@phnx-labs/agents-cli 1.22.51 → 1.22.53

package/dist/lib/channels/owner-forward.js

@@ -0,0 +1,116 @@
+import { loadDevices, isDialableDevice } from '../devices/registry.js';
+import { machineId, normalizeHost } from '../machine-id.js';
+import { RUSH_CHANNELS } from './providers/rush.js';
+import { resolvePeerTarget, sshCapture } from '../session/remote/remote-list.js';
+import { buildRemoteAgentsInvocation, stripClixml } from '../hosts/remote-cmd.js';
+/**
+ * Env marker set on the forwarded `agents send` so a box that received a
+ * forwarded owner notify never forwards it onward. `agents send` does not route
+ * through this module today, so this is defense-in-depth against a future
+ * consumer wiring forwarding into the send path and creating a fan-out loop.
+ */
+export const OWNER_FORWARD_GUARD_ENV = 'AGENTS_OWNER_NO_FORWARD';
+/** Per-peer SSH deadline for a one-shot owner delivery. */
+const PEER_SEND_TIMEOUT_MS = 15_000;
+/**
+ * True when the resolved owner transport is the macOS-only rush family — the
+ * one case a Linux/headless box structurally cannot deliver and a peer can.
+ * `openclaw-telegram` and the local `desktop`/`mailbox` providers are NOT
+ * rush-backed, so a failure there is not a wrong-OS problem and is left as-is.
+ * Mirrors the same `RUSH_CHANNELS.includes(transport)` gate in owner-sink.ts.
+ */
+export function isRushBackedTransport(channel, meta) {
+    const transport = meta.notify?.transports?.[channel] ?? channel;
+    return RUSH_CHANNELS.includes(transport);
+}
+/**
+ * Decide which peers can deliver the owner notification, in try order. Pure —
+ * no I/O — so the channel gate, the recursion guard, self-exclusion, and the
+ * capability/ordering rules are unit-testable without a live tailnet.
+ *
+ * Only macOS peers are candidates: the rush owner transport is macOS-only, so a
+ * Linux/Windows peer could not deliver it either. The configured
+ * `interactive.host` (the box the operator sits at, where rush is signed in) is
+ * tried first when it is among the candidates.
+ */
+export function planOwnerForward(channel, meta, devices, self, opts = {}) {
+    if (opts.guarded)
+        return { candidates: [], skip: 'guarded' };
+    if (!isRushBackedTransport(channel, meta))
+        return { candidates: [], skip: 'not-rush-backed' };
+    const selfId = normalizeHost(self);
+    const capable = devices.filter((d) => d.platform === 'macos' && isDialableDevice(d) && normalizeHost(d.name) !== selfId);
+    const interactiveHost = typeof meta.config?.interactiveHost === 'string'
+        ? normalizeHost(meta.config.interactiveHost)
+        : undefined;
+    const rank = (name) => (interactiveHost && normalizeHost(name) === interactiveHost ? 0 : 1);
+    const candidates = capable
+        .map((d) => normalizeHost(d.name))
+        .sort((a, b) => rank(a) - rank(b));
+    if (candidates.length === 0)
+        return { candidates: [], skip: 'no-capable-peer' };
+    return { candidates };
+}
+async function sendOnPeer(machine, text) {
+    const peer = await resolvePeerTarget(machine);
+    if (!peer)
+        return undefined;
+    const args = ['send', '--to', 'owner', '--text', text, '--json'];
+    // Reuse the one injection-tested remote-command builder every `--device`
+    // dispatch uses (posix `bash -lc` / Windows `-EncodedCommand`), rather than a
+    // second hand-rolled quoting path on a security-sensitive seam. The env map is
+    // the loop guard, exported the same way every remote invocation exports env.
+    const remoteCmd = buildRemoteAgentsInvocation(args, undefined, peer.os, { [OWNER_FORWARD_GUARD_ENV]: '1' });
+    const capture = await sshCapture(peer.target, remoteCmd, PEER_SEND_TIMEOUT_MS);
+    if (capture.code !== 0)
+        return undefined;
+    try {
+        const parsed = JSON.parse(stripClixml(capture.stdout));
+        if (parsed && typeof parsed === 'object' && typeof parsed.ok === 'boolean')
+            return parsed;
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+/**
+ * Try each capable peer in order and return the first successful delivery. A
+ * peer that is unreachable or reports its own delivery failure is skipped and
+ * the next is tried; the first `ok:true` wins and stops the sweep so the owner's
+ * phone rings once. Resolves `undefined` when forwarding does not apply or no
+ * peer delivered — the caller then keeps its original local error.
+ *
+ * The transport (`send`) is injectable so the try-order / first-success / stop
+ * orchestration is testable without a live SSH host; the default runs the real
+ * `agents send --to owner` over SSH.
+ */
+export async function forwardOwnerNotifyToPeer(text, channel, meta, opts = {}) {
+    // Cheap, I/O-free gate first: a box that already received a forward, or an
+    // owner channel that isn't the macOS-only rush family, can never forward — so
+    // a normal local success/failure never pays a device-registry disk read.
+    if (process.env[OWNER_FORWARD_GUARD_ENV] === '1')
+        return undefined;
+    if (!isRushBackedTransport(channel, meta))
+        return undefined;
+    const self = opts.self ?? machineId();
+    let devices = opts.devices;
+    if (!devices) {
+        try {
+            devices = Object.values(await loadDevices());
+        }
+        catch {
+            return undefined; // no registry, nothing to forward to
+        }
+    }
+    const plan = planOwnerForward(channel, meta, devices, self);
+    if (plan.candidates.length === 0)
+        return undefined;
+    const send = opts.send ?? sendOnPeer;
+    for (const machine of plan.candidates) {
+        const result = await send(machine, text);
+        if (result?.ok)
+            return result;
+    }
+    return undefined;
+}

package/dist/lib/channels/owner-sink.js

@@ -11,6 +11,13 @@
  * after-the-fact `owner failed: …` line. `agents doctor` had no signal for it,
  * which is exactly the gap RUSH-2258 / RUSH-2262 flagged.
  *
+ * At runtime the owner-delivery lane no longer strands this failure: when local
+ * delivery fails on a box that structurally cannot reach the owner,
+ * `forwardOwnerNotifyToPeer` (owner-forward.ts) hands it to a capable macOS peer
+ * over SSH (PHNX-3303). This finding still stands as a diagnostic — the forward
+ * is best-effort and only lands when a reachable mac peer exists, so a box that
+ * cannot deliver locally is worth surfacing regardless.
+ *
  * This probes the SAME transport the lane uses, from the SAME context doctor runs
  * in, so `agents doctor` can fail loud when this box cannot reach the owner. It is
  * deliberately honest about context: `rush whoami` is what tells a real signed-in

package/dist/lib/daemon/runner.js

@@ -1313,10 +1313,17 @@ async function executeJobPlaced(config, deps, attempt) {
     // Workflows run via `agents run <workflow>` which delegates to claude under the hood.
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
     // (command jobs branched out earlier, so config.agent is set on the non-workflow path.)
+    // Custom harness/profile name (e.g. `deepseek`) stays on harnessName; the
+    // HOST CLI is effectiveAgent. The loop path spawns in-process via runLoop
+    // and never re-enters `agents run`, so it must stamp harnessName itself
+    // (PHNX-2935) — same field commands/exec.ts sets on ExecOptions.
+    const harnessName = !config.workflow && config.agent && isCustomHarnessName(config.agent)
+        ? config.agent
+        : undefined;
     const effectiveAgent = config.workflow
         ? 'claude'
-        : isCustomHarnessName(config.agent)
-            ? readProfile(config.agent).host.agent
+        : harnessName
+            ? readProfile(harnessName).host.agent
             : config.agent;
     if (!dispatchesViaAgentsRun(config)) {
         const { findUnifiedAccount, resolveAccountSelection, resolveCredentialAccount } = await import('../account-registry.js');
@@ -1377,6 +1384,7 @@ async function executeJobPlaced(config, deps, attempt) {
         const spawnEnv = buildRoutineSpawnEnv(baseEnv, effectiveAgent, primaryVersion, config.timezone, overlayHome);
         const execOptions = {
             agent: effectiveAgent,
+            harnessName,
             // Routine-supported self-updating CLIs (Cursor/Droid) use one global
             // binary; a versioned shim would point at a nonexistent isolated install.
             version: isSelfUpdatingAgent(effectiveAgent) ? undefined : primaryVersion,

package/dist/lib/device-config.js

@@ -164,8 +164,9 @@ export const CONFIG_KEYS = [
         visibility: 'machine',
         type: 'bool',
         defaultValue: false,
-        description: 'Whether an interactive `agents run` on this device is wrapped in the shared-socket tmux session. ' +
-            'Off, the default, spawns the agent directly. Turn it on to give every agent an addressable pane for ' +
+        description: 'Whether an interactive `agents run` on this device is wrapped in the shared-socket tmux session — local runs and ' +
+            'followed `--device` runs alike (PHNX-3316). Off, the default, spawns the agent directly; a remote run left bare ' +
+            'is protected by reconnect-and-resume, not a pane. Turn it on to give every agent an addressable pane for ' +
             '`agents message`, injection, and `agents focus` once the tmux mouse, clipboard, and scrollback behavior suits this device.',
     },
     {

package/dist/lib/devices/config-migration.js

@@ -44,6 +44,7 @@ import { META_HEADER, getDevicesAutoLaunchPath, getDevicesIgnoredPath, getDevice
 import { atomicWriteFileSync } from '../fs-atomic.js';
 import { machineId } from '../machine-id.js';
 import { withIgnoredAdded } from './registry.js';
+import { addIgnoredEntry } from './device-docs.js';
 /** Read every device doc. A doc that fails to parse is loudly skipped. */
 function readDeviceDocs(devicesRoot) {
     const docs = [];
@@ -176,6 +177,21 @@ export function migrateDeviceConfigStores() {
     const legacyIgnoredPath = getDevicesIgnoredPath();
     const legacyIgnoredPending = fs.existsSync(legacyIgnoredPath);
     const legacyIgnored = legacyIgnoredPending ? readLegacyIgnoredFile(legacyIgnoredPath) : null;
+    // Central shared fleet.discovery / fleet.ignored (PHNX-3315): the maps N boxes
+    // used to rewrite. Folded into THIS box's device doc below, then stripped.
+    const centralFleetState = !!(fleet &&
+        ((fleet.discovery && Object.keys(fleet.discovery).length > 0) ||
+            (Array.isArray(fleet.ignored) && fleet.ignored.length > 0)));
+    // Central shared `hosts:` map (PHNX-3315): the host registry N boxes used to
+    // rewrite. Folded into THIS box's device doc below, then the central key is
+    // dropped entirely.
+    const centralHosts = readMeta().hosts;
+    const centralHostsPending = !!(centralHosts && Object.keys(centralHosts).length > 0);
+    // Central device-scoped native accounts (PHNX-3315): a native login is
+    // machine-local, so `scope:'device'` identities (and the bindings that target
+    // them) belong in this box's device doc, off the git-tracked shared file.
+    const centralAccounts = readMeta().accounts;
+    const accountsPending = !!(centralAccounts?.native && Object.values(centralAccounts.native).some((a) => a.scope === 'device'));
     const pinsPath = getDevicePinsPath();
     let selfPins = {};
     try {
@@ -209,7 +225,7 @@ export function migrateDeviceConfigStores() {
         : undefined;
     const hasDestinationWork = plans.length > 0 || newDocs.length > 0 || docAgents !== undefined || docIsolated !== undefined;
     const autoLaunchPending = fs.existsSync(autoLaunchPath);
-    if (!centralHasConfig && !hasDestinationWork && !autoLaunchPending && !legacyIgnoredPending)
+    if (!centralHasConfig && !hasDestinationWork && !autoLaunchPending && !legacyIgnoredPending && !centralFleetState && !centralHostsPending && !accountsPending)
         return;
     // ── 2. Destination writes FIRST (crash-safe), under the meta lock so they
     //    serialize against writeMetaUnlocked's own read-merge-write of the doc.
@@ -302,6 +318,136 @@ export function migrateDeviceConfigStores() {
             console.error(`device config migration: could not remove ${legacyIgnoredPath} (${err.message}); a later run retries`);
         }
     }
+    // ── 5. Central fleet.discovery / fleet.ignored → THIS box's device doc ─────
+    // (PHNX-3315) The shared maps every box used to rewrite fold into this box's
+    // deviceFleet, then are stripped from central. writeMetaUnlocked writes the
+    // device doc BEFORE the central strip, so a crash re-folds on the next run and
+    // the union-dedup (ignored beats approved; newest ignoredAt wins) makes the
+    // re-fold a no-op. Idempotent — once central holds neither key the gather
+    // guard above skips this whole pass.
+    if (centralFleetState) {
+        updateMeta((m) => {
+            const disc = m.fleet?.discovery;
+            const ign = m.fleet?.ignored;
+            const hasDisc = !!disc && Object.keys(disc).length > 0;
+            const hasIgn = Array.isArray(ign) && ign.length > 0;
+            if (!hasDisc && !hasIgn)
+                return m;
+            const discovery = { ...m.deviceFleet?.discovery };
+            if (hasDisc) {
+                for (const [name, status] of Object.entries(disc)) {
+                    if (status !== 'approved' && status !== 'ignored')
+                        continue;
+                    if (discovery[name] === 'ignored')
+                        continue; // ignored is never downgraded
+                    discovery[name] = status;
+                }
+            }
+            const byName = new Map();
+            for (const e of m.deviceFleet?.ignored ?? [])
+                addIgnoredEntry(byName, e);
+            if (hasIgn)
+                for (const e of ign)
+                    addIgnoredEntry(byName, e);
+            const ignored = [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+            const deviceFleet = {
+                ...(Object.keys(discovery).length > 0 ? { discovery } : {}),
+                ...(ignored.length > 0 ? { ignored } : {}),
+            };
+            const fleet = m.fleet ? { ...m.fleet } : undefined;
+            if (fleet) {
+                delete fleet.discovery;
+                delete fleet.ignored;
+            }
+            // Drop an emptied fleet block entirely (mirrors step 3a's guard) so the
+            // strip does not leave a bare `fleet: { devices: {} }` behind.
+            const fleetEmpty = !fleet ||
+                ((fleet.devices === undefined ||
+                    (fleet.devices !== 'all' && Object.keys(fleet.devices).length === 0)) &&
+                    !fleet.defaults &&
+                    !fleet.secrets &&
+                    !fleet.routines);
+            if (fleetEmpty) {
+                const { fleet: _drop, ...rest } = m;
+                void _drop;
+                return { ...rest, deviceFleet };
+            }
+            return { ...m, deviceFleet, fleet };
+        });
+    }
+    // ── 6. Central hosts map → THIS box's device doc (PHNX-3315) ───────────────
+    // The shared host registry folds into this box's deviceHosts, then the central
+    // key is dropped. writeMetaUnlocked writes the device doc before the central
+    // strip, so a crash re-folds and the newest-addedAt union makes it a no-op.
+    // Idempotent — once central holds no `hosts:` the gather guard skips this.
+    if (centralHostsPending) {
+        updateMeta((m) => {
+            const hosts = m.hosts;
+            if (!hosts || Object.keys(hosts).length === 0)
+                return m;
+            // This box's own device-doc entries win over the shared legacy on a name
+            // collision (a re-fold after a crash must not clobber a fresher local edit).
+            const deviceHosts = { ...hosts, ...m.deviceHosts };
+            const { hosts: _drop, ...rest } = m;
+            void _drop;
+            return { ...rest, deviceHosts };
+        });
+    }
+    // ── 7. Central device-scoped native accounts → THIS box's device doc ───────
+    // (PHNX-3315) Fold `scope:'device'` natives and the bindings that target them
+    // out of central and into the device doc, removing their identity PII from the
+    // git-tracked shared file. The selection is recomputed INSIDE the lock so a
+    // concurrent write is never clobbered; the device-doc write precedes the
+    // central strip, so a crash re-folds and the id-keyed merge makes it a no-op.
+    if (accountsPending) {
+        updateMeta((m) => {
+            const native = { ...m.accounts?.native };
+            const bindings = { ...m.accounts?.bindings };
+            const devNative = { ...m.deviceAccounts?.native };
+            const devBindings = { ...m.deviceAccounts?.bindings };
+            const movedIds = new Set();
+            let changed = false;
+            for (const [id, entry] of Object.entries(native)) {
+                if (entry.scope === 'device') {
+                    devNative[id] = entry;
+                    movedIds.add(id);
+                    delete native[id];
+                    changed = true;
+                }
+            }
+            for (const [target, id] of Object.entries(bindings)) {
+                if (movedIds.has(id)) {
+                    devBindings[target] = id;
+                    delete bindings[target];
+                    changed = true;
+                }
+            }
+            if (!changed)
+                return m;
+            const deviceAccounts = {
+                ...(Object.keys(devNative).length > 0 ? { native: devNative } : {}),
+                ...(Object.keys(devBindings).length > 0 ? { bindings: devBindings } : {}),
+            };
+            const accounts = { ...m.accounts };
+            if (Object.keys(native).length > 0)
+                accounts.native = native;
+            else
+                delete accounts.native;
+            if (Object.keys(bindings).length > 0)
+                accounts.bindings = bindings;
+            else
+                delete accounts.bindings;
+            // Drop the whole central `accounts` block only when nothing fleet-shared
+            // remains (no version natives, no bindings, no defaults).
+            const accountsEmpty = !accounts.native && !accounts.bindings && !accounts.defaults;
+            if (accountsEmpty) {
+                const { accounts: _drop, ...rest } = m;
+                void _drop;
+                return { ...rest, deviceAccounts };
+            }
+            return { ...m, accounts, deviceAccounts };
+        });
+    }
 }
 /** Shallow-set equality for folded doc content (values compared deep via JSON). */
 function sameDocContent(a, b) {

package/dist/lib/devices/device-docs.d.ts

@@ -0,0 +1,35 @@
+import type { HostEntry } from '../types.js';
+import type { IgnoredDeviceEntry } from '../fleet/types.js';
+/** One parsed device doc under `~/.agents/devices/`. */
+export interface DeviceDoc {
+    device: string;
+    doc: Record<string, unknown>;
+}
+/**
+ * Every device doc, sorted by device name so the union is order-independent. A
+ * corrupt or non-map doc throws (loud), never silently skipped — a dropped doc
+ * would let the next writer clobber that peer's slice.
+ */
+export declare function readAllDeviceDocs(): DeviceDoc[];
+/**
+ * Union the per-box `fleet.discovery` maps. Precedence for a name declared by
+ * more than one box is deterministic and order-independent: `ignored` beats
+ * `approved` (a dismissal on any box wins), so every box computes the identical
+ * effective policy regardless of walk order.
+ */
+export declare function unionDeviceDiscovery(docs?: DeviceDoc[]): Record<string, 'approved' | 'ignored'>;
+/**
+ * Union the per-box `fleet.ignored` dismissal lists by node name. When two boxes
+ * dismissed the same node, the entry with the newest `ignoredAt` wins (ties
+ * broken by `ignoredOn`), so the attribution is deterministic and
+ * order-independent. Sorted by name to match the central writer's ordering.
+ */
+export declare function unionDeviceIgnored(docs?: DeviceDoc[]): IgnoredDeviceEntry[];
+/** Insert/replace a dismissal, newest ignoredAt (then ignoredOn) winning. */
+export declare function addIgnoredEntry(byName: Map<string, IgnoredDeviceEntry>, entry: IgnoredDeviceEntry): void;
+/**
+ * Union the per-box `hosts:` registries by host name. When two boxes registered
+ * the same name, the newest `addedAt` wins (ties broken by device name), so the
+ * merged directory is deterministic. Entries missing `addedAt` sort oldest.
+ */
+export declare function unionDeviceHosts(docs?: DeviceDoc[]): Record<string, HostEntry>;

package/dist/lib/devices/device-docs.js

@@ -0,0 +1,163 @@
+/**
+ * Union-on-read across every tracked device document (PHNX-3315).
+ *
+ * Phase 2 device-scopes three writers that used to rewrite one fleet-shared
+ * block in the central `agents.yaml` (fleet discovery/dismissals, the host
+ * registry, and device-scoped accounts). Each box now records only its OWN
+ * decisions in `~/.agents/devices/<machine>/agents.yaml`, so pulls never
+ * conflict — and the effective fleet view is recomputed here as a deterministic,
+ * order-independent UNION across every device doc, exactly like the browser
+ * profile registry (`lib/browser/registry.ts` `profileRegistry`).
+ *
+ * These readers walk the device docs ONLY. The central-legacy values (present
+ * until the fold-then-delete migration drains them) are merged in by each
+ * caller, so a value mid-migration is never lost. A doc that fails to parse is a
+ * hard error — silently returning an empty union would let a later write wipe a
+ * peer's decision, the same corruption contract `routine-activation.ts` and the
+ * device registry keep.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as yaml from 'yaml';
+import { getUserAgentsDir } from '../state.js';
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Every device doc, sorted by device name so the union is order-independent. A
+ * corrupt or non-map doc throws (loud), never silently skipped — a dropped doc
+ * would let the next writer clobber that peer's slice.
+ */
+export function readAllDeviceDocs() {
+    const devicesDir = path.join(getUserAgentsDir(), 'devices');
+    if (!fs.existsSync(devicesDir))
+        return [];
+    const out = [];
+    const names = fs
+        .readdirSync(devicesDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name)
+        .sort();
+    for (const device of names) {
+        const file = path.join(devicesDir, device, 'agents.yaml');
+        if (!fs.existsSync(file))
+            continue;
+        let parsed;
+        try {
+            parsed = yaml.parse(fs.readFileSync(file, 'utf8'));
+        }
+        catch (err) {
+            throw new Error(`Device config corrupted at ${file}: ${err.message}. Inspect and restore from backup.`);
+        }
+        if (parsed == null)
+            continue;
+        if (!isRecord(parsed)) {
+            throw new Error(`Device config corrupted at ${file}: document root must be a map.`);
+        }
+        out.push({ device, doc: parsed });
+    }
+    return out;
+}
+/**
+ * Union the per-box `fleet.discovery` maps. Precedence for a name declared by
+ * more than one box is deterministic and order-independent: `ignored` beats
+ * `approved` (a dismissal on any box wins), so every box computes the identical
+ * effective policy regardless of walk order.
+ */
+export function unionDeviceDiscovery(docs = readAllDeviceDocs()) {
+    const out = {};
+    for (const { device, doc } of docs) {
+        const fleet = doc.fleet;
+        if (fleet === undefined)
+            continue;
+        if (!isRecord(fleet))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet must be a map.`);
+        const discovery = fleet.discovery;
+        if (discovery === undefined)
+            continue;
+        if (!isRecord(discovery))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.discovery must be a map.`);
+        for (const [name, status] of Object.entries(discovery)) {
+            if (status !== 'approved' && status !== 'ignored') {
+                throw new Error(`Device discovery policy for '${name}' in devices/${device}/agents.yaml must be approved or ignored.`);
+            }
+            // ignored beats approved; once ignored, never downgraded by another box.
+            if (out[name] === 'ignored')
+                continue;
+            out[name] = status;
+        }
+    }
+    return out;
+}
+/**
+ * Union the per-box `fleet.ignored` dismissal lists by node name. When two boxes
+ * dismissed the same node, the entry with the newest `ignoredAt` wins (ties
+ * broken by `ignoredOn`), so the attribution is deterministic and
+ * order-independent. Sorted by name to match the central writer's ordering.
+ */
+export function unionDeviceIgnored(docs = readAllDeviceDocs()) {
+    const byName = new Map();
+    for (const { device, doc } of docs) {
+        const fleet = doc.fleet;
+        if (fleet === undefined)
+            continue;
+        if (!isRecord(fleet))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet must be a map.`);
+        const ignored = fleet.ignored;
+        if (ignored === undefined)
+            continue;
+        if (!Array.isArray(ignored))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.ignored must be a list.`);
+        for (const raw of ignored) {
+            if (!raw || typeof raw.name !== 'string' || typeof raw.ignoredAt !== 'string' || typeof raw.ignoredOn !== 'string') {
+                throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.ignored entries must be { name, ignoredAt, ignoredOn }.`);
+            }
+            addIgnoredEntry(byName, raw);
+        }
+    }
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Insert/replace a dismissal, newest ignoredAt (then ignoredOn) winning. */
+export function addIgnoredEntry(byName, entry) {
+    const prev = byName.get(entry.name);
+    if (!prev) {
+        byName.set(entry.name, entry);
+        return;
+    }
+    const at = Date.parse(entry.ignoredAt);
+    const prevAt = Date.parse(prev.ignoredAt);
+    if (at > prevAt || (at === prevAt && entry.ignoredOn.localeCompare(prev.ignoredOn) > 0)) {
+        byName.set(entry.name, entry);
+    }
+}
+/**
+ * Union the per-box `hosts:` registries by host name. When two boxes registered
+ * the same name, the newest `addedAt` wins (ties broken by device name), so the
+ * merged directory is deterministic. Entries missing `addedAt` sort oldest.
+ */
+export function unionDeviceHosts(docs = readAllDeviceDocs()) {
+    const out = {};
+    const wonAt = new Map();
+    for (const { device, doc } of docs) {
+        const hosts = doc.hosts;
+        if (hosts === undefined)
+            continue;
+        if (!isRecord(hosts))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: hosts must be a map.`);
+        for (const [name, entry] of Object.entries(hosts)) {
+            if (!isRecord(entry))
+                throw new Error(`Device config corrupted at devices/${device}/agents.yaml: host '${name}' must be a map.`);
+            const at = typeof entry.addedAt === 'string' ? Date.parse(entry.addedAt) : 0;
+            const prev = wonAt.get(name);
+            if (prev === undefined || at > prev) {
+                out[name] = entry;
+                wonAt.set(name, Number.isNaN(at) ? 0 : at);
+            }
+        }
+    }
+    return out;
+}
+// Native accounts and their bindings are machine-local (a native login lives in
+// the harness home on ONE box), so account-registry.ts reads THIS box's own
+// slice (meta.deviceAccounts) merged with the fleet-shared central store rather
+// than a cross-box union — there is deliberately no unionDeviceAccounts here.

package/dist/lib/devices/discovery-policy.d.ts

@@ -7,9 +7,21 @@ export interface DeviceDiscoveryReconcileResult {
 }
 /** Read one portable decision. Absence means pending. */
 export declare function getDeviceDiscoveryStatus(name: string): DeviceDiscoveryStatus | undefined;
-/** Persist one portable decision in the central fleet manifest. */
+/**
+ * Persist ONE discovery decision in THIS box's device doc (PHNX-3315). Each box
+ * records only its own choices in `devices/<machine>/agents.yaml` `fleet.discovery`,
+ * so N boxes no longer rewrite one shared central map (the guaranteed pull
+ * conflict). The effective policy is the union across every box
+ * ({@link loadDeviceDiscoveryPolicies}).
+ */
 export declare function setDeviceDiscoveryStatus(name: string, status: DeviceDiscoveryStatus | undefined): void;
-/** Load every explicit decision from the synced central fleet manifest. */
+/**
+ * The effective discovery policy: the UNION across every box's device doc, plus
+ * any lingering central-legacy map (drained by the fold-then-delete migration).
+ * Precedence for a name declared by more than one box is deterministic and
+ * order-independent — `ignored` beats `approved` — so every box computes the
+ * identical policy. Absence means pending.
+ */
 export declare function loadDeviceDiscoveryPolicies(): Map<string, DeviceDiscoveryStatus>;
 /**
  * Apply synced intent to this machine's local registry. Approval resolves live

package/dist/lib/devices/discovery-policy.js

@@ -1,5 +1,6 @@
 /** Synced device approval/ignore policy and local registry reconciliation. */
 import { readMeta, updateMeta } from '../state.js';
+import { unionDeviceDiscovery } from './device-docs.js';
 import { addIgnored, assertValidDeviceName, loadDevices, removeDevice, removeIgnored, upsertDevice, } from './registry.js';
 import { localLoginUser, withDefaultUser } from './sync.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson } from './tailscale.js';
@@ -8,36 +9,46 @@ export function getDeviceDiscoveryStatus(name) {
     assertValidDeviceName(name);
     return loadDeviceDiscoveryPolicies().get(name);
 }
-/** Persist one portable decision in the central fleet manifest. */
+/**
+ * Persist ONE discovery decision in THIS box's device doc (PHNX-3315). Each box
+ * records only its own choices in `devices/<machine>/agents.yaml` `fleet.discovery`,
+ * so N boxes no longer rewrite one shared central map (the guaranteed pull
+ * conflict). The effective policy is the union across every box
+ * ({@link loadDeviceDiscoveryPolicies}).
+ */
 export function setDeviceDiscoveryStatus(name, status) {
     assertValidDeviceName(name);
     updateMeta((meta) => {
-        const discovery = { ...meta.fleet?.discovery };
+        const discovery = { ...meta.deviceFleet?.discovery };
         if (status)
             discovery[name] = status;
         else
             delete discovery[name];
-        const fleet = {
-            ...meta.fleet,
-            devices: meta.fleet?.devices ?? {},
-            // Keep an empty map as the synced tombstone: it distinguishes "policy is
-            // authoritative and every device is pending" from an older config that
-            // has never opted into portable discovery decisions.
-            discovery,
-        };
-        return { ...meta, fleet };
+        return { ...meta, deviceFleet: { ...meta.deviceFleet, discovery } };
     });
 }
-/** Load every explicit decision from the synced central fleet manifest. */
+/**
+ * The effective discovery policy: the UNION across every box's device doc, plus
+ * any lingering central-legacy map (drained by the fold-then-delete migration).
+ * Precedence for a name declared by more than one box is deterministic and
+ * order-independent — `ignored` beats `approved` — so every box computes the
+ * identical policy. Absence means pending.
+ */
 export function loadDeviceDiscoveryPolicies() {
     const policies = new Map();
-    for (const [name, status] of Object.entries(readMeta().fleet?.discovery ?? {})) {
-        assertValidDeviceName(name);
-        if (status !== 'approved' && status !== 'ignored') {
-            throw new Error(`Device discovery policy for '${name}' must be approved or ignored.`);
+    const apply = (rec) => {
+        for (const [name, status] of Object.entries(rec ?? {})) {
+            assertValidDeviceName(name);
+            if (status !== 'approved' && status !== 'ignored') {
+                throw new Error(`Device discovery policy for '${name}' must be approved or ignored.`);
+            }
+            if (policies.get(name) === 'ignored')
+                continue; // ignored is never downgraded
+            policies.set(name, status);
         }
-        policies.set(name, status);
-    }
+    };
+    apply(readMeta().fleet?.discovery); // central legacy, until the migration drains it
+    apply(unionDeviceDiscovery()); // per-box device docs (ignored still wins)
     return policies;
 }
 /**
@@ -55,11 +66,10 @@ export function loadDeviceDiscoveryPolicies() {
  * that never meant to touch them.
  */
 export async function reconcileDeviceDiscoveryPolicies() {
-    const configured = readMeta().fleet?.discovery;
-    if (configured === undefined) {
+    const policies = loadDeviceDiscoveryPolicies();
+    if (policies.size === 0) {
         return { approved: [], ignored: [], registered: [], unresolved: [] };
     }
-    const policies = loadDeviceDiscoveryPolicies();
     const approved = [...policies].filter(([, s]) => s === 'approved').map(([n]) => n).sort();
     const ignored = [...policies].filter(([, s]) => s === 'ignored').map(([n]) => n).sort();
     for (const name of ignored) {