@phnx-labs/agents-cli 1.22.83 → 1.22.85

package/dist/lib/account-catalog.js

@@ -3,7 +3,23 @@ import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from './i
 import { readInstallation } from './installations/store.js';
 import { readMeta } from './state.js';
 import { listNativeAccounts, readAccountRegistry } from './account-registry.js';
+import { providerAuthenticatesHarness } from './account-provider-registry.js';
+import { readSlots } from './accounts/slots.js';
+import { harnessWorkerIsPerDevice } from './harness-auth-capabilities.js';
+import { hasKeychainTokenSync, isSecretsTransportError } from './secrets-client.js';
 import { isLaunchableSignedIn as isCredentialLaunchable } from './accounting/rotate.js';
+import { authCacheKey, readAuthHealthCache } from './auth-health.js';
+import { readFleetSharedDeviceStates } from './fleet-shared-state.js';
+import { machineId } from './machine-id.js';
+import { isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
+import { applyUsageHonesty, collectLocalHarnessInventory, } from './devices/harness-inventory.js';
+import { fixFor, } from './signin-badge.js';
+import { renderBar } from './accounting/usage.js';
+import { padToWidth, stringWidth } from './text/width.js';
+export { applyUsageHonesty };
+import chalk from 'chalk';
+/** Compact usage gauge in the USAGE column — same length as the pre-T3 inline bar. */
+const LISTING_USAGE_BAR_LEN = 5;
 /**
  * Strict "is this home actually connected?" — a live CREDENTIAL in that exact
  * version home, not just a metadata identity claim (PHNX-3940). A `.claude.json`
@@ -46,6 +62,28 @@ export async function discoverNativeAccounts() {
     const rows = await collectNativeHomeRows();
     return groupNativeAccountRows(rows.map(r => ({ agent: r.agent, version: r.label, accountKey: r.accountKey, email: r.email, signedIn: r.signedIn })));
 }
+/**
+ * The provider (durable-credential) accounts read through `secrets`, tolerant of
+ * an unreachable standalone. Native OAuth logins never touch `secrets`, so a
+ * missing/broken standalone must NOT take down the whole account view — the
+ * provider section is simply reported unavailable. Only a TRANSPORT-level
+ * failure (missing binary, timeout, non-JSON, spawn error) degrades; a genuine
+ * data error still throws so it is never silently swallowed. DIST-1 holds: there
+ * is no fallback to an embedded engine, the standalone just could not answer.
+ */
+function readProviderRowsTolerant(meta) {
+    try {
+        const rows = Object.values(readAccountRegistry().accounts)
+            .map((account) => toProviderRow(account, meta))
+            .sort((a, b) => a.name.localeCompare(b.name));
+        return { rows, error: null };
+    }
+    catch (err) {
+        if (isSecretsTransportError(err))
+            return { rows: [], error: err };
+        throw err;
+    }
+}
 /** Probe every installed home of every inspectable harness for its native identity. */
 export async function collectNativeHomeRows() {
     const rows = [];
@@ -140,6 +178,19 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
             installations: homes,
             isDefault,
             state: signedIn ? 'connected' : 'reconnect-needed',
+            identityLabel: email ?? account?.name ?? group.identityKey,
+            provisioning: provisioningFor(group.agent),
+            verdict: signedIn ? 'unverified' : 'missing',
+            checkedAt: null,
+            devices: [],
+            usage: null,
+            fix: fixFor({
+                agent: group.agent,
+                verdict: signedIn ? 'unverified' : 'missing',
+                name: account?.name,
+                version: home,
+                provisioning: provisioningFor(group.agent),
+            }),
         });
     }
     // Named accounts first, then default, then a stable display order.
@@ -148,19 +199,382 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
         || Number(b.isDefault) - Number(a.isDefault)
         || a.display.localeCompare(b.display));
 }
-function toProviderRow(account) {
-    return { kind: 'provider', name: account.name, id: account.id, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl };
+function provisioningFor(agent) {
+    return harnessWorkerIsPerDevice(agent) ? 'per-device' : 'portable';
+}
+export function toProviderRow(account, meta) {
+    const harnesses = ALL_AGENT_IDS.filter((agent) => providerAuthenticatesHarness(account.provider, account.auth, agent));
+    const defaults = meta.accounts?.defaults ?? {};
+    const defaultFor = ALL_AGENT_IDS.filter((agent) => {
+        const ref = defaults[agent];
+        return ref === account.name || ref === account.id;
+    });
+    const secretPresent = hasKeychainTokenSync(account.secretRef);
+    return {
+        kind: 'provider',
+        name: account.name,
+        id: account.id,
+        provider: account.provider,
+        auth: account.auth,
+        ...(account.baseUrl ? { baseUrl: account.baseUrl } : {}),
+        harnesses,
+        defaultFor,
+        identityLabel: account.provider,
+        verdict: secretPresent ? 'ready' : 'missing',
+        fix: secretPresent ? null : `agents accounts set-key ${account.name}`,
+    };
 }
 /**
  * Wire the real collectors to the pure builder. This is the canonical
  * account-first read model `view.ts` renders: native identities (account +
- * connection first, release/home secondary) plus the durable provider bundles.
+ * connection first, release/home secondary) plus durable provider credentials.
  */
 export async function loadAccountCatalog() {
     const meta = readMeta();
     const native = buildNativeCatalog(await collectNativeHomeRows(), meta);
-    const provider = Object.values(readAccountRegistry().accounts)
-        .map(toProviderRow)
-        .sort((a, b) => a.name.localeCompare(b.name));
-    return { native, provider };
+    const host = machineId();
+    const auth = readAuthHealthCache();
+    const inventory = await collectLocalHarnessInventory();
+    const inventoryByHome = new Map(inventory.map((row) => [`${row.agent}:${row.version}`, row]));
+    const shared = readSharedAccountVerdicts();
+    const headed = isHeadedDeviceRole(selfConfiguredDeviceRole());
+    const localSlots = readSlots(meta);
+    for (const row of native) {
+        const registered = row.id ? listNativeAccounts(meta).find((account) => account.id === row.id) : undefined;
+        row.provisioning = registered?.provisioning ?? provisioningFor(row.agent);
+        const localHome = row.installations.find((home) => home.label === row.home)
+            ?? row.installations.find((home) => home.signedIn)
+            ?? row.installations[0];
+        const cached = localHome ? auth[authCacheKey(host, row.agent, localHome.label)] : undefined;
+        const slot = row.id ? localSlots[row.id] : undefined;
+        const observation = resolveLocalAccountObservation(slot, cached, localHome?.signedIn === true);
+        const local = {
+            device: host,
+            authMode: observation.authMode
+                ?? (row.provisioning === 'per-device' ? 'per-device' : (headed ? 'native' : 'durable')),
+            verdict: observation.verdict,
+            ...(observation.checkedAt ? { checkedAt: observation.checkedAt } : {}),
+        };
+        // Registered accounts join fleet state on their stable id ONLY — two
+        // accounts may share one email label, so a label join would cross-attribute
+        // one account's revoked verdict to the other. The label index exists solely
+        // for unnamed legacy logins, which have no registry id to key on.
+        const fromFleet = row.id
+            ? (shared.get(`${row.agent}:${row.id}`) ?? [])
+            : (shared.get(`label:${row.agent}:${row.identityLabel}`) ?? []);
+        row.devices = mergeDeviceVerdicts(fromFleet, local);
+        row.verdict = aggregateAccountVerdict(row.provisioning, row.devices);
+        row.checkedAt = newestCheckedAt(row.devices);
+        const honest = applyUsageHonesty(row.verdict, localHome ? (inventoryByHome.get(`${row.agent}:${localHome.label}`)?.quota ?? null) : null);
+        row.verdict = honest.verdict;
+        row.usage = honest.usage;
+        row.fix = fixFor({
+            agent: row.agent,
+            verdict: row.verdict,
+            name: row.name,
+            version: localHome?.label,
+            provisioning: row.provisioning,
+            hasSlot: slot != null,
+        });
+    }
+    const { rows: provider, error } = readProviderRowsTolerant(meta);
+    return error
+        ? { native, provider, secretsUnavailable: { code: error.code, message: error.message } }
+        : { native, provider };
+}
+/**
+ * The one clear line a read-only surface prints when the provider section could
+ * not be read (PHNX-3989) — so a missing/broken standalone is stated plainly
+ * while the native rows and the rest of the output still render. Null when the
+ * catalog is complete. Printed to stderr by the command so it never corrupts
+ * `--json` stdout.
+ */
+export function secretsUnavailableNote(catalog) {
+    const err = catalog.secretsUnavailable;
+    if (!err)
+        return null;
+    return `secrets unavailable (${err.code}) — provider accounts not shown; native logins and the rest are current.`;
+}
+function providerListEntry(row, harness) {
+    return {
+        kind: 'provider',
+        id: row.id,
+        harness,
+        name: row.name,
+        identityLabel: row.identityLabel,
+        isDefault: harness ? row.defaultFor.includes(harness) : false,
+        provisioning: 'portable',
+        verdict: row.verdict,
+        checkedAt: null,
+        devices: [],
+        usage: null,
+        fix: row.fix,
+    };
+}
+/**
+ * Unfiltered JSON emits one entry per harness the credential authenticates
+ * (same `id`, `kind: 'provider'`, each with its own `harness`), plus one
+ * `harness: null` entry for an orphan. A harness filter emits only that
+ * harness's entry. The v2 field set is otherwise unchanged.
+ */
+function providerJsonEntries(row, harness) {
+    if (harness) {
+        return row.harnesses.includes(harness) ? [providerListEntry(row, harness)] : [];
+    }
+    if (row.harnesses.length === 0)
+        return [providerListEntry(row, null)];
+    return row.harnesses.map((agent) => providerListEntry(row, agent));
+}
+export function accountListJson(native, providers = [], harness) {
+    return {
+        version: 2,
+        accounts: [
+            ...native.map((row) => ({
+                kind: 'native',
+                id: row.id ?? row.identityKey,
+                harness: row.agent,
+                name: row.name,
+                identityLabel: row.identityLabel,
+                isDefault: row.isDefault,
+                provisioning: row.provisioning,
+                verdict: row.verdict,
+                checkedAt: row.checkedAt,
+                devices: row.devices.map(({ device, authMode, verdict }) => ({ device, authMode, verdict })),
+                usage: row.usage,
+                fix: row.fix,
+            })),
+            ...providers.flatMap((row) => providerJsonEntries(row, harness)),
+        ],
+    };
+}
+function verdictText(verdict) {
+    if (verdict === 'rate_limited')
+        return 'LIMITED';
+    return verdict.toUpperCase();
+}
+function whereText(row, localDevice) {
+    const names = [...new Set(row.devices.map((device) => device.device))];
+    // Peers on an older release do not publish slot verdicts, so the only
+    // observation is this box — say so rather than a coverage count of +1.
+    if (names.length === 1 && names[0] === localDevice)
+        return 'this box';
+    const live = row.devices.filter((device) => device.verdict === 'live').length;
+    if (live > 0)
+        return `+${live}`;
+    if (row.provisioning === 'per-device') {
+        const present = row.devices
+            .filter((device) => device.verdict !== 'missing')
+            .map((device) => device.device);
+        return present.join(', ') || 'this box';
+    }
+    return '—';
+}
+function usageText(row) {
+    if (row.usage?.status === 'rate_limited' && (row.usage.usedPercent === null || row.usage.usedPercent === undefined)) {
+        return 'limited';
+    }
+    if (row.usage?.status === 'out_of_credits')
+        return 'no credits';
+    if (row.usage?.usedPercent === null || row.usage?.usedPercent === undefined)
+        return '';
+    const percent = `${row.usage.usedPercent}%${row.usage.stale ? '*' : ''}`;
+    return `${renderBar(row.usage.usedPercent, LISTING_USAGE_BAR_LEN)} ${percent}`;
+}
+function nativeLine(row, localDevice) {
+    return {
+        name: row.name ?? 'unnamed',
+        identityLabel: row.identityLabel,
+        verdict: row.verdict,
+        where: whereText(row, localDevice),
+        fix: row.fix,
+        usage: usageText(row),
+        isDefault: row.isDefault,
+    };
+}
+function providerLine(row, harness) {
+    return {
+        name: row.name,
+        identityLabel: row.identityLabel,
+        verdict: row.verdict,
+        where: '—',
+        fix: row.fix,
+        usage: '',
+        isDefault: harness ? row.defaultFor.includes(harness) : false,
+    };
+}
+function formatListingLine(line, nameW, identityW, stateW, whereW, usageW) {
+    const marker = line.isDefault ? '*' : ' ';
+    const fix = line.fix ? `fix: ${line.fix}` : '';
+    return (`  ${chalk.green(marker)} ${chalk.cyan(line.name.padEnd(nameW))}  `
+        + `${line.identityLabel.padEnd(identityW)}  `
+        + `${verdictText(line.verdict).padEnd(stateW)}  `
+        + `${line.where.padEnd(whereW)}  `
+        + `${padToWidth(line.usage, usageW)}  `
+        + `${fix ? chalk.gray(fix) : ''}`).trimEnd();
+}
+function pushGroup(out, title, lines, widths, harnessHeadings) {
+    if (lines.length === 0)
+        return;
+    if (harnessHeadings)
+        out.push(chalk.bold(title));
+    out.push(chalk.gray(`  ${'ACCOUNT'.padEnd(widths.nameW + 2)}${'IDENTITY'.padEnd(widths.identityW + 2)}${'STATE'.padEnd(widths.stateW + 2)}${'WHERE'.padEnd(widths.whereW + 2)}${'USAGE'.padEnd(widths.usageW + 2)}FIX`));
+    for (const line of lines) {
+        out.push(formatListingLine(line, widths.nameW, widths.identityW, widths.stateW, widths.whereW, widths.usageW));
+    }
+    out.push('');
+}
+/** Shared text renderer used by both `accounts list` and account-first `view`. */
+export function renderAccountRows(rows, opts) {
+    const heading = opts.heading !== false;
+    const footer = opts.footer !== false;
+    const harnessHeadings = opts.harnessHeadings !== false;
+    const providers = opts.providers ?? [];
+    const harnessFilter = opts.harness;
+    const localDevice = opts.localDevice;
+    const out = [];
+    if (heading)
+        out.push(`${chalk.bold('Accounts')}  ${chalk.gray('run: agents run <h>#<name>')}`, '');
+    const visibleProviders = harnessFilter
+        ? providers.filter((row) => row.harnesses.includes(harnessFilter))
+        : providers;
+    const visibleNative = harnessFilter
+        ? rows.filter((row) => row.agent === harnessFilter)
+        : rows;
+    if (visibleNative.length === 0 && visibleProviders.length === 0) {
+        out.push(chalk.gray('No accounts found. Add one: agents accounts add <harness> [name]'));
+    }
+    else {
+        const harnesses = new Set();
+        for (const row of visibleNative)
+            harnesses.add(row.agent);
+        for (const row of visibleProviders) {
+            for (const agent of row.harnesses) {
+                if (!harnessFilter || agent === harnessFilter)
+                    harnesses.add(agent);
+            }
+        }
+        const grouped = new Map();
+        for (const harness of [...harnesses].sort((a, b) => a.localeCompare(b))) {
+            const lines = [
+                ...visibleNative.filter((row) => row.agent === harness).map((row) => nativeLine(row, localDevice)),
+                ...visibleProviders.filter((row) => row.harnesses.includes(harness)).map((row) => providerLine(row, harness)),
+            ];
+            if (lines.length === 0)
+                continue;
+            grouped.set(harness, lines);
+        }
+        const orphans = harnessFilter
+            ? []
+            : visibleProviders.filter((row) => row.harnesses.length === 0).map((row) => providerLine(row));
+        const allLines = [...grouped.values()].flat().concat(orphans);
+        const widths = {
+            nameW: Math.max(7, ...allLines.map((line) => line.name.length)),
+            identityW: Math.max(8, ...allLines.map((line) => line.identityLabel.length)),
+            stateW: Math.max(5, ...allLines.map((line) => verdictText(line.verdict).length)),
+            whereW: Math.max(5, ...allLines.map((line) => line.where.length)),
+            usageW: Math.max(5, ...allLines.map((line) => stringWidth(line.usage))),
+        };
+        for (const [harness, lines] of grouped) {
+            pushGroup(out, harness, lines, widths, harnessHeadings);
+        }
+        if (orphans.length > 0)
+            pushGroup(out, 'Other accounts', orphans, widths, true);
+    }
+    if (footer) {
+        // "Need you" is an actionable repair, not an unread usage probe. Unverified
+        // (a worker whose token lacks the usage scope) has no fix and must not
+        // inflate the count.
+        const count = visibleNative.filter((row) => !!row.fix).length
+            + visibleProviders.filter((row) => !!row.fix).length;
+        out.push(chalk.gray(`${count} accounts need you · add: agents accounts add <harness>`));
+    }
+    return out.join('\n').trimEnd();
+}
+export function readSharedAccountVerdicts(userAgentsDir) {
+    const out = new Map();
+    for (const state of readFleetSharedDeviceStates(userAgentsDir).states) {
+        for (const row of state.accounts?.rows ?? []) {
+            if (!ALL_AGENT_IDS.includes(row.harness))
+                continue;
+            if (!['native', 'durable', 'per-device'].includes(row.authMode))
+                continue;
+            if (!['live', 'expired', 'revoked', 'rate_limited', 'unverified', 'missing'].includes(row.verdict))
+                continue;
+            const key = `${row.harness}:${row.accountId}`;
+            const values = out.get(key) ?? [];
+            values.push({
+                device: state.device,
+                authMode: row.authMode,
+                verdict: row.verdict,
+                ...(row.checkedAt ? { checkedAt: row.checkedAt } : {}),
+            });
+            out.set(key, values);
+            if (row.identityLabel)
+                out.set(`label:${row.harness}:${row.identityLabel}`, values);
+        }
+    }
+    return out;
+}
+/**
+ * Devices whose daemon-state file exists but carries no account verdicts —
+ * typically an older release that has not started publishing the T3 envelope.
+ * The fleet matrix lists them in a coverage note rather than as blank columns.
+ */
+export function listDevicesWithoutAccountVerdicts(userAgentsDir) {
+    const out = [];
+    for (const state of readFleetSharedDeviceStates(userAgentsDir).states) {
+        if (!state.accounts?.rows?.length)
+            out.push(state.device);
+    }
+    return out.sort((a, b) => a.localeCompare(b));
+}
+function normalizeAuthVerdict(verdict, signedIn) {
+    if (verdict === 'unconfigured')
+        return 'missing';
+    if (verdict === 'error')
+        return signedIn ? 'unverified' : 'missing';
+    return verdict ?? (signedIn ? 'unverified' : 'missing');
+}
+/**
+ * Merge the two writers of the same local truth — the T1 slot store and the
+ * daemon's auth-health cache — by NEWEST observation. A naive `??` chain lets
+ * an older slot `live` permanently mask a newer daemon `revoked`, so a revoked
+ * account would keep rendering LIVE on its own device. Pure.
+ */
+export function resolveLocalAccountObservation(slot, cached, signedIn) {
+    const slotAt = slot?.checkedAt ? Date.parse(slot.checkedAt) : null;
+    const cachedAt = cached?.checkedAt ?? null;
+    const preferSlot = !!slot && (!cached || (slotAt !== null && (cachedAt === null || slotAt >= cachedAt)));
+    return {
+        verdict: normalizeAuthVerdict((preferSlot ? slot : cached)?.verdict, signedIn),
+        ...(preferSlot && slot?.authMode ? { authMode: slot.authMode } : {}),
+        ...(preferSlot && slot?.checkedAt
+            ? { checkedAt: slot.checkedAt }
+            : !preferSlot && cached ? { checkedAt: new Date(cached.checkedAt).toISOString() } : {}),
+    };
+}
+function mergeDeviceVerdicts(fleet, local) {
+    const byDevice = new Map(fleet.map((row) => [row.device, row]));
+    byDevice.set(local.device, local);
+    return [...byDevice.values()].sort((a, b) => a.device.localeCompare(b.device));
+}
+function aggregateAccountVerdict(provisioning, devices) {
+    const verdicts = devices.map((row) => row.verdict);
+    if (verdicts.includes('revoked'))
+        return 'revoked';
+    if (verdicts.includes('expired'))
+        return 'expired';
+    if (verdicts.includes('rate_limited'))
+        return 'rate_limited';
+    if (verdicts.includes('live'))
+        return 'live';
+    if (verdicts.includes('unverified'))
+        return 'unverified';
+    return provisioning === 'per-device' ? 'per-device' : 'missing';
+}
+function newestCheckedAt(devices) {
+    return devices
+        .map((row) => row.checkedAt)
+        .filter((value) => !!value)
+        .sort((a, b) => Date.parse(b) - Date.parse(a))[0] ?? null;
 }

package/dist/lib/account-registry.d.ts

@@ -1,4 +1,4 @@
-import { type AgentId, type Meta } from './types.js';
+import { type AgentId, type Meta, type NativeAccountRecord } from './types.js';
 import { type AccountAuthKind } from './account-provider-registry.js';
 export interface CredentialAccount {
     id: string;
@@ -19,15 +19,11 @@ export interface ResolvedCredentialAccount {
     auth: AccountAuthKind;
     env: Record<string, string>;
 }
-export interface NativeAccount {
-    id: string;
-    name: string;
+export interface NativeAccount extends NativeAccountRecord {
     kind: 'native';
-    agent: AgentId;
-    identityKey: string;
-    identityLabel?: string;
-    scope: 'version' | 'device';
 }
+export { recordSlot, readSlots } from './accounts/slots.js';
+export { registeredNativeAccountForEmail, parseNativeIdentityKey } from './native-accounts.js';
 export type UnifiedAccount = (CredentialAccount & {
     kind: 'provider';
 }) | NativeAccount;
@@ -86,7 +82,7 @@ export declare function parseAccountSelector(input: string): {
 export declare function assertUnambiguousNativeAccount(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, name: string, agent?: AgentId): void;
 /**
  * Validate a native account NAME (charset + per-harness uniqueness) WITHOUT a
- * known identity — the pre-flight `agents accounts connect` runs before it
+ * known identity — the pre-flight `agents accounts add` runs before it
  * installs a home and drives a login, so a bad/colliding name fails before any
  * side effect instead of orphaning a freshly-minted home (PHNX-3940).
  */
@@ -95,29 +91,11 @@ export declare function addNativeAccount(name: string, agent: AgentId, identityK
 /** Create or replace the version-independent label for one native identity. */
 export declare function labelNativeAccount(agent: AgentId, identityKey: string, identityLabel: string | undefined, label: string | undefined, scope: 'version' | 'device'): NativeAccount;
 /**
- * Record THIS box's connect home for an account (PHNX-3940). Device-scoped: the
- * home a box minted for an account is not assumed to exist on any other box, so
- * it lives in the device doc keyed by the stable account id, never on the
- * fleet-synced central identity row. Idempotent. A reconnect reads it back via
- * {@link nativeAccountHome} to reuse the exact home even when the credential has
- * expired and local signed-in discovery can no longer find it.
+ * This box's recorded home LABEL for an account, or null.
+ * Reads the leftover device-scoped `homes` map so legacy `acct-*` installation
+ * labels still resolve (T5/T7); spawn-time HOME is {@link readSlots}[id].slotDir.
  */
-export declare function setNativeAccountHome(accountId: string, installationLabel: string): void;
-/** This box's recorded connect home for an account, or null. */
 export declare function nativeAccountHome(accountId: string, meta: Pick<Meta, 'deviceAccounts'>): string | null;
-/**
- * Every installation label THIS box has recorded as SOME account's connect home
- * (PHNX-3940). These are identity-bearing and MUST NEVER be re-minted for a new
- * account — the safe-allocation invariant that stops a new connect from
- * overwriting another account's login.
- */
-export declare function ownedConnectHomeLabels(meta: Pick<Meta, 'deviceAccounts'>): Set<string>;
-/** This box's in-flight connect slot for `(agent, name)`, or null. */
-export declare function pendingConnectSlot(agent: AgentId, name: string, meta: Pick<Meta, 'deviceAccounts'>): string | null;
-/** Record an in-flight connect slot for `(agent, name)` (device-scoped). */
-export declare function setPendingConnectSlot(agent: AgentId, name: string, slot: string): void;
-/** Clear the in-flight connect slot for `(agent, name)` once the account lands. */
-export declare function clearPendingConnectSlot(agent: AgentId, name: string): void;
 /**
  * Set the per-harness default account by NAME only when none is configured
  * (PHNX-3940). Never overrides an existing choice — a first connect selecting a