@phnx-labs/agents-cli 1.22.65 → 1.22.66

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.22.66
+
+- **Fleet usage/auth sync now reaches FQDN-only-pinned workers (PHNX-3505).** The
+  usage-sync and reserved-auth-sync push/pull planners judged a peer "pinned" by its
+  bare device name, but a tailnet-discovered worker's host key is pinned under its
+  FQDN (`yosemite-m6.tail….ts.net`). So every worker not also pinned under its short
+  name was silently skipped — its `claude-usage.json` went days stale and `balanced`
+  routed into weekly-maxed accounts, and its auth token never propagated. The pin
+  check now resolves the same host string the ssh connection dials
+  (`isDevicePinned`), matching either form. Source:
+  `cli/src/lib/devices/known-hosts.ts`, `cli/src/lib/accounting/usage-sync.ts`,
+  `cli/src/lib/secrets/reserved-sync.ts`.
+
 ## 1.22.65
 
 - **`agents view` shows the last-known usage number with its age instead of hiding it (PHNX-3453).** When the usage endpoint 429-backs-off an account so a window is not refreshed within its own lifetime (Claude's 5h session window) or a billing period rolls over (Grok's weekly credit window), the view now renders the last reading with a staleness suffix — `S: █▌░░░ 30% · 6h old`, `W: ██▏░░ 42% · stale (period ended 1h ago)` — instead of `S: ┄┄┄┄┄ unavailable` or a numberless `run grok once to refresh usage`. The dropped windows ride a new VIEW-ONLY `UsageSnapshot.staleWindows` field; routing still reads only `windows`, so `isUsageVerified`/`hasStaleUsage`/`deriveUsageStatusFromSnapshot` continue to treat a stale/expired number as unverified and never route on it. Source: `cli/src/lib/accounting/usage.ts`.

package/dist/commands/apply.js

@@ -14,7 +14,7 @@ import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { loadDevices } from '../lib/devices/registry.js';
-import { isHostPinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
+import { isHostPinned, isDevicePinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired, emptyTargetsMessage } from '../lib/fleet/manifest.js';
 import { snapshotAuth } from '../lib/fleet/auth-sync.js';
@@ -233,7 +233,14 @@ async function runApply(opts) {
         provisionSecrets: opts.provisionSecrets === true,
         forceSecrets: opts.force === true,
         // Portable secret values only ever go to a host whose key is already pinned.
-        isHostPinned: (device) => isHostPinned(device, managedKnownHostsPath()),
+        // Resolve the device to its profile so the pin is checked against the FQDN the
+        // ssh connection dials (isDevicePinned), not the bare name — a tailnet worker
+        // pinned only under its FQDN would otherwise be refused as "not pinned"
+        // (PHNX-3505). A name with no profile falls back to the raw host-string check.
+        isHostPinned: (device) => {
+            const p = nameToProfile.get(device);
+            return p ? isDevicePinned(p) : isHostPinned(device, managedKnownHostsPath());
+        },
     });
     // --only filter.
     if (opts.only) {

package/dist/lib/accounting/usage-sync.js

@@ -29,7 +29,7 @@ import { buildRemoteAgentsInvocation, buildWindowsStdinAgentsCommand, remoteShel
 import { resolveRemoteOsSync } from '../hosts/remote-os.js';
 import { loadDevicesSync } from '../devices/registry.js';
 import { sshTargetFor } from '../devices/connect.js';
-import { isHostPinned } from '../devices/known-hosts.js';
+import { isHostPinned, isDevicePinned } from '../devices/known-hosts.js';
 import { machineId, normalizeHost } from '../session/sync/config.js';
 import { isHeadedDeviceRole, listConfiguredDeviceRoles, selfConfiguredDeviceRole, } from '../device-config.js';
 import { exportClaudeUsageCacheRows, ingestPeerClaudeUsageRows, } from './usage.js';
@@ -154,7 +154,7 @@ export function pullUsageFromPrimary(deps = {}) {
     const primary = devices
         .filter((device) => roles[device.name] === 'personal')
         .concat(devices.filter((device) => roles[device.name] === 'desktop'))
-        .find((device) => device.tailscale?.online !== false && isPinned(device.name));
+        .find((device) => device.tailscale?.online !== false && isDevicePinned(device, isPinned));
     if (!primary) {
         result.error = 'no reachable, pinned personal or desktop device is configured as the usage primary';
         return result;
@@ -205,7 +205,7 @@ export function syncFleetUsageSnapshots(deps = {}) {
         name: d.name,
         role: roles[d.name],
         online: d.tailscale?.online !== false,
-        pinned: isPinned(d.name),
+        pinned: isDevicePinned(d, isPinned),
     }));
     const rows = (deps.exportRows ?? exportClaudeUsageCacheRows)();
     const plan = planUsagePush(isHeadedDeviceRole(selfRole), Object.keys(rows).length > 0, targets);

package/dist/lib/devices/known-hosts.d.ts

@@ -1,3 +1,4 @@
+import type { DeviceProfile } from './registry.js';
 /** Path to the CLI-managed known_hosts store (created lazily, mode 0600). */
 export declare function managedKnownHostsPath(): string;
 /** Ensure the parent directory of the managed store exists (mode 0700). */
@@ -12,6 +13,20 @@ export declare function readManagedKnownHosts(file?: string): string;
 export declare function isHostPinnedIn(content: string, host: string): boolean;
 /** True if `host` is pinned in the managed store on disk. */
 export declare function isHostPinned(host: string, file?: string): boolean;
+/**
+ * True if a DEVICE's host key is pinned — checked against the SAME host string
+ * the ssh connection dials (`hostNameFor(device)`: the Tailscale dnsName/IP that
+ * `sshTargetFor` resolves), falling back to the bare device name.
+ *
+ * A device discovered over the tailnet is pinned under its FQDN
+ * (`yosemite-m6.tail….ts.net`), so a caller that checks the bare `device.name`
+ * misses the pin and wrongly treats a reachable, pinned peer as unpinned —
+ * silently excluding it from usage/auth fan-out while ssh to it would have
+ * succeeded (PHNX-3505). Accepting the bare name too keeps a device pinned only
+ * under its short name working. `isPinned` is injectable for tests; it defaults
+ * to the managed on-disk store.
+ */
+export declare function isDevicePinned(device: DeviceProfile, isPinned?: (host: string) => boolean): boolean;
 /**
  * The host-key-checking ssh options for a connection.
  *

package/dist/lib/devices/known-hosts.js

@@ -22,6 +22,7 @@ import { spawnSync } from 'child_process';
 import { getCacheDir } from '../state.js';
 import { assertValidSshTarget } from '../ssh-exec.js';
 import { parseKnownHosts } from '../hosts/ssh-config.js';
+import { hostNameFor } from './ssh-config.js';
 /** Path to the CLI-managed known_hosts store (created lazily, mode 0600). */
 export function managedKnownHostsPath() {
     return path.join(getCacheDir(), 'devices', 'known_hosts');
@@ -54,6 +55,23 @@ export function isHostPinnedIn(content, host) {
 export function isHostPinned(host, file = managedKnownHostsPath()) {
     return isHostPinnedIn(readManagedKnownHosts(file), host);
 }
+/**
+ * True if a DEVICE's host key is pinned — checked against the SAME host string
+ * the ssh connection dials (`hostNameFor(device)`: the Tailscale dnsName/IP that
+ * `sshTargetFor` resolves), falling back to the bare device name.
+ *
+ * A device discovered over the tailnet is pinned under its FQDN
+ * (`yosemite-m6.tail….ts.net`), so a caller that checks the bare `device.name`
+ * misses the pin and wrongly treats a reachable, pinned peer as unpinned —
+ * silently excluding it from usage/auth fan-out while ssh to it would have
+ * succeeded (PHNX-3505). Accepting the bare name too keeps a device pinned only
+ * under its short name working. `isPinned` is injectable for tests; it defaults
+ * to the managed on-disk store.
+ */
+export function isDevicePinned(device, isPinned = (host) => isHostPinned(host)) {
+    const host = device.address ? hostNameFor(device) : undefined;
+    return (host != null && isPinned(host)) || isPinned(device.name);
+}
 /**
  * The host-key-checking ssh options for a connection.
  *

package/dist/lib/secrets/reserved-sync.js

@@ -17,7 +17,7 @@ import { AUTH_BUNDLE_NAME, inspectReservedAuthBundle } from './bundles.js';
 import { pushBundleToHost } from './push.js';
 import { loadDevicesSync } from '../devices/registry.js';
 import { sshTargetFor } from '../devices/connect.js';
-import { isHostPinned, managedKnownHostsPath } from '../devices/known-hosts.js';
+import { isHostPinned, isDevicePinned, managedKnownHostsPath } from '../devices/known-hosts.js';
 import { machineId, normalizeHost } from '../session/sync/config.js';
 import { probeDevice } from '../fleet/apply.js';
 export function planAuthBundlePush(localAuthOk, devices) {
@@ -81,9 +81,9 @@ export function syncReservedAuthBundle(deps = {}) {
         // No live probe until we know a push is even possible: missing local auth
         // skips every device, and an unpinned host is refused before we SSH.
         if (!localOk) {
-            return { name: d.name, reachable: true, pinned: pinned(d.name), remoteHasAuth: false };
+            return { name: d.name, reachable: true, pinned: isDevicePinned(d, pinned), remoteHasAuth: false };
         }
-        const isPinnedDev = pinned(d.name);
+        const isPinnedDev = isDevicePinned(d, pinned);
         if (!isPinnedDev) {
             return { name: d.name, reachable: true, pinned: false, remoteHasAuth: false };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.65",
+  "version": "1.22.66",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",