@phnx-labs/agents-cli 1.22.47 → 1.22.50

package/dist/commands/config.d.ts

@@ -5,7 +5,6 @@
  *   - run defaults (model, mode, effort)
  *   - tier overrides (folded into the run namespace)
  *   - interactive host
- *   - usage primary host
  *   - browser profile
  *   - local projects root
  *   - per-device config keys

package/dist/commands/config.js

@@ -5,7 +5,6 @@
  *   - run defaults (model, mode, effort)
  *   - tier overrides (folded into the run namespace)
  *   - interactive host
- *   - usage primary host
  *   - browser profile
  *   - local projects root
  *   - per-device config keys
@@ -40,8 +39,6 @@ function parseValue(key, parsed, raw) {
             return raw.trim();
         case 'interactive':
             return raw.trim();
-        case 'usage':
-            return raw.trim();
         case 'auto':
             return raw.trim();
         case 'browser':
@@ -109,10 +106,6 @@ function setConfig(parsed, value) {
             setConfigValue('interactive.host', value);
             return;
         }
-        case 'usage': {
-            setConfigValue('usage.primary-host', value);
-            return;
-        }
         case 'auto': {
             setConfigValue('auto.pool', value);
             return;
@@ -156,11 +149,6 @@ function unsetConfig(parsed) {
             unsetConfigValue('interactive.host');
             return had;
         }
-        case 'usage': {
-            const had = getConfigValue('usage.primary-host').value !== undefined;
-            unsetConfigValue('usage.primary-host');
-            return had;
-        }
         case 'auto': {
             const had = getConfigValue('auto.pool').value !== undefined;
             unsetConfigValue('auto.pool');
@@ -204,8 +192,6 @@ function getConfig(parsed) {
         }
         case 'interactive':
             return getConfigValue('interactive.host').value;
-        case 'usage':
-            return getConfigValue('usage.primary-host').value;
         case 'auto':
             return getConfigValue('auto.pool').value;
         case 'browser': {
@@ -263,9 +249,6 @@ function* listCentralConfigEntries() {
     if (meta.config?.interactiveHost !== undefined) {
         yield { key: 'interactive.host', value: meta.config.interactiveHost, hint: 'config.interactiveHost' };
     }
-    if (meta.config?.usagePrimaryHost !== undefined) {
-        yield { key: 'usage.primary-host', value: meta.config.usagePrimaryHost, hint: 'config.usagePrimaryHost' };
-    }
     if (meta.config?.autoPool !== undefined) {
         yield { key: 'auto.pool', value: meta.config.autoPool, hint: 'config.autoPool' };
     }
@@ -353,14 +336,11 @@ export function registerConfigCommand(program) {
       agents config set run.claude@2.1.45.model claude-opus-4-8
       agents config set run.claude@*.mode auto
       agents config set interactive.host zion
-      agents config set usage.primary-host zion
       agents config set browser.profile work
       agents config set project.root ~/src/github.com/<you>
       agents config set devices.mac-mini.max-agents 4
       agents config get run.claude@*.model
-      agents config get usage.primary-host
       agents config unset run.claude@*.tier.best
-      agents config unset usage.primary-host
       agents config list
       agents config budget
       agents config budget set per_day 50

package/dist/commands/daemon-test-harness.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared harness for the `agents daemon` CLI subprocess suites (RUSH-2354).
+ *
+ * Every test spawns the real CLI against an isolated mkdtemp HOME with no
+ * daemon running — no mocks. Modeled on routines.test.ts.
+ *
+ * EXTRACTED so the suite can live in several files. `daemon.test.ts` was 35
+ * tests in ONE file at 159s — the slowest file in the repo and therefore the
+ * SUITE'S FLOOR, because vitest parallelises across files and runs the tests
+ * inside one file sequentially in a single worker. Splitting the tests across
+ * files lets them run concurrently; sharing the harness is what makes that
+ * possible without duplicating the spawn plumbing.
+ */
+import { spawnSync, type ChildProcess } from 'child_process';
+export declare const REPO_ROOT: string;
+export declare const TSX_IMPORT: string;
+export declare const CLI_ENTRYPOINT: string;
+/**
+ * win32: subprocess CLI + process-group signals / path spawn assumptions
+ * (RUSH-2215). Exported as a PREDICATE, not as a pre-bound `describe.skip` —
+ * vitest's suite type is not nameable across a module boundary (TS4023), so
+ * each suite builds its own `describe` from this.
+ */
+export declare const DAEMON_TESTS_SUPPORTED: boolean;
+/** Provision an isolated HOME with just enough scaffolding for the CLI to boot. */
+export declare function makeHome(): string;
+/** Run `agents daemon <args>` against an isolated HOME — no daemon process ever started. */
+export declare function run(home: string, args: string[]): ReturnType<typeof spawnSync>;
+/**
+ * Spawn a real, long-lived process whose command line ends in `__daemon-run`
+ * (so `isDaemonRunProcess`'s `ps` check accepts it — see
+ * `lib/daemon.test.ts`'s "reaps a live __daemon-run registrant" test, same
+ * technique) and register it in `home`'s OWN instance registry, exactly the
+ * marker `registerDaemonInstance` would write. A real live process, not a
+ * mock — `agents daemon status` reads it through the actual registry +
+ * `ps`-liveness path, the same one the reaper and `stopDaemon`'s postcondition
+ * use.
+ */
+export declare function spawnFakeRegisteredDaemon(home: string): Promise<ChildProcess>;
+/** Register a pid in `home`'s instance registry — the scope stale/duplicate reporting uses. */
+export declare function registerInstance(home: string, pid: number): void;
+export declare function killFakeDaemon(child: ChildProcess): void;

package/dist/commands/daemon-test-harness.js

@@ -0,0 +1,90 @@
+/**
+ * Shared harness for the `agents daemon` CLI subprocess suites (RUSH-2354).
+ *
+ * Every test spawns the real CLI against an isolated mkdtemp HOME with no
+ * daemon running — no mocks. Modeled on routines.test.ts.
+ *
+ * EXTRACTED so the suite can live in several files. `daemon.test.ts` was 35
+ * tests in ONE file at 159s — the slowest file in the repo and therefore the
+ * SUITE'S FLOOR, because vitest parallelises across files and runs the tests
+ * inside one file sequentially in a single worker. Splitting the tests across
+ * files lets them run concurrently; sharing the harness is what makes that
+ * possible without duplicating the spawn plumbing.
+ */
+import { spawnSync, spawn } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { createRequire } from 'module';
+export const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const require = createRequire(import.meta.url);
+export const TSX_IMPORT = pathToFileURL(require.resolve('tsx')).href;
+export const CLI_ENTRYPOINT = path.join(REPO_ROOT, 'src', 'index.ts');
+/**
+ * win32: subprocess CLI + process-group signals / path spawn assumptions
+ * (RUSH-2215). Exported as a PREDICATE, not as a pre-bound `describe.skip` —
+ * vitest's suite type is not nameable across a module boundary (TS4023), so
+ * each suite builds its own `describe` from this.
+ */
+export const DAEMON_TESTS_SUPPORTED = process.platform !== 'win32';
+/** Provision an isolated HOME with just enough scaffolding for the CLI to boot. */
+export function makeHome() {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-daemon-test-'));
+    fs.mkdirSync(path.join(home, '.agents', '.system', '.git'), { recursive: true });
+    fs.writeFileSync(path.join(home, '.agents', 'agents.yaml'), 'agents: {}\n');
+    return home;
+}
+/** Run `agents daemon <args>` against an isolated HOME — no daemon process ever started. */
+export function run(home, args) {
+    return spawnSync('node', ['--import', TSX_IMPORT, CLI_ENTRYPOINT, 'daemon', ...args], {
+        cwd: REPO_ROOT,
+        env: {
+            ...process.env,
+            HOME: home,
+            USERPROFILE: home,
+            AGENTS_SKIP_MIGRATION: '1',
+            AGENTS_NO_AUTOPULL: '1',
+            AGENTS_CLI_DISABLE_AUTO_UPDATE: '1',
+            AGENTS_DAEMON_DIR: path.join(home, '.agents', '.cache', 'helpers', 'daemon'),
+        },
+        encoding: 'utf-8',
+        timeout: 30_000,
+    });
+}
+/**
+ * Spawn a real, long-lived process whose command line ends in `__daemon-run`
+ * (so `isDaemonRunProcess`'s `ps` check accepts it — see
+ * `lib/daemon.test.ts`'s "reaps a live __daemon-run registrant" test, same
+ * technique) and register it in `home`'s OWN instance registry, exactly the
+ * marker `registerDaemonInstance` would write. A real live process, not a
+ * mock — `agents daemon status` reads it through the actual registry +
+ * `ps`-liveness path, the same one the reaper and `stopDaemon`'s postcondition
+ * use.
+ */
+export async function spawnFakeRegisteredDaemon(home) {
+    const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1e9)', '__daemon-run'], {
+        stdio: 'ignore',
+    });
+    // Give the exec a moment to land before `ps` (read by the status command's
+    // isDaemonRunProcess check) is asked to see its real argv — mirrors
+    // lib/daemon.test.ts's identical fake-daemon technique.
+    await new Promise((r) => setTimeout(r, 150));
+    const instancesDir = path.join(home, '.agents', '.cache', 'helpers', 'daemon', 'instances');
+    fs.mkdirSync(instancesDir, { recursive: true });
+    fs.writeFileSync(path.join(instancesDir, String(child.pid)), '__daemon-run', 'utf-8');
+    return child;
+}
+/** Register a pid in `home`'s instance registry — the scope stale/duplicate reporting uses. */
+export function registerInstance(home, pid) {
+    const dir = path.join(home, '.agents', '.cache', 'helpers', 'daemon', 'instances');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, String(pid)), '__daemon-run', 'utf-8');
+}
+export function killFakeDaemon(child) {
+    try {
+        if (child.pid)
+            process.kill(child.pid, 'SIGKILL');
+    }
+    catch { /* already gone */ }
+}

package/dist/commands/daemon.d.ts

@@ -15,4 +15,25 @@
  * duplicating it.
  */
 import type { Command } from 'commander';
+import { type DaemonServiceId } from '../lib/daemon-services.js';
+/** One row of the roster every registered daemon service — supervisor-managed or legacy — renders in `agents daemon services`. */
+export interface DaemonServiceRow {
+    id: DaemonServiceId;
+    title: string;
+    description: string;
+    enabled: boolean;
+    /**
+     * `ServiceSupervisor`'s real lifecycle state when `supervised` is true
+     * (`idle`/`running`/`parked`/`stopped`, written cross-process via
+     * `recordSubsystemState`). A legacy `setInterval`-driven service has no such
+     * record, so its state is inferred from `enabled` + whether the daemon
+     * process is up — labelled distinctly so a reader can't mistake it for a
+     * measured value.
+     */
+    state: string;
+    supervised: boolean;
+    lastRunMs: number | null;
+    lastError: string | null;
+    consecutiveFailures: number;
+}
 export declare function registerDaemonCommand(program: Command): void;

package/dist/commands/daemon.js

@@ -21,8 +21,8 @@ import * as path from 'path';
 import { setHelpSections } from '../lib/help.js';
 import { getDaemonStatus, isDaemonRunning, isDaemonWedged, readDaemonLog, startDaemon, stopDaemon, signalDaemonReload, findSurvivingStateDirDaemons, getDaemonLogPath, isDaemonAutostartCircuitOpen, } from '../lib/daemon/daemon.js';
 import { getConfigValue, setConfigValue, isDaemonEnabled } from '../lib/device-config.js';
-import { readSubsystemHealth, SUBSYSTEM_SECRETS_BROKER, SUBSYSTEM_BROWSER_IPC, SUBSYSTEM_DAEMON_START, } from '../lib/daemon-health.js';
-import { DAEMON_SERVICE_IDS, listDaemonServiceStates, setDaemonServiceEnabled, getDaemonServicesConfigPath, } from '../lib/daemon-services.js';
+import { readSubsystemHealth, readAllSubsystemHealth, SUBSYSTEM_SECRETS_BROKER, SUBSYSTEM_BROWSER_IPC, SUBSYSTEM_DAEMON_START, } from '../lib/daemon-health.js';
+import { DAEMON_SERVICE_IDS, listDaemonServiceStates, setDaemonServiceEnabled, getDaemonServicesConfigPath, queueDaemonServiceRestart, } from '../lib/daemon-services.js';
 import { listJobs, getLatestRun } from '../lib/scheduling/routines.js';
 import { JobScheduler } from '../lib/scheduler.js';
 import { followFile } from '../lib/log-follow.js';
@@ -474,19 +474,76 @@ async function runStatus(opts) {
         console.log(chalk.red('\nThe daemon is wedged (heartbeat stale). Restart: agents daemon restart'));
     }
 }
+/**
+ * Combine the persisted enable/disable toggles with whatever health the
+ * `ServiceSupervisor` (or a legacy subsystem) has reported. Pure — reads two
+ * on-disk files, makes no probes — so it's cheap to call from both the
+ * non-interactive renderer and the interactive picker's refresh tick.
+ */
+function buildServiceRows(daemonRunning) {
+    const states = listDaemonServiceStates();
+    const healthById = new Map(readAllSubsystemHealth().map((h) => [h.subsystem, h]));
+    return states.map((s) => {
+        const h = healthById.get(s.id);
+        const supervised = h?.state !== undefined;
+        // A persisted supervisor state (health.json) is only trustworthy while the
+        // daemon is actually up. If it is not running (crash / kill -9 / never
+        // started), every service is stopped no matter what the last-written record
+        // says — trusting a stale 'running'/'parked'/'idle' here would print a
+        // report that contradicts the live-probed socket rows below (RUSH-2368).
+        const state = daemonRunning
+            ? (h?.state ?? (s.enabled ? 'running (unsupervised)' : 'stopped'))
+            : 'stopped';
+        return {
+            id: s.id,
+            title: s.title,
+            description: s.description,
+            enabled: s.enabled,
+            state,
+            supervised,
+            lastRunMs: h?.lastOkAt ? Date.parse(h.lastOkAt) : null,
+            lastError: h?.lastError ?? null,
+            consecutiveFailures: h?.consecutiveFailures ?? 0,
+        };
+    });
+}
+function serviceStateLabel(state) {
+    if (state === 'running')
+        return chalk.green('running');
+    if (state === 'parked')
+        return chalk.red('parked');
+    if (state === 'stopped')
+        return chalk.gray('stopped');
+    if (state === 'idle')
+        return chalk.gray('idle');
+    return chalk.yellow(state); // 'running (unsupervised)' or any future label
+}
 async function runServices(opts) {
     const [secrets, browserIpc] = await Promise.all([probeSecretsBroker(), probeBrowserIPC()]);
+    const rows = buildServiceRows(isDaemonRunning());
     if (opts.json) {
         console.log(JSON.stringify({
+            // Existing fields — unchanged shape, agents/CI consume these directly.
             secretsBroker: { reachable: secrets.reachable, socketPath: secrets.socketPath, heldBundles: secrets.heldBundles, health: secrets.record },
             browserIpc: { bound: browserIpc.bound, socketPath: browserIpc.socketPath, sessionCount: browserIpc.sessionCount, health: browserIpc.record },
+            // Additive: every registered service, supervised or legacy.
+            services: rows,
         }, null, 2));
         return;
     }
-    console.log(chalk.bold('Hosted services\n'));
+    console.log(chalk.bold('Daemon services\n'));
+    for (const row of rows) {
+        const lastRun = row.lastRunMs ? new Date(row.lastRunMs).toLocaleString() : '-';
+        console.log(`  ${row.id.padEnd(16)} ${serviceStateLabel(row.state).padEnd(20)} `
+            + `enabled=${row.enabled ? 'yes' : 'no '}  fails=${row.consecutiveFailures}  last-run=${lastRun}`);
+        if (row.lastError)
+            console.log(chalk.gray(`    last-error: ${row.lastError}`));
+    }
+    console.log(chalk.bold('\nHosted sockets\n'));
     console.log(healthLine(`secrets broker  ${secrets.reachable ? `(${secrets.socketPath}, ${secrets.heldBundles} bundle(s) held)` : '(unreachable)'}`, secrets.reachable, secrets.record));
     console.log(healthLine(`browser IPC     ${browserIpc.bound ? `(${browserIpc.socketPath}, ${browserIpc.sessionCount} session(s))` : '(unbound)'}`, browserIpc.bound, browserIpc.record));
     console.log(chalk.gray('\nScheduled routines run through `agents routines` — see: agents routines stats'));
+    console.log(chalk.gray('agents daemon services enable|disable|restart <id> apply live for supervised services.'));
 }
 function parseLogLines(raw) {
     const out = [];
@@ -795,9 +852,17 @@ export function registerDaemonCommand(program) {
       # Reload config (SIGHUP) without restarting — picks up routine/scheduler-gate changes
       agents daemon reload
 
-      # Every hosted service (secrets broker, browser IPC, webhook receiver, ...)
+      # Every registered service — state, enabled, failures, last error
       agents daemon services
 
+      # Toggle or restart a service live — applies without a daemon restart
+      # for supervisor-managed services (secrets-broker, browser-ipc,
+      # account-state, session-index, monitors' off-transition, watchdog,
+      # device-probe, self-heal, keychain-reap, state-dir-check)
+      agents daemon services disable secrets-broker
+      agents daemon services enable secrets-broker
+      agents daemon services restart secrets-broker
+
       # Host a signed webhook receiver here, supervised and restarted on crash
       agents daemon webhooks add --secrets-bundle linear-webhook
       agents daemon webhooks list
@@ -821,6 +886,16 @@ export function registerDaemonCommand(program) {
       the daemon (daemon.enabled: false in ~/.agents/devices/<host>/agents.yaml).
       'agents daemon start' still starts it explicitly, same as
       'systemctl start' on a disabled unit.
+
+      'agents daemon services enable|disable|restart <id>' applies live (no
+      daemon restart) for the 10 supervisor-managed services: secrets-broker,
+      browser-ipc, account-state, session-index, monitors (off only — turning
+      monitors back on still needs a restart), watchdog, device-probe,
+      self-heal, keychain-reap, and state-dir-check. The other 2 services
+      (scheduler, webhook-receiver) are still bare interval/socket setups with
+      no live start/stop hook, so a toggle there — and 'enable' on any service
+      that was disabled at daemon boot — still needs 'agents daemon restart'.
+      'agents daemon services' names which case you're in per row.
     `,
     });
     cmd.command('status')
@@ -917,11 +992,38 @@ export function registerDaemonCommand(program) {
     });
     const servicesCmd = cmd
         .command('services')
-        .description('The hosted services: health, bound state, socket path, and per-service toggles.')
+        .description('Every registered daemon service: live health, enabled state, and live enable/disable/restart.')
         .option('--json', 'Emit as JSON')
         .action(async (opts, command) => {
         await runServices({ json: command.optsWithGlobals().json === true });
     });
+    setHelpSections(servicesCmd, {
+        examples: `
+      # State, enabled, consecutive failures, last error for every service
+      agents daemon services
+
+      # Machine-readable — additive: also carries the pre-existing
+      # secretsBroker/browserIpc hosted-socket fields
+      agents daemon services --json
+
+      # Just the enable/disable metadata, no health probe
+      agents daemon services list
+
+      # Toggle or restart live — no daemon restart for a supervisor-managed
+      # service (secrets-broker, browser-ipc, account-state, session-index)
+      agents daemon services disable secrets-broker
+      agents daemon services enable secrets-broker
+      agents daemon services restart secrets-broker
+    `,
+        notes: `
+      A service disabled at daemon boot was never registered on the
+      supervisor, so 'enable' on it — and any toggle/restart on the 2
+      services the supervisor doesn't manage yet (scheduler,
+      webhook-receiver) — falls back to 'restart the daemon to apply'. Each
+      row in the plain-text view names which case it is; 'supervised:
+      true/false' does the same in --json.
+    `,
+    });
     servicesCmd
         .command('list')
         .description('List every daemon service and whether it is enabled.')
@@ -947,9 +1049,28 @@ export function registerDaemonCommand(program) {
         console.log(chalk.gray(`\nConfig: ${getDaemonServicesConfigPath()}`));
         console.log(chalk.gray('Changes take effect on the next daemon reload or restart.'));
     });
+    /**
+     * Apply an enable/disable toggle live (RUSH-3193 P4): persist it, then signal
+     * the running daemon to reload — its handler diffs the toggle and drives
+     * `supervisor.start/stop(id)` for a supervised service, so no restart is
+     * needed for the 10 supervisor-managed services (secrets-broker,
+     * browser-ipc, account-state, session-index, monitors' off-transition,
+     * watchdog, device-probe, self-heal, keychain-reap, state-dir-check). The 2
+     * remaining `setInterval`/socket-driven services (scheduler,
+     * webhook-receiver) and monitors' on-transition still need a restart — the
+     * daemon's own reload log says so.
+     */
+    function applyServiceToggleLive(service) {
+        if (!isDaemonRunning())
+            return;
+        const ok = signalDaemonReload();
+        console.log(ok
+            ? chalk.gray('Signalled the daemon to apply live. Confirm: agents daemon services')
+            : chalk.yellow('Reload signal not delivered — restart the daemon to apply: agents daemon restart'));
+    }
     servicesCmd
         .command('enable <service>')
-        .description('Enable a daemon service.')
+        .description('Enable a daemon service. Applies live for supervised services; a legacy service needs a restart.')
         .action((service) => {
         if (!DAEMON_SERVICE_IDS.includes(service)) {
             console.error(chalk.red(`Unknown service '${service}'. Run 'agents daemon services list' for valid services.`));
@@ -957,13 +1078,11 @@ export function registerDaemonCommand(program) {
         }
         setDaemonServiceEnabled(service, true);
         console.log(chalk.green(`Enabled '${service}'.`));
-        if (isDaemonRunning()) {
-            console.log(chalk.gray('Run `agents daemon reload` (or restart) to apply.'));
-        }
+        applyServiceToggleLive(service);
     });
     servicesCmd
         .command('disable <service>')
-        .description('Disable a daemon service.')
+        .description('Disable a daemon service. Applies live for supervised services; a legacy service needs a restart.')
         .action((service) => {
         if (!DAEMON_SERVICE_IDS.includes(service)) {
             console.error(chalk.red(`Unknown service '${service}'. Run 'agents daemon services list' for valid services.`));
@@ -971,9 +1090,25 @@ export function registerDaemonCommand(program) {
         }
         setDaemonServiceEnabled(service, false);
         console.log(chalk.green(`Disabled '${service}'.`));
-        if (isDaemonRunning()) {
-            console.log(chalk.gray('Run `agents daemon reload` (or restart) to apply.'));
+        applyServiceToggleLive(service);
+    });
+    servicesCmd
+        .command('restart <service>')
+        .description('Restart a supervised daemon service live, right now, outside its normal backoff schedule.')
+        .action((service) => {
+        if (!DAEMON_SERVICE_IDS.includes(service)) {
+            console.error(chalk.red(`Unknown service '${service}'. Run 'agents daemon services list' for valid services.`));
+            process.exit(1);
         }
+        if (!isDaemonRunning()) {
+            console.log(chalk.yellow('Daemon is not running — nothing to restart. Start it: agents daemon start'));
+            process.exit(1);
+        }
+        queueDaemonServiceRestart(service);
+        const ok = signalDaemonReload();
+        console.log(ok
+            ? chalk.green(`Restart requested for '${service}'.`) + chalk.gray(' Confirm: agents daemon services')
+            : chalk.yellow('Reload signal not delivered (unsupported on this platform, or the daemon just exited).'));
     });
     registerWebhooksSubcommand(cmd);
     registerFunnelCommand(cmd);

package/dist/commands/device-config-test-harness.d.ts

@@ -0,0 +1,11 @@
+export declare const REPO_ROOT: string;
+export declare const INDEX: string;
+export declare function guardedHome(): void;
+export declare function run(args: string[], extraEnv?: Record<string, string>): {
+    stdout: string;
+    stderr: string;
+    status: number | null;
+};
+export declare function centralDoc(): string;
+export declare function deviceDoc(name: string): string;
+export declare function addDevice(name: string, target?: string): void;

package/dist/commands/device-config-test-harness.js

@@ -0,0 +1,59 @@
+import { afterEach, expect } from 'vitest';
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+// End-to-end tests for the unified `agents devices config` surface and the
+// retired-subcommand tombstones (configure / note / set / set-interactive /
+// enable / disable / prefer / unprefer). Spawns the REAL CLI against a
+// throwaway HOME (same pattern as ssh.test.ts) — no mocking; the assertions
+// read the actual files the commands wrote: per-device docs under
+// devices/<name>/agents.yaml (device layer) and central agents.yaml
+// fleet.defaults.config (fleet layer).
+export const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+export const INDEX = path.join(REPO_ROOT, 'src', 'index.ts');
+let testHome = '';
+afterEach(() => {
+    if (testHome)
+        fs.rmSync(testHome, { recursive: true, force: true });
+    testHome = '';
+});
+export function guardedHome() {
+    testHome = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-devices-config-home-'));
+    const systemDir = path.join(testHome, '.agents', '.system');
+    fs.mkdirSync(path.join(systemDir, '.git'), { recursive: true });
+    fs.writeFileSync(path.join(systemDir, '.update-check'), JSON.stringify({ lastCheck: 4102444800000, latestVersion: '0.0.0' }));
+}
+export function run(args, extraEnv = {}) {
+    const r = spawnSync('bun', [INDEX, ...args], {
+        encoding: 'utf-8',
+        env: {
+            ...process.env,
+            HOME: testHome,
+            // os.homedir() reads USERPROFILE on Windows, so HOME alone leaves the
+            // spawned CLI resolving the real profile ('agents-cli is not set up').
+            USERPROFILE: testHome,
+            AGENTS_NO_UPDATE_CHECK: '1',
+            AGENTS_NO_USAGE_TRACK: '1',
+            // Default identity is mac-mini so machine-local keys (scheduler, tmux,
+            // browser consent) can be set in these tests. Override per-call to act
+            // as a different box.
+            AGENTS_SYNC_MACHINE_ID: 'mac-mini',
+            ...extraEnv,
+        },
+    });
+    return { stdout: r.stdout ?? '', stderr: r.stderr ?? '', status: r.status };
+}
+export function centralDoc() {
+    const p = path.join(testHome, '.agents', 'agents.yaml');
+    return fs.existsSync(p) ? fs.readFileSync(p, 'utf-8') : '';
+}
+export function deviceDoc(name) {
+    const p = path.join(testHome, '.agents', 'devices', name, 'agents.yaml');
+    return fs.existsSync(p) ? fs.readFileSync(p, 'utf-8') : '';
+}
+export function addDevice(name, target = 'muqsit@192.0.2.1') {
+    const r = run(['devices', 'add', name, target]);
+    expect(r.status, r.stderr).toBe(0);
+}