@dylanpiercey/work 0.0.201 → 0.0.203

package/dist/{_BntJJ2eD.js → _B9FeLAO5.js}

@@ -36,14 +36,31 @@ var config = {
 	* `3000-work.example.com`. The server accepts both; this only picks
 	* which one the port chips link to. `dash` stays one label under the
 	* zone, which is what a free Cloudflare certificate covers. */
-	portHosts: process.env.WORK_PORT_HOSTS === "dash" ? "dash" : "sub"
+	portHosts: process.env.WORK_PORT_HOSTS === "dash" ? "dash" : "sub",
+	/** The address the server listens on: this machine only, unless set
+	* (`0.0.0.0` / `::` for every interface, or one address) — reaching it
+	* from elsewhere is an auth wrapper's job (server/access.ts). Under
+	* systemd the socket unit binds, and `work setup` writes this into it. */
+	listen: process.env.WORK_LISTEN || "127.0.0.1",
+	/** The auth wrapper's addresses when it runs on another machine (IPs or
+	* CIDRs, or `*`): the only peers besides this machine work answers. */
+	trustedProxies: list(process.env.WORK_TRUSTED_PROXIES),
+	/** Names beyond this machine's own that work answers to — the ones a
+	* wrapper in front of it serves (their port subdomains included). */
+	allowedHosts: list(process.env.WORK_ALLOWED_HOSTS)
 };
+function list(value) {
+	return (value || "").split(",").map((s) => s.trim()).filter(Boolean);
+}
 fs.mkdirSync(config.dataDir, { recursive: true });
 //#endregion
 //#region src/server/exec.ts
 /** Dedicated tmux server so we never touch another multiplexer's or the
-* user's default tmux. */
-var TMUX_SOCKET = "work";
+* user's default tmux. `WORK_TMUX_SOCKET` names another for a server that
+* must not share the machine's (the smoke test, a throwaway): each start
+* detaches every client on its socket, which on the live one cut every
+* open terminal. */
+var TMUX_SOCKET = process.env.WORK_TMUX_SOCKET || "work";
 var execFileAsync = promisify(execFile);
 async function run$1(cmd, args, cwd, env, opts = {}) {
 	const child = execFileAsync(cmd, args, {
@@ -305,7 +322,8 @@ var agents_default = [
 			"shell": "sh"
 		},
 		"icon": "M4 5.25h16v2.9h-2.35v10.6h-2.9V8.15h-3.5v10.6h-2.9V8.15H7.1c-.62 0-1.13.32-1.46.86l-.36.6L4 8.6V5.25z",
-		"reauth": "pi"
+		"reauth": "pi",
+		"pathDirs": ["~/.pi/agent/bin"]
 	}
 ];
 //#endregion
@@ -890,7 +908,7 @@ function shared(fn, ttlMs) {
 }
 //#endregion
 //#region src/server/events.ts
-var listeners = /* @__PURE__ */ new Set();
+var listeners$1 = /* @__PURE__ */ new Set();
 function publish(type, data) {
 	publishJson(type, data === void 0 ? void 0 : JSON.stringify(data), data);
 }
@@ -902,20 +920,20 @@ function publishJson(type, dataJson, data) {
 		data,
 		frame: dataJson === void 0 ? JSON.stringify({ type }) : `{"type":${JSON.stringify(type)},"data":${dataJson}}`
 	};
-	for (const listener of [...listeners]) try {
+	for (const listener of [...listeners$1]) try {
 		listener(event);
 	} catch (err) {
 		console.error("[work] event listener error", err);
 	}
 }
 function subscribe(listener) {
-	listeners.add(listener);
-	return () => listeners.delete(listener);
+	listeners$1.add(listener);
+	return () => listeners$1.delete(listener);
 }
 /** Connected SSE clients — lets background watchers idle when no one
 * is listening. */
 function subscriberCount() {
-	return listeners.size;
+	return listeners$1.size;
 }
 //#endregion
 //#region node_modules/.pnpm/bn.js@4.12.5/node_modules/bn.js/lib/bn.js
@@ -6563,12 +6581,20 @@ var import_src = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((export
 		sendNotification: webPush.sendNotification.bind(webPush)
 	};
 })))(), 1);
-/** Web Push for "agent waiting" alerts. VAPID keys are generated once and
-* kept in the data dir; subscriptions live in sqlite and are pruned when a
-* push endpoint reports them gone. */
+/** Web Push for agent alerts (a turn finished, an agent stopped on the
+* user). VAPID keys are generated once and kept in the data dir;
+* subscriptions live in sqlite and are pruned when a push endpoint reports
+* them gone. */
 function pushPublicKey() {
 	return keys().publicKey;
 }
+/** Whether a subscription's keys are the sizes Web Push needs (a P-256
+* point and a 16-byte secret): one that is not fails every send, forever,
+* with nothing to say it is gone. */
+function validSubscription(subscription) {
+	const bytes = (b64) => Buffer.from(b64, "base64url").length;
+	return bytes(subscription.keys.p256dh) === 65 && bytes(subscription.keys.auth) === 16;
+}
 function saveSubscription(subscription) {
 	db.prepare("INSERT OR REPLACE INTO push_subscriptions (endpoint, data) VALUES (?, ?)").run(subscription.endpoint, JSON.stringify(subscription));
 }
@@ -6576,13 +6602,15 @@ function deleteSubscription(endpoint) {
 	db.prepare("DELETE FROM push_subscriptions WHERE endpoint = ?").run(endpoint);
 }
 /** Push to every subscribed device, or to the one `endpoint` names (a
-* test from Settings → Notifications). */
-async function sendPush(payload, endpoint) {
+* test from Settings → Notifications), and say what became of each.
+* `urgency`: how hard a phone should wake for it (a finished turn can wait
+* for the next wake; a question cannot). */
+async function sendPush(payload, { endpoint, urgency = "high" } = {}) {
 	const rows = all("SELECT endpoint, data FROM push_subscriptions").filter((row) => !endpoint || row.endpoint === endpoint);
-	if (!rows.length) return;
+	if (!rows.length) return [];
 	const { publicKey, privateKey } = keys();
 	const body = JSON.stringify(payload);
-	await Promise.all(rows.map(async (row) => {
+	return Promise.all(rows.map(async (row) => {
 		try {
 			await import_src.default.sendNotification(JSON.parse(row.data), body, {
 				vapidDetails: {
@@ -6591,26 +6619,45 @@ async function sendPush(payload, endpoint) {
 					privateKey
 				},
 				TTL: 600,
-				urgency: "high"
+				urgency,
+				timeout: 1e4
 			});
+			return { ok: true };
 		} catch (err) {
 			const status = err.statusCode;
 			if (status === 404 || status === 410) deleteSubscription(row.endpoint);
 			else console.warn("[work] push failed", status ?? err);
+			return {
+				ok: false,
+				status,
+				error: status === 404 || status === 410 ? "the push service no longer knows this device" : status === 401 || status === 403 ? "the push service refused this server's key" : err.message || String(err)
+			};
 		}
 	}));
 }
 var VAPID_SUBJECT = "https://github.com/DylanPiercey/work";
 var cachedKeys = null;
+/** The server's key pair, made once. Only a missing file makes a new
+* one: every subscription was made for the old key, and a new key fails
+* every send to them, so a file that will not read is an error to see,
+* not a reason to silence every device. Written whole or not at all. */
 function keys() {
 	if (cachedKeys) return cachedKeys;
 	const file = path.join(config.dataDir, "vapid.json");
+	let text = null;
 	try {
-		cachedKeys = JSON.parse(fs.readFileSync(file, "utf8"));
-	} catch {
-		cachedKeys = import_src.default.generateVAPIDKeys();
-		fs.writeFileSync(file, JSON.stringify(cachedKeys), { mode: 384 });
+		text = fs.readFileSync(file, "utf8");
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+	}
+	if (text != null) {
+		cachedKeys = JSON.parse(text);
+		return cachedKeys;
 	}
+	cachedKeys = import_src.default.generateVAPIDKeys();
+	const tmp = `${file}.${process.pid}.tmp`;
+	fs.writeFileSync(tmp, JSON.stringify(cachedKeys), { mode: 384 });
+	fs.renameSync(tmp, file);
 	return cachedKeys;
 }
 var ACCENT_RE = /^#[0-9a-f]{6}$/;
@@ -6764,7 +6811,8 @@ var meta_default = {
 		"shell": "sh"
 	},
 	icon: "M4 5.25h16v2.9h-2.35v10.6h-2.9V8.15h-3.5v10.6h-2.9V8.15H7.1c-.62 0-1.13.32-1.46.86l-.36.6L4 8.6V5.25z",
-	reauth: "pi"
+	reauth: "pi",
+	pathDirs: ["~/.pi/agent/bin"]
 };
 //#endregion
 //#region src/agents/meta.ts
@@ -6824,14 +6872,37 @@ var scraped = /* @__PURE__ */ new Map();
 var reasons = /* @__PURE__ */ new Map();
 var summaries = /* @__PURE__ */ new Map();
 var viewers = /* @__PURE__ */ new Map();
+/** "Finished" pushes waiting out `DONE_SETTLE_MS`. */
+var pendingDone = /* @__PURE__ */ new Map();
+/** When each session's hooks last reported, since its process started:
+* a session whose hooks never report (not loaded, not trusted, turned
+* off) is left to the pane scraper rather than to silence. */
+var reportedAt = /* @__PURE__ */ new Map();
+/** A turn's end is pushed once it has stayed ended this long. Stop fires
+* again each time something sends the agent back to work (a stop hook
+* that continues it, a goal loop, background subagents reporting in), and
+* each of those ends was a "Finished" on the phone while it carried on. */
+var DONE_SETTLE_MS = 3e3;
+var listeners = /* @__PURE__ */ new Set();
+/** Called on every phase transition (the status snapshot drops itself). */
+function onPhaseChange(fn) {
+	listeners.add(fn);
+}
 function setAgentPhase(sessionId, phase, reason, summary) {
+	reportedAt.set(sessionId, Date.now());
+	cancelDone(sessionId);
+	if (phase === "idle") {
+		if (phases.has(sessionId)) applyChange(sessionId, () => dropHook(sessionId));
+		return;
+	}
 	if (phase === "waiting" && reason === "done") {
+		const failed = phases.get(sessionId) === "waiting" && reasons.get(sessionId) === "attention";
 		if (summary) summaries.set(sessionId, summary);
-		notify(sessionId, "done");
-		if (phases.has(sessionId)) applyChange(sessionId, () => {
-			phases.delete(sessionId);
-			reasons.delete(sessionId);
-		}, true);
+		if (phases.has(sessionId)) applyChange(sessionId, () => dropHook(sessionId));
+		if (!failed) pendingDone.set(sessionId, setTimeout(() => {
+			pendingDone.delete(sessionId);
+			notify(sessionId, "done");
+		}, DONE_SETTLE_MS));
 		return;
 	}
 	if (phase === "waiting" && summary) summaries.set(sessionId, summary);
@@ -6844,7 +6915,43 @@ function setAgentPhase(sessionId, phase, reason, summary) {
 	applyChange(sessionId, () => {
 		phases.set(sessionId, phase);
 		if (phase === "waiting" && reason) reasons.set(sessionId, reason);
-	}, true);
+	}, reasons.get(sessionId) !== next);
+}
+function dropHook(sessionId) {
+	phases.delete(sessionId);
+	reasons.delete(sessionId);
+}
+function cancelDone(sessionId) {
+	const timer = pendingDone.get(sessionId);
+	if (!timer) return;
+	clearTimeout(timer);
+	pendingDone.delete(sessionId);
+}
+/** What the session's hooks last said, apart from the scraper. */
+function hookPhase(sessionId) {
+	return phases.get(sessionId);
+}
+/** When the session's hooks last reported (undefined: never, this run). */
+function hookReportedAt(sessionId) {
+	return reportedAt.get(sessionId);
+}
+/** A hook's "working" whose pane has gone still: the turn ended without
+* a hook saying so (an interrupt, a failure the CLI reports no hook for),
+* since every agent's screen animates while it works. Idle, no push. */
+function settleQuietWorking(sessionId) {
+	if (phases.get(sessionId) !== "working") return;
+	applyChange(sessionId, () => dropHook(sessionId));
+}
+/** The user answered at the terminal while the session was stopped on
+* them (approved, denied, picked, interrupted): no longer waiting on
+* them, whether or not the CLI has a hook for the answer. Working until
+* a hook says otherwise, or the pane goes still. */
+function noteUserAnswered(sessionId) {
+	if (phases.get(sessionId) !== "waiting") return;
+	applyChange(sessionId, () => {
+		phases.set(sessionId, "working");
+		reasons.delete(sessionId);
+	});
 }
 /** Live visible-terminal count per session, reported by the term server;
 * a session someone is watching does not push notifications. */
@@ -6888,15 +6995,19 @@ async function notify(sessionId, reason) {
 			workspaceId: row.workspace_id,
 			sessionId
 		}
-	}).catch(() => {});
+	}, { urgency: reason === "done" ? "normal" : "high" }).catch(() => {});
 }
+/** Forget everything about a session: its pane went away, or it is being
+* started afresh (a respawn must not inherit the last process's wait). */
 function clearAgentPhase(sessionId) {
+	cancelDone(sessionId);
+	summaries.delete(sessionId);
+	reportedAt.delete(sessionId);
 	if (!phases.has(sessionId) && !scraped.has(sessionId)) return;
 	applyChange(sessionId, () => {
 		phases.delete(sessionId);
 		scraped.delete(sessionId);
 		reasons.delete(sessionId);
-		summaries.delete(sessionId);
 	});
 }
 /** What a session is doing. The hook wins where there is one: it reports
@@ -6904,26 +7015,23 @@ function clearAgentPhase(sessionId) {
 function agentPhase(sessionId) {
 	return phases.get(sessionId) ?? scraped.get(sessionId);
 }
-/** A freshly booted server's first scans re-derive scraped state from
-* panes that were already that way — that must not re-buzz every device
-* after a deploy. Hook reports are exempt: each is a real transition the
-* agent just made, and one that lands right after a restart (the turn
-* that was running through it) is exactly the one worth hearing about. */
-var BOOT_GRACE_MS = 15e3;
-var bootedAt = Date.now();
-function applyChange(sessionId, mutate, fromHook = false) {
+/** Apply a mutation and broadcast when it moved the session's phase (or,
+* `force`, its reason: finished and blocked draw differently). Only a
+* hook ever reports "waiting", so a transition into it is a push. */
+function applyChange(sessionId, mutate, force = false) {
 	const before = agentPhase(sessionId);
 	mutate();
 	const after = agentPhase(sessionId);
-	if (before === after) return;
+	if (before === after && !force) return;
 	publishChange(sessionId);
-	if (after === "waiting" && before !== "waiting" && (fromHook || Date.now() - bootedAt > BOOT_GRACE_MS)) notify(sessionId, reasons.get(sessionId) ?? "attention");
+	if (after === "waiting" && before !== "waiting") notify(sessionId, reasons.get(sessionId) ?? "attention");
 }
 function publishChange(sessionId) {
+	for (const fn of listeners) fn();
 	const row = get("SELECT workspace_id FROM sessions WHERE id = ?", sessionId);
 	if (row?.workspace_id) {
 		const workspaceId = row.workspace_id;
-		import("./_V3gojze9.js").then((m) => m.notifySessionsChanged(workspaceId));
+		import("./_7W8iLTql.js").then((m) => m.notifySessionsChanged(workspaceId));
 		return;
 	}
 	publish("sessions.changed");
@@ -6933,37 +7041,42 @@ function publishChange(sessionId) {
 /** Shell command a CLI hook runs to report a state: POSTs the hook's own
 * stdin JSON to the app, which mines it for a notification summary. `exit 0`
 * always — a state report must never block the agent. Session and port
-* come from the env tmux gave the pane (see sessions.ts). */
-function stateCurl(state, reason) {
-	const qs = `session=$WORK_SESSION_ID&state=${state}` + (reason ? `&reason=${reason}` : "");
-	return `[ -n "$WORK_SESSION_ID" ] && curl -sf -m 2 --retry 2 --retry-delay 1 --retry-connrefused -X POST "http://127.0.0.1:\${WORK_APP_PORT:-${config.appPort}}/api/agent-state?${qs}" -H 'content-type: application/json' --data-binary @- >/dev/null 2>&1; exit 0`;
+* come from the env tmux gave the pane (see sessions.ts); `family` names
+* the CLI, so one run inside another session's pane (a nested `grok -p`)
+* does not report as that session's agent. */
+function stateCurl(family, state, reason) {
+	const qs = `session=$WORK_SESSION_ID&agent=${family}&state=${state}` + (reason ? `&reason=${reason}` : "");
+	return `[ -n "$WORK_SESSION_ID" ] && curl -sf --connect-timeout 1 -m 2 -X POST "http://127.0.0.1:\${WORK_APP_PORT:-${config.appPort}}/api/agent-state?${qs}" -H 'content-type: application/json' --data-binary @- >/dev/null 2>&1; exit 0`;
 }
 /** Claude-format hook groups (`{matcher?, hooks:[{type:"command",command}]}`)
 * for a hook map — the JSON shape Claude, Copilot plugins and Grok all read. */
-function claudeStyleHooks(map, extra = {}) {
+function claudeStyleHooks(family, map, extra = {}) {
 	const hooks = {};
 	for (const [event, state, reason, matcher] of map) (hooks[event] ??= []).push({
 		...matcher ? { matcher } : {},
 		hooks: [{
 			type: "command",
-			command: stateCurl(state, reason),
+			command: stateCurl(family, state, reason),
 			...extra
 		}]
 	});
 	return hooks;
 }
+/** The notifications that mean the agent is stopped on the user, and how
+* each reads. Only these: the CLIs also notify about an idle session (a
+* nudge a minute after Stop already pushed), a finished sign-in, a
+* question already answered, a subagent done, a quota wait resuming —
+* none of them a session needing anything, and each one read as
+* "attention" buzzed a phone and painted the nav red for nothing. */
 var NOTIFICATION_LABELS = {
 	permission_prompt: "Waiting for permission",
 	agent_needs_input: "Waiting for input",
 	elicitation_dialog: "Asking a question",
 	elicitation_url_dialog: "Needs a browser sign-in"
 };
-/** Notifications that mean the agent is nudging about an idle session
-* rather than blocking on one. Stop already said the turn ended and
-* pushed for it; reporting the nudge too painted the nav red for a
-* session that merely sat there, and — read as "done" — buzzed a second
-* time a minute after every finish. Dropped entirely. */
-var NUDGE_NOTIFICATIONS = /* @__PURE__ */ new Set(["idle_prompt"]);
+/** A matcher for the notifications worth a report, for CLIs whose hook
+* config takes one (so the rest never run a hook at all). */
+var NOTIFICATION_MATCHER = Object.keys(NOTIFICATION_LABELS).join("|");
 function str$1(v) {
 	return typeof v === "string" ? v.trim() : "";
 }
@@ -6972,12 +7085,12 @@ function notificationType(p) {
 	return str$1(p.notification_type) || str$1(p.notificationType);
 }
 /** Read a Claude-format payload: last message on Stop, the CLI's own
-* notification line (or a label for its type) on Notification, and the
-* idle nudge dropped. Families that speak this dialect start here and
-* add their own quirks. */
+* notification line (or a label for its type) on Notification, and any
+* other notification dropped. Families that speak this dialect start
+* here and add their own quirks. */
 function readClaudeStyle(p, reported) {
 	const kind = notificationType(p);
-	if (NUDGE_NOTIFICATIONS.has(kind)) return { ignore: true };
+	if (kind && !NOTIFICATION_LABELS[kind]) return { ignore: true };
 	const reason = reported;
 	const text = str$1(p.last_assistant_message) || str$1(p["last-assistant-message"]) || str$1(p.lastAssistantMessage);
 	if (text) return {
@@ -6997,6 +7110,16 @@ function cleanSummary(text) {
 	if (!flat) return void 0;
 	return flat.length > 180 ? `${flat.slice(0, 177)}…` : flat;
 }
+/** Write a file work keeps in its data dir for a CLI to load (a plugin,
+* an extension, a hook list), only when its content moved: each launch
+* asks, and a rewrite would bump the mtime a running CLI may watch. */
+function writeIfChanged(file, content) {
+	try {
+		if (fs.readFileSync(file, "utf8") === content) return;
+	} catch {}
+	fs.mkdirSync(path.dirname(file), { recursive: true });
+	fs.writeFileSync(file, content);
+}
 //#endregion
 //#region src/server/usage/shared.ts
 var HOME = os.homedir();
@@ -7231,11 +7354,16 @@ function numberedDirs() {
 * macOS Claude Code keeps them in the login keychain instead (service
 * "Claude Code-credentials"), which `security` reads back as the same JSON.
 * The keychain read is cached per process tick of the usage refresh — it
-* forks a process — and only tried for the primary account. */
+* forks a process — and only tried for the primary account. Read once per
+* account per refresh: a row asks for them half a dozen times, and every
+* refresh lists the accounts afresh. */
+var credentialsRead = /* @__PURE__ */ new WeakMap();
 var credentials = (account) => {
-	const file = readJson(path.join(account.dir, ".credentials.json"));
-	if (file || process.platform !== "darwin" || account.suffix) return file;
-	return keychainCredentials();
+	if (credentialsRead.has(account)) return credentialsRead.get(account);
+	let cred = readJson(path.join(account.dir, ".credentials.json"));
+	if (!cred && process.platform === "darwin" && !account.suffix) cred = keychainCredentials();
+	credentialsRead.set(account, cred);
+	return cred;
 };
 var keychain = null;
 function keychainCredentials() {
@@ -7273,7 +7401,7 @@ function credentialNote(account) {
 	if (expired(obj(cred.claudeAiOauth).expiresAt)) return "token expired — use this Claude account to refresh";
 	return "usage unavailable";
 }
-function tokenExpired(account) {
+function tokenExpired$1(account) {
 	const cred = credentials(account);
 	return cred ? expired(obj(cred.claudeAiOauth).expiresAt) : false;
 }
@@ -7297,6 +7425,38 @@ async function fetchUsage$3(account) {
 		Accept: "application/json"
 	} }));
 }
+/** How often an account's plan is asked for: it changes on an upgrade,
+* not by the minute, so once an hour stands behind the usage refresh. */
+var PROFILE_TTL_MS = 36e5;
+var profiles = /* @__PURE__ */ new Map();
+/** The account's plan as Anthropic has it now. `.claude.json` holds what
+* Claude Code saw at sign-in, and it only asks again on a new login, so an
+* upgrade (Max 5x → 20x) kept reading as the old plan until then. Asked
+* with the same token as the usage; the cached plan stands in when it
+* cannot be. */
+async function livePlan(account) {
+	const hit = profiles.get(account.dir);
+	if (hit && Date.now() - hit.at < PROFILE_TTL_MS) return hit.plan;
+	const token = str(obj(credentials(account)?.claudeAiOauth).accessToken);
+	if (!token) return null;
+	try {
+		const org = obj(obj(await fetchJson("https://api.anthropic.com/api/oauth/profile", { headers: {
+			Authorization: `Bearer ${token}`,
+			"anthropic-beta": "oauth-2025-04-20",
+			"User-Agent": "claude-cli",
+			Accept: "application/json"
+		} })).organization);
+		const plan = str(org.rate_limit_tier || org.organization_type);
+		if (!plan) return null;
+		profiles.set(account.dir, {
+			at: Date.now(),
+			plan
+		});
+		return plan;
+	} catch {
+		return hit?.plan ?? null;
+	}
+}
 /** The CLI's own last-seen utilization, written into .claude.json. Older and
 * coarser than the API, but it survives an expired token. */
 function claudeJsonFallback(account) {
@@ -7368,8 +7528,9 @@ async function claudeRow(account) {
 			note: row.note ?? credentialNote(account)
 		};
 	}
-	const lapsed = tokenExpired(account);
-	const loaded = await loadPayload(`claude${account.suffix}`, () => lapsed ? Promise.reject(new FetchFailed("auth expired")) : fetchUsage$3(account));
+	const lapsed = tokenExpired$1(account);
+	const [loaded, plan] = await Promise.all([loadPayload(`claude${account.suffix}`, () => lapsed ? Promise.reject(new FetchFailed("auth expired")) : fetchUsage$3(account)), lapsed ? null : livePlan(account)]);
+	if (plan) account.plan = plan;
 	const fallback = loaded.payload ? null : claudeJsonFallback(account);
 	const row = parseRow$4(account, loaded.payload ?? fallback, fallback ? "claude.json" : loaded.source);
 	if (lapsed) return {
@@ -7385,65 +7546,159 @@ var meta$6 = meta_default$6;
 * like any other, but the turn has not ended, so no Stop or Notification
 * says so — PreToolUse on this tool is the only signal, and PostToolUse
 * (the answer arrived) clears it. */
-var QUESTION_TOOL = "AskUserQuestion";
-/** Claude's dialect plus the question tool's prompt text. */
-function readHook$4(p, reported) {
+var QUESTION_TOOL$1 = "AskUserQuestion";
+/** A teammate in an agent team stopped on a permission only the lead
+* session can grant: the user has to answer it there, so it is as much a
+* wait as the lead's own prompt. Claude's own notification type, beside
+* the shared ones. */
+var WORKER_PERMISSION = "worker_permission_prompt";
+/** How StopFailure's `error` reads on a phone. */
+var FAILURES = {
+	authentication_failed: "Signed out",
+	oauth_org_not_allowed: "Organization not allowed",
+	account_on_hold: "Account on hold",
+	verification_required: "Verification required",
+	billing_error: "Billing problem",
+	rate_limit: "Rate limited",
+	overloaded: "Overloaded",
+	invalid_request: "Request rejected",
+	model_not_found: "Model not found",
+	server_error: "Server error",
+	max_output_tokens: "Hit the output limit",
+	cloud_credential_error: "Cloud credentials failed"
+};
+/** Claude's dialect: subagents' tool calls left out, the question tool's
+* prompt, the command awaiting approval and a failed turn's error as the
+* summary, and a Stop that hands off to background subagents not counted
+* as the turn's end. */
+function readHook$6(p, reported, _state) {
+	const event = p.hook_event_name;
+	if ((event === "PreToolUse" || event === "PostToolUse" || event === "PostToolUseFailure") && str$1(p.agent_id)) return { ignore: true };
+	if (event === "Stop" && runningSubagents(p)) return { ignore: true };
+	if (event === "PostToolUseFailure" && p.is_interrupt === true) return { state: "idle" };
+	if (notificationType(p) === WORKER_PERMISSION) return {
+		reason: "attention",
+		summary: cleanSummary(str$1(p.message)) ?? "A teammate needs permission"
+	};
+	if (event === "StopFailure") {
+		const label = FAILURES[str$1(p.error)] ?? "The turn failed";
+		const details = str$1(p.error_details);
+		return {
+			reason: "attention",
+			summary: cleanSummary(details ? `${label}: ${details}` : label)
+		};
+	}
 	const read = readClaudeStyle(p, reported);
 	if (read.ignore) return read;
-	if (p.hook_event_name === "PreToolUse" && p.tool_name === QUESTION_TOOL) {
+	if (event === "PreToolUse" && p.tool_name === QUESTION_TOOL$1) {
 		const input = p.tool_input;
 		const q = str$1(input?.questions?.[0]?.question);
 		read.summary = q ? cleanSummary(q) : "Asking a question";
+	} else if (event === "PermissionRequest" && !read.summary) {
+		const input = p.tool_input;
+		const what = str$1(input?.description) || str$1(input?.command) || str$1(p.tool_name);
+		read.summary = what ? cleanSummary(`Approve: ${what}`) : "Waiting for permission";
 	}
 	return read;
 }
+/** Stop's `background_tasks` (in-flight work that will wake the session)
+* holding a subagent. A background shell (a dev server) is left out: it
+* may never finish, and the turn really has ended. */
+function runningSubagents(p) {
+	const tasks = p.background_tasks;
+	return Array.isArray(tasks) && tasks.some((t) => !!t && typeof t === "object" && t.type === "subagent");
+}
 /** Claude Code takes its settings inline (`--settings` accepts a JSON
 * string), so the hooks travel in argv and nothing is written anywhere.
-* Its Notification hook fires for permission prompts and questions —
-* and for the idle nudge, which readClaudeStyle drops. */
+* PermissionRequest is the prompt itself, the moment it shows; the
+* permission Notification only comes after the user has left it for a
+* while (each keystroke defers it), but it is the one that covers a
+* sandbox's network prompt. A turn that fails (rate limit, signed out)
+* ends with StopFailure rather than Stop; an interrupt ends with no hook
+* at all, which the pane going still catches (scraper.ts). */
 var claude = {
 	meta: meta$6,
-	launchFlags: () => ["--settings", JSON.stringify({ hooks: claudeStyleHooks([
+	launchFlags: () => ["--settings", JSON.stringify({ hooks: claudeStyleHooks("claude", [
 		["UserPromptSubmit", "working"],
 		[
 			"PreToolUse",
 			"working",
 			void 0,
-			`^(?!${QUESTION_TOOL}$)`
+			`^(?!${QUESTION_TOOL$1}$)`
 		],
 		[
 			"PreToolUse",
 			"waiting",
 			"attention",
-			`^${QUESTION_TOOL}$`
+			`^${QUESTION_TOOL$1}$`
 		],
 		["PostToolUse", "working"],
+		["PostToolUseFailure", "working"],
+		[
+			"PermissionRequest",
+			"waiting",
+			"attention"
+		],
 		[
 			"Stop",
 			"waiting",
 			"done"
 		],
 		[
-			"Notification",
+			"StopFailure",
 			"waiting",
 			"attention"
+		],
+		[
+			"Notification",
+			"waiting",
+			"attention",
+			`${NOTIFICATION_MATCHER}|${WORKER_PERMISSION}`
 		]
 	]) })],
 	reportsWorking: () => true,
-	envPrefixes: [
-		"CLAUDE",
-		"CLAUDECODE",
-		"AI_AGENT"
-	],
-	readHook: readHook$4,
+	envPrefixes: ["CLAUDE", "AI_AGENT"],
+	startupPrompt: (screen) => /Is this a project you created or one you trust/.test(screen) ? ["Enter"] : void 0,
+	readHook: readHook$6,
 	usage: () => Promise.all(claudeAccounts().map((account) => claudeRow(account)))
 };
 //#endregion
 //#region src/agents/codex/usage.ts
-var AUTH$2 = path.join(HOME, ".codex", "auth.json");
+/** Codex's home, where it keeps auth.json and config.toml: `CODEX_HOME`
+* when set, as the CLI reads it. */
+function codexHome() {
+	return process.env.CODEX_HOME || path.join(HOME, ".codex");
+}
+var authFile$1 = () => path.join(codexHome(), "auth.json");
+/** Credentials Codex was told to keep in the system keyring
+* (`cli_auth_credentials_store = "keyring"`, or `"auto"` where one is
+* available) leave no auth.json to read: signed in, but nothing here can
+* ask on its behalf. */
+function keyringStore() {
+	try {
+		const top = fs.readFileSync(path.join(codexHome(), "config.toml"), "utf8").split(/^\s*\[/m)[0];
+		const mode = /^\s*cli_auth_credentials_store\s*=\s*"(\w+)"/m.exec(top)?.[1];
+		return mode === "keyring" || mode === "auto";
+	} catch {
+		return false;
+	}
+}
+/** The access token's own `exp` (it is a JWT): whether a 401 or 429 is a
+* lapsed token rather than the provider throttling. Undefined when there
+* is no token or it does not decode. */
+function tokenExpired() {
+	const payload = str(obj(readJson(authFile$1())?.tokens).access_token).split(".")[1];
+	if (!payload) return void 0;
+	try {
+		const claims = obj(JSON.parse(Buffer.from(payload, "base64url").toString("utf8")));
+		return claims.exp == null ? void 0 : expired(claims.exp);
+	} catch {
+		return;
+	}
+}
 /** Live rate-limit windows from the endpoint the Codex CLI itself uses. */
 async function fetchUsage$2() {
-	const tokens = obj(readJson(AUTH$2)?.tokens);
+	const tokens = obj(readJson(authFile$1())?.tokens);
 	const token = str(tokens.access_token);
 	if (!token) return null;
 	return obj(await fetchJson("https://chatgpt.com/backend-api/wham/usage", { headers: {
@@ -7484,7 +7739,7 @@ function parseRow$3(payload, source) {
 /** Signed in with an API key rather than a ChatGPT plan: pay-as-you-go,
 * no rate-limit windows to draw. */
 function apiKeyMode() {
-	const auth = readJson(AUTH$2);
+	const auth = readJson(authFile$1());
 	return !!auth && (str(auth.auth_mode) === "apikey" || !obj(auth.tokens).access_token && !!auth.OPENAI_API_KEY);
 }
 async function codexRow() {
@@ -7494,19 +7749,21 @@ async function codexRow() {
 		note: API_KEY_NOTE
 	};
 	const { payload, source, reason } = await loadPayload("codex", fetchUsage$2);
-	const missingAuth = fs.existsSync(AUTH$2) ? void 0 : noAuthReason("codex");
+	const missingAuth = fs.existsSync(authFile$1()) ? void 0 : keyringStore() ? "credentials are in the system keyring — usage can't be read" : noAuthReason("codex");
 	return markStale(payload ? parseRow$3(payload, source) : {
 		...blankRow("codex", source),
 		note: missingAuth ?? "usage unavailable"
-	}, "codex", void 0, missingAuth ?? reason);
+	}, "codex", tokenExpired(), missingAuth ?? reason);
 }
 //#endregion
 //#region src/agents/codex/index.ts
 var meta$5 = meta_default$5;
 /** Codex hook events → state. PermissionRequest fires just before the
 * approval prompt (PostToolUse clears it once the approved call has run,
-* or the next PreToolUse does if a reviewer auto-decided). */
-var HOOKS$2 = claudeStyleHooks([
+* or the next PreToolUse does if a reviewer auto-decided). A turn the
+* user interrupts, or a session that ends, has no Stop: Interrupt and
+* SessionEnd say the pane is back at its prompt (or gone). */
+var HOOKS$2 = claudeStyleHooks("codex", [
 	["UserPromptSubmit", "working"],
 	["PreToolUse", "working"],
 	["PostToolUse", "working"],
@@ -7519,23 +7776,37 @@ var HOOKS$2 = claudeStyleHooks([
 		"Stop",
 		"waiting",
 		"done"
-	]
+	],
+	["Interrupt", "idle"],
+	["SessionEnd", "idle"]
 ]);
+/** Codex runs these two with a short deadline (one second by default,
+* three at most) where every other event gets ten minutes; the report
+* needs a little over two at worst (stateCurl's timeouts). */
+var SHORT_HOOKS = {
+	Interrupt: 3,
+	SessionEnd: 3
+};
+/** The tool Codex asks the user a question with (Plan mode and wherever
+* it is enabled). It goes through PreToolUse like any tool, but the turn
+* is waiting on the user until its PostToolUse. */
+var QUESTION_TOOL = "request_user_input";
 /** Codex only runs hooks it trusts. Trust is a hash of the normalized hook
 * kept in config (`hooks.state.<key>.trusted_hash`), and both the hooks and
 * that state are read from the `-c` override layer too — so the launch flags
 * can carry their own trust without touching ~/.codex/config.toml.
 * Mirrors codex-rs/hooks/src/engine/discovery.rs (hook_hash, hook_key,
-* normalized Command config: timeout defaults to 600, async false, None
-* fields omitted) and codex-rs/config/src/fingerprint.rs (sha256 of
-* key-sorted JSON). scripts/smoke.mjs pins it against a hash Codex wrote. */
-function codexHookTrustHash(event, command) {
+* normalize_command_hook: timeout defaults to 600, or 1 clamped to 1..3
+* for SessionEnd and Interrupt; async false; None fields omitted) and
+* codex-rs/config/src/fingerprint.rs (sha256 of key-sorted JSON).
+* scripts/smoke.mjs pins it against a hash Codex wrote. */
+function codexHookTrustHash(event, command, timeout = 600) {
 	const identity = {
 		event_name: hookKeyLabel(event),
 		hooks: [{
 			async: false,
 			command,
-			timeout: 600,
+			timeout,
 			type: "command"
 		}]
 	};
@@ -7547,24 +7818,46 @@ function hookKeyLabel(event) {
 }
 /** Synthetic path Codex gives the `-c` override layer when keying hook state. */
 var SESSION_FLAGS_PATH = "/<session-flags>/config.toml";
-/** `-c` overrides that install work's state hooks and trust them. */
-function launchFlags() {
+/** `-c` overrides that install work's state hooks, trust them, and trust
+* the workspace folder for this session. Codex asks whether to trust a
+* folder it has not seen before it takes input, and every workspace is
+* one: the first prompt would land in that menu, and the Enter after it
+* would answer "trust" into the user's config.toml on their behalf. The
+* `-c` layer is this process's alone. Its keys split on every "." with no
+* quoting (codex-rs/config/src/overrides.rs), so a path goes in as the
+* key of an inline table, which is merged over the user's projects. */
+function launchFlags(ctx) {
 	const flags = [];
 	const state = [];
 	for (const [event, groups] of Object.entries(HOOKS$2)) {
 		const command = groups[0].hooks[0].command;
-		flags.push("-c", `hooks.${event}=[{hooks=[{type="command",command=${JSON.stringify(command)}}]}]`);
+		const timeout = SHORT_HOOKS[event];
+		flags.push("-c", `hooks.${event}=[{hooks=[{type="command",command=${JSON.stringify(command)}${timeout ? `,timeout=${timeout}` : ""}}]}]`);
 		const key = `${SESSION_FLAGS_PATH}:${hookKeyLabel(event)}:0:0`;
-		state.push(`${JSON.stringify(key)}={trusted_hash=${JSON.stringify(codexHookTrustHash(event, command))}}`);
+		state.push(`${JSON.stringify(key)}={trusted_hash=${JSON.stringify(codexHookTrustHash(event, command, timeout))}}`);
 	}
 	flags.push("-c", `hooks.state={${state.join(",")}}`);
+	const folders = /* @__PURE__ */ new Set([ctx.cwd]);
+	try {
+		folders.add(fs.realpathSync(ctx.cwd));
+	} catch {}
+	flags.push("-c", `projects={${[...folders].map((dir) => `${JSON.stringify(dir)}={trust_level="trusted"}`).join(",")}}`);
 	return flags;
 }
-function readHook$3(p, reported) {
+function readHook$5(p, reported, _state) {
+	const input = p.tool_input;
+	if (p.hook_event_name === "PreToolUse" && p.tool_name === QUESTION_TOOL) {
+		const questions = input?.questions;
+		const q = str$1(questions?.[0]?.question);
+		return {
+			state: "waiting",
+			reason: "attention",
+			summary: q ? cleanSummary(q) : "Asking a question"
+		};
+	}
 	const read = readClaudeStyle(p, reported);
 	if (!read.summary && p.hook_event_name === "PermissionRequest") {
-		const input = p.tool_input;
-		const what = str$1(input?.command) || str$1(p.tool_name);
+		const what = str$1(input?.description) || str$1(input?.command) || str$1(p.tool_name);
 		read.summary = what ? cleanSummary(`Approve: ${what}`) : "Waiting for permission";
 	}
 	return read;
@@ -7574,18 +7867,21 @@ var codex = {
 	launchFlags,
 	reportsWorking: () => true,
 	envPrefixes: ["CODEX_"],
-	readHook: readHook$3,
+	readHook: readHook$5,
 	usage: () => codexRow().then((row) => [row])
 };
 //#endregion
 //#region src/agents/copilot/usage.ts
 var USER_API = "https://api.github.com/copilot_internal/user";
 var HOSTS = path.join(process.env.XDG_CONFIG_HOME || path.join(HOME, ".config"), "gh", "hosts.yml");
-var SESSION_DB = path.join(HOME, ".copilot", "session-store.db");
-/** github.com's `oauth_token` straight out of gh's own hosts.yml.
+/** Copilot's own home (`COPILOT_HOME`, as the CLI reads it). */
+var sessionDb = () => path.join(process.env.COPILOT_HOME || path.join(HOME, ".copilot"), "session-store.db");
+/** github.com's active `oauth_token` straight out of gh's own hosts.yml.
 *
 * Deliberately not a YAML parse (no dependency): track the current top-level
-* host key by indentation and take the first token beneath github.com. */
+* host key by indentation and take the token that is a direct child of
+* github.com. With several accounts signed in, each also has one under
+* `users:`, listed first; the host's own is the active account's. */
 function hostsToken() {
 	let text;
 	try {
@@ -7594,12 +7890,17 @@ function hostsToken() {
 		return null;
 	}
 	let host = "";
+	let childIndent = -1;
 	for (const line of text.split("\n")) {
 		if (line[0]?.trim() && line.trimEnd().endsWith(":")) {
 			host = line.trim().replace(/:$/, "");
+			childIndent = -1;
 			continue;
 		}
-		if (host !== "github.com") continue;
+		if (host !== "github.com" || !line.trim()) continue;
+		const indent = line.length - line.trimStart().length;
+		if (childIndent < 0) childIndent = indent;
+		if (indent !== childIndent) continue;
 		const match = /^\s+oauth_token:\s*(\S+)/.exec(line);
 		if (match) return match[1] ?? null;
 	}
@@ -7609,7 +7910,11 @@ function hostsToken() {
 * gh manages. Copilot entitlement is account-scoped, so any valid token for
 * the entitled user reads the quota. */
 async function token() {
-	for (const key of ["GH_TOKEN", "GITHUB_TOKEN"]) {
+	for (const key of [
+		"COPILOT_GITHUB_TOKEN",
+		"GH_TOKEN",
+		"GITHUB_TOKEN"
+	]) {
 		const value = process.env[key]?.trim();
 		if (value) return value;
 	}
@@ -7647,9 +7952,10 @@ function periodStart(resetIso) {
 * only, which is why the caller floors it with upstream rather than trusting
 * it alone. */
 function localCredits(start) {
-	if (!start || !fs.existsSync(SESSION_DB)) return null;
+	const file = sessionDb();
+	if (!start || !fs.existsSync(file)) return null;
 	try {
-		const db = new DatabaseSync(SESSION_DB, { readOnly: true });
+		const db = new DatabaseSync(file, { readOnly: true });
 		try {
 			const nano = num(db.prepare("select sum(total_nano_aiu) as nano from assistant_usage_events where created_at >= ?").get(start)?.nano);
 			return nano == null ? 0 : nano / 1e9;
@@ -7712,14 +8018,25 @@ var meta$4 = meta_default$4;
 /** Copilot hook events (Claude-format names, which make it emit Claude's
 * snake_case payloads) → state. Notification rather than PermissionRequest
 * for "needs input": the latter fires before Copilot's own allow rules, the
-* former only once a prompt is actually on screen. */
-var HOOKS$1 = claudeStyleHooks([
+* former only once a prompt is actually on screen. Its matcher keeps out
+* the rest of what Copilot notifies about (a background shell or subagent
+* finishing, an inbox message), none of which is the user being needed.
+* A tool that fails has PostToolUseFailure instead of PostToolUse; an
+* error the turn cannot recover from ends it with ErrorOccurred. */
+var HOOKS$1 = claudeStyleHooks("copilot", [
 	["UserPromptSubmit", "working"],
 	["PreToolUse", "working"],
 	["PostToolUse", "working"],
+	["PostToolUseFailure", "working"],
 	[
 		"Notification",
 		"waiting",
+		"attention",
+		NOTIFICATION_MATCHER
+	],
+	[
+		"ErrorOccurred",
+		"waiting",
 		"attention"
 	],
 	[
@@ -7733,41 +8050,36 @@ var HOOKS$1 = claudeStyleHooks([
 * prompt. The plugin is two files kept under work's data dir and rewritten
 * only when their content changes (a stale hook would report to the wrong
 * port after a config change). */
-function pluginDir() {
+function pluginDir$1() {
 	const dir = path.join(config.dataDir, "copilot-plugin");
 	writeIfChanged(path.join(dir, ".claude-plugin", "plugin.json"), JSON.stringify({
 		name: "work-session-state",
 		version: "1",
 		description: "Reports this session's working / needs-input / done state to work."
 	}, null, 2));
-	writeIfChanged(path.join(dir, "hooks", "hooks.json"), JSON.stringify({ hooks: HOOKS$1 }, null, 2));
+	writeIfChanged(path.join(dir, "hooks", "hooks.json"), JSON.stringify({
+		version: 1,
+		hooks: HOOKS$1
+	}, null, 2));
 	return dir;
 }
-function writeIfChanged(file, content) {
-	try {
-		if (fs.readFileSync(file, "utf8") === content) return;
-	} catch {}
-	fs.mkdirSync(path.dirname(file), { recursive: true });
-	fs.writeFileSync(file, content);
-}
-/** Copilot routes shell and inbox chatter through the same Notification
-* hook; those are neither "needs input" nor "done" and must be dropped. */
-var CHATTER = /* @__PURE__ */ new Set([
-	"shell_completed",
-	"shell_detached_completed",
-	"new_inbox_message",
-	"instruction_discovered",
-	"factory_completed",
-	"unclassified"
-]);
-function readHook$2(p, reported) {
-	if (CHATTER.has(notificationType(p))) return { ignore: true };
+function readHook$4(p, reported, _state) {
+	if (p.hook_event_name === "ErrorOccurred") {
+		if (p.recoverable !== false) return { ignore: true };
+		const error = p.error;
+		return {
+			reason: "attention",
+			summary: cleanSummary(str$1(error?.message)) ?? "Stopped on an error"
+		};
+	}
 	const read = readClaudeStyle(p, reported);
 	if (!read.summary && reported === "done") read.summary = lastMessageFromTranscript(p);
 	return read;
 }
-/** The last non-empty `assistant.message` in Copilot's events.jsonl. Reads
-* the tail only — transcripts grow for the life of a session. */
+/** The last non-empty `assistant.message` of the turn that just ended in
+* Copilot's events.jsonl — none rather than an earlier turn's, so the scan
+* stops at the prompt that started it. Reads the tail only — transcripts
+* grow for the life of a session. */
 function lastMessageFromTranscript(p) {
 	const file = p.transcript_path;
 	if (typeof file !== "string" || !file.endsWith("events.jsonl")) return void 0;
@@ -7780,6 +8092,7 @@ function lastMessageFromTranscript(p) {
 			fs.readSync(fd, buf, 0, len, size - len);
 			const lines = buf.toString("utf8").split("\n");
 			for (let i = lines.length - 1; i >= 0; i--) {
+				if (lines[i].includes("\"user.message\"")) break;
 				if (!lines[i].includes("\"assistant.message\"")) continue;
 				try {
 					const ev = JSON.parse(lines[i]);
@@ -7803,31 +8116,41 @@ function startupPrompt(screen) {
 }
 var copilot = {
 	meta: meta$4,
-	launchFlags: () => ["--plugin-dir", pluginDir()],
+	launchFlags: () => ["--plugin-dir", pluginDir$1()],
 	startupPrompt,
 	reportsWorking: () => true,
 	envPrefixes: ["COPILOT_"],
-	readHook: readHook$2,
+	readHook: readHook$4,
 	usage: () => copilotRow().then((row) => [row])
 };
 //#endregion
 //#region src/agents/cursor/usage.ts
-var AUTH$1 = path.join(HOME, ".config", "cursor", "auth.json");
 var CLI_CONFIG = path.join(HOME, ".cursor", "cli-config.json");
+/** Where the CLI keeps its auth, as it looks it up itself: `~/.cursor` on a
+* Mac, the XDG config dir elsewhere. */
+function authFile() {
+	if (process.platform === "darwin") return path.join(HOME, ".cursor", "auth.json");
+	const config = process.env.XDG_CONFIG_HOME || path.join(HOME, ".config");
+	return path.join(config, "cursor", "auth.json");
+}
 var API = "https://api2.cursor.sh";
 var WWW = "https://cursor.com";
 function cursorAuth() {
-	const auth = readJson(AUTH$1);
+	const auth = readJson(authFile());
 	if (!auth) return null;
 	const token = str(auth.accessToken || auth.access_token);
 	if (!token) return null;
 	let sub = "";
+	let exp;
 	try {
-		sub = str(obj(JSON.parse(Buffer.from(str(token.split(".")[1]), "base64url").toString())).sub);
+		const claims = obj(JSON.parse(Buffer.from(str(token.split(".")[1]), "base64url").toString()));
+		sub = str(claims.sub);
+		exp = claims.exp;
 	} catch {}
 	return {
 		token,
 		sub,
+		exp,
 		email: str(obj(readJson(CLI_CONFIG)?.authInfo).email).trim()
 	};
 }
@@ -7846,7 +8169,8 @@ var dashboardPost = async (token, method) => obj(await fetchJson(`${API}/aiserve
 * it is only readable with the web session cookie. */
 async function usageSummary(auth) {
 	if (!auth.sub) return null;
-	const cookie = `WorkosCursorSessionToken=${encodeURIComponent(`${auth.sub}::${auth.token}`)}`;
+	const user = auth.sub.split("|").pop();
+	const cookie = `WorkosCursorSessionToken=${encodeURIComponent(`${user}::${auth.token}`)}`;
 	return obj(await fetchJson(`${WWW}/api/usage-summary`, { headers: {
 		Cookie: cookie,
 		Accept: "application/json",
@@ -7915,14 +8239,58 @@ async function cursorRow() {
 	return markStale(payload ? parseRow$1(payload, auth, source) : {
 		...blankRow("cursor", source),
 		note: missingAuth ?? "usage unavailable"
-	}, "cursor", void 0, missingAuth ?? reason);
+	}, "cursor", auth?.exp != null ? expired(auth.exp) : void 0, missingAuth ?? reason);
+}
+//#endregion
+//#region src/agents/cursor/index.ts
+var meta$3 = meta_default$3;
+/** Cursor has no hook for a permission prompt or a question, so the pane
+* scraper (scraper.ts) still says when a session is working and when it
+* has gone quiet — a stopped turn and a question look the same there. What
+* a hook adds is the end of a turn and how it ended, which is what a push
+* needs: one `stop` hook and nothing else. A hook that reported "working"
+* would outrank the scraper and hold a session stopped on a prompt at
+* "working" for good, since nothing reports the prompt.
+*
+* The hook comes from a plugin in work's data dir named with `--plugin-dir`
+* (the CLI runs plugin hooks for every step, those of a `--plugin-dir`
+* plugin included), never ~/.cursor/hooks.json — the user's, which Grok
+* also loads. Cursor hands the payload to a command as a heredoc after it,
+* so the report is a brace group: the heredoc is its stdin, not `exit`'s. */
+function pluginDir() {
+	const dir = path.join(config.dataDir, "cursor-plugin");
+	writeIfChanged(path.join(dir, ".cursor-plugin", "plugin.json"), JSON.stringify({
+		name: "work-session-state",
+		version: "1",
+		description: "Reports when this session's turn ends to work."
+	}, null, 2));
+	writeIfChanged(path.join(dir, "hooks", "hooks.json"), JSON.stringify({
+		version: 1,
+		hooks: { stop: [{
+			command: `{ ${stateCurl("cursor", "waiting", "done")}; }`,
+			timeout: 5
+		}] }
+	}, null, 2));
+	return dir;
+}
+/** `stop` carries how the turn ended: finished, interrupted (back at the
+* prompt, nothing to push) or failed (worth reading). */
+function readHook$3(p, reported) {
+	if (p.status === "aborted") return { state: "idle" };
+	if (p.status === "error") return {
+		reason: "attention",
+		summary: "The turn failed"
+	};
+	return { reason: reported };
 }
-/** Cursor's plugin-dir hooks can't carry stop/prompt events (those load only
-* from ~/.cursor/hooks.json) and it has no permission-prompt hook at all,
-* so its sessions get working/idle from pane activity (see scraper.ts) and
-* nothing else — a stopped turn and a question look the same. */
 var cursor = {
-	meta: meta_default$3,
+	meta: meta$3,
+	launchFlags: () => [
+		"--trust",
+		"--plugin-dir",
+		pluginDir()
+	],
+	readHook: readHook$3,
 	readyScreen: /Plan, search, build anything|Add a follow-up/,
 	usage: () => cursorRow().then((row) => [row])
 };
@@ -7985,7 +8353,8 @@ function billingFromLogs() {
 	if (!Object.keys(cfg).length) return null;
 	return {
 		config: cfg,
-		subscriptionTier: ctx.subscriptionTier
+		subscriptionTier: ctx.subscriptionTier,
+		loggedAt: Date.parse(str(latest.ts)) || null
 	};
 }
 function parseRow(payload, auth, source) {
@@ -8019,7 +8388,8 @@ async function grokRow() {
 	const loaded = await loadPayload("grok", () => auth?.token ? fetchBilling(auth.token) : Promise.resolve(null));
 	const fromLog = loaded.payload ? null : billingFromLogs();
 	const payload = loaded.payload ?? fromLog;
-	const source = fromLog ? "unified.jsonl" : loaded.source;
+	const loggedAt = num(fromLog?.loggedAt);
+	const source = fromLog ? loggedAt ? `stale-cache ${Math.max(0, Math.round((Date.now() - loggedAt) / 1e3))}s` : "stale-cache" : loaded.source;
 	const missingAuth = auth?.token ? void 0 : noAuthReason("grok");
 	return markStale(payload ? parseRow(payload, auth, source) : {
 		...blankRow("grok", source),
@@ -8029,14 +8399,25 @@ async function grokRow() {
 //#endregion
 //#region src/agents/grok/index.ts
 var meta$2 = meta_default$2;
-/** Grok hook events → state. Payloads are camelCase (hookEventName,
-* notificationType, lastAssistantMessage). Notification is matched to the
-* two kinds that mean a prompt is on screen; Stop fires on shutdown too,
-* with a reason readHook uses to tell a finished turn from a closed
-* session. */
-var HOOKS = claudeStyleHooks([
+/** Grok hook events → state: the busy/idle indicator its hook guide spells
+* out, five registrations and two more. UserPromptSubmit starts a turn;
+* Stop, StopFailure and StopCancelled end it however it ended (readHook
+* tells an interrupt from a cut-off); the `idle_prompt` Notification is
+* the backstop for the turns that report none of the three, and
+* SessionEnd for a session that exits first. A tool call is not "working"
+* of itself — Grok's matchers are Rust regexes with no way to except one
+* tool — so PreToolUse only catches the question card, which stops the
+* turn on the user, and PostToolUse (the question answered, or any tool
+* done) puts it back to work. Payloads are camelCase (hookEventName,
+* notificationType, lastAssistantMessage). */
+var HOOKS = claudeStyleHooks("grok", [
 	["UserPromptSubmit", "working"],
-	["PreToolUse", "working"],
+	[
+		"PreToolUse",
+		"waiting",
+		"attention",
+		"^ask_user_question$"
+	],
 	["PostToolUse", "working"],
 	[
 		"Notification",
@@ -8045,23 +8426,49 @@ var HOOKS = claudeStyleHooks([
 		"permission_prompt|elicitation_dialog"
 	],
 	[
-		"Stop",
-		"waiting",
-		"done"
+		"Notification",
+		"idle",
+		void 0,
+		"^idle_prompt$"
 	],
 	[
-		"StopCancelled",
+		"Stop",
 		"waiting",
 		"done"
 	],
+	["StopCancelled", "idle"],
 	[
 		"StopFailure",
 		"waiting",
 		"attention"
-	]
+	],
+	["SessionEnd", "idle"]
 ], { timeout: 5 });
-var HOOK_FILE = () => path.join(config.dataDir, "grok-hooks.json");
-var REGISTRY = () => path.join(process.env.HOME || "", ".grok", "hooks-paths");
+/** Where Grok keeps its config, the registry among it. */
+var GROK_HOME = () => process.env.GROK_HOME || path.join(os.homedir(), ".grok");
+var REGISTRY = () => path.join(GROK_HOME(), "hooks-paths");
+/** work's hook file, by its real path: Grok's sandbox refuses to start
+* while a registry line runs through a symlink. */
+function hookFile() {
+	let dir = config.dataDir;
+	try {
+		dir = fs.realpathSync(dir);
+	} catch {}
+	return path.join(dir, "grok-hooks.json");
+}
+/** A data dir under the system temp dir is a scratch server's: naming its
+* hook file in the user's registry would outlive it, and a registry line
+* whose file is gone keeps Grok's sandbox from starting at all. */
+function scratch() {
+	const tmp = (() => {
+		try {
+			return fs.realpathSync(os.tmpdir());
+		} catch {
+			return os.tmpdir();
+		}
+	})();
+	return hookFile().startsWith(tmp + path.sep);
+}
 /** Whether Grok's hook registry names work's hook file — without it Grok
 * reports nothing and the screen has to speak for it. Read from disk, not
 * remembered from a launch: a session that outlives the app process still
@@ -8069,20 +8476,24 @@ var REGISTRY = () => path.join(process.env.HOME || "", ".grok", "hooks-paths");
 * back on a session that reports for itself. */
 function registered() {
 	try {
-		const file = HOOK_FILE();
+		const file = hookFile();
 		return fs.readFileSync(REGISTRY(), "utf8").split("\n").some((line) => line.trim() === file);
 	} catch {
 		return false;
 	}
 }
-/** Grok has no flag for hooks. It discovers them from `~/.grok/hooks-paths`:
+/** Grok has no flag for hooks. It discovers them from `$GROK_HOME/hooks-paths`:
 * one absolute path per line, the registry its own `/hooks-add` command
 * appends to. work's hook file is kept in the data dir — the commands read
 * the port from env, so the file never needs rewriting — and named there
 * once. The one line in that registry is the only thing work writes
-* outside its own dir for any agent. */
+* outside its own dir for any agent; lines naming a work hook file that is
+* gone (a data dir moved or removed) are dropped as it is written, since
+* Grok's sandbox will not start while one is there, and a stale one on
+* another port reported every event twice. */
 function registerHooks() {
-	const file = HOOK_FILE();
+	if (scratch()) return;
+	const file = hookFile();
 	writeIfChanged(file, JSON.stringify({ hooks: HOOKS }, null, 2));
 	const registry = REGISTRY();
 	try {
@@ -8090,17 +8501,74 @@ function registerHooks() {
 		try {
 			current = fs.readFileSync(registry, "utf8");
 		} catch {}
-		if (!current.split("\n").some((line) => line.trim() === file)) {
+		const lines = current.split("\n").filter((line) => {
+			const target = line.trim();
+			return target === file || !target.endsWith(`${path.sep}grok-hooks.json`) || fs.existsSync(target);
+		});
+		if (!lines.some((line) => line.trim() === file)) {
+			while (lines.length && !lines.at(-1).trim()) lines.pop();
+			lines.push(file, "");
+		}
+		const next = lines.join("\n");
+		if (next !== current) {
 			fs.mkdirSync(path.dirname(registry), { recursive: true });
-			fs.appendFileSync(registry, `${current && !current.endsWith("\n") ? "\n" : ""}${file}\n`);
+			fs.writeFileSync(registry, next);
 		}
 	} catch {}
 }
-function readHook$1(p, reported) {
-	if (str$1(p.subagentType)) return { ignore: true };
-	if (p.hookEventName === "stop" && str$1(p.reason) && p.reason !== "end_turn") return { ignore: true };
+/** The turns each Grok session has started, oldest first, so a report
+* for a turn that has since been replaced is known for what it is: a
+* cancelled turn's report is sent off Grok's command loop, and can land
+* after the next turn's UserPromptSubmit. */
+var TURNS_KEPT = 32;
+var turns = /* @__PURE__ */ new Map();
+function noteTurn(session, prompt) {
+	let list = turns.get(session);
+	if (!list) {
+		turns.set(session, list = []);
+		if (turns.size > 200) turns.delete(turns.keys().next().value);
+	}
+	list.push(prompt);
+	if (list.length > TURNS_KEPT) list.shift();
+}
+/** A turn-end report for a turn the session has moved on from. One for a
+* turn it never saw start (an interrupted bash-mode command) is not: it
+* settles like any other. */
+function superseded(session, prompt) {
+	const list = turns.get(session);
+	if (!list) return false;
+	const at = list.indexOf(prompt);
+	return at >= 0 && at < list.length - 1;
+}
+/** StopCancelled reasons the agent chose rather than the user: cut off,
+* the session is waiting on them to say what next. Anything else — an
+* interrupt, a declined or dismissed prompt, a reason Grok adds later —
+* is the user having stopped it. */
+var RUNTIME_STOPS = /* @__PURE__ */ new Set(["max_turns", "no_progress"]);
+function readHook$2(p, reported, state) {
+	const event = str$1(p.hook_event_name);
+	const session = str$1(p.sessionId);
+	const prompt = str$1(p.promptId);
+	if (str$1(p.subagentType) && notificationType(p) !== "permission_prompt") return { ignore: true };
+	if (event === "UserPromptSubmit" && session && prompt) noteTurn(session, prompt);
+	if ((event === "Stop" || event === "StopCancelled" || event === "StopFailure") && session && prompt && superseded(session, prompt)) return { ignore: true };
+	if (event === "Stop" && str$1(p.reason) && p.reason !== "end_turn") return { state: "idle" };
+	if (event === "Stop" && Array.isArray(p.backgroundTasks) && p.backgroundTasks.some((task) => task?.type === "subagent")) return { ignore: true };
+	if (event === "StopCancelled") {
+		if (!RUNTIME_STOPS.has(str$1(p.reason))) return { state: "idle" };
+		return {
+			state: "waiting",
+			reason: "attention",
+			summary: cleanSummary(str$1(p.reasonDetails) || str$1(p.lastAssistantMessage) || (p.reason === "max_turns" ? "Stopped at the turn limit" : "Stopped making progress"))
+		};
+	}
+	if (state === "idle") return { state: "idle" };
+	if (event === "PreToolUse") return {
+		reason: "attention",
+		summary: cleanSummary(str$1((p.toolInput ?? {}).questions?.[0]?.question)) ?? "Asking a question"
+	};
 	const read = readClaudeStyle(p, reported);
-	if (!read.summary) {
+	if (!read.ignore && !read.summary) {
 		const err = str$1(p.errorDetails) || str$1(p.error);
 		if (err) read.summary = cleanSummary(err);
 	}
@@ -8115,7 +8583,7 @@ var grok = {
 	reportsWorking: registered,
 	promptAsArgv: true,
 	envPrefixes: ["GROK_"],
-	readHook: readHook$1,
+	readHook: readHook$2,
 	usage: () => grokRow().then((row) => [row])
 };
 //#endregion
@@ -8133,7 +8601,7 @@ const post = async (state, reason, summary) => {
   if (!session) return;
   const port = process.env.WORK_APP_PORT || "${appPort}";
   const qs =
-    \`session=\${encodeURIComponent(session)}&state=\${state}\` +
+    \`session=\${encodeURIComponent(session)}&agent=opencode&state=\${state}\` +
     (reason ? \`&reason=\${reason}\` : "");
   try {
     await fetch(\`http://127.0.0.1:\${port}/api/agent-state?\${qs}\`, {
@@ -8145,19 +8613,51 @@ const post = async (state, reason, summary) => {
   } catch {}
 };
 
-export const WorkSessionState = async () => {
+export const WorkSessionState = async ({ client } = {}) => {
   // A subagent's turn is not the pane's: task sessions carry a parentID,
   // and their busy/idle would otherwise end the turn the user is watching.
+  // One this process never saw created (a resumed session's subagent,
+  // restarted by task id) is looked up once.
   const children = new Set();
+  const roots = new Set();
   const roles = new Map();
   const lastText = new Map();
-  const mine = (id) => !!id && !children.has(id);
+  // Sessions whose turn has already been reported ended (so an idle that
+  // follows another, old and new events both, reports once), and those
+  // whose turn ended on an error (whose report was the error).
+  const settled = new Set();
+  const errored = new Set();
+  const child = async (id) => {
+    if (!id || children.has(id)) return true;
+    if (roots.has(id)) return false;
+    try {
+      const res = await client?.session?.get?.({ sessionID: id, path: { id } });
+      if ((res?.data ?? res)?.parentID) {
+        children.add(id);
+        return true;
+      }
+    } catch {}
+    roots.add(id);
+    return false;
+  };
+  const turnEnd = (id) => {
+    if (settled.has(id)) return;
+    settled.add(id);
+    const summary = lastText.get(id);
+    lastText.delete(id);
+    roles.clear();
+    // The error was the report; "Finished" after it would replace it, and
+    // clear the session's call for attention with it.
+    if (errored.delete(id)) return;
+    return post("waiting", "done", summary);
+  };
   return {
     event: async ({ event }) => {
       const type = event?.type;
       const p = event?.properties || {};
       if (type === "session.created" || type === "session.updated") {
         if (p.info?.parentID) children.add(p.info.id);
+        else if (p.info?.id) roots.add(p.info.id);
         return;
       }
       // Text parts carry no role; the message they belong to does, and a
@@ -8171,22 +8671,9 @@ export const WorkSessionState = async () => {
           lastText.set(p.part.sessionID, p.part.text);
         return;
       }
-      if (!mine(p.sessionID)) return;
-      if (type === "session.status" && p.status?.type === "busy")
-        return post("working");
-      if (type === "session.idle") {
-        const summary = lastText.get(p.sessionID);
-        lastText.delete(p.sessionID);
-        roles.clear();
-        return post("waiting", "done", summary);
-      }
-      if (type === "session.error")
-        return post(
-          "waiting",
-          "attention",
-          p.error?.data?.message || p.error?.name,
-        );
-      // A prompt is on screen and nothing moves until it is answered.
+      // A prompt is on screen and nothing moves until it is answered —
+      // whichever session raised it: the TUI shows a subagent's with the
+      // session's own.
       if (type === "permission.asked")
         return post(
           "waiting",
@@ -8195,7 +8682,44 @@ export const WorkSessionState = async () => {
             .filter(Boolean)
             .join(": "),
         );
-      if (type === "permission.replied") return post("working");
+      if (type === "question.asked")
+        return post(
+          "waiting",
+          "attention",
+          p.questions?.[0]?.question || "Asking a question",
+        );
+      if (
+        type === "permission.replied" ||
+        type === "question.replied" ||
+        type === "question.rejected"
+      )
+        return post("working");
+      if (!p.sessionID || (await child(p.sessionID))) return;
+      // session.status is the current event (idle | retry | busy);
+      // session.idle the older one, which builds still send beside it.
+      if (type === "session.status") {
+        if (p.status?.type === "busy") {
+          settled.delete(p.sessionID);
+          errored.delete(p.sessionID);
+          return post("working");
+        }
+        if (p.status?.type === "idle") return turnEnd(p.sessionID);
+        return;
+      }
+      if (type === "session.idle") return turnEnd(p.sessionID);
+      if (type === "session.error") {
+        // Stopped by the user: back at the prompt, nothing to push.
+        if (p.error?.name === "MessageAbortedError") {
+          settled.add(p.sessionID);
+          return post("idle");
+        }
+        errored.add(p.sessionID);
+        return post(
+          "waiting",
+          "attention",
+          p.error?.data?.message || p.error?.name,
+        );
+      }
     },
   };
 };
@@ -8205,7 +8729,7 @@ var PLUGIN_FILE = () => path.join(config.dataDir, "opencode-plugin.js");
 * screen has to speak for the session. Checked on disk rather than
 * remembered from a launch, so a session that outlives the app process
 * is still known to report for itself. */
-function installed() {
+function installed$1() {
 	return fs.existsSync(PLUGIN_FILE());
 }
 /** opencode resolves a `plugin` entry that looks like a path as a local
@@ -8219,6 +8743,114 @@ function pluginConfig() {
 	} catch {}
 	return JSON.stringify({ plugin: [file] });
 }
+function readHook$1(p, reported) {
+	const summary = str$1(p.summary);
+	return {
+		reason: reported,
+		summary: summary ? cleanSummary(summary) : void 0
+	};
+}
+var opencode = {
+	meta: meta$1,
+	readyScreen: /Ask anything/,
+	launchEnv: () => ({ OPENCODE_CONFIG_CONTENT: pluginConfig() }),
+	reportsWorking: installed$1,
+	envPrefixes: ["OPENCODE_"],
+	readHook: readHook$1
+};
+//#endregion
+//#region src/agents/pi/index.ts
+var meta = meta_default;
+/** Pi's hooks are extensions: a module loaded with `-e <path>` (repeatable,
+* alongside the user's own, no config written) that subscribes to the
+* agent's events. `agent_settled` is the end of a turn — `agent_end` fires
+* after every run, and Pi may still retry, compact or carry on with a
+* queued follow-up — and `ui_prompt_start`/`_end` bracket an extension's
+* prompt, the one way Pi stops on the user. A Pi older than
+* `agent_settled` (0.80.4) never sends it, so a run's end waits a moment
+* for one and reports itself when none comes. The extension posts its own
+* reports, as opencode's plugin does; `readHook` only unwraps them. */
+var EXTENSION = (appPort) => `// Generated by work. Reports this
+// session's working / needs-input / done state to the app; edits are
+// overwritten. Port and session id come from the env tmux gave the pane.
+const post = async (state, reason, summary) => {
+  const session = process.env.WORK_SESSION_ID;
+  if (!session) return;
+  const port = process.env.WORK_APP_PORT || "${appPort}";
+  const qs =
+    \`session=\${encodeURIComponent(session)}&agent=pi&state=\${state}\` +
+    (reason ? \`&reason=\${reason}\` : "");
+  try {
+    await fetch(\`http://127.0.0.1:\${port}/api/agent-state?\${qs}\`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ summary }),
+      signal: AbortSignal.timeout(3000),
+    });
+  } catch {}
+};
+
+const textOf = (message) =>
+  (Array.isArray(message?.content) ? message.content : [])
+    .filter((part) => part?.type === "text" && part.text)
+    .map((part) => part.text)
+    .join("\\n");
+
+export default function (pi) {
+  // The run's last assistant message, for the summary and how it ended.
+  let last = null;
+  // This Pi sends agent_settled; until one arrives, a run's end waits.
+  let settles = false;
+  let fallback = null;
+  const settle = () => {
+    clearTimeout(fallback);
+    fallback = null;
+    const message = last;
+    last = null;
+    if (message?.stopReason === "aborted") return post("idle");
+    if (message?.stopReason === "error")
+      return post("waiting", "attention", message.errorMessage || textOf(message));
+    return post("waiting", "done", textOf(message));
+  };
+  pi.on("agent_start", () => {
+    clearTimeout(fallback);
+    fallback = null;
+    return post("working");
+  });
+  pi.on("agent_end", (event) => {
+    const messages = Array.isArray(event?.messages) ? event.messages : [];
+    last = [...messages].reverse().find((m) => m?.role === "assistant") ?? last;
+    if (!settles) fallback = setTimeout(settle, 1500);
+  });
+  pi.on("agent_settled", (_event, ctx) => {
+    settles = true;
+    // Another extension may have started a run already.
+    if (ctx?.isIdle && !ctx.isIdle()) return;
+    return settle();
+  });
+  pi.on("ui_prompt_start", (event) =>
+    post("waiting", "attention", event?.title || "Waiting for input"),
+  );
+  pi.on("ui_prompt_end", (_event, ctx) =>
+    post(ctx?.isIdle && ctx.isIdle() ? "idle" : "working"),
+  );
+}
+`;
+var EXTENSION_FILE = () => path.join(config.dataDir, "pi-extension.ts");
+/** Whether the extension is on disk for Pi to load — without it the
+* screen has to speak for the session. Checked on disk rather than
+* remembered from a launch, so a session that outlives the app process
+* is still known to report for itself. */
+function installed() {
+	return fs.existsSync(EXTENSION_FILE());
+}
+function extensionFile() {
+	const file = EXTENSION_FILE();
+	try {
+		writeIfChanged(file, EXTENSION(config.appPort));
+	} catch {}
+	return file;
+}
 function readHook(p, reported) {
 	const summary = str$1(p.summary);
 	return {
@@ -8237,17 +8869,13 @@ var AGENTS = [
 	copilot,
 	cursor,
 	grok,
+	opencode,
 	{
-		meta: meta$1,
-		readyScreen: /Ask anything/,
-		launchEnv: () => ({ OPENCODE_CONFIG_CONTENT: pluginConfig() }),
+		meta,
+		launchFlags: () => ["-e", extensionFile()],
 		reportsWorking: installed,
-		envPrefixes: ["OPENCODE_"],
+		envPrefixes: ["PI_"],
 		readHook
-	},
-	{
-		meta: meta_default,
-		envPrefixes: ["PI_"]
 	}
 ];
 var byFamily = new Map(AGENTS.map((a) => [a.meta.id, a]));
@@ -8256,13 +8884,13 @@ function agentFor(id) {
 	return id ? byFamily.get(agentFamily(id)) : void 0;
 }
 /** Extra argv for an agent CLI so it reports working/waiting state. */
-function agentLaunchFlags(id) {
-	return agentFor(id)?.launchFlags?.() ?? [];
+function agentLaunchFlags(id, ctx) {
+	return agentFor(id)?.launchFlags?.(ctx) ?? [];
 }
 /** Env for a spawned pane so the agent CLI reports state — the families
 * configured by environment rather than argv. */
-function agentLaunchEnv(id) {
-	return agentFor(id)?.launchEnv?.() ?? {};
+function agentLaunchEnv(id, ctx) {
+	return agentFor(id)?.launchEnv?.(ctx) ?? {};
 }
 /** Whether the agent says when it *starts* working, not just when it stops
 * — believing the screen over that costs it the state its own hook just
@@ -8270,6 +8898,14 @@ function agentLaunchEnv(id) {
 function reportsWorking(id) {
 	return agentFor(id)?.reportsWorking?.() ?? false;
 }
+/** The pane title a CLI shows at its prompt, if it sets one. */
+function idleTitle(id) {
+	return agentFor(id)?.idleTitle;
+}
+/** The CLI draws menus before its input box that work answers. */
+function hasStartupPrompt(id) {
+	return !!agentFor(id)?.startupPrompt;
+}
 /** Keys that answer whatever startup prompt the CLI is showing, if any. */
 function startupPromptKeys(id, screen) {
 	return agentFor(id)?.startupPrompt?.(screen);
@@ -8294,10 +8930,10 @@ function agentPathDirs(home) {
 }
 /** What a hook payload the session's CLI POSTed means. Unknown families
 * (or an unreadable body) keep the reported reason and carry no summary. */
-function readHookPayload(id, payload, reported) {
+function readHookPayload(id, payload, reported, state) {
 	if (!payload || typeof payload !== "object") return { reason: reported };
 	const read = agentFor(id)?.readHook;
-	return read ? read(payload, reported) : { reason: reported };
+	return read ? read(payload, reported, state) : { reason: reported };
 }
 //#endregion
 //#region src/server/sessions.ts
@@ -8481,18 +9117,19 @@ async function listPanesNow() {
 		"list-panes",
 		"-a",
 		"-F",
-		"#{session_name}	#{pane_current_command}	#{pane_pid}	#{window_activity}"
+		"#{session_name}	#{pane_current_command}	#{pane_pid}	#{window_activity}	#{pane_title}"
 	]).catch(() => null);
 	if (out === null) return null;
 	const panes = [];
 	for (const line of out.split("\n")) {
 		if (!line) continue;
-		const [name, command, pid, stamp] = line.split("	");
+		const [name, command, pid, stamp, ...title] = line.split("	");
 		panes.push({
 			id: name?.startsWith("wk-") ? name.slice(3) : void 0,
 			command: command || "",
 			pid: Number(pid),
-			activityAt: Number(stamp) * 1e3
+			activityAt: Number(stamp) * 1e3,
+			title: title.join("	")
 		});
 	}
 	lastPanes = {
@@ -8649,20 +9286,20 @@ function newSessionArgs(session, wsPath, mode, initialPrompt, size) {
 		tmuxName(session.id),
 		"-c",
 		wsPath,
-		...sessionEnvArgs(session.id, session.agent),
-		...loginShellCommand(session.agent, initialPrompt)
+		...sessionEnvArgs(session.id, session.agent, wsPath),
+		...loginShellCommand(session.agent, wsPath, initialPrompt)
 	];
 }
 /** Run the agent through a login shell so the pane's PATH matches the
 * user's interactive terminal (mise activation, cargo, custom bins) —
 * a service manager's PATH is far slimmer than a login shell's. */
-function loginShellCommand(agent, initialPrompt) {
+function loginShellCommand(agent, cwd, initialPrompt) {
 	const words = sessionCommand(agent);
 	if (!words.length) return [];
 	const line = [
 		...words,
-		...agentLaunchFlags(agent),
-		...initialPrompt ? [initialPrompt] : []
+		...agentLaunchFlags(agent, { cwd }),
+		...initialPrompt ? initialPrompt.startsWith("-") ? ["--", initialPrompt] : [initialPrompt] : []
 	].map(shellQuote).join(" ");
 	return [
 		process.env.SHELL || "bash",
@@ -8691,6 +9328,14 @@ function cleanEnv() {
 	env.PATH = [...parts, ...bins.filter((bin) => !parts.includes(bin))].join(":");
 	return forceUtf8Locale(env);
 }
+/** Answer the menus a CLI draws before its input box (a folder-trust
+* question) on a pane an attach just created, as sending a first prompt
+* does — so a session opened with nothing to send is not left on one. */
+async function settleStartup(id) {
+	const session = getSession(id);
+	if (!session || !hasStartupPrompt(session.agent)) return;
+	await waitForAgent(tmuxName(id), cleanEnv(), session.agent).catch(() => {});
+}
 /** Upper bound on waiting for an agent to be ready for input; past it
 * the paste goes in regardless (a TUI with a boot animation never settles). */
 var AGENT_BOOT_MS = 8e3;
@@ -8780,13 +9425,13 @@ function sessionCommand(agent) {
 /** tmux new-session env flags so the agent's hooks can report back which
 * session they belong to, plus whatever the family needs to load its own
 * hooks (opencode names its plugin here — tmux quotes it, not the shell). */
-function sessionEnvArgs(sessionId, agent) {
+function sessionEnvArgs(sessionId, agent, cwd) {
 	return [
 		"-e",
 		`WORK_SESSION_ID=${sessionId}`,
 		"-e",
 		`WORK_APP_PORT=${config.appPort}`,
-		...Object.entries(agentLaunchEnv(agent)).flatMap(([key, value]) => ["-e", `${key}=${value}`])
+		...Object.entries(agentLaunchEnv(agent, { cwd })).flatMap(([key, value]) => ["-e", `${key}=${value}`])
 	];
 }
 function tmuxName(sessionId) {
@@ -8796,4 +9441,4 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-export { allPrefs as $, agentBadge as A, setInstance as B, readHookPayload as C, TMUX_SOCKET as Ct, setAgentPhase as D, tmux as Dt, clearAgentPhase as E, run$1 as Et, ACCENT_RE as F, publish as G, pushPublicKey as H, getInstance as I, subscriberCount as J, publishJson as K, iconSvg as L, agentFromCommand as M, agentLabel as N, setScrapedPhase as O, config as Ot, agentMeta as P, agentChoices as Q, manifest as R, AGENTS as S, workspacePath as St, blankRow as T, git as Tt, saveSubscription as U, deleteSubscription as V, sendPush as W, swr as X, shared as Y, withLock as Z, renameSession as _, agentLabel$1 as _t, ensureTmuxServer as a, setPref as at, tmuxName as b, db as bt, killSession as c, doctor as ct, listPanesWithin as d, miseVersions as dt, disabledAgents as et, listSessions as f, setupPath as ft, panePids as g, agentById as gt, notifySessionsChanged as h, TOOLS as ht, disposeSessions as i, setDisabledAgents as it, agentFamily as j, setSessionViewers as k, killWorkspaceSessions as l, ghKnownHosts as lt, newSessionArgs as m, DEFAULT_GITHUB_HOST as mt, clearTmuxStarted as n, getSetting as nt, forgetPanes as o, setSetting as ot, markTmuxStarted as p, which as pt, subscribe as q, createSession as r, preferredAgent as rt, getSession as s, discoverAgents as st, cleanEnv as t, enabledAgents as tt, listPanes as u, miseInstalls as ut, sendToSession as v, toolById as vt, reportsWorking as w, gh as wt, tmuxWasStarted as x, get as xt, sessionStates as y, all as yt, normalizeAccent as z };
+export { validSubscription as $, hookPhase as A, get as At, agentFromCommand as B, AGENTS as C, DEFAULT_GITHUB_HOST as Ct, blankRow as D, toolById as Dt, reportsWorking as E, agentLabel$1 as Et, setScrapedPhase as F, run$1 as Ft, iconSvg as G, agentMeta as H, setSessionViewers as I, tmux as It, setInstance as J, manifest as K, settleQuietWorking as L, config as Lt, noteUserAnswered as M, TMUX_SOCKET as Mt, onPhaseChange as N, gh as Nt, agentPhase as O, all as Ot, setAgentPhase as P, git as Pt, sendPush as Q, agentBadge as R, tmuxWasStarted as S, which as St, readHookPayload as T, agentById as Tt, ACCENT_RE as U, agentLabel as V, getInstance as W, pushPublicKey as X, deleteSubscription as Y, saveSubscription as Z, renameSession as _, doctor as _t, ensureTmuxServer as a, swr as at, settleStartup as b, miseVersions as bt, killSession as c, allPrefs as ct, listPanesWithin as d, getSetting as dt, publish as et, listSessions as f, preferredAgent as ft, panePids as g, discoverAgents as gt, notifySessionsChanged as h, setSetting as ht, disposeSessions as i, shared as it, hookReportedAt as j, workspacePath as jt, clearAgentPhase as k, db as kt, killWorkspaceSessions as l, disabledAgents as lt, newSessionArgs as m, setPref as mt, clearTmuxStarted as n, subscribe as nt, forgetPanes as o, withLock as ot, markTmuxStarted as p, setDisabledAgents as pt, normalizeAccent as q, createSession as r, subscriberCount as rt, getSession as s, agentChoices as st, cleanEnv as t, publishJson as tt, listPanes as u, enabledAgents as ut, sendToSession as v, ghKnownHosts as vt, idleTitle as w, TOOLS as wt, tmuxName as x, setupPath as xt, sessionStates as y, miseInstalls as yt, agentFamily as z };