@phnx-labs/agents-cli 1.22.98 → 1.22.100

package/dist/lib/daemon-ticks.js

@@ -14,7 +14,7 @@
  * by the cross-process refresh lease so an explicit CLI refresh and the daemon
  * timer converge on the same published result.
  */
-import { AUTH_PROBE_MAX_AGE_MS } from './auth-health.js';
+import { AUTH_PROBE_MAX_AGE_MS, authTargetKey } from './auth-health.js';
 export { AUTH_PROBE_MAX_AGE_MS } from './auth-health.js';
 export function isFreshFleetAuthSnapshot(value, minimumCapturedAt) {
     return value.row.capturedAt >= minimumCapturedAt
@@ -36,12 +36,32 @@ export function isFreshFleetAuthSnapshot(value, minimumCapturedAt) {
  * publishes every tick — it does not ride that endpoint.
  */
 /**
- * True when every cached auth row was probed within {@link AUTH_PROBE_MAX_AGE_MS}
- * — i.e. reusing them would not let a verdict get staler than one probe window.
- * Empty cache is never fresh (nothing to reuse). Pure — unit-tested.
+ * The cached rows still backed by a home on this device, by `authTargetKey`.
+ *
+ * A row for an uninstalled version is an ORPHAN: the probe enumerates installed
+ * homes + account slots, so nothing re-probes it and its `checkedAt` is frozen
+ * at whatever the last probe left. Pure — unit-tested.
+ */
+export function installedAuthRows(authRows, installedTargets) {
+    return authRows.filter((r) => installedTargets.has(authTargetKey(r.agent, r.version)));
+}
+/**
+ * True when every cached auth row FOR AN INSTALLED HOME was probed within
+ * {@link AUTH_PROBE_MAX_AGE_MS} — i.e. reusing them would not let a verdict get
+ * staler than one probe window. No installed row is never fresh (nothing to
+ * reuse). Pure — unit-tested.
+ *
+ * Orphan rows are excluded rather than counted stale (PHNX-4051). Counting them
+ * made this permanently false on any box that had ever uninstalled a version:
+ * the orphan can never be re-probed, so the tick live-probed the rate-limited
+ * `/api/oauth/usage` for every account every 3 minutes, re-arming the per-account
+ * 429 backoff and parking the usage refresher — the RUSH-2998 failure the reuse
+ * window exists to prevent. Observed on yosemite-m0 (rows dated Sep 2 / Sep 6 for
+ * uninstalled Claude versions).
  */
-export function isCachedFleetAuthProbeFresh(authRows, now, maxAgeMs = AUTH_PROBE_MAX_AGE_MS) {
-    return authRows.length > 0 && authRows.every((r) => now - r.health.checkedAt < maxAgeMs);
+export function isCachedFleetAuthProbeFresh(authRows, now, installedTargets, maxAgeMs = AUTH_PROBE_MAX_AGE_MS) {
+    const installed = installedAuthRows(authRows, installedTargets);
+    return installed.length > 0 && installed.every((r) => now - r.health.checkedAt < maxAgeMs);
 }
 /**
  * Whether the tick may reuse the cached auth verdict instead of re-probing the
@@ -51,8 +71,8 @@ export function isCachedFleetAuthProbeFresh(authRows, now, maxAgeMs = AUTH_PROBE
  * revoked account (the second `runFleetPing` call site, RUSH-2998). Pure —
  * unit-tested so that inversion cannot regress unnoticed.
  */
-export function shouldReuseCachedAuthProbe(force, cached, now, maxAgeMs = AUTH_PROBE_MAX_AGE_MS) {
-    return !force && isCachedFleetAuthProbeFresh(cached, now, maxAgeMs);
+export function shouldReuseCachedAuthProbe(force, cached, now, installedTargets, maxAgeMs = AUTH_PROBE_MAX_AGE_MS) {
+    return !force && isCachedFleetAuthProbeFresh(cached, now, installedTargets, maxAgeMs);
 }
 /**
  * Fleet cache warm: publish THIS host's row for the caches `agents fleet
@@ -67,7 +87,7 @@ export async function refreshLocalFleetAuthState(opts) {
     const force = opts?.force === true;
     const signal = opts?.signal;
     const { machineId } = await import('./machine-id.js');
-    const { probeLocalFleetAuth, readFleetAuthRows, writeFleetAuthRows } = await import('./auth-health.js');
+    const { probeLocalFleetAuth, readFleetAuthRows, writeFleetAuthRows, localAuthTargetKeys } = await import('./auth-health.js');
     const { getCliVersion } = await import('./version.js');
     const self = machineId();
     const requestedAt = Date.now();
@@ -91,11 +111,16 @@ export async function refreshLocalFleetAuthState(opts) {
             // Re-probe the rate-limited /oauth/usage endpoint at most every
             // AUTH_PROBE_MAX_AGE_MS; reuse the last real verdict in between (RUSH-2998).
             // Fleet status publishes every tick regardless — it does not ride that endpoint.
+            const installed = localAuthTargetKeys();
             const cached = readFleetAuthRows(self);
-            const reuse = shouldReuseCachedAuthProbe(force, cached, requestedAt);
-            const authRows = reuse ? cached : await probeLocalFleetAuth({ cliVersion: getCliVersion(), forceLive: force, signal });
-            if (!reuse)
-                writeFleetAuthRows(self, authRows);
+            const live = installedAuthRows(cached, installed);
+            const reuse = shouldReuseCachedAuthProbe(force, cached, requestedAt, installed);
+            const authRows = reuse ? live : await probeLocalFleetAuth({ cliVersion: getCliVersion(), forceLive: force, signal });
+            // Write when we probed, and ALSO when the cache holds orphan rows for homes
+            // that are gone: a reusing tick is the common case, so leaving the prune on
+            // the probe branch would keep them in `agents view` indefinitely (PHNX-4051).
+            if (!reuse || live.length !== cached.length)
+                writeFleetAuthRows(self, authRows, installed);
             const row = await publishLocalFleetStatus(self);
             return { row, authRows };
         },

package/dist/lib/fleet-shared-repo-sync.d.ts

@@ -1,5 +1,12 @@
 export declare const FLEET_SHARED_REPO_SYNC_DEADLINE_MS = 45000;
 export declare const FLEET_SHARED_REPO_KILL_GRACE_MS = 250;
+export declare const FLEET_SHARED_REPO_OUTPUT_MAX_BYTES: number;
+/**
+ * When the shared-state exchange last completed successfully, in epoch ms, or
+ * `null` if it never has on this box (no marker yet) or the marker is unreadable.
+ * Reads the default daemon-dir marker the periodic exchange writes.
+ */
+export declare function readLastSuccessfulExchangeMs(): number | null;
 export interface BoundedProcessResult {
     code: number | null;
     stdout: string;

package/dist/lib/fleet-shared-repo-sync.js

@@ -19,9 +19,46 @@ import { machineId } from './session/sync/config.js';
 import { getDaemonDir, getUserAgentsDir } from './state.js';
 export const FLEET_SHARED_REPO_SYNC_DEADLINE_MS = 45_000;
 export const FLEET_SHARED_REPO_KILL_GRACE_MS = 250;
-const FLEET_SHARED_REPO_OUTPUT_MAX_BYTES = 1024 * 1024;
+export const FLEET_SHARED_REPO_OUTPUT_MAX_BYTES = 1024 * 1024;
 const FLEET_SHARED_REPO_PUSH_ATTEMPTS = 3;
 const FLEET_SHARED_REPO_REBASE_CLEANUP_RESERVE_MS = 5_000;
+/**
+ * The exchange records its last SUCCESSFUL completion beside its lock so a
+ * sibling service (auth-sync) can gate work on the freshness of the peer state
+ * this exchange delivers into the local checkout (PHNX-4051). auth-sync's
+ * credential pushes read the peer verdicts the LAST usage-sync exchange wrote; if
+ * that exchange has not landed within a tick interval, those verdicts are stale
+ * and pushing off them would act on a peer that may already hold the key.
+ */
+function exchangeMarkerPath(lockPath) {
+    return `${lockPath}.last-success`;
+}
+function writeExchangeMarker(lockPath, nowMs = Date.now()) {
+    try {
+        const p = exchangeMarkerPath(lockPath);
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, JSON.stringify({ at: nowMs }), 'utf-8');
+    }
+    catch {
+        // Best-effort telemetry — never fail the exchange over its own marker.
+    }
+}
+/**
+ * When the shared-state exchange last completed successfully, in epoch ms, or
+ * `null` if it never has on this box (no marker yet) or the marker is unreadable.
+ * Reads the default daemon-dir marker the periodic exchange writes.
+ */
+export function readLastSuccessfulExchangeMs() {
+    try {
+        const lockPath = path.join(getDaemonDir(), 'fleet-shared-repo-sync');
+        const raw = fs.readFileSync(exchangeMarkerPath(lockPath), 'utf-8');
+        const at = JSON.parse(raw).at;
+        return typeof at === 'number' && Number.isFinite(at) ? at : null;
+    }
+    catch {
+        return null;
+    }
+}
 function signalProcessTree(child, signal) {
     const pid = child.pid;
     if (!pid)
@@ -177,9 +214,30 @@ function retainedAutostash(stashList, objectId) {
  * cannot create a fresh collision — so nothing is silently destroyed. Then let
  * the rebase check out origin's version. A file we cannot clear is left in
  * place; the rebase may still abort, no worse than today and never losing data.
+ *
+ * The scan is scoped to the TRACKED ROOTS origin carries — the top-level entries
+ * of `git ls-tree --name-only origin/<branch>` — NOT the whole working tree
+ * (PHNX-4051). Only a file origin tracks can be overwritten by the rebase
+ * checkout, so a tracked root is the tightest superset of the collidable paths:
+ * every path origin tracks stays in scope (a stale untracked `projects/rush.yaml`
+ * under a tracked `projects/` root is still cleared), while an untracked-ONLY tree
+ * origin never tracks — artifacts-cli's revision store
+ * (`~/.agents/artifact-history/`, ~11k files / >1 MiB of paths) is the live case —
+ * is never a tracked root, so it never enters the `git ls-files --others` listing.
+ * An unbounded listing there blows past {@link FLEET_SHARED_REPO_OUTPUT_MAX_BYTES}
+ * and kills the exchange on every tick; scoping to the tracked roots keeps the
+ * PHNX-3923 coverage whole while an unrelated untracked tree cannot push the
+ * listing over the cap. `ls-tree`'s own output is bounded — it lists only the root
+ * entries, never the recursive tree.
  */
 async function clearCollidingUntracked(git, root, branch) {
-    const others = await git(['ls-files', '--others', '--exclude-standard', '-z']);
+    const tree = await git(['ls-tree', '--name-only', '-z', `origin/${branch}`]);
+    if (tree.code !== 0)
+        return { error: tree };
+    const trackedRoots = tree.stdout.split('\0').filter(Boolean);
+    if (trackedRoots.length === 0)
+        return { cleared: 0, backedUp: [], backupDir: null };
+    const others = await git(['ls-files', '--others', '--exclude-standard', '-z', '--', ...trackedRoots]);
     if (others.code !== 0)
         return { error: others };
     const relPaths = others.stdout.split('\0').filter(Boolean);
@@ -403,7 +461,12 @@ export async function syncFleetSharedStateRepo(options = {}) {
             retries: { retries: 20, factor: 1, minTimeout: 100, maxTimeout: 100 },
             onCompromised: logAndContinueOnLockCompromised('fleet shared repo sync'),
         });
-        return await performFleetSharedRepoSync(root, device, timeoutMs);
+        const result = await performFleetSharedRepoSync(root, device, timeoutMs);
+        // Record freshness only on a real success, beside the lock so a test-redirected
+        // lockPath keeps its marker isolated too (PHNX-4051).
+        if (result.success)
+            writeExchangeMarker(lockPath);
+        return result;
     }
     catch (err) {
         return {

package/dist/lib/helper-versions.js

@@ -36,7 +36,7 @@
  * helper release now, off this table entirely.
  */
 export const HELPER_RELEASES = {
-    menubar: { tagPrefix: 'menubar', floor: '1.1.1' },
+    menubar: { tagPrefix: 'menubar', floor: '1.1.4' },
     'computer-mac': { tagPrefix: 'computer-mac', floor: '1.0.0' },
     // The Windows helper is a bare .exe, not an .app bundle, so it does not share
     // helper-download.ts's zip/codesign/notarize machinery -- but it has the same

package/dist/lib/reconcile-and-repair.d.ts

@@ -18,6 +18,7 @@
  */
 import type { AgentId } from './types.js';
 import { type HealResult } from './heal.js';
+import { type SlotProjection } from './accounts/slots.js';
 import { type HookRuntimeRepairReport } from './hooks/install.js';
 import { type RemediateStaleInstallsResult, type FindAgentsCliInstallsOptions } from './self-update.js';
 export interface HookRewireResult {
@@ -36,6 +37,13 @@ export interface RepairAfterSyncReport {
     hookRuntimeRepair: HookRuntimeRepairReport;
     /** Only populated on the umbrella (no-agent) path; null otherwise. */
     staleInstallPurge: RemediateStaleInstallsResult | null;
+    /**
+     * Account slots re-projected from their harness's default version home
+     * (PHNX-3940): one entry per slot, with the artifacts pruned because the
+     * source no longer carries them. Errors are per-harness sentences.
+     */
+    slotProjection: SlotProjection[];
+    slotProjectionErrors: string[];
 }
 /**
  * Test/override hook that scopes the destructive stale-CLI purge to injected

package/dist/lib/reconcile-and-repair.js

@@ -1,6 +1,7 @@
 import { AGENTS, ALL_AGENT_IDS } from './agents.js';
 import chalk from 'chalk';
 import { heal, healChangedAnything } from './heal.js';
+import { projectAccountSlots } from './accounts/slots.js';
 import { checkVersionHookWiring, registerHooksToSettings, repairManagedHookRuntimeArtifacts, } from './hooks/install.js';
 import { getVersionHomePath, listInstalledVersions, isVersionIsolated, } from './installations/versions.js';
 import { invalidateDoctorOverviewCache } from './devices/doctor-overview-cache.js';
@@ -126,11 +127,27 @@ export async function repairAfterSync(opts) {
     const staleInstallPurge = (!opts.agent && opts.pruneClis === true)
         ? purgeStaleAgentsCliCopies(opts.purgeInjection)
         : null;
+    // Account slots follow the version home (PHNX-3940). `agents accounts add`
+    // projects a slot once; without this every later sync would update the
+    // version home and leave each slot on the resources it was cloned with.
+    const slotProjection = [];
+    const slotProjectionErrors = [];
+    const slotAgents = opts.agent ? [opts.agent] : ALL_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0);
+    for (const agent of slotAgents) {
+        try {
+            slotProjection.push(...projectAccountSlots(agent));
+        }
+        catch (err) {
+            slotProjectionErrors.push(`${agent}: ${err.message}`);
+        }
+    }
     const report = {
         heal: healResult,
         hookRewire,
         hookRuntimeRepair,
         staleInstallPurge,
+        slotProjection,
+        slotProjectionErrors,
     };
     if (repairChangedAnything(report))
         invalidateDoctorOverviewCache();
@@ -142,7 +159,9 @@ export function repairChangedAnything(report) {
         report.hookRewire.some((r) => r.rewired > 0 || r.remaining > 0 || r.failure !== undefined) ||
         report.hookRuntimeRepair.attempts.length > 0 ||
         (report.staleInstallPurge !== null &&
-            (report.staleInstallPurge.removed.length > 0 || report.staleInstallPurge.failed.length > 0)));
+            (report.staleInstallPurge.removed.length > 0 || report.staleInstallPurge.failed.length > 0)) ||
+        report.slotProjection.length > 0 ||
+        report.slotProjectionErrors.length > 0);
 }
 /**
  * True when the RECONCILE repair left a per-version problem a human must fix — an
@@ -174,6 +193,8 @@ export function repairAfterSyncJson(report) {
         hookRewire: report.hookRewire,
         hookRuntimeRepair: report.hookRuntimeRepair,
         staleInstallPurge: report.staleInstallPurge,
+        slotProjection: report.slotProjection,
+        slotProjectionErrors: report.slotProjectionErrors,
         hadFailures: repairHadFailures(report),
     };
 }
@@ -264,4 +285,14 @@ export function renderRepairAfterSync(report, log = (s) => console.log(s)) {
     renderHookRuntimeRepairText(report.hookRuntimeRepair, log);
     if (report.staleInstallPurge)
         renderStaleInstallPurgeText(report.staleInstallPurge, log);
+    renderSlotProjectionText(report, log);
+}
+function renderSlotProjectionText(report, log) {
+    for (const slot of report.slotProjection) {
+        const pruned = slot.pruned.length > 0 ? chalk.gray(` — removed ${slot.pruned.join(', ')}`) : '';
+        log(`  ${chalk.green('slot')}    account ${chalk.bold(slot.name)} ${chalk.gray(`← ${slot.from}`)}${pruned}`);
+    }
+    for (const err of report.slotProjectionErrors) {
+        log(`  ${chalk.yellow('slot')}    ${err}`);
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.98",
+  "version": "1.22.100",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",