@phnx-labs/agents-cli 1.20.74 → 1.20.77

package/dist/lib/session/active.js

@@ -19,12 +19,13 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { execFile } from 'child_process';
+import { execFile, execFileSync } from 'child_process';
 import { promisify } from 'util';
 import { listActiveTasks } from '../cloud/store.js';
 import { AgentManager } from '../teams/agents.js';
 import { getTerminalsDir } from '../state.js';
-import { readPidSessionEntry, prunePidSessionRegistry } from './pid-registry.js';
+import { readPidSessionEntry, listPidSessionEntries, prunePidSessionRegistry } from './pid-registry.js';
+import { loadHookSessionIndex, resolveHookSessionRecord } from './hook-sessions.js';
 import { buildClaudeLabelMap } from './discover.js';
 import { buildRunNameMap } from './run-names.js';
 import { latestSessionFileForCwd } from './db.js';
@@ -33,6 +34,8 @@ import { readSessionTailWithRaw } from './tail.js';
 import { computeTokPerSec } from './throughput.js';
 import { inferSessionState } from './state.js';
 import { detectProvenance } from './provenance.js';
+import { loadDevices } from '../devices/registry.js';
+import { presenceFromStore } from './detached.js';
 import { mapBounded } from '../concurrency.js';
 const execFileAsync = promisify(execFile);
 /**
@@ -43,6 +46,15 @@ const execFileAsync = promisify(execFile);
  */
 export const LSOF_CONCURRENCY = 4;
 const LSOF_STAGGER_MS = 10;
+/**
+ * Hard ceilings on the two syscalls the status path shells out to. Without them
+ * a single hung probe (a wedged NFS `lsof`, an EDR that stalls the `ps` snapshot)
+ * pins a bounded worker slot forever and silently drops live sessions to a
+ * fallback status. On timeout the call rejects, is caught, and the row degrades
+ * honestly (unknown / empty table) instead of the sweep hanging.
+ */
+const LSOF_TIMEOUT_MS = 5_000;
+const PS_SNAPSHOT_TIMEOUT_MS = 10_000;
 export function activeStatusFromCloudStatus(status) {
     switch (status) {
         case 'running':
@@ -102,16 +114,72 @@ export function agentKindFromComm(commRaw) {
     const key = stripped === base ? base : stripped.toLowerCase();
     return AGENT_CLI_NAMES[key];
 }
-function isPidAlive(pid) {
+/**
+ * A process that began more than this long AFTER a session's recorded
+ * `startedAtMs` cannot be that session's process — the OS handed its pid to
+ * something newer. The window absorbs clock granularity (`ps -o lstart=` reports
+ * whole seconds) and the gap between a process spawning and the SessionStart
+ * hook recording `startedAtMs`; it is far below the minutes-to-hours it takes the
+ * pid space to wrap and actually recycle a pid, so it never false-kills a live
+ * session.
+ */
+const PID_REUSE_TOLERANCE_MS = 60_000;
+/**
+ * Epoch-ms start time of the process at `pid`, or null if unknowable.
+ *
+ * Distinct from teams/agents.ts's `captureProcessStartTime`, which returns an
+ * opaque token only meaningful for equality against a prior capture of the SAME
+ * pid. Here we need a value comparable to a session's `startedAtMs`, so we read
+ * `ps -o lstart=` — a ctime string on both macOS and Linux — and parse it to
+ * epoch ms. Windows and any exec/parse failure return null, so the caller falls
+ * back to a bare existence check (never worse than before).
+ */
+function processStartMs(pid) {
+    if (process.platform === 'win32')
+        return null;
+    try {
+        const out = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        if (!out)
+            return null;
+        const ms = Date.parse(out);
+        return Number.isFinite(ms) ? ms : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when `pid` names a live process AND — when a session's recorded
+ * `startedAtMs` is supplied — that process is plausibly the SAME one, not a later
+ * process that recycled the pid. The OS reuses pids, so a bare
+ * `process.kill(pid, 0)` existence check reports a dead session as alive (a
+ * "zombie") once its pid is handed to an unrelated process. A genuine session
+ * process starts at or before its own recorded start, so a process that began
+ * meaningfully AFTER `startedAtMs` is a reused pid and the session is dead. When
+ * the start time can't be read, we keep the existence answer.
+ */
+export function isPidAlive(pid, startedAtMs) {
     if (!pid || pid < 1)
         return false;
     try {
         process.kill(pid, 0);
-        return true;
     }
     catch (err) {
-        return err?.code === 'EPERM';
+        // EPERM means the pid exists but is owned by another user — still "alive",
+        // fall through to the identity check. Any other error means no such process.
+        if (err?.code !== 'EPERM')
+            return false;
     }
+    if (startedAtMs && startedAtMs > 0) {
+        const procStartMs = processStartMs(pid);
+        if (procStartMs !== null && procStartMs > startedAtMs + PID_REUSE_TOLERANCE_MS) {
+            return false; // pid recycled by a newer process — this session is gone
+        }
+    }
+    return true;
 }
 /** Read the live-terminals registry, dedupe by sessionId, keep only pid-alive entries. */
 function readLiveTerminals() {
@@ -134,7 +202,7 @@ function readLiveTerminals() {
     const merged = new Map();
     for (const [windowId, slice] of Object.entries(parsed)) {
         for (const e of (slice?.entries ?? [])) {
-            if (!e?.sessionId || !isPidAlive(e.pid))
+            if (!e?.sessionId || !isPidAlive(e.pid, e.startedAtMs))
                 continue;
             merged.set(e.sessionId, { ...e, windowId });
         }
@@ -189,19 +257,49 @@ export function pickSessionFile(projectDir, sessionId) {
     }
     return best?.path;
 }
-function classifyActivity(sessionFile) {
-    // No resolvable transcript is NOT evidence of activity — default to idle. (Before
-    // the no-borrow fix in pickSessionFile this rarely fired because every terminal
-    // borrowed the newest file; now a session with an unresolved id lands here, and
-    // "running" would wrongly light it up.)
+/**
+ * One `stat` → the transcript's creation (≈ session start) and last-write (≈ last
+ * activity) epochs. Both `undefined` when the file can't be stat'd (vanished /
+ * unresolved). `birthtimeMs` can be 0 on filesystems without creation time — coerce
+ * that to `undefined` so callers fall through to a real signal instead of epoch 0.
+ */
+export function sessionFileTimes(sessionFile) {
     if (!sessionFile)
-        return 'idle';
+        return {};
+    try {
+        const st = fs.statSync(sessionFile);
+        return { birthtimeMs: st.birthtimeMs || undefined, mtimeMs: st.mtimeMs || undefined };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * The ONE place a fallback status is decided when no rich transcript state is
+ * available — a non-Claude/Codex kind we cannot parse, or a Claude/Codex tail
+ * that was empty or unreadable. Honest by construction: it never asserts a status
+ * it cannot justify from a measured signal.
+ *
+ *   - Resolvable transcript, readable mtime → the MEASURED freshness signal:
+ *     written within ACTIVE_MTIME_WINDOW_MS ⇒ `running`, else `idle`.
+ *   - Resolvable transcript whose `stat` throws (file vanished / permission) → we
+ *     genuinely cannot tell ⇒ `unknown`. (This branch previously returned
+ *     `running`, which contradicted the `idle` default one branch up.)
+ *   - No resolvable transcript but the process is alive → alive-but-opaque ⇒
+ *     `unknown`. This is the truthful answer for a live gemini / droid / cursor /
+ *     opencode whose format we don't parse — NOT a fabricated `idle` (which the
+ *     UI reads as "done and waiting"), and it never lies as `running` either.
+ *   - No transcript and the process is not known alive → nothing to report ⇒ `idle`.
+ */
+export function resolveFallbackStatus(sessionFile, pidAlive) {
+    if (!sessionFile)
+        return pidAlive ? 'unknown' : 'idle';
     try {
         const mtimeMs = fs.statSync(sessionFile).mtimeMs;
         return Date.now() - mtimeMs < ACTIVE_MTIME_WINDOW_MS ? 'running' : 'idle';
     }
     catch {
-        return 'running';
+        return 'unknown';
     }
 }
 /**
@@ -255,11 +353,13 @@ function statusFromActivity(activity) {
 /**
  * Fold a computed SessionState onto an active-session row: rich status +
  * preview + PR/worktree/ticket badges. With no state (unreadable/non-Claude/
- * Codex file) it degrades to the mtime-only classification.
+ * Codex file) it degrades to {@link resolveFallbackStatus}, which needs
+ * `pidAlive` to tell an alive-but-opaque process (`unknown`) from a dead one
+ * (`idle`).
  */
-function applyState(base, state, fallbackFile) {
+function applyState(base, state, fallbackFile, pidAlive) {
     if (!state)
-        return { ...base, status: classifyActivity(fallbackFile) };
+        return { ...base, status: resolveFallbackStatus(fallbackFile, pidAlive) };
     return {
         ...base,
         status: statusFromActivity(state.activity),
@@ -361,7 +461,8 @@ export async function listTeamsActive() {
         const sessionId = a.parentSessionId ?? a.remoteSessionId ?? undefined;
         const sessionFile = findSessionFileForKind(a.agentType, a.cwd ?? undefined, sessionId ?? undefined);
         const topic = sessionFile ? quickExtractTopic(sessionFile) : undefined;
-        const { state, tokPerSec } = computeLiveSignals(a.agentType, sessionFile, a.cwd ?? undefined, a.pid ? isPidAlive(a.pid) : true);
+        const pidAlive = a.pid ? isPidAlive(a.pid) : true;
+        const { state, tokPerSec } = computeLiveSignals(a.agentType, sessionFile, a.cwd ?? undefined, pidAlive);
         return applyState({
             context: 'teams',
             kind: a.agentType,
@@ -373,9 +474,10 @@ export async function listTeamsActive() {
             tokPerSec,
             sessionFile,
             startedAtMs: a.startedAt.getTime(),
+            lastActivityMs: sessionFileTimes(sessionFile).mtimeMs,
             teamName: a.taskName,
             agentId: a.agentId,
-        }, state, sessionFile);
+        }, state, sessionFile, pidAlive);
     });
 }
 /** Live editor-terminal agents across every IDE window. */
@@ -411,7 +513,8 @@ export async function listTerminalsActive() {
         const name = resolvedId ? runNameMap.get(resolvedId) ?? undefined : undefined;
         // Extract topic from session file (first meaningful user message)
         const topic = sessionFile ? quickExtractTopic(sessionFile) : undefined;
-        const { state, tokPerSec } = computeLiveSignals(t.kind, sessionFile, t.cwd ?? undefined, isPidAlive(t.pid));
+        const pidAlive = isPidAlive(t.pid, t.startedAtMs);
+        const { state, tokPerSec } = computeLiveSignals(t.kind, sessionFile, t.cwd ?? undefined, pidAlive);
         return applyState({
             context: 'terminal',
             kind: t.kind,
@@ -426,8 +529,9 @@ export async function listTerminalsActive() {
             tokPerSec,
             sessionFile,
             startedAtMs: t.startedAtMs,
+            lastActivityMs: sessionFileTimes(sessionFile).mtimeMs,
             windowId: t.windowId,
-        }, state, sessionFile);
+        }, state, sessionFile, pidAlive);
     });
 }
 /** Cloud tasks still in a non-terminal state. `tasks.db` may not exist; that's fine. */
@@ -485,7 +589,7 @@ async function readProcessTable() {
         return readProcessTableWin32();
     let out;
     try {
-        ({ stdout: out } = await execFileAsync('ps', ['-A', '-o', 'pid=,ppid=,tty=,comm='], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }));
+        ({ stdout: out } = await execFileAsync('ps', ['-A', '-o', 'pid=,ppid=,tty=,comm='], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: PS_SNAPSHOT_TIMEOUT_MS }));
     }
     catch {
         return [];
@@ -519,7 +623,7 @@ async function readProcessTableWin32() {
         ({ stdout: out } = await execFileAsync('powershell.exe', [
             '-NoProfile', '-NonInteractive', '-Command',
             'Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name | ConvertTo-Csv -NoTypeInformation',
-        ], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, windowsHide: true }));
+        ], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, windowsHide: true, timeout: PS_SNAPSHOT_TIMEOUT_MS }));
     }
     catch {
         return [];
@@ -581,6 +685,7 @@ async function getCwdForPid(pid) {
     try {
         const res = await execFileAsync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], {
             encoding: 'utf8',
+            timeout: LSOF_TIMEOUT_MS,
         });
         out = res.stdout;
     }
@@ -763,6 +868,33 @@ export async function listUnattributedActive(attributed) {
     // Bounded + staggered lsof probes: same cwds, but a trickle of spawns instead
     // of one simultaneous system-wide burst that behavioral EDR flags as recon.
     const cwds = await resolveCwds(kept.map(c => c.pid));
+    // The hook state dir is scanned at most ONCE per active-scan, and the ppid map
+    // is inverted at most once — both built lazily on the first candidate that
+    // lacks an exact launch-time id, so an all-Claude set does neither. The ~3s
+    // poll must not re-read the dir (or re-invert the map) per candidate.
+    let hookIndex;
+    let childrenByParent;
+    // Durable `agents run --name` handles keyed by session id — the same source the
+    // terminal path uses to name a row. Headless agents have no live-terminals
+    // label and no /rename, so without this a `--name`d headless run would surface
+    // with only a topic and no tab title. Built once per scan.
+    const runNameMap = buildRunNameMap();
+    const ensureChildren = () => {
+        if (childrenByParent)
+            return childrenByParent;
+        const m = new Map();
+        // The hook records under the agent pid; a wrapper/shell pid we recorded has
+        // the agent as a child, so we resolve via a recorded pid's immediate children.
+        for (const [childPid, parentPid] of ppidMap) {
+            const arr = m.get(parentPid);
+            if (arr)
+                arr.push(childPid);
+            else
+                m.set(parentPid, [childPid]);
+        }
+        childrenByParent = m;
+        return m;
+    };
     const out = [];
     for (let i = 0; i < kept.length; i++) {
         const { pid, kind } = kept[i];
@@ -772,12 +904,45 @@ export async function listUnattributedActive(attributed) {
         // .jsonl. The shim's entry may sit on a wrapper ancestor (Windows .cmd
         // path). Absent entirely (direct launch outside agents-cli) → heuristic.
         const entry = readPidSessionEntry(pid) ?? readAncestorSessionEntry(pid, ppidMap, kind);
+        // Exact session id, in priority: (1) the id we recorded at launch (Claude,
+        // known up front via --session-id); (2) the agent's OWN SessionStart hook,
+        // authoritative for non-Claude and for agents we didn't launch, joined by
+        // launchId/terminalId/pid and kind-guarded against a stale reused-pid file;
+        // (3) the newest-jsonl heuristic (sessionIdFromFile, below).
+        let exactId = entry?.sessionId;
+        // The hook record (when we fall to it) also carries the SessionStart `ts` — the
+        // real session-start epoch. Capture it so terminal/headless rows get a
+        // `startedAtMs` instead of rendering "0s ago" (they set none before this).
+        let hookRec;
+        if (!exactId) {
+            hookIndex ??= loadHookSessionIndex();
+            hookRec = resolveHookSessionRecord(hookIndex, {
+                pid,
+                kind,
+                launchId: entry?.launchId,
+                terminalId: entry?.terminalId,
+                childPids: ensureChildren().get(pid),
+            });
+            exactId = hookRec?.session_id;
+        }
         const cwd = cwds[i] ?? entry?.cwd ?? undefined;
-        const sessionFile = findSessionFileForKind(kind, cwd, entry?.sessionId);
+        const sessionFile = findSessionFileForKind(kind, cwd, exactId);
         const topic = sessionFile ? quickExtractTopic(sessionFile) : undefined;
         const host = detectHost(pid, procByPid);
         const context = host && UI_HOSTS.has(host) ? 'terminal' : 'headless';
+        // pidAlive is true by construction: this pid was just enumerated from the
+        // live process table, so an opaque (non-parseable) kind resolves to
+        // `unknown`, not a fake `idle`.
         const { state, tokPerSec } = computeLiveSignals(kind, sessionFile, cwd, true);
+        const { birthtimeMs, mtimeMs } = sessionFileTimes(sessionFile);
+        // Durable run name from `agents run --name`, resolved by the run's session id
+        // — the tab-title handle for a run we launched by name. A headless row carries
+        // no /rename label and no live-terminals label, so this handle IS its label
+        // (mirrors listTeamsActive `label: a.name`). Absent a `--name`, label stays
+        // undefined and the display falls back to the topic on its own — no band-aid.
+        const resolvedId = exactId ?? sessionIdFromFile(sessionFile);
+        const name = resolvedId ? runNameMap.get(resolvedId) ?? undefined : undefined;
+        const label = name;
         out.push(applyState({
             context,
             kind,
@@ -785,25 +950,73 @@ export async function listUnattributedActive(attributed) {
             tty: procByPid.get(pid)?.tty,
             pid,
             cwd,
-            sessionId: entry?.sessionId ?? sessionIdFromFile(sessionFile),
+            sessionId: resolvedId,
+            label,
+            name,
             topic,
             tokPerSec,
             sessionFile,
+            // Session start: the hook's authoritative SessionStart `ts`, else the
+            // transcript's creation time. Last activity: the transcript's last write.
+            startedAtMs: hookRec?.ts ?? birthtimeMs,
+            lastActivityMs: mtimeMs,
             pidCount: 1 + (foldedByRoot.get(pid) ?? 0),
-        }, state, sessionFile));
+        }, state, sessionFile, true));
     }
     // Housekeeping: drop registry files for pids that have since died.
     prunePidSessionRegistry(isPidAlive);
     return out;
 }
+/**
+ * Attribute a single tmux pane to the agent actually running in it.
+ *
+ * The launch registry — written per bare-spawn AND per wrap, each stamped with the
+ * `tmuxPane` it targeted (see src/lib/exec.ts) — is the EXACT, per-pane source of
+ * truth. So an agent spawned into an EXISTING pane (a split, where `$TMUX` is
+ * already set so no new session meta is stamped) is attributed to its OWN launch,
+ * not the session's original agent — closing the gap where such an agent was
+ * dropped by this source and left to the weaker ps-scan fallback. Session-meta
+ * labels remain the fallback for the wrapped origin pane of a session whose
+ * registry entry is absent (a failed best-effort write, or a legacy session that
+ * predates the registry's `tmuxPane` field) — and ONLY for that origin pane
+ * (`meta.pane`), so a split shell pane of a labeled session isn't mis-attributed
+ * the wrapped agent. When `meta.pane` is unknown (attach-existing sessions), any
+ * labeled pane is accepted and the caller's per-session dedupe keeps one.
+ * `source: 'teams'` panes are skipped — teammates are surfaced by listTeamsActive.
+ * Pure so it is unit-tested without tmux.
+ */
+export function resolvePaneIdentity(pane, meta, liveEntry, getHookIndex) {
+    if (meta?.source === 'teams')
+        return undefined;
+    if (liveEntry) {
+        // Exact id: the id recorded at launch (Claude), else the agent's own
+        // SessionStart hook joined by launchId/terminalId (non-Claude, or agents we
+        // didn't launch) — kind-guarded against a stale reused-pid file.
+        const sessionId = liveEntry.sessionId
+            ?? resolveHookSessionRecord(getHookIndex(), {
+                pid: liveEntry.pid,
+                kind: liveEntry.agent,
+                launchId: liveEntry.launchId,
+                terminalId: liveEntry.terminalId,
+            })?.session_id;
+        return { agent: liveEntry.agent, sessionId, pid: liveEntry.pid };
+    }
+    const agent = meta?.labels?.agent;
+    const sessionId = meta?.labels?.sessionId;
+    if (agent && sessionId && (meta?.pane == null || meta.pane === pane))
+        return { agent, sessionId };
+    return undefined;
+}
 /**
  * Agents hosted in the shared-socket tmux server — the authoritative source for
- * tmux-wrapped interactive spawns (see src/lib/exec.ts `runInTmux`). Enumerates
- * every pane on the shared socket and keeps those whose session meta was stamped
- * with `labels.agent` + `labels.sessionId` by the spawn-wrap. Because tmux (not a
- * per-window `live-terminals.json`) is the source of truth, a tmux-hosted agent is
- * ALWAYS captured with its exact `%pane` even when the extension registry is stale
- * or absent. `source: 'teams'` is skipped — teammates are surfaced by listTeamsActive.
+ * tmux-hosted interactive spawns (see src/lib/exec.ts `runInTmux`). Enumerates
+ * every pane on the shared socket and attributes each to the agent running in it
+ * via {@link resolvePaneIdentity}: the per-pane launch registry (exact) first, the
+ * session-meta labels as fallback. Because tmux (not a per-window
+ * `live-terminals.json`) is the source of truth, a tmux-hosted agent is captured
+ * with its exact `%pane` even when the extension registry is stale — INCLUDING an
+ * agent bare-spawned into a split of an existing session, which older logic dropped
+ * (it kept only the first pane per session meta). `source: 'teams'` is skipped.
  */
 export async function listTmuxAgentSessions() {
     const { getDefaultSocketPath } = await import('../tmux/paths.js');
@@ -825,6 +1038,21 @@ export async function listTmuxAgentSessions() {
     }
     if (res.code !== 0)
         return [];
+    // Index live launches by the pane they target, so a pane we did NOT wrap (a
+    // split) resolves to its own agent. Newest launch wins a pane (pid reuse), and
+    // only live pids count — a dead agent's stale entry can't light up its old pane.
+    const liveByPane = new Map();
+    for (const e of listPidSessionEntries()) {
+        if (!e.tmuxPane || !isPidAlive(e.pid, e.startedAtMs))
+            continue;
+        const prev = liveByPane.get(e.tmuxPane);
+        if (!prev || e.startedAtMs > prev.startedAtMs)
+            liveByPane.set(e.tmuxPane, e);
+    }
+    // Hook index is scanned lazily — only when a live launch lacks a recorded id
+    // (a non-Claude split) and needs the SessionStart-hook join.
+    let hookIndex;
+    const getHookIndex = () => (hookIndex ??= loadHookSessionIndex());
     const out = [];
     const seen = new Set();
     for (const line of res.stdout.split('\n')) {
@@ -834,22 +1062,31 @@ export async function listTmuxAgentSessions() {
         if (!pane || !sessName)
             continue;
         const meta = readSessionMeta(sessName);
-        const agent = meta?.labels?.agent;
-        const sessionId = meta?.labels?.sessionId;
-        if (!agent || !sessionId)
-            continue; // only our stamped agent sessions
-        if (meta?.source === 'teams')
-            continue; // teammates come from listTeamsActive
-        if (seen.has(sessionId))
-            continue; // first pane per session wins
-        seen.add(sessionId);
-        const pid = parseInt(pidRaw, 10) || undefined;
-        const cwd = meta?.cwd ?? (curPath || undefined);
-        const sessionFile = findSessionFileForKind(agent, cwd, sessionId);
+        const liveEntry = liveByPane.get(pane);
+        const id = resolvePaneIdentity(pane, meta, liveEntry, getHookIndex);
+        if (!id)
+            continue;
+        // Dedupe by resolved session id; an as-yet-unresolved id (a hookless/lagging
+        // split) keys on the unique pane so it still surfaces as its own row.
+        const dedupKey = id.sessionId ?? pane;
+        if (seen.has(dedupKey))
+            continue;
+        seen.add(dedupKey);
+        // Prefer the registry pid (the agent), falling back to the pane leaf pid. A
+        // pid we emit here goes into getActiveSessions' attributed set, so the ps-scan
+        // does NOT also surface this agent as a duplicate headless row.
+        const pid = id.pid ?? (parseInt(pidRaw, 10) || undefined);
+        const cwd = liveEntry?.cwd ?? meta?.cwd ?? (curPath || undefined);
+        const sessionFile = findSessionFileForKind(id.agent, cwd, id.sessionId);
         const topic = sessionFile ? quickExtractTopic(sessionFile) : undefined;
-        const { state, tokPerSec } = computeLiveSignals(agent, sessionFile, cwd, pid ? isPidAlive(pid) : true);
-        // Provenance is known exactly here (the pane IS a tmux pane) — set it so
-        // enrichProvenance skips it and the locator/reply rails resolve off the pane.
+        const pidAlive = pid ? isPidAlive(pid, liveEntry?.startedAtMs) : true;
+        const { state, tokPerSec } = computeLiveSignals(id.agent, sessionFile, cwd, pidAlive);
+        const { birthtimeMs, mtimeMs } = sessionFileTimes(sessionFile);
+        // The mux/reply rails are known exactly here (the pane IS a tmux pane), so we
+        // stamp them off the pane. `transport:'local'` is only a placeholder: the pane
+        // can't reveal how the shell above it was reached. enrichProvenance later reads
+        // the pane process's env and upgrades this to 'ssh' (with the real origin) when
+        // SSH_CONNECTION is present, while preserving this mux/reply.
         const provenance = {
             host: os.hostname(),
             transport: 'local',
@@ -858,16 +1095,20 @@ export async function listTmuxAgentSessions() {
         };
         out.push(applyState({
             context: 'terminal',
-            kind: agent,
+            kind: id.agent,
             host: 'tmux',
             pid,
-            sessionId,
+            sessionId: id.sessionId ?? sessionIdFromFile(sessionFile),
             cwd,
             topic,
             tokPerSec,
             sessionFile,
+            // tmux panes carry no start timestamp; derive both from the transcript
+            // (creation ≈ start, last write ≈ last activity).
+            startedAtMs: birthtimeMs,
+            lastActivityMs: mtimeMs,
             provenance,
-        }, state, sessionFile));
+        }, state, sessionFile, pidAlive));
     }
     return out;
 }
@@ -898,34 +1139,127 @@ export async function getActiveSessions(opts = {}) {
     const unattributed = opts.skipHeadless ? [] : await listUnattributedActive(knownPids);
     const merged = dedupeBySession([...tmuxAgents, ...teams, ...terminals, ...cloud, ...unattributed]);
     await enrichProvenance(merged);
+    await resolveOrigins(merged);
+    foldPresence(merged);
     return merged;
 }
+/**
+ * Fold detach/attach presence onto each row from the detach store. A stored
+ * record wins (`background`/`parked`); otherwise a live terminal session is
+ * `attached`. Ad-hoc headless runs and cloud/team rows stay unmarked — they are
+ * not on the foreground/background axis.
+ */
+function foldPresence(rows) {
+    for (const s of rows) {
+        if (!s.sessionId)
+            continue;
+        const stored = presenceFromStore(s.sessionId);
+        if (stored)
+            s.presence = stored;
+        else if (s.context === 'terminal')
+            s.presence = 'attached';
+    }
+}
 /**
  * Attach provenance (host / local-vs-SSH / tmux pane / reply rail) to every
  * session that has a live pid. Mutates in place. Runs after dedupe so we probe
  * each session once, not once per fork pid. Probes run in parallel — each is a
  * single /proc read (Linux) or `ps` call (macOS); failures leave `provenance`
  * undefined rather than blocking the listing.
+ *
+ * A row that already carries provenance (the tmux path, which knows its exact
+ * mux/reply from the pane) is not skipped — it is probe-and-MERGED. The tmux
+ * path can only stamp a `transport:'local'` placeholder because the pane alone
+ * doesn't reveal how the shell above it was reached; the process env does. So we
+ * still read the env and fill in the real SSH origin/term, while preserving the
+ * authoritative mux/reply the pane already gave us. Skipping this (the old
+ * behavior) is exactly why ssh-launched tmux sessions rendered as local.
  */
 async function enrichProvenance(sessions) {
     await Promise.all(sessions.map(async (s) => {
-        if (s.provenance || !s.pid)
+        if (!s.pid)
             return;
-        s.provenance = await detectProvenance(s.pid);
+        const probed = await detectProvenance(s.pid);
+        if (!probed)
+            return;
+        if (!s.provenance) {
+            s.provenance = probed;
+            return;
+        }
+        // Row already carries exact mux/reply (the tmux path). Fill only what a
+        // pre-set provenance can't know from the pane alone: the real launch origin.
+        if (probed.transport === 'ssh' && !s.provenance.ssh) {
+            s.provenance.transport = 'ssh';
+            s.provenance.ssh = probed.ssh;
+        }
+        if (probed.term && !s.provenance.term)
+            s.provenance.term = probed.term;
     }));
 }
+/**
+ * Match an SSH client IP to a registered device (pure — testable with a plain
+ * registry object). Returns the device name + ssh login user when the IP is a
+ * known device address.
+ */
+export function matchOriginDevice(clientIp, reg) {
+    for (const d of Object.values(reg)) {
+        if (d.address?.ip && d.address.ip === clientIp) {
+            return { device: d.name, ...(d.user ? { user: d.user } : {}) };
+        }
+    }
+    return undefined;
+}
+/**
+ * Resolve the initiating device for every ssh-transport session by matching its
+ * `ssh.clientIp` against the device registry. Read-only and best-effort: a
+ * registry that can't be loaded, or an IP that matches no device, leaves
+ * `origin` undefined (the raw client IP is still on `ssh`). Mutates in place.
+ */
+async function resolveOrigins(sessions) {
+    const needing = sessions.filter((s) => s.provenance?.ssh && !s.provenance.origin);
+    if (needing.length === 0)
+        return;
+    let reg;
+    try {
+        reg = await loadDevices();
+    }
+    catch {
+        return;
+    }
+    for (const s of needing) {
+        const match = matchOriginDevice(s.provenance.ssh.clientIp, reg);
+        if (match)
+            s.provenance.origin = match;
+    }
+}
+/**
+ * Identity for a row the scan could not tie to a session: a daemon's worker
+ * processes (an OpenClaw gateway spawning `codex`, a supervisor pool) have no
+ * session id, no transcript file, and no cloud/run handle — nothing tells two of
+ * them apart, because nothing distinguishes them. Same binary + same working
+ * directory + same context IS the identity, so N indistinguishable workers
+ * collapse to one row carrying `pidCount: N`.
+ *
+ * Returns undefined with no cwd: without it there is no stable identity, and
+ * keying on kind alone would fold unrelated agents onto one row.
+ */
+function anonymousWorkerKey(s) {
+    if (!s.cwd)
+        return undefined;
+    return `anon\0${s.kind}\0${s.context}\0${s.cwd}`;
+}
 /**
  * Collapse rows that resolve to the *same* session — a session with many
  * subagent/fork PIDs (all matched to one transcript file) would otherwise print
- * dozens of identical rows. Keyed by session id (falling back to the file), the
- * first row wins and carries a `pidCount`. Rows with no session identity (cloud,
- * unresolved headless) pass through untouched.
+ * dozens of identical rows. Keyed by session id, falling back to the transcript
+ * file, then the cloud/run handle, then {@link anonymousWorkerKey}. The first row
+ * wins and carries a `pidCount`.
  */
-function dedupeBySession(sessions) {
+export function dedupeBySession(sessions) {
     const out = [];
     const byKey = new Map();
     for (const s of sessions) {
-        const key = s.sessionId || s.sessionFile;
+        const key = s.sessionId || s.sessionFile || s.cloudTaskId || s.agentId || anonymousWorkerKey(s);
         if (!key) {
             out.push(s);
             continue;