@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/lib/org/tool-surface.mjs

@@ -105,6 +105,7 @@ import { WORK_STAGES } from "./work-ledger.mjs";
 // sessions, open cadence handoffs and the cached board-mine count, read from
 // local state so the tool answers with no token and no network.
 import { readSessionStatus, statusLine } from "../session/status-summary.mjs";
+import { currentWorkBlock } from "../session/current-work.mjs";
 // The hq vocabularies the model must pick from (an out-of-vocabulary enum value
 // is a BAD_REQUEST). Sourced from the wire contract so the tool table and the
 // normaliser can never disagree about what hq accepts.
@@ -343,6 +344,23 @@ export const ORG_TOOLS = Object.freeze([
     access: "read",
     binding: { kind: "rpc", method: "messaging.history" },
   },
+  {
+    name: "messaging_silences",
+    title: "Why a message got no reply",
+    description:
+      "WHY a person's message got NO reply from any AI colleague (messaging.silences): the routing " +
+      "verdicts recorded when a message was read as addressed to a person, or nobody was elected to " +
+      "answer. Pass messageId for ONE message, or channelId for a channel's recent silences. Use it " +
+      "when someone asks why nobody answered, before guessing.",
+    input_schema: S({
+      messageId: str("The message that went unanswered (one of messageId / channelId is required)."),
+      channelId: str("Channel id for its recent silences (one of messageId / channelId is required)."),
+      windowDays: num("Channel arm only: how far back to look (server default 14, max 90)."),
+      limit: num("Max rows (server default applies)."),
+    }),
+    access: "read",
+    binding: { kind: "rpc", method: "messaging.silences" },
+  },
   {
     name: "messaging_send",
     title: "Send org message",
@@ -892,8 +910,19 @@ export const ORG_TOOLS = Object.freeze([
       "needed. `live:false` with state 'stale' means the session exists but stopped beating; " +
       "'absent' means it is not running (the daemon is then answering inbound itself). Use it " +
       "before addressing the main session with SendMessage, or to answer \"is the front door " +
-      "up?\". Never quote session names to a human — they are internal.",
-    input_schema: S({}),
+      "up?\". `currentWork` is the bounded \"what am I doing right now\" block — the daemon's live " +
+      "sessions with the board item each is for, board items in progress, peers, and whether an " +
+      "interactive session is open on the box (existence only) — so a \"what are you doing?\" is " +
+      "answered from fact. It is SCOPED TO AN AUDIENCE: pass the asker (`audienceSender`, " +
+      "`audienceChannelId`, `audiencePrivate`) and a live session from another conversation is " +
+      "reported as existing only — no summary, no sender, no board id — because its summary is " +
+      "a restatement of someone else's message. With no audience given, nothing " +
+      "cross-conversation is disclosed. Never quote session names to a human — they are internal.",
+    input_schema: S({
+      audienceSender: str("The person the answer is for (their sender name as the inbound item carries it)."),
+      audienceChannelId: str("The channel (or DM) id the answer will be posted in."),
+      audiencePrivate: bool("true when that channel is a 1:1 DM with audienceSender — their own asks from it may then be described back to them."),
+    }),
     access: "read",
     binding: { kind: "local" },
   },
@@ -3095,7 +3124,14 @@ async function screenOrgOutbound({ channel, recipient, text, agentRoot, screenIm
       screen = null;
     }
   }
-  if (typeof screen !== "function") return { allow: true, reason: "" };
+  if (typeof screen !== "function") {
+    // The gate module would not load. This used to return allow SILENTLY — the
+    // whole outbound perimeter off, for every org tool call, with nothing in the
+    // log to say so. Now it is counted, and the one rule that needs no module
+    // still runs.
+    await countFailOpen({ channel, stage: "org-tool-import", error: "send-gate module unavailable", agentRoot, bumpImpl });
+    return lastResortScaffold(text);
+  }
   try {
     const verdict = await screen({
       channel,
@@ -3108,19 +3144,57 @@ async function screenOrgOutbound({ channel, recipient, text, agentRoot, screenIm
     }
     return { allow: true, reason: "", text: verdict?.redactedText };
   } catch (err) {
-    try {
-      let bump = bumpImpl;
-      if (typeof bump !== "function") ({ bump } = await import("../diagnostics/counters.mjs"));
-      bump(
-        "channel.send_gate.fail_open",
-        { channel, stage: "org-tool", error: err && err.message },
-        { agentRoot },
-      );
-    } catch {
-      /* a counter must never crash the path it observes */
+    await countFailOpen({ channel, stage: "org-tool", error: err && err.message, agentRoot, bumpImpl });
+    return lastResortScaffold(text);
+  }
+}
+
+/** Count a send-gate fail-open. Never throws — a counter must not crash the path it observes. */
+async function countFailOpen({ channel, stage, error, agentRoot, bumpImpl }) {
+  try {
+    let bump = bumpImpl;
+    if (typeof bump !== "function") ({ bump } = await import("../diagnostics/counters.mjs"));
+    bump("channel.send_gate.fail_open", { channel, stage, error }, { agentRoot });
+  } catch {
+    /* a counter must never crash the path it observes */
+  }
+}
+
+/**
+ * The fail-open FLOOR. Fail-open is the right posture for POLICY when the shared
+ * gate is unreachable or threw — a transient fault must not gag the agent inside
+ * its own workspace — and the wrong one for SCAFFOLD: the body that gets through
+ * on the day the gate is broken is exactly the body this rule exists to stop, and
+ * every recorded leak was internal.
+ *
+ * So this is the floor no fault lowers — the same literal set as SCAFFOLD_MARKERS
+ * in lib/comms/send-gate.mjs, inlined because the branch it defends is the branch
+ * where importing that module is what failed. `tool-surface.test.mjs` asserts the
+ * two lists stay identical.
+ */
+export const SCAFFOLD_MARKERS_FLOOR = Object.freeze([
+  "<user_message>", "</user_message>", "<thinking>", "</thinking>",
+  "<system-reminder>", "</system-reminder>",
+  "<function_calls>", "</function_calls>", "<function_results>", "</function_results>",
+  "<invoke name=", "</invoke>", "[auto-reply:", "<<<UNTRUSTED_", "<END_UNTRUSTED_",
+]);
+
+/** @returns {{allow:boolean, reason:string}} */
+export function lastResortScaffold(text) {
+  const lc = String(text || "")
+    .replace(/```[\s\S]*?```/g, " ")
+    .replace(/```[\s\S]*$/g, " ")
+    .replace(/(`+)[\s\S]*?\1/g, " ")
+    .toLowerCase();
+  for (const marker of SCAFFOLD_MARKERS_FLOOR) {
+    if (lc.includes(marker.toLowerCase())) {
+      return {
+        allow: false,
+        reason: `session-scaffold marker "${marker}" in the outbound body (send-gate unavailable — the scaffold floor still applies)`,
+      };
     }
-    return { allow: true, reason: "" };
   }
+  return { allow: true, reason: "" };
 }
 
 /** Outbound screen inputs (recipient + text) for a screened tool/method. */
@@ -3355,8 +3429,22 @@ async function executeOrgToolInner(name, input = {}, o = {}) {
     // Offline-capable local tools first.
     if (name === "org_describe") return describeProtocol(input);
     if (name === "session_status") {
-      const status = readSessionStatus(cfg.agentRoot, { now: Date.now() });
-      return okFrame({ ...status, agentRoot: cfg.agentRoot, summary: statusLine(status) });
+      const now = Date.now();
+      const status = readSessionStatus(cfg.agentRoot, { now });
+      // The "what am I doing right now" block (lib/session/current-work): the
+      // same fact the daemon's reply paths inject, so a front door answering
+      // through tools and a daemon child answering from its prompt say the
+      // same thing. Read-only; "" when there is nothing to say.
+      let currentWork = "";
+      try {
+        const audience = {
+          sender: input.audienceSender ? String(input.audienceSender) : "",
+          channelId: input.audienceChannelId ? String(input.audienceChannelId) : "",
+          isPrivate: input.audiencePrivate === true,
+        };
+        currentWork = await currentWorkBlock(cfg.agentRoot, { now, audience });
+      } catch { currentWork = ""; }
+      return okFrame({ ...status, agentRoot: cfg.agentRoot, summary: statusLine(status), currentWork });
     }
 
     // Every network tool needs a token; per §1.4 the server stays up and each

package/lib/org/ui-parity.mjs

@@ -1,7 +1,7 @@
 /**
  * lib/org/ui-parity.mjs — Agent UI-parity helpers (full human-action mirror).
  *
- * A 1:1 mirror of the human Cohort UI: 373 named convenience wrappers over the
+ * A 1:1 mirror of the human Cohort UI: 374 named convenience wrappers over the
  * /v1 RPC binding, one per method behind a HUMAN SURFACE — the things a person
  * can do by clicking (charter, member, team, channel, persona, profile, sop,
  * escalation, annotation, contact, file, memory, compact, notification,
@@ -3311,6 +3311,21 @@ export function messagingSearch(params, o = {}) {
   return call("messaging.search", params || {}, o);
 }
 
+/**
+ * WHY a message in a room got no reply from the ambient responder
+ * (messaging.silences). READ-ONLY. The `responder.silence` verdicts for ONE
+ * message ({ messageId }) or a channel over a window ({ channelId,
+ * windowDays? }); one of the two is required. Each row carries the operator
+ * reason (human_mentioned | addressed_to_human | nobody_elected |
+ * no_responders) and its text. The agent-plane twin of the "Unanswered
+ * messages" panel on /settings/ai — same reader, same decoder.
+ * @param {object} params - { channelId?, messageId?, windowDays?, limit? }
+ * @param {object} o - { base, token, fetchImpl? }
+ */
+export function messagingSilences(params, o = {}) {
+  return call("messaging.silences", params || {}, o);
+}
+
 /**
  * The channels this seat can see (messaging.channels). READ-ONLY.
  * @param {object} params - { kind?, limit? }

package/lib/org/work-ledger.mjs

@@ -22,11 +22,13 @@
  * be two answers within a week. So there is one, and this is a client of it.
  *
  * IDENTITY, NOT DIGESTS. We send the ask's identity (`service`, `channelId`,
- * `messageId`) and let the server derive the dedupe key. The hashing algorithm
- * therefore exists in exactly one repo, and a daemon can never compute a
- * different key than hq would for the same message — which is what makes
- * re-delivery after a dead session find the SAME row instead of opening a
- * second one.
+ * `messageId`, and for a collective ask the ADDRESSEE, which the server takes
+ * from the calling SEAT rather than from the wire) and let the server derive
+ * the dedupe key. The hashing algorithm therefore exists in exactly one repo,
+ * and a daemon can never compute a different key than hq would for the same
+ * message — which is what makes re-delivery after a dead session find the SAME
+ * row instead of opening a second one, and what keeps thirteen seats answering
+ * one broadcast on thirteen rows instead of trampling one.
  *
  * FAIL-OPEN, NEVER SILENT. Every path returns a benign `{tracked:false, reason}`
  * rather than throwing: a board write must never cost the user their reply. But
@@ -43,12 +45,15 @@
 "use strict";
 
 import { isEnabled as orgEnabled, configFromAgent, trackWork } from "./client.mjs";
+import { isRollCallItem } from "./inbound/broadcast.mjs";
 
 /** The stages the ledger understands. Mirrors hq's `WorkStage`. */
 export const WORK_STAGES = ["accepted", "working", "blocked", "review", "done", "failed"];
 
 const MAX_NOTE = 4000;
 const MAX_TITLE = 200;
+/** hq accepts 4000; we clip to the same 1000 `maestro board track --why` uses. */
+const MAX_WHY = 1000;
 const MAX_BODY = 20000;
 
 /**
@@ -137,7 +142,10 @@ function clip(s, n) {
  * @param {boolean} [a.deferred] could this NOT be answered inside the turn?
  *   (true for the session path — the same signal that fires the holding
  *   message; false for the quick-reply path). The server's gate reads it.
- * @param {string} [a.title] row title (defaults server-side from the ask)
+ * @param {string} [a.title] row title, READ ONLY WHEN THE ROW OPENS (defaults
+ *                            server-side from the ask)
+ * @param {string} [a.why]   why the row was opened → `why.reason`, also read
+ *                            only when the row opens (hq protects the key)
  * @param {string} [a.priority] P0..P4, applied when the row is created
  * @param {string} [a.detail] row detail, written once at open
  * @param {string} [a.note] a progress comment for this step
@@ -179,12 +187,35 @@ export async function recordWorkStep(a = {}) {
       // it only when the address is genuine, never guessed. A channel message
       // the agent merely overheard is not assigned work.
       directed: !!(a.item && a.item.priority_signals && a.item.priority_signals.mentions_agent),
+      // ── THE AUDIENCE, AS A FACT — NEVER AS A JUDGEMENT ──────────────────
+      //
+      // A broadcast is not an @mention and `mentions_agent` must never start
+      // claiming it is: that flag gates the daemon's own directed-message
+      // rules, and widening it to cover "everyone" would change what this seat
+      // REPLIES to, not just what it tracks. So the audience travels as its own
+      // structural fact — the inbound join already stamped the verdict reason
+      // `collective`, and `isRollCallItem` reads it back off the flattened item
+      // with no new plumbing.
+      //
+      // WHETHER a collective ask is WORK is emphatically not decided here.
+      // hq's `work/collective.ts` decides it, from the body we are sending,
+      // under the same gate that serves hq's own responder — so a roll-call
+      // ("give me an update") and a hedged aside ("take a look sometime") are
+      // refused by name, and a seat that got its local classifier wrong loses a
+      // well-shaped prompt rather than opening a row it should not have.
+      collective: isRollCallItem(a.item),
       authorKind: a.item && a.item.author_kind === "AI_AGENT" ? "AI_AGENT" : "HUMAN",
       deferred: a.deferred === true,
     };
     const requester = requesterMemberId(a.item);
     if (requester) params.requesterId = requester;
     if (a.title) params.title = clip(a.title, MAX_TITLE);
+    // `why` lands as the row's `why.reason` on hq (methods/board/track.ts →
+    // ledger.ts `if (!taskId)`). WRITTEN ONCE, AT OPEN: `reason` is in hq's
+    // PROTECTED_WHY_KEYS, so sending it on a later step is accepted and
+    // ignored. Same for `title`. Callers that want either must send it with
+    // the step that opens the row.
+    if (a.why) params.why = clip(a.why, MAX_WHY);
     // The classifier's urgency, already mapped onto hq's P-scale by the caller
     // (`board-mirror.mjs#boardPriority` — hq 400s the whole call on anything
     // that is not P0..P4). Only ever read when the row is CREATED.

package/lib/rate-guard.mjs

@@ -127,6 +127,10 @@ export function readState(provider, deps) {
       consecutive429: numOr0(raw.consecutive429),
       lastBackoffMs: numOr0(raw.lastBackoffMs),
       updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : undefined,
+      // cohort holds only (recordCohortRefusal): what kind of hold this is.
+      ...(typeof raw.kind === "string" ? { kind: raw.kind } : {}),
+      ...(typeof raw.code === "string" ? { code: raw.code } : {}),
+      ...(typeof raw.holdKind === "string" ? { holdKind: raw.holdKind } : {}),
     };
   } catch {
     return { ...EMPTY_STATE };
@@ -204,6 +208,14 @@ export function recordSuccess(provider, deps) {
   // Only rewrite if there is something to clear (avoids churning the file on
   // every successful spawn).
   const prev = readState(provider, deps);
+  // A cohort hold is not a breaker a clean run disproves. A window/spend
+  // (defer_until) or credits hold says "the gateway will refuse until T": a
+  // session admitted before the window ran out that exits cleanly afterwards
+  // proves nothing about T. Only a still-live `retry` hold (concurrency,
+  // overload) is cleared by success; the others stand until they expire.
+  if (sanitizeProvider(provider) === COHORT_BACKEND && prev.openUntil > clock(deps)() && prev.holdKind !== "retry") {
+    return prev;
+  }
   if (prev.openUntil === 0 && prev.consecutive429 === 0 && prev.lastBackoffMs === 0) {
     return { ...EMPTY_STATE };
   }
@@ -309,4 +321,105 @@ export function recordUsageLimit(provider, resetAt, deps) {
   return { openUntil: next.openUntil, resetAt: typeof resetAt === "number" && resetAt > now ? resetAt : null };
 }
 
-export const _internals = { RATE_BASE_BACKOFF_MS, RATE_MAX_BACKOFF_MS, RATE_BACKOFF_FACTOR, RATE_USAGE_LIMIT_HOLD_MS };
+// ---------------------------------------------------------------------------
+// cohort-llm refusals (design §4.6 / §8.3)
+// ---------------------------------------------------------------------------
+//
+// A cohort-llm hard refusal is NOT a provider incident, and must never be read
+// as one:
+//   - it is keyed by the backend "cohort" (state/rate-limits/cohort.json), never
+//     the Anthropic provider file, and it never touches the router's backend
+//     breaker (lib/model-router/health.mjs) — a seat that spent its weekly
+//     window has not found a broken backend;
+//   - a limit or spend refusal holds until the refusal's own resetsAt, not a
+//     decorrelated-jitter backoff (retrying a drained window only burns spawns);
+//   - the English stderr regexes above stay exactly as they were for the
+//     claude/anthropic backend. Call sites check `classifyCohortRefusal` FIRST
+//     on a cohort-routed run, because a cohort 429 body carries the words
+//     "rate_limit_error" and would otherwise trip the Anthropic breaker.
+
+import { parseRefusalBody, refusalDisposition } from "./org/quota.mjs";
+
+/** The backend key every cohort refusal is recorded under. */
+export const COHORT_BACKEND = "cohort";
+/** A credits hold re-checks after this long (a top-up can land any time). */
+export const COHORT_CREDITS_RECHECK_MS = num(process.env.COHORT_CREDITS_RECHECK_MS, 10 * 60 * 1000);
+
+/**
+ * Find a cohort refusal in a run's output: an engine JSON result, a gateway
+ * error body echoed by the claude binary, or a bare refusal object. Scans
+ * every balanced top-level JSON object in the text. null when there is none.
+ * @param {string} text
+ * @returns {object|null} a normalised refusal
+ */
+export function classifyCohortRefusal(text) {
+  if (!text || typeof text !== "string" || !/cohort_/.test(text)) return null;
+  for (const candidate of jsonObjects(text)) {
+    let o;
+    try { o = JSON.parse(candidate); } catch { continue; }
+    const direct = parseRefusalBody(o);
+    if (direct) return direct;
+    // An engine result: {is_error, error:{code,...}} or {cohort:{refusal}}.
+    const nested = o && typeof o === "object" ? (o.cohort && o.cohort.refusal) || o.refusal : null;
+    const r = nested ? parseRefusalBody({ cohort: nested }) : null;
+    if (r) return r;
+  }
+  return null;
+}
+
+/** Yield balanced top-level {...} substrings (string-literal aware). */
+function* jsonObjects(text) {
+  let depth = 0, start = -1, inStr = false, esc = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (c === "\\") esc = true;
+      else if (c === '"') inStr = false;
+      continue;
+    }
+    if (c === '"') { if (depth > 0) inStr = true; continue; }
+    if (c === "{") { if (depth === 0) start = i; depth++; }
+    else if (c === "}" && depth > 0) { depth--; if (depth === 0 && start >= 0) { yield text.slice(start, i + 1); start = -1; } }
+  }
+}
+
+/**
+ * Record a cohort refusal against the "cohort" backend per its disposition:
+ *   defer_until       hold until resetsAt (never shortens a longer hold)
+ *   hold_for_credits  hold for COHORT_CREDITS_RECHECK_MS, then look again
+ *   retry             hold for afterMs
+ *   fail              nothing recorded (not a timing problem)
+ * The Anthropic provider file and the backoff/consecutive counters are never
+ * touched.
+ *
+ * @param {object} refusal  a normalised refusal (lib/org/quota.mjs)
+ * @param {object} [deps]   { now?, stateDir?, agentRoot?, retryAfterMs? }
+ * @returns {{recorded:boolean, openUntil:number|null, disposition:object}}
+ */
+export function recordCohortRefusal(refusal, deps) {
+  const now = clock(deps)();
+  const disposition = refusalDisposition(refusal, { now, retryAfterMs: deps && deps.retryAfterMs });
+  let until = null;
+  if (disposition.kind === "defer_until") until = disposition.until;
+  else if (disposition.kind === "hold_for_credits") until = now + COHORT_CREDITS_RECHECK_MS;
+  else if (disposition.kind === "retry") until = now + disposition.afterMs;
+  if (until === null || until <= now) return { recorded: false, openUntil: null, disposition };
+  const prev = readState(COHORT_BACKEND, deps);
+  // The hold that ends LAST names the kind: a short retry recorded inside a
+  // live multi-day window hold must not relabel it as clearable.
+  const prevLive = prev.openUntil > now;
+  const keepPrev = prevLive && prev.openUntil >= until;
+  const next = {
+    openUntil: Math.max(prev.openUntil, until),
+    consecutive429: prev.consecutive429,
+    lastBackoffMs: prev.lastBackoffMs,
+    kind: "cohort_refusal",
+    code: keepPrev && prev.code ? prev.code : disposition.code,
+    holdKind: keepPrev ? (prev.holdKind || "defer_until") : disposition.kind,
+  };
+  writeState(COHORT_BACKEND, next, deps);
+  return { recorded: true, openUntil: next.openUntil, disposition };
+}
+
+export const _internals = { RATE_BASE_BACKOFF_MS, RATE_MAX_BACKOFF_MS, RATE_BACKOFF_FACTOR, RATE_USAGE_LIMIT_HOLD_MS, jsonObjects };

package/lib/resource-governor.mjs

@@ -229,11 +229,44 @@ function reaperAgentRoot(explicit) {
  * session either. Requires a FULL command line (`ps -eo … command`), not `comm`.
  */
 export function isDaemonSpawnedClaude(line, agentRoot) {
-  if (!/claude/i.test(line)) return false;
-  if (/Claude\.app|Claude Helper|watchdog|grep|ps -eo/.test(line)) return false;
-  if (!/(^|\s)--print(\s|$)/.test(line)) return false;      // interactive Claude Code is never --print
-  if (agentRoot && !line.includes(agentRoot)) return false; // scope to THIS agent's own sessions
-  return true;
+  const kind = classifyGovernedProcess(line, agentRoot);
+  return kind === "claude" || kind === "engine-run";
+}
+
+/** The engine's headless entry: `…/lib/engine/cli.mjs run` (the adapter always emits `run -p`). */
+const ENGINE_RUN_RE = /(^|\s)\S*\/lib\/engine\/cli\.mjs\s+run(\s|$)/;
+/** A long-lived engine front door sets its process title to `cohort-session:<name>` (session-runtime/runner.mjs). */
+const ENGINE_SESSION_RE = /(^|\s)cohort-session:\S/;
+
+/**
+ * What kind of agent process a `ps` line is, as the governor sees it. Pure.
+ *
+ *   "claude"          a daemon-spawned `claude --print` lane for this agent
+ *   "engine-run"      a daemon-spawned engine lane for this agent: `node …/lib/engine/cli.mjs run -p …`
+ *                     (the engine twin of `claude --print`; the agent root is on its argv the same way,
+ *                     via `--mcp-config <AGENT_ROOT>/.mcp.json`)
+ *   "engine-session"  a long-lived engine front door or peer (`cohort-session:<name>`)
+ *   null              anything else — including a human's interactive Claude Code session
+ *
+ * The concurrency ceiling and the reaper count "claude" and "engine-run" only. An
+ * "engine-session" is the engine twin of an interactive Claude Code session (a front
+ * door `claude --name <first>-main`, or a peer): those are never `--print`, so the
+ * governor has never counted or reaped them, and a long-lived front door must not be
+ * killed at REAP_SESSION_MS. Its title also carries no agent root to scope by.
+ *
+ * @param {string} line  a FULL `ps -eo …,command` line
+ * @param {string} [agentRoot]
+ * @returns {"claude"|"engine-run"|"engine-session"|null}
+ */
+export function classifyGovernedProcess(line, agentRoot) {
+  const l = String(line || "");
+  if (ENGINE_SESSION_RE.test(l)) return "engine-session";
+  if (/Claude\.app|Claude Helper|watchdog|grep|ps -eo/.test(l)) return null;
+  if (agentRoot && !l.includes(agentRoot)) return null;      // scope to THIS agent's own sessions
+  if (ENGINE_RUN_RE.test(l) && /(^|\s)(-p|--print)(\s|$)/.test(l)) return "engine-run";
+  if (!/claude/i.test(l)) return null;
+  if (!/(^|\s)--print(\s|$)/.test(l)) return null;           // interactive Claude Code is never --print
+  return "claude";
 }
 
 export function liveClaudeStats(opts = {}) {
@@ -248,7 +281,9 @@ export function liveClaudeStats(opts = {}) {
     // FULL command (not comm) so we can require `--print` + the agent root — i.e.
     // count ONLY this daemon's own sessions, never a human's interactive Claude
     // Code session (which would otherwise inflate the count and get reaped).
-    const out = execFileSync("/bin/ps", ["-eo", "pid,etime,rss,command"], { encoding: "utf-8", timeout: 4000 });
+    const out = typeof opts.psImpl === "function"
+      ? String(opts.psImpl())
+      : execFileSync("/bin/ps", ["-eo", "pid,etime,rss,command"], { encoding: "utf-8", timeout: 4000 });
     let count = 0;
     let rssKb = 0;
     let stale = 0;