@phnx-labs/agents-cli 1.22.65 → 1.22.68

package/dist/lib/accounting/usage-sync.js

@@ -1,231 +1,87 @@
 /**
- * Fleet sync of the identity-keyed Claude usage snapshot (PHNX-3392 follow-up).
+ * Fleet distribution of identity-keyed Claude usage through the user repo.
  *
- * A rate limit is metered per ACCOUNT, so an account's 5h/weekly usage is the
- * same number on every box. But only a HEADED device (`personal`/`desktop`) can
- * read it: the interactive OAuth login it holds carries the `user:profile` scope
- * `/api/oauth/usage` requires, and its interactive Claude runs feed the native
- * windows through the status-line writer. A headless `worker` has only the
- * `user:inference` setup-token, which the usage endpoint 403s (RUSH-2392), so its
- * local `claude-usage.json` stays blank and `agents view` shows no S:/W: bars.
- *
- * This closes that gap the same way {@link ../secrets/reserved-sync.ts} closes
- * the auth-token gap: each headed daemon PUSHES its identity-keyed usage rows to
- * the worker peers that cannot read them, which merge NEWEST-WINS
- * ({@link ingestPeerClaudeUsageRows}). Publish direction is role-driven —
- * personal/desktop publish, worker/unmarked consume — so it composes with the
- * device-role taxonomy rather than adding a second notion of "which box is real".
- *
- * Double-fire safety: each daemon only writes the DESTINATION's own cache, and
- * the merge is idempotent + timestamp-guarded, so two headed publishers pushing
- * the same account to one worker converge on the freshest snapshot regardless of
- * order. The input a publisher reads is its OWN cache (device-local state), so an
- * unrestricted per-device fire is correct — no shared queue.
- *
- * The planner is pure so tests cover every skip/push branch with no SSH.
+ * A headed device can read authoritative usage; a worker's setup-token cannot.
+ * Headed daemons therefore publish one snapshot into their conflict-free
+ * `~/.agents/devices/<device>/daemon-state.json`. The daemon's bounded Git
+ * transport delivers those files automatically; workers merge newest-wins.
+ * There is deliberately no device-to-device SSH in this module or its tick.
  */
-import { sshExec } from '../ssh-exec.js';
-import { buildRemoteAgentsInvocation, buildWindowsStdinAgentsCommand, remoteShellFor, stripClixml } from '../hosts/remote-cmd.js';
-import { resolveRemoteOsSync } from '../hosts/remote-os.js';
-import { loadDevicesSync } from '../devices/registry.js';
-import { sshTargetFor } from '../devices/connect.js';
-import { isHostPinned } from '../devices/known-hosts.js';
+import { isHeadedDeviceRole, listConfiguredDeviceRoles, selfConfiguredDeviceRole } from '../device-config.js';
+import { readFleetSharedDeviceStates, updateFleetSharedDeviceState, } from '../fleet-shared-state.js';
+import { getUserAgentsDir } from '../state.js';
 import { machineId, normalizeHost } from '../session/sync/config.js';
-import { isHeadedDeviceRole, listConfiguredDeviceRoles, selfConfiguredDeviceRole, } from '../device-config.js';
 import { exportClaudeUsageCacheRows, ingestPeerClaudeUsageRows, } from './usage.js';
-/** How long a single peer push may take before it is abandoned for this tick. */
-export const USAGE_PUSH_DEADLINE_MS = 20_000;
-export const USAGE_PULL_DEADLINE_MS = 20_000;
-/**
- * A worker's newest local usage row older than this triggers a pull from the
- * primary. A worker cannot self-read usage (setup-token lacks `user:profile`,
- * RUSH-2392), so its only source of a fresh row is the daemon push every
- * `USAGE_SYNC_TICK_MS` (15m); this cutoff is 2× that tick, so one missed push
- * cycle is tolerated before the worker actively pulls. Bounds worker staleness
- * to ~30m instead of the days-old caches this replaces.
- */
-export const USAGE_SYNC_MAX_AGE_MS = 30 * 60_000;
-/** Epoch ms of a cache row's capture time, or null when unparseable/absent. */
-function capturedAtMs(capturedAt) {
-    if (!capturedAt)
-        return null;
-    const ms = Date.parse(capturedAt);
-    return Number.isFinite(ms) ? ms : null;
-}
-/**
- * Decide, per peer, whether to push the local usage snapshot. Pure.
- *
- * - `selfIsPublisher` is false on a `worker`/unmarked box: it has no authoritative
- *   usage to publish, so every peer is skipped.
- * - `hasLocalRows` false means the local cache is empty (nothing to teach yet).
- * - A HEADED peer is skipped — it reads its own usage; pushing risks nothing
- *   (the merge is newest-wins) but is wasted work, and keeping the fan-out to
- *   consumers only makes the intent legible.
- */
-export function planUsagePush(selfIsPublisher, hasLocalRows, targets) {
-    if (!selfIsPublisher) {
-        return targets.map((d) => ({
-            action: 'skip',
-            device: d.name,
-            reason: 'this device is not a usage publisher (mark it personal or desktop)',
-        }));
-    }
-    if (!hasLocalRows) {
-        return targets.map((d) => ({ action: 'skip', device: d.name, reason: 'no local usage snapshot to publish' }));
-    }
-    return targets.map((d) => {
-        if (isHeadedDeviceRole(d.role))
-            return { action: 'skip', device: d.name, reason: 'headed peer reads its own usage' };
-        if (!d.online)
-            return { action: 'skip', device: d.name, reason: 'offline' };
-        if (!d.pinned) {
-            return { action: 'skip', device: d.name, reason: `host key not pinned; run \`agents ssh ${d.name}\` once` };
-        }
-        return { action: 'push', device: d.name };
-    });
-}
-/** Production push: pipe the payload to the peer's `agents __usage-ingest` over ssh. */
-function defaultUsagePush(device, payload) {
-    const target = sshTargetFor(device);
-    const os = resolveRemoteOsSync(device.name);
-    // A Windows peer's `agents.ps1` shim does not forward ssh-piped stdin, so hand
-    // the payload through a temp file (`--from`) instead of stdin — same workaround
-    // the secrets push uses. A POSIX peer reads stdin directly.
-    const remoteCmd = remoteShellFor(os) === 'powershell'
-        ? buildWindowsStdinAgentsCommand(['__usage-ingest'])
-        : buildRemoteAgentsInvocation(['__usage-ingest'], undefined, os);
-    const res = sshExec(target, remoteCmd, { input: payload, timeoutMs: USAGE_PUSH_DEADLINE_MS });
-    if (res.timedOut)
-        return { ok: false, message: 'timed out' };
-    if (res.code !== 0)
-        return { ok: false, message: res.stderr.trim() || `remote exit ${res.code}` };
-    return { ok: true };
-}
-/** Production pull: read the primary's cache through its hidden export verb. */
-function defaultUsagePull(device) {
-    const target = sshTargetFor(device);
-    const os = resolveRemoteOsSync(device.name);
-    const remoteCmd = buildRemoteAgentsInvocation(['__usage-export'], undefined, os);
-    const res = sshExec(target, remoteCmd, { timeoutMs: USAGE_PULL_DEADLINE_MS });
-    if (res.timedOut)
-        return { ok: false, message: 'timed out' };
-    if (res.code !== 0)
-        return { ok: false, message: res.stderr.trim() || `remote exit ${res.code}` };
-    return { ok: true, stdout: res.stdout };
-}
-/**
- * Pull usage from the fleet's primary headed device when this worker's local
- * cache is empty or contains an expired row. `personal` is the primary role;
- * a `desktop` is used only when the fleet has no personal device.
- */
-export function pullUsageFromPrimary(deps = {}) {
-    const result = { pulledFrom: null, merged: 0, skipped: null, error: null };
-    if ((deps.selfRole ?? selfConfiguredDeviceRole)() !== 'worker') {
-        result.skipped = 'this device is not a worker';
+/** Publish this headed device's stable usage snapshot into its owned store file. */
+export function publishUsageSnapshotToSharedStore(options = {}) {
+    const result = {
+        published: false,
+        changed: false,
+        skipped: null,
+        error: null,
+        path: null,
+    };
+    const role = options.role ?? selfConfiguredDeviceRole();
+    if (!isHeadedDeviceRole(role)) {
+        result.skipped = 'this device is not a usage publisher (mark it personal or desktop)';
         return result;
     }
-    const localRows = (deps.exportRows ?? exportClaudeUsageCacheRows)();
-    const localEntries = Object.entries(localRows);
-    // Fresh means RECENT, not "the cache equals itself". The prior check read the
-    // SAME on-disk cache twice (exportRows() and readRow()) and compared window
-    // COUNT, so `fresh.windows.length === row.windows.length` was always true and
-    // any non-empty worker cache skipped the pull forever — which is how a worker
-    // served a days-old snapshot indefinitely and balanced launched into an
-    // account already at its weekly cap. A worker cannot self-read usage, so any
-    // row older than the sync cadence is stale and must trigger a pull; the merge
-    // is newest-wins + idempotent, so pulling when the primary is no fresher is a
-    // harmless no-op.
-    const now = (deps.now ?? Date.now)();
-    const staleCutoff = now - USAGE_SYNC_MAX_AGE_MS;
-    const allFresh = localEntries.length > 0 &&
-        localEntries.every(([, row]) => {
-            const ms = capturedAtMs(row.capturedAt);
-            return ms !== null && ms >= staleCutoff;
-        });
-    if (allFresh) {
-        result.skipped = 'local usage cache is fresh';
+    const rows = exportClaudeUsageCacheRows(options.cachePath);
+    if (Object.keys(rows).length === 0) {
+        result.skipped = 'no local usage snapshot to publish';
         return result;
     }
-    const devices = deps.listDevices?.() ?? Object.values(loadDevicesSync());
-    const roles = deps.listRoles?.() ?? (deps.listDevices
-        ? listConfiguredDeviceRoles(devices.map((device) => device.name))
-        : listConfiguredDeviceRoles());
-    const isPinned = deps.isPinned ?? isHostPinned;
-    const primary = devices
-        .filter((device) => roles[device.name] === 'personal')
-        .concat(devices.filter((device) => roles[device.name] === 'desktop'))
-        .find((device) => device.tailscale?.online !== false && isPinned(device.name));
-    if (!primary) {
-        result.error = 'no reachable, pinned personal or desktop device is configured as the usage primary';
-        return result;
-    }
-    const outcome = (deps.pull ?? defaultUsagePull)(primary);
-    if (!outcome.ok) {
-        result.error = outcome.message ?? 'pull failed';
-        return result;
-    }
-    let payload;
     try {
-        // A Windows usage primary's `agents.ps1` shim prepends a PowerShell CLIXML
-        // progress banner to stdout, exactly as every other remote-JSON boundary
-        // strips (remote-cmd.ts:325). Without this, a headed Windows box (win-mini
-        // is a live fleet device) makes every pull fail as "malformed JSON", the
-        // worker's cache stays null, and the PHNX-3392 capacity floor silently
-        // becomes the only thing standing between a blind pool and an exhausted pick.
-        payload = JSON.parse(stripClixml(outcome.stdout ?? ''));
-    }
-    catch {
-        result.error = 'primary returned malformed JSON';
-        return result;
+        const write = updateFleetSharedDeviceState(options.device ?? machineId(), { usage: { rows } }, options.userAgentsDir ?? getUserAgentsDir());
+        result.published = true;
+        result.changed = write.changed;
+        result.path = write.path;
     }
-    if (!payload || payload.v !== 1 || typeof payload.rows !== 'object' || payload.rows === null || Array.isArray(payload.rows)) {
-        result.error = 'primary returned an unrecognized usage-sync payload shape';
-        return result;
+    catch (err) {
+        result.error = err.message;
     }
-    result.pulledFrom = primary.name;
-    result.merged = (deps.ingestRows ?? ingestPeerClaudeUsageRows)(payload.rows);
     return result;
 }
+function capturedAtMs(row) {
+    if (!row.capturedAt)
+        return null;
+    const ms = Date.parse(row.capturedAt);
+    return Number.isFinite(ms) ? ms : null;
+}
 /**
- * Push the local identity-keyed usage snapshot to every reachable, pinned,
- * non-headed peer. A no-op on a non-headed box or when the local cache is empty.
+ * Read headed publishers from the local user-repo checkout and merge one
+ * newest-wins batch into the worker cache. No network or subprocess is touched.
  */
-export function syncFleetUsageSnapshots(deps = {}) {
-    const result = { pushed: [], skipped: [], errors: [] };
-    const selfRole = (deps.selfRole ?? selfConfiguredDeviceRole)();
-    const devices = deps.listDevices?.() ?? Object.values(loadDevicesSync());
-    const self = deps.localName?.() ?? machineId();
-    const selfNorm = normalizeHost(self);
-    const roles = deps.listRoles?.() ?? (deps.listDevices ? listConfiguredDeviceRoles(devices.map((d) => d.name)) : listConfiguredDeviceRoles());
-    const isPinned = deps.isPinned ?? isHostPinned;
-    const byName = new Map(devices.map((d) => [d.name, d]));
-    const targets = devices
-        .filter((d) => normalizeHost(d.name) !== selfNorm)
-        .map((d) => ({
-        name: d.name,
-        role: roles[d.name],
-        online: d.tailscale?.online !== false,
-        pinned: isPinned(d.name),
-    }));
-    const rows = (deps.exportRows ?? exportClaudeUsageCacheRows)();
-    const plan = planUsagePush(isHeadedDeviceRole(selfRole), Object.keys(rows).length > 0, targets);
-    const payload = JSON.stringify({ v: 1, rows });
-    const push = deps.push ?? defaultUsagePush;
-    for (const item of plan) {
-        if (item.action === 'skip') {
-            result.skipped.push({ device: item.device, reason: item.reason });
-            continue;
-        }
-        const device = byName.get(item.device);
-        if (!device) {
-            result.errors.push({ device: item.device, message: 'device left the registry mid-sync' });
+export function consumeUsageSnapshotsFromSharedStore(options = {}) {
+    const result = { sources: [], merged: 0, skipped: null, errors: [] };
+    if ((options.role ?? selfConfiguredDeviceRole()) !== 'worker') {
+        result.skipped = 'this device is not a worker';
+        return result;
+    }
+    const read = readFleetSharedDeviceStates(options.userAgentsDir ?? getUserAgentsDir());
+    result.errors.push(...read.errors);
+    const self = normalizeHost(options.device ?? machineId());
+    const roles = options.roles ?? listConfiguredDeviceRoles(read.states.map((state) => state.device));
+    const rows = {};
+    for (const state of read.states) {
+        if (normalizeHost(state.device) === self || !isHeadedDeviceRole(roles[state.device]) || !state.usage)
             continue;
+        result.sources.push(state.device);
+        for (const [identity, incoming] of Object.entries(state.usage.rows)) {
+            if (!incoming || !Array.isArray(incoming.windows) || incoming.windows.length === 0)
+                continue;
+            const current = rows[identity];
+            if (!current) {
+                rows[identity] = incoming;
+                continue;
+            }
+            const incomingMs = capturedAtMs(incoming);
+            const currentMs = capturedAtMs(current);
+            if (incomingMs !== null && (currentMs === null || incomingMs > currentMs))
+                rows[identity] = incoming;
         }
-        const outcome = push(device, payload);
-        if (outcome.ok)
-            result.pushed.push(item.device);
-        else
-            result.errors.push({ device: item.device, message: outcome.message ?? 'push failed' });
     }
+    result.sources.sort();
+    result.merged = ingestPeerClaudeUsageRows(rows, options.cachePath);
     return result;
 }

package/dist/lib/accounting/usage.d.ts

@@ -229,6 +229,12 @@ interface UsageOptions {
      * absent, the backoff stays provider-wide.
      */
     usageScope?: string | null;
+    /**
+     * Caller-supplied abort signal (the daemon tick's deadline). Combined with each
+     * provider fetch's own timeout so a hung refresh is bounded by BOTH the
+     * per-fetch timeout and the supervisor deadline (PHNX-3608).
+     */
+    signal?: AbortSignal;
     /**
      * When true, never open the ACL-bound OS keychain item (macOS Touch ID).
      * Daemon usage refresh sets this so a background tick cannot pop biometrics.
@@ -362,6 +368,8 @@ export declare const USAGE_FETCH_CONCURRENCY = 3;
 export interface UsageLookupOptions {
     forceRefresh?: boolean;
     fileOnly?: boolean;
+    /** Daemon tick deadline signal, combined with each provider fetch's own timeout (PHNX-3608). */
+    signal?: AbortSignal;
     /**
      * Permit a foreground personal-device usage read to fall through to the
      * interactive login when no setup-token exists (USAGE-READ-2). Set ONLY by
@@ -626,11 +634,11 @@ export interface ProviderProbe {
     reason?: 'usage_scope';
 }
 /** Probe Claude's OAuth token against the usage endpoint. Never refreshes — reports `expired` for a near-expiry token; see the comment below (RUSH-1822). */
-export declare function probeClaudeStatus(home?: string, cliVersion?: string | null, usageScope?: string | null): Promise<ProviderProbe>;
+export declare function probeClaudeStatus(home?: string, cliVersion?: string | null, usageScope?: string | null, signal?: AbortSignal): Promise<ProviderProbe>;
 /** Probe Kimi's OAuth token against the /usages endpoint. Never refreshes (single-use rotation — see getKimiUsageInfo). */
-export declare function probeKimiStatus(home?: string, usageScope?: string | null): Promise<ProviderProbe>;
+export declare function probeKimiStatus(home?: string, usageScope?: string | null, signal?: AbortSignal): Promise<ProviderProbe>;
 /** Probe Droid's WorkOS token against the billing-limits endpoint. Never refreshes (single-use rotation — see getDroidUsageInfo). */
-export declare function probeDroidStatus(home?: string, usageScope?: string | null): Promise<ProviderProbe>;
+export declare function probeDroidStatus(home?: string, usageScope?: string | null, signal?: AbortSignal): Promise<ProviderProbe>;
 /**
  * Normalize the Factory billing-limits payload into the common UsageWindow
  * shape. Orgs on the legacy (non token-rate-limit) billing model have no

package/dist/lib/accounting/usage.js

@@ -318,6 +318,16 @@ export async function getUsageInfo(agentId, options) {
     const source = getUsageSource(agentId);
     return source ? source.fetch(options) : { snapshot: null, error: null };
 }
+/**
+ * Combine a caller-supplied abort signal (the daemon tick deadline) with a
+ * per-fetch timeout, so a provider fetch is bounded by whichever fires first
+ * (PHNX-3608). With no caller signal it degrades to the timeout alone —
+ * byte-identical to the previous `AbortSignal.timeout(ms)` behaviour.
+ */
+function usageFetchSignal(signal, timeoutMs) {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
 /** Derive a stable lookup key from account info for usage deduplication. */
 export function getUsageLookupKey(info) {
     return info?.usageKey || info?.accountKey || null;
@@ -421,6 +431,7 @@ export async function getUsageInfoForIdentity(input, opts) {
             organizationId: input.info.organizationId,
             fileOnly: opts?.fileOnly,
             allowInteractiveLogin: opts?.allowInteractiveLogin,
+            signal: opts?.signal,
         });
     }
     const cached = readClaudeUsageCache(usageKey);
@@ -458,6 +469,7 @@ export async function getUsageInfoForIdentity(input, opts) {
     // Explicit refresh: block on the shared device collector.
     return fetchLiveUsageDeduped(input, usageKey, cached, opts?.fileOnly === true, {
         allowInteractiveLogin: opts?.allowInteractiveLogin === true,
+        signal: opts?.signal,
     });
 }
 /**
@@ -489,6 +501,7 @@ async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly, opts) {
                 usageScope: usageKey,
                 fileOnly,
                 allowInteractiveLogin: opts?.allowInteractiveLogin === true,
+                signal: opts?.signal,
             });
             if (usage.snapshot) {
                 if (!usage.snapshot.capturedAt || usage.snapshot.capturedAt.getTime() <= previousCapturedAt) {
@@ -931,7 +944,7 @@ async function getClaudeUsageInfo(options) {
                 'anthropic-beta': CLAUDE_OAUTH_BETA_HEADER,
                 'User-Agent': getClaudeUserAgent(options?.cliVersion),
             },
-            signal: AbortSignal.timeout(5000),
+            signal: usageFetchSignal(options?.signal, 5000),
         });
         if (!response.ok) {
             if (response.status === 429) {
@@ -1038,7 +1051,7 @@ async function getKimiUsageInfo(options) {
                 Authorization: `Bearer ${accessToken}`,
                 Accept: 'application/json',
             },
-            signal: AbortSignal.timeout(5000),
+            signal: usageFetchSignal(options?.signal, 5000),
         });
         // 401/403 => expired token, 404 => no Kimi For Coding subscription. Either
         // way there are no bars to draw, and the status is what tells them apart.
@@ -1172,7 +1185,7 @@ async function getDroidUsageInfo(options) {
                 Authorization: `Bearer ${accessToken}`,
                 Accept: 'application/json',
             },
-            signal: AbortSignal.timeout(5000),
+            signal: usageFetchSignal(options?.signal, 5000),
         });
         // 401 => revoked/expired token. No bars to draw, and the status says why.
         if (!response.ok) {
@@ -1204,7 +1217,7 @@ async function getDroidUsageInfo(options) {
     }
 }
 /** Probe Claude's OAuth token against the usage endpoint. Never refreshes — reports `expired` for a near-expiry token; see the comment below (RUSH-1822). */
-export async function probeClaudeStatus(home, cliVersion, usageScope) {
+export async function probeClaudeStatus(home, cliVersion, usageScope, signal) {
     // accessTokenCache: the daemon warms this probe every ~3 min per account, so it
     // reads ONLY the file-based setup-token and never the interactive login —
     // transmitting that ACL-bound token to the usage API from a background loop is
@@ -1240,7 +1253,7 @@ export async function probeClaudeStatus(home, cliVersion, usageScope) {
                 'anthropic-beta': CLAUDE_OAUTH_BETA_HEADER,
                 'User-Agent': getClaudeUserAgent(cliVersion),
             },
-            signal: AbortSignal.timeout(8000),
+            signal: usageFetchSignal(signal, 8000),
         });
         if (response.status === 429) {
             noteUsageRateLimited('claude', response.headers.get('retry-after'), { account: usageScope });
@@ -1271,7 +1284,7 @@ export async function probeClaudeStatus(home, cliVersion, usageScope) {
     }
 }
 /** Probe Kimi's OAuth token against the /usages endpoint. Never refreshes (single-use rotation — see getKimiUsageInfo). */
-export async function probeKimiStatus(home, usageScope) {
+export async function probeKimiStatus(home, usageScope, signal) {
     const credPath = resolveKimiCredentialPath(home);
     if (!credPath)
         return { status: null, token: 'missing' };
@@ -1301,7 +1314,7 @@ export async function probeKimiStatus(home, usageScope) {
         const response = await fetch(KIMI_USAGES_URL, {
             method: 'GET',
             headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/json' },
-            signal: AbortSignal.timeout(8000),
+            signal: usageFetchSignal(signal, 8000),
         });
         if (response.status === 429) {
             noteUsageRateLimited('kimi', response.headers.get('retry-after'), { account: usageScope });
@@ -1313,7 +1326,7 @@ export async function probeKimiStatus(home, usageScope) {
     }
 }
 /** Probe Droid's WorkOS token against the billing-limits endpoint. Never refreshes (single-use rotation — see getDroidUsageInfo). */
-export async function probeDroidStatus(home, usageScope) {
+export async function probeDroidStatus(home, usageScope, signal) {
     const cred = decryptDroidAuthPayload(home || os.homedir());
     const accessToken = cred?.access_token;
     if (typeof accessToken !== 'string' || !accessToken)
@@ -1331,7 +1344,7 @@ export async function probeDroidStatus(home, usageScope) {
         const response = await fetch(DROID_USAGE_URL, {
             method: 'GET',
             headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/json' },
-            signal: AbortSignal.timeout(8000),
+            signal: usageFetchSignal(signal, 8000),
         });
         if (response.status === 429) {
             noteUsageRateLimited('droid', response.headers.get('retry-after'), { account: usageScope });
@@ -2963,7 +2976,7 @@ async function getCursorUsageInfo(options) {
                 Cookie: cookie,
                 Accept: 'application/json',
             },
-            signal: AbortSignal.timeout(5000),
+            signal: usageFetchSignal(options?.signal, 5000),
         });
         // 401/redirect => revoked/expired session. No bars to draw, and the status
         // says why.

package/dist/lib/auth-health.d.ts

@@ -163,6 +163,8 @@ export declare function probeAuthHealth(agent: AgentId, home: string | undefined
      * a genuinely live request that surfaces `revoked` immediately.
      */
     forceLive?: boolean;
+    /** Daemon tick deadline signal, combined with each probe fetch's own timeout (PHNX-3608). */
+    signal?: AbortSignal;
 }): Promise<AuthHealth>;
 /** One probed install on a host. */
 export interface AuthProbeRow {
@@ -225,6 +227,12 @@ export declare function probeLocalFleetAuth(opts?: {
     agents?: readonly AgentId[];
     /** Fire real network probes even when fresh usage evidence exists (RUSH-3036) — the `devices ping [--strict]` contract. */
     forceLive?: boolean;
+    /**
+     * Deadline signal from the daemon's supervised auth tick (PHNX-3608). Aborts
+     * the probe's in-flight network work when the tick deadline elapses so it
+     * unwinds instead of leaking a runaway await; on-demand CLI callers omit it.
+     */
+    signal?: AbortSignal;
 }): Promise<AuthProbeRow[]>;
 /** Persist a host's probed rows into the cache (keyed by host+agent+version). */
 export declare function writeFleetAuthRows(host: string, rows: AuthProbeRow[]): void;

package/dist/lib/auth-health.js

@@ -347,11 +347,11 @@ export async function probeAuthHealth(agent, home, opts) {
         }
         let probe;
         if (agent === 'claude')
-            probe = await probeClaudeStatus(home, opts?.cliVersion, usageScope);
+            probe = await probeClaudeStatus(home, opts?.cliVersion, usageScope, opts?.signal);
         else if (agent === 'kimi')
-            probe = await probeKimiStatus(home, usageScope);
+            probe = await probeKimiStatus(home, usageScope, opts?.signal);
         else
-            probe = await probeDroidStatus(home, usageScope);
+            probe = await probeDroidStatus(home, usageScope, opts?.signal);
         return { verdict: verdictFromProbe(probe), checkedAt, detail: probeDetail(probe) };
     }
     const info = opts?.info !== undefined ? opts.info : await getAccountInfo(agent, home).catch(() => null);
@@ -426,7 +426,7 @@ export async function probeLocalFleetAuth(opts) {
     // accounts, so no same-account concurrency is left to trip the throttle.
     const perGroup = await Promise.all(groupFleetAuthInstalls(installs, (inst) => LIVE_PROBE_AGENTS.has(inst.agent)).map(async (group) => {
         const rep = group.probe;
-        const health = await probeAuthHealth(rep.agent, rep.home, { cliVersion: opts?.cliVersion, info: rep.info, forceLive: opts?.forceLive });
+        const health = await probeAuthHealth(rep.agent, rep.home, { cliVersion: opts?.cliVersion, info: rep.info, forceLive: opts?.forceLive, signal: opts?.signal });
         health.account = authAccountLabel(rep.info);
         if (health.verdict === 'unconfigured')
             return [];

package/dist/lib/browser/caller-identity.d.ts

@@ -13,6 +13,18 @@ export interface CallerIdentity {
  * agent comm is found.
  */
 export declare function resolveCallerIdentity(env?: NodeJS.ProcessEnv): CallerIdentity;
+/**
+ * The env a `browser --device` dispatch forwards so the HUB resolves the SAME
+ * caller identity the worker would stamp locally. Without it a forwarded verb
+ * lands on the hub with BLANK identity, and the daemon's no-identity task bucket
+ * matches any other no-identity task — so a cold verb could attach to (or a
+ * `done`/`stop` could close) an unrelated agent's or a human's browser. This is
+ * the same surface-parity fix the `run --device` path already carries via
+ * `--env AGENT_LAUNCH_ID` (remote-session-id.ts). Absent fields are omitted so a
+ * genuinely-unidentifiable caller forwards nothing rather than an empty string
+ * that would read as a real (blank) identity on the far side.
+ */
+export declare function callerIdentityEnv(caller: Pick<CallerIdentity, 'sessionId' | 'launchId'>): Record<string, string>;
 /**
  * True when a live task belongs to this caller. Match on sessionId or
  * launchId — either is enough. A task with no recorded identity never

package/dist/lib/browser/caller-identity.js

@@ -141,6 +141,25 @@ export function resolveCallerIdentity(env = process.env) {
     }
     return { actor, sessionId, launchId, agentPid };
 }
+/**
+ * The env a `browser --device` dispatch forwards so the HUB resolves the SAME
+ * caller identity the worker would stamp locally. Without it a forwarded verb
+ * lands on the hub with BLANK identity, and the daemon's no-identity task bucket
+ * matches any other no-identity task — so a cold verb could attach to (or a
+ * `done`/`stop` could close) an unrelated agent's or a human's browser. This is
+ * the same surface-parity fix the `run --device` path already carries via
+ * `--env AGENT_LAUNCH_ID` (remote-session-id.ts). Absent fields are omitted so a
+ * genuinely-unidentifiable caller forwards nothing rather than an empty string
+ * that would read as a real (blank) identity on the far side.
+ */
+export function callerIdentityEnv(caller) {
+    const env = {};
+    if (caller.sessionId)
+        env.AGENT_SESSION_ID = caller.sessionId;
+    if (caller.launchId)
+        env.AGENT_LAUNCH_ID = caller.launchId;
+    return env;
+}
 /**
  * True when a live task belongs to this caller. Match on sessionId or
  * launchId — either is enough. A task with no recorded identity never