@phnx-labs/agents-cli 1.22.73 → 1.22.75

package/dist/lib/daemon-webhooks.js

@@ -18,6 +18,7 @@ import * as yaml from 'yaml';
 import { exec } from 'child_process';
 import { getDaemonConfigDir, getRuntimeStateDir } from './state.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
+import { closeServerBounded } from './secrets/agent.js';
 import { readAndResolveBundleEnv } from './secrets/bundles.js';
 import { startWebhookServer, createFileDeliveryStore, waitForListening } from './triggers/webhook.js';
 import { buildFunnelUpCommand, FUNNEL_PORTS } from './funnel.js';
@@ -195,8 +196,13 @@ export async function startHostedWebhookReceivers(opts) {
                     log('WARN', `webhook ${webhook.source}:${webhook.event} dispatch failed after ack: ${err.message}`);
                 },
             });
+            const sockets = new Set();
+            server.on('connection', (socket) => {
+                sockets.add(socket);
+                socket.once('close', () => sockets.delete(socket));
+            });
             await waitForListening(server);
-            servers.push(server);
+            servers.push({ server, sockets });
             log('INFO', `webhook receiver bound on 127.0.0.1:${port} (bundle ${receiver.bundle})`);
             if (receiver.funnel)
                 reconcileFunnel(receiver.funnel.publicPort, port, log);
@@ -210,6 +216,13 @@ export async function startHostedWebhookReceivers(opts) {
     }
     return {
         count: servers.length,
-        close: () => Promise.all(servers.map((s) => new Promise((resolve) => s.close(() => resolve())))).then(() => undefined),
+        close: () => Promise.all(servers.map(async ({ server, sockets }) => {
+            // Stop accepting first, then force every persistent HTTP connection
+            // closed so keep-alive cannot hold daemon shutdown open indefinitely.
+            const closing = closeServerBounded(server);
+            for (const socket of sockets)
+                socket.destroy();
+            await closing;
+        })).then(() => undefined),
     };
 }

package/dist/lib/fleet-shared-repo-sync.d.ts

@@ -21,6 +21,18 @@ export interface FleetSharedRepoSyncResult {
     timedOut: boolean;
     skipped: string | null;
     error: string | null;
+    /**
+     * Untracked working-tree files that collided with origin and were dropped
+     * (byte-identical to origin) before rebasing. See clearCollidingUntracked.
+     */
+    untrackedCleared?: number;
+    /**
+     * Untracked working-tree files that collided with origin, differed from it,
+     * and were moved to untrackedBackupDir before rebasing.
+     */
+    untrackedBackedUp?: string[];
+    /** Directory the differing untracked collisions were moved to, if any. */
+    untrackedBackupDir?: string;
 }
 /** Run one real process asynchronously with a hard wall-clock/process-tree bound. */
 export declare function runBoundedProcess(command: string, args: string[], options: {

package/dist/lib/fleet-shared-repo-sync.js

@@ -161,6 +161,72 @@ function retainedAutostash(stashList, objectId) {
         ref: null,
     };
 }
+/**
+ * `git rebase` checks out its base (origin/<branch>) and aborts when an
+ * untracked working-tree file would be overwritten by a file that origin
+ * tracks. `--autostash` only sets aside *tracked* changes, so these untracked
+ * collisions wedge the rebase on every sync and the device silently falls
+ * hundreds of commits behind — the fleet-wide drift root cause (PHNX-3923).
+ *
+ * In this shared-state repo an untracked file that also exists on origin is a
+ * stale local snapshot: the canonical copy is on origin and every device
+ * republishes its own state (this device's own owned file is already committed
+ * before we get here, so it is tracked and never appears below). Drop the ones
+ * byte-identical to origin (lossless) and move any that differ into a backup
+ * dir beside the repo root — outside the repo's tracked tree, so the move
+ * cannot create a fresh collision — so nothing is silently destroyed. Then let
+ * the rebase check out origin's version. A file we cannot clear is left in
+ * place; the rebase may still abort, no worse than today and never losing data.
+ */
+async function clearCollidingUntracked(git, root, branch) {
+    const others = await git(['ls-files', '--others', '--exclude-standard', '-z']);
+    if (others.code !== 0)
+        return { error: others };
+    const relPaths = others.stdout.split('\0').filter(Boolean);
+    let cleared = 0;
+    const backedUp = [];
+    let backupDir = null;
+    for (const rel of relPaths) {
+        // rev-parse doubles as the "does origin track this path" test (non-zero =
+        // absent) — only paths origin tracks are overwritten by the rebase checkout.
+        const originHash = await git(['rev-parse', `origin/${branch}:${rel}`]);
+        if (originHash.code !== 0 || !originHash.stdout.trim())
+            continue;
+        const abs = path.join(root, rel);
+        // Byte-exact identity via git blob SHAs. Comparing UTF-8-decoded strings
+        // would collapse distinct invalid bytes to U+FFFD and could delete
+        // non-identical content. `--no-filters` hashes the raw on-disk bytes (no
+        // clean/autocrlf normalization), so `identical` is true only when the local
+        // bytes exactly equal origin's stored blob — never a filter-normalized
+        // near-match. A hash-object failure (unreadable / vanished under a
+        // concurrent writer) means "leave it in place".
+        const localHash = await git(['hash-object', '--no-filters', '--', abs]);
+        if (localHash.code !== 0 || !localHash.stdout.trim())
+            continue;
+        const identical = originHash.stdout.trim() === localHash.stdout.trim();
+        try {
+            if (identical) {
+                fs.rmSync(abs, { force: true });
+                cleared++;
+            }
+            else {
+                if (!backupDir) {
+                    // A sibling of the repo root: outside the tracked tree (so the move
+                    // cannot create a fresh collision) yet colocated for easy recovery.
+                    backupDir = path.join(`${root}-fleet-sync-backups`, String(Date.now()));
+                }
+                const dest = path.join(backupDir, rel);
+                fs.mkdirSync(path.dirname(dest), { recursive: true });
+                fs.renameSync(abs, dest);
+                backedUp.push(rel);
+            }
+        }
+        catch {
+            // Could not clear this collision; leave it in place.
+        }
+    }
+    return { cleared, backedUp, backupDir };
+}
 async function performFleetSharedRepoSync(root, device, timeoutMs) {
     if (!fs.existsSync(path.join(root, '.git'))) {
         return {
@@ -201,29 +267,57 @@ async function performFleetSharedRepoSync(root, device, timeoutMs) {
     }
     const ownedFile = fleetSharedStatePath(device, root);
     const relativeOwnedFile = path.relative(root, ownedFile).split(path.sep).join('/');
+    // The central `agents.yaml` is fleet-shared state too — `agents accounts label`
+    // writes version-scoped native account rows there (lib/state.ts writeMetaUnlocked),
+    // as a plain file write with no commit. Publishing only the per-device file and
+    // then `rebase --autostash`-ing over a dirty central file silently destroyed
+    // those labels: every box lost its account labels on its next daemon publish
+    // (PHNX-3887). Commit it alongside the device doc so the rebase carries the
+    // rows instead of stashing them, which is also what `accounts label --help`
+    // already promises ("labels live on the central account rows in agents.yaml,
+    // which repo push/pull already syncs fleet-wide").
+    const centralFile = path.join(root, 'agents.yaml');
+    const publishPaths = [relativeOwnedFile];
+    if (fs.existsSync(centralFile))
+        publishPaths.push('agents.yaml');
+    const existingPaths = publishPaths.filter(rel => fs.existsSync(path.join(root, rel)));
     let committed = false;
-    if (fs.existsSync(ownedFile)) {
-        const status = await git(['status', '--porcelain=v1', '--', relativeOwnedFile]);
+    if (existingPaths.length > 0) {
+        const status = await git(['status', '--porcelain=v1', '--', ...existingPaths]);
         if (status.code !== 0)
             return failure('git status', status);
         if (status.stdout.trim()) {
-            const add = await git(['add', '--', relativeOwnedFile]);
+            const add = await git(['add', '--', ...existingPaths]);
             if (add.code !== 0)
                 return failure('git add', add);
             const commit = await git([
                 '-c', 'commit.gpgsign=false',
                 'commit', '--no-verify', '-m', `chore(devices): publish ${device} daemon state`,
-                '--', relativeOwnedFile,
+                '--', ...existingPaths,
             ]);
             if (commit.code !== 0)
                 return failure('git commit', commit);
             committed = true;
         }
     }
+    let untrackedCleared = 0;
+    const untrackedBackedUp = [];
+    let untrackedBackupDir;
     for (let attempt = 1; attempt <= FLEET_SHARED_REPO_PUSH_ATTEMPTS; attempt++) {
         const fetch = await git(['fetch', 'origin']);
         if (fetch.code !== 0)
             return { ...failure('git fetch', fetch), committed };
+        // Untracked files that origin tracks would abort the rebase's checkout
+        // (autostash only covers tracked changes). Clear them first — this is the
+        // fleet-drift root cause (PHNX-3923).
+        const reconcile = await clearCollidingUntracked(git, root, branch);
+        if ('error' in reconcile) {
+            return { ...failure('git ls-files --others', reconcile.error), committed };
+        }
+        untrackedCleared += reconcile.cleared;
+        untrackedBackedUp.push(...reconcile.backedUp);
+        if (reconcile.backupDir)
+            untrackedBackupDir = reconcile.backupDir;
         // Keep enough of the same wall-clock bound available to remove a botched
         // autostash pop from the operator's live checkout before returning.
         const rebase = await git(['rebase', '--autostash', `origin/${branch}`], FLEET_SHARED_REPO_REBASE_CLEANUP_RESERVE_MS);
@@ -283,6 +377,9 @@ async function performFleetSharedRepoSync(root, device, timeoutMs) {
                 timedOut: false,
                 skipped: null,
                 error: null,
+                untrackedCleared,
+                untrackedBackedUp,
+                untrackedBackupDir,
             };
         }
         if (attempt === FLEET_SHARED_REPO_PUSH_ATTEMPTS || !isPushRace(push)) {

package/dist/lib/project-resources.d.ts

@@ -7,7 +7,11 @@ export declare function projectAgentRoot(projectRoot: string, agent: AgentId): s
 export declare function syncProjectResourcesToAgent(agent: AgentId, version: string, projectAgentsDir: string): ProjectResourceSyncResult;
 /**
  * Turn the manifest's managed paths (relative to agentRoot) into anchored,
- * POSIX, projectRoot-relative `.gitignore` entries. Two guards keep it honest:
+ * POSIX, `referenceRoot`-relative ignore entries. `referenceRoot` is the
+ * directory the anchored `/…` patterns resolve against — the git worktree root
+ * for a `.git/info/exclude` block, since git anchors info/exclude patterns at
+ * the top of the working tree (not at the harness dir). Two guards keep it
+ * honest:
  *   - drop any path that escapes the harness config dir (e.g. grok writes
  *     commands back into the tracked `.agents/` tree via a `../` subdir —
  *     ignoring that would hide tracked source; separate bug, PHNX-3718);
@@ -16,7 +20,7 @@ export declare function syncProjectResourcesToAgent(agent: AgentId, version: str
  *     these never masks a hand-authored or committed file (e.g. a repo that
  *     commits its own `.claude/CLAUDE.md` keeps it — it is not in the manifest).
  */
-export declare function managedGitignoreEntries(agentRoot: string, projectRoot: string, managed: string[]): string[];
+export declare function managedGitignoreEntries(agentRoot: string, referenceRoot: string, managed: string[]): string[];
 /**
  * One human line for the files a project sync left alone because you already
  * wrote them. This is the normal steady state — every sync of a project whose

package/dist/lib/project-resources.js

@@ -1,3 +1,4 @@
+import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import { AGENTS, agentConfigDirName, isAgentHardDeprecated } from './agents.js';
@@ -39,10 +40,14 @@ export function syncProjectResourcesToAgent(agent, version, projectAgentsDir) {
         // .agents/{commands,skills,…}, refreshed on every launch. Left untracked it
         // dirties `git status` and can block `git merge`/`checkout` when a stray
         // commit of the same path collides. So the generator owns its ignore rule:
-        // reconcile a per-agent marker block in <projectRoot>/.gitignore listing
-        // exactly the paths it manages. Passing the manifest set (empty when a sync
-        // clears a harness) also prunes the block. See PHNX-3717.
-        reconcileProjectGitignore(projectRoot, agent, agentRoot, Array.from(next).sort());
+        // reconcile a per-agent marker block listing exactly the paths it manages.
+        // That block lives in `.git/info/exclude` — git's per-clone, uncommitted
+        // ignore file — NOT the tracked `.gitignore`: these entries are never
+        // committed upstream, so writing them into `.gitignore` left every launch
+        // with a permanent `M .gitignore` that blocked `git pull` (PHNX-3718).
+        // Passing the manifest set (empty when a sync clears a harness) also prunes
+        // the block. See PHNX-3717 for the self-managed-ignore feature.
+        reconcileManagedIgnore(projectRoot, agent, agentRoot, Array.from(next).sort());
     }
     return result;
 }
@@ -75,7 +80,11 @@ function gitignoreMarkers(agent) {
 }
 /**
  * Turn the manifest's managed paths (relative to agentRoot) into anchored,
- * POSIX, projectRoot-relative `.gitignore` entries. Two guards keep it honest:
+ * POSIX, `referenceRoot`-relative ignore entries. `referenceRoot` is the
+ * directory the anchored `/…` patterns resolve against — the git worktree root
+ * for a `.git/info/exclude` block, since git anchors info/exclude patterns at
+ * the top of the working tree (not at the harness dir). Two guards keep it
+ * honest:
  *   - drop any path that escapes the harness config dir (e.g. grok writes
  *     commands back into the tracked `.agents/` tree via a `../` subdir —
  *     ignoring that would hide tracked source; separate bug, PHNX-3718);
@@ -84,7 +93,7 @@ function gitignoreMarkers(agent) {
  *     these never masks a hand-authored or committed file (e.g. a repo that
  *     commits its own `.claude/CLAUDE.md` keeps it — it is not in the manifest).
  */
-export function managedGitignoreEntries(agentRoot, projectRoot, managed) {
+export function managedGitignoreEntries(agentRoot, referenceRoot, managed) {
     const root = path.resolve(agentRoot);
     const entries = new Set();
     for (const rel of managed) {
@@ -93,31 +102,63 @@ export function managedGitignoreEntries(agentRoot, projectRoot, managed) {
         const abs = path.resolve(agentRoot, rel);
         if (abs !== root && !abs.startsWith(root + path.sep))
             continue;
-        const fromProject = toPosixRel(path.relative(projectRoot, abs));
-        if (!fromProject || fromProject === '..' || fromProject.startsWith('../'))
+        const fromRoot = toPosixRel(path.relative(referenceRoot, abs));
+        if (!fromRoot || fromRoot === '..' || fromRoot.startsWith('../'))
             continue;
-        entries.add('/' + fromProject);
+        entries.add('/' + fromRoot);
     }
     return Array.from(entries).sort();
 }
-/** True when `dir` is inside a git working tree — walks up to the filesystem
- *  root looking for a `.git` entry. `projectRoot` (the parent of the resolved
- *  `.agents/` dir) is not guaranteed to be the git root: a monorepo subdir can
- *  carry its own `.agents/` while `.git` lives several levels up. A root-only
- *  check would silently no-op the whole feature there. */
-function isInsideGitRepo(dir) {
-    let cur = path.resolve(dir);
-    for (;;) {
-        if (pathExists(path.join(cur, '.git')))
-            return true;
-        const parent = path.dirname(cur);
-        if (parent === cur)
-            return false;
-        cur = parent;
+/**
+ * Ask git where the local, per-clone ignore file lives and where the worktree
+ * top is, resolved robustly for every layout by delegating to git itself:
+ *   - normal repo → `<root>/.git/info/exclude`;
+ *   - monorepo subdir → the same file even when `.git` is several levels up
+ *     (`projectRoot`, the parent of `.agents/`, is not the git root);
+ *   - linked worktree / submodule → `.git` is a FILE (`gitdir: …`), and
+ *     `--git-path info/exclude` resolves to the shared COMMON dir so the block
+ *     applies across every worktree.
+ * `--path-format=absolute` forces absolute paths regardless of the `-C` cwd.
+ * One `git rev-parse` yields both paths (exclude path first, worktree root
+ * second), so the launch path spawns git ONCE, not twice.
+ * Returns null when `dir` is not inside a git repo (git exits non-zero), which
+ * fails the feature open (no-op) exactly like the old in-tree check did.
+ */
+function resolveGitExcludeTarget(dir) {
+    try {
+        const out = execFileSync('git', ['-C', dir, 'rev-parse', '--path-format=absolute', '--git-path', 'info/exclude', '--show-toplevel'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const [excludePath, worktreeRoot] = out.split('\n').map((l) => l.trim());
+        if (!excludePath || !worktreeRoot)
+            return null;
+        // Fail open on anything that isn't a clean pair of ABSOLUTE paths. A git
+        // older than 2.31 (predates `--path-format`) echoes the unrecognized flag
+        // back on stdout instead of erroring, which would otherwise shift the parse
+        // and have mkdirSync create a stray `--path-format=absolute` dir. The
+        // absolute-path check turns that into a clean no-op.
+        if (!path.isAbsolute(excludePath) || !path.isAbsolute(worktreeRoot))
+            return null;
+        return { excludePath, worktreeRoot };
+    }
+    catch {
+        return null;
+    }
+}
+/** True when git tracks `absPath` in the repo `dir` sits in. */
+function isTrackedByGit(dir, absPath) {
+    try {
+        execFileSync('git', ['-C', dir, 'ls-files', '--error-unmatch', '--', absPath], {
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+        return true;
+    }
+    catch {
+        return false;
     }
 }
 /**
- * Apply this agent's managed block to `.gitignore` content, IN PLACE.
+ * Apply this agent's managed block to ignore-file content, IN PLACE — used both
+ * to write the block into `.git/info/exclude` and to strip a leftover block from
+ * a legacy tracked `.gitignore` (entries `[]` prunes).
  *
  * In-place replacement (not strip-then-append) is load-bearing: appending would
  * move this agent's block behind every other agent's block on each resync, so in
@@ -141,9 +182,11 @@ function applyManagedBlock(content, begin, end, entries) {
         if (entries.length > 0) {
             return [...lines.slice(0, bi), begin, ...entries, end, ...lines.slice(ei + 1)].join('\n');
         }
-        // Prune the block, tidying the blank lines that hugged it. Vestigial on the
-        // reconcileProjectGitignore path (its entries always include the manifest,
-        // so entries.length is never 0 there) — kept for a direct caller/unit test.
+        // Prune the block, tidying the blank lines that hugged it. Unreached on the
+        // reconcileManagedIgnore write path (its entries always include the manifest,
+        // so entries.length is never 0 there), but the load-bearing case for
+        // stripLegacyManagedGitignoreBlock, which calls with entries=[] to migrate a
+        // leftover block out of the tracked .gitignore.
         const before = lines.slice(0, bi);
         const after = lines.slice(ei + 1);
         while (before.length && before[before.length - 1].trim() === '')
@@ -160,30 +203,42 @@ function applyManagedBlock(content, begin, end, entries) {
     return body.length > 0 ? `${body}\n\n${block}\n` : `${block}\n`;
 }
 /**
- * Reconcile a per-agent managed block in `<projectRoot>/.gitignore` so the
- * generated per-harness resource dir never shows as untracked dirt. Idempotent
- * and convergent: replaces the block in place and writes only when the content
- * actually changes, so the launch hot path does not churn the file (or its
- * watchers) every run — even in a project synced by several harnesses. When a
- * sync clears a harness's resources the block does not vanish: it shrinks to the
- * lone `.agents-managed.json` entry (that file still sits in the harness dir and
- * must stay ignored), so the block is only ever fully pruned by hand, never via
- * this call path. Never creates a `.gitignore` outside a git working tree.
+ * Reconcile a per-agent managed block in `.git/info/exclude` so the generated
+ * per-harness resource dir never shows as untracked dirt — WITHOUT dirtying the
+ * tracked `.gitignore`. Idempotent and convergent: replaces the block in place
+ * and writes only when the content actually changes, so the launch hot path does
+ * not churn the file (or its watchers) every run — even in a project synced by
+ * several harnesses. When a sync clears a harness's resources the block does not
+ * vanish: it shrinks to the lone `.agents-managed.json` entry (that file still
+ * sits in the harness dir and must stay ignored), so the block is only ever
+ * fully pruned by hand, never via this call path. Fails open (no-op) outside a
+ * git working tree.
+ *
+ * Also self-heals repos dirtied by the previous behavior: PHNX-3717 wrote these
+ * blocks into `<projectRoot>/.gitignore`, which is never committed upstream, so
+ * every launch left a permanent `M .gitignore` that blocked `git pull`
+ * (PHNX-3718). `stripLegacyManagedGitignoreBlock` removes this agent's leftover
+ * block from that tracked file on the next launch, cleaning the diff instead of
+ * stranding it.
  */
-function reconcileProjectGitignore(projectRoot, agent, agentRoot, managed) {
-    const gitignorePath = path.join(projectRoot, '.gitignore');
-    if (!isInsideGitRepo(projectRoot) && !pathExists(gitignorePath))
-        return;
+function reconcileManagedIgnore(projectRoot, agent, agentRoot, managed) {
+    // Migrate away from the old tracked-.gitignore location first, so an already
+    // dirtied repo cleans itself even if git resolution below fails.
+    stripLegacyManagedGitignoreBlock(projectRoot, agent);
+    const target = resolveGitExcludeTarget(projectRoot);
+    if (!target)
+        return; // not a git repo — fail open
     const { begin, end } = gitignoreMarkers(agent);
     // Ignore the manifest marker file too, not just the synced resources: the
     // sync always writes `<agentRoot>/.agents-managed.json`, so without this the
     // harness dir still shows as untracked in `git status` on the strength of that
     // one file (defeating the whole point). It lives at agentRoot, so it resolves
-    // through the same anchoring + escape guard as any managed path.
-    const entries = managedGitignoreEntries(agentRoot, projectRoot, [MANIFEST_FILE, ...managed]);
+    // through the same anchoring + escape guard as any managed path. Anchored to
+    // the worktree root, since info/exclude patterns resolve against the tree top.
+    const entries = managedGitignoreEntries(agentRoot, target.worktreeRoot, [MANIFEST_FILE, ...managed]);
     let original = '';
     try {
-        original = fs.readFileSync(gitignorePath, 'utf-8');
+        original = fs.readFileSync(target.excludePath, 'utf-8');
     }
     catch {
         original = '';
@@ -191,8 +246,42 @@ function reconcileProjectGitignore(projectRoot, agent, agentRoot, managed) {
     const next = applyManagedBlock(original, begin, end, entries);
     if (next === null || next === original)
         return;
-    const tmp = gitignorePath + '.tmp';
+    fs.mkdirSync(path.dirname(target.excludePath), { recursive: true }); // create info/ if missing
+    const tmp = target.excludePath + '.tmp';
     fs.writeFileSync(tmp, next);
+    fs.renameSync(tmp, target.excludePath);
+}
+/**
+ * Remove this agent's leftover managed block from a tracked `<projectRoot>/
+ * .gitignore` written by the pre-PHNX-3718 behavior. Strips ONLY the fenced
+ * block (leaving every hand-written rule untouched), never creates the file,
+ * and never touches a `.gitignore` that carries no block of ours. If stripping
+ * empties a file we created (its only content was our block), the empty file is
+ * removed when git does not track it — an empty untracked `.gitignore` would
+ * still read as `?? .gitignore` dirt, the very thing this migration clears.
+ */
+function stripLegacyManagedGitignoreBlock(projectRoot, agent) {
+    const gitignorePath = path.join(projectRoot, '.gitignore');
+    let original;
+    try {
+        original = fs.readFileSync(gitignorePath, 'utf-8');
+    }
+    catch {
+        return; // no .gitignore — nothing to migrate
+    }
+    const { begin, end } = gitignoreMarkers(agent);
+    // Empty entries → applyManagedBlock prunes the block; returns `original`
+    // unchanged when there is no block, or null on an orphaned begin marker
+    // (which we refuse to touch rather than truncate the user's rules).
+    const stripped = applyManagedBlock(original, begin, end, []);
+    if (stripped === null || stripped === original)
+        return;
+    if (stripped === '' && !isTrackedByGit(projectRoot, gitignorePath)) {
+        removePath(gitignorePath);
+        return;
+    }
+    const tmp = gitignorePath + '.tmp';
+    fs.writeFileSync(tmp, stripped);
     fs.renameSync(tmp, gitignorePath);
 }
 function removeManagedPath(agentRoot, rel) {

package/dist/lib/rush-session.d.ts

@@ -2,8 +2,16 @@
  * Rush session freshness — the ONE judgment shared by every consumer of
  * ~/.rush/user.yaml (cloud dispatch, cloud session source, secrets sync driver).
  *
- * A Rush session stores `expires_at` as Unix seconds. Two values mean "never
- * expires" and MUST NOT be read as an absolute timestamp:
+ * A Rush session stores `expires_at` as Unix MILLISECONDS — the same unit
+ * rush/cli writes and reads it in (`sessionTokenFresh` in auth_reader.go compares
+ * against `time.Now()...UnixMilli()`), and the same unit the JWT `exp` claim maps
+ * to (`exp * 1000`). So freshness must compare it against `Date.now()` (ms), NOT
+ * `Date.now() / 1000` (seconds). Comparing ms against seconds was PHNX-3805: a
+ * long-expired session (e.g. `expires_at: 1788157222000`) read as `1.788e12 <=
+ * 1.788e9` → always false → never expired, so `agents cloud providers` reported
+ * Rush `available: true` on a dead session and every dispatch failed with a 401.
+ *
+ * Two values mean "never expires" and MUST NOT be read as an absolute timestamp:
  *   - `0`         — an opaque Phoenix `pid_` bearer written by `rush login`;
  *                   `0` = non-expiring by contract (mirrors rush/cli's isFresh,
  *                   the same fix RUSH-1310 landed for the daemon-less freshness

package/dist/lib/rush-session.js

@@ -2,8 +2,16 @@
  * Rush session freshness — the ONE judgment shared by every consumer of
  * ~/.rush/user.yaml (cloud dispatch, cloud session source, secrets sync driver).
  *
- * A Rush session stores `expires_at` as Unix seconds. Two values mean "never
- * expires" and MUST NOT be read as an absolute timestamp:
+ * A Rush session stores `expires_at` as Unix MILLISECONDS — the same unit
+ * rush/cli writes and reads it in (`sessionTokenFresh` in auth_reader.go compares
+ * against `time.Now()...UnixMilli()`), and the same unit the JWT `exp` claim maps
+ * to (`exp * 1000`). So freshness must compare it against `Date.now()` (ms), NOT
+ * `Date.now() / 1000` (seconds). Comparing ms against seconds was PHNX-3805: a
+ * long-expired session (e.g. `expires_at: 1788157222000`) read as `1.788e12 <=
+ * 1.788e9` → always false → never expired, so `agents cloud providers` reported
+ * Rush `available: true` on a dead session and every dispatch failed with a 401.
+ *
+ * Two values mean "never expires" and MUST NOT be read as an absolute timestamp:
  *   - `0`         — an opaque Phoenix `pid_` bearer written by `rush login`;
  *                   `0` = non-expiring by contract (mirrors rush/cli's isFresh,
  *                   the same fix RUSH-1310 landed for the daemon-less freshness
@@ -20,5 +28,6 @@ export function isRushSessionExpired(expiresAt) {
     // `0` (non-expiring pid_ bearer) and a missing value are never expired.
     if (typeof expiresAt !== 'number' || expiresAt === 0)
         return false;
-    return expiresAt <= Date.now() / 1000;
+    // expires_at is Unix milliseconds — compare ms to ms.
+    return expiresAt <= Date.now();
 }

package/dist/lib/secrets/drivers/rush.js

@@ -29,7 +29,7 @@ function readRushToken() {
     }
     const expiresAt = data.session?.expires_at;
     if (isRushSessionExpired(expiresAt)) {
-        const expiredAt = new Date(expiresAt * 1000).toISOString();
+        const expiredAt = new Date(expiresAt).toISOString();
         throw new Error(`Rush session expired at ${expiredAt}. Run \`rush login\` to refresh.`);
     }
     return token;

package/dist/lib/session/cloud.js

@@ -32,7 +32,7 @@ function readToken() {
     }
     const expiresAt = data.session?.expires_at;
     if (isRushSessionExpired(expiresAt)) {
-        const expiredAt = new Date(expiresAt * 1000).toISOString();
+        const expiredAt = new Date(expiresAt).toISOString();
         throw new Error(`Rush session expired at ${expiredAt}. Run \`rush login\` to refresh.`);
     }
     return token;

package/dist/lib/session/live-metadata.d.ts

@@ -13,3 +13,27 @@ export declare function activeSessionToSessionMeta(active: ActiveSession, self:
  * (no id, non-agent kind) are dropped. Order follows the input.
  */
 export declare function liveSessionMetas(active: ActiveSession[], self: string, nowMs: number): SessionMeta[];
+/**
+ * Which box the AGENT of each live session executes on, keyed by lowercased id,
+ * as recovered from the fleet-active snapshot (`agents sessions --active`'s
+ * cross-machine merge). A dispatcher that launched a session running on a peer
+ * has a live shim row locally whose `machine` self-defaulted to itself — the
+ * launch process IS here, the agent is not (PHNX-3890). The fleet snapshot
+ * already reconciled that against the peer's own self-report, so it is the one
+ * place that knows the true execution host without a synced index row (which is
+ * why `foldExecutionMachine` can't recover it: there is no local index row to
+ * join). Only rows the fleet attributes to a real machine are included.
+ */
+export declare function fleetExecutionMachineById(fleet: ActiveSession[]): Map<string, string>;
+/**
+ * Correct a live `SessionMeta` candidate's machine to its true EXECUTION host
+ * using the fleet-active attribution (PHNX-3890). Only a **self-attributed,
+ * transcript-less** row is a candidate for correction — the launcher-shim shape
+ * a dispatcher holds for a session whose agent runs on a peer, which is
+ * indistinguishable from a genuinely-local just-started session by its local
+ * fields alone. A row already attributed to another box, or one carrying a
+ * transcript path, is left untouched. A corrected row is stamped `_remote` so
+ * the read-vs-resume router (`transcriptOnPeerOf`) sends the preview to the
+ * owning peer instead of dead-ending on the local "not indexed here" stub.
+ */
+export declare function reconcileLiveMetaMachine(metas: SessionMeta[], fleetExecutionMachine: Map<string, string>, self: string): SessionMeta[];

package/dist/lib/session/live-metadata.js

@@ -76,3 +76,58 @@ export function liveSessionMetas(active, self, nowMs) {
     }
     return out;
 }
+/**
+ * Which box the AGENT of each live session executes on, keyed by lowercased id,
+ * as recovered from the fleet-active snapshot (`agents sessions --active`'s
+ * cross-machine merge). A dispatcher that launched a session running on a peer
+ * has a live shim row locally whose `machine` self-defaulted to itself — the
+ * launch process IS here, the agent is not (PHNX-3890). The fleet snapshot
+ * already reconciled that against the peer's own self-report, so it is the one
+ * place that knows the true execution host without a synced index row (which is
+ * why `foldExecutionMachine` can't recover it: there is no local index row to
+ * join). Only rows the fleet attributes to a real machine are included.
+ */
+export function fleetExecutionMachineById(fleet) {
+    const byId = new Map();
+    for (const s of fleet) {
+        // The AGENT machine is `machine` (where the transcript/harness lives), NOT
+        // `offloadedFrom` (where the launcher shim runs) — reading follows the
+        // transcript owner, so a would-be reader must reach `machine`.
+        if (!s.sessionId || !s.machine)
+            continue;
+        byId.set(s.sessionId.toLowerCase(), s.machine);
+    }
+    return byId;
+}
+/**
+ * Correct a live `SessionMeta` candidate's machine to its true EXECUTION host
+ * using the fleet-active attribution (PHNX-3890). Only a **self-attributed,
+ * transcript-less** row is a candidate for correction — the launcher-shim shape
+ * a dispatcher holds for a session whose agent runs on a peer, which is
+ * indistinguishable from a genuinely-local just-started session by its local
+ * fields alone. A row already attributed to another box, or one carrying a
+ * transcript path, is left untouched. A corrected row is stamped `_remote` so
+ * the read-vs-resume router (`transcriptOnPeerOf`) sends the preview to the
+ * owning peer instead of dead-ending on the local "not indexed here" stub.
+ */
+export function reconcileLiveMetaMachine(metas, fleetExecutionMachine, self) {
+    return metas.map(meta => {
+        // Already attributed elsewhere, or locally readable — not a self-default.
+        if (meta.machine && meta.machine !== self)
+            return meta;
+        if (meta.filePath)
+            return meta;
+        const exec = fleetExecutionMachine.get(meta.id.toLowerCase());
+        // Only a PEER attribution is positive information. A snapshot entry that
+        // names THIS box cannot be trusted as confirmation, because the snapshot is
+        // a merge that INCLUDES this box's own rows — so for exactly the session
+        // shape being corrected here (no index row to fold from), a `self` entry may
+        // be nothing but an echo of the self-default above, recorded while the
+        // owning peer had not reported yet or was unreachable during that gather.
+        // Treating it as proof would skip the fan-out and dead-end on the local stub
+        // for a session genuinely running elsewhere — the PHNX-3890 bug itself.
+        if (!exec || exec === self)
+            return meta;
+        return { ...meta, machine: exec, _remote: true };
+    });
+}

package/dist/lib/session/remote/remote-list.d.ts

@@ -124,6 +124,8 @@ export declare function resolvePeerTarget(machine: string): Promise<{
  * error, timeout, version-skewed peer with no `--json` preview envelope.
  */
 export declare function fetchPeerPreviewDigest(sessionId: string, machine: string, timeoutMs?: number): Promise<unknown | undefined>;
+/** Parse the JSON envelope returned by `sessions preview --json`. */
+export declare function parsePeerPreviewDigest(parsed: unknown): unknown | undefined;
 /**
  * Run `agents <args>` ON a peer over SSH, attached to this terminal (inherited
  * stdio). `args` is the full arg vector after the binary — callers pass e.g.