@phnx-labs/agents-cli 1.22.58 → 1.22.60

package/dist/commands/sessions.js

@@ -55,7 +55,7 @@ import { listInstalledVersions, resolveVersionAliasLoose } from '../lib/installa
 import { getAgentsInvocation } from '../lib/daemon/daemon.js';
 import { sessionRecoveryRunArgs } from '../lib/session/recovery.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-import { sessionPicker, buildPreview, loadSessionPreviewDigest, formatTodoCompact, githubRepoUrlFromCwd, } from './sessions-picker.js';
+import { sessionPicker, buildPreview, loadSessionPreviewDigest, transcriptOnPeerOf, formatTodoCompact, githubRepoUrlFromCwd, } from './sessions-picker.js';
 import { setHelpSections } from '../lib/help.js';
 import { registerSessionsTailCommand } from './sessions-tail.js';
 import { registerSessionsResumeCommand } from './sessions-resume.js';
@@ -2017,13 +2017,14 @@ export async function renderSessionPreview(query, scope) {
         return;
     }
     const session = outcome.session;
-    if (session._remote && session.machine && session.machine !== machineId()) {
+    const transcriptPeer = transcriptOnPeerOf(session);
+    if (transcriptPeer) {
         const args = ['sessions', 'preview', session.id, '--local'];
         if (scope.json)
             args.push('--json');
-        const rendered = await runOnPeer(args, session.machine);
+        const rendered = await runOnPeer(args, transcriptPeer);
         if (rendered === 'no-target') {
-            console.error(chalk.red(`Session ${session.id} is on ${session.machine}, but that device is not reachable.`));
+            console.error(chalk.red(`Session ${session.id} is on ${transcriptPeer}, but that device is not reachable.`));
             process.exitCode = 1;
         }
         return;
@@ -2316,9 +2317,16 @@ limitSource) {
         return;
     }
     // --device / --devices values are merged into options.host for internal routing. A bare `all` / `fleet` sentinel means
-    // "search every peer" — which is already the default — so it resolves to no
-    // explicit host set rather than erroring on a device literally named "all".
-    const deviceTargets = [...(options.device ?? []), ...(options.devices ?? [])]
+    // "search every peer" — which is already the default for `--active` and the
+    // interactive listing — so it resolves to no explicit host set rather than
+    // erroring on a device literally named "all".
+    const rawDeviceTargets = [...(options.device ?? []), ...(options.devices ?? [])];
+    // But the HISTORICAL `--json` listing does NOT fan out by default (it stays a
+    // deterministic local slice for scripts), so the sentinel would otherwise be
+    // silently dropped and the fleet never reached (PHNX-2673). Remember it so that
+    // path can sweep every peer, exactly as the interactive listing already does.
+    const fleetWide = rawDeviceTargets.some(t => t.toLowerCase() === 'all' || t.toLowerCase() === 'fleet');
+    const deviceTargets = rawDeviceTargets
         .filter(t => t.toLowerCase() !== 'all' && t.toLowerCase() !== 'fleet');
     if (deviceTargets.length > 0) {
         options.host = [...(options.host ?? []), ...deviceTargets];
@@ -2775,16 +2783,43 @@ limitSource) {
             // each peer) would fall to FTS content search and return every transcript
             // that merely MENTIONS the id, defeating exact remote resolution. A genuine
             // search phrase keeps the ranked metadata+content path.
-            const filtered = searchQuery
+            let filtered = searchQuery
                 ? resolveSessionQuery(sessions, searchQuery, {
                     scope: { agent: options.agent, project: options.project, routine: options.routine },
                 }).matches
                 : sessions;
+            // `--device all`/`--fleet` on a historical `--json` query fans out to every
+            // peer and merges their rows in — the SAME SSH sweep the interactive listing
+            // below uses, and the whole-fleet twin of the explicit `--device <host>
+            // --json` path (`runRemoteSessionsJson`). Without this the documented
+            // "search the whole fleet" flag returned local rows only (PHNX-2673). Guarded
+            // to the sentinel so a bare `--json` stays a deterministic local slice for
+            // scripts, and skipped under `--local`/the peer recursion guard. Dead peers
+            // are skipped by the fan-out, never fatal — enrichment, not a dependency.
+            const forceLocalJson = options.local === true || process.env[NO_FANOUT_ENV] === '1';
+            if (fleetWide && !forceLocalJson) {
+                const forwarded = ensureWholeIndex(buildForwardedArgs(process.argv, new Set(options.host ?? [])));
+                if (!forwarded.includes('--json'))
+                    forwarded.push('--json');
+                const fanSpinner = isInteractiveTerminal() ? ora('Reaching other machines...').start() : null;
+                try {
+                    const { sessions: remoteSessions } = await gatherRemoteList(forwarded, undefined);
+                    if (remoteSessions.length > 0) {
+                        filtered = mergeLocalFirst([...filtered, ...remoteSessions], machineId());
+                    }
+                }
+                catch {
+                    // fan-out is an enrichment, never a hard dependency
+                }
+                finally {
+                    fanSpinner?.stop();
+                }
+            }
             // JSON is the canonical picker contract: enrich the durable rows once
             // from the shared live cache so every consumer gets lifecycle/recovery
             // metadata without performing its own join or transcript scan.
             const live = await gatherActiveSessions({
-                local: options.local === true || process.env[NO_FANOUT_ENV] === '1',
+                local: forceLocalJson,
                 hosts: options.host,
             });
             process.stdout.write(serializeSessionsJson(serializeSessionPickerRows(filtered, live.sessions)));
@@ -3839,11 +3874,11 @@ export async function handlePickedSession(picked) {
     }
     // Reading and resuming are on DIFFERENT machines' terms, and conflating them
     // is what RUSH-2022 was. Reading follows the FILE: a synced mirror sits on
-    // this disk, so only a live fan-out row (`_remote`) has to be read on the
-    // peer. Resuming follows the HARNESS STATE, which is on the owning machine
-    // whatever the transcript's location — a mirror included.
+    // this disk, so a peer-owned row with no readable local transcript has to be
+    // read on the peer. Resuming follows the HARNESS STATE, which is on the
+    // owning machine whatever the transcript's location — a mirror included.
     if (picked.action === 'view') {
-        const readFrom = picked.session._remote ? picked.session.machine : undefined;
+        const readFrom = transcriptOnPeerOf(picked.session);
         if (readFrom) {
             const rc = await runOnPeer(['sessions', picked.session.shortId, '--markdown'], readFrom);
             if (rc === 'no-target')
@@ -4469,7 +4504,8 @@ async function renderOneSession(query, mode, scope) {
         }
         if (outcome.kind === 'resolved') {
             const resolved = outcome.session;
-            if (resolved._remote && resolved.machine && resolved.machine !== machineId()) {
+            const transcriptPeer = transcriptOnPeerOf(resolved);
+            if (transcriptPeer) {
                 const args = ['sessions', resolved.id, '--local'];
                 const flag = modeFlag(mode);
                 if (flag)
@@ -4484,9 +4520,9 @@ async function renderOneSession(query, mode, scope) {
                     args.push('--last', String(scope.filter.last));
                 if (scope.redact === false)
                     args.push('--no-redact');
-                const rendered = await runOnPeer(args, resolved.machine);
+                const rendered = await runOnPeer(args, transcriptPeer);
                 if (rendered === 'no-target') {
-                    console.error(chalk.red(`Session ${resolved.id} is on ${resolved.machine}, but that device is not reachable.`));
+                    console.error(chalk.red(`Session ${resolved.id} is on ${transcriptPeer}, but that device is not reachable.`));
                     process.exit(1);
                 }
                 return;

package/dist/commands/ssh.js

@@ -130,7 +130,11 @@ function pctCell(v, width) {
  * header — which defeats the scannability this column exists for. */
 const SPEC_WIDTH_MIN = 12;
 /** The static hardware as one compact cell — `12c 64G 1T`: cores, total RAM,
- * total root disk via fmtBytes. `—` only when no probe has ever seen the box.
+ * total root disk via fmtBytes. `—` covers two cases: no probe has ever seen
+ * the box, or the probe answered but yielded no usable core count (`parseNcpu`
+ * finding none, or the Windows `ncpu` group failing the finite-and-positive
+ * check) — the cell is keyed on `ncpu` because a spec string without it would
+ * read as a machine with zero cores.
  *
  * Deliberately NOT gated on `reachable`: hardware does not change while a
  * machine is down, so an offline device keeps rendering the spec from its last
@@ -2298,6 +2302,13 @@ box; \`agents doctor\` names it.
 
 A box whose probe cannot answer (no POSIX shell, e.g. Windows) is reported
 \`unverified\` rather than counted as a success.
+
+The upgrade OWNS its global bin links: after installing, it verifies that
+\`<prefix>/bin/{agents,ag,browser,computer}\` resolve to the freshly-installed
+copy and RESTORES any the package manager dropped — the state that once left a
+box upgraded in place but with every \`agents\` invocation "command not found"
+(PHNX-2768). A link it cannot make resolve fails the upgrade loud, so that box
+is reported \`failed\` (exit non-zero), never a stranded \`ok\`.
 `)
         .action(async (version) => {
         let cmd;

package/dist/commands/teams-picker.js

@@ -9,6 +9,7 @@
 import chalk from 'chalk';
 import { relTime, truncate, humanDuration } from '../lib/format.js';
 import { itemPicker } from '../lib/picker.js';
+import { deliveryDisplayLabel, deliveryColorKey } from '../lib/teams/delivery.js';
 const AGENT_LABEL = {
     claude: 'Claude',
     codex: 'Codex',
@@ -21,6 +22,7 @@ function statusColor(status) {
         case 'pending': return chalk.blue;
         case 'running': return chalk.yellow;
         case 'completed': return chalk.green;
+        case 'stranded': return chalk.yellow;
         case 'failed': return chalk.red;
         case 'stopped': return chalk.gray;
         default: return chalk.white;
@@ -61,10 +63,12 @@ function displayAgent(agent, version) {
 function statusCell(t) {
     if (t.agent_count === 0)
         return chalk.gray('empty');
+    const done = Math.max(0, t.completed - (t.stranded ?? 0));
     const states = [
         [t.pending, chalk.blue, 'pending'],
         [t.running, chalk.yellow, 'working'],
-        [t.completed, chalk.green, 'done'],
+        [done, chalk.green, 'done'],
+        [t.stranded ?? 0, chalk.yellow, 'stranded'],
         [t.failed, chalk.red, 'failed'],
         [t.stopped, chalk.gray, 'stopped'],
     ];
@@ -76,13 +80,16 @@ function statusCell(t) {
     return nonzero.map(([n, color, label]) => color(`${n} ${label}`)).join(chalk.gray(' · '));
 }
 function statusSummaryParts(t) {
+    const done = Math.max(0, t.completed - (t.stranded ?? 0));
     const parts = [];
     if (t.pending)
         parts.push(chalk.blue(`${t.pending} pending`));
     if (t.running)
         parts.push(chalk.yellow(`${t.running} working`));
-    if (t.completed)
-        parts.push(chalk.green(`${t.completed} done`));
+    if (done)
+        parts.push(chalk.green(`${done} done`));
+    if (t.stranded)
+        parts.push(chalk.yellow(`${t.stranded} stranded`));
     if (t.failed)
         parts.push(chalk.red(`${t.failed} failed`));
     if (t.stopped)
@@ -173,7 +180,12 @@ export function buildTeamPreview(row) {
     const nameW = Math.max(6, ...row.agents.map((a) => displayHandle(a).length));
     const agentW = Math.max(8, ...row.agents.map((a) => displayAgent(a.agent_type, a.version).length));
     for (const a of row.agents) {
-        const stat = statusColor(a.status)(a.status);
+        const delivery = a.delivery;
+        const colorKey = delivery ? deliveryColorKey(delivery, a.status) : a.status;
+        const label = delivery
+            ? deliveryDisplayLabel(delivery, a.status)
+            : a.status.toUpperCase();
+        const stat = statusColor(colorKey)(label);
         const metaParts = [];
         if (a.task_type)
             metaParts.push(chalk.magenta(a.task_type));
@@ -244,8 +256,8 @@ function searchHaystack(row) {
         parts.push(a.status);
     }
     // Also include team-level status words exposed in the row ("done",
-    // "working", "pending", "failed", "stopped", "empty") so the search matches
-    // what the user sees on screen.
+    // "working", "pending", "stranded", "failed", "stopped", "empty") so the
+    // search matches what the user sees on screen.
     const t = row.team;
     if (t.agent_count === 0)
         parts.push('empty');
@@ -255,6 +267,8 @@ function searchHaystack(row) {
         parts.push('working', 'running');
     if (t.completed)
         parts.push('done', 'completed');
+    if (t.stranded)
+        parts.push('stranded');
     if (t.failed)
         parts.push('failed');
     if (t.stopped)

package/dist/commands/teams.d.ts

@@ -120,11 +120,11 @@ export declare function cloudDispatchOptions(agent: Pick<AgentProcess, 'prompt'
 export declare function runOneWave(mgr: AgentManager, team: string, json: boolean): Promise<void>;
 export declare function buildTeamRowsFromSnapshots(registry: TeamRegistry, agents: TeamListAgentSnapshot[], 
 /** team name -> the session that spawned it (see teamSpawners). */
-spawners?: Map<string, TeamSpawner>): {
+spawners?: Map<string, TeamSpawner>): Promise<{
     rows: TeamRow[];
     teams: TaskInfo[];
     names: string[];
-};
+}>;
 /**
  * `teams add --remote-cwd` is a no-op trap. `--remote-cwd` comes from the shared
  * `--device` option family (option.ts) and is meaningful for commands that *route*

package/dist/commands/teams.js

@@ -62,6 +62,7 @@ function statusColor(status) {
         case 'running': return chalk.yellow;
         case 'completed': return chalk.green;
         case 'pr_open': return chalk.magenta; // RUSH-2380: process done, PR not merged
+        case 'stranded': return chalk.yellow; // PHNX-2951: done but work not committed
         case 'failed': return chalk.red;
         case 'stopped': return chalk.gray;
         default: return chalk.white;
@@ -150,6 +151,7 @@ function snapshotToStatusDetail(agent) {
         after: agent.after,
         task_type: agent.task_type,
         host: agent.host,
+        workspace_dir: agent.workspace_dir,
     };
 }
 function fullName(type, version) {
@@ -784,6 +786,9 @@ function printAgentDetail(a, session) {
     }
     if (a.has_errors)
         console.log(`    ${chalk.red('! reported an error')}`);
+    if (delivery === 'stranded' && a.workspace_dir) {
+        console.log(`    ${chalk.yellow('! stranded')} uncommitted work at ${a.workspace_dir}`);
+    }
     if (a.pr_url)
         console.log(`    ${chalk.gray('PR  ')}${a.pr_url}`);
 }
@@ -864,17 +869,34 @@ function printAgentSummary(s) {
                 console.log(`      ${chalk.gray('>')} ${truncate(firstLine, 96)}`);
         }
     }
+    if (delivery === 'stranded' && s.workspace_dir) {
+        console.log(`    ${chalk.yellow('! stranded')} uncommitted work at ${s.workspace_dir}`);
+    }
     if (s.pr_url)
         console.log(`    ${chalk.gray('PR      ')} ${chalk.cyan(s.pr_url)}`);
 }
+function formatTeamStatusSummary(summary) {
+    const done = Math.max(0, summary.completed - summary.stranded);
+    const parts = [];
+    if (summary.pending > 0)
+        parts.push(`${summary.pending} pending`);
+    if (summary.running > 0 || parts.length === 0)
+        parts.push(`${summary.running} working`);
+    if (done > 0 || summary.stranded === 0)
+        parts.push(`${done} done`);
+    if (summary.stranded > 0)
+        parts.push(`${summary.stranded} stranded`);
+    if (summary.failed > 0 || parts.length === 0)
+        parts.push(`${summary.failed} failed`);
+    if (summary.stopped > 0 || parts.length === 0)
+        parts.push(`${summary.stopped} stopped`);
+    return `(${parts.join(', ')})`;
+}
 // Render a team's status in the same format the `status` subcommand uses, so
 // the interactive picker's Enter action drops the user into a familiar view.
 async function printTeamStatus(team, result) {
     const { summary, agents } = result;
-    console.log(chalk.bold(`Team ${chalk.cyan(team)}  `) +
-        chalk.gray(summary.pending > 0
-            ? `(${summary.pending} pending, ${summary.running} working, ${summary.completed} done, ${summary.failed} failed, ${summary.stopped} stopped)`
-            : `(${summary.running} working, ${summary.completed} done, ${summary.failed} failed, ${summary.stopped} stopped)`));
+    console.log(chalk.bold(`Team ${chalk.cyan(team)}  `) + chalk.gray(formatTeamStatusSummary(summary)));
     if (agents.length === 0) {
         console.log(chalk.gray('  (no teammates yet — add one with `agents teams add`)'));
     }
@@ -900,10 +922,7 @@ async function printTeamStatus(team, result) {
 // verbose/legacy layout.
 function printTeamSummary(team, result) {
     const { summary, agents } = result;
-    console.log(chalk.bold(`Team ${chalk.cyan(team)}  `) +
-        chalk.gray(summary.pending > 0
-            ? `(${summary.pending} pending, ${summary.running} working, ${summary.completed} done, ${summary.failed} failed, ${summary.stopped} stopped)`
-            : `(${summary.running} working, ${summary.completed} done, ${summary.failed} failed, ${summary.stopped} stopped)`));
+    console.log(chalk.bold(`Team ${chalk.cyan(team)}  `) + chalk.gray(formatTeamStatusSummary(summary)));
     if (agents.length === 0) {
         console.log(chalk.gray('  (no teammates yet — add one with `agents teams add`)'));
     }
@@ -925,12 +944,13 @@ function printTeamSummary(team, result) {
     console.log(chalk.gray('Raw log:     agents teams logs --team ' + team + ' --teammate <name>'));
 }
 // Classify a team into a single bucket for --status filtering.
-//  - empty:   no teammates (created but nobody added yet)
-//  - waiting: only staged teammates — call `teams start` to kick them off
-//  - working: at least one teammate still running
-//  - failed:  at least one teammate failed or was stopped (any failure wins —
-//             even if others finished, you want to know about the failure)
-//  - done:    everyone finished successfully, no failures
+//  - empty:    no teammates (created but nobody added yet)
+//  - waiting:  only staged teammates — call `teams start` to kick them off
+//  - working:  at least one teammate still running
+//  - failed:   at least one teammate failed or was stopped (any failure wins —
+//              even if others finished, you want to know about the failure)
+//  - stranded: everyone finished, but at least one has uncommitted work and no PR
+//  - done:     everyone finished successfully, no failures, no stranded work
 function classifyTeamStatus(t) {
     if (t.agent_count === 0)
         return 'empty';
@@ -943,6 +963,10 @@ function classifyTeamStatus(t) {
     const accounted = t.running + t.completed + t.failed + t.stopped;
     if (accounted < t.agent_count)
         return 'waiting';
+    // Completed-without-delivery is not "done": the work is still in the worktree
+    // and will be lost on cleanup (PHNX-2951).
+    if ((t.stranded ?? 0) > 0)
+        return 'stranded';
     return 'done';
 }
 // Merge persistent team registry with tasks derived from live agents so empty
@@ -959,6 +983,7 @@ function mergeTeams(registry, tasks) {
                 pending: 0,
                 running: 0,
                 completed: 0,
+                stranded: 0,
                 failed: 0,
                 stopped: 0,
                 workspace_dir: null,
@@ -969,7 +994,7 @@ function mergeTeams(registry, tasks) {
     }
     return Array.from(byName.values()).sort((a, b) => new Date(b.modified_at).getTime() - new Date(a.modified_at).getTime());
 }
-function buildTasksFromSnapshots(agents) {
+async function buildTasksFromSnapshots(agents) {
     const byTeam = new Map();
     for (const agent of agents) {
         const teamAgents = byTeam.get(agent.task_name) || [];
@@ -981,6 +1006,7 @@ function buildTasksFromSnapshots(agents) {
         let pending = 0;
         let running = 0;
         let completed = 0;
+        let stranded = 0;
         let failed = 0;
         let stopped = 0;
         let earliestStart = null;
@@ -998,6 +1024,16 @@ function buildTasksFromSnapshots(agents) {
                 failed++;
             else if (status === AgentStatus.STOPPED)
                 stopped++;
+            // Stranded = completed with no PR and a dirty local worktree (PHNX-2951).
+            if (status === AgentStatus.COMPLETED &&
+                !agent.pr_url?.trim() &&
+                !agent.host &&
+                agent.workspace_dir) {
+                const dirty = await hasUncommittedChanges(agent.workspace_dir);
+                if (dirty) {
+                    stranded++;
+                }
+            }
             const startedAt = parseTimestamp(agent.started_at);
             if (startedAt && (!earliestStart || startedAt < earliestStart)) {
                 earliestStart = startedAt;
@@ -1017,6 +1053,7 @@ function buildTasksFromSnapshots(agents) {
             pending,
             running,
             completed,
+            stranded,
             failed,
             stopped,
             workspace_dir: workspaceDir,
@@ -1026,7 +1063,7 @@ function buildTasksFromSnapshots(agents) {
     }
     return tasks.sort((a, b) => new Date(b.modified_at).getTime() - new Date(a.modified_at).getTime());
 }
-export function buildTeamRowsFromSnapshots(registry, agents, 
+export async function buildTeamRowsFromSnapshots(registry, agents, 
 /** team name -> the session that spawned it (see teamSpawners). */
 spawners) {
     const byTeam = new Map();
@@ -1035,7 +1072,26 @@ spawners) {
         details.push(snapshotToStatusDetail(agent));
         byTeam.set(agent.task_name, details);
     }
-    const teams = mergeTeams(registry, buildTasksFromSnapshots(agents));
+    const teams = mergeTeams(registry, await buildTasksFromSnapshots(agents));
+    // Recompute delivery for cached snapshots so `teams list` reflects stranded
+    // work discovered by probing the real worktree (PHNX-2951).
+    for (const details of byTeam.values()) {
+        for (const a of details) {
+            const snapshot = agents.find((s) => s.agent_id === a.agent_id);
+            if (snapshot &&
+                normalizeTeamListStatus(a.status) === AgentStatus.COMPLETED &&
+                !snapshot.pr_url?.trim() &&
+                !snapshot.host &&
+                snapshot.workspace_dir) {
+                const dirty = await hasUncommittedChanges(snapshot.workspace_dir);
+                a.delivery = resolveTeammateDelivery({
+                    status: a.status,
+                    prUrl: snapshot.pr_url,
+                    hasUncommittedChanges: dirty,
+                });
+            }
+        }
+    }
     return {
         teams,
         rows: teams.map((team) => ({
@@ -1107,7 +1163,7 @@ async function loadTeamRows(_mgr) {
     catch {
         // The index is an enrichment here — a missing/locked DB just drops the column.
     }
-    return buildTeamRowsFromSnapshots(registry, agents, spawners);
+    return await buildTeamRowsFromSnapshots(registry, agents, spawners);
 }
 // Picker fallback for `teams logs` when the teammate ref is omitted. Shows a
 // flat list of every teammate with their team context; Enter picks one.
@@ -1271,7 +1327,7 @@ export function registerTeamsCommands(program) {
         .alias('ls')
         .description('List your teams, most recent activity first')
         .option('-a, --agent <agent>', 'Filter: only teams with this agent (e.g. claude or claude@2.1.112)')
-        .option('--status <status>', 'Filter: only teams with this status (working, done, failed, or empty)')
+        .option('--status <status>', 'Filter: only teams with this status (working, done, stranded, failed, or empty)')
         .option('--since <time>', 'Filter: teams active after this time (e.g. "2h", "7d", or ISO date)')
         .option('--until <time>', 'Filter: teams active before this time (e.g. "30d", or ISO date)')
         .option('-n, --limit <n>', 'Show at most this many teams (default: 20)', '20')
@@ -1298,7 +1354,7 @@ export function registerTeamsCommands(program) {
         catch {
             // The session index is an enrichment here; a missing one drops the column.
         }
-        let rows = buildTeamRowsFromSnapshots(registry, everyAgent, spawners).rows;
+        let rows = (await buildTeamRowsFromSnapshots(registry, everyAgent, spawners)).rows;
         // --- query: substring match on team name ---
         if (query) {
             const q = query.toLowerCase();
@@ -1318,7 +1374,7 @@ export function registerTeamsCommands(program) {
         // --- --status: classify each team, filter ---
         if (opts.status) {
             const want = opts.status.toLowerCase();
-            const validStatuses = ['working', 'done', 'failed', 'empty'];
+            const validStatuses = ['working', 'done', 'stranded', 'failed', 'empty'];
             if (!validStatuses.includes(want)) {
                 dieFriction('teams', 'invalid-status-filter', `Invalid --status '${opts.status}'. Use one of: ${validStatuses.join(', ')}`);
             }

package/dist/commands/versions.js

@@ -11,7 +11,7 @@ import { installVersion, removeVersion, listInstalledVersions, isVersionInstalle
 import { carryForwardSettings } from '../lib/settings-manifest.js';
 import { createShim, createVersionedAlias, supportsIsolatedInstall, isIsolationProtected, CONFIG_ENV_ISOLATED_AGENTS, removeShim, shimExists, getShimsDir, getShimPath, getPathShadowingExecutable, isShimsInPath, getPathSetupInstructions, addShimsToPath, switchConfigSymlink, switchHomeFileSymlinks, } from '../lib/installations/shims.js';
 import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
-import { tryAutoPull } from '../lib/git.js';
+import { tryAutoPullSystemRepo } from '../lib/git.js';
 import { getAgentsDir, getTrashVersionsDir } from '../lib/state.js';
 import { setHelpSections } from '../lib/help.js';
 import { updateSessionFilePaths } from '../lib/session/db.js';
@@ -630,10 +630,18 @@ export function registerVersionsCommands(program) {
     useCmd.action(async (agentArg, versionArg, options) => {
         try {
             const skipPrompts = options.yes || !isInteractiveTerminal();
-            // Auto-pull ~/.agents/.system if it's a git repo with remote (silent on success)
+            // Auto-pull ~/.agents/.system if it's a git repo tracking the EXPECTED
+            // system remote (silent on success). The system repo ships hooks that run
+            // as shell on tool events, so pulling from a repointed origin would be
+            // remote code execution — tryAutoPullSystemRepo refuses that (PHNX-2957).
             const agentsDir = getAgentsDir();
-            const pullResult = await tryAutoPull(agentsDir);
-            if (pullResult.pulled) {
+            const pullResult = await tryAutoPullSystemRepo(agentsDir);
+            if (pullResult.refused) {
+                console.error(chalk.red(`Refusing to auto-sync ~/.agents/.system: its origin (${pullResult.actualRemote}) is not the expected system repo.`));
+                console.error(chalk.gray('The system repo ships hooks that run on tool events; a fast-forward from an unexpected origin is not applied. ' +
+                    'Re-point it (git -C ~/.agents/.system remote set-url origin <expected>) or set AGENTS_SYSTEM_REPO, then re-run `agents setup --force`.'));
+            }
+            else if (pullResult.pulled) {
                 console.log(chalk.gray('Synced ~/.agents/.system from remote'));
             }
             // Support both "claude 2.0.65" and "claude@2.0.65" formats

package/dist/commands/view.js

@@ -4,7 +4,7 @@ import { termLink } from '../lib/format.js';
 import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
-import { AGENTS, ALL_AGENT_IDS, accountDisplayLabel, getAllCliStates, getUnmanagedCliState, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
+import { AGENTS, ALL_AGENT_IDS, accountDisplayLabel, getAllCliStates, getUnmanagedCliState, getAccountInfo, credentialPresence, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
 import { ambientClaudeToken, loginHint } from '../lib/signin-badge.js';
 import { machineId } from '../lib/machine-id.js';
 import { authCacheKey, readAuthHealthCache } from '../lib/auth-health.js';
@@ -24,7 +24,7 @@ import { listNativeAccounts } from '../lib/account-registry.js';
 import { isGitRepo, getGitSyncStatus } from '../lib/git.js';
 import { getCentralRulesFileName } from '../lib/rules/rules.js';
 import { composeRulesFromState } from '../lib/rules/compose.js';
-import { getConfiguredRunStrategy } from '../lib/accounting/rotate.js';
+import { getConfiguredRunStrategy, isLaunchableSignedIn } from '../lib/accounting/rotate.js';
 import { resolveRunDefaults } from '../lib/run-defaults.js';
 import { resolveConfiguredModel } from '../lib/models.js';
 import { listProfiles, profileExists, profileSummary, readProfile } from '../lib/profiles.js';
@@ -1293,6 +1293,11 @@ export async function collectAgentsJson(filterAgentId, resourceSections, opts) {
             isolated: isVersionIsolated(agentId, version),
             isIsolatedDefault: getIsolatedDefault(agentId) === version,
             signedIn: info.signedIn,
+            // The strict per-version launch truth (vs the display `signedIn` above,
+            // which inherits the active/global HOME login). The same primitive
+            // `collectRunCandidates` uses locally, so remote `--device auto` placement
+            // is gated on identical launchability (PHNX-3466).
+            launchable: isLaunchableSignedIn(info.signedIn, credentialPresence(agentId, home)),
             authVerdict: authCache[authCacheKey(host, agentId, version)]?.verdict ?? null,
             email: info.email,
             accountId: info.accountId,

package/dist/lib/accounting/rotate.js

@@ -313,7 +313,7 @@ export function pickBalancedCandidate(candidates, nowMs = Date.now()) {
         if (!deduped.has(c))
             excluded.push(c);
     }
-    const { picked, usageUnverified } = preferVerified(sorted, nowMs, weightedRandomByCapacity, 'representative');
+    const { picked, usageUnverified } = preferVerified(sorted, nowMs, (from) => weightedRandomByCapacity(from, nowMs), 'representative');
     return { picked, healthy: sorted, excluded, usageUnverified };
 }
 /**
@@ -376,8 +376,16 @@ export { PROJECTION_HORIZON_MIN, capacityWeight };
  * routing capacity (see {@link capacityWeight}). Floor each weight at 1 so a
  * near-exhausted-but-still-eligible candidate can still be picked occasionally.
  */
-function weightedRandomByCapacity(sorted) {
-    const weights = sorted.map((c) => capacityWeight(getRoutingUsedPercent(c.usageSnapshot), c.usageMinutesToLimit));
+function weightedRandomByCapacity(sorted, nowMs = Date.now()) {
+    const weights = sorted.map((c) => capacityWeight(
+    // An unverified (stale or absent) snapshot carries no trustworthy number,
+    // so it weights as UNVERIFIED_WEIGHT (the floor) instead of by its frozen
+    // usedPercent. Otherwise a day-old "45% used" competes as if it were live
+    // headroom and can win the draw over a verified-healthy account — which is
+    // exactly how balanced launched into an account already at its weekly cap
+    // on a worker whose usage refresh had stalled (PHNX-3479). A verified
+    // snapshot keeps its real remaining-headroom weight.
+    isUsageVerified(c, nowMs) ? getRoutingUsedPercent(c.usageSnapshot) : null, c.usageMinutesToLimit));
     const total = weights.reduce((sum, w) => sum + w, 0);
     if (total <= 0)
         return sorted[0];
@@ -485,7 +493,7 @@ export function pickHarnessWeighted(byHarness, nowMs = Date.now()) {
     const excluded = summaries.filter((s) => s.best === null);
     if (healthy.length === 0)
         return null;
-    const pickedBest = weightedRandomByCapacity(healthy.map((s) => s.best));
+    const pickedBest = weightedRandomByCapacity(healthy.map((s) => s.best), nowMs);
     const picked = healthy.find((s) => s.best === pickedBest);
     return { picked, healthy, excluded };
 }

package/dist/lib/accounting/usage-sync.d.ts

@@ -1,9 +1,18 @@
 import { type DeviceProfile } from '../devices/registry.js';
 import { type ConfiguredDeviceRole } from '../device-config.js';
-import { type CachedUsageSnapshot, type UsageSnapshot } from './usage.js';
+import { type CachedUsageSnapshot } from './usage.js';
 /** How long a single peer push may take before it is abandoned for this tick. */
 export declare const USAGE_PUSH_DEADLINE_MS = 20000;
 export declare const USAGE_PULL_DEADLINE_MS = 20000;
+/**
+ * A worker's newest local usage row older than this triggers a pull from the
+ * primary. A worker cannot self-read usage (setup-token lacks `user:profile`,
+ * RUSH-2392), so its only source of a fresh row is the daemon push every
+ * `USAGE_SYNC_TICK_MS` (15m); this cutoff is 2× that tick, so one missed push
+ * cycle is tolerated before the worker actively pulls. Bounds worker staleness
+ * to ~30m instead of the days-old caches this replaces.
+ */
+export declare const USAGE_SYNC_MAX_AGE_MS: number;
 /** The stdin envelope the `__usage-ingest` verb reads. `v` guards the shape. */
 export interface UsageSyncPayload {
     v: 1;
@@ -75,8 +84,9 @@ export interface UsagePullDeps {
     listRoles?: () => Record<string, ConfiguredDeviceRole>;
     isPinned?: (name: string) => boolean;
     exportRows?: () => Record<string, CachedUsageSnapshot>;
-    readRow?: (usageKey: string) => Pick<UsageSnapshot, 'windows'> | null;
     ingestRows?: (rows: Record<string, CachedUsageSnapshot>) => number;
+    /** Injectable clock for the staleness gate; defaults to `Date.now`. */
+    now?: () => number;
     /** Read the versioned payload from the primary. Default: ssh `__usage-export`. */
     pull?: (device: DeviceProfile) => {
         ok: boolean;