@jc_stack/ez-agents 0.1.0-beta.48 → 0.1.0-beta.49

package/src/control-state.ts

@@ -2,7 +2,8 @@ import { assertEffort } from './model-policy.js'
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
 import { mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import path from 'node:path'
-import { isPreset, persistedPreset, presetProvider, type AiPreset, type ExecutionChoice, type ModelChoice } from './ai.js'
+import { isPreset, persistedPreset, presetProvider, sameEngine, type AiPreset, type ExecutionChoice, type ModelChoice } from './ai.js'
+import { isAuthProfile } from './auth-profile.js'
 
 export type Owner = {
   id?: string
@@ -58,6 +59,8 @@ export type SessionState = {
   sessionId: string
   hasStarted: boolean
   cli?: string
+  // Bound with cli at creation: a native session never resumes under another home.
+  authProfile?: string
   nativeSessionId?: string
   title?: string
   archived?: boolean
@@ -129,7 +132,8 @@ const isState = (value: unknown): value is ControlState => {
     (s.archived === undefined || typeof s.archived === 'boolean') &&
     (s.applicationScope === undefined || /^[a-f0-9]{64}$/.test(s.applicationScope)) &&
     (s.telegramShared === undefined || typeof s.telegramShared === 'boolean') &&
-    (s.preset === undefined || (isPreset(s.preset) && s.preset.cli === s.cli))
+    (s.authProfile === undefined || (isAuthProfile(s.authProfile) && s.cli !== undefined)) &&
+    (s.preset === undefined || (isPreset(s.preset) && sameEngine(s.preset, s)))
   return (
     candidate.version === 1 &&
     Array.isArray(candidate.pending) &&
@@ -150,9 +154,11 @@ const isState = (value: unknown): value is ControlState => {
 export const sessionTitle = (session: SessionState): string =>
   session.title || `Conversation ${session.sessionId.slice(0, 8)}`
 
+const engineOf = (preset: AiPreset) => ({ cli: preset.cli, ...(preset.authProfile ? { authProfile: preset.authProfile } : {}) })
+
 const rememberPreset = (state: ControlState) => {
   const preset = state.ai?.presets.find(p => p.id === state.ai!.selectedId)
-  if (state.activeSession && preset && state.activeSession.cli === preset.cli)
+  if (state.activeSession && preset && sameEngine(state.activeSession, preset))
     state.activeSession.preset = preset
 }
 
@@ -486,8 +492,8 @@ export class ControlStore {
       const ai = state.ai
       // Older sessions did not record their model. Reuse a known preset for the
       // same CLI; never resume an engine ID through a different client.
-      const preset = session.preset ?? ai?.presets.find(p => p.cli === session.cli)
-      if (!ai || !preset || preset.cli !== session.cli)
+      const preset = session.preset ?? ai?.presets.find(p => sameEngine(p, session))
+      if (!ai || !preset || !sameEngine(preset, session))
         throw new Error('This older conversation has no saved AI binding. Start a new conversation.')
       if (session.hasStarted && ['codex', 'codex-gui', 'opencode'].includes(session.cli!) && !session.nativeSessionId)
         throw new Error('This conversation has no native session ID. Start a new conversation.')
@@ -537,10 +543,11 @@ export class ControlStore {
       const state = await this.readState()
       await requireControlGuard(state, guard)
       if (expectedSession !== undefined && (state.activeSession?.sessionId ?? null) !== expectedSession) throw new Error('Conversation changed. Refresh controls before trying again.')
+      const fallback = state.ai?.presets.find((p) => p.id === state.ai!.defaultId)
       const next: SessionState = {
         sessionId: crypto.randomUUID(),
         hasStarted: false,
-        cli: state.ai?.presets.find((p) => p.id === state.ai!.defaultId)?.cli,
+        ...(fallback ? engineOf(fallback) : {}),
       }
       rememberPreset(state)
       if (state.activeSession) (state.sessions ??= []).push(state.activeSession)
@@ -624,25 +631,25 @@ export class ControlStore {
     const settledPreset = settledAi?.presets.find((p) => p.id === settledAi.selectedId)
     const session = settled.activeSession
     if (settledPreset && session && (session.cli || session.hasStarted) &&
-      !(session.cli === settledPreset.cli && session.hasStarted && session.preset &&
+      !(sameEngine(session, settledPreset) && session.hasStarted && session.preset &&
         presetProvider(session.preset) !== presetProvider(settledPreset)) &&
-      (session.cli !== settledPreset.cli || JSON.stringify(session.preset) === JSON.stringify(settledPreset)) &&
+      (!sameEngine(session, settledPreset) || JSON.stringify(session.preset) === JSON.stringify(settledPreset)) &&
       Boolean(session.title || session.hasStarted || !title?.trim()))
       return { sessionId: session.sessionId, preset: settledPreset }
     return this.withLock(async () => {
       const state = await this.readState()
       state.ai ??= { presets: [persistedPreset(initial)], defaultId: initial.id, selectedId: initial.id, recentIds: [] }
       const preset = state.ai.presets.find((p) => p.id === state.ai!.selectedId)!
-      state.activeSession ??= { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli }
-      if (!state.activeSession.cli && !state.activeSession.hasStarted) state.activeSession.cli = preset.cli
-      if (state.activeSession.cli === preset.cli) {
+      state.activeSession ??= { sessionId: crypto.randomUUID(), hasStarted: false, ...engineOf(preset) }
+      if (!state.activeSession.cli && !state.activeSession.hasStarted) Object.assign(state.activeSession, engineOf(preset))
+      if (sameEngine(state.activeSession, preset)) {
         const previous = state.activeSession.preset
         // A provider change starts a separate native context. Model and effort
         // changes are native turn settings within the existing conversation.
         if (state.activeSession.hasStarted && previous &&
             presetProvider(previous) !== presetProvider(preset)) {
           ;(state.sessions ??= []).push(state.activeSession)
-          state.activeSession = { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli, preset }
+          state.activeSession = { sessionId: crypto.randomUUID(), hasStarted: false, ...engineOf(preset), preset }
         } else {
           state.activeSession.preset = preset
         }
@@ -675,14 +682,14 @@ export class ControlStore {
         state.ai!.selectedId = session.preset!.id
       }
       if (previous?.preset) {
-        if (requested && requested.cli !== previous.cli) throw new Error('Application request conflicts with existing session engine')
+        if (requested && !sameEngine(requested, previous)) throw new Error('Application request conflicts with existing session engine')
         if (requested) previous.preset = requested
         activate(previous)
         if (shareTelegram || requested) await this.writeState(state)
         return { sessionId: previous.sessionId, preset: previous.preset }
       }
       const preset = requested ?? state.ai.presets.find(item => item.id === state.ai!.selectedId)!
-      const session: SessionState = { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli, preset, applicationScope: scope }
+      const session: SessionState = { sessionId: crypto.randomUUID(), hasStarted: false, ...engineOf(preset), preset, applicationScope: scope }
       state.sessions.push(session)
       activate(session)
       await this.writeState(state)
@@ -705,7 +712,7 @@ export class ControlStore {
         throw new Error('Application scope is shared; use shared controls')
       const nextPreset = preset ?? state.ai?.presets.find(item => item.id === state.ai!.defaultId)
       if (!nextPreset || !isPreset(nextPreset)) throw new Error('Invalid application AI selection')
-      if (preset && previous?.cli === preset.cli) {
+      if (preset && previous && sameEngine(previous, preset)) {
         previous.preset = persistedPreset(preset)
         await this.writeState(state)
         return previous
@@ -714,7 +721,7 @@ export class ControlStore {
       // the old immutable session ID; private history stays absent from /chats.
       if (previous) previous.archived = true
       const next: SessionState = {sessionId:crypto.randomUUID(), hasStarted:false,
-        cli:nextPreset.cli, preset:persistedPreset(nextPreset), applicationScope:scope}
+        ...engineOf(nextPreset), preset:persistedPreset(nextPreset), applicationScope:scope}
       ;(state.sessions ??= []).push(next)
       await this.writeState(state)
       return next
@@ -725,8 +732,8 @@ export class ControlStore {
     const state = await this.status()
     const session = state.activeSession?.sessionId === choice.sessionId ? state.activeSession
       : state.sessions?.find((s) => s.sessionId === choice.sessionId)
-    if (!session || session.cli !== choice.preset.cli)
-      throw new Error('Conversation has no matching CLI binding. Use New conversation explicitly; files are preserved.')
+    if (!session?.cli || !sameEngine(session, choice.preset))
+      throw new Error('Conversation has no matching CLI binding for this client and auth profile. Use New conversation explicitly; files are preserved.')
     if (session.hasStarted && ['codex', 'codex-gui', 'opencode'].includes(session.cli) && !session.nativeSessionId)
       throw new Error('Native session ID missing. Use New conversation explicitly; no automatic reset.')
     return session
@@ -774,16 +781,16 @@ export class ControlStore {
       assertEffort(preset.effort, preset.model, preset.cli)
       if ((state.activeSession?.sessionId ?? null) !== expectedSession) throw new Error('Menu expired. Open Choose AI again.')
       const current = ai.presets.find((p) => p.id === ai.selectedId)!
-      if (state.activeSession && (current.cli !== preset.cli || presetProvider(current) !== presetProvider(preset) || !state.activeSession.cli) && !fresh) return false
+      if (state.activeSession && (!sameEngine(current, preset) || presetProvider(current) !== presetProvider(preset) || !state.activeSession.cli) && !fresh) return false
       if (fresh || !state.activeSession) {
         rememberPreset(state)
         if (state.activeSession) (state.sessions ??= []).push(state.activeSession)
-        state.activeSession = { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli, preset: persistedPreset(preset) }
+        state.activeSession = { sessionId: crypto.randomUUID(), hasStarted: false, ...engineOf(preset), preset: persistedPreset(preset) }
       }
       ai.selectedId = id
       // Persist the conversation's choice now, even if the owner switches chats
       // or restarts before sending another message. Queued choices are snapshots.
-      if (state.activeSession.cli === preset.cli && (!state.activeSession.preset || presetProvider(state.activeSession.preset) === presetProvider(preset)))
+      if (sameEngine(state.activeSession, preset) && (!state.activeSession.preset || presetProvider(state.activeSession.preset) === presetProvider(preset)))
         state.activeSession.preset = persistedPreset(preset)
       ai.recentIds = [id, ...(ai.recentIds ?? []).filter((recentId) => recentId !== id)].slice(0, 3)
       await this.writeState(state)

package/src/delivery-socket.ts

@@ -318,6 +318,8 @@ export const createLedgerHandler = (controlDir: string, hooks: LedgerHooks): Del
         const payload = (op.payload ?? {}) as { runId?: unknown; change?: unknown }
         if (typeof payload.runId !== 'string' || !payload.runId) throw new Error('Run ID is required')
         if (!payload.change || typeof payload.change !== 'object') throw new Error('Patch change is required')
+        // Setup attempts select what the host admits; only the relay records them.
+        if ('attempts' in payload.change) throw new Error('Setup attempts are relay-owned')
         return runs.patch(payload.runId, payload.change as never)
       }
       case 'taskApplication': {

package/src/executor.ts

@@ -12,6 +12,7 @@ import { fileURLToPath } from 'node:url'
 import { DESKTOP_UNAVAILABLE } from './desktop-bridge.js'
 import { macosWorkspaceProfile, workspaceSiblingDenies } from './workspace-confine.js'
 import { Scripts, type ScriptRunRef } from './scripts.js'
+import { claudeAuthEnvironment, cliHome, provisionedHome } from './auth-profile.js'
 
 export type ExecutorOptions = {
   repairEnabled?: boolean
@@ -35,6 +36,8 @@ export type ExecutorOptions = {
   model?: string
   effort?: string
   provider?: string
+  // Named owner-provisioned credential home; unset keeps the agent default.
+  authProfile?: string
   codexSandbox?: 'external'
   codexAutoCompactTokens?: number
   codexProvider?: CodexProviderBinding
@@ -95,6 +98,10 @@ export const executorJobEnv = (
 
 export const grokJobEnv = executorJobEnv
 
+// The selected native CLI is not installed or not executable. Nothing ran, so a
+// scheduled occurrence may advance to its next setup.
+export class CliUnavailableError extends Error {}
+
 // Package binDir is Ez tools (ezenciel-agents-message). Native CLIs come from the
 // host PATH so one agent's wrapper cannot retarget another agent's CODEX_HOME.
 export const resolveHostCommand = (command: string, pathValue = process.env.PATH): string => {
@@ -107,14 +114,14 @@ export const resolveHostCommand = (command: string, pathValue = process.env.PATH
       return candidate
     } catch { /* try the next PATH entry */ }
   }
-  throw new Error(`Native CLI ${command} is not executable on the host PATH`)
+  throw new CliUnavailableError(`Native CLI ${command} is not executable on the host PATH`)
 }
 export type CliAdapter = {
   name: string
   command: string
   description: string
   buildArgs: (
-    options: Pick<ExecutorOptions, 'workspace' | 'sessionId' | 'isResume' | 'model' | 'effort' | 'toolsHome' | 'sharedWorkspace' | 'additionalWorkspaces' | 'codexAutoCompactTokens' | 'codexSandbox' | 'codexProvider'> & { controlDir?: string },
+    options: Pick<ExecutorOptions, 'workspace' | 'sessionId' | 'isResume' | 'model' | 'effort' | 'toolsHome' | 'sharedWorkspace' | 'additionalWorkspaces' | 'codexAutoCompactTokens' | 'codexSandbox' | 'codexProvider' | 'nativeSession'> & { controlDir?: string },
     promptFile: string,
     promptText: string,
   ) => string[]
@@ -161,6 +168,9 @@ export const EXECUTOR_REGISTRY: Record<string, CliAdapter> = {
         args.push('--session-id', opts.sessionId)
       }
       args.push('--print', '--dangerously-skip-permissions')
+      // Scheduled runs stream structured events so core can tell a provider
+      // rejection before work from a failure after work began.
+      if (opts.nativeSession) args.push('--output-format', 'stream-json', '--verbose')
       for (const directory of [opts.controlDir, opts.sharedWorkspace, ...(opts.additionalWorkspaces ?? []), opts.toolsHome])
         if (directory) args.push('--add-dir', directory)
       if (opts.model) args.push('--model', opts.model)
@@ -294,7 +304,7 @@ export const opencodeDataHome = (controlDir: string): string | undefined => {
 }
 
 // Agent-bound Claude Code configuration directory (CLAUDE_CONFIG_DIR).
-export const claudeConfigHome = (controlDir: string): string => path.join(controlDir, 'cli', 'claude')
+export const claudeConfigHome = (controlDir: string, authProfile?: string): string => cliHome(controlDir, 'claude', authProfile)
 
 // Pi resolves its provider/model catalog from an agent dir (settings.json,
 // auth.json). Only a path is ever returned, never a secret.
@@ -336,6 +346,8 @@ export const startExecutorJob = async (
 ): Promise<{ child: ChildProcess; cleanup: () => Promise<void>; stdout: string }> => {
   if (options.script && process.env.EZ_EXECUTOR_TRANSPORT !== 'host') return startScriptJob(options as ExecutorOptions & { script: ScriptLaunch })
   options = executionDefaults(executorKey(options.cli), options)
+  // Named credential homes are owner-provisioned; fail closed before any launch state.
+  if (options.authProfile !== undefined) await provisionedHome(options.controlDir, executorKey(options.cli), options.authProfile)
   // Routing is caller-owned: a restricted task run goes to the task runner
   // unless the host transport must ship it across the boundary first.
   if (options.taskRun && process.env.EZ_EXECUTOR_TRANSPORT !== 'host') return startTaskExecutor(options)
@@ -377,7 +389,7 @@ export const startExecutorJob = async (
   }
   if (!host && !gui && command === 'codex') {
     // Share the existing authentication, never the user's memory/config/sessions.
-    const base = path.join(options.controlDir, 'cli', 'codex')
+    const base = await provisionedHome(options.controlDir, 'codex', options.authProfile)
     const home = nativeSession ? path.join(base,'tasks',options.runId) : base
     await mkdir(home, {recursive:true,mode:0o700})
     if(nativeSession){
@@ -387,9 +399,10 @@ export const startExecutorJob = async (
       try{await writeFile(path.join(home,'config.toml'),await readFile(path.join(base,'config.toml')),{flag:'wx',mode:0o600})}
       catch(error){if(!['ENOENT','EEXIST'].includes((error as NodeJS.ErrnoException).code || ''))throw error}
     }
-    // Isolated agents keep auth in this CODEX_HOME. Host-capable may link the
-    // installer login. Never replace an existing binding.
-    const authLinks = process.env.EZ_ISOLATION === 'isolated'
+    // Isolated agents and named profiles keep auth in this CODEX_HOME. The
+    // host-capable default may link the installer login. Never replace an
+    // existing binding.
+    const authLinks = process.env.EZ_ISOLATION === 'isolated' || options.authProfile !== undefined
       ? nativeSession ? [[path.join(home, 'auth.json'), path.join(base, 'auth.json')]] : []
       : [[path.join(base, 'auth.json'), path.join(homedir(), '.codex', 'auth.json')],
         ...(nativeSession ? [[path.join(home, 'auth.json'), path.join(base, 'auth.json')]] : [])]
@@ -402,28 +415,18 @@ export const startExecutorJob = async (
   if (!host && !gui && key === 'claude') {
     // Mirror the Codex binding: agent-bound settings, memory, plugins and
     // sessions; never the user's personal ~/.claude configuration.
-    const home = claudeConfigHome(options.controlDir)
+    const home = await provisionedHome(options.controlDir, 'claude', options.authProfile)
     await mkdir(home, {recursive:true,mode:0o700})
-    environment.CLAUDE_CONFIG_DIR = home
-    // Host-capable agents share the installer login only. An empty secure
-    // storage dir makes Claude use its default credential store (macOS
+    // Host-capable default homes share the installer login only. An empty
+    // secure storage dir makes Claude use its default credential store (macOS
     // Keychain entry or ~/.claude/.credentials.json) in place, so token
     // refreshes stay shared rather than diverging through a copy. Isolated
-    // agents keep their own login inside CLAUDE_CONFIG_DIR. The host executor
-    // runs unlabelled, so this matches the Codex auth-link check, not
-    // resolveIsolation().
-    if (process.env.EZ_ISOLATION !== 'isolated') environment.CLAUDE_SECURESTORAGE_CONFIG_DIR = ''
-    // Optional owner-provisioned long-lived token (`claude setup-token`). It
-    // never refreshes, so one file can be copied to every agent without the
-    // agents invalidating each other's OAuth session.
-    const token = await readFile(path.join(home, 'oauth-token'), 'utf8').then(value => value.trim(), (error: NodeJS.ErrnoException) => {
-      if (error.code === 'ENOENT') return undefined
-      throw error
-    })
-    if (token !== undefined) {
-      if (!/^[A-Za-z0-9._-]{20,512}$/.test(token)) throw new Error('Invalid Claude token binding')
-      environment.CLAUDE_CODE_OAUTH_TOKEN = token
-    }
+    // agents and named profiles keep their own login inside CLAUDE_CONFIG_DIR.
+    // The host executor runs unlabelled, so this matches the Codex auth-link
+    // check, not resolveIsolation(). An optional owner-provisioned long-lived
+    // token (`claude setup-token`) never refreshes, so one file can be copied
+    // to every agent without them invalidating each other's OAuth session.
+    Object.assign(environment, await claudeAuthEnvironment(home, options.authProfile))
   }
   if (!host && !gui && key === 'opencode') {
     // Point OpenCode at the agent-bound data home (cli/opencode/auth.json)

package/src/host-executor.ts

@@ -7,9 +7,11 @@ import { mkdir, readFile, writeFile, readdir, rename, rm, appendFile, realpath }
 import path from 'node:path'
 import { isHostRunId } from './host-executor-protocol.js'
 import { fileURLToPath } from 'node:url'
-import { startExecutorJob, terminateJob, resolveExecutor, validateCodexProvider, type CodexProviderBinding, type ExecutorOptions } from './executor.js'
+import { CliUnavailableError, startExecutorJob, terminateJob, resolveExecutor, validateCodexProvider, type CodexProviderBinding, type ExecutorOptions } from './executor.js'
+import { activeSetup } from './runs.js'
+import { startupLine, startupObserver } from './setup-fallback.js'
 import { parseIsolationClass, type IsolationClass } from './isolation.js'
-import { readModels, validateSelection, validateOpencodeProviders, type ModelChoice } from './ai.js'
+import { readModels, sameEngine, validateSelection, validateOpencodeProviders, type ModelChoice } from './ai.js'
 import type { ChildProcess } from 'node:child_process'
 import { packageVersion } from './version.js'
 import { installedPluginVersions } from './software-status.js'
@@ -48,6 +50,8 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
       new Set(installation.agents.map(a=>a.controlDir)).size !== installation.agents.length)
     throw new Error('Each agent requires a separate workspace and control directory')
   const active = new Map<string, ChildProcess>()
+  // A fallback attempt reuses its run ID; claim it only after the prior attempt's cleanup.
+  const claimed = new Set<string>()
   const tasks = new Set<Promise<void>>()
   let catalogRefresh: Promise<void> | undefined
   const locks: string[] = []
@@ -148,6 +152,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
         for (const file of await readdir(directory)) {
           if (!file.endsWith('.request.json') || !isHostRunId(file.slice(0,-13))) continue
           const id=file.slice(0,-13)
+          if (claimed.has(path.join(directory,id))) continue
           let run
           try {
             run = await readRun(agent.controlDir, id)
@@ -170,6 +175,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
             activeWorkspaces.set(agent, workspace)
           }
           workspace.lanes.set(id, scheduled)
+          claimed.add(base)
           // Keep plugin workspace invocations excluded until all native jobs finish.
           const releaseWorkspace = async () => {
             workspace.lanes.delete(id)
@@ -179,11 +185,12 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
             }
           }
           try { await rename(base+'.request.json',base+'.running.json') }
-          catch (error) { await releaseWorkspace(); throw error }
+          catch (error) { claimed.delete(base); await releaseWorkspace(); throw error }
           const task=(async()=>{
             let job: Awaited<ReturnType<typeof startExecutorJob>> | undefined
             let cancellation: ReturnType<typeof setInterval> | undefined
             let writes=Promise.resolve()
+            let observeClaude=false
             const emit=(event:unknown)=>{writes=writes.then(()=>appendFile(base+'.events',JSON.stringify(event)+'\n',{mode:0o600}))}
             try {
               try { await readFile(base+'.cancel'); throw new Error('Cancelled') } catch(error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error }
@@ -203,12 +210,20 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
                   script:{...run.script,scheduleId:run.scheduled.id,scheduleRevision:run.scheduled.revision,dueAt:run.scheduled.dueAt}}
                 job=await launch(request.texts,options)
               } else {
+                const cli = opts.cli || installation.cli
                 if (run?.scheduled) {
-                  assertScheduledModel(run.execution?.preset.model)
-                  if (opts.model !== run.execution!.preset.model) throw new Error('Scheduled run model does not match its saved task model')
+                  const setup = activeSetup(run)
+                  assertScheduledModel(setup?.model)
+                  if (opts.model !== setup!.model || cli !== setup!.cli) throw new Error('Scheduled run model does not match its saved task model')
+                  observeClaude = cli === 'claude'
                 }
-                const cli = opts.cli || installation.cli
                 resolveExecutor(cli)
+                // The credential home comes from the authorized run's captured
+                // choice; a request can never move it to another account.
+                const captured = run?.scheduled ? activeSetup(run) : run?.execution?.preset
+                if ((opts.authProfile !== undefined || (captured?.cli === cli && captured.authProfile !== undefined)) &&
+                    !(captured && sameEngine(captured, {cli, authProfile: opts.authProfile})))
+                  throw new Error('Run auth profile does not match its captured AI selection')
                 const provider = cli === 'codex' && opts.provider
                   ? (agent.codexProviders ?? []).map(validateCodexProvider).find(candidate=>candidate.id===opts.provider)
                   : undefined
@@ -221,17 +236,24 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
                 // Admission and execution must use the same catalog snapshot. A
                 // transient native-client probe failure must not reject a model
                 // that the host just advertised to the relay and application.
-                if (cli !== installation.cli) await validateSelection({id:'selected',name:'Selected model',cli,provider:opts.provider,model,effort:opts.effort},JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')))
+                if (cli !== installation.cli || opts.authProfile !== undefined) await validateSelection({id:'selected',name:'Selected model',cli,provider:opts.provider,authProfile:opts.authProfile,model,effort:opts.effort},JSON.parse(await readFile(path.join(directory,'models.json'),'utf8')))
                 const options:ExecutorOptions={workspace:agent.workspace,controlDir:agent.controlDir,binDir:agent.binDir,toolsHome:agent.toolsHome,sharedWorkspace,additionalWorkspaces:additionalWorkspaces.get(agent),cli,
                   runId:path.basename(base),timeoutMs:0,repairEnabled:opts.repairEnabled,
-                  sessionId:opts.sessionId,isResume:opts.isResume,model,effort:opts.effort,provider:opts.provider,codexAutoCompactTokens:opts.codexAutoCompactTokens,codexProvider:provider,
+                  sessionId:opts.sessionId,isResume:opts.isResume,model,effort:opts.effort,provider:opts.provider,authProfile:opts.authProfile,codexAutoCompactTokens:opts.codexAutoCompactTokens,codexProvider:provider,
                   promptSuffix:runPromptSuffix(run),taskRun:Boolean(run?.taskId),nativeSession:Boolean(run?.scheduled)}
                 job=await launch(request.texts,options)
               }
               active.set(base,job.child)
               await writeFile(base+'.process.json',JSON.stringify({pid:job.child.pid}),{mode:0o600})
               if(signal.aborted)terminateJob(job.child)
-              job.child.stdout?.on('data',chunk=>emit({stream:'stdout',text:chunk.toString()}))
+              // Scheduled Claude streams every event; forward only the startup summary.
+              const startup = observeClaude ? startupObserver() : undefined
+              let summary = ''
+              job.child.stdout?.setEncoding('utf8').on('data',(chunk:string)=>{
+                if (!startup) return emit({stream:'stdout',text:chunk})
+                startup.write(chunk)
+                if (startup.summary() !== summary) { summary = startup.summary(); emit({stream:'stdout',text:summary+'\n'}) }
+              })
               job.child.stderr?.on('data',chunk=>emit({stream:'stderr',text:chunk.toString()}))
               cancellation=setInterval(()=>{void readFile(base+'.cancel').then(()=>terminateJob(job!.child)).catch(()=>{})},250)
               const code=await new Promise<number>(resolve=>job!.child.once('close',code=>resolve(code??1)))
@@ -239,7 +261,9 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
               await job.cleanup()
               job = undefined
               emit({stream:'exit',code})
-            } catch (error) { emit({stream:'stderr',text:'Host CLI execution failed: '+redactFailure(error instanceof Error ? error.message : 'Unknown error')+'\n'}); emit({stream:'exit',code:1}) }
+            } catch (error) {
+              if (error instanceof CliUnavailableError) emit({stream:'stdout',text:startupLine({workBegan:false,rejection:{category:'cli-unavailable'}})+'\n'})
+              emit({stream:'stderr',text:'Host CLI execution failed: '+redactFailure(error instanceof Error ? error.message : 'Unknown error')+'\n'}); emit({stream:'exit',code:1}) }
             finally {
               if(cancellation)clearInterval(cancellation)
               await job?.cleanup().catch(() => {})
@@ -249,6 +273,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
               await rm(base+'.cancel',{force:true})
               active.delete(base)
               await releaseWorkspace()
+              claimed.delete(base)
             }
           })()
           tasks.add(task); void task.finally(()=>tasks.delete(task))