@phnx-labs/agents-cli 1.22.52 → 1.22.54

package/dist/lib/device-config.d.ts

@@ -223,9 +223,9 @@ export declare function isDaemonEnabled(): boolean;
 /**
  * Throw when the daemon is disabled on this machine, naming the setting and
  * the fix. Every AUTO-start surface (routines add/start/catchup/webhook,
- * `ensureDaemonStarted`) refuses with this before calling `startDaemon()`.
- * `agents daemon start` is the deliberate override and does NOT call this —
- * disable only blocks auto-start, mirroring `systemctl disable`.
+ * monitors add, `ensureDaemonStarted`) refuses with this before calling
+ * `startDaemon()`. `agents daemon start` is the deliberate override and does
+ * NOT call this — disable only blocks auto-start, mirroring `systemctl disable`.
  */
 export declare function assertDaemonEnabled(): void;
 /**

package/dist/lib/device-config.js

@@ -145,7 +145,7 @@ export const CONFIG_KEYS = [
         defaultValue: true,
         description: 'Whether the daemon may run on this device at all (secrets broker, browser IPC, watchdog, and the ' +
             'routines scheduler). Disabling is the top-level kill switch: nothing auto-starts the daemon while it ' +
-            'is set, including `routines add`/`routines start`/`routines catchup`/webhook triggers. ' +
+            'is set, including `routines add`/`routines start`/`routines catchup`/`monitors add`/webhook triggers. ' +
             '`agents daemon start` still starts it explicitly.',
     },
     {
@@ -164,8 +164,9 @@ export const CONFIG_KEYS = [
         visibility: 'machine',
         type: 'bool',
         defaultValue: false,
-        description: 'Whether an interactive `agents run` on this device is wrapped in the shared-socket tmux session. ' +
-            'Off, the default, spawns the agent directly. Turn it on to give every agent an addressable pane for ' +
+        description: 'Whether an interactive `agents run` on this device is wrapped in the shared-socket tmux session — local runs and ' +
+            'followed `--device` runs alike (PHNX-3316). Off, the default, spawns the agent directly; a remote run left bare ' +
+            'is protected by reconnect-and-resume, not a pane. Turn it on to give every agent an addressable pane for ' +
             '`agents message`, injection, and `agents focus` once the tmux mouse, clipboard, and scrollback behavior suits this device.',
     },
     {
@@ -175,7 +176,7 @@ export const CONFIG_KEYS = [
         visibility: 'machine',
         type: 'bool',
         defaultValue: false,
-        description: "Whether other fleet machines may drive THIS device's browser over `browser --device <this-device>`. " +
+        description: "Whether other fleet machines may drive THIS device's browser over `browser --device <this-device>` or `agents ssh <this-device> …` (`agents browser` / `ag browser` / standalone `browser`). " +
             'Default off — a fleet-remote drive is refused until the owner runs `agents browser remote-control on`.',
     },
     {
@@ -812,9 +813,9 @@ export function isDaemonEnabled() {
 /**
  * Throw when the daemon is disabled on this machine, naming the setting and
  * the fix. Every AUTO-start surface (routines add/start/catchup/webhook,
- * `ensureDaemonStarted`) refuses with this before calling `startDaemon()`.
- * `agents daemon start` is the deliberate override and does NOT call this —
- * disable only blocks auto-start, mirroring `systemctl disable`.
+ * monitors add, `ensureDaemonStarted`) refuses with this before calling
+ * `startDaemon()`. `agents daemon start` is the deliberate override and does
+ * NOT call this — disable only blocks auto-start, mirroring `systemctl disable`.
  */
 export function assertDaemonEnabled() {
     if (isDaemonEnabled())

package/dist/lib/devices/config-migration.js

@@ -44,6 +44,7 @@ import { META_HEADER, getDevicesAutoLaunchPath, getDevicesIgnoredPath, getDevice
 import { atomicWriteFileSync } from '../fs-atomic.js';
 import { machineId } from '../machine-id.js';
 import { withIgnoredAdded } from './registry.js';
+import { addIgnoredEntry } from './device-docs.js';
 /** Read every device doc. A doc that fails to parse is loudly skipped. */
 function readDeviceDocs(devicesRoot) {
     const docs = [];
@@ -176,6 +177,21 @@ export function migrateDeviceConfigStores() {
     const legacyIgnoredPath = getDevicesIgnoredPath();
     const legacyIgnoredPending = fs.existsSync(legacyIgnoredPath);
     const legacyIgnored = legacyIgnoredPending ? readLegacyIgnoredFile(legacyIgnoredPath) : null;
+    // Central shared fleet.discovery / fleet.ignored (PHNX-3315): the maps N boxes
+    // used to rewrite. Folded into THIS box's device doc below, then stripped.
+    const centralFleetState = !!(fleet &&
+        ((fleet.discovery && Object.keys(fleet.discovery).length > 0) ||
+            (Array.isArray(fleet.ignored) && fleet.ignored.length > 0)));
+    // Central shared `hosts:` map (PHNX-3315): the host registry N boxes used to
+    // rewrite. Folded into THIS box's device doc below, then the central key is
+    // dropped entirely.
+    const centralHosts = readMeta().hosts;
+    const centralHostsPending = !!(centralHosts && Object.keys(centralHosts).length > 0);
+    // Central device-scoped native accounts (PHNX-3315): a native login is
+    // machine-local, so `scope:'device'` identities (and the bindings that target
+    // them) belong in this box's device doc, off the git-tracked shared file.
+    const centralAccounts = readMeta().accounts;
+    const accountsPending = !!(centralAccounts?.native && Object.values(centralAccounts.native).some((a) => a.scope === 'device'));
     const pinsPath = getDevicePinsPath();
     let selfPins = {};
     try {
@@ -209,7 +225,7 @@ export function migrateDeviceConfigStores() {
         : undefined;
     const hasDestinationWork = plans.length > 0 || newDocs.length > 0 || docAgents !== undefined || docIsolated !== undefined;
     const autoLaunchPending = fs.existsSync(autoLaunchPath);
-    if (!centralHasConfig && !hasDestinationWork && !autoLaunchPending && !legacyIgnoredPending)
+    if (!centralHasConfig && !hasDestinationWork && !autoLaunchPending && !legacyIgnoredPending && !centralFleetState && !centralHostsPending && !accountsPending)
         return;
     // ── 2. Destination writes FIRST (crash-safe), under the meta lock so they
     //    serialize against writeMetaUnlocked's own read-merge-write of the doc.
@@ -302,6 +318,136 @@ export function migrateDeviceConfigStores() {
             console.error(`device config migration: could not remove ${legacyIgnoredPath} (${err.message}); a later run retries`);
         }
     }
+    // ── 5. Central fleet.discovery / fleet.ignored → THIS box's device doc ─────
+    // (PHNX-3315) The shared maps every box used to rewrite fold into this box's
+    // deviceFleet, then are stripped from central. writeMetaUnlocked writes the
+    // device doc BEFORE the central strip, so a crash re-folds on the next run and
+    // the union-dedup (ignored beats approved; newest ignoredAt wins) makes the
+    // re-fold a no-op. Idempotent — once central holds neither key the gather
+    // guard above skips this whole pass.
+    if (centralFleetState) {
+        updateMeta((m) => {
+            const disc = m.fleet?.discovery;
+            const ign = m.fleet?.ignored;
+            const hasDisc = !!disc && Object.keys(disc).length > 0;
+            const hasIgn = Array.isArray(ign) && ign.length > 0;
+            if (!hasDisc && !hasIgn)
+                return m;
+            const discovery = { ...m.deviceFleet?.discovery };
+            if (hasDisc) {
+                for (const [name, status] of Object.entries(disc)) {
+                    if (status !== 'approved' && status !== 'ignored')
+                        continue;
+                    if (discovery[name] === 'ignored')
+                        continue; // ignored is never downgraded
+                    discovery[name] = status;
+                }
+            }
+            const byName = new Map();
+            for (const e of m.deviceFleet?.ignored ?? [])
+                addIgnoredEntry(byName, e);
+            if (hasIgn)
+                for (const e of ign)
+                    addIgnoredEntry(byName, e);
+            const ignored = [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+            const deviceFleet = {
+                ...(Object.keys(discovery).length > 0 ? { discovery } : {}),
+                ...(ignored.length > 0 ? { ignored } : {}),
+            };
+            const fleet = m.fleet ? { ...m.fleet } : undefined;
+            if (fleet) {
+                delete fleet.discovery;
+                delete fleet.ignored;
+            }
+            // Drop an emptied fleet block entirely (mirrors step 3a's guard) so the
+            // strip does not leave a bare `fleet: { devices: {} }` behind.
+            const fleetEmpty = !fleet ||
+                ((fleet.devices === undefined ||
+                    (fleet.devices !== 'all' && Object.keys(fleet.devices).length === 0)) &&
+                    !fleet.defaults &&
+                    !fleet.secrets &&
+                    !fleet.routines);
+            if (fleetEmpty) {
+                const { fleet: _drop, ...rest } = m;
+                void _drop;
+                return { ...rest, deviceFleet };
+            }
+            return { ...m, deviceFleet, fleet };
+        });
+    }
+    // ── 6. Central hosts map → THIS box's device doc (PHNX-3315) ───────────────
+    // The shared host registry folds into this box's deviceHosts, then the central
+    // key is dropped. writeMetaUnlocked writes the device doc before the central
+    // strip, so a crash re-folds and the newest-addedAt union makes it a no-op.
+    // Idempotent — once central holds no `hosts:` the gather guard skips this.
+    if (centralHostsPending) {
+        updateMeta((m) => {
+            const hosts = m.hosts;
+            if (!hosts || Object.keys(hosts).length === 0)
+                return m;
+            // This box's own device-doc entries win over the shared legacy on a name
+            // collision (a re-fold after a crash must not clobber a fresher local edit).
+            const deviceHosts = { ...hosts, ...m.deviceHosts };
+            const { hosts: _drop, ...rest } = m;
+            void _drop;
+            return { ...rest, deviceHosts };
+        });
+    }
+    // ── 7. Central device-scoped native accounts → THIS box's device doc ───────
+    // (PHNX-3315) Fold `scope:'device'` natives and the bindings that target them
+    // out of central and into the device doc, removing their identity PII from the
+    // git-tracked shared file. The selection is recomputed INSIDE the lock so a
+    // concurrent write is never clobbered; the device-doc write precedes the
+    // central strip, so a crash re-folds and the id-keyed merge makes it a no-op.
+    if (accountsPending) {
+        updateMeta((m) => {
+            const native = { ...m.accounts?.native };
+            const bindings = { ...m.accounts?.bindings };
+            const devNative = { ...m.deviceAccounts?.native };
+            const devBindings = { ...m.deviceAccounts?.bindings };
+            const movedIds = new Set();
+            let changed = false;
+            for (const [id, entry] of Object.entries(native)) {
+                if (entry.scope === 'device') {
+                    devNative[id] = entry;
+                    movedIds.add(id);
+                    delete native[id];
+                    changed = true;
+                }
+            }
+            for (const [target, id] of Object.entries(bindings)) {
+                if (movedIds.has(id)) {
+                    devBindings[target] = id;
+                    delete bindings[target];
+                    changed = true;
+                }
+            }
+            if (!changed)
+                return m;
+            const deviceAccounts = {
+                ...(Object.keys(devNative).length > 0 ? { native: devNative } : {}),
+                ...(Object.keys(devBindings).length > 0 ? { bindings: devBindings } : {}),
+            };
+            const accounts = { ...m.accounts };
+            if (Object.keys(native).length > 0)
+                accounts.native = native;
+            else
+                delete accounts.native;
+            if (Object.keys(bindings).length > 0)
+                accounts.bindings = bindings;
+            else
+                delete accounts.bindings;
+            // Drop the whole central `accounts` block only when nothing fleet-shared
+            // remains (no version natives, no bindings, no defaults).
+            const accountsEmpty = !accounts.native && !accounts.bindings && !accounts.defaults;
+            if (accountsEmpty) {
+                const { accounts: _drop, ...rest } = m;
+                void _drop;
+                return { ...rest, deviceAccounts };
+            }
+            return { ...m, accounts, deviceAccounts };
+        });
+    }
 }
 /** Shallow-set equality for folded doc content (values compared deep via JSON). */
 function sameDocContent(a, b) {

package/dist/lib/devices/connect.d.ts

@@ -37,6 +37,26 @@ export declare function fleetDialTarget(device: DeviceProfile): string;
  * login).
  */
 export declare function wrapRemoteCommand(device: DeviceProfile, cmd: string[]): string | undefined;
+/**
+ * True when `cmd` is a browser drive: `agents browser …`, `ag browser …`, or
+ * the standalone `browser` binary (`cli/package.json` `bin.browser` →
+ * `src/browser.ts`), including the quoted single-string form
+ * `agents ssh box 'browser …'`. The `--device` passthrough stamps
+ * {@link markFleetRemote} on this shape so the far-side consent gate can fire;
+ * `agents ssh` must too (PHNX-3065).
+ */
+export declare function isAgentsBrowserDrive(cmd: string[]): boolean;
+/**
+ * Prefix a remote command so the far side sees `AGENTS_FLEET_REMOTE=1` — the
+ * marker the browser consent gate reads. `wrapRemoteCommand` joins the argv
+ * with spaces (POSIX) or base64-encodes it for PowerShell, so a
+ * shell-appropriate leading token rides through both: `env VAR=1 …` on POSIX,
+ * `$env:VAR='1'; …` on PowerShell.
+ *
+ * Already-marked argv (the `--device` fan-out stamps this before
+ * {@link buildSshInvocation}) is left unchanged so the prefix is not doubled.
+ */
+export declare function markFleetRemote(cmd: string[], device: Pick<DeviceProfile, 'shell'>): string[];
 /**
  * Build the remote command that starts an INTERACTIVE LOGIN shell inside a
  * mirrored project directory, falling back to the remote home when that
@@ -97,6 +117,12 @@ export declare function deviceIdentityArgs(device: DeviceProfile): string[];
  * to the remote home), matching `agents run --device`. It is ignored when a `cmd`
  * is given: an explicit command keeps its current cwd (the remote home) and its
  * behavior unchanged (RUSH-2412).
+ *
+ * An `agents browser …` / `ag browser …` / standalone `browser …` command is
+ * prefixed with {@link markFleetRemote} so the far-side consent gate sees
+ * `AGENTS_FLEET_REMOTE=1` the same way `browser --device` does. The local `env`
+ * overlay here is for the ssh *client* (askpass); it cannot carry the marker —
+ * OpenSSH does not forward arbitrary env (PHNX-3065).
  */
 export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions, opts?: {
     agentOnly?: boolean;

package/dist/lib/devices/connect.js

@@ -86,6 +86,43 @@ export function wrapRemoteCommand(device, cmd) {
     }
     return joined;
 }
+/**
+ * True when `cmd` is a browser drive: `agents browser …`, `ag browser …`, or
+ * the standalone `browser` binary (`cli/package.json` `bin.browser` →
+ * `src/browser.ts`), including the quoted single-string form
+ * `agents ssh box 'browser …'`. The `--device` passthrough stamps
+ * {@link markFleetRemote} on this shape so the far-side consent gate can fire;
+ * `agents ssh` must too (PHNX-3065).
+ */
+export function isAgentsBrowserDrive(cmd) {
+    if (cmd.length === 0)
+        return false;
+    const tokens = cmd.length === 1 && /\s/.test(cmd[0]) ? cmd[0].trim().split(/\s+/) : cmd;
+    const bin = tokens[0];
+    if (bin === 'browser')
+        return true;
+    return (bin === 'agents' || bin === 'ag') && tokens[1] === 'browser';
+}
+/**
+ * Prefix a remote command so the far side sees `AGENTS_FLEET_REMOTE=1` — the
+ * marker the browser consent gate reads. `wrapRemoteCommand` joins the argv
+ * with spaces (POSIX) or base64-encodes it for PowerShell, so a
+ * shell-appropriate leading token rides through both: `env VAR=1 …` on POSIX,
+ * `$env:VAR='1'; …` on PowerShell.
+ *
+ * Already-marked argv (the `--device` fan-out stamps this before
+ * {@link buildSshInvocation}) is left unchanged so the prefix is not doubled.
+ */
+export function markFleetRemote(cmd, device) {
+    if (device.shell === 'powershell') {
+        return cmd[0] === `$env:AGENTS_FLEET_REMOTE='1';`
+            ? cmd
+            : [`$env:AGENTS_FLEET_REMOTE='1';`, ...cmd];
+    }
+    return cmd[0] === 'env' && cmd[1] === 'AGENTS_FLEET_REMOTE=1'
+        ? cmd
+        : ['env', 'AGENTS_FLEET_REMOTE=1', ...cmd];
+}
 /**
  * Build the remote command that starts an INTERACTIVE LOGIN shell inside a
  * mirrored project directory, falling back to the remote home when that
@@ -156,6 +193,12 @@ export function deviceIdentityArgs(device) {
  * to the remote home), matching `agents run --device`. It is ignored when a `cmd`
  * is given: an explicit command keeps its current cwd (the remote home) and its
  * behavior unchanged (RUSH-2412).
+ *
+ * An `agents browser …` / `ag browser …` / standalone `browser …` command is
+ * prefixed with {@link markFleetRemote} so the far-side consent gate sees
+ * `AGENTS_FLEET_REMOTE=1` the same way `browser --device` does. The local `env`
+ * overlay here is for the ssh *client* (askpass); it cannot carry the marker —
+ * OpenSSH does not forward arbitrary env (PHNX-3065).
  */
 export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, opts = {}) {
     // The effective profile: central config (ssh.*/platform/user) overlaid on
@@ -166,9 +209,13 @@ export function buildSshInvocation(device, cmd, askpassShimPath, hostKey = {}, o
     // wrapper (interactiveCwd), which is an interactive login too and still needs
     // a real tty below.
     const interactive = cmd.length === 0;
+    // Stamp the consent marker on the REMOTE command, not the local ssh env:
+    // SSH_ASKPASS lives on this side; AGENTS_FLEET_REMOTE must be visible to the
+    // process that runs on the peer.
+    const remoteCmd = !interactive && isAgentsBrowserDrive(cmd) ? markFleetRemote(cmd, device) : cmd;
     const remote = interactive
         ? buildInteractiveShellCommand(device, opts.interactiveCwd)
-        : wrapRemoteCommand(device, cmd);
+        : wrapRemoteCommand(device, remoteCmd);
     const env = {};
     const args = [
         ...hostKeyCheckingOpts(hostKey.pinned ?? false, hostKey.knownHostsFile),

package/dist/lib/devices/device-docs.d.ts

@@ -0,0 +1,35 @@
+import type { HostEntry } from '../types.js';
+import type { IgnoredDeviceEntry } from '../fleet/types.js';
+/** One parsed device doc under `~/.agents/devices/`. */
+export interface DeviceDoc {
+    device: string;
+    doc: Record<string, unknown>;
+}
+/**
+ * Every device doc, sorted by device name so the union is order-independent. A
+ * corrupt or non-map doc throws (loud), never silently skipped — a dropped doc
+ * would let the next writer clobber that peer's slice.
+ */
+export declare function readAllDeviceDocs(): DeviceDoc[];
+/**
+ * Union the per-box `fleet.discovery` maps. Precedence for a name declared by
+ * more than one box is deterministic and order-independent: `ignored` beats
+ * `approved` (a dismissal on any box wins), so every box computes the identical
+ * effective policy regardless of walk order.
+ */
+export declare function unionDeviceDiscovery(docs?: DeviceDoc[]): Record<string, 'approved' | 'ignored'>;
+/**
+ * Union the per-box `fleet.ignored` dismissal lists by node name. When two boxes
+ * dismissed the same node, the entry with the newest `ignoredAt` wins (ties
+ * broken by `ignoredOn`), so the attribution is deterministic and
+ * order-independent. Sorted by name to match the central writer's ordering.
+ */
+export declare function unionDeviceIgnored(docs?: DeviceDoc[]): IgnoredDeviceEntry[];
+/** Insert/replace a dismissal, newest ignoredAt (then ignoredOn) winning. */
+export declare function addIgnoredEntry(byName: Map<string, IgnoredDeviceEntry>, entry: IgnoredDeviceEntry): void;
+/**
+ * Union the per-box `hosts:` registries by host name. When two boxes registered
+ * the same name, the newest `addedAt` wins (ties broken by device name), so the
+ * merged directory is deterministic. Entries missing `addedAt` sort oldest.
+ */
+export declare function unionDeviceHosts(docs?: DeviceDoc[]): Record<string, HostEntry>;

package/dist/lib/devices/device-docs.js

@@ -0,0 +1,163 @@
+/**
+ * Union-on-read across every tracked device document (PHNX-3315).
+ *
+ * Phase 2 device-scopes three writers that used to rewrite one fleet-shared
+ * block in the central `agents.yaml` (fleet discovery/dismissals, the host
+ * registry, and device-scoped accounts). Each box now records only its OWN
+ * decisions in `~/.agents/devices/<machine>/agents.yaml`, so pulls never
+ * conflict — and the effective fleet view is recomputed here as a deterministic,
+ * order-independent UNION across every device doc, exactly like the browser
+ * profile registry (`lib/browser/registry.ts` `profileRegistry`).
+ *
+ * These readers walk the device docs ONLY. The central-legacy values (present
+ * until the fold-then-delete migration drains them) are merged in by each
+ * caller, so a value mid-migration is never lost. A doc that fails to parse is a
+ * hard error — silently returning an empty union would let a later write wipe a
+ * peer's decision, the same corruption contract `routine-activation.ts` and the
+ * device registry keep.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as yaml from 'yaml';
+import { getUserAgentsDir } from '../state.js';
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Every device doc, sorted by device name so the union is order-independent. A
+ * corrupt or non-map doc throws (loud), never silently skipped — a dropped doc
+ * would let the next writer clobber that peer's slice.
+ */
+export function readAllDeviceDocs() {
+    const devicesDir = path.join(getUserAgentsDir(), 'devices');
+    if (!fs.existsSync(devicesDir))
+        return [];
+    const out = [];
+    const names = fs
+        .readdirSync(devicesDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name)
+        .sort();
+    for (const device of names) {
+        const file = path.join(devicesDir, device, 'agents.yaml');
+        if (!fs.existsSync(file))
+            continue;
+        let parsed;
+        try {
+            parsed = yaml.parse(fs.readFileSync(file, 'utf8'));
+        }
+        catch (err) {
+            throw new Error(`Device config corrupted at ${file}: ${err.message}. Inspect and restore from backup.`);
+        }
+        if (parsed == null)
+            continue;
+        if (!isRecord(parsed)) {
+            throw new Error(`Device config corrupted at ${file}: document root must be a map.`);
+        }
+        out.push({ device, doc: parsed });
+    }
+    return out;
+}
+/**
+ * Union the per-box `fleet.discovery` maps. Precedence for a name declared by
+ * more than one box is deterministic and order-independent: `ignored` beats
+ * `approved` (a dismissal on any box wins), so every box computes the identical
+ * effective policy regardless of walk order.
+ */
+export function unionDeviceDiscovery(docs = readAllDeviceDocs()) {
+    const out = {};
+    for (const { device, doc } of docs) {
+        const fleet = doc.fleet;
+        if (fleet === undefined)
+            continue;
+        if (!isRecord(fleet))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet must be a map.`);
+        const discovery = fleet.discovery;
+        if (discovery === undefined)
+            continue;
+        if (!isRecord(discovery))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.discovery must be a map.`);
+        for (const [name, status] of Object.entries(discovery)) {
+            if (status !== 'approved' && status !== 'ignored') {
+                throw new Error(`Device discovery policy for '${name}' in devices/${device}/agents.yaml must be approved or ignored.`);
+            }
+            // ignored beats approved; once ignored, never downgraded by another box.
+            if (out[name] === 'ignored')
+                continue;
+            out[name] = status;
+        }
+    }
+    return out;
+}
+/**
+ * Union the per-box `fleet.ignored` dismissal lists by node name. When two boxes
+ * dismissed the same node, the entry with the newest `ignoredAt` wins (ties
+ * broken by `ignoredOn`), so the attribution is deterministic and
+ * order-independent. Sorted by name to match the central writer's ordering.
+ */
+export function unionDeviceIgnored(docs = readAllDeviceDocs()) {
+    const byName = new Map();
+    for (const { device, doc } of docs) {
+        const fleet = doc.fleet;
+        if (fleet === undefined)
+            continue;
+        if (!isRecord(fleet))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet must be a map.`);
+        const ignored = fleet.ignored;
+        if (ignored === undefined)
+            continue;
+        if (!Array.isArray(ignored))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.ignored must be a list.`);
+        for (const raw of ignored) {
+            if (!raw || typeof raw.name !== 'string' || typeof raw.ignoredAt !== 'string' || typeof raw.ignoredOn !== 'string') {
+                throw new Error(`Device config corrupted at devices/${device}/agents.yaml: fleet.ignored entries must be { name, ignoredAt, ignoredOn }.`);
+            }
+            addIgnoredEntry(byName, raw);
+        }
+    }
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Insert/replace a dismissal, newest ignoredAt (then ignoredOn) winning. */
+export function addIgnoredEntry(byName, entry) {
+    const prev = byName.get(entry.name);
+    if (!prev) {
+        byName.set(entry.name, entry);
+        return;
+    }
+    const at = Date.parse(entry.ignoredAt);
+    const prevAt = Date.parse(prev.ignoredAt);
+    if (at > prevAt || (at === prevAt && entry.ignoredOn.localeCompare(prev.ignoredOn) > 0)) {
+        byName.set(entry.name, entry);
+    }
+}
+/**
+ * Union the per-box `hosts:` registries by host name. When two boxes registered
+ * the same name, the newest `addedAt` wins (ties broken by device name), so the
+ * merged directory is deterministic. Entries missing `addedAt` sort oldest.
+ */
+export function unionDeviceHosts(docs = readAllDeviceDocs()) {
+    const out = {};
+    const wonAt = new Map();
+    for (const { device, doc } of docs) {
+        const hosts = doc.hosts;
+        if (hosts === undefined)
+            continue;
+        if (!isRecord(hosts))
+            throw new Error(`Device config corrupted at devices/${device}/agents.yaml: hosts must be a map.`);
+        for (const [name, entry] of Object.entries(hosts)) {
+            if (!isRecord(entry))
+                throw new Error(`Device config corrupted at devices/${device}/agents.yaml: host '${name}' must be a map.`);
+            const at = typeof entry.addedAt === 'string' ? Date.parse(entry.addedAt) : 0;
+            const prev = wonAt.get(name);
+            if (prev === undefined || at > prev) {
+                out[name] = entry;
+                wonAt.set(name, Number.isNaN(at) ? 0 : at);
+            }
+        }
+    }
+    return out;
+}
+// Native accounts and their bindings are machine-local (a native login lives in
+// the harness home on ONE box), so account-registry.ts reads THIS box's own
+// slice (meta.deviceAccounts) merged with the fleet-shared central store rather
+// than a cross-box union — there is deliberately no unionDeviceAccounts here.

package/dist/lib/devices/discovery-policy.d.ts

@@ -7,9 +7,21 @@ export interface DeviceDiscoveryReconcileResult {
 }
 /** Read one portable decision. Absence means pending. */
 export declare function getDeviceDiscoveryStatus(name: string): DeviceDiscoveryStatus | undefined;
-/** Persist one portable decision in the central fleet manifest. */
+/**
+ * Persist ONE discovery decision in THIS box's device doc (PHNX-3315). Each box
+ * records only its own choices in `devices/<machine>/agents.yaml` `fleet.discovery`,
+ * so N boxes no longer rewrite one shared central map (the guaranteed pull
+ * conflict). The effective policy is the union across every box
+ * ({@link loadDeviceDiscoveryPolicies}).
+ */
 export declare function setDeviceDiscoveryStatus(name: string, status: DeviceDiscoveryStatus | undefined): void;
-/** Load every explicit decision from the synced central fleet manifest. */
+/**
+ * The effective discovery policy: the UNION across every box's device doc, plus
+ * any lingering central-legacy map (drained by the fold-then-delete migration).
+ * Precedence for a name declared by more than one box is deterministic and
+ * order-independent — `ignored` beats `approved` — so every box computes the
+ * identical policy. Absence means pending.
+ */
 export declare function loadDeviceDiscoveryPolicies(): Map<string, DeviceDiscoveryStatus>;
 /**
  * Apply synced intent to this machine's local registry. Approval resolves live

package/dist/lib/devices/discovery-policy.js

@@ -1,5 +1,6 @@
 /** Synced device approval/ignore policy and local registry reconciliation. */
 import { readMeta, updateMeta } from '../state.js';
+import { unionDeviceDiscovery } from './device-docs.js';
 import { addIgnored, assertValidDeviceName, loadDevices, removeDevice, removeIgnored, upsertDevice, } from './registry.js';
 import { localLoginUser, withDefaultUser } from './sync.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson } from './tailscale.js';
@@ -8,36 +9,46 @@ export function getDeviceDiscoveryStatus(name) {
     assertValidDeviceName(name);
     return loadDeviceDiscoveryPolicies().get(name);
 }
-/** Persist one portable decision in the central fleet manifest. */
+/**
+ * Persist ONE discovery decision in THIS box's device doc (PHNX-3315). Each box
+ * records only its own choices in `devices/<machine>/agents.yaml` `fleet.discovery`,
+ * so N boxes no longer rewrite one shared central map (the guaranteed pull
+ * conflict). The effective policy is the union across every box
+ * ({@link loadDeviceDiscoveryPolicies}).
+ */
 export function setDeviceDiscoveryStatus(name, status) {
     assertValidDeviceName(name);
     updateMeta((meta) => {
-        const discovery = { ...meta.fleet?.discovery };
+        const discovery = { ...meta.deviceFleet?.discovery };
         if (status)
             discovery[name] = status;
         else
             delete discovery[name];
-        const fleet = {
-            ...meta.fleet,
-            devices: meta.fleet?.devices ?? {},
-            // Keep an empty map as the synced tombstone: it distinguishes "policy is
-            // authoritative and every device is pending" from an older config that
-            // has never opted into portable discovery decisions.
-            discovery,
-        };
-        return { ...meta, fleet };
+        return { ...meta, deviceFleet: { ...meta.deviceFleet, discovery } };
     });
 }
-/** Load every explicit decision from the synced central fleet manifest. */
+/**
+ * The effective discovery policy: the UNION across every box's device doc, plus
+ * any lingering central-legacy map (drained by the fold-then-delete migration).
+ * Precedence for a name declared by more than one box is deterministic and
+ * order-independent — `ignored` beats `approved` — so every box computes the
+ * identical policy. Absence means pending.
+ */
 export function loadDeviceDiscoveryPolicies() {
     const policies = new Map();
-    for (const [name, status] of Object.entries(readMeta().fleet?.discovery ?? {})) {
-        assertValidDeviceName(name);
-        if (status !== 'approved' && status !== 'ignored') {
-            throw new Error(`Device discovery policy for '${name}' must be approved or ignored.`);
+    const apply = (rec) => {
+        for (const [name, status] of Object.entries(rec ?? {})) {
+            assertValidDeviceName(name);
+            if (status !== 'approved' && status !== 'ignored') {
+                throw new Error(`Device discovery policy for '${name}' must be approved or ignored.`);
+            }
+            if (policies.get(name) === 'ignored')
+                continue; // ignored is never downgraded
+            policies.set(name, status);
         }
-        policies.set(name, status);
-    }
+    };
+    apply(readMeta().fleet?.discovery); // central legacy, until the migration drains it
+    apply(unionDeviceDiscovery()); // per-box device docs (ignored still wins)
     return policies;
 }
 /**
@@ -55,11 +66,10 @@ export function loadDeviceDiscoveryPolicies() {
  * that never meant to touch them.
  */
 export async function reconcileDeviceDiscoveryPolicies() {
-    const configured = readMeta().fleet?.discovery;
-    if (configured === undefined) {
+    const policies = loadDeviceDiscoveryPolicies();
+    if (policies.size === 0) {
         return { approved: [], ignored: [], registered: [], unresolved: [] };
     }
-    const policies = loadDeviceDiscoveryPolicies();
     const approved = [...policies].filter(([, s]) => s === 'approved').map(([n]) => n).sort();
     const ignored = [...policies].filter(([, s]) => s === 'ignored').map(([n]) => n).sort();
     for (const name of ignored) {