@phnx-labs/agents-cli 1.22.73 → 1.22.75

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # Changelog
 
+## 1.22.75
+
+- **Account labels are per-harness, and survive a daemon publish (PHNX-3887).** One
+  identity signed into several harnesses can now carry the SAME label on each —
+  `claude#icloud`, `codex#icloud`, and `grok#icloud` all resolve to that harness's own
+  login, instead of the first-labelled harness squatting the name and forcing prefixes
+  (`cxicloud`, `gkicloud`) on the rest. Uniqueness is scoped to `(agent, label)`;
+  provider accounts, selected by bare name via `--account`, stay globally unique, and a
+  duplicate label within one harness is still refused. Separately, `agents accounts
+  label` wrote version-scoped rows into the central `agents.yaml` as a plain file write
+  with no commit, so the daemon's `publish <device> daemon state` tick — which committed
+  only the per-device doc and then rebased `--autostash` over the dirty central file —
+  silently destroyed them: every box lost its account labels on its next publish. The
+  publish now commits `agents.yaml` alongside the device doc, so labels persist and
+  actually sync fleet-wide as `accounts label --help` already promised. Source:
+  `cli/src/lib/account-registry.ts`, `cli/src/lib/fleet-shared-repo-sync.ts`.
+
+- **Keep one daemon alive across concurrent stop/start (PHNX-3941).** Prevent a replacement daemon from exiting while stop holds the lifecycle lock, so concurrent stop/start cannot leave zero instances, and extend real-boot supervisor-wiring coverage to all 20 services. Source: `cli/src/lib/daemon/daemon.ts`.
+
+- **`agents computer` can now drive a Linux GUI desktop over VNC/RFB (PHNX-3948).**
+  A third computer backend joins the macOS (Accessibility) and Windows (UIA) native
+  helpers — this one speaks the RFB/VNC protocol directly to an x11vnc/Xvnc server, so
+  a headless Linux desktop (or an LXD container exposing x11vnc on the host's Tailscale
+  IP) becomes drivable with no per-box native helper install. Select it with
+  `agents computer --vnc <host:port>` (port defaults to 5901; password via
+  `--vnc-password` or `COMPUTER_HELPER_VNC_PASSWORD`), then use the same verbs as the
+  other backends: `screenshot`, `click`, `right-click`, `type`, `type-text`, `key`,
+  `scroll`, `wait`. It is coordinate-based — RFB carries a framebuffer and pointer/key
+  events, not an accessibility tree — so the AX-tree verbs (`describe`, `get-text`,
+  `ax-action`, element-id targeting) and `launch` fail loud with a clear message rather
+  than silently no-op'ing. VNC authentication uses a bundled pure-JS DES (Node 24's
+  OpenSSL 3 keeps DES in the off-by-default legacy provider). Source:
+  `cli/src/lib/computer/rfb-client.ts`, `cli/src/lib/computer/des.ts`,
+  `cli/src/lib/computer/computer-rpc.ts`, `cli/src/commands/computer.ts`.
+
+## 1.22.74
+
+- **Launching an agent no longer dirties your tracked `.gitignore` (PHNX-3718).**
+  The per-harness resource sync self-manages ignore rules for the generated
+  `.claude/`, `.cursor/`, `.codex/`, … dirs it writes on every launch. Those
+  rules used to be written into the tracked `<project>/.gitignore`, but they are
+  never committed upstream — so every launch left the repo with a permanent
+  `M .gitignore` (one managed block per harness that had run there) that in turn
+  blocked `git pull` with *"local changes to .gitignore would be overwritten by
+  merge"*. The managed block now lives in `.git/info/exclude` (git's per-clone,
+  uncommitted ignore file, resolved via `git rev-parse --git-path info/exclude`
+  so it works from a subdir, linked worktree, or submodule), keeping the
+  generated dirs hidden while leaving the working tree clean. On the next launch,
+  a repo already dirtied by the old behavior self-heals: the leftover managed
+  block is stripped from the tracked `.gitignore` (hand-written rules untouched;
+  an untracked file that held only our block is removed). Source:
+  `cli/src/lib/project-resources.ts`.
+
+- **`sessions preview` of a remote session no longer dead-ends on the dispatcher
+  (PHNX-3890).** A box that launched a session running on another device kept a
+  transcript-less live row for it whose machine defaulted to itself, so
+  `agents sessions preview <full-uuid>` — and the interactive browser's preview
+  pane — rendered `Live session — full transcript not indexed here.` instead of
+  fetching the owning peer's digest. A passive peer rendered the same session
+  fine. The launcher shim is now reconciled against the fleet's own view of which
+  device runs the session, and a full-UUID hit only skips the fleet fan-out when
+  this box can actually answer for it (a transcript on disk, or a row that already
+  names another device). Remote previews fill in asynchronously over SSH; a
+  locally readable transcript or synced mirror still renders with no hop, and an
+  unreachable owner still fails loud. Source: `cli/src/commands/sessions.ts`,
+  `cli/src/lib/session/live-metadata.ts`.
+
 ## 1.22.73
 
 - **Ctrl-C works again while `agents sessions` is reaching other machines (PHNX-3791).** The static session list, `Searching the fleet…`, and the cloud session/fetch paths wrap their long SSH/network waits in `ora(...)`. ora defaults to `discardStdin: true`, which on a TTY flips stdin into raw mode for the spinner's lifetime (via `stdin-discarder`) — and raw mode disables the terminal's own ISIG, so a Ctrl-C keystroke no longer raises SIGINT. ora's compensating "re-emit SIGINT when I read a 0x03 byte" only fires when stdin is in *flowing* mode, but a fresh `process.stdin` has `flowing === null`, `isPaused()` returns false, the discarder skips its `resume()`, and `prependListener('data')` doesn't auto-resume — so the byte is never read and SIGINT is never raised. The global handler in `index.ts` (`process.exit(130)`) was correct; it simply never fired. The user-visible result: a sweep that stalls on offline/unreachable boxes (each burning a ~12s SSH `ConnectTimeout`) could not be aborted — measured, `agents sessions --flat` had to be SIGKILLed. New `lib/spinner.ts#interruptibleSpinner` is a drop-in for `ora(text)` built with `discardStdin: false`: the terminal stays in cooked mode, Ctrl-C raises SIGINT normally (and the terminal SIGINTs the whole foreground group, reaping the outstanding `ssh` children), and the process exits promptly — only cosmetic stray-keystroke discarding during the spin is lost. The five cross-machine/network spinners in `sessions.ts` route through it; short local spinners are unchanged. Source: `cli/src/lib/spinner.ts`, `cli/src/lib/spinner.test.ts`, `cli/src/commands/sessions.ts`.

package/README.md

@@ -1756,7 +1756,7 @@ Agents are defined in [src/lib/agents.ts](cli/src/lib/agents.ts) -- each is a co
 |---|---|
 | [`cli`](cli) | **The CLI** (this README) — version management, config sync, sessions, teams, cloud, browser, computer, secrets. |
 | [phnx-labs/agi-ext](https://github.com/phnx-labs/agi-ext) | **AGI EXT** — the VS Code extension (agent terminals as tabs + the Fleet dashboard). Moved to its own repo (RUSH-3189); separate product, own publish identity. |
-| [`native/computer-mac`](native/computer-mac) · [`native/computer-win`](native/computer-win) | Native backends behind `agents computer` — Swift (macOS Accessibility + screen capture) and C#/.NET (Windows UI Automation). |
+| [`native/computer-mac`](native/computer-mac) · [`native/computer-win`](native/computer-win) | Native backends behind `agents computer` — Swift (macOS Accessibility + screen capture) and C#/.NET (Windows UI Automation). A third, install-free backend drives a **Linux GUI desktop over VNC/RFB**: `agents computer --vnc <host:port> screenshot` (coordinate-based — screenshot/click/type/key/scroll against any x11vnc/Xvnc server). |
 | [`packages/session-tracker`](packages/session-tracker) | The `SessionStart` hook that writes live-session state **AGI EXT** reads back (agi-ext `src/core/liveSession.ts`) — not the CLI, which reads transcripts. |
 
 ## Contributing

package/dist/commands/computer.d.ts

@@ -10,6 +10,7 @@ import { resolveHelperExec, resolveSocketPath } from '../lib/computer/computer-r
 export declare function shouldBlockOffPlatform(opts: {
     platform: NodeJS.Platform;
     tcpConfigured: boolean;
+    vncConfigured?: boolean;
     device?: string;
 }): boolean;
 /**

package/dist/commands/computer.js

@@ -3,7 +3,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { registerCommandGroups } from '../lib/help.js';
-import { openComputerClient, resolveHelperApp, resolveHelperExec, resolveSocketPath, resolveLogPath, resolvePolicyPath, resolvePeersPath, resolveTcpEndpoint, loadComputerAllowList, loadDefaultPeers, writeComputerPolicy, writeComputerPeers, } from '../lib/computer/computer-rpc.js';
+import { openComputerClient, resolveHelperApp, resolveHelperExec, resolveSocketPath, resolveLogPath, resolvePolicyPath, resolvePeersPath, resolveTcpEndpoint, resolveVncEndpoint, loadComputerAllowList, loadDefaultPeers, writeComputerPolicy, writeComputerPeers, } from '../lib/computer/computer-rpc.js';
 import { setupRemoteHelper, startRemoteTunnel, stopRemoteHelper, hydrateRemoteEnvFromState, readRemoteState, resolveRemoteDevice, REMOTE_TASK_NAME, WIN_HELPER_EXE, } from '../lib/computer/ssh-tunnel.js';
 import { sshExec } from '../lib/ssh-exec.js';
 import { encodePowershell } from '../lib/hosts/remote-cmd.js';
@@ -41,6 +41,8 @@ export function shouldBlockOffPlatform(opts) {
         return false;
     if (opts.tcpConfigured)
         return false; // remote (Windows) daemon over a tunnel
+    if (opts.vncConfigured)
+        return false; // RFB/VNC desktop (Linux GUI over the wire)
     if (opts.device)
         return false; // remote path resolves its own endpoint
     return true;
@@ -84,20 +86,37 @@ export function reconcileScreenshotExt(outPath, buf) {
 export function registerComputerCommand(program) {
     const computer = program
         .command('computer')
-        .description('Drive macOS apps via Accessibility, or a remote Windows device with --device — list, screenshot, click, type')
+        .description('Drive macOS apps via Accessibility, a Linux GUI desktop with --vnc, or a remote Windows device with --device — screenshot, click, type')
+        // A VNC/RFB desktop is driven over the wire (--vnc host:port, e.g. an x11vnc
+        // server on a headless Linux box or an LXD container). Set it before the gate.
+        .option('--vnc <host:port>', 'Drive a GUI desktop over VNC/RFB (x11vnc/Xvnc; port defaults to 5901) instead of a native helper')
+        .option('--vnc-password <password>', 'VNC password for --vnc (or set COMPUTER_HELPER_VNC_PASSWORD)')
         // The whole subsystem is macOS Accessibility / TCC for LOCAL driving. Off
-        // macOS it still works against a remote daemon (COMPUTER_HELPER_TCP set, or
-        // a `--device <name>` invocation). Fail fast with a clear message only when
-        // neither remote path is available, instead of a downstream launchctl error.
+        // macOS it still works against a remote daemon (COMPUTER_HELPER_TCP set, a
+        // --vnc desktop, or a `--device <name>` invocation). Fail fast with a clear
+        // message only when no remote path is available, instead of a downstream error.
         .hook('preAction', async (_thisCommand, actionCommand) => {
-        const device = actionCommand.opts().device;
+        const globals = actionCommand.optsWithGlobals();
+        // --vnc selects the RFB transport for every verb under this command.
+        if (globals.vnc) {
+            process.env.COMPUTER_HELPER_VNC = globals.vnc;
+            if (globals.vncPassword)
+                process.env.COMPUTER_HELPER_VNC_PASSWORD = globals.vncPassword;
+        }
+        const device = globals.device;
         // Verbs with --device reconnect to the tunnel `start --device` recorded;
         // this sets COMPUTER_HELPER_TCP so the shared client picks the TCP transport.
         if (device && !REMOTE_LIFECYCLE.has(actionCommand.name())) {
             hydrateRemoteEnvFromState(device);
         }
-        if (shouldBlockOffPlatform({ platform: process.platform, tcpConfigured: resolveTcpEndpoint() != null, device })) {
+        if (shouldBlockOffPlatform({
+            platform: process.platform,
+            tcpConfigured: resolveTcpEndpoint() != null,
+            vncConfigured: resolveVncEndpoint() != null,
+            device,
+        })) {
             console.error('agents computer: macOS only for local driving — it uses the macOS Accessibility API.');
+            console.error('For a Linux GUI desktop over VNC: `agents computer --vnc <host:port> screenshot`.');
             console.error('For a remote Windows device: register it with `agents devices`, then use --device (or set COMPUTER_HELPER_TCP).');
             process.exit(1);
         }

package/dist/commands/sessions.d.ts

@@ -896,9 +896,58 @@ export declare function metadataResolveOutcome(localMatches: SessionMeta[], remo
     sessions: SessionMeta[];
     unreachable: string[];
 }, selector: string): MetadataResolveOutcome;
-/** Injectable dependency for the live-registry cold-miss fallback (RUSH-2682). */
+/**
+ * Whether a local candidate answers a full-UUID selector **definitively** — i.e.
+ * whether finding it on this box is the whole answer, so the fleet fan-out can be
+ * skipped (PHNX-3890).
+ *
+ * Two shapes qualify, and both are claims this box can actually back:
+ *
+ * - **A real transcript on this disk** (`filePath`). It renders locally, whoever
+ *   owns it — a local session or a fleet-synced mirror — so no SSH hop is needed.
+ * - **A genuine peer attribution** (`machine` names another box). The row already
+ *   routes the read to its owner through `transcriptOnPeerOf`, so the peer that
+ *   would answer the fan-out is the peer the render already dials.
+ *
+ * What does NOT qualify is the launcher-shim shape: a transcript-less live row
+ * whose `machine` is this box only because it DEFAULTED there
+ * (`activeSessionToSessionMeta`'s `active.machine ?? self`,
+ * `computeLocalMetadataMatches`'s `machine || localMachine`). A dispatcher holds
+ * exactly that row for a session whose agent and transcript live on a peer: the
+ * launch process is here, the conversation is not. Treating it as definitive is
+ * what dead-ended `agents sessions preview <full-uuid>` on the local
+ * "Live session — full transcript not indexed here." stub while a passive peer —
+ * which has no local row at all, so it fans out — rendered the real digest.
+ * Process locality is not transcript locality.
+ */
+export declare function isLocallyDefinitiveMatch(session: SessionMeta, self: string): boolean;
+/**
+ * Drop the launcher-shim local rows that a peer has since answered for
+ * (PHNX-3890). `fleetCandidatesByQuery` groups a logical session's copies per
+ * machine and every consumer reads `hits[0]`, with local rows passed first — so
+ * simply fanning out is not enough: the self-defaulted shim would still win the
+ * attribution and route the read back to a box with no transcript. When the peer
+ * that actually owns the session has answered the sweep, its row is the strictly
+ * better one, and the shim carries no information the candidate loses (same
+ * logical id, so the candidate — and any ambiguity it is part of — survives
+ * through the remote hit).
+ *
+ * A row that is {@link isLocallyDefinitiveMatch} is never dropped, so a locally
+ * readable transcript or a synced mirror still renders here with no SSH hop. When
+ * no peer answered for that id, the shim is kept: with no fleet evidence, a
+ * transcript-less self-attributed row is indistinguishable from a session THIS box
+ * just started, and dropping it would re-break the cold-index lookup RUSH-2682
+ * fixed.
+ */
+export declare function preferOwnerAttribution(localMatches: SessionMeta[], remoteSessions: SessionMeta[], self: string): SessionMeta[];
+/** Injectable dependencies for the live-registry cold-miss fallback (RUSH-2682)
+ * and the fleet-attribution reconciliation (PHNX-3890). */
 export type LiveMetadataDeps = {
     loadActive?: typeof loadLocalActiveSessions;
+    /** The fleet-active snapshot rows used to attribute a self-defaulted launcher
+     * shim to its true execution host. Defaults to the cached fleet snapshot; the
+     * cache is warmed by any fleet-wide `agents sessions --active`. */
+    loadFleetActive?: () => ActiveSession[];
 };
 /**
  * Local metadata candidates for a selector: the indexed SQLite rows, plus — when

package/dist/commands/sessions.js

@@ -29,14 +29,14 @@ import { mapPanesToTargets, listClients } from '../lib/tmux/session.js';
 import { resolveViewingIn, viewingInLabel } from '../lib/session/viewing-in.js';
 import { machineId, normalizeHost } from '../lib/session/sync/config.js';
 import { gatherRemoteActive, NO_FANOUT_ENV } from '../lib/session/remote-active.js';
-import { loadFleetActiveSessions, loadLocalActiveSessions, } from '../lib/session/session-cache.js';
+import { loadFleetActiveSessions, loadLocalActiveSessions, readActiveSessionsCache, } from '../lib/session/session-cache.js';
 import { gatherRemoteList, gatherRemoteToolProgramCounts, gatherRemoteToolSearch, runOnPeer } from '../lib/session/remote-list.js';
 import { gatherRemoteAgentsJson } from '../lib/remote-agents-json.js';
 import { stringWidth, truncateToWidth, padToWidth, terminalWidth } from '../lib/session/width.js';
 import { inferSessionState } from '../lib/session/state.js';
 import { discoverSessions, queryIndexedSessions, countSessionsInScope, resolveSessionById, isCompleteSessionId, looksLikeSessionId, searchContentIndex, getSessionRoots, scopeToManaged } from '../lib/session/discover.js';
 import { findSessionsById, querySessions, readSessionContent, readArchivedSessionPreview } from '../lib/session/db.js';
-import { liveSessionMetas } from '../lib/session/live-metadata.js';
+import { liveSessionMetas, fleetExecutionMachineById, reconcileLiveMetaMachine } from '../lib/session/live-metadata.js';
 import { filterTeamSessions, shouldShowTeamSessions, safeTeamText, groupSessionsByTeam, NO_TEAM_GROUP_KEY, } from '../lib/session/team-filter.js';
 import { parseSession } from '../lib/session/parse.js';
 import { runRemoteSessions, buildForwardedArgs, ensureWholeIndex } from '../lib/session/remote.js';
@@ -4844,6 +4844,59 @@ export function metadataResolveOutcome(localMatches, remote, selector) {
         return { kind: 'ambiguous', candidates };
     return { kind: 'resolved', session: candidates[0].hits[0].session };
 }
+/**
+ * Whether a local candidate answers a full-UUID selector **definitively** — i.e.
+ * whether finding it on this box is the whole answer, so the fleet fan-out can be
+ * skipped (PHNX-3890).
+ *
+ * Two shapes qualify, and both are claims this box can actually back:
+ *
+ * - **A real transcript on this disk** (`filePath`). It renders locally, whoever
+ *   owns it — a local session or a fleet-synced mirror — so no SSH hop is needed.
+ * - **A genuine peer attribution** (`machine` names another box). The row already
+ *   routes the read to its owner through `transcriptOnPeerOf`, so the peer that
+ *   would answer the fan-out is the peer the render already dials.
+ *
+ * What does NOT qualify is the launcher-shim shape: a transcript-less live row
+ * whose `machine` is this box only because it DEFAULTED there
+ * (`activeSessionToSessionMeta`'s `active.machine ?? self`,
+ * `computeLocalMetadataMatches`'s `machine || localMachine`). A dispatcher holds
+ * exactly that row for a session whose agent and transcript live on a peer: the
+ * launch process is here, the conversation is not. Treating it as definitive is
+ * what dead-ended `agents sessions preview <full-uuid>` on the local
+ * "Live session — full transcript not indexed here." stub while a passive peer —
+ * which has no local row at all, so it fans out — rendered the real digest.
+ * Process locality is not transcript locality.
+ */
+export function isLocallyDefinitiveMatch(session, self) {
+    if (session.filePath)
+        return true;
+    return !!session.machine && session.machine !== self;
+}
+/**
+ * Drop the launcher-shim local rows that a peer has since answered for
+ * (PHNX-3890). `fleetCandidatesByQuery` groups a logical session's copies per
+ * machine and every consumer reads `hits[0]`, with local rows passed first — so
+ * simply fanning out is not enough: the self-defaulted shim would still win the
+ * attribution and route the read back to a box with no transcript. When the peer
+ * that actually owns the session has answered the sweep, its row is the strictly
+ * better one, and the shim carries no information the candidate loses (same
+ * logical id, so the candidate — and any ambiguity it is part of — survives
+ * through the remote hit).
+ *
+ * A row that is {@link isLocallyDefinitiveMatch} is never dropped, so a locally
+ * readable transcript or a synced mirror still renders here with no SSH hop. When
+ * no peer answered for that id, the shim is kept: with no fleet evidence, a
+ * transcript-less self-attributed row is indistinguishable from a session THIS box
+ * just started, and dropping it would re-break the cold-index lookup RUSH-2682
+ * fixed.
+ */
+export function preferOwnerAttribution(localMatches, remoteSessions, self) {
+    if (remoteSessions.length === 0)
+        return localMatches;
+    const answeredByPeer = new Set(remoteSessions.map(session => session.id.toLowerCase()));
+    return localMatches.filter(session => isLocallyDefinitiveMatch(session, self) || !answeredByPeer.has(session.id.toLowerCase()));
+}
 /**
  * Local metadata candidates for a selector: the indexed SQLite rows, plus — when
  * an id-shaped selector misses the index entirely — the live-session registry
@@ -4881,7 +4934,20 @@ export async function computeLocalMetadataMatches(selector, scope, deps = {}) {
  */
 export async function liveMetadataMatches(selector, scope, self, deps = {}) {
     const load = deps.loadActive ?? loadLocalActiveSessions;
-    const match = (metas) => resolveIndexedMetadataRows(applyScopeFilters(metas, scope), selector, scope);
+    const loadFleet = deps.loadFleetActive ?? (() => readActiveSessionsCache('fleet')?.sessions ?? []);
+    // A launcher-shim row whose `machine` self-defaulted to this box gets its true
+    // EXECUTION host from the fleet snapshot, so a session dispatched to a peer is
+    // read on that peer instead of dead-ending on the local stub (PHNX-3890). The
+    // read is best-effort: an absent/cold snapshot leaves the row untouched and the
+    // fleet fan-out in resolveSessionMetadataValue supplies the owner instead.
+    let fleetExecMachine;
+    try {
+        fleetExecMachine = fleetExecutionMachineById(loadFleet());
+    }
+    catch {
+        fleetExecMachine = new Map();
+    }
+    const match = (metas) => resolveIndexedMetadataRows(applyScopeFilters(reconcileLiveMetaMachine(metas, fleetExecMachine, self), scope), selector, scope);
     try {
         const cached = liveSessionMetas((await load()).sessions, self, Date.now());
         const hit = match(cached);
@@ -4898,16 +4964,24 @@ export async function liveMetadataMatches(selector, scope, self, deps = {}) {
  * Full UUIDs hit the local SQLite index without any SSH fan-out. */
 export async function resolveSessionMetadataValue(selector, scope = {}, deps = { gatherRemoteList }) {
     const localMatches = await computeLocalMetadataMatches(selector, scope, deps);
+    const localMachine = machineId();
     // A full-UUID local hit resolves with ZERO SSH: a UUID is globally unique, so
     // finding it locally is the whole answer and no peer is dialed. (A label is
     // NOT resolved local-only here — it can collide with a same-label session on a
     // peer, so it must consult the fleet; see isDefinitiveMatch, RUSH-2203.) The
     // local index lookup is synchronous and completes before any fan-out spawns,
     // so this local hit never waits on a peer.
+    //
+    // "Found it locally" must mean this box can actually ANSWER for it, though —
+    // see isLocallyDefinitiveMatch. A transcript-less launcher shim for a session
+    // executing on a peer is a local row that is not a local answer, and
+    // short-circuiting on it skipped the one fan-out that could have named the
+    // owner (PHNX-3890).
     if (FULL_SESSION_ID_RE.test(selector)) {
         const localOutcome = metadataResolveOutcome(localMatches, { sessions: [], unreachable: [] }, selector);
-        if (localOutcome.kind === 'resolved')
+        if (localOutcome.kind === 'resolved' && isLocallyDefinitiveMatch(localOutcome.session, localMachine)) {
             return localOutcome;
+        }
     }
     if (scope.local === true)
         return metadataResolveOutcome(localMatches, { sessions: [], unreachable: [] }, selector);
@@ -4920,7 +4994,7 @@ export async function resolveSessionMetadataValue(selector, scope = {}, deps = {
         const remote = await deps.gatherRemoteList(forwarded, scope.hosts, selectorAllowsEarlyExit(selector)
             ? { isDefinitive: (session) => isDefinitiveMatch(session, selector) }
             : undefined);
-        return metadataResolveOutcome(localMatches, remote, selector);
+        return metadataResolveOutcome(preferOwnerAttribution(localMatches, remote.sessions, localMachine), remote, selector);
     }
     catch (error) {
         return metadataResolveOutcome(localMatches, { sessions: [], unreachable: [error?.message ?? 'fleet fan-out'] }, selector);

package/dist/lib/account-registry.js

@@ -187,11 +187,32 @@ function nativeRowsForNameOrId(meta, name) {
         return [];
     return nativeIdentityRows(meta, found.agent, found.identityKey);
 }
-function assertUniqueUnifiedName(name, meta, doc, exceptIds) {
+/**
+ * Native label names are unique per HARNESS, not globally (PHNX-3887).
+ *
+ * One human identity is commonly signed into several harnesses —
+ * `muqsitnawaz@icloud.com` is a claude login AND a codex login AND a grok login.
+ * A global namespace let whichever harness was labelled first squat the good
+ * name, forcing prefixed junk (`cxicloud`, `gkicloud`) on the rest. Nothing is
+ * actually ambiguous at the point of use: the selector is `<harness>#<label>`,
+ * and `findUnifiedAccount` already disambiguates via `preferAgent`.
+ *
+ * Pass `agent` to scope the check to that harness. Omit it for management
+ * lookups with no harness in hand (rename/remove), which keep the old
+ * fleet-wide check so a rename cannot collide with an unrelated harness's row.
+ *
+ * Provider (non-native) accounts stay globally unique — they are selected by
+ * bare name via `--account`, with no harness to scope them by.
+ */
+function assertUniqueUnifiedName(name, meta, doc, exceptIds, agent) {
     const needle = name.toLowerCase();
-    const nativeHits = listNativeAccounts(meta).filter(account => account.id === name || account.name.toLowerCase() === needle || account.identityLabel?.toLowerCase() === needle);
-    if (nativeHits.some(account => !exceptIds?.has(account.id)))
-        throw new Error(`Account '${name}' already exists.`);
+    const nativeHits = listNativeAccounts(meta).filter(account => (agent === undefined || account.agent === agent)
+        && (account.id === name || account.name.toLowerCase() === needle || account.identityLabel?.toLowerCase() === needle));
+    if (nativeHits.some(account => !exceptIds?.has(account.id))) {
+        throw new Error(agent === undefined
+            ? `Account '${name}' already exists.`
+            : `Account '${name}' already exists for the ${agent} harness.`);
+    }
     // Same laziness as findUnifiedAccount: a native row that already owns this
     // name (even one we are mutating) means we never open the provider store.
     if (nativeHits.length > 0)
@@ -203,7 +224,7 @@ function assertUniqueUnifiedName(name, meta, doc, exceptIds) {
 export function addNativeAccount(name, agent, identityKey, identityLabel, scope) {
     assertNativeLabel(name);
     const meta = readMeta();
-    assertUniqueUnifiedName(name, meta);
+    assertUniqueUnifiedName(name, meta, undefined, undefined, agent);
     const duplicate = listNativeAccounts(meta).find(account => account.agent === agent && account.identityKey === identityKey);
     if (duplicate)
         throw new Error(`This ${agent} login is already named '${duplicate.name}'.`);
@@ -240,7 +261,7 @@ export function labelNativeAccount(agent, identityKey, identityLabel, label, sco
     assertNativeLabel(resolvedLabel);
     const meta = readMeta();
     const matches = nativeIdentityRows(meta, agent, identityKey);
-    assertUniqueUnifiedName(resolvedLabel, meta, undefined, new Set(matches.map(account => account.id)));
+    assertUniqueUnifiedName(resolvedLabel, meta, undefined, new Set(matches.map(account => account.id)), agent);
     if (matches.length === 0)
         return addNativeAccount(resolvedLabel, agent, identityKey, identityLabel, scope);
     // Sweep every row for this identity (PHNX-3206), routing the whole sweep to the

package/dist/lib/cloud/rush.d.ts

@@ -7,7 +7,7 @@
 import type { CloudProvider, CloudTask, CloudTaskStatus, CloudEvent, DispatchOptions, ProviderCapabilities, ImageAttachment, SkillRef } from './types.js';
 /**
  * Returns true when ~/.rush/user.yaml exists, carries an access_token, and
- * the token has not passed its expires_at timestamp (Unix seconds). A missing
+ * the token has not passed its expires_at timestamp (Unix milliseconds). A missing
  * expires_at, or `expires_at: 0` (a non-expiring Phoenix `pid_` bearer), is
  * treated as non-expired (see isRushSessionExpired, PHNX-3645). Pass yamlPath
  * to override the default path in tests.

package/dist/lib/cloud/rush.js

@@ -19,7 +19,7 @@ const PROXY_BASE = process.env.RUSH_PROXY_BASE ?? 'https://api.prix.dev';
 const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
 /**
  * Returns true when ~/.rush/user.yaml exists, carries an access_token, and
- * the token has not passed its expires_at timestamp (Unix seconds). A missing
+ * the token has not passed its expires_at timestamp (Unix milliseconds). A missing
  * expires_at, or `expires_at: 0` (a non-expiring Phoenix `pid_` bearer), is
  * treated as non-expired (see isRushSessionExpired, PHNX-3645). Pass yamlPath
  * to override the default path in tests.
@@ -58,7 +58,7 @@ export function readToken(yamlPath = USER_YAML) {
     }
     const expiresAt = data.session?.expires_at;
     if (isRushSessionExpired(expiresAt)) {
-        const expiredAt = new Date(expiresAt * 1000).toISOString();
+        const expiredAt = new Date(expiresAt).toISOString();
         throw new Error(`Rush session expired at ${expiredAt}. Run \`rush login\` to refresh.`);
     }
     return token;

package/dist/lib/computer/computer-rpc.d.ts

@@ -25,10 +25,15 @@ export declare function resolveTcpEndpoint(): {
     port: number;
     token: string | null;
 } | null;
+export declare function resolveVncEndpoint(): {
+    host: string;
+    port: number;
+    password: string;
+} | null;
 export declare function openComputerClient(): ComputerClient;
 export declare const RPC_TIMEOUT_MS = 30000;
 export declare function resolveRpcTimeoutMs(env: string | undefined): number;
 export declare function describeTransport(): {
-    kind: 'socket' | 'stdio' | 'tcp' | 'none';
+    kind: 'socket' | 'stdio' | 'tcp' | 'vnc' | 'none';
     path: string | null;
 };

package/dist/lib/computer/computer-rpc.js

@@ -17,6 +17,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
 import { getHelpersDir, getLogsDir, getUserPermissionsDir, getPermissionsDir } from '../state.js';
+import { RfbClient, parseVncEndpoint } from './rfb-client.js';
 // Resolve the socket path used by the launchd-managed daemon. Internal
 // scratch — lives under getHelpersDir() (~/.agents/.cache/helpers/),
 // matching browser.sock.
@@ -209,11 +210,28 @@ export function resolveTcpEndpoint() {
     const token = process.env.COMPUTER_HELPER_TOKEN;
     return { host: hostPart || '127.0.0.1', port, token: token && token.length > 0 ? token : null };
 }
+// Resolve the VNC/RFB endpoint for driving a remote GUI desktop over the RFB
+// protocol (an x11vnc/Xvnc server — e.g. a headless Linux desktop or an LXD
+// container exposing x11vnc on the host's Tailscale IP). COMPUTER_HELPER_VNC is
+// "host:port" (port defaults to 5901); COMPUTER_HELPER_VNC_PASSWORD is the VNC
+// password. Unlike the native helpers this transport carries a framebuffer, not
+// an accessibility tree, so it is coordinate-based (see rfb-client.ts).
+export function resolveVncEndpoint() {
+    const parsed = parseVncEndpoint(process.env.COMPUTER_HELPER_VNC);
+    if (!parsed)
+        return null;
+    return { ...parsed, password: process.env.COMPUTER_HELPER_VNC_PASSWORD ?? '' };
+}
 // Pick the best transport. Precedence:
-//   1. COMPUTER_HELPER_TCP -> the Windows daemon over a (tunneled) TCP port.
-//   2. the macOS launchd socket if it exists.
-//   3. spawning the helper as a subprocess (legacy/dev fallback).
+//   1. COMPUTER_HELPER_VNC  -> an RFB/VNC desktop (Linux GUI over the wire).
+//   2. COMPUTER_HELPER_TCP  -> the Windows daemon over a (tunneled) TCP port.
+//   3. the macOS launchd socket if it exists.
+//   4. spawning the helper as a subprocess (legacy/dev fallback).
 export function openComputerClient() {
+    const vnc = resolveVncEndpoint();
+    if (vnc) {
+        return new RfbClient(vnc.host, vnc.port, vnc.password);
+    }
     const tcp = resolveTcpEndpoint();
     if (tcp) {
         return new TcpClient(tcp.host, tcp.port, tcp.token);
@@ -415,6 +433,8 @@ class StdioClient extends BaseClient {
 // .app) must not be told "no transport". `path` is null: the endpoint is an
 // env-configured host:port, not an on-disk path.
 export function describeTransport() {
+    if (resolveVncEndpoint())
+        return { kind: 'vnc', path: null };
     if (resolveTcpEndpoint())
         return { kind: 'tcp', path: null };
     const sockPath = resolveSocketPath();

package/dist/lib/computer/des.d.ts

@@ -0,0 +1 @@
+export declare function desEncryptBlock(key8: Buffer, block8: Buffer): Buffer;

package/dist/lib/computer/des.js

@@ -0,0 +1,114 @@
+// Minimal, dependency-free single-block DES (ECB) — used only for VNC
+// authentication's challenge/response. Node 24 ships OpenSSL 3, whose DES lives
+// in the legacy provider that is off by default, so `createCipheriv('des-ecb')`
+// throws `digital envelope routines::unsupported`. VNC clients have always
+// bundled their own DES for exactly this reason. This is a textbook FIPS-46 DES
+// implementation over bit arrays — verified against the standard test vector in
+// des.test.ts. It encrypts one 8-byte block; VNC auth encrypts the two halves
+// of the 16-byte challenge independently (see rfb-client.ts).
+const IP = [
+    58, 50, 42, 34, 26, 18, 10, 2, 60, 52, 44, 36, 28, 20, 12, 4,
+    62, 54, 46, 38, 30, 22, 14, 6, 64, 56, 48, 40, 32, 24, 16, 8,
+    57, 49, 41, 33, 25, 17, 9, 1, 59, 51, 43, 35, 27, 19, 11, 3,
+    61, 53, 45, 37, 29, 21, 13, 5, 63, 55, 47, 39, 31, 23, 15, 7,
+];
+const FP = [
+    40, 8, 48, 16, 56, 24, 64, 32, 39, 7, 47, 15, 55, 23, 63, 31,
+    38, 6, 46, 14, 54, 22, 62, 30, 37, 5, 45, 13, 53, 21, 61, 29,
+    36, 4, 44, 12, 52, 20, 60, 28, 35, 3, 43, 11, 51, 19, 59, 27,
+    34, 2, 42, 10, 50, 18, 58, 26, 33, 1, 41, 9, 49, 17, 57, 25,
+];
+const E = [
+    32, 1, 2, 3, 4, 5, 4, 5, 6, 7, 8, 9, 8, 9, 10, 11, 12, 13, 12, 13, 14, 15, 16, 17,
+    16, 17, 18, 19, 20, 21, 20, 21, 22, 23, 24, 25, 24, 25, 26, 27, 28, 29, 28, 29, 30, 31, 32, 1,
+];
+const P = [
+    16, 7, 20, 21, 29, 12, 28, 17, 1, 15, 23, 26, 5, 18, 31, 10,
+    2, 8, 24, 14, 32, 27, 3, 9, 19, 13, 30, 6, 22, 11, 4, 25,
+];
+const PC1 = [
+    57, 49, 41, 33, 25, 17, 9, 1, 58, 50, 42, 34, 26, 18, 10, 2, 59, 51, 43, 35, 27, 19, 11, 3, 60, 52, 44, 36,
+    63, 55, 47, 39, 31, 23, 15, 7, 62, 54, 46, 38, 30, 22, 14, 6, 61, 53, 45, 37, 29, 21, 13, 5, 28, 20, 12, 4,
+];
+const PC2 = [
+    14, 17, 11, 24, 1, 5, 3, 28, 15, 6, 21, 10, 23, 19, 12, 4, 26, 8, 16, 7, 27, 20, 13, 2,
+    41, 52, 31, 37, 47, 55, 30, 40, 51, 45, 33, 48, 44, 49, 39, 56, 34, 53, 46, 42, 50, 36, 29, 32,
+];
+const SHIFTS = [1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1];
+const SBOX = [
+    [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7, 0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8, 4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0, 15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13],
+    [15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10, 3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5, 0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15, 13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9],
+    [10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8, 13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1, 13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7, 1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12],
+    [7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15, 13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9, 10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4, 3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14],
+    [2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9, 14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6, 4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14, 11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3],
+    [12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11, 10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8, 9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6, 4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13],
+    [4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1, 13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6, 1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2, 6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12],
+    [13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7, 1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2, 7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8, 2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11],
+];
+function bytesToBits(buf) {
+    const bits = [];
+    for (let i = 0; i < buf.length; i++) {
+        for (let b = 7; b >= 0; b--)
+            bits.push((buf[i] >> b) & 1);
+    }
+    return bits;
+}
+function bitsToBytes(bits) {
+    const out = Buffer.alloc(bits.length / 8);
+    for (let i = 0; i < out.length; i++) {
+        let byte = 0;
+        for (let b = 0; b < 8; b++)
+            byte = (byte << 1) | bits[i * 8 + b];
+        out[i] = byte;
+    }
+    return out;
+}
+function permute(bits, table) {
+    return table.map((pos) => bits[pos - 1]);
+}
+function keySchedule(key8) {
+    const keyBits = bytesToBits(key8);
+    const pc1 = permute(keyBits, PC1);
+    let c = pc1.slice(0, 28);
+    let d = pc1.slice(28, 56);
+    const subkeys = [];
+    for (let round = 0; round < 16; round++) {
+        const s = SHIFTS[round];
+        c = c.slice(s).concat(c.slice(0, s));
+        d = d.slice(s).concat(d.slice(0, s));
+        subkeys.push(permute(c.concat(d), PC2));
+    }
+    return subkeys;
+}
+function feistel(r, subkey) {
+    const expanded = permute(r, E);
+    const xored = expanded.map((bit, i) => bit ^ subkey[i]);
+    const out = [];
+    for (let box = 0; box < 8; box++) {
+        const chunk = xored.slice(box * 6, box * 6 + 6);
+        const row = (chunk[0] << 1) | chunk[5];
+        const col = (chunk[1] << 3) | (chunk[2] << 2) | (chunk[3] << 1) | chunk[4];
+        const val = SBOX[box][row * 16 + col];
+        for (let b = 3; b >= 0; b--)
+            out.push((val >> b) & 1);
+    }
+    return permute(out, P);
+}
+// Encrypt one 8-byte block with DES-ECB under an 8-byte key.
+export function desEncryptBlock(key8, block8) {
+    if (key8.length !== 8)
+        throw new Error(`des key must be 8 bytes, got ${key8.length}`);
+    if (block8.length !== 8)
+        throw new Error(`des block must be 8 bytes, got ${block8.length}`);
+    const subkeys = keySchedule(key8);
+    const bits = permute(bytesToBits(block8), IP);
+    let l = bits.slice(0, 32);
+    let r = bits.slice(32, 64);
+    for (let round = 0; round < 16; round++) {
+        const f = feistel(r, subkeys[round]);
+        const next = l.map((bit, i) => bit ^ f[i]);
+        l = r;
+        r = next;
+    }
+    return bitsToBytes(permute(r.concat(l), FP));
+}