.code === 'string';
+        if (process.platform === 'win32' && spawnFailed) {
+            const line = composeWin32CommandLine(c.cmd, c.args);
+            return new Promise((resolve) => {
                 execFile(line, { timeout: 10_000, shell: true }, (retryErr) => resolve(!retryErr));
-                return;
-            }
-            resolve(false);
-        });
+            });
+        }
+        return false;
     });
 }
 // ─── Method selection ────────────────────────────────────────────────────────

package/dist/lib/codex-policy.d.ts

@@ -1,6 +1,7 @@
-export type CodexPolicyMode = 'plan' | 'edit' | 'skip';
+export type CodexPolicyMode = 'plan' | 'edit' | 'auto' | 'skip';
 export declare const CODEX_PLAN_PROFILE = "agents-plan";
 export declare const CODEX_EDIT_PROFILE = "agents-edit";
+export declare const CODEX_AUTO_PROFILE = "agents-auto";
 /**
  * Writable roots for Codex's `edit` profile: the managed user `.agents` dir, the
  * baseline toolchain caches, and — when `cwd` is inside a repo — that repo's
@@ -17,6 +18,15 @@ export declare function codexPermissionProfileConfig(mode: Exclude<CodexPolicyMo
  * Config overrides are deliberately used instead of the legacy `--sandbox`
  * flags: named permission profiles are the only Codex surface that can keep a
  * plan run filesystem-read-only while independently enabling network access.
+ *
+ * `auto` and `edit` share one sandbox (`:workspace` plus the writable roots) and
+ * differ only in `approval_policy`. `edit` is `on-request`: a command the sandbox
+ * denies comes back as an approval prompt, which is right when someone is sitting
+ * at the terminal. `auto` is `never`: nothing prompts, and a denied command
+ * surfaces to the model as a plain command failure — the only behavior that works
+ * for an unattended run, where a prompt nobody answers is an agent that has
+ * stopped. Autonomy is the approval axis only; neither widens the sandbox, and
+ * `skip` remains the sole mode that removes it.
  */
 export declare function codexPolicyArgs(mode: CodexPolicyMode, writableRoots?: string[]): string[];
 /** Preserve whether --mode was omitted when a run is re-dispatched remotely. */

package/dist/lib/codex-policy.js

@@ -4,6 +4,7 @@ import { codexDefaultWritableRoots } from './permissions.js';
 import { repoAgentsDirForCwd } from './project-key.js';
 export const CODEX_PLAN_PROFILE = 'agents-plan';
 export const CODEX_EDIT_PROFILE = 'agents-edit';
+export const CODEX_AUTO_PROFILE = 'agents-auto';
 function unique(values) {
     return [...new Set(values)];
 }
@@ -28,25 +29,39 @@ function inlineWorkspaceRoots(roots) {
 }
 export function codexPermissionProfileConfig(mode, writableRoots = codexEditWritableRoots()) {
     const parent = mode === 'plan' ? ':read-only' : ':workspace';
-    const roots = mode === 'edit'
-        ? `, workspace_roots = { ${inlineWorkspaceRoots(unique(writableRoots))} }`
-        : '';
+    const roots = mode === 'plan'
+        ? ''
+        : `, workspace_roots = { ${inlineWorkspaceRoots(unique(writableRoots))} }`;
     return `{ extends = ${JSON.stringify(parent)}${roots}, network = { enabled = true, allow_local_binding = true } }`;
 }
+const CODEX_PROFILES = {
+    plan: CODEX_PLAN_PROFILE,
+    edit: CODEX_EDIT_PROFILE,
+    auto: CODEX_AUTO_PROFILE,
+};
 /**
  * Canonical Codex safety policy used by every native launch path.
  *
  * Config overrides are deliberately used instead of the legacy `--sandbox`
  * flags: named permission profiles are the only Codex surface that can keep a
  * plan run filesystem-read-only while independently enabling network access.
+ *
+ * `auto` and `edit` share one sandbox (`:workspace` plus the writable roots) and
+ * differ only in `approval_policy`. `edit` is `on-request`: a command the sandbox
+ * denies comes back as an approval prompt, which is right when someone is sitting
+ * at the terminal. `auto` is `never`: nothing prompts, and a denied command
+ * surfaces to the model as a plain command failure — the only behavior that works
+ * for an unattended run, where a prompt nobody answers is an agent that has
+ * stopped. Autonomy is the approval axis only; neither widens the sandbox, and
+ * `skip` remains the sole mode that removes it.
  */
 export function codexPolicyArgs(mode, writableRoots = codexEditWritableRoots()) {
     if (mode === 'skip')
         return ['--dangerously-bypass-approvals-and-sandbox'];
-    const profile = mode === 'plan' ? CODEX_PLAN_PROFILE : CODEX_EDIT_PROFILE;
+    const profile = CODEX_PROFILES[mode];
     return [
         '-c',
-        'approval_policy="on-request"',
+        `approval_policy=${mode === 'auto' ? '"never"' : '"on-request"'}`,
         '-c',
         `default_permissions=${JSON.stringify(profile)}`,
         '-c',

package/dist/lib/config-keys.d.ts

@@ -33,10 +33,11 @@ export interface ParsedAutoConfigKey {
     scope: 'auto';
     property: 'pool';
 }
-/** The default browser profile (device-scope, self or peer). */
+/** A device-scope browser key (self or peer): the profile agents drive, or the
+ *  browser that shows the user a page. */
 export interface ParsedBrowserConfigKey {
     scope: 'browser';
-    property: 'profile';
+    property: 'profile' | 'viewer';
     device?: string;
 }
 export interface ParsedProjectConfigKey {
@@ -50,7 +51,7 @@ export interface ParsedDeviceConfigKey {
     property: DeviceConfigProperty;
 }
 export type ParsedConfigKey = ParsedRunConfigKey | ParsedInteractiveConfigKey | ParsedUsageConfigKey | ParsedAutoConfigKey | ParsedBrowserConfigKey | ParsedProjectConfigKey | ParsedDeviceConfigKey;
-export type DeviceConfigProperty = 'role' | 'max-agents' | 'scheduler' | 'daemon' | 'watchdog' | 'tmux' | 'browser.remote-control' | 'browser.task-idle-minutes' | 'notes' | 'browser.profile';
+export type DeviceConfigProperty = 'role' | 'max-agents' | 'scheduler' | 'daemon' | 'watchdog' | 'tmux' | 'browser.remote-control' | 'browser.task-idle-minutes' | 'notes' | 'browser.profile' | 'browser.viewer';
 /** Normalize agent@version to use `@` consistently. */
 export declare function formatAgentVersion(agent: AgentId, version: string): string;
 /**

package/dist/lib/config-keys.js

@@ -10,6 +10,7 @@ import { AGENTS } from './agents.js';
 import { MODEL_TIERS } from './model-tiers.js';
 import { VERSION_RE } from './run-defaults.js';
 const DEVICE_CONFIG_PROPERTIES = [
+    'browser.viewer',
     'role',
     'max-agents',
     'scheduler',
@@ -88,10 +89,13 @@ export function parseConfigKey(key) {
     if (raw === 'browser.profile') {
         return { scope: 'browser', property: 'profile' };
     }
+    if (raw === 'browser.viewer') {
+        return { scope: 'browser', property: 'viewer' };
+    }
     if (raw === 'project.root') {
         return { scope: 'project', property: 'root' };
     }
-    const deviceMatch = raw.match(/^devices\.(.+)\.(role|max-agents|scheduler|daemon|watchdog|tmux|notes|browser\.remote-control|browser\.task-idle-minutes|browser\.profile)$/);
+    const deviceMatch = raw.match(/^devices\.(.+)\.(role|max-agents|scheduler|daemon|watchdog|tmux|notes|browser\.remote-control|browser\.task-idle-minutes|browser\.profile|browser\.viewer)$/);
     if (deviceMatch) {
         return {
             scope: 'device',
@@ -113,7 +117,7 @@ export function parseConfigKey(key) {
         throw new Error(`Invalid auto config key '${key}'. Use auto.pool.`);
     }
     if (raw.startsWith('browser.')) {
-        throw new Error(`Invalid browser config key '${key}'. Use browser.profile.`);
+        throw new Error(`Invalid browser config key '${key}'. Use browser.profile or browser.viewer.`);
     }
     if (raw.startsWith('project.')) {
         throw new Error(`Invalid project config key '${key}'. Use project.root.`);
@@ -138,7 +142,9 @@ export function formatConfigKey(parsed) {
         case 'auto':
             return 'auto.pool';
         case 'browser':
-            return parsed.device ? `devices.${parsed.device}.browser.profile` : 'browser.profile';
+            return parsed.device
+                ? `devices.${parsed.device}.browser.${parsed.property}`
+                : `browser.${parsed.property}`;
         case 'project':
             return 'project.root';
         case 'device':
@@ -152,7 +158,7 @@ export function listKnownConfigKeys() {
     for (const tier of MODEL_TIERS) {
         keys.push(`run.<agent@version>.tier.${tier}`);
     }
-    keys.push('interactive.host', 'usage.primary-host', 'auto.pool', 'browser.profile', 'project.root');
+    keys.push('interactive.host', 'usage.primary-host', 'auto.pool', 'browser.profile', 'browser.viewer', 'project.root');
     for (const prop of DEVICE_CONFIG_PROPERTIES) {
         keys.push(`devices.<name>.${prop}`);
     }
@@ -185,6 +191,8 @@ export function devicePropertyToConfigName(property) {
             return 'notes';
         case 'browser.profile':
             return 'browser.profile';
+        case 'browser.viewer':
+            return 'browser.viewer';
     }
 }
 /**
@@ -204,10 +212,12 @@ export function configKeyStorageHint(parsed) {
             return 'config.usagePrimaryHost';
         case 'auto':
             return 'config.autoPool';
-        case 'browser':
+        case 'browser': {
+            const yamlKey = parsed.property === 'viewer' ? 'browserViewer' : 'defaultBrowserProfile';
             return parsed.device
-                ? `devices/${parsed.device}/agents.yaml config.defaultBrowserProfile`
-                : 'devices/<self>/agents.yaml config.defaultBrowserProfile';
+                ? `devices/${parsed.device}/agents.yaml config.${yamlKey}`
+                : `devices/<self>/agents.yaml config.${yamlKey}`;
+        }
         case 'project':
             return 'devices.<self>.projectRoot';
         case 'device':

package/dist/lib/daemon/runner.js

@@ -39,6 +39,7 @@ import { resolveClaudeSetupToken } from '../claude-account-token.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, } from '../accounting/rotate.js';
 import { readAuthHealth, isDeadVerdict } from '../auth-health.js';
 import { machineId } from '../machine-id.js';
+import { selfConfiguredDeviceRole } from '../device-config.js';
 import { isSelfUpdatingAgent, ROUTINE_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../agents.js';
 import { isCustomHarnessName, readProfile } from '../profiles.js';
 export class RoutineAlreadyRunningError extends Error {
@@ -1120,10 +1121,22 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone, overlayH
     const setupToken = agent === 'claude' && version
         ? resolveClaudeSetupToken(getVersionHomePath('claude', version))
         : null;
-    if (setupToken)
+    // A `personal` device (the user's own interactive box) uses the per-version
+    // login for EVERY run, routines included — the setup-token is a worker-only
+    // credential (RUSH-2395, mirrors the claude adapter's personal-device branch).
+    // On a personal box, only strip an inherited copy of the account's OWN
+    // setup-token by value so a leaked ambient value can't override the login; a
+    // token the user set deliberately is a different string and survives.
+    if (selfConfiguredDeviceRole() === 'personal') {
+        if (setupToken && out.CLAUDE_CODE_OAUTH_TOKEN === setupToken)
+            delete out.CLAUDE_CODE_OAUTH_TOKEN;
+    }
+    else if (setupToken) {
         out.CLAUDE_CODE_OAUTH_TOKEN = setupToken;
-    else
+    }
+    else {
         delete out.CLAUDE_CODE_OAUTH_TOKEN;
+    }
     if (agent === 'cursor' && overlayHome) {
         // prepareJobHome links this host's Cursor auth file here. Pin XDG_CONFIG_HOME
         // to the overlay so an ambient value cannot bypass the routine sandbox.

package/dist/lib/daemon-ticks.js

@@ -89,7 +89,7 @@ export async function refreshLocalFleetAuthState(opts) {
             // Fleet status publishes every tick regardless — it does not ride that endpoint.
             const cached = readFleetAuthRows(self);
             const reuse = shouldReuseCachedAuthProbe(force, cached, requestedAt);
-            const authRows = reuse ? cached : await probeLocalFleetAuth({ cliVersion: getCliVersion() });
+            const authRows = reuse ? cached : await probeLocalFleetAuth({ cliVersion: getCliVersion(), forceLive: force });
             if (!reuse)
                 writeFleetAuthRows(self, authRows);
             const row = await publishLocalFleetStatus(self);
@@ -129,7 +129,7 @@ export async function runUsageRefreshTick() {
     const r = await runUsageRefresh({
         listAccounts: buildLocalUsageAccounts,
         writeUsageCache: writeClaudeUsageCache,
-        backoffUntil: usageRateLimitedUntil,
+        backoffUntil: (agentId, usageKey) => usageRateLimitedUntil(agentId, Date.now(), usageKey),
     });
     const { listProfiles } = await import('./profiles.js');
     const { refreshDueByokUsage } = await import('./byok-usage.js');

package/dist/lib/device-config.d.ts

@@ -147,8 +147,32 @@ export type AutoPoolMode = (typeof AUTO_POOL_MODES)[number];
  * explicit `worker` mark (see {@link listConfiguredDeviceRoles}).
  */
 export declare function configuredDeviceRole(name: string): ConfiguredDeviceRole | undefined;
+/**
+ * The role marked on THIS machine — the one running the CLI — or undefined when
+ * it was never marked. Keyed off {@link machineId} (overridable via
+ * AGENTS_SYNC_MACHINE_ID), so it matches the device's own config-folder key.
+ *
+ * The auth strategy reads this: a `personal` device (the user's own interactive
+ * box) holds a real per-version login and MUST authenticate from it for EVERY
+ * run, interactive or headless; only a `worker` uses the file-based setup-token
+ * (RUSH-2395). `undefined` is treated as non-personal (worker-equivalent) by
+ * that gate — an unmarked box has no login to defer to.
+ */
+export declare function selfConfiguredDeviceRole(): ConfiguredDeviceRole | undefined;
 /** Mark a device's role fleet-wide; `undefined` clears the mark. */
 export declare function setConfiguredDeviceRole(name: string, role: ConfiguredDeviceRole | undefined): void;
+/**
+ * Devices whose OWN config pins one of the browser profile keys to `profile`.
+ *
+ * Used by `profiles rename` to warn rather than silently leave a peer pointing at
+ * a name that no longer exists. Deliberately read-only: rewriting another
+ * machine's device doc from here would be a cross-machine mutation nobody asked
+ * for, and the pin may well be correct there (a local profile of the same name).
+ */
+export declare function devicesPinningBrowserProfile(profile: string): Array<{
+    device: string;
+    key: 'browser.profile' | 'browser.viewer';
+}>;
 /**
  * Every device with an effective role, keyed by device name. Layers like every
  * other device-scope key: the fleet default (central fleet.defaults.config)
@@ -194,14 +218,7 @@ export declare function isSchedulerEnabled(): boolean;
  * scheduler init) refuses with.
  */
 export declare function assertSchedulerEnabled(): void;
-/**
- * True unless this machine's config turns off the managed tmux wrap for
- * interactive `agents run` launches (`tmux.enabled=false`).
- *
- * Read as one of the guards in `shouldWrapInTmux` (lib/exec.ts) — the durable,
- * per-machine form of `--no-tmux` / `AGENTS_NO_TMUX=1`, for a box whose tmux is
- * broken or unwanted. Unset means today's behavior: wrap.
- */
+/** True only when this machine explicitly enables the managed tmux wrap. */
 export declare function isTmuxEnabled(): boolean;
 /** True unless this machine's config disables the daemon outright (top-level kill switch). */
 export declare function isDaemonEnabled(): boolean;