@phnx-labs/agents-cli 1.20.46 → 1.20.48

package/dist/lib/secrets/index.d.ts

@@ -22,6 +22,8 @@
  * through the explicit export/import flow in src/lib/secrets/sync.ts
  * rather than the system's cloud-keychain path.
  */
+import type { NativeImportReport } from './fallback.js';
+export type { NativeImportReport, NativeImportResult, NativeImportStatus } from './fallback.js';
 /** Supported secret resolution backends. */
 export type SecretProvider = 'keychain' | 'env' | 'file' | 'exec';
 /** A typed reference to a secret, consisting of a provider and a provider-specific value. */
@@ -181,6 +183,15 @@ export declare function parseOrphanMigrationOutput(stdout: string): OrphanMigrat
  * aborted" from "nothing to do" (empty array).
  */
 export declare function migrateOrphanedKeychainItems(prefix: string): OrphanMigrationResult[];
+/**
+ * Import agents-cli secrets from the native store (GNOME Keyring / Windows
+ * Credential Manager) into the encrypted file store — the Linux/Windows
+ * analogue of the macOS orphan/legacy migration, exposed as
+ * `agents secrets import-keyring`. Requires the native store to be
+ * reachable/unlocked; `commit=false` is a dry-run. macOS returns an empty
+ * report (it has no file fallback and uses `migrate-acl` instead).
+ */
+export declare function importNativeItems(prefix: string, commit: boolean): NativeImportReport;
 /** Options controlling how secret refs are resolved. */
 export interface ResolveOptions {
     /** Translate a short keychain ID to a fully namespaced item name. */

package/dist/lib/secrets/index.js

@@ -26,8 +26,8 @@ import { execFileSync, spawnSync } from 'child_process';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { linuxBackend, usesFileFallback as linuxUsesFileFallback } from './linux.js';
-import { windowsBackend, usesFileFallback as windowsUsesFileFallback } from './windows.js';
+import { linuxBackend, usesFileFallback as linuxUsesFileFallback, importNativeSecretToolItems } from './linux.js';
+import { windowsBackend, usesFileFallback as windowsUsesFileFallback, importNativeCredManItems } from './windows.js';
 import { getKeychainHelperPath } from './install-helper.js';
 const SERVICE_PREFIX = 'agents-cli';
 const SECRETS_ITEM_PREFIX = `${SERVICE_PREFIX}.secrets.`;
@@ -518,6 +518,24 @@ export function migrateOrphanedKeychainItems(prefix) {
     }
     return parseOrphanMigrationOutput(result.stdout?.toString() || '');
 }
+/**
+ * Import agents-cli secrets from the native store (GNOME Keyring / Windows
+ * Credential Manager) into the encrypted file store — the Linux/Windows
+ * analogue of the macOS orphan/legacy migration, exposed as
+ * `agents secrets import-keyring`. Requires the native store to be
+ * reachable/unlocked; `commit=false` is a dry-run. macOS returns an empty
+ * report (it has no file fallback and uses `migrate-acl` instead).
+ */
+export function importNativeItems(prefix, commit) {
+    if (backend)
+        return { available: false, locked: false, results: [] };
+    assertSupportedPlatform();
+    if (isLinux())
+        return importNativeSecretToolItems(prefix, commit);
+    if (isWindows())
+        return importNativeCredManItems(prefix, commit);
+    return { available: false, locked: false, results: [] };
+}
 function expandHome(p) {
     if (p.startsWith('~/') || p === '~') {
         return path.join(os.homedir(), p.slice(1));

package/dist/lib/secrets/linux.d.ts

@@ -17,6 +17,7 @@
  *   item    = the secret identifier
  */
 import type { KeychainBackend } from './index.js';
+import { type NativeImportReport } from './fallback.js';
 export { encryptForFallback, decryptForFallback, fileBackend, type EncFile, } from './filestore.js';
 /**
  * True when secret operations currently route to the encrypted-file store
@@ -55,6 +56,12 @@ export declare function parseSecretToolItems(output: string, prefix: string): st
  * so we use secret-tool search which outputs in a specific format.
  */
 export declare function listSecretToolItems(prefix: string): string[];
+/**
+ * Copy agents-cli items from the keyring into the file store (the `import-keyring`
+ * backend for Linux). Requires an unlocked keyring; items already in the file
+ * store are left untouched. With `commit=false` it reports what it *would* do.
+ */
+export declare function importNativeSecretToolItems(prefix: string, commit: boolean): NativeImportReport;
 /** KeychainBackend implementation for Linux. Routes through secret-tool
  *  with a transparent encrypted-file fallback when the default Secret
  *  Service collection is locked (or libsecret-tools is not installed but

package/dist/lib/secrets/linux.js

@@ -19,6 +19,7 @@
 import { spawnSync } from 'child_process';
 import * as os from 'os';
 import { fileStore, fileDir, fileStoreHasItems, machinePassphraseExists, _resetFileStoreForTest, } from './filestore.js';
+import { noteNativeShadow, _resetFallbackNoticeForTest, } from './fallback.js';
 // Re-exported so existing importers (and tests) can keep reaching these via
 // './linux.js'. The implementations live in ./filestore.ts.
 export { encryptForFallback, decryptForFallback, fileBackend, } from './filestore.js';
@@ -35,13 +36,16 @@ let isAvailable = false;
 // ---------- file fallback state ----------
 let useFileFallback = false;
 let warnedFallback = false;
+// Set once the keyring is observed locked/unreachable in this process, so the
+// read-through in get/has stops re-probing it (and stops re-emitting notices).
+let nativeUnreachable = false;
 function activateFileFallback() {
     if (useFileFallback)
         return;
     useFileFallback = true;
     if (!warnedFallback) {
         warnedFallback = true;
-        process.stderr.write(`[agents] secret-service collection locked, using file-based store at ${fileDir()}\n`);
+        process.stderr.write(`[agents] using the encrypted file store at ${fileDir()}\n`);
     }
 }
 function isLockedCollectionError(stderr) {
@@ -111,8 +115,21 @@ export function usesFileFallback() {
 /** secret-tool lookup attributes:
  *   service=agents-cli account=<user> item=<itemName> */
 export function hasSecretToolToken(item) {
-    if (preflight() === 'file')
-        return fileStore.has(item);
+    if (preflight() === 'file') {
+        if (fileStore.has(item))
+            return true;
+        // The file store is primary under the fallback, but an item can still live
+        // only in an (unlocked) keyring that predates it — read through so it isn't
+        // silently shadowed.
+        const probe = readNativeItemRaw(item);
+        if (probe.value !== undefined) {
+            noteNativeShadow('shadowed', fileDir());
+            return true;
+        }
+        if (probe.locked)
+            noteNativeShadow('locked', fileDir());
+        return false;
+    }
     const user = os.userInfo().username;
     const result = spawnSync('secret-tool', [
         'lookup',
@@ -125,14 +142,25 @@ export function hasSecretToolToken(item) {
     }
     const stderr = result.stderr?.toString() ?? '';
     if (isLockedCollectionError(stderr)) {
+        nativeUnreachable = true;
         activateFileFallback();
         return fileStore.has(item);
     }
     return false;
 }
 export function getSecretToolToken(item) {
-    if (preflight() === 'file')
-        return fileStore.get(item);
+    if (preflight() === 'file') {
+        if (fileStore.has(item))
+            return fileStore.get(item);
+        const probe = readNativeItemRaw(item);
+        if (probe.value !== undefined) {
+            noteNativeShadow('shadowed', fileDir());
+            return probe.value;
+        }
+        if (probe.locked)
+            noteNativeShadow('locked', fileDir());
+        throw new Error(`Secret '${item}' not found in the file store or keyring.`);
+    }
     const user = os.userInfo().username;
     const result = spawnSync('secret-tool', [
         'lookup',
@@ -148,6 +176,7 @@ export function getSecretToolToken(item) {
     }
     const stderr = result.stderr?.toString() ?? '';
     if (isLockedCollectionError(stderr)) {
+        nativeUnreachable = true;
         activateFileFallback();
         return fileStore.get(item);
     }
@@ -171,6 +200,7 @@ export function setSecretToolToken(item, value) {
         return;
     const stderr = result.stderr?.toString().trim() ?? '';
     if (isLockedCollectionError(stderr)) {
+        nativeUnreachable = true;
         activateFileFallback();
         fileStore.set(item, value);
         return;
@@ -193,6 +223,7 @@ export function deleteSecretToolToken(item) {
         return true;
     const stderr = result.stderr?.toString() ?? '';
     if (isLockedCollectionError(stderr)) {
+        nativeUnreachable = true;
         activateFileFallback();
         return fileStore.delete(item);
     }
@@ -252,6 +283,81 @@ export function listSecretToolItems(prefix) {
     const output = `${result.stdout?.toString() || ''}\n${result.stderr?.toString() || ''}`;
     return parseSecretToolItems(output, prefix);
 }
+// ---------- native-direct helpers (bypass preflight routing) ----------
+//
+// These always talk to secret-tool regardless of whether the process has fallen
+// back to the file store. They power (a) the read-through that keeps the file
+// store from silently shadowing keyring items, and (b) `import-keyring`.
+/**
+ * Read one item straight from the keyring. Returns `{value}` on a hit,
+ * `{locked:true}` when the collection is locked/unreachable, and `{}` on a plain
+ * miss. Never throws and never emits — the caller decides whether to notice.
+ */
+function readNativeItemRaw(item) {
+    if (nativeUnreachable)
+        return { locked: true };
+    if (!secretToolAvailable())
+        return {};
+    const user = os.userInfo().username;
+    const r = spawnSync('secret-tool', [
+        'lookup', 'service', SERVICE, 'account', user, 'item', item,
+    ], { stdio: ['ignore', 'pipe', 'pipe'] });
+    if (r.status === 0) {
+        const v = r.stdout?.toString().trim();
+        return v && v.length ? { value: v } : {};
+    }
+    if (isLockedCollectionError(r.stderr?.toString() ?? '')) {
+        nativeUnreachable = true;
+        return { locked: true };
+    }
+    return {};
+}
+/**
+ * Enumerate agents-cli items in the keyring whose name starts with `prefix`.
+ * `available` is false when secret-tool isn't installed; `locked` is true when
+ * the collection is locked.
+ */
+function listNativeItemsRaw(prefix) {
+    if (!secretToolAvailable())
+        return { items: [], locked: false, available: false };
+    const r = spawnSync('secret-tool', [
+        'search', '--all', 'service', SERVICE,
+    ], { stdio: ['ignore', 'pipe', 'pipe'] });
+    if (r.status !== 0) {
+        const locked = isLockedCollectionError(r.stderr?.toString() ?? '');
+        if (locked)
+            nativeUnreachable = true;
+        return { items: [], locked, available: true };
+    }
+    const output = `${r.stdout?.toString() || ''}\n${r.stderr?.toString() || ''}`;
+    return { items: parseSecretToolItems(output, prefix), locked: false, available: true };
+}
+/**
+ * Copy agents-cli items from the keyring into the file store (the `import-keyring`
+ * backend for Linux). Requires an unlocked keyring; items already in the file
+ * store are left untouched. With `commit=false` it reports what it *would* do.
+ */
+export function importNativeSecretToolItems(prefix, commit) {
+    const { items, locked, available } = listNativeItemsRaw(prefix);
+    if (!available || locked)
+        return { available, locked, results: [] };
+    const results = [];
+    for (const item of items) {
+        if (fileStore.has(item)) {
+            results.push({ item, status: 'exists' });
+            continue;
+        }
+        const probe = readNativeItemRaw(item);
+        if (probe.value === undefined) {
+            results.push({ item, status: 'failed', detail: probe.locked ? 'keyring locked' : 'unreadable' });
+            continue;
+        }
+        if (commit)
+            fileStore.set(item, probe.value);
+        results.push({ item, status: commit ? 'imported' : 'would-import' });
+    }
+    return { available, locked, results };
+}
 /** KeychainBackend implementation for Linux. Routes through secret-tool
  *  with a transparent encrypted-file fallback when the default Secret
  *  Service collection is locked (or libsecret-tools is not installed but
@@ -280,6 +386,8 @@ export function _resetForTest(opts = {}) {
     _resetFileStoreForTest({ fileDir: opts.fileDir ?? null, passphrase: opts.passphrase ?? null });
     useFileFallback = opts.forceFileFallback ?? false;
     warnedFallback = false;
+    nativeUnreachable = false;
     checkedAvailability = false;
     isAvailable = false;
+    _resetFallbackNoticeForTest();
 }

package/dist/lib/secrets/windows.d.ts

@@ -27,6 +27,7 @@
  * names directly.
  */
 import type { KeychainBackend } from './index.js';
+import { type NativeImportReport } from './fallback.js';
 export { encryptForFallback, decryptForFallback, fileBackend, type EncFile, } from './filestore.js';
 /**
  * CRED_MAX_CREDENTIAL_BLOB_SIZE — Credential Manager rejects a generic
@@ -53,6 +54,12 @@ export declare function listCredManItems(prefix: string): string[];
  * parseSecretToolItems (linux.ts). Exported for tests.
  */
 export declare function parseWindowsCredList(output: string, prefix: string): string[];
+/**
+ * Copy agents-cli credentials from Credential Manager into the file store (the
+ * `import-keyring` backend for Windows). Requires a reachable store; items
+ * already in the file store are left untouched.
+ */
+export declare function importNativeCredManItems(prefix: string, commit: boolean): NativeImportReport;
 /**
  * KeychainBackend implementation for Windows. Routes through Windows Credential
  * Manager (via PowerShell P/Invoke) with a transparent encrypted-file fallback

package/dist/lib/secrets/windows.js

@@ -29,6 +29,7 @@
 import { spawnSync } from 'child_process';
 import { encodePwshBase64 } from '../pwsh.js';
 import { fileStore, fileDir, fileStoreHasItems, machinePassphraseExists, _resetFileStoreForTest, } from './filestore.js';
+import { noteNativeShadow, _resetFallbackNoticeForTest, } from './fallback.js';
 // Re-exported so importers (and tests) can keep reaching these via './windows.js'.
 export { encryptForFallback, decryptForFallback, fileBackend, } from './filestore.js';
 const POWERSHELL = 'powershell.exe';
@@ -250,13 +251,16 @@ let isAvailable = false;
 // ---------- file fallback state ----------
 let useFileFallback = false;
 let warnedFallback = false;
+// Set once Credential Manager is observed unreachable in this process, so the
+// read-through in get/has stops re-probing it (and re-emitting notices).
+let nativeUnreachable = false;
 function activateFileFallback() {
     if (useFileFallback)
         return;
     useFileFallback = true;
     if (!warnedFallback) {
         warnedFallback = true;
-        process.stderr.write(`[agents] Windows Credential Manager unavailable, using file-based store at ${fileDir()}\n`);
+        process.stderr.write(`[agents] using the encrypted file store at ${fileDir()}\n`);
     }
 }
 /**
@@ -316,22 +320,45 @@ export function usesFileFallback() {
 }
 // ---------- Credential Manager ops with fallback ----------
 export function hasCredManToken(item) {
-    if (preflight() === 'file')
-        return fileStore.has(item);
+    if (preflight() === 'file') {
+        if (fileStore.has(item))
+            return true;
+        // Read through to Credential Manager so an item that predates the fallback
+        // isn't silently shadowed by the file store.
+        const probe = readNativeCredItemRaw(item);
+        if (probe.value !== undefined) {
+            noteNativeShadow('shadowed', fileDir());
+            return true;
+        }
+        if (probe.unavailable)
+            noteNativeShadow('locked', fileDir());
+        return false;
+    }
     const r = runCred('has', { target: item });
     if (r.status === 0)
         return true;
     if (r.status === 3)
         return false;
     if (isCredManUnavailableError(r)) {
+        nativeUnreachable = true;
         activateFileFallback();
         return fileStore.has(item);
     }
     return false;
 }
 export function getCredManToken(item) {
-    if (preflight() === 'file')
-        return fileStore.get(item);
+    if (preflight() === 'file') {
+        if (fileStore.has(item))
+            return fileStore.get(item);
+        const probe = readNativeCredItemRaw(item);
+        if (probe.value !== undefined) {
+            noteNativeShadow('shadowed', fileDir());
+            return probe.value;
+        }
+        if (probe.unavailable)
+            noteNativeShadow('locked', fileDir());
+        throw new Error(`Secret '${item}' not found in the file store or Credential Manager.`);
+    }
     const r = runCred('get', { target: item });
     if (r.status === 0) {
         // stdout is base64 of the raw UTF-8 blob (dodges PowerShell encoding corruption).
@@ -340,6 +367,7 @@ export function getCredManToken(item) {
     if (r.status === 3)
         throw new Error(`Secret '${item}' not found in Credential Manager.`);
     if (isCredManUnavailableError(r)) {
+        nativeUnreachable = true;
         activateFileFallback();
         return fileStore.get(item);
     }
@@ -362,6 +390,7 @@ export function setCredManToken(item, value) {
     if (r.status === 0)
         return;
     if (isCredManUnavailableError(r)) {
+        nativeUnreachable = true;
         activateFileFallback();
         fileStore.set(item, value);
         return;
@@ -377,6 +406,7 @@ export function deleteCredManToken(item) {
     if (r.status === 3)
         return false;
     if (isCredManUnavailableError(r)) {
+        nativeUnreachable = true;
         activateFileFallback();
         return fileStore.delete(item);
     }
@@ -389,6 +419,7 @@ export function listCredManItems(prefix) {
     if (r.status === 0)
         return parseWindowsCredList(r.stdout, prefix);
     if (isCredManUnavailableError(r)) {
+        nativeUnreachable = true;
         activateFileFallback();
         return fileStore.list(prefix);
     }
@@ -407,6 +438,78 @@ export function parseWindowsCredList(output, prefix) {
         .filter((s) => s.startsWith(prefix));
     return [...new Set(items)]; // dedupe
 }
+// ---------- native-direct helpers (bypass preflight routing) ----------
+//
+// Always talk to Credential Manager regardless of the file fallback. They power
+// (a) the read-through that keeps the file store from shadowing credman items,
+// and (b) `import-keyring`.
+/**
+ * Read one item straight from Credential Manager. `{value}` on hit,
+ * `{unavailable:true}` when the store is unreachable, `{}` on a plain miss.
+ * Never throws, never emits.
+ */
+function readNativeCredItemRaw(item) {
+    if (nativeUnreachable)
+        return { unavailable: true };
+    if (!powershellAvailable())
+        return {};
+    const r = runCred('get', { target: item });
+    if (r.status === 0)
+        return { value: Buffer.from(r.stdout.trim(), 'base64').toString('utf8') };
+    if (r.status === 3)
+        return {};
+    if (isCredManUnavailableError(r)) {
+        nativeUnreachable = true;
+        return { unavailable: true };
+    }
+    return {};
+}
+/**
+ * Enumerate agents-cli credentials under `prefix`. Windows credentials have no
+ * service scoping — the target IS the identifier — so we NEVER enumerate with an
+ * empty filter (that returns unrelated machine credentials). The filter is
+ * floored to the `agents-cli.` namespace; bare items (unprefixed targets) are
+ * therefore out of scope for auto-discovery on Windows.
+ */
+function listNativeCredItemsRaw(prefix) {
+    if (!powershellAvailable())
+        return { items: [], locked: false, available: false };
+    const floor = prefix && prefix.startsWith('agents-cli.') ? prefix : 'agents-cli.';
+    const r = runCred('list', { prefix: floor });
+    if (r.status === 0)
+        return { items: parseWindowsCredList(r.stdout, floor), locked: false, available: true };
+    if (isCredManUnavailableError(r)) {
+        nativeUnreachable = true;
+        return { items: [], locked: true, available: true };
+    }
+    return { items: [], locked: false, available: true };
+}
+/**
+ * Copy agents-cli credentials from Credential Manager into the file store (the
+ * `import-keyring` backend for Windows). Requires a reachable store; items
+ * already in the file store are left untouched.
+ */
+export function importNativeCredManItems(prefix, commit) {
+    const { items, locked, available } = listNativeCredItemsRaw(prefix);
+    if (!available || locked)
+        return { available, locked, results: [] };
+    const results = [];
+    for (const item of items) {
+        if (fileStore.has(item)) {
+            results.push({ item, status: 'exists' });
+            continue;
+        }
+        const probe = readNativeCredItemRaw(item);
+        if (probe.value === undefined) {
+            results.push({ item, status: 'failed', detail: probe.unavailable ? 'credential manager unavailable' : 'unreadable' });
+            continue;
+        }
+        if (commit)
+            fileStore.set(item, probe.value);
+        results.push({ item, status: commit ? 'imported' : 'would-import' });
+    }
+    return { available, locked, results };
+}
 /**
  * KeychainBackend implementation for Windows. Routes through Windows Credential
  * Manager (via PowerShell P/Invoke) with a transparent encrypted-file fallback
@@ -440,6 +543,8 @@ export function _resetForTest(opts = {}) {
     _resetFileStoreForTest({ fileDir: opts.fileDir ?? null, passphrase: opts.passphrase ?? null });
     useFileFallback = opts.forceFileFallback ?? false;
     warnedFallback = false;
+    nativeUnreachable = false;
+    _resetFallbackNoticeForTest();
     if (opts.forceAvailable === undefined || opts.forceAvailable === null) {
         checkedAvailability = false;
         isAvailable = false;

package/dist/lib/self-heal/checks/shims.js

@@ -4,7 +4,7 @@
 // background so the shim schema settles without user-facing churn.
 import { resultOf } from '../types.js';
 import { AGENTS } from '../../agents.js';
-import { ensureShimCurrent, ensureVersionedAliasCurrent, isShimCurrent, isVersionedAliasCurrent, removeLegacyUserShim, listAgentsWithInstalledVersions, } from '../../shims.js';
+import { createShim, ensureShimCurrent, ensureVersionedAliasCurrent, isShimCurrent, isVersionedAliasCurrent, shimPointsAtLiveInstall, removeLegacyUserShim, listAgentsWithInstalledVersions, listShimFileNames, pruneOrphanedCommandShim, } from '../../shims.js';
 import { listInstalledVersions } from '../../versions.js';
 export const shimsCheck = {
     id: 'shims',
@@ -19,6 +19,14 @@ export const shimsCheck = {
                     ensureShimCurrent(agent);
                 fixed.push(`${cmd} shim`);
             }
+            else if (!shimPointsAtLiveInstall(agent)) {
+                // Schema is current but the baked AGENTS_BIN points at a different, removed
+                // install (dev build, old npm-global, rotated version dir). ensureShimCurrent
+                // would no-op on a schema-current shim, so force a rewrite to the current install.
+                if (!ctx.dryRun)
+                    createShim(agent);
+                fixed.push(`${cmd} shim (repointed to current install)`);
+            }
             for (const version of listInstalledVersions(agent)) {
                 if (!isVersionedAliasCurrent(agent, version)) {
                     if (!ctx.dryRun)
@@ -30,6 +38,16 @@ export const shimsCheck = {
             if (!ctx.dryRun && removeLegacyUserShim(agent))
                 fixed.push(`removed legacy ${cmd} shim`);
         }
+        // Prune orphaned legacy command shims (browser/secrets/sessions/… left by a
+        // removed install) whose baked AGENTS_BIN is dead — the current source never
+        // regenerates them, and they either die with exit 127 or shadow the real
+        // package bin on PATH. Only removes shims whose target install is gone.
+        if (!ctx.dryRun) {
+            for (const name of listShimFileNames()) {
+                if (pruneOrphanedCommandShim(name))
+                    fixed.push(`pruned orphaned ${name} shim`);
+            }
+        }
         return resultOf(fixed, []);
     },
 };

package/dist/lib/session/discover.js

@@ -2456,6 +2456,8 @@ export function readKimiMeta(filePath) {
             project = parts.slice(0, -1).join('/');
         }
     }
+    // Parse wire.jsonl to extract message count and token usage
+    const { messageCount, tokenCount } = parseKimiWireMetrics(sessionDir);
     const meta = {
         id: sessionId,
         shortId,
@@ -2464,9 +2466,48 @@ export function readKimiMeta(filePath) {
         project,
         filePath,
         topic,
+        messageCount,
+        tokenCount: tokenCount > 0 ? tokenCount : undefined,
     };
     return { meta, content: lastPrompt || '' };
 }
+/** Parse Kimi's wire.jsonl to extract message count and token usage.
+ * TODO: optimize to stream (like scanClaudeSession) to avoid loading large files into memory.
+ * For now, synchronous readFileSync matches the pattern of reading state.json and is acceptable
+ * since session dirs are usually fresh in FS cache during incremental scans. */
+function parseKimiWireMetrics(sessionDir) {
+    const wirePath = path.join(sessionDir, 'agents', 'main', 'wire.jsonl');
+    let messageCount = 0;
+    let tokenCount = 0;
+    if (!fs.existsSync(wirePath)) {
+        return { messageCount: 0, tokenCount: 0 };
+    }
+    try {
+        const lines = fs.readFileSync(wirePath, 'utf-8').split('\n');
+        for (const line of lines) {
+            if (!line.trim())
+                continue;
+            try {
+                const event = JSON.parse(line);
+                if (event.type === 'context.append_message') {
+                    messageCount++;
+                }
+                else if (event.type === 'usage.record' && event.usage) {
+                    // Kimi usage structure: inputOther + output + inputCacheRead + inputCacheCreation
+                    const u = event.usage;
+                    tokenCount += (u.inputOther || 0) + (u.output || 0) + (u.inputCacheRead || 0) + (u.inputCacheCreation || 0);
+                }
+            }
+            catch {
+                // Malformed line, skip
+            }
+        }
+    }
+    catch {
+        // If wire.jsonl can't be read, return 0s (graceful degradation)
+    }
+    return { messageCount, tokenCount };
+}
 /** Parse a time filter string (relative like '7d' or ISO timestamp) into epoch milliseconds. */
 export function parseTimeFilter(input) {
     const relativeMatch = input.match(/^(\d+)([mhdw])$/i);

package/dist/lib/shims.d.ts

@@ -284,6 +284,28 @@ export declare function shimExists(agent: AgentId): boolean;
  * older version that needs regeneration.
  */
 export declare function isShimCurrent(agent: AgentId): boolean;
+/**
+ * True when the agent shim's baked `AGENTS_BIN` is fine to keep: it either already
+ * points at the install we'd generate now, OR points at some OTHER install that
+ * still exists on disk (leave it — regenerating could ping-pong two live installs
+ * sharing the shims dir). Returns FALSE only when the shim points at a DIFFERENT,
+ * now-removed install — the exact drift a deleted dev build (`~/.local/agents-cli-dev`),
+ * an old npm-global (`/opt/homebrew`), or a rotated version dir leaves behind. A shim
+ * can pass the schema check (`isShimCurrent`) yet still carry that stale path.
+ */
+export declare function shimPointsAtLiveInstall(agent: AgentId): boolean;
+/** Shim files in the shims dir, excluding the hooks/ subdir and @-versioned aliases. */
+export declare function listShimFileNames(): string[];
+/**
+ * Prune a stale, orphaned shim: one that is NOT a managed agent shim and NOT a user
+ * alias, whose baked `AGENTS_BIN` points at an install that no longer exists. These
+ * are legacy `exec "$AGENTS_BIN" <cmd>` command shims (browser/secrets/sessions/…)
+ * left behind by a removed install — the current source never generates them, and
+ * they either die with `exit 127` or shadow the real package bin on PATH. Only
+ * removed when the baked target is gone, so a working shim is never touched.
+ * Returns true if removed.
+ */
+export declare function pruneOrphanedCommandShim(fileName: string): boolean;
 /**
  * Regenerate the shim if it's missing or outdated. Returns a status describing
  * what happened — callers can surface a one-line notice to the user ("Updated