@cohortapp/agent-sdk 2.11.15 → 2.13.0

package/lib/telemetry/collect.mjs

@@ -12,7 +12,10 @@
  *     state: "active"|"idle"|"busy"|"error"|"offline",
  *     activity: string,                 // human-readable ("handling inbox" / "session: <taskClass>" / "idle")
  *     subAgentsRunning: number,         // running claude child processes (best-effort)
- *     session: { id?, taskClass?, model? } | null,
+ *     session: { id?, taskClass?, model? } | null,   // the running WORK session; NULL when idle
+ *                                       // (readers take null as "no work session" — keep it so).
+ *                                       // hq validates this object STRICTLY: a key it does not
+ *                                       // know rejects the whole beat, so nothing new goes here.
  *     machine: {
  *       // MOMENTARY — true at `ts`, expires with the snapshot
  *       loadavg: [n,n,n],
@@ -31,6 +34,25 @@
  *       device?: string,                // "Mac mini M4 Pro"
  *       ram?: string,                   // "24 GB"
  *       cores?: number,
+ *       // IDENTITY — where the seat is and what it runs (re-read every beat,
+ *       // never served from the inventory cache: an autoupdate changes the
+ *       // version and a tailnet re-join changes the IP without touching the chip)
+ *       hostname?: string,              // os.hostname()
+ *       tailnetIp?: string,             // `tailscale ip -4`, fail-open
+ *       sdkVersion?: string,            // installed @cohortapp/agent-sdk version — how a fleet upgrade is verified
+ *       // FRONT DOOR — who receives inbound on this seat and whether it is alive.
+ *       // Lives on `machine` (hq stores it as an OPEN record, so a new key lands
+ *       // the moment the daemon emits it) and NOT on `session`, whose hq schema
+ *       // is `.strict()` — an unknown key there rejects the whole beat and
+ *       // silently drops the seat out of the mesh.
+ *       frontDoor: "session"|"daemon",  // the main session job, or the daemon's --print lane
+ *       sessionLive: boolean,           // state/session/heartbeat.json fresher than 90 s
+ *       // LAST UPGRADE — the outcome autoupdate.sh recorded in
+ *       // state/autoupdate/last.json (WP-M6); absent until a first attempt.
+ *       // Also on `machine` (open record), so hq's fleet view can show it next
+ *       // to sdkVersion without a schema change. `ok` is the attempt's verdict:
+ *       // true = healthy on `to`; false = install failed or rolled back to `from`.
+ *       upgrade?: { at: ISO8601, from: string, to: string, ok: boolean },
  *     },
  *     claudeAuth: "ok"|"relogin_required"|"unknown",
  *     alerts: [{ id, severity, kind, detail }],
@@ -60,9 +82,12 @@
 
 import os from "node:os";
 import { execFile } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join, resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import { writeJsonAtomic } from "../fs-atomic.mjs";
+import { probeClaude as defaultProbeClaude } from "../setup/claude-probe.mjs";
 
 import { list as listPresence } from "../collective/presence.mjs";
 import { billableUsd } from "../cost/ledger-row.mjs";
@@ -383,6 +408,10 @@ export async function collectMachine(o = {}) {
     if (inv.device) machine.device = inv.device;
     if (inv.ram) machine.ram = inv.ram;
     if (Number.isFinite(inv.cores)) machine.cores = inv.cores;
+    // IDENTITY (§3.8) — where the seat is and what it runs.
+    if (inv.hostname) machine.hostname = inv.hostname;
+    if (inv.tailnetIp) machine.tailnetIp = inv.tailnetIp;
+    if (inv.sdkVersion) machine.sdkVersion = inv.sdkVersion;
   }
 
   // spend24h — the agent's own rolling 24h LLM spend, off the cost ledger.
@@ -847,10 +876,17 @@ export async function collectInventory(o = {}) {
     ? join(resolve(o.agentRoot), "state", "telemetry", "inventory.json")
     : null;
 
+  // IDENTITY — hostname / tailnetIp / sdkVersion — is re-read on every call and
+  // never cached: an autoupdate changes the version and a tailnet re-join
+  // changes the IP without touching the chip the cache is keyed on. This is the
+  // field the fleet view reads to confirm a rollout, so a stale answer here
+  // would hide exactly the thing it exists to show.
+  const identity = await collectIdentity(o, osImpl);
+
   if (cachePath && o.inventoryCache !== false) {
     const cached = safeReadJson(cachePath);
     if (cached && cached.key === key && cached.inv && typeof cached.inv === "object") {
-      return cached.inv;
+      return { ...cached.inv, ...identity };
     }
   }
 
@@ -875,10 +911,152 @@ export async function collectInventory(o = {}) {
   if (cachePath && Object.keys(inv).length > 0) {
     try {
       mkdirSync(join(resolve(o.agentRoot), "state", "telemetry"), { recursive: true });
-      writeFileSync(cachePath, JSON.stringify({ key, inv }, null, 2));
+      writeJsonAtomic(cachePath, { key, inv });
     } catch { /* cache is an optimisation; never fatal */ }
   }
-  return inv;
+  return { ...inv, ...identity };
+}
+
+// ---------------------------------------------------------------------------
+// Identity — where the seat is and what it runs (hostname / tailnetIp / sdkVersion)
+// ---------------------------------------------------------------------------
+
+/** Where the tailscale CLI lives, in the order we try it. */
+const TAILSCALE_BINS = Object.freeze([
+  "tailscale",                                             // PATH (standalone / homebrew)
+  "/usr/local/bin/tailscale",
+  "/opt/homebrew/bin/tailscale",
+  "/Applications/Tailscale.app/Contents/MacOS/Tailscale",   // App Store / .pkg install
+]);
+
+/**
+ * The machine's tailnet IPv4 via `tailscale ip -4`, trying each known binary
+ * location in turn. Fail-open → "" (no Tailscale, not joined, or the CLI is
+ * slow); the field simply drops out of the beat.
+ * @returns {Promise<string>}
+ */
+export async function collectTailnetIp(o = {}) {
+  const execFileImpl = o.execFile || execFile;
+  const timeoutMs = Number.isFinite(o.tailscaleTimeoutMs) ? o.tailscaleTimeoutMs : 2000;
+  for (const bin of o.tailscaleBins || TAILSCALE_BINS) {
+    const out = await execFileSafe(execFileImpl, bin, ["ip", "-4"], timeoutMs);
+    const m = String(out || "").match(/\b(\d{1,3}(?:\.\d{1,3}){3})\b/);
+    if (m) return m[1];
+  }
+  return "";
+}
+
+/**
+ * The installed @cohortapp/agent-sdk version. Two honest sources, in order:
+ *   1. the agent's own dependency — `require.resolve("@cohortapp/agent-sdk/package.json")`
+ *      from `<agentRoot>/package.json` (the copy `maestro upgrade` installs
+ *      from, so a rollout shows up here as soon as `npm install` lands);
+ *   2. the package this very file ships in — walk up from lib/telemetry/ to the
+ *      nearest package.json NAMED @cohortapp/agent-sdk (a global install, or a
+ *      `~/maestro` checkout running its own code).
+ * "" when neither resolves; the field drops out rather than lying.
+ * @param {string} [agentRoot]
+ * @returns {string}
+ */
+export function readSdkVersion(agentRoot) {
+  if (agentRoot) {
+    try {
+      const req = createRequire(join(resolve(agentRoot), "package.json"));
+      const pkg = JSON.parse(readFileSync(req.resolve("@cohortapp/agent-sdk/package.json"), "utf8"));
+      if (pkg && typeof pkg.version === "string") return pkg.version;
+    } catch { /* not a dependency of this agent — try the package we ship in */ }
+  }
+  try {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < 6; i += 1) {
+      const p = join(dir, "package.json");
+      if (existsSync(p)) {
+        const pkg = safeReadJson(p);
+        if (pkg && pkg.name === "@cohortapp/agent-sdk" && typeof pkg.version === "string") return pkg.version;
+      }
+      const up = dirname(dir);
+      if (up === dir) break;
+      dir = up;
+    }
+  } catch { /* fall through to "" */ }
+  return "";
+}
+
+/** hostname / tailnetIp / sdkVersion — each independently fail-open. */
+async function collectIdentity(o, osImpl) {
+  const out = {};
+  try {
+    const h = typeof osImpl.hostname === "function" ? String(osImpl.hostname() || "").trim() : "";
+    if (h) out.hostname = h;
+  } catch { /* no hostname */ }
+  if (o.tailnet !== false) {
+    try {
+      const ip = typeof o.tailnetIp === "string" ? o.tailnetIp : await collectTailnetIp(o);
+      if (ip) out.tailnetIp = ip;
+    } catch { /* no tailnetIp */ }
+  }
+  try {
+    const v = typeof o.sdkVersion === "string" ? o.sdkVersion : readSdkVersion(o.agentRoot);
+    if (v) out.sdkVersion = v;
+  } catch { /* no sdkVersion */ }
+  return out;
+}
+
+// ---------------------------------------------------------------------------
+// Front door — is the main session job the one receiving inbound, and is it live?
+// ---------------------------------------------------------------------------
+
+/** A main-session heartbeat older than this is not live. */
+export const SESSION_STALE_MS = 90_000;
+
+/**
+ * Pure: derive `{frontDoor, sessionLive}` from the heartbeat the main session's
+ * feed writes every 15 s (`state/session/heartbeat.json` `{pid, ppid, sessionId,
+ * name, ts, feedVersion}`). No heartbeat file at all means the session job is
+ * not installed on this seat → the daemon is the front door. A file that exists
+ * but is stale means the job IS the front door and is currently down (the
+ * daemon falls back to its --print lane meanwhile) — a different fact, reported
+ * as such.
+ * @param {object|null} hb   parsed heartbeat, or null when absent/unreadable
+ * @param {number} nowMs
+ * @param {{staleMs?:number}} [opts]
+ * @returns {{frontDoor:"session"|"daemon", sessionLive:boolean}}
+ */
+export function sessionLiveness(hb, nowMs, opts = {}) {
+  if (!hb || typeof hb !== "object") return { frontDoor: "daemon", sessionLive: false };
+  const staleMs = Number.isFinite(opts.staleMs) ? opts.staleMs : SESSION_STALE_MS;
+  const ts = typeof hb.ts === "number" ? hb.ts : Date.parse(hb.ts);
+  const age = nowMs - ts;
+  const live = Number.isFinite(age) && age >= 0 && age <= staleMs;
+  return { frontDoor: "session", sessionLive: live };
+}
+
+/**
+ * Pure: the beat's `machine.upgrade` from state/autoupdate/last.json
+ * (`{from,to,at,ok,healthy,reason}` as autoupdate.sh writes it). Only the four
+ * fields the fleet view reads; anything malformed → null, and the field drops
+ * out rather than lying.
+ * @param {object|null} last
+ * @returns {{at:string, from:string, to:string, ok:boolean}|null}
+ */
+export function upgradeSummary(last) {
+  if (!last || typeof last !== "object") return null;
+  const at = typeof last.at === "string" ? last.at : "";
+  const to = typeof last.to === "string" ? last.to : "";
+  if (!at || !to) return null;
+  return { at, from: typeof last.from === "string" ? last.from : "", to, ok: last.ok === true };
+}
+
+/** state/autoupdate/last.json, or null. */
+function readAutoupdateLast(agentRoot) {
+  if (!agentRoot) return null;
+  return safeReadJson(join(resolve(agentRoot), "state", "autoupdate", "last.json"));
+}
+
+/** Read state/session/heartbeat.json; null when absent or malformed. */
+function readSessionHeartbeat(agentRoot) {
+  if (!agentRoot) return null;
+  return safeReadJson(join(resolve(agentRoot), "state", "session", "heartbeat.json"));
 }
 
 // ---------------------------------------------------------------------------
@@ -1004,10 +1182,71 @@ export function detectClaudeAuth(o = {}) {
     const text = tailFile(file, 64 * 1024);
     if (scanForRelogin(text)) { sawRelogin = true; break; }
   }
+  // A fresh auth failure in the logs is the strongest evidence there is: it
+  // means a real spawn was just refused, whatever `claude auth status` thinks.
   if (sawRelogin) return "relogin_required";
+
+  // Subscription mode: ask the SAME probe setup/doctor use (§3.9), so the beat,
+  // the wizard and the doctor cannot disagree about one machine. "unknown"
+  // from the probe (CLI missing/slow) defers to the log evidence — and so does
+  // an UNVERIFIED "ok": `claude auth status` says loggedIn for any token value,
+  // so only a verified ok (a real call) may flip this beat from unknown to ok.
+  // The one state claudeAuth exists to catch — a seat whose token is garbage —
+  // is thus reported exactly as it was before the probe existed: by the logs.
+  const probed = probeAuthForBeat(o, nowMs);
+  if (probed === "ok" || probed === "relogin_required") return probed;
+
   return sawAny ? "ok" : "unknown";
 }
 
+/**
+ * Module-scoped memo for the beat's auth probe. WHY: `collectStatus` runs on
+ * every 30 s presence beat and the probe forks `claude auth status`; one fork a
+ * beat is affordable but pointless — the answer changes on the order of days.
+ * The memo holds ONE entry per agentRoot for AUTH_PROBE_TTL_MS and applies only
+ * to the default probe (an injected `o.probeClaude` is never memoised, so tests
+ * and callers that want a fresh answer get one). Concurrency: single-threaded
+ * per process; a stale read across two daemons is harmless (same answer).
+ * Reset seam: `_internals.resetAuthProbeCache()`.
+ */
+const AUTH_PROBE_TTL_MS = 5 * 60 * 1000;
+const _authProbeMemo = new Map();
+function resetAuthProbeCache() { _authProbeMemo.clear(); }
+
+/**
+ * Only fork the probe when the agent is on the subscription path — the api-key
+ * path is curl-pinged by doctor, not by the beat. `.env` or the daemon's
+ * ambient env (`o.env`, default process.env — launchd hands the headless seat
+ * its token that way) both count, as they do for the probe itself.
+ */
+function subscriptionModeFromEnv(agentRoot, env) {
+  let body = "";
+  try { body = readFileSync(join(resolve(agentRoot), ".env"), "utf8"); } catch { body = ""; /* no .env → the ambient env decides */ }
+  if (/^CLAUDE_CODE_OAUTH_TOKEN=.+/m.test(body) || /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=(1|true|yes)\s*$/im.test(body)) return true;
+  const e = env || {};
+  return !!(e.CLAUDE_CODE_OAUTH_TOKEN && String(e.CLAUDE_CODE_OAUTH_TOKEN).trim()) || /^(1|true|yes)$/i.test(String(e.MAESTRO_PREFER_SUBSCRIPTION_AUTH || "").trim());
+}
+
+function probeAuthForBeat(o, nowMs) {
+  if (o.probeClaude === false) return "unknown";
+  const agentRoot = resolve(o.agentRoot);
+  if (!subscriptionModeFromEnv(agentRoot, o.env || process.env)) return "unknown";
+  const injected = typeof o.probeClaude === "function";
+  if (!injected) {
+    const hit = _authProbeMemo.get(agentRoot);
+    if (hit && nowMs - hit.at < AUTH_PROBE_TTL_MS && nowMs >= hit.at) return hit.auth;
+  }
+  let auth = "unknown";
+  try {
+    const r = (injected ? o.probeClaude : defaultProbeClaude)(agentRoot);
+    // A reported-but-unverified ok is NOT evidence (see detectClaudeAuth).
+    if (r && r.auth === "relogin_required") auth = "relogin_required";
+    else if (r && r.auth === "ok" && r.verified === true) auth = "ok";
+  } catch { auth = "unknown"; /* the probe is diagnostic; never fail the beat */ }
+  if (!injected) _authProbeMemo.set(agentRoot, { at: nowMs, auth });
+  return auth;
+}
+
 function scanForRelogin(text) {
   const lower = String(text || "").toLowerCase();
   return RELOGIN_FINGERPRINTS.some((f) => lower.includes(f));
@@ -1111,6 +1350,26 @@ export async function collectStatus(o = {}) {
   if (claudeAuth === "relogin_required") state = "error";
   else if (state === "idle" && subAgentsRunning > 0) state = "busy";
 
+  // 4b. front door (§3.8) — always present, even when no work session runs,
+  // because "who receives inbound and is it alive" is a fact about the SEAT,
+  // not about a task in flight. It therefore rides `machine`: hq's
+  // presence.beat validator keeps `session` strict (`{id,taskClass,model}`)
+  // and `machine` open, so this is the only place a new seat-level fact can
+  // land without a lock-step hq deploy. `session` stays `null` when idle.
+  let door = { frontDoor: "daemon", sessionLive: false };
+  try {
+    const hb = opt.heartbeat !== undefined ? opt.heartbeat : readSessionHeartbeat(opt.agentRoot);
+    door = sessionLiveness(hb, nowMs, { staleMs: opt.sessionStaleMs });
+  } catch { /* defaults: daemon front door, not live */ }
+  machine = { ...machine, ...door };
+
+  // 4c. last upgrade outcome (WP-M6) — `machine.upgrade`, absent until the
+  // first autoupdate attempt; a corrupt file drops the field, never the beat.
+  try {
+    const up = upgradeSummary(opt.autoupdateLast !== undefined ? opt.autoupdateLast : readAutoupdateLast(opt.agentRoot));
+    if (up) machine.upgrade = up;
+  } catch { /* no upgrade field */ }
+
   const status = {
     state,
     activity: act.activity || "idle",
@@ -1147,7 +1406,12 @@ export const _internals = {
   parseSystemProfilerHardware,
   ramLabel,
   collectSpend24h,
+  collectTailnetIp,
+  readSdkVersion,
+  sessionLiveness,
+  upgradeSummary,
   detectClaudeAuth,
+  resetAuthProbeCache,
   scanForRelogin,
   countSubAgents,
   execFileSafe,

package/lib/telemetry/collect.test.mjs

@@ -12,7 +12,7 @@
 
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, utimesSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -32,6 +32,7 @@ import {
   parseSystemProfilerHardware,
   ramLabel,
   collectSpend24h,
+  collectInventory,
   _internals,
 } from "./collect.mjs";
 
@@ -738,3 +739,197 @@ test("memUsedPct ignores an out-of-range memory_pressure reading", async () => {
   const m = await collectMachine({ execFile, os: osImpl, platform: "darwin" });
   assert.equal(m.memUsedPct, 60, "a nonsense percentage falls back rather than propagating");
 });
+
+// ---------------------------------------------------------------------------
+// Fleet identity + front door (§3.8): hostname / tailnetIp / sdkVersion ride
+// the inventory; machine.frontDoor + machine.sessionLive come off the main
+// session's heartbeat file. This is how a fleet-wide upgrade is verified.
+//
+// WHY `machine` and not `session`: hq's presence.beat validator is
+// `session: z.object({id,taskClass,model}).strict()` — an unknown key there
+// rejects the WHOLE beat (BAD_REQUEST before any write) and the seat drops out
+// of the mesh. `machine` is `z.record(z.unknown())` by design, so a new field
+// lands the moment the daemon emits it. `session` stays `null` when no work
+// session runs — consumers read null as "no work session", and that contract
+// is pinned here.
+// ---------------------------------------------------------------------------
+
+test("collectInventory emits hostname, tailnetIp (tailscale ip -4) and sdkVersion", async () => {
+  const osImpl = fakeOs({ cpus: 12, totalmem: 24 * 1024 ** 3 });
+  osImpl.hostname = () => "ethans-mac-mini.local";
+  const inv = await collectInventory({
+    os: osImpl,
+    execFile: fakeExecFile({ "/usr/sbin/system_profiler": SP_HARDWARE, tailscale: "100.95.116.68\n" }),
+    sdkVersion: "2.12.0",
+  });
+  assert.equal(inv.hostname, "ethans-mac-mini.local");
+  assert.equal(inv.tailnetIp, "100.95.116.68");
+  assert.equal(inv.sdkVersion, "2.12.0");
+  assert.equal(inv.device, "Mac mini M4 Pro");
+});
+
+test("collectInventory falls back to the Tailscale.app binary and is fail-open without any", async () => {
+  const osImpl = fakeOs({});
+  osImpl.hostname = () => "h";
+  const appBin = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
+  const viaApp = await collectInventory({
+    os: osImpl, sdkVersion: "x",
+    execFile: fakeExecFile({ [appBin]: "100.68.98.127\nfd7a::1\n" }),
+    inventoryCache: false,
+  });
+  assert.equal(viaApp.tailnetIp, "100.68.98.127");
+  const none = await collectInventory({ os: osImpl, sdkVersion: "x", execFile: fakeExecFile({}), inventoryCache: false });
+  assert.equal(none.tailnetIp, undefined, "no tailscale → the field drops out, nothing throws");
+  assert.equal(none.hostname, "h");
+});
+
+test("sdkVersion is read from the installed @cohortapp/agent-sdk package.json, not from the cache", async () => {
+  const root = mkdtempSync(join(tmpdir(), "inv-sdk-"));
+  try {
+    const osImpl = fakeOs({});
+    osImpl.hostname = () => "h";
+    const first = await collectInventory({ agentRoot: root, os: osImpl, execFile: fakeExecFile({}), sdkVersion: "2.11.17" });
+    assert.equal(first.sdkVersion, "2.11.17");
+    // Same chip/RAM key → the device inventory is served from the cache, but the
+    // version (which an autoupdate changes without touching the hardware) and
+    // the tailnet IP are re-read every time.
+    const second = await collectInventory({ agentRoot: root, os: osImpl, execFile: fakeExecFile({ tailscale: "100.1.1.1\n" }), sdkVersion: "2.12.0" });
+    assert.equal(second.sdkVersion, "2.12.0");
+    assert.equal(second.tailnetIp, "100.1.1.1");
+    assert.equal(second.hostname, "h");
+    // The real resolver: this checkout IS the SDK, so it reports its own version.
+    const real = _internals.readSdkVersion();
+    assert.match(real, /^\d+\.\d+\.\d+/);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("sessionLiveness: a heartbeat younger than 90 s is live; older, missing or malformed is not", () => {
+  const { sessionLiveness } = _internals;
+  const now = Date.parse("2026-09-08T12:00:00Z");
+  assert.deepEqual(sessionLiveness({ ts: "2026-09-08T11:59:30Z", pid: 1, sessionId: "s" }, now), { frontDoor: "session", sessionLive: true });
+  assert.deepEqual(sessionLiveness({ ts: "2026-09-08T11:58:29Z" }, now), { frontDoor: "session", sessionLive: false });
+  assert.deepEqual(sessionLiveness({ ts: now - 89_000 }, now), { frontDoor: "session", sessionLive: true });
+  assert.deepEqual(sessionLiveness(null, now), { frontDoor: "daemon", sessionLive: false });
+  assert.deepEqual(sessionLiveness({ ts: "not a date" }, now), { frontDoor: "session", sessionLive: false });
+  assert.deepEqual(sessionLiveness({ ts: "2026-09-08T11:59:30Z" }, now, { staleMs: 10_000 }), { frontDoor: "session", sessionLive: false });
+});
+
+test("collectStatus: machine carries frontDoor + sessionLive from state/session/heartbeat.json; session stays null when idle", async () => {
+  const root = mkdtempSync(join(tmpdir(), "front-door-"));
+  try {
+    const now = Date.parse("2026-09-08T12:00:00Z");
+    const osImpl = fakeOs({});
+    osImpl.hostname = () => "seat.local";
+    const base = { agentRoot: root, now, os: osImpl, execFile: fakeExecFile({}), subAgentsRunning: 0, powermetrics: false, disk: false, spend: false };
+    // No heartbeat file: the daemon is the front door. No work session → null.
+    const noHb = await collectStatus(base);
+    assert.equal(noHb.machine.frontDoor, "daemon");
+    assert.equal(noHb.machine.sessionLive, false);
+    assert.equal(noHb.session, null, "an idle seat beats session: null (hq's strict session schema; activity.mjs reads null as 'no work session')");
+    // Fresh heartbeat → live main session.
+    mkdirSync(join(root, "state", "session"), { recursive: true });
+    writeFileSync(join(root, "state", "session", "heartbeat.json"), JSON.stringify({ pid: 4242, sessionId: "abc", name: "ethan-main", ts: "2026-09-08T11:59:50Z" }));
+    const live = await collectStatus(base);
+    assert.equal(live.machine.frontDoor, "session");
+    assert.equal(live.machine.sessionLive, true);
+    assert.equal(live.session, null);
+    // Stale (> 90 s) → not live, but the front door is still the session job.
+    writeFileSync(join(root, "state", "session", "heartbeat.json"), JSON.stringify({ pid: 4242, ts: "2026-09-08T11:50:00Z" }));
+    const stale = await collectStatus(base);
+    assert.equal(stale.machine.frontDoor, "session");
+    assert.equal(stale.machine.sessionLive, false);
+    // A running work session keeps EXACTLY the keys hq's strict validator knows.
+    const busy = await collectStatus({ ...base, sessions: [{ sessionId: "s1", kind: "interactive", intent: "session: inbox", model: "sonnet", lastBeat: "2026-09-08T11:59:55Z" }] });
+    assert.equal(busy.session.id, "s1");
+    assert.equal(busy.session.taskClass, "inbox");
+    const allowed = new Set(["id", "taskClass", "model"]);
+    for (const k of Object.keys(busy.session)) assert.ok(allowed.has(k), `session.${k} would be rejected by hq's strict presence.beat schema`);
+    assert.equal(busy.machine.frontDoor, "session");
+    // Inventory identity rides machine.
+    assert.equal(typeof live.machine.hostname, "string");
+    assert.match(live.machine.sdkVersion, /^\d+\.\d+\.\d+/);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("detectClaudeAuth: in subscription mode the shared probe decides; logs still win for relogin", () => {
+  const root = mkdtempSync(join(tmpdir(), "auth-probe-"));
+  try {
+    writeFileSync(join(root, ".env"), "CLAUDE_CODE_OAUTH_TOKEN=t\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n");
+    const calls = [];
+    // An UNVERIFIED "ok" (the CLI merely reports a login — it says loggedIn for
+    // any token value) must not flip the beat from unknown to ok: that is the
+    // one state claudeAuth exists to catch. Only a verified ok is an ok.
+    const probeClaude = (agentRoot) => { calls.push(agentRoot); return { ok: true, mode: "subscription", auth: "ok", verified: false, name: "x" }; };
+    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: {} }), "unknown", "reported-not-verified ok + no logs → unknown, as before the probe existed");
+    assert.deepEqual(calls, [root]);
+    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, env: {}, probeClaude: () => ({ ok: true, auth: "ok", verified: true }) }), "ok");
+    // The probe says relogin → relogin, even with no logs at all.
+    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, env: {}, probeClaude: () => ({ ok: false, auth: "relogin_required" }) }), "relogin_required");
+    // Probe unknown → fall back to what the logs say (nothing here → unknown).
+    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, env: {}, probeClaude: () => ({ ok: true, auth: "unknown" }) }), "unknown");
+    // Clean recent logs + an unverified ok → ok (the logs are the evidence, as before).
+    mkdirSync(join(root, "logs", "sessions"), { recursive: true });
+    const p = join(root, "logs", "sessions", "s.log");
+    writeFileSync(p, "spawn ok, 3 turns, done");
+    const t = new Date(NOW - 60_000);
+    utimesSync(p, t, t);
+    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: {} }), "ok");
+    // A recent relogin fingerprint in the logs wins over a probe that says ok.
+    writeFileSync(p, "… OAuth token has expired …");
+    utimesSync(p, t, t);
+    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: {} }), "relogin_required");
+    // Not in subscription mode → the probe is never forked from the beat.
+    writeFileSync(join(root, ".env"), "ANTHROPIC_API_KEY=sk\n");
+    const before = calls.length;
+    detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: {} });
+    assert.equal(calls.length, before);
+    // A token only in the daemon's ambient env (launchd) is subscription mode too
+    // (clean logs first — a relogin fingerprint decides before any probe runs).
+    writeFileSync(p, "spawn ok"); utimesSync(p, t, t);
+    writeFileSync(join(root, ".env"), "");
+    detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: { CLAUDE_CODE_OAUTH_TOKEN: "t" } });
+    assert.equal(calls.length, before + 1);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+// ---------------------------------------------------------------------------
+// Last upgrade outcome (WP-M6): machine.upgrade = {at, from, to, ok} from
+// state/autoupdate/last.json — fail-open, absent until a first attempt.
+// ---------------------------------------------------------------------------
+
+test("upgradeSummary: the four fleet-view fields from autoupdate's last.json; malformed → null", () => {
+  const { upgradeSummary } = _internals;
+  assert.deepEqual(
+    upgradeSummary({ from: "2.11.17", to: "2.12.0", at: "2026-09-08T12:00:00Z", ok: true, healthy: true, reason: "" }),
+    { at: "2026-09-08T12:00:00Z", from: "2.11.17", to: "2.12.0", ok: true },
+  );
+  assert.deepEqual(
+    upgradeSummary({ from: "2.11.17", to: "2.12.0", at: "2026-09-08T12:00:00Z", ok: false, healthy: true, reason: "unhealthy-rolled-back" }),
+    { at: "2026-09-08T12:00:00Z", from: "2.11.17", to: "2.12.0", ok: false },
+  );
+  assert.equal(upgradeSummary(null), null);
+  assert.equal(upgradeSummary({ ok: true }), null, "no at/to → nothing to report");
+  assert.equal(upgradeSummary("2.12.0"), null);
+});
+
+test("collectStatus: machine.upgrade rides the beat when state/autoupdate/last.json exists, and is absent (not null) when it does not or is corrupt", async () => {
+  const root = mkdtempSync(join(tmpdir(), "tel-upgrade-"));
+  try {
+    const base = { agentRoot: root, os: fakeOs(), execFile: fakeExecFile({}), powermetrics: false, disk: false, spend: false, inventory: false, tailnet: false, sdkVersion: "2.12.0", withAlerts: false, now: Date.parse("2026-09-08T12:00:00Z") };
+    const none = await collectStatus(base);
+    assert.ok(!("upgrade" in none.machine), "absent until a first autoupdate attempt");
+
+    mkdirSync(join(root, "state", "autoupdate"), { recursive: true });
+    writeFileSync(join(root, "state", "autoupdate", "last.json"), JSON.stringify({ from: "2.11.17", to: "2.12.0", at: "2026-09-08T11:30:00Z", ok: true, healthy: true, reason: "" }));
+    const some = await collectStatus(base);
+    assert.deepEqual(some.machine.upgrade, { at: "2026-09-08T11:30:00Z", from: "2.11.17", to: "2.12.0", ok: true });
+    assert.equal(some.session, null, "nothing new lands on the strictly-validated session object");
+
+    writeFileSync(join(root, "state", "autoupdate", "last.json"), "{not json");
+    const corrupt = await collectStatus(base);
+    assert.ok(!("upgrade" in corrupt.machine));
+
+    const injected = await collectStatus({ ...base, autoupdateLast: { from: "1", to: "2", at: "2026-09-08T00:00:00Z", ok: false } });
+    assert.equal(injected.machine.upgrade.ok, false);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});