@phnx-labs/agents-cli 1.22.52 → 1.22.53

package/dist/lib/browser/registry.js

@@ -2,34 +2,108 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import * as yaml from 'yaml';
-import { getUserAgentsDir, readMeta, updateMeta } from '../state.js';
+import { getUserAgentsDir, readMeta, updateMeta, withMetaLock, writeMetaUnlocked } from '../state.js';
 function isRecord(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
 }
-/** Leftover central `browser:` map from before per-device declarations. Empty when none remain. */
+/**
+ * The leftover central `browser:` tombstone from before per-device declarations.
+ * Empty when none remain — and `agents sync` now drains it automatically via
+ * {@link autoEvictCentralBrowserProfiles}, so on a synced box this is empty and
+ * {@link profileRegistry} is the single source of truth. It survives only to
+ * fold in migration and to explain an as-yet-unclaimed profile in a resolve
+ * error (a profile hostable on a peer that has not synced yet), never as a
+ * parallel store callers read for resolution.
+ */
 export function centralBrowserProfiles() {
     const central = readMeta().browser;
     if (!central || Object.keys(central).length === 0)
         return {};
     return { ...central };
 }
+/**
+ * Pick the central `browser:` entries this machine may fold into its device doc.
+ *
+ * A profile is claimable only when `canHostHere` accepts it — the endpoint or
+ * binary resolves to THIS machine — so a `cdp://localhost:*` profile owned by a
+ * peer is never claimed here (the logged-out-headless-browser bug this module
+ * exists to prevent). A name already declared locally with an IDENTICAL config
+ * is folded too, which just drops the redundant central copy. A name declared
+ * locally with a DIFFERENT config is a genuine conflict: `onConflict: 'throw'`
+ * (the explicit `claim` command) surfaces it; `onConflict: 'skip'` (automatic
+ * eviction on sync) leaves it central so a stray duplicate can never wedge a
+ * sync — an operator resolves it with an explicit claim.
+ */
+function selectClaimableCentral(central, local, canHostHere, opts) {
+    const toClaim = {};
+    const skipped = [];
+    for (const [profileName, config] of Object.entries(central)) {
+        if (opts.name && profileName !== opts.name)
+            continue;
+        if (!canHostHere(config)) {
+            skipped.push(profileName);
+            continue;
+        }
+        const existing = local[profileName];
+        if (existing && !isDeepStrictEqual(existing, config)) {
+            if (opts.onConflict === 'throw') {
+                throw new Error(`Cannot migrate browser profile "${profileName}": central agents.yaml and this device's ` +
+                    `agents.yaml declare different configurations. Resolve the duplicate before retrying.`);
+            }
+            skipped.push(profileName);
+            continue;
+        }
+        toClaim[profileName] = config;
+    }
+    return { toClaim, skipped };
+}
+/**
+ * Return `current` with `toClaim` moved out of the central `browser:` map and
+ * into this device's `deviceBrowser` doc. The central key is dropped entirely
+ * once drained, so the tombstone disappears rather than lingering as an empty
+ * map. Pure — the caller applies it under the meta lock.
+ */
+function buildEvictedMeta(current, toClaim) {
+    const legacy = current;
+    const remaining = {};
+    for (const [profileName, config] of Object.entries(legacy.browser ?? {})) {
+        if (!(profileName in toClaim))
+            remaining[profileName] = config;
+    }
+    const { browser: _removed, ...withoutCentralBrowser } = legacy;
+    return {
+        ...withoutCentralBrowser,
+        ...(Object.keys(remaining).length > 0 ? { browser: remaining } : {}),
+        deviceBrowser: { ...current.deviceBrowser, ...toClaim },
+    };
+}
+/**
+ * Commit a claim computed by the EXPLICIT path (`migrateCentralBrowserProfiles`).
+ * `toClaim` was selected from an unlocked snapshot — acceptable for that manual,
+ * deliberate command; the automatic path instead selects INSIDE the lock (see
+ * {@link autoEvictCentralBrowserProfiles}) so an unrelated concurrent write can
+ * never be clobbered by a stale selection.
+ */
+function commitCentralClaim(toClaim) {
+    updateMeta((current) => buildEvictedMeta(current, toClaim));
+}
 /**
  * Fold leftover central `browser:` entries into THIS device's declaration file.
  *
- * Never called implicitly, and that is the point. Every device can read the
- * central map, so an implicit claim races: whichever box happens to read first
- * claims the name, {@link profileKind} then reports it `identity`, and the
- * daemon tunnels to that box — which for a fleet-wide `cdp://localhost:*`
- * profile is a logged-out headless browser wearing a credentialed browser's
- * name. That is the exact bug this module exists to remove, and an implicit
- * migration would write it to disk as a stored fact.
+ * The EXPLICIT operator action (`agents browser profiles claim`), run on the
+ * machine that actually owns the browser. It is never called implicitly from a
+ * read, and that is the point: every device can read the central map, so an
+ * implicit claim races — whichever box reads first claims the name, {@link
+ * profileKind} then reports it `identity`, and the daemon tunnels to that box,
+ * which for a fleet-wide `cdp://localhost:*` profile is a logged-out headless
+ * browser wearing a credentialed browser's name. {@link autoEvictCentralBrowserProfiles}
+ * closes that race for the automatic path (host-gated + non-throwing on sync);
+ * this one is the manual, throw-on-conflict counterpart.
  *
- * The claim is an explicit operator action (`agents browser profiles claim`),
- * run on the machine that actually owns the browser. `canHostHere` is supplied
- * by the command layer so this module stays a leaf — it must not import
- * `isProfileLaunchableHere` (that would cycle through chrome.ts → profiles.ts).
- * Only profiles this machine can host are claimed; the rest stay central,
- * undeclared, and fail loudly on resolve.
+ * `canHostHere` is supplied by the command layer so this module stays a leaf —
+ * it must not import `isProfileLaunchableHere` (that would cycle through
+ * chrome.ts → profiles.ts). Only profiles this machine can host are claimed; the
+ * rest stay central, undeclared, and fail loudly on resolve.
  */
 export function migrateCentralBrowserProfiles(canHostHere, name) {
     const meta = readMeta();
@@ -53,42 +127,64 @@ export function migrateCentralBrowserProfiles(canHostHere, name) {
                 `(its browser/binary isn't installed here). Run this command on the machine that has that browser.`);
         }
     }
-    const toClaim = {};
-    const skipped = [];
-    for (const [profileName, config] of Object.entries(central)) {
-        if (name && profileName !== name)
-            continue;
-        if (!canHostHere(config)) {
-            skipped.push(profileName);
-            continue;
-        }
-        const existing = local[profileName];
-        if (existing && !isDeepStrictEqual(existing, config)) {
-            throw new Error(`Cannot migrate browser profile "${profileName}": central agents.yaml and this device's ` +
-                `agents.yaml declare different configurations. Resolve the duplicate before retrying.`);
-        }
-        toClaim[profileName] = config;
-    }
+    const { toClaim, skipped } = selectClaimableCentral(central, local, canHostHere, {
+        name,
+        onConflict: 'throw',
+    });
     const claimed = Object.keys(toClaim).sort();
     skipped.sort();
     if (claimed.length === 0)
         return { claimed, skipped };
-    updateMeta((current) => {
-        const legacy = current;
-        const remaining = {};
-        for (const [profileName, config] of Object.entries(legacy.browser ?? {})) {
-            if (!(profileName in toClaim))
-                remaining[profileName] = config;
-        }
-        const { browser: _removed, ...withoutCentralBrowser } = legacy;
-        return {
-            ...withoutCentralBrowser,
-            ...(Object.keys(remaining).length > 0 ? { browser: remaining } : {}),
-            deviceBrowser: { ...current.deviceBrowser, ...toClaim },
-        };
-    });
+    commitCentralClaim(toClaim);
     return { claimed, skipped };
 }
+/**
+ * Automatic, self-draining counterpart to {@link migrateCentralBrowserProfiles}:
+ * fold every lingering central `browser:` profile THIS machine can host into its
+ * device doc and clear it from central, so the tombstone drains itself on
+ * `agents sync` with no manual `agents browser profiles claim`.
+ *
+ * Safe to call implicitly, unlike a claim at registry-read time (which races —
+ * see the `profileRegistry does not claim central declarations` guard), but the
+ * CALLER owns one ordering invariant: invoke it AFTER the sync's repo pull. Two
+ * boxes can both host the same profile (`canHostHere` is launchability, not
+ * ownership), so a box acting on a PRE-pull view of central could re-claim a
+ * profile a peer already drained and pushed — both writes land in different
+ * device files with no git conflict, and the profile flips identity->fungible.
+ * Running post-pull means central already reflects peers' drains, so the tombstone
+ * is gone locally before this box looks. The selection is also computed INSIDE
+ * the meta lock, and the path never throws — an unhostable profile or one that
+ * conflicts with an existing local declaration is left central for an explicit
+ * claim rather than wedging the sync. After it runs, {@link profileRegistry} is
+ * the single source of truth: a claimed profile lives in the device doc alone,
+ * never double-counted across the two stores.
+ */
+export function autoEvictCentralBrowserProfiles(canHostHere) {
+    // Read fresh, select, and commit inside ONE meta-lock acquisition. Reading
+    // central before the lock and committing after (the manual path's shape) leaves
+    // a window where a concurrent write on THIS machine changes central/deviceBrowser
+    // between snapshot and commit, so the stale selection would be merged over the
+    // fresher value. Selecting from the state the lock just handed us closes that
+    // window. We write ONLY when something is claimed, so a no-op sync never touches
+    // any doc (writeMetaUnlocked would otherwise re-serialize the device doc every
+    // run). This mirrors updateMeta's own body, minus the unconditional write.
+    return withMetaLock(() => {
+        const meta = readMeta();
+        const central = meta.browser;
+        if (!central || Object.keys(central).length === 0)
+            return { claimed: [], skipped: [] };
+        const local = meta.deviceBrowser ?? {};
+        const { toClaim, skipped } = selectClaimableCentral(central, local, canHostHere, {
+            onConflict: 'skip',
+        });
+        const claimed = Object.keys(toClaim).sort();
+        skipped.sort();
+        if (claimed.length === 0)
+            return { claimed, skipped };
+        writeMetaUnlocked(buildEvictedMeta(meta, toClaim));
+        return { claimed, skipped };
+    });
+}
 /**
  * Every profile any device declares, keyed by name to all declaring devices.
  * Reads every `devices/<name>/agents.yaml`; declarations never overwrite.

package/dist/lib/daemon/runner.js

@@ -1313,10 +1313,17 @@ async function executeJobPlaced(config, deps, attempt) {
     // Workflows run via `agents run <workflow>` which delegates to claude under the hood.
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
     // (command jobs branched out earlier, so config.agent is set on the non-workflow path.)
+    // Custom harness/profile name (e.g. `deepseek`) stays on harnessName; the
+    // HOST CLI is effectiveAgent. The loop path spawns in-process via runLoop
+    // and never re-enters `agents run`, so it must stamp harnessName itself
+    // (PHNX-2935) — same field commands/exec.ts sets on ExecOptions.
+    const harnessName = !config.workflow && config.agent && isCustomHarnessName(config.agent)
+        ? config.agent
+        : undefined;
     const effectiveAgent = config.workflow
         ? 'claude'
-        : isCustomHarnessName(config.agent)
-            ? readProfile(config.agent).host.agent
+        : harnessName
+            ? readProfile(harnessName).host.agent
             : config.agent;
     if (!dispatchesViaAgentsRun(config)) {
         const { findUnifiedAccount, resolveAccountSelection, resolveCredentialAccount } = await import('../account-registry.js');
@@ -1377,6 +1384,7 @@ async function executeJobPlaced(config, deps, attempt) {
         const spawnEnv = buildRoutineSpawnEnv(baseEnv, effectiveAgent, primaryVersion, config.timezone, overlayHome);
         const execOptions = {
             agent: effectiveAgent,
+            harnessName,
             // Routine-supported self-updating CLIs (Cursor/Droid) use one global
             // binary; a versioned shim would point at a nonexistent isolated install.
             version: isSelfUpdatingAgent(effectiveAgent) ? undefined : primaryVersion,

package/dist/lib/device-config.js

@@ -164,8 +164,9 @@ export const CONFIG_KEYS = [
         visibility: 'machine',
         type: 'bool',
         defaultValue: false,
-        description: 'Whether an interactive `agents run` on this device is wrapped in the shared-socket tmux session. ' +
-            'Off, the default, spawns the agent directly. Turn it on to give every agent an addressable pane for ' +
+        description: 'Whether an interactive `agents run` on this device is wrapped in the shared-socket tmux session — local runs and ' +
+            'followed `--device` runs alike (PHNX-3316). Off, the default, spawns the agent directly; a remote run left bare ' +
+            'is protected by reconnect-and-resume, not a pane. Turn it on to give every agent an addressable pane for ' +
             '`agents message`, injection, and `agents focus` once the tmux mouse, clipboard, and scrollback behavior suits this device.',
     },
     {

package/dist/lib/devices/config-migration.js

@@ -44,6 +44,7 @@ import { META_HEADER, getDevicesAutoLaunchPath, getDevicesIgnoredPath, getDevice
 import { atomicWriteFileSync } from '../fs-atomic.js';
 import { machineId } from '../machine-id.js';
 import { withIgnoredAdded } from './registry.js';
+import { addIgnoredEntry } from './device-docs.js';
 /** Read every device doc. A doc that fails to parse is loudly skipped. */
 function readDeviceDocs(devicesRoot) {
     const docs = [];
@@ -176,6 +177,21 @@ export function migrateDeviceConfigStores() {
     const legacyIgnoredPath = getDevicesIgnoredPath();
     const legacyIgnoredPending = fs.existsSync(legacyIgnoredPath);
     const legacyIgnored = legacyIgnoredPending ? readLegacyIgnoredFile(legacyIgnoredPath) : null;
+    // Central shared fleet.discovery / fleet.ignored (PHNX-3315): the maps N boxes
+    // used to rewrite. Folded into THIS box's device doc below, then stripped.
+    const centralFleetState = !!(fleet &&
+        ((fleet.discovery && Object.keys(fleet.discovery).length > 0) ||
+            (Array.isArray(fleet.ignored) && fleet.ignored.length > 0)));
+    // Central shared `hosts:` map (PHNX-3315): the host registry N boxes used to
+    // rewrite. Folded into THIS box's device doc below, then the central key is
+    // dropped entirely.
+    const centralHosts = readMeta().hosts;
+    const centralHostsPending = !!(centralHosts && Object.keys(centralHosts).length > 0);
+    // Central device-scoped native accounts (PHNX-3315): a native login is
+    // machine-local, so `scope:'device'` identities (and the bindings that target
+    // them) belong in this box's device doc, off the git-tracked shared file.
+    const centralAccounts = readMeta().accounts;
+    const accountsPending = !!(centralAccounts?.native && Object.values(centralAccounts.native).some((a) => a.scope === 'device'));
     const pinsPath = getDevicePinsPath();
     let selfPins = {};
     try {
@@ -209,7 +225,7 @@ export function migrateDeviceConfigStores() {
         : undefined;
     const hasDestinationWork = plans.length > 0 || newDocs.length > 0 || docAgents !== undefined || docIsolated !== undefined;
     const autoLaunchPending = fs.existsSync(autoLaunchPath);
-    if (!centralHasConfig && !hasDestinationWork && !autoLaunchPending && !legacyIgnoredPending)
+    if (!centralHasConfig && !hasDestinationWork && !autoLaunchPending && !legacyIgnoredPending && !centralFleetState && !centralHostsPending && !accountsPending)
         return;
     // ── 2. Destination writes FIRST (crash-safe), under the meta lock so they
     //    serialize against writeMetaUnlocked's own read-merge-write of the doc.
@@ -302,6 +318,136 @@ export function migrateDeviceConfigStores() {
             console.error(`device config migration: could not remove ${legacyIgnoredPath} (${err.message}); a later run retries`);
         }
     }
+    // ── 5. Central fleet.discovery / fleet.ignored → THIS box's device doc ─────
+    // (PHNX-3315) The shared maps every box used to rewrite fold into this box's
+    // deviceFleet, then are stripped from central. writeMetaUnlocked writes the
+    // device doc BEFORE the central strip, so a crash re-folds on the next run and
+    // the union-dedup (ignored beats approved; newest ignoredAt wins) makes the
+    // re-fold a no-op. Idempotent — once central holds neither key the gather
+    // guard above skips this whole pass.
+    if (centralFleetState) {
+        updateMeta((m) => {
+            const disc = m.fleet?.discovery;
+            const ign = m.fleet?.ignored;
+            const hasDisc = !!disc && Object.keys(disc).length > 0;
+            const hasIgn = Array.isArray(ign) && ign.length > 0;
+            if (!hasDisc && !hasIgn)
+                return m;
+            const discovery = { ...m.deviceFleet?.discovery };
+            if (hasDisc) {
+                for (const [name, status] of Object.entries(disc)) {
+                    if (status !== 'approved' && status !== 'ignored')
+                        continue;
+                    if (discovery[name] === 'ignored')
+                        continue; // ignored is never downgraded
+                    discovery[name] = status;
+                }
+            }
+            const byName = new Map();
+            for (const e of m.deviceFleet?.ignored ?? [])
+                addIgnoredEntry(byName, e);
+            if (hasIgn)
+                for (const e of ign)
+                    addIgnoredEntry(byName, e);
+            const ignored = [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+            const deviceFleet = {
+                ...(Object.keys(discovery).length > 0 ? { discovery } : {}),
+                ...(ignored.length > 0 ? { ignored } : {}),
+            };
+            const fleet = m.fleet ? { ...m.fleet } : undefined;
+            if (fleet) {
+                delete fleet.discovery;
+                delete fleet.ignored;
+            }
+            // Drop an emptied fleet block entirely (mirrors step 3a's guard) so the
+            // strip does not leave a bare `fleet: { devices: {} }` behind.
+            const fleetEmpty = !fleet ||
+                ((fleet.devices === undefined ||
+                    (fleet.devices !== 'all' && Object.keys(fleet.devices).length === 0)) &&
+                    !fleet.defaults &&
+                    !fleet.secrets &&
+                    !fleet.routines);
+            if (fleetEmpty) {
+                const { fleet: _drop, ...rest } = m;
+                void _drop;
+                return { ...rest, deviceFleet };
+            }
+            return { ...m, deviceFleet, fleet };
+        });
+    }
+    // ── 6. Central hosts map → THIS box's device doc (PHNX-3315) ───────────────
+    // The shared host registry folds into this box's deviceHosts, then the central
+    // key is dropped. writeMetaUnlocked writes the device doc before the central
+    // strip, so a crash re-folds and the newest-addedAt union makes it a no-op.
+    // Idempotent — once central holds no `hosts:` the gather guard skips this.
+    if (centralHostsPending) {
+        updateMeta((m) => {
+            const hosts = m.hosts;
+            if (!hosts || Object.keys(hosts).length === 0)
+                return m;
+            // This box's own device-doc entries win over the shared legacy on a name
+            // collision (a re-fold after a crash must not clobber a fresher local edit).
+            const deviceHosts = { ...hosts, ...m.deviceHosts };
+            const { hosts: _drop, ...rest } = m;
+            void _drop;
+            return { ...rest, deviceHosts };
+        });
+    }
+    // ── 7. Central device-scoped native accounts → THIS box's device doc ───────
+    // (PHNX-3315) Fold `scope:'device'` natives and the bindings that target them
+    // out of central and into the device doc, removing their identity PII from the
+    // git-tracked shared file. The selection is recomputed INSIDE the lock so a
+    // concurrent write is never clobbered; the device-doc write precedes the
+    // central strip, so a crash re-folds and the id-keyed merge makes it a no-op.
+    if (accountsPending) {
+        updateMeta((m) => {
+            const native = { ...m.accounts?.native };
+            const bindings = { ...m.accounts?.bindings };
+            const devNative = { ...m.deviceAccounts?.native };
+            const devBindings = { ...m.deviceAccounts?.bindings };
+            const movedIds = new Set();
+            let changed = false;
+            for (const [id, entry] of Object.entries(native)) {
+                if (entry.scope === 'device') {
+                    devNative[id] = entry;
+                    movedIds.add(id);
+                    delete native[id];
+                    changed = true;
+                }
+            }
+            for (const [target, id] of Object.entries(bindings)) {
+                if (movedIds.has(id)) {
+                    devBindings[target] = id;
+                    delete bindings[target];
+                    changed = true;
+                }
+            }
+            if (!changed)
+                return m;
+            const deviceAccounts = {
+                ...(Object.keys(devNative).length > 0 ? { native: devNative } : {}),
+                ...(Object.keys(devBindings).length > 0 ? { bindings: devBindings } : {}),
+            };
+            const accounts = { ...m.accounts };
+            if (Object.keys(native).length > 0)
+                accounts.native = native;
+            else
+                delete accounts.native;
+            if (Object.keys(bindings).length > 0)
+                accounts.bindings = bindings;
+            else
+                delete accounts.bindings;
+            // Drop the whole central `accounts` block only when nothing fleet-shared
+            // remains (no version natives, no bindings, no defaults).
+            const accountsEmpty = !accounts.native && !accounts.bindings && !accounts.defaults;
+            if (accountsEmpty) {
+                const { accounts: _drop, ...rest } = m;
+                void _drop;
+                return { ...rest, deviceAccounts };
+            }
+            return { ...m, accounts, deviceAccounts };
+        });
+    }
 }
 /** Shallow-set equality for folded doc content (values compared deep via JSON). */
 function sameDocContent(a, b) {

package/dist/lib/devices/device-docs.d.ts

@@ -0,0 +1,35 @@
+import type { HostEntry } from '../types.js';
+import type { IgnoredDeviceEntry } from '../fleet/types.js';
+/** One parsed device doc under `~/.agents/devices/`. */
+export interface DeviceDoc {
+    device: string;
+    doc: Record<string, unknown>;
+}
+/**
+ * Every device doc, sorted by device name so the union is order-independent. A
+ * corrupt or non-map doc throws (loud), never silently skipped — a dropped doc
+ * would let the next writer clobber that peer's slice.
+ */
+export declare function readAllDeviceDocs(): DeviceDoc[];
+/**
+ * Union the per-box `fleet.discovery` maps. Precedence for a name declared by
+ * more than one box is deterministic and order-independent: `ignored` beats
+ * `approved` (a dismissal on any box wins), so every box computes the identical
+ * effective policy regardless of walk order.
+ */
+export declare function unionDeviceDiscovery(docs?: DeviceDoc[]): Record<string, 'approved' | 'ignored'>;
+/**
+ * Union the per-box `fleet.ignored` dismissal lists by node name. When two boxes
+ * dismissed the same node, the entry with the newest `ignoredAt` wins (ties
+ * broken by `ignoredOn`), so the attribution is deterministic and
+ * order-independent. Sorted by name to match the central writer's ordering.
+ */
+export declare function unionDeviceIgnored(docs?: DeviceDoc[]): IgnoredDeviceEntry[];
+/** Insert/replace a dismissal, newest ignoredAt (then ignoredOn) winning. */
+export declare function addIgnoredEntry(byName: Map<string, IgnoredDeviceEntry>, entry: IgnoredDeviceEntry): void;
+/**
+ * Union the per-box `hosts:` registries by host name. When two boxes registered
+ * the same name, the newest `addedAt` wins (ties broken by device name), so the
+ * merged directory is deterministic. Entries missing `addedAt` sort oldest.
+ */
+export declare function unionDeviceHosts(docs?: DeviceDoc[]): Record<string, HostEntry>;

package/dist/lib/devices/device-docs.js

@@ -0,0 +1,163 @@
+/**
+ * Union-on-read across every tracked device document (PHNX-3315).
+ *
+ * Phase 2 device-scopes three writers that used to rewrite one fleet-shared
+ * block in the central `agents.yaml` (fleet discovery/dismissals, the host
+ * registry, and device-scoped accounts). Each box now records only its OWN
+ * decisions in `~/.agents/devices/<machine>/agents.yaml`, so pulls never
+ * conflict — and the effective fleet view is recomputed here as a deterministic,
+ * order-independent UNION across every device doc, exactly like the browser
+ * profile registry (`lib/browser/registry.ts` `profileRegistry`).
+ *
+ * These readers walk the device docs ONLY. The central-legacy values (present
+ * until the fold-then-delete migration drains them) are merged in by each
+ * caller, so a value mid-migration is never lost. A doc that fails to parse is a
+ * hard error — silently returning an empty union would let a later write wipe a
+ * peer's decision, the same corruption contract `routine-activation.ts` and the
+ * device registry keep.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as yaml from 'yaml';
+import { getUserAgentsDir } from '../state.js';
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Every device doc, sorted by device name so the union is order-independent. A
+ * corrupt or non-map doc throws (loud), never silently skipped — a dropped doc
+ * would let the next writer clobber that peer's slice.
+ */
+export function readAllDeviceDocs() {
+    const devicesDir = path.join(getUserAgentsDir(), 'devices');
+    if (!fs.existsSync(devicesDir))
+        return [];
+    const out = [];
+    const names = fs
+        .readdirSync(devicesDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name)
+        .sort();
+    for (const device of names) {
+        const file = path.join(devicesDir, device, 'agents.yaml');
+        if (!fs.existsSync(file))
+            continue;
+        let parsed;
+        try {
+            parsed = yaml.parse(fs.readFileSync(file, 'utf8'));
+        }
+        catch (err) {
+            throw new Error(`Device config corrupted at ${file}: ${err.message}. Inspect and restore from backup.`);
+        }
+        if (parsed == null)
+            continue;
+        if (!isRecord(parsed)) {
+            throw new Error(`Device config corrupted at ${file}: document root must be a map.`);
+        }
+        out.push({ device, doc: parsed });
+    }
+    return out;
+}
+/**
+ * Union the per-box `fleet.discovery` maps. Precedence for a name declared by
+ * more than one box is deterministic and order-independent: `ignored` beats
+ * `approved` (a dismissal on any box wins), so every box computes the identical
+ * effective policy regardless of walk order.
+ */
+export function unionDeviceDiscovery(docs = readAllDeviceDocs()) {
+    const out = {};
+    for (const { device, doc } of docs) {
+        const fleet = doc.fleet;
+        if (fleet === undefined)
+            continue;
+        if (!isRecord(fleet))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet must be a map.`);
+        const discovery = fleet.discovery;
+        if (discovery === undefined)
+            continue;
+        if (!isRecord(discovery))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.discovery must be a map.`);
+        for (const [name, status] of Object.entries(discovery)) {
+            if (status !== 'approved' && status !== 'ignored') {
+                throw new Error(`Device discovery policy for '${name}' in devices/${device}/agents.yaml must be approved or ignored.`);
+            }
+            // ignored beats approved; once ignored, never downgraded by another box.
+            if (out[name] === 'ignored')
+                continue;
+            out[name] = status;
+        }
+    }
+    return out;
+}
+/**
+ * Union the per-box `fleet.ignored` dismissal lists by node name. When two boxes
+ * dismissed the same node, the entry with the newest `ignoredAt` wins (ties
+ * broken by `ignoredOn`), so the attribution is deterministic and
+ * order-independent. Sorted by name to match the central writer's ordering.
+ */
+export function unionDeviceIgnored(docs = readAllDeviceDocs()) {
+    const byName = new Map();
+    for (const { device, doc } of docs) {
+        const fleet = doc.fleet;
+        if (fleet === undefined)
+            continue;
+        if (!isRecord(fleet))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet must be a map.`);
+        const ignored = fleet.ignored;
+        if (ignored === undefined)
+            continue;
+        if (!Array.isArray(ignored))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.ignored must be a list.`);
+        for (const raw of ignored) {
+            if (!raw || typeof raw.name !== 'string' || typeof raw.ignoredAt !== 'string' || typeof raw.ignoredOn !== 'string') {
+                throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.ignored entries must be { name, ignoredAt, ignoredOn }.`);
+            }
+            addIgnoredEntry(byName, raw);
+        }
+    }
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Insert/replace a dismissal, newest ignoredAt (then ignoredOn) winning. */
+export function addIgnoredEntry(byName, entry) {
+    const prev = byName.get(entry.name);
+    if (!prev) {
+        byName.set(entry.name, entry);
+        return;
+    }
+    const at = Date.parse(entry.ignoredAt);
+    const prevAt = Date.parse(prev.ignoredAt);
+    if (at > prevAt || (at === prevAt && entry.ignoredOn.localeCompare(prev.ignoredOn) > 0)) {
+        byName.set(entry.name, entry);
+    }
+}
+/**
+ * Union the per-box `hosts:` registries by host name. When two boxes registered
+ * the same name, the newest `addedAt` wins (ties broken by device name), so the
+ * merged directory is deterministic. Entries missing `addedAt` sort oldest.
+ */
+export function unionDeviceHosts(docs = readAllDeviceDocs()) {
+    const out = {};
+    const wonAt = new Map();
+    for (const { device, doc } of docs) {
+        const hosts = doc.hosts;
+        if (hosts === undefined)
+            continue;
+        if (!isRecord(hosts))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: hosts must be a map.`);
+        for (const [name, entry] of Object.entries(hosts)) {
+            if (!isRecord(entry))
+                throw new Error(`Device config corrupted at devices/${device}/agents.yaml: host '${name}' must be a map.`);
+            const at = typeof entry.addedAt === 'string' ? Date.parse(entry.addedAt) : 0;
+            const prev = wonAt.get(name);
+            if (prev === undefined || at > prev) {
+                out[name] = entry;
+                wonAt.set(name, Number.isNaN(at) ? 0 : at);
+            }
+        }
+    }
+    return out;
+}
+// Native accounts and their bindings are machine-local (a native login lives in
+// the harness home on ONE box), so account-registry.ts reads THIS box's own
+// slice (meta.deviceAccounts) merged with the fleet-shared central store rather
+// than a cross-box union — there is deliberately no unionDeviceAccounts here.

package/dist/lib/devices/discovery-policy.d.ts

@@ -7,9 +7,21 @@ export interface DeviceDiscoveryReconcileResult {
 }
 /** Read one portable decision. Absence means pending. */
 export declare function getDeviceDiscoveryStatus(name: string): DeviceDiscoveryStatus | undefined;
-/** Persist one portable decision in the central fleet manifest. */
+/**
+ * Persist ONE discovery decision in THIS box's device doc (PHNX-3315). Each box
+ * records only its own choices in `devices/<machine>/agents.yaml` `fleet.discovery`,
+ * so N boxes no longer rewrite one shared central map (the guaranteed pull
+ * conflict). The effective policy is the union across every box
+ * ({@link loadDeviceDiscoveryPolicies}).
+ */
 export declare function setDeviceDiscoveryStatus(name: string, status: DeviceDiscoveryStatus | undefined): void;
-/** Load every explicit decision from the synced central fleet manifest. */
+/**
+ * The effective discovery policy: the UNION across every box's device doc, plus
+ * any lingering central-legacy map (drained by the fold-then-delete migration).
+ * Precedence for a name declared by more than one box is deterministic and
+ * order-independent — `ignored` beats `approved` — so every box computes the
+ * identical policy. Absence means pending.
+ */
 export declare function loadDeviceDiscoveryPolicies(): Map<string, DeviceDiscoveryStatus>;
 /**
  * Apply synced intent to this machine's local registry. Approval resolves live