@phnx-labs/agents-cli 1.22.57 → 1.22.58

package/dist/lib/browser/service.js

@@ -2608,9 +2608,45 @@ export class BrowserService {
         if (port === undefined)
             return null;
         const host = parsed?.host && parsed.host !== 'localhost' ? parsed.host : 'localhost';
-        // ssh:// endpoints need a tunnel; soft rehydrate only handles local CDP.
-        if (resolved.target.startsWith('ssh:'))
-            return null;
+        // ssh:// endpoints: a daemon restart killed this box's tunnel, but the
+        // browser is still running on the FAR side — so the caller's tasks are
+        // valid, only the local hop is gone. Re-establish the tunnel and reconnect
+        // CDP (connectSSH attaches to the already-running remote browser via
+        // isOwnTunnel — it never launches one, so this stays a soft-attach), then
+        // merge the disk tasks. Without this, a remote agent driving a browser host
+        // after a restart got "Unknown browser task" for a tab that was still alive
+        // (PHNX-2663). A failure returns null exactly like the local-CDP path, so
+        // the caller falls through to disk reconcile rather than crashing.
+        if (resolved.target.startsWith('ssh:')) {
+            try {
+                const conn = await connectSSH(resolved.target, profile, key, { persistRemote: true });
+                await this.enableDomains(conn.cdp);
+                const tasks = this.loadTaskState(key);
+                for (const [k, t] of diskTasks) {
+                    if (!tasks.has(k))
+                        tasks.set(k, t);
+                }
+                return {
+                    cdp: conn.cdp,
+                    port: conn.port,
+                    pid: conn.pid,
+                    electron: profile.electron,
+                    browserType: profile.browser,
+                    targetFilter: resolved.targetFilter ?? profile.targetFilter,
+                    key,
+                    profile: bare,
+                    tasks,
+                    sessionCache: new Map(),
+                    // Carry the tunnel teardown so removing this connection kills the
+                    // ssh hop — otherwise it leaks across the next restart (see the
+                    // `cleanup` docblock on ProfileConnection).
+                    cleanup: conn.cleanup,
+                };
+            }
+            catch {
+                return null;
+            }
+        }
         try {
             const { wsUrl, browser } = await discoverBrowserWsUrl(port, host, bare);
             verifyBrowserIdentity(browser, profile.browser, port, host);
@@ -2645,6 +2681,48 @@ export class BrowserService {
      * tasks.json entries. Used before identity-based resolution so a daemon
      * restart does not make the caller's tasks invisible.
      */
+    /**
+     * Register a freshly-rehydrated connection, unless a concurrent rehydrate won
+     * the race and already registered one for this key. `attachRunningProfile`
+     * awaits an ssh-tunnel spawn / CDP connect, so two commands landing right
+     * after a daemon restart can each build a connection for the same key; the
+     * loser must be released instead of silently overwriting the winner (whose
+     * `cleanup` would then never run).
+     *
+     * The subtlety is the SSH tunnel: when the loser's `connectSSH` landed after
+     * the winner's tunnel had already bound the local port, `isOwnTunnel` makes it
+     * **reuse** that same OS process (`drivers/ssh.ts`) — so both connections carry
+     * the same `pid`/`port`. Calling the loser's `cleanup()` then does
+     * `tunnel.kill()` on the SHARED process and breaks the winner's live CDP. So
+     * when the loser shares the winner's tunnel we close ONLY the loser's own CDP
+     * socket and leave the tunnel to the winner; only a loser that spawned its own
+     * distinct tunnel gets the full `cleanup()` (else it would leak). Returns the
+     * winning connection to use.
+     */
+    registerRehydratedConnection(key, conn) {
+        const existing = this.connections.get(key);
+        if (!existing) {
+            this.connections.set(key, conn);
+            return conn;
+        }
+        const sharesTunnel = conn.pid !== 0 && conn.pid === existing.pid && conn.port === existing.port;
+        if (conn.pid !== 0 && !sharesTunnel && conn.cleanup) {
+            // Distinct tunnel — full teardown so this loser's tunnel doesn't leak.
+            try {
+                conn.cleanup();
+            }
+            catch { /* best effort — the winner stays live */ }
+        }
+        else {
+            // Shared/borrowed tunnel (or a local connection with no tunnel): close
+            // only our own CDP client; killing the tunnel would break the winner.
+            try {
+                conn.cdp.close();
+            }
+            catch { /* best effort */ }
+        }
+        return existing;
+    }
     async rehydrateAllFromDisk() {
         const runtimeRoot = getBrowserRuntimeDir();
         let dirNames = [];
@@ -2676,7 +2754,11 @@ export class BrowserService {
             const conn = await this.attachRunningProfile(key, tasks);
             if (!conn)
                 continue;
-            this.connections.set(key, conn);
+            // A concurrent rehydrate may have registered one for this key while we
+            // awaited the attach; keep the winner and tear our loser's tunnel down.
+            const registered = this.registerRehydratedConnection(key, conn);
+            if (registered !== conn)
+                continue;
             try {
                 await this.applyDefaultDownloadBehavior(conn, key);
             }
@@ -2734,13 +2816,16 @@ export class BrowserService {
                     // CDP down — cannot rehydrate a live connection; caller will error.
                     continue;
                 }
-                conn = attached;
-                this.connections.set(key, conn);
-                try {
-                    await this.applyDefaultDownloadBehavior(conn, key);
-                }
-                catch {
-                    // Non-fatal.
+                // Keep whichever connection a concurrent rehydrate registered first and
+                // tear our loser's tunnel down instead of leaking it (see the helper).
+                conn = this.registerRehydratedConnection(key, attached);
+                if (conn === attached) {
+                    try {
+                        await this.applyDefaultDownloadBehavior(conn, key);
+                    }
+                    catch {
+                        // Non-fatal.
+                    }
                 }
             }
             const task = this.lookupTaskOnConn(conn, taskId) ?? found;

package/dist/lib/browser/sessions-list.js

@@ -21,6 +21,7 @@ import { formatBytes } from '../format.js';
 export { formatBytes };
 import * as path from 'path';
 import { getBrowserRuntimeDir, getProfileRuntimeDir } from './profiles.js';
+import { listProfileCacheDirs } from './runtime-state.js';
 import { formatRelativeTime } from '../session/relative-time.js';
 import { getSessionById, listBrowserSessionRecords, pruneToolSessions } from '../session/db.js';
 import { listPidSessionEntries } from '../session/pid-registry.js';
@@ -99,7 +100,15 @@ export function listProfileArtifacts(profile) {
 export function listBrowserSessions(only) {
     let profiles;
     if (only) {
-        profiles = [only];
+        // A profile's live tasks/captures may live under a composite runtime dir
+        // (`<name>@<device>`, `<name>@endpoint-N`, forks) — NOT the bare `<name>`
+        // dir. Resolve `only` to every cache dir that belongs to it, the same rule
+        // status()/findTask use (keyBelongsToProfile), so `--profile comet-local`
+        // surfaces the real `comet-local@zion` store instead of the empty legacy
+        // dir. Keep the requested name when nothing exists on disk yet so a fresh
+        // profile still returns its (empty) entry rather than vanishing.
+        const dirs = listProfileCacheDirs(only).map((d) => path.basename(d));
+        profiles = dirs.length > 0 ? dirs : [only];
     }
     else {
         try {

package/dist/lib/daemon/runner.d.ts

@@ -113,6 +113,8 @@ export interface RoutineLaunchPlan {
     /** False when `account` names a harness-native login rather than a durable credential. */
     forwardAccount?: boolean;
 }
+/** Claude's own local auth check; unlike account metadata it cannot mistake identity for a usable login. */
+export declare function claudeVersionIsAuthenticated(version: string): boolean;
 /**
  * Resolve the version/account chain for a routine the same way `agents run`
  * does: honor an explicit `version:` pin; otherwise use the configured run
@@ -130,6 +132,7 @@ export declare function resolveRoutineLaunch(config: JobConfig, cwd?: string, de
     resolveCredentialAccount?: (name: string, host: AgentId) => {
         env: Record<string, string>;
     };
+    claudeVersionIsAuthenticated?: typeof claudeVersionIsAuthenticated;
 }): Promise<RoutineLaunchPlan>;
 /**
  * Rewrite `cmd[0]` to the absolute binary for `agent@version` when installed.

package/dist/lib/daemon/runner.js

@@ -21,7 +21,7 @@ import { getCliLaunch, getAgentsBinDir } from '../cli-entry.js';
 import { resolveJobPrompt, parseTimeout, writeRunMeta, listRuns, getJobRunsDir, getRunDir, checkJobDeviceEligibility, finalizeRunMeta, resolveJobExecutionContext, slotRunId, claimRunSlot, readRunMeta, resolveHostStrategy, } from '../scheduling/routines.js';
 import { getRunsDir, getUserAgentsDir, readMeta, getDaemonDir } from '../state.js';
 import { shortCodexHome } from '../codex-home.js';
-import { prepareJobHome, buildSpawnEnv, getJobHomePath, assertSandboxForwardsHostGhAuth } from '../sandbox.js';
+import { prepareJobHome, buildSpawnEnv, getJobHomePath, assertSandboxForwardsHostGhAuth, linkVersionAuth } from '../sandbox.js';
 import { resolveModel, buildReasoningFlags } from '../models.js';
 import { createTimer, redactPrompt, emitRoutineEnd } from '../feed/events.js';
 import { resolveHarnessAdapter } from '../harness/index.js';
@@ -37,8 +37,6 @@ import { walkForFiles } from '../fs-walk.js';
 import { getBinaryPath, isVersionInstalled, resolveVersion, getVersionHomePath } from '../installations/versions.js';
 import { resolveClaudeSetupToken } from '../claude-account-token.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, } from '../accounting/rotate.js';
-import { readAuthHealth, isDeadVerdict } from '../auth-health.js';
-import { machineId } from '../machine-id.js';
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from '../device-config.js';
 import { isSelfUpdatingAgent, ROUTINE_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../agents.js';
 import { isCustomHarnessName, readProfile } from '../profiles.js';
@@ -860,6 +858,27 @@ function readCommandExitCode(runDir) {
         return null;
     }
 }
+/** Claude's own local auth check; unlike account metadata it cannot mistake identity for a usable login. */
+export function claudeVersionIsAuthenticated(version) {
+    if (!isVersionInstalled('claude', version))
+        return true; // synthetic/unit plans are validated at spawn
+    const binary = getBinaryPath('claude', version);
+    if (!binary)
+        return false;
+    const home = getVersionHomePath('claude', version);
+    try {
+        const raw = execFileSync(binary, ['auth', 'status', '--json'], {
+            encoding: 'utf8',
+            timeout: 5_000,
+            env: { ...process.env, HOME: process.env.AGENTS_REAL_HOME || os.homedir(), CLAUDE_CONFIG_DIR: path.join(home, '.claude') },
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return JSON.parse(raw).loggedIn === true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Resolve the version/account chain for a routine the same way `agents run`
  * does: honor an explicit `version:` pin; otherwise use the configured run
@@ -890,7 +909,7 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
         : false;
     const selectedCredential = config.account
         ? (explicitCredential ? config.account : undefined)
-        : resolveAccountSelection(undefined, agent, meta);
+        : resolveAccountSelection(undefined, agent, meta)?.id;
     if (selectedCredential) {
         // A default/binding may resolve to a native account — never route that
         // through the provider credential path (it has no bundle to resolve).
@@ -980,6 +999,24 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
     if (!version) {
         version = resolveVersion(agent, cwd) ?? undefined;
     }
+    if (agent === 'claude' && version) {
+        const checkClaudeAuth = deps.claudeVersionIsAuthenticated ?? claudeVersionIsAuthenticated;
+        const authenticatedHealthy = rotation?.healthy.filter((candidate) => checkClaudeAuth(candidate.version));
+        const authenticated = authenticatedHealthy?.find((candidate) => candidate.version === version) ?? authenticatedHealthy?.[0];
+        if (rotation && (!authenticated || authenticatedHealthy.length === 0)) {
+            throw new Error(`Routine '${config.name}' found no authenticated Claude account; run \`claude /login\` for an installed version or pin a provider profile.`);
+        }
+        if (!rotation && !checkClaudeAuth(version)) {
+            throw new Error(`Routine '${config.name}' found no authenticated Claude account at claude@${version}; run \`claude /login\` for that version or remove the pin.`);
+        }
+        if (rotation && authenticated) {
+            const rejected = rotation.healthy.filter((candidate) => !authenticatedHealthy.includes(candidate));
+            if (rejected.length > 0 || rotation.picked !== authenticated) {
+                rotation = { ...rotation, picked: authenticated, healthy: authenticatedHealthy, excluded: [...rotation.excluded, ...rejected] };
+            }
+            version = authenticated.version;
+        }
+    }
     if (!version) {
         process.stderr.write(`[agents] routine ${config.name}: no version of ${agent} configured — ` +
             `run: agents add ${agent}@<version> && agents use ${agent} <version>\n`);
@@ -1143,6 +1180,10 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone, overlayH
         // to the overlay so an ambient value cannot bypass the routine sandbox.
         out.XDG_CONFIG_HOME = path.join(overlayHome, '.config');
     }
+    if (overlayHome && agent === 'claude')
+        out.HOME = process.env.AGENTS_REAL_HOME || os.homedir();
+    if (overlayHome && agent === 'codex')
+        out.CODEX_HOME = path.join(overlayHome, '.codex');
     if (timezone)
         out.TZ = timezone;
     return out;
@@ -1304,7 +1345,7 @@ async function executeJobPlaced(config, deps, attempt) {
     // sentinel, version homes) from HOME, which the overlay would hide. Exec
     // still isolates the run in the host version home it swaps HOME into.
     const useSandbox = config.sandbox !== false && !config.resume && !(config.agent && isCustomHarnessName(config.agent));
-    const overlayHome = useSandbox ? prepareJobHome(config) : undefined;
+    const overlayHome = useSandbox ? prepareJobHome(config, primaryVersion) : undefined;
     const runId = attempt.runId;
     const runDir = getRunDir(config.name, runId);
     fs.mkdirSync(runDir, { recursive: true });
@@ -1329,7 +1370,7 @@ async function executeJobPlaced(config, deps, attempt) {
     if (!dispatchesViaAgentsRun(config)) {
         const { findUnifiedAccount, resolveAccountSelection, resolveCredentialAccount } = await import('../account-registry.js');
         const meta = readMeta();
-        const selectedAccount = resolveAccountSelection(config.account, effectiveAgent, meta);
+        const selectedAccount = resolveAccountSelection(config.account, effectiveAgent, meta)?.id;
         if (selectedAccount) {
             // Only a provider account injects env; a native account (explicit or via a
             // device-scoped binding) is read from the harness home and forwards nothing.
@@ -1360,24 +1401,24 @@ async function executeJobPlaced(config, deps, attempt) {
     // Baseline the child's transcript dirs BEFORE spawning so archiveRoutineTranscripts
     // copies only THIS run's transcript out of a shared per-version home (RUSH-2271).
     snapshotRoutineTranscriptBase(meta, runDir, overlayHome);
-    // Auth preflight: if the last live probe rejected this (agent, version)'s
-    // token (verdict `revoked`), the run is guaranteed to fail auth — fail fast
-    // before spawning instead of producing a doomed run + poisoned report. Cache-
-    // only (the daemon refreshes it periodically); fail OPEN on any non-revoked or
-    // missing verdict so a stale/absent probe or a network blip never blocks a
-    // run, and agents with no live probe (codex/gemini/grok) are never blocked.
+    // Auth preflight: if the resolved account is provably signed out (revoked or
+    // unconfigured), record a terminal `blocked`/`agent_auth_failed` run with the
+    // re-login repair instead of spawning a doomed run that 401s and burns a
+    // session (PHNX-3415). `blocked` (readiness rejection, no body ran) is kept
+    // distinct from `failed` (a body ran and errored) per RT-7. Cache-only + fails
+    // OPEN — see fireTimeAuthReadiness.
     const preflightVersion = launch.chain[0]?.version;
-    if (preflightVersion) {
-        const health = readAuthHealth(machineId(), effectiveAgent, preflightVersion);
-        if (health && isDeadVerdict(health.verdict)) {
-            const reason = `auth_preflight: ${health.verdict}`;
-            process.stderr.write(`[agents] routine ${config.name}: ${effectiveAgent}@${preflightVersion} token ${health.verdict} — skipping run (re-login required)\n`);
-            finalizeRunMeta(meta, 'failed', 1, { errorMessage: reason });
-            writeRunMeta(meta);
-            timer.end({ status: 'failed', exitCode: 1, runId, error: reason });
-            archiveRoutineTranscripts(meta, runDir, overlayHome);
-            return { meta, reportPath: null };
-        }
+    // Dynamic import breaks the routine-readiness -> scheduling/routines -> runner cycle.
+    const { fireTimeAuthReadiness } = await import('../routine-readiness.js');
+    const authBlocker = preflightVersion ? fireTimeAuthReadiness(effectiveAgent, preflightVersion) : null;
+    if (authBlocker) {
+        process.stderr.write(`[agents] routine ${config.name}: ${effectiveAgent}@${preflightVersion} ${authBlocker.code} — skipping run (${authBlocker.repair})\n`);
+        meta.readiness = authBlocker;
+        finalizeRunMeta(meta, 'blocked', null, { errorMessage: `blocked: ${authBlocker.code} — ${authBlocker.message}` });
+        writeRunMeta(meta);
+        timer.end({ status: 'blocked', runId, error: authBlocker.code });
+        archiveRoutineTranscripts(meta, runDir, overlayHome);
+        return { meta, reportPath: null };
     }
     const timeoutMs = parseTimeout(config.timeout) || 10 * 60 * 1000;
     // Loop path: delegate to runLoop (same driver as `agents run --loop` / workflow loop:).
@@ -1444,6 +1485,8 @@ async function executeJobPlaced(config, deps, attempt) {
         meta.version = attemptVersion;
         snapshotRoutineTranscriptBase(meta, runDir, overlayHome);
         const viaAgentsRun = dispatchesViaAgentsRun(config);
+        if (overlayHome)
+            linkVersionAuth(overlayHome, attemptAgent, attemptVersion);
         const cmd = viaAgentsRun
             ? baseCmd
             : pinJobBinary(baseCmd, attemptAgent, attemptVersion);
@@ -1837,7 +1880,7 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
     // sentinel, version homes) from HOME, which the overlay would hide. Exec
     // still isolates the run in the host version home it swaps HOME into.
     const useSandbox = config.sandbox !== false && !config.resume && !(config.agent && isCustomHarnessName(config.agent));
-    const overlayHome = useSandbox ? prepareJobHome(config) : undefined;
+    const overlayHome = useSandbox ? prepareJobHome(config, version) : undefined;
     const runId = attempt.runId;
     const runDir = getRunDir(config.name, runId);
     fs.mkdirSync(runDir, { recursive: true });
@@ -1850,7 +1893,7 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
         const { findAccount, resolveAccountSelection, resolveCredentialAccount } = await import('../account-registry.js');
         const selectedAccount = config.account && !findAccount(config.account)
             ? undefined
-            : resolveAccountSelection(config.account, config.agent, readMeta());
+            : resolveAccountSelection(config.account, config.agent, readMeta())?.id;
         if (selectedAccount)
             Object.assign(baseEnv, resolveCredentialAccount(selectedAccount, config.agent).env);
     }
@@ -1891,28 +1934,26 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
     // Baseline the child's transcript dirs BEFORE spawning so archiveRoutineTranscripts
     // copies only THIS run's transcript out of a shared per-version home (RUSH-2271).
     snapshotRoutineTranscriptBase(meta, runDir, overlayHome);
-    // Auth preflight (mirrors executeJob): with no injected token, a daemon-fired
-    // Claude routine authenticates via the pinned account's own CLAUDE_CONFIG_DIR
-    // login. If the last live probe rejected that (agent, version)'s token, the run
-    // is guaranteed to 401 — fail fast with a re-login hint instead of spawning a
-    // doomed run + poisoned report. Cache-only; fails OPEN on any non-dead/missing
-    // verdict, and agents with no live probe (codex/gemini/grok) are never blocked.
+    // Auth preflight (mirrors executeJob): a provably signed-out resolved account
+    // records a terminal `blocked`/`agent_auth_failed` run with the re-login repair
+    // instead of spawning a doomed run that 401s and burns a session (PHNX-3415).
+    // Cache-only + fails OPEN — see fireTimeAuthReadiness.
     const preflightVersion = launch.chain[0]?.version;
-    if (preflightVersion) {
-        const health = readAuthHealth(machineId(), effectiveAgent, preflightVersion);
-        if (health && isDeadVerdict(health.verdict)) {
-            const reason = `auth_preflight: ${health.verdict}`;
-            process.stderr.write(`[agents] routine ${config.name}: ${effectiveAgent}@${preflightVersion} token ${health.verdict} — skipping run (re-login required)\n`);
-            try {
-                fs.closeSync(stdoutFd);
-            }
-            catch { /* already closed */ }
-            finalizeRunMeta(meta, 'failed', 1, { errorMessage: reason });
-            writeRunMeta(meta);
-            archiveRoutineTranscripts(meta, runDir, overlayHome);
-            timer.end({ status: 'failed', exitCode: 1, runId, error: reason });
-            return meta;
+    // Dynamic import breaks the routine-readiness -> scheduling/routines -> runner cycle.
+    const { fireTimeAuthReadiness } = await import('../routine-readiness.js');
+    const authBlocker = preflightVersion ? fireTimeAuthReadiness(effectiveAgent, preflightVersion) : null;
+    if (authBlocker) {
+        process.stderr.write(`[agents] routine ${config.name}: ${effectiveAgent}@${preflightVersion} ${authBlocker.code} — skipping run (${authBlocker.repair})\n`);
+        try {
+            fs.closeSync(stdoutFd);
         }
+        catch { /* already closed */ }
+        meta.readiness = authBlocker;
+        finalizeRunMeta(meta, 'blocked', null, { errorMessage: `blocked: ${authBlocker.code} — ${authBlocker.message}` });
+        writeRunMeta(meta);
+        archiveRoutineTranscripts(meta, runDir, overlayHome);
+        timer.end({ status: 'blocked', runId, error: authBlocker.code });
+        return meta;
     }
     const child = spawn(cmd[0], cmd.slice(1), {
         stdio: ['ignore', stdoutFd, stdoutFd],

package/dist/lib/daemon/usage-sync-service.d.ts

@@ -2,9 +2,9 @@
  * Fleet usage-snapshot sync as a `PeriodicService` (PHNX-3392 usage-sync).
  *
  * On a headed box (personal/desktop) each tick pushes the local identity-keyed
- * Claude usage rows to worker peers that cannot read usage themselves. A no-op on
- * a worker/unmarked box or when the local cache is empty — the driver
- * ({@link syncFleetUsageSnapshots}) gates on the self role, so this service is
+ * Claude usage rows to worker peers that cannot read usage themselves. On a
+ * worker whose cache is empty or stale, the same tick pulls those rows from the
+ * primary headed device. Both drivers gate on the self role, so this service is
  * safe to register everywhere. Single-executor per destination: each daemon only
  * writes the DESTINATION's own cache, and the merge is newest-wins + idempotent.
  */

package/dist/lib/daemon/usage-sync-service.js

@@ -2,9 +2,9 @@
  * Fleet usage-snapshot sync as a `PeriodicService` (PHNX-3392 usage-sync).
  *
  * On a headed box (personal/desktop) each tick pushes the local identity-keyed
- * Claude usage rows to worker peers that cannot read usage themselves. A no-op on
- * a worker/unmarked box or when the local cache is empty — the driver
- * ({@link syncFleetUsageSnapshots}) gates on the self role, so this service is
+ * Claude usage rows to worker peers that cannot read usage themselves. On a
+ * worker whose cache is empty or stale, the same tick pulls those rows from the
+ * primary headed device. Both drivers gate on the self role, so this service is
  * safe to register everywhere. Single-executor per destination: each daemon only
  * writes the DESTINATION's own cache, and the merge is newest-wins + idempotent.
  */
@@ -24,13 +24,19 @@ export class UsageSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { syncFleetUsageSnapshots } = await import('../accounting/usage-sync.js');
-        const result = syncFleetUsageSnapshots();
-        if (result.pushed.length > 0) {
-            ctx.log('INFO', `usage-sync: pushed usage to ${result.pushed.join(', ')}`);
+        const { pullUsageFromPrimary, syncFleetUsageSnapshots } = await import('../accounting/usage-sync.js');
+        const pushResult = syncFleetUsageSnapshots();
+        if (pushResult.pushed.length > 0) {
+            ctx.log('INFO', `usage-sync: pushed usage to ${pushResult.pushed.join(', ')}`);
         }
-        for (const err of result.errors) {
+        for (const err of pushResult.errors) {
             ctx.log('WARN', `usage-sync: ${err.device}: ${err.message}`);
         }
+        const pullResult = pullUsageFromPrimary();
+        if (pullResult.pulledFrom) {
+            ctx.log('INFO', `usage-sync: pulled usage from ${pullResult.pulledFrom}; merged ${pullResult.merged} row(s)`);
+        }
+        if (pullResult.error)
+            ctx.log('WARN', `usage-sync: pull: ${pullResult.error}`);
     }
 }

package/dist/lib/daemon-services.js

@@ -100,7 +100,7 @@ export const DAEMON_SERVICES = [
     {
         id: 'usage-sync',
         title: 'Usage snapshot sync',
-        description: 'From a personal/desktop box, pushes the per-account usage snapshot to worker peers that cannot read it themselves.',
+        description: 'Bidirectional per-account usage sync: a headed personal/desktop box pushes its snapshot to worker peers, and a worker with a stale cache pulls from the primary — so workers that cannot read the endpoint themselves still route by real capacity.',
     },
 ];
 /** Stable order of service IDs. */

package/dist/lib/devices/connect.d.ts

@@ -47,16 +47,25 @@ export declare function wrapRemoteCommand(device: DeviceProfile, cmd: string[]):
  */
 export declare function isAgentsBrowserDrive(cmd: string[]): boolean;
 /**
- * Prefix a remote command so the far side sees `AGENTS_FLEET_REMOTE=1` — the
- * marker the browser consent gate reads. `wrapRemoteCommand` joins the argv
- * with spaces (POSIX) or base64-encodes it for PowerShell, so a
- * shell-appropriate leading token rides through both: `env VAR=1 …` on POSIX,
- * `$env:VAR='1'; …` on PowerShell.
+ * Prefix a remote command with the provenance the far-side browser needs: the
+ * `AGENTS_FLEET_REMOTE=1` consent marker AND the caller's resolved actor
+ * (`AGENTS_ACTOR*`/`GIT_*`). Without the actor, a task created over
+ * `agents ssh <host> 'agents browser …'` is stamped `UNRESOLVED@<host>` because
+ * the peer re-resolves identity from its own (empty) env — the same RUSH-2028
+ * gap the `--device` dispatch already closes via `withActorEnv`, applied here to
+ * the `agents ssh` browser-drive seam so ownership is honest across BOTH paths.
  *
- * Already-marked argv (the `--device` fan-out stamps this before
- * {@link buildSshInvocation}) is left unchanged so the prefix is not doubled.
+ * `wrapRemoteCommand` joins the argv with spaces (POSIX) or base64-encodes it for
+ * PowerShell, so a shell-appropriate prelude rides through both: `env VAR=v …` on
+ * POSIX, `$env:VAR='v'; …` on PowerShell. The marker stays the FIRST token so the
+ * consent gate and the idempotency guard below both still key on it.
+ *
+ * `provenanceEnv` is injectable so tests can pin a deterministic actor; it
+ * defaults to the live resolved actor. Already-marked argv (the `--device`
+ * fan-out stamps the marker before {@link buildSshInvocation}) is left unchanged
+ * so nothing is doubled.
  */
-export declare function markFleetRemote(cmd: string[], device: Pick<DeviceProfile, 'shell'>): string[];
+export declare function markFleetRemote(cmd: string[], device: Pick<DeviceProfile, 'shell'>, provenanceEnv?: Record<string, string>): string[];
 /**
  * Build the remote command that starts an INTERACTIVE LOGIN shell inside a
  * mirrored project directory, falling back to the remote home when that

package/dist/lib/devices/connect.js

@@ -16,6 +16,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { assertValidSshTarget, shellQuote } from '../ssh-exec.js';
+import { resolveActor, actorEnv } from '../actor.js';
 import { getCliLaunch } from '../cli-entry.js';
 import { encodePwshBase64 } from '../pwsh.js';
 import { homeRemainder, remoteCdPrefix } from '../project-root.js';
@@ -104,24 +105,40 @@ export function isAgentsBrowserDrive(cmd) {
     return (bin === 'agents' || bin === 'ag') && tokens[1] === 'browser';
 }
 /**
- * Prefix a remote command so the far side sees `AGENTS_FLEET_REMOTE=1` — the
- * marker the browser consent gate reads. `wrapRemoteCommand` joins the argv
- * with spaces (POSIX) or base64-encodes it for PowerShell, so a
- * shell-appropriate leading token rides through both: `env VAR=1 …` on POSIX,
- * `$env:VAR='1'; …` on PowerShell.
+ * Prefix a remote command with the provenance the far-side browser needs: the
+ * `AGENTS_FLEET_REMOTE=1` consent marker AND the caller's resolved actor
+ * (`AGENTS_ACTOR*`/`GIT_*`). Without the actor, a task created over
+ * `agents ssh <host> 'agents browser …'` is stamped `UNRESOLVED@<host>` because
+ * the peer re-resolves identity from its own (empty) env — the same RUSH-2028
+ * gap the `--device` dispatch already closes via `withActorEnv`, applied here to
+ * the `agents ssh` browser-drive seam so ownership is honest across BOTH paths.
  *
- * Already-marked argv (the `--device` fan-out stamps this before
- * {@link buildSshInvocation}) is left unchanged so the prefix is not doubled.
+ * `wrapRemoteCommand` joins the argv with spaces (POSIX) or base64-encodes it for
+ * PowerShell, so a shell-appropriate prelude rides through both: `env VAR=v …` on
+ * POSIX, `$env:VAR='v'; …` on PowerShell. The marker stays the FIRST token so the
+ * consent gate and the idempotency guard below both still key on it.
+ *
+ * `provenanceEnv` is injectable so tests can pin a deterministic actor; it
+ * defaults to the live resolved actor. Already-marked argv (the `--device`
+ * fan-out stamps the marker before {@link buildSshInvocation}) is left unchanged
+ * so nothing is doubled.
  */
-export function markFleetRemote(cmd, device) {
+export function markFleetRemote(cmd, device, provenanceEnv = actorEnv(resolveActor())) {
     if (device.shell === 'powershell') {
-        return cmd[0] === `$env:AGENTS_FLEET_REMOTE='1';`
-            ? cmd
-            : [`$env:AGENTS_FLEET_REMOTE='1';`, ...cmd];
+        // Exact-match guard, symmetric with the POSIX branch below: the marker token
+        // is always this literal, so `startsWith` would only loosen it for no gain.
+        if (cmd[0] === `$env:AGENTS_FLEET_REMOTE='1';`)
+            return cmd;
+        const prelude = [
+            `$env:AGENTS_FLEET_REMOTE='1';`,
+            ...Object.entries(provenanceEnv).map(([k, v]) => `$env:${k}='${v.replace(/'/g, "''")}';`),
+        ];
+        return [...prelude, ...cmd];
     }
-    return cmd[0] === 'env' && cmd[1] === 'AGENTS_FLEET_REMOTE=1'
-        ? cmd
-        : ['env', 'AGENTS_FLEET_REMOTE=1', ...cmd];
+    if (cmd[0] === 'env' && cmd[1] === 'AGENTS_FLEET_REMOTE=1')
+        return cmd;
+    const actorTokens = Object.entries(provenanceEnv).map(([k, v]) => shellQuote(`${k}=${v}`));
+    return ['env', 'AGENTS_FLEET_REMOTE=1', ...actorTokens, ...cmd];
 }
 /**
  * Build the remote command that starts an INTERACTIVE LOGIN shell inside a