@phnx-labs/agents-cli 1.22.47 → 1.22.49

package/dist/lib/browser/profiles.js

@@ -2,8 +2,11 @@ import * as path from 'path';
 import * as fs from 'fs';
 import { getBrowserRuntimeDir as getBrowserRuntimeDirRoot, readMeta, updateMeta, } from '../state.js';
 import { getConfigValue } from '../device-config.js';
+import { machineId } from '../machine-id.js';
+import { declaringDevices, profileRegistry, } from './registry.js';
 import { findBrowserPath, findFirstInstalledBrowser, isPortInUse } from './chrome.js';
 import { DEFAULT_VIEWPORT } from './devices.js';
+export { declaringDevices, profileKind, profileRegistry, } from './registry.js';
 /**
  * Name of the profile `ensureDefaultBrowserProfile` auto-detects and pins.
  *
@@ -29,25 +32,6 @@ export const LEGACY_DEFAULT_BROWSER_PROFILE_NAME = 'default';
  * wins, so no existing config breaks.
  */
 export const DEFAULT_PROFILE_ALIAS = 'default';
-/**
- * True for a profile whose contents only make sense on THIS machine, so it must
- * live in the per-machine doc rather than the fleet-synced agents.yaml.
- *
- * The auto-detected `default` always qualifies: it is generated by probing local
- * browser installs and a free local port, so its `binary:` is an absolute path
- * for one OS. Shared fleet-wide it caused a permanent rewrite loop — a macOS box
- * wrote `/Applications/...`, a Linux box rewrote `/usr/bin/chromium-browser`,
- * each on every `agents browser start`.
- *
- * As of RUSH-2716 it is not the only one: EVERY newly created profile is
- * machine-local unless the caller explicitly asks for the fleet-synced store
- * (`createProfile(p, { fleet: true })` / `--fleet`). See {@link createProfile}.
- * This predicate is what keeps an existing `default` that an older version wrote
- * into central from being written back there by {@link updateProfile}.
- */
-function isMachineLocalProfile(name) {
-    return name === DEFAULT_BROWSER_PROFILE_NAME || name === LEGACY_DEFAULT_BROWSER_PROFILE_NAME;
-}
 /**
  * The device-local configured default profile name (set via
  * `agents browser use`), or undefined when unset. When set, it
@@ -82,7 +66,7 @@ export function getProfileDownloadsDir(name) {
 export function getProfileSessionsDir(name, task) {
     return path.join(getProfileRuntimeDir(name), 'sessions', task);
 }
-function configToProfile(name, config) {
+function configToProfile(name, config, devices = []) {
     validateRemoteBrowserBinaries(config);
     return {
         name,
@@ -98,6 +82,7 @@ function configToProfile(name, config) {
         viewport: config.viewport,
         logDir: config.logDir,
         logHost: config.logHost,
+        devices,
     };
 }
 function profileToConfig(profile) {
@@ -128,38 +113,24 @@ function profileToConfig(profile) {
         config.logHost = profile.logHost;
     return config;
 }
-/**
- * Every profile visible on this machine: the fleet-shared ones plus this
- * machine's own. A machine-local entry WINS on a name collision — it was written
- * by this box for this box, whereas the shared copy may carry another OS's
- * binary path (that mismatch is exactly why `default` moved local).
- */
-function allProfileConfigs() {
-    const meta = readMeta();
-    return { ...meta.browser, ...meta.deviceBrowser };
+function selectedDeclaration(declarations) {
+    return declarations.find((declaration) => declaration.device === machineId()) ?? declarations[0];
 }
-export async function listProfiles() {
-    const configs = allProfileConfigs();
-    return Object.entries(configs).map(([name, config]) => configToProfile(name, config));
+function localDeclaration(name) {
+    return profileRegistry().get(name)?.find((declaration) => declaration.device === machineId());
 }
-/**
- * Every visible profile paired with the store it lives in. Same precedence as
- * {@link listProfiles} — a machine-local entry wins a name collision, so a name
- * present in both maps reports `local`, which is the copy that is actually used.
- */
-export async function listProfilesWithScope() {
-    const meta = readMeta();
-    const local = meta.deviceBrowser ?? {};
-    return Object.entries(allProfileConfigs()).map(([name, config]) => ({
-        profile: configToProfile(name, config),
-        scope: (local[name] ? 'local' : 'fleet'),
-    }));
+export async function listProfiles() {
+    return [...profileRegistry()].map(([name, declarations]) => {
+        const selected = selectedDeclaration(declarations);
+        return configToProfile(name, selected.config, declarations.map((declaration) => declaration.device));
+    });
 }
 export async function getProfile(name) {
-    const config = allProfileConfigs()[name];
-    if (!config)
+    const declarations = profileRegistry().get(name);
+    if (!declarations?.length)
         return null;
-    return configToProfile(name, config);
+    const selected = selectedDeclaration(declarations);
+    return configToProfile(name, selected.config, declarations.map((declaration) => declaration.device));
 }
 /**
  * True when `profile` can actually launch or attach on THIS machine.
@@ -183,26 +154,6 @@ export function isProfileLaunchableHere(profile) {
         return false;
     }
 }
-/**
- * Resolve the profile `agents browser start` uses when no `--profile` is given.
- *
- * Order: (1) the device-local configured default (`agents browser profiles
- * set-default <name>`) when it names an existing profile that can launch here;
- * (2) an existing `default` profile that can launch here; (3) auto-pick the
- * first installed Chromium-family browser per the platform priority list in
- * chrome.ts (macOS: chrome > brave > edge > chromium > comet > arc; Linux: chrome >
- * chromium > brave > edge; Windows: edge > chrome > brave > comet) and pin a
- * `default` profile to it. Throws an actionable error if none of those binaries
- * are installed.
- *
- * "Can launch here" matters because `agents.yaml` syncs across the fleet: a
- * `default` auto-created on macOS carries a `/Applications/...` binary path that
- * doesn't exist on a Linux box. Rather than hand that broken profile back (the
- * top browser roadblock — "Custom binary not found"), we re-detect and
- * regenerate the `default` for this machine. A configured or existing default
- * that no longer exists, or can't launch here, warns and falls through — never a
- * hard fail.
- */
 /**
  * The auto-detected profile this machine already carries, under either name —
  * the current `auto-chrome` or the `default` an older build wrote. Callers that
@@ -210,8 +161,14 @@ export function isProfileLaunchableHere(profile) {
  * name, or a machine that predates the RUSH-2709 rename grows a second one.
  */
 export async function getAutoDetectedProfile() {
-    return ((await getProfile(DEFAULT_BROWSER_PROFILE_NAME)) ??
-        (await getProfile(LEGACY_DEFAULT_BROWSER_PROFILE_NAME)));
+    const current = machineId();
+    const registry = profileRegistry();
+    for (const name of [DEFAULT_BROWSER_PROFILE_NAME, LEGACY_DEFAULT_BROWSER_PROFILE_NAME]) {
+        const declaration = registry.get(name)?.find((entry) => entry.device === current);
+        if (declaration)
+            return configToProfile(name, declaration.config, [current]);
+    }
+    return null;
 }
 /**
  * Resolve what a caller typed after `--profile` to a real, BARE profile name.
@@ -262,15 +219,16 @@ export async function resolveProfileRef(ref) {
  * `start`'s resolver. Same order as {@link resolveProfileRef} for an explicit
  * name, but the IMPLICIT path (no `--profile`, or the bare `default` alias with
  * no profile of that name) goes through {@link ensureDefaultBrowserProfile} —
- * which additionally verifies the resolved default can launch on THIS machine,
- * warns and falls through when it can't, and regenerates or creates one.
+ * which additionally verifies the resolved default can launch on THIS machine.
+ * An undeclared configured default is an error. A declared default whose
+ * browser isn't installed here warns and falls through to auto-detect.
  *
  * `start` is the only command that launches a browser, so it is the only one
  * that may do those things; routing a filter-only command through this would
  * warn about, and rewrite, config the user never asked it to touch.
  *
- * Throws when no profile exists and no supported browser is installed —
- * `ensureDefaultBrowserProfile`'s actionable "install one of …" error.
+ * Throws when the configured default is undeclared, or when no profile exists
+ * and no supported browser is installed.
  */
 export async function resolveProfileRefForStart(ref) {
     if (ref && ref !== DEFAULT_PROFILE_ALIAS)
@@ -280,25 +238,51 @@ export async function resolveProfileRefForStart(ref) {
         return ref;
     return (await ensureDefaultBrowserProfile()).name;
 }
+/**
+ * Resolve the profile a bare `agents browser start` uses.
+ *
+ * Order: (1) the device-local configured default (`agents browser use <name>`)
+ * when it names a profile that exists and can launch here; (2) an existing
+ * auto-detected profile that can launch here; (3) auto-pick the first installed
+ * Chromium-family browser and pin `auto-chrome` (or repair a stale legacy
+ * `default`) to it.
+ *
+ * Two failure modes at the configured-default step are not the same:
+ *   - No device declares the name (including a leftover central `browser:`
+ *     entry that was never claimed) → throw. Auto-creating `auto-chrome` would
+ *     hand the agent a logged-out browser while `browser.profile` still names
+ *     the credentialed one.
+ *   - The name is declared, but its browser/binary is not installed HERE →
+ *     warn and fall through. That is a missing binary on this box, not a
+ *     missing identity; auto-detect is the existing repair.
+ */
 export async function ensureDefaultBrowserProfile() {
     const configured = getConfiguredDefaultProfileName();
     if (configured && configured !== DEFAULT_PROFILE_ALIAS) {
         const chosen = await getProfile(configured);
         if (chosen && isProfileLaunchableHere(chosen))
             return chosen;
-        console.warn(chosen
-            ? `warning: configured default browser profile "${configured}" can't launch on this ` +
-                `machine (its browser/binary isn't installed here); falling back to auto-detect. ` +
-                `Fix with: agents browser use <name>  (or --unset)`
-            : `warning: configured default browser profile "${configured}" no longer exists; ` +
-                `falling back to auto-detect. Fix with: agents browser use <name>  (or --unset)`);
+        if (!chosen) {
+            const central = readMeta().browser ?? {};
+            if (central[configured]) {
+                throw new Error(`configured default browser profile "${configured}" is not declared by any device. ` +
+                    `It still lives in the central agents.yaml browser: map. ` +
+                    `Claim it on the machine that hosts that browser with: agents browser profiles claim ${configured}`);
+            }
+            throw new Error(`configured default browser profile "${configured}" is not declared by any device. ` +
+                `Create it with: agents browser profiles create ${configured} --browser <chrome|comet|chromium|brave|edge|arc|custom> ` +
+                `(or, if it is a leftover central profile, claim it with: agents browser profiles claim ${configured}). ` +
+                `Or unset the default with: agents browser use --unset`);
+        }
+        console.warn(`warning: configured default browser profile "${configured}" can't launch on this ` +
+            `machine (its browser/binary isn't installed here); falling back to auto-detect. ` +
+            `Fix with: agents browser use <name>  (or --unset)`);
     }
     // Prefer whichever auto-detected profile this machine already carries: the
     // current `auto-chrome`, else the `default` an older build wrote. Reusing the
     // legacy one is what keeps a currently-running browser (and its runtime dirs,
     // keyed `default@endpoint-0`) attached after the rename.
-    const existing = (await getProfile(DEFAULT_BROWSER_PROFILE_NAME)) ??
-        (await getProfile(LEGACY_DEFAULT_BROWSER_PROFILE_NAME));
+    const existing = await getAutoDetectedProfile();
     if (existing && isProfileLaunchableHere(existing))
         return existing;
     const detected = findFirstInstalledBrowser();
@@ -435,10 +419,13 @@ export function assertLocalPortFree(profile, opts = {}) {
     const wanted = effectiveLocalPort(profile);
     if (wanted === undefined)
         return;
-    for (const [existingName, existingConfig] of Object.entries(allProfileConfigs())) {
+    for (const [existingName, declarations] of profileRegistry()) {
         if (existingName === opts.ignore)
             continue;
-        const existingProfile = configToProfile(existingName, existingConfig);
+        const declaration = declarations.find((entry) => entry.device === machineId());
+        if (!declaration)
+            continue;
+        const existingProfile = configToProfile(existingName, declaration.config, [machineId()]);
         if (effectiveLocalPort(existingProfile) === wanted) {
             throw new Error(`Local port ${wanted} is already used by profile "${existingName}". ` +
                 `Each profile must own a unique local port (SSH tunnels now bind ` +
@@ -446,28 +433,10 @@ export function assertLocalPortFree(profile, opts = {}) {
         }
     }
 }
-/**
- * Create a profile. **It lands in this machine's own store by default** — pass
- * `{ fleet: true }` (the CLI's `--fleet`) to put it in the synced `agents.yaml`
- * where every box will see it.
- *
- * Local-by-default is the RUSH-2716 fix. A profile is a local browser install
- * (`binary:` is an absolute path for one OS) bound to a locally chosen free port,
- * so the fleet-synced copy is wrong on every other machine to begin with; and
- * because agents mint throwaway profiles freely, every ad-hoc one was syncing to
- * every machine as junk that nothing cleaned up (`agents browser profiles prune`
- * is the other half of that fix). Opting in with `--fleet` is for a profile that
- * really is fleet config — a remote `ssh://` endpoint, or a named profile whose
- * shape you want on every box.
- *
- * Existing profiles are NOT migrated: this only decides where a NEW entry is
- * written, so a fleet profile created before this change keeps syncing.
- */
-export async function createProfile(profile, opts = {}) {
-    const meta = readMeta();
-    const existingConfigs = allProfileConfigs();
-    if (existingConfigs[profile.name]) {
-        throw new Error(`Profile "${profile.name}" already exists`);
+/** Declare a profile on this device. The same name may be declared by peers. */
+export async function createProfile(profile) {
+    if (localDeclaration(profile.name)) {
+        throw new Error(`Profile "${profile.name}" already exists on ${machineId()}`);
     }
     assertLocalPortFree(profile);
     // Resolve the browser binary at create time. Fails fast with an actionable
@@ -482,69 +451,23 @@ export async function createProfile(profile, opts = {}) {
         findBrowserPath(profile.browser, profile.binary);
     }
     const config = profileToConfig(profile);
-    // Machine-local unless the caller explicitly asked for the fleet store. The
-    // auto `default` is always local regardless of what a caller passes — its
-    // binary path and port are this box's, and fleet-syncing it is the rewrite
-    // loop RUSH-2161 fixed.
-    if (!opts.fleet || isMachineLocalProfile(profile.name)) {
-        updateMeta((m) => ({ ...m, deviceBrowser: { ...m.deviceBrowser, [profile.name]: config } }));
-        return;
-    }
-    updateMeta((m) => ({ ...m, browser: { ...m.browser, [profile.name]: config } }));
+    updateMeta((meta) => ({
+        ...meta,
+        deviceBrowser: { ...meta.deviceBrowser, [profile.name]: config },
+    }));
 }
 export async function updateProfile(profile) {
-    const meta = readMeta();
-    const local = meta.deviceBrowser?.[profile.name];
-    if (!local && !meta.browser?.[profile.name]) {
-        throw new Error(`Profile "${profile.name}" does not exist`);
+    const local = localDeclaration(profile.name);
+    if (!local) {
+        const devices = declaringDevices(profile.name);
+        const where = devices.length > 0 ? `; declared on ${devices.join(', ')}` : '';
+        throw new Error(`Profile "${profile.name}" is not declared on ${machineId()}${where}`);
     }
     const config = profileToConfig(profile);
-    // A profile that already lives machine-locally stays there; so does the auto
-    // `default`, whose binary path and port are specific to this machine.
-    if (local || isMachineLocalProfile(profile.name)) {
-        updateMeta((m) => ({ ...m, deviceBrowser: { ...m.deviceBrowser, [profile.name]: config } }));
-        return;
-    }
-    updateMeta((m) => ({ ...m, browser: { ...m.browser, [profile.name]: config } }));
-}
-/**
- * Flag a fleet-synced profile whose contents only make sense on ONE machine.
- *
- * A `cdp://` endpoint on loopback always connects on the machine EVALUATING the
- * profile, so a fleet-scope copy does not mean "that browser" — it means "port N
- * on whichever box ran the command". The name then silently resolves to a
- * different, usually logged-out browser on every other machine, which is the
- * worst possible failure for a profile that carries live logins.
- *
- * Reported by `profiles doctor` (a failing `scope` check) and noted in the
- * `kept` reason `profiles prune` prints for a fleet profile. The repair is
- * {@link moveProfileScope}, never an automatic rewrite of the synced doc.
- */
-export function misfiledFleetProfile(profile, scope) {
-    if (scope !== 'fleet')
-        return { misfiled: false };
-    // Judge the endpoint the profile would actually CONNECT on, resolving
-    // `defaultEndpoint` exactly as effectiveLocalPort does. Scanning every preset
-    // instead would fail a legitimate fleet profile that defaults to `ssh://` and
-    // merely carries a loopback alternate for local debugging.
-    const presets = getEndpointPresets(profile);
-    const chosen = profile.defaultEndpoint && presets[profile.defaultEndpoint]
-        ? profile.defaultEndpoint
-        : Object.keys(presets)[0];
-    if (!chosen)
-        return { misfiled: false };
-    const loopback = presets[chosen].target;
-    if (!loopback.startsWith('cdp://'))
-        return { misfiled: false };
-    const parsed = parseEndpointUrl(loopback);
-    if (!parsed || !isLocalHost(parsed.host))
-        return { misfiled: false };
-    return {
-        misfiled: true,
-        why: `fleet-synced but "${loopback}" is a loopback endpoint — on every other machine ` +
-            `this name resolves to that box's own port, not this browser. ` +
-            `Repair on the machine that owns it: agents browser profiles scope ${profile.name} local`,
-    };
+    updateMeta((meta) => ({
+        ...meta,
+        deviceBrowser: { ...meta.deviceBrowser, [profile.name]: config },
+    }));
 }
 /**
  * Merge `patch` onto the stored profile and persist it in the store it already
@@ -556,13 +479,14 @@ export function misfiledFleetProfile(profile, scope) {
  * with this profile excluded so an unchanged port is not a self-collision.
  */
 export async function editProfile(name, patch) {
-    const meta = readMeta();
-    const local = meta.deviceBrowser?.[name];
-    const fleet = meta.browser?.[name];
-    if (!local && !fleet) {
-        throw new Error(`Profile "${name}" does not exist`);
-    }
-    const current = configToProfile(name, (local ?? fleet));
+    const local = localDeclaration(name);
+    if (!local) {
+        const devices = declaringDevices(name);
+        const where = devices.length > 0 ? `; declared on ${devices.join(', ')}` : '';
+        throw new Error(`Profile "${name}" is not declared on ${machineId()}${where}`);
+    }
+    const devices = declaringDevices(name);
+    const current = configToProfile(name, local.config, devices);
     const merged = { ...current, ...patch, name };
     const changed = Object.keys(patch).filter((k) => JSON.stringify(current[k]) !== JSON.stringify(merged[k]));
     // A target filter only means anything for an Electron app, and the gate must
@@ -580,27 +504,12 @@ export async function editProfile(name, patch) {
         findBrowserPath(merged.browser, merged.binary);
     }
     await updateProfile(merged);
-    const landedLocal = !!local || isMachineLocalProfile(name);
     return {
         profile: merged,
-        scope: landedLocal ? 'local' : 'fleet',
+        devices,
         changed,
-        fleetCopyLeftStale: landedLocal && !local && !!fleet ? true : undefined,
     };
 }
-/**
- * Move an existing profile between the fleet-synced store and this machine's
- * device store.
- *
- * `fleet -> local` is the repair for a profile whose endpoint is machine-bound
- * (a loopback `cdp://`) but which was created with `--fleet`: the name resolves
- * to a DIFFERENT browser on every box, because `cdp:` always connects on the
- * machine evaluating it. Run it ON the machine that owns the browser — the copy
- * that survives is the one that works.
- *
- * Deliberately not automatic. Rewriting the user's synced `agents.yaml` from a
- * heuristic is the rewrite loop RUSH-2161 fixed; this is an explicit verb.
- */
 /** Profile names an agent has to be able to type and an fs path can hold. */
 const PROFILE_NAME_RE = /^[a-z][a-z0-9-]*$/;
 /**
@@ -647,12 +556,13 @@ export function assertRegistrableProfileName(name) {
 export async function renameProfile(from, to) {
     if (from === to)
         throw new Error(`"${from}" is already its own name.`);
-    const meta = readMeta();
-    const local = meta.deviceBrowser?.[from];
-    const fleet = meta.browser?.[from];
-    if (!local && !fleet)
-        throw new Error(`Profile "${from}" does not exist`);
-    if (allProfileConfigs()[to])
+    const local = localDeclaration(from);
+    if (!local) {
+        const devices = declaringDevices(from);
+        const where = devices.length > 0 ? `; declared on ${devices.join(', ')}` : '';
+        throw new Error(`Profile "${from}" is not declared on ${machineId()}${where}`);
+    }
+    if (profileRegistry().has(to))
         throw new Error(`Profile "${to}" already exists`);
     assertRegistrableProfileName(to);
     const { isProfileInUse, listProfileCacheDirs } = await import('./runtime-state.js');
@@ -660,26 +570,8 @@ export async function renameProfile(from, to) {
         throw new Error(`"${from}" is in use (live browser, tunnel, or open task). Renaming would move its ` +
             `user-data-dir out from under the running browser. Stop it first: agents browser stop --profile ${from}`);
     }
-    // A name can exist in BOTH stores (local wins in allProfileConfigs). Rewriting
-    // only one leaves the other listed under the OLD name with its data dir already
-    // moved away — the abandoned-`--user-data-dir` state this command exists to
-    // prevent, produced by this command, and previously reported as a clean
-    // success. Refuse instead: which copy the user means is genuinely ambiguous,
-    // and `profiles scope` is the tool for collapsing the duplicate first.
-    if (local && fleet) {
-        // `scope <name> fleet`, NOT local: moveProfileScope computes `from` as
-        // 'local' whenever a local entry exists, so asking for local is a no-op that
-        // reports success and leaves the duplicate. Sending the user there and then
-        // to `profiles delete` — which drops the cached runtime dirs by default —
-        // walked a data-preservation command into a data-destroying one.
-        throw new Error(`"${from}" exists in BOTH this machine's store and the fleet-synced one. ` +
-            `Renaming would move its browser data while leaving one copy behind under the old name.\n` +
-            `  Collapse the duplicate first:  agents browser profiles scope ${from} fleet\n` +
-            `  Then rename.  (To drop a copy instead, agents browser profiles delete ${from} --keep-cache ` +
-            `keeps the browser data.)`);
-    }
-    const config = (local ?? fleet);
-    const scope = local ? 'local' : 'fleet';
+    const config = local.config;
+    const devices = declaringDevices(from);
     // Move the on-disk state BEFORE the config, so a crash between the two leaves
     // a profile whose dirs are already where the new name expects them rather than
     // a config pointing at dirs that no longer exist.
@@ -703,20 +595,11 @@ export async function renameProfile(from, to) {
         fs.renameSync(dir, dest);
         movedDirs.push(dest);
     }
-    if (scope === 'local') {
-        updateMeta((m) => {
-            const next = { ...m.deviceBrowser };
-            delete next[from];
-            return { ...m, deviceBrowser: { ...next, [to]: config } };
-        });
-    }
-    else {
-        updateMeta((m) => {
-            const next = { ...m.browser };
-            delete next[from];
-            return { ...m, browser: { ...next, [to]: config } };
-        });
-    }
+    updateMeta((meta) => {
+        const next = { ...meta.deviceBrowser };
+        delete next[from];
+        return { ...meta, deviceBrowser: { ...next, [to]: config } };
+    });
     // Both pointers are separate keys. Leaving `browser.profile` behind falls back
     // to auto-detect on the next `browser start`; leaving `browser.viewer` behind
     // sends every artifact back to the OS default handler — which is the exact bug
@@ -732,68 +615,24 @@ export async function renameProfile(from, to) {
         setConfigValue('browser.viewer', to);
         repointedViewer = true;
     }
-    // A fleet rename changes the name on every machine, but each machine's own
-    // config doc is separate — a peer pinning the old name is left dangling. Not
-    // rewritten from here: that would be a cross-machine mutation, and on a peer
-    // the pin may be correct (a LOCAL profile of the same name). Reported instead.
+    // A rename changes only this device's declaration. If it was the only
+    // declaration, peer pins become stale and are reported rather than rewritten.
     const { devicesPinningBrowserProfile } = await import('../device-config.js');
-    const { machineId } = await import('../machine-id.js');
-    const stalePins = scope === 'fleet'
+    const stalePins = devices.length === 1
         ? devicesPinningBrowserProfile(from).filter((p) => p.device !== machineId())
         : [];
-    return { scope, movedDirs, repointedDefault, repointedViewer, stalePins };
-}
-export async function moveProfileScope(name, to) {
-    const meta = readMeta();
-    const local = meta.deviceBrowser?.[name];
-    const fleet = meta.browser?.[name];
-    if (!local && !fleet) {
-        throw new Error(`Profile "${name}" does not exist`);
-    }
-    const from = local ? 'local' : 'fleet';
-    if (from === to)
-        return { from, to };
-    if (to === 'fleet' && isMachineLocalProfile(name)) {
-        throw new Error(`"${name}" is always machine-local — its binary path and port are this box's. ` +
-            `Fleet-syncing it is the rewrite loop RUSH-2161 fixed.`);
-    }
-    const config = (local ?? fleet);
-    // Write the destination BEFORE dropping the source, so a crash between the two
-    // leaves a duplicate (harmless — local wins in allProfileConfigs) rather than
-    // no profile at all.
-    if (to === 'local') {
-        updateMeta((m) => ({ ...m, deviceBrowser: { ...m.deviceBrowser, [name]: config } }));
-        updateMeta((m) => {
-            const next = { ...m.browser };
-            delete next[name];
-            return { ...m, browser: Object.keys(next).length > 0 ? next : undefined };
-        });
-    }
-    else {
-        updateMeta((m) => ({ ...m, browser: { ...m.browser, [name]: config } }));
-        updateMeta((m) => {
-            const next = { ...m.deviceBrowser };
-            delete next[name];
-            return { ...m, deviceBrowser: Object.keys(next).length > 0 ? next : undefined };
-        });
-    }
-    return { from, to };
+    return { devices, movedDirs, repointedDefault, repointedViewer, stalePins };
 }
 export async function deleteProfile(name) {
-    const meta = readMeta();
-    const isLocal = !!meta.deviceBrowser?.[name];
-    if (!isLocal && !meta.browser?.[name]) {
-        throw new Error(`Profile "${name}" does not exist`);
-    }
-    updateMeta((m) => {
-        if (isLocal) {
-            const next = { ...m.deviceBrowser };
-            delete next[name];
-            return { ...m, deviceBrowser: Object.keys(next).length > 0 ? next : undefined };
-        }
-        const next = { ...m.browser };
+    if (!localDeclaration(name)) {
+        const devices = declaringDevices(name);
+        const where = devices.length > 0 ? `; declared on ${devices.join(', ')}` : '';
+        throw new Error(`Profile "${name}" is not declared on ${machineId()}${where}`);
+    }
+    updateMeta((meta) => {
+        const next = { ...meta.deviceBrowser };
         delete next[name];
-        return { ...m, browser: Object.keys(next).length > 0 ? next : undefined };
+        return { ...meta, deviceBrowser: Object.keys(next).length > 0 ? next : undefined };
     });
 }
 /** Widest NAME column we will grow to before truncating instead. */
@@ -828,13 +667,10 @@ export function padColumn(text, width) {
  * a leading column, explained by a legend line — so the name column carries just
  * the name and `default` in it always means the profile of that name.
  *
- * The SCOPE column is the RUSH-2716 companion: it says whether an entry lives on
- * this machine only (`local`) or in the fleet-synced `agents.yaml` (`fleet`), so
- * "why does this box have a profile I never made here?" is answerable at a
- * glance.
+ * WHERE lists the devices whose own files declare the name.
  */
 export function formatProfilesTable(rows, configuredDefault) {
-    const cells = rows.map(({ profile, scope }) => {
+    const cells = rows.map((profile) => {
         const presets = getEndpointPresets(profile);
         const endpoints = Object.entries(presets)
             .map(([name, ep]) => (name.startsWith('endpoint-') ? ep.target : `${name}=${ep.target}`))
@@ -843,42 +679,35 @@ export function formatProfilesTable(rows, configuredDefault) {
             marker: profile.name === configuredDefault ? '*' : ' ',
             name: profile.name,
             browser: profile.browser || '-',
-            scope,
+            where: profile.devices.join(', '),
             description: profile.description ?? '',
             endpoints,
         };
     });
     const nameWidth = Math.min(MAX_NAME_COLUMN, Math.max('NAME'.length, ...cells.map((c) => c.name.length)));
     const browserWidth = Math.max('BROWSER'.length, ...cells.map((c) => c.browser.length));
-    // 'local' / 'fleet' are both 5 chars, so the header is the widest value.
-    const scopeWidth = 'SCOPE'.length;
+    const whereWidth = Math.min(36, Math.max('WHERE'.length, ...cells.map((c) => c.where.length)));
     const hasDescriptions = cells.some((c) => c.description);
     const descWidth = hasDescriptions
         ? Math.min(36, Math.max('DESCRIPTION'.length, ...cells.map((c) => c.description.length)))
         : 0;
-    const row = (marker, name, browser, scope, desc, endpoints) => `${marker} ` +
+    const row = (marker, name, browser, where, desc, endpoints) => `${marker} ` +
         padColumn(name, nameWidth) + '  ' +
         padColumn(browser, browserWidth) + '  ' +
-        padColumn(scope, scopeWidth) + '  ' +
+        padColumn(where, whereWidth) + '  ' +
         (hasDescriptions ? padColumn(desc, descWidth) + '  ' : '') +
         endpoints;
-    const header = row(' ', 'NAME', 'BROWSER', 'SCOPE', 'DESCRIPTION', 'ENDPOINTS');
+    const header = row(' ', 'NAME', 'BROWSER', 'WHERE', 'DESCRIPTION', 'ENDPOINTS');
     const lines = [header, '-'.repeat(header.length)];
     for (const c of cells) {
-        lines.push(row(c.marker, c.name, c.browser, c.scope, c.description, c.endpoints));
+        lines.push(row(c.marker, c.name, c.browser, c.where, c.description, c.endpoints));
     }
     if (configuredDefault) {
         lines.push('');
         lines.push(`* = this machine's default profile (${configuredDefault}) — what a bare \`agents browser start\` uses.`);
     }
-    lines.push(hasFleetRow(rows)
-        ? 'scope: local = this machine only · fleet = synced to every machine (agents.yaml).'
-        : 'scope: local = this machine only. Create a synced one with: agents browser profiles create <name> --fleet');
     return lines;
 }
-function hasFleetRow(rows) {
-    return rows.some((r) => r.scope === 'fleet');
-}
 /**
  * Resolve a profile's endpoint presets into a normalized map regardless of
  * whether the YAML uses the legacy `string[]` shape or the new map shape.