@phnx-labs/agents-cli 1.22.46 → 1.22.49

package/dist/lib/browser/runtime-state.js

@@ -1,8 +1,55 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
-import { getProfileRuntimeDir, getBrowserRuntimeDir, listProfilesWithScope, getConfiguredDefaultProfileName, isProfileLaunchableHere, deleteProfile, DEFAULT_BROWSER_PROFILE_NAME, LEGACY_DEFAULT_BROWSER_PROFILE_NAME, } from './profiles.js';
+import { getProfileRuntimeDir, getBrowserRuntimeDir, getEndpointPresets, listProfiles, getConfiguredDefaultProfileName, isProfileLaunchableHere, deleteProfile, DEFAULT_BROWSER_PROFILE_NAME, LEGACY_DEFAULT_BROWSER_PROFILE_NAME, } from './profiles.js';
 import { keyBelongsToProfile } from './types.js';
+import { declaringDevices, profileKind } from './registry.js';
+import { machineId } from '../machine-id.js';
+/**
+ * Detect an identity-bearing profile whose stored endpoint is loopback, viewed
+ * from a machine that is NOT the declaring device.
+ *
+ * That is the original `comet-local` bug: five real logins on the declaring
+ * box, a bare logged-out chromium answering to the same name on a worker
+ * because `cdp://localhost:N` is evaluated on the machine running the command.
+ * The daemon now tunnels that shape (`resolve-target.ts`); doctor still flags
+ * it so a worker does not report a green local binary/port for someone else's
+ * browser. Kind comes from the registry (exactly one declaring device), never
+ * from a stored field.
+ */
+export function identityLoopbackMismatch(profile) {
+    if (profileKind(profile.name) !== 'identity')
+        return { misfiled: false };
+    const declaringDevice = declaringDevices(profile.name)[0];
+    if (!declaringDevice || declaringDevice === machineId())
+        return { misfiled: false };
+    const presets = getEndpointPresets(profile);
+    const chosen = profile.defaultEndpoint && presets[profile.defaultEndpoint]
+        ? profile.defaultEndpoint
+        : Object.keys(presets)[0];
+    if (!chosen)
+        return { misfiled: false };
+    const target = presets[chosen].target;
+    if (!target.startsWith('cdp://'))
+        return { misfiled: false };
+    let host;
+    try {
+        host = new URL(target).hostname;
+    }
+    catch {
+        return { misfiled: false };
+    }
+    if (host !== 'localhost' && host !== '127.0.0.1' && host !== '::1' && host !== '[::1]') {
+        return { misfiled: false };
+    }
+    const here = machineId();
+    return {
+        misfiled: true,
+        why: `identity-bearing profile declared on ${declaringDevice}, but "${target}" is a loopback endpoint — ` +
+            `on ${here} that address is this device's own browser, not ${declaringDevice}'s. ` +
+            `Diagnose the real browser on ${declaringDevice}: agents browser profiles doctor ${profile.name}`,
+    };
+}
 const PID_FILE = 'pid';
 const PORT_FILE = 'port';
 const COMMAND_FILE = 'command';
@@ -96,7 +143,7 @@ export function clearProfileRuntime(profileName) {
 }
 /**
  * Recursively remove the whole profile cache (chrome-data, tasks.json,
- * everything). Used by `profiles delete` so an old profile name doesn't
+ * everything). Used by `profiles remove` so an old profile name doesn't
  * leak its history into a freshly-recreated one.
  */
 export function removeProfileCache(profileName) {
@@ -298,8 +345,6 @@ export const PRUNE_REASON_TEXT = {
  *   - **the auto-detected profile** (`auto-chrome`, or the `default` an older
  *     build wrote) — auto-regenerated by `ensureDefaultBrowserProfile`, so
  *     pruning it is pure churn.
- *   - **fleet-synced** — deleting one removes it from EVERY machine, so it takes
- *     the explicit `includeFleet` opt-in.
  *
  * Known limitation: `BrowserProfileConfig` records no creation time, so a
  * profile created seconds ago and not yet started is indistinguishable from an
@@ -308,10 +353,17 @@ export const PRUNE_REASON_TEXT = {
  */
 export function planProfilePrune(profiles, opts = {}) {
     const plan = { candidates: [], kept: [] };
-    for (const { name, scope, launchableHere } of profiles) {
-        const keep = (why) => { plan.kept.push({ name, scope, why }); };
-        if (scope === 'fleet' && !opts.includeFleet) {
-            keep('fleet-synced (pass --fleet to include it)');
+    for (const { name, scope, launchableHere, misfiledWhy } of profiles) {
+        const keep = (why, misfiled = false) => {
+            plan.kept.push(misfiled ? { name, scope, why, misfiled } : { name, scope, why });
+        };
+        // Checked FIRST. A misfiled identity profile's defining symptom is that the
+        // browser is absent on whatever box you are standing on — pruning it would
+        // delete the declaring device's entry (or throw, for a peer declaration).
+        // The repair is to declare it only on the machine that owns the browser;
+        // an intentional delete is still available as `profiles remove`.
+        if (misfiledWhy) {
+            keep(`MISFILED — ${misfiledWhy}`, true);
             continue;
         }
         if (name === DEFAULT_BROWSER_PROFILE_NAME || name === LEGACY_DEFAULT_BROWSER_PROFILE_NAME) {
@@ -343,13 +395,44 @@ export function planProfilePrune(profiles, opts = {}) {
  * Build the prune plan from live config. Split from {@link planProfilePrune} so
  * the decision rules stay unit-testable without a configured machine.
  */
-export async function buildProfilePrunePlan(opts = {}) {
-    const scoped = await listProfilesWithScope();
-    return planProfilePrune(scoped.map(({ profile, scope }) => ({
-        name: profile.name,
-        scope,
-        launchableHere: isProfileLaunchableHere(profile),
-    })), { includeFleet: opts.includeFleet, configuredDefault: getConfiguredDefaultProfileName() });
+export async function buildProfilePrunePlan() {
+    const current = machineId();
+    const profiles = await listProfiles();
+    const declaredHere = [];
+    const peerKept = [];
+    for (const profile of profiles) {
+        const scope = profile.devices.length > 1 ? 'fungible' : 'identity';
+        const misfiled = identityLoopbackMismatch(profile);
+        if (profile.devices.includes(current)) {
+            declaredHere.push({
+                name: profile.name,
+                scope,
+                launchableHere: isProfileLaunchableHere(profile),
+                misfiledWhy: misfiled.misfiled ? misfiled.why : undefined,
+            });
+            continue;
+        }
+        if (misfiled.misfiled) {
+            peerKept.push({
+                name: profile.name,
+                scope,
+                why: `MISFILED — ${misfiled.why}`,
+                misfiled: true,
+            });
+        }
+        else {
+            peerKept.push({
+                name: profile.name,
+                scope,
+                why: `declared on ${profile.devices.join(', ')}, not this device`,
+            });
+        }
+    }
+    const plan = planProfilePrune(declaredHere, {
+        configuredDefault: getConfiguredDefaultProfileName(),
+    });
+    plan.kept.push(...peerKept);
+    return plan;
 }
 /**
  * Execute a prune plan: drop each candidate's config entry and wipe its cache

package/dist/lib/browser/service.d.ts

@@ -1,4 +1,5 @@
 import { CDPClient } from './cdp.js';
+import { type DeviceProbe } from './resolve-target.js';
 import { type ResolvedDomainSkill } from './domain-skills.js';
 import { type Task, type TabInfo, type ProfileStatus, type BrowserType, type HistoricalTask, type ReapResult, type ProfileName, type ConnectionKey } from './types.js';
 import { type ReapOptions } from './hygiene.js';
@@ -136,7 +137,8 @@ export declare class BrowserService {
      * Live browsers, keyed by {@link ConnectionKey} — NOT by profile name. The
      * branded key type is what makes `connections.get(someProfileName)` (the
      * RUSH-2709 miss that made `status --profile <name>` return empty for a
-     * running `<name>@endpoint-0`) fail to compile.
+     * running `<name>@<device>`) fail to compile. Keys are `<profile>@<device>`
+     * (legacy leftover `<profile>@endpoint-N` dirs are still recognized).
      */
     private connections;
     private forkingProfiles;
@@ -161,8 +163,12 @@ export declare class BrowserService {
         launchId?: string;
         /** Calling agent session, forwarded from the CLI (see IPCRequest.sessionId). */
         sessionId?: string;
+        /** Whether the CALLER was dispatched here by a fleet `--device` hop. */
+        fleetRemote?: boolean;
         /** Explicit human label (`--title`). */
         title?: string;
+        /** Injected reachability probe — production uses ssh; tests pass a fake. */
+        probe?: DeviceProbe;
     }): Promise<{
         task: string;
         name: string;
@@ -170,8 +176,12 @@ export declare class BrowserService {
         windowId?: string;
         /** BARE profile name — what the caller asked for, never the runtime key. */
         profile: ProfileName;
-        /** Runtime key the task actually landed on (`<profile>@<endpoint>`). */
+        /** Runtime key the task actually landed on (`<profile>@<device>`). */
         key: ConnectionKey;
+        /** Device the daemon connected to. */
+        device: string;
+        /** Set when the daemon picked a remote declaring device. */
+        picked?: string;
         skill?: ResolvedDomainSkill;
     }>;
     /**
@@ -238,7 +248,7 @@ export declare class BrowserService {
     /**
      * Close tasks whose owning agent session is gone, or that have sat untouched
      * past the idle window. The entry point the daemon's periodic tick and
-     * `agents browser gc` both call; the policy lives in `hygiene.ts`.
+     * `agents browser prune` both call; the policy lives in `hygiene.ts`.
      */
     reapAbandoned(opts?: ReapOptions): Promise<ReapResult>;
     stop(taskName: string): Promise<{
@@ -359,8 +369,9 @@ export declare class BrowserService {
      * `profileName` is a {@link ProfileName} — a BARE name, never a runtime key.
      * Every candidate is selected by the one rule ({@link keyBelongsToProfile}),
      * and a scoped query that finds no live connection falls through to disk, so
-     * `status --profile comet-local` reports the LIVE `comet-local@endpoint-0`
-     * instead of the empty list it used to return (RUSH-2709).
+     * `status --profile comet-local` reports the LIVE `comet-local@<device>`
+     * (and leftover `comet-local@endpoint-0` dirs) instead of the empty list
+     * it used to return (RUSH-2709).
      */
     status(profileRef?: ProfileName | ConnectionKey): Promise<ProfileStatus[]>;
     /**
@@ -436,10 +447,9 @@ export declare class BrowserService {
      * already resolved the endpoint and built the `effectiveProfile` with
      * the per-endpoint binary/targetFilter overrides applied; we just use it.
      *
-     * `key` is the runtime key (`<profile>@<endpoint>`) and is what every on-disk
-     * lookup uses, so per-endpoint pid/port files don't collide when the same app
-     * runs locally and remotely at the same time. It is a SEPARATE argument
-     * because `effectiveProfile.name` stays the bare, user-facing name (RUSH-2709).
+     * `key` is the runtime key (`<profile>@<device>`) and is what every on-disk
+     * lookup uses. It is a SEPARATE argument because `effectiveProfile.name`
+     * stays the bare, user-facing name (RUSH-2709).
      */
     private connectProfile;
     private connectEndpoint;
@@ -469,6 +479,8 @@ export declare class BrowserService {
      *   - no handle, zero, !createIfMissing → return null (caller reports "nothing to close")
      */
     resolveOrCreateTask(opts: {
+        /** Whether the CALLER was dispatched here by a fleet `--device` hop. */
+        fleetRemote?: boolean;
         task?: string;
         profile?: string;
         actor?: string;
@@ -482,6 +494,8 @@ export declare class BrowserService {
         task: Task;
         key: ConnectionKey;
         created: boolean;
+        picked?: string;
+        device?: string;
     } | null>;
     private listTasksForCaller;
     private currentUrlHint;
@@ -536,6 +550,48 @@ export declare class BrowserService {
     private saveTaskState;
     private loadTaskState;
     private saveToHistory;
+    /**
+     * The cached connection for `key`, or undefined — evicting it first if the
+     * browser died underneath us.
+     *
+     * A browser killed externally (Cmd-Q, crash, a user clearing the profile by
+     * hand) leaves a closed WebSocket in the map. Without this the next
+     * `cdp.send` throws "CDP connection not open" and there is no recovery short
+     * of killing the daemon.
+     */
+    private reuseHealthyConnection;
+    /**
+     * Reuse a live connection for this profile: the new `<name>@<device>` key
+     * first, then any leftover `<name>@endpoint-N` key still in the map so a
+     * browser started before the key collapse is not abandoned.
+     */
+    private reuseProfileConnection;
+    /** Connect a profile at `target`, register it under `key`, and arm downloads. */
+    private openConnection;
+    /**
+     * Open a tab for a HUMAN to read, bound to no task.
+     *
+     * That is the entire difference from {@link start}, and it is the point. The
+     * abandoned-task reaper closes a task's tabs when the calling session dies or
+     * after the idle window, but it "deliberately never touches a tab that is not
+     * in `task.tabs`" (hygiene.ts) — so a viewer tab must not be in one, or the
+     * artifact the user is reading vanishes when the agent that rendered it exits.
+     *
+     * Consequently `stop`/`done` do not close it either, which is correct: it is
+     * the user's tab now.
+     */
+    showUrl(profileName: ProfileName, url: string, opts?: {
+        endpointName?: string;
+        fleetRemote?: boolean;
+        actor?: string;
+        probe?: DeviceProbe;
+    }): Promise<{
+        profile: ProfileName;
+        key: ConnectionKey;
+        tabId: string;
+        device: string;
+        picked?: string;
+    }>;
     getHistory(limit?: number): Promise<HistoricalTask[]>;
 }
 export {};