@phnx-labs/agents-cli 1.20.76 → 1.20.78

package/dist/lib/secrets/unlock-hints.js

@@ -0,0 +1,36 @@
+// Usage-based unlock hints: surface bundles you keep getting a Touch ID prompt
+// for, so `agents secrets status` can suggest unlocking them once instead of
+// prompting on every read. Built on the existing `secrets.get` audit events
+// (events.jsonl) — no new tracking. Pure + exported so the threshold/filter
+// logic is unit-testable without the events sink or the keychain.
+/**
+ * From recent `secrets.get` records, find bundles read often enough via the
+ * keychain (i.e. NOT served silently by the broker or a durable session) to be
+ * worth unlocking once. A bundle currently `held` is already silent, so it is
+ * excluded; the caller further drops `never`/no-ACL bundles (which never prompt,
+ * so unlocking them is a no-op).
+ *
+ * @param records recent `secrets.get` events (any order)
+ * @param held    bundle names the broker currently holds (silent reads)
+ * @param opts.minReads minimum prompting reads to surface a bundle (default 3)
+ */
+export function frequentlyPromptedBundles(records, held, opts = {}) {
+    const minReads = opts.minReads ?? 3;
+    const counts = new Map();
+    for (const r of records) {
+        if (!r.bundle)
+            continue;
+        // A broker hit or a durable-session read raised no Touch ID sheet — only a
+        // read that fell through to the keychain did. Count those; they are the ones
+        // an unlock would silence.
+        if (r.source === 'agent' || r.source === 'session')
+            continue;
+        if (held.has(r.bundle))
+            continue;
+        counts.set(r.bundle, (counts.get(r.bundle) ?? 0) + 1);
+    }
+    return [...counts.entries()]
+        .filter(([, n]) => n >= minReads)
+        .map(([name, count]) => ({ name, count }))
+        .sort((a, b) => b.count - a.count || a.name.localeCompare(b.name));
+}

package/dist/lib/session/active.d.ts

@@ -4,6 +4,7 @@ import { type HookSessionIndex } from './hook-sessions.js';
 import { type SessionActivity, type AwaitingReason, type StructuredQuestion, type TodoProgress, type DetectedPr, type DetectedWorktree, type DetectedTicket } from './state.js';
 import type { SessionAttachment } from './types.js';
 import { type SessionProvenance } from './provenance.js';
+import { type DeviceRegistry } from '../devices/registry.js';
 import { type Presence } from './detached.js';
 /**
  * Per-PID `lsof` probes run bounded and staggered rather than as one parallel
@@ -188,6 +189,13 @@ export declare function agentKindFromComm(commRaw: string): string | undefined;
  * the start time can't be read, we keep the existence answer.
  */
 export declare function isPidAlive(pid: number, startedAtMs?: number): boolean;
+/**
+ * Resolve a Claude transcript for `cwd` across the given project roots, newest
+ * mtime winning when the same id/cwd resolves in more than one version home
+ * (the actively-written copy is the newest). Pure over `projectRoots`, so it is
+ * testable against temp dirs without touching the real home directory.
+ */
+export declare function pickClaudeSessionFileAcrossRoots(projectRoots: string[], cwd: string, sessionId?: string): string | undefined;
 /**
  * Pick a Claude transcript file within a project dir.
  *
@@ -353,6 +361,15 @@ export declare function listTmuxAgentSessions(): Promise<ActiveSession[]>;
  * terminal/headless row for the same session id.
  */
 export declare function getActiveSessions(opts?: ActiveQueryOptions): Promise<ActiveSession[]>;
+/**
+ * Match an SSH client IP to a registered device (pure — testable with a plain
+ * registry object). Returns the device name + ssh login user when the IP is a
+ * known device address.
+ */
+export declare function matchOriginDevice(clientIp: string, reg: DeviceRegistry): {
+    device: string;
+    user?: string;
+} | undefined;
 /**
  * Collapse rows that resolve to the *same* session — a session with many
  * subagent/fork PIDs (all matched to one transcript file) would otherwise print

package/dist/lib/session/active.js

@@ -26,7 +26,7 @@ import { AgentManager } from '../teams/agents.js';
 import { getTerminalsDir } from '../state.js';
 import { readPidSessionEntry, listPidSessionEntries, prunePidSessionRegistry } from './pid-registry.js';
 import { loadHookSessionIndex, resolveHookSessionRecord } from './hook-sessions.js';
-import { buildClaudeLabelMap } from './discover.js';
+import { buildClaudeLabelMap, getAgentSessionDirs } from './discover.js';
 import { buildRunNameMap } from './run-names.js';
 import { latestSessionFileForCwd } from './db.js';
 import { extractSessionTopic } from './prompt.js';
@@ -34,6 +34,7 @@ import { readSessionTailWithRaw } from './tail.js';
 import { computeTokPerSec } from './throughput.js';
 import { inferSessionState } from './state.js';
 import { detectProvenance } from './provenance.js';
+import { loadDevices } from '../devices/registry.js';
 import { presenceFromStore } from './detached.js';
 import { mapBounded } from '../concurrency.js';
 const execFileAsync = promisify(execFile);
@@ -66,7 +67,6 @@ export function activeStatusFromCloudStatus(status) {
             return 'queued';
     }
 }
-const HOME = os.homedir();
 const LIVE_TERMINALS_FILE = path.join(getTerminalsDir(), 'live-terminals.json');
 /**
  * A process is classified `running` if its session file was touched in the
@@ -216,9 +216,45 @@ function claudeProjectDirName(cwd) {
  * Locate the active Claude session file for a process. If we know the session
  * UUID (from terminal env or team parent), prefer the exact match. Otherwise
  * fall back to the most-recent-mtime .jsonl in the project's folder.
+ *
+ * Searches EVERY version-home project root, not just the live `~/.claude`
+ * symlink. `~/.claude` points at the currently-installed agent version; a
+ * session launched under an EARLIER version keeps its transcript under that
+ * version's home (`…/.history/versions/claude/<ver>/home/.claude/projects/`).
+ * Resolving only `~/.claude/projects` meant that the instant a newer version
+ * was installed, every still-running older-version session lost its transcript
+ * here — no `sessionFile`, so no start/activity time, so `agents sessions`
+ * rendered it `unknown` and the watchdog skipped it as "no activity timestamp".
+ * `getAgentSessionDirs('claude','projects')` is the same version-aware enumerator
+ * the rest of the CLI uses, so this stays in lockstep with discovery.
  */
 function findClaudeSessionFile(cwd, sessionId) {
-    return pickSessionFile(path.join(HOME, '.claude', 'projects', claudeProjectDirName(cwd)), sessionId);
+    return pickClaudeSessionFileAcrossRoots(getAgentSessionDirs('claude', 'projects'), cwd, sessionId);
+}
+/**
+ * Resolve a Claude transcript for `cwd` across the given project roots, newest
+ * mtime winning when the same id/cwd resolves in more than one version home
+ * (the actively-written copy is the newest). Pure over `projectRoots`, so it is
+ * testable against temp dirs without touching the real home directory.
+ */
+export function pickClaudeSessionFileAcrossRoots(projectRoots, cwd, sessionId) {
+    const enc = claudeProjectDirName(cwd);
+    let best;
+    for (const root of projectRoots) {
+        const hit = pickSessionFile(path.join(root, enc), sessionId);
+        if (!hit)
+            continue;
+        let mtime;
+        try {
+            mtime = fs.statSync(hit).mtimeMs;
+        }
+        catch {
+            continue;
+        }
+        if (!best || mtime > best.mtime)
+            best = { path: hit, mtime };
+    }
+    return best?.path;
 }
 /**
  * Pick a Claude transcript file within a project dir.
@@ -1081,8 +1117,11 @@ export async function listTmuxAgentSessions() {
         const pidAlive = pid ? isPidAlive(pid, liveEntry?.startedAtMs) : true;
         const { state, tokPerSec } = computeLiveSignals(id.agent, sessionFile, cwd, pidAlive);
         const { birthtimeMs, mtimeMs } = sessionFileTimes(sessionFile);
-        // Provenance is known exactly here (the pane IS a tmux pane) — set it so
-        // enrichProvenance skips it and the locator/reply rails resolve off the pane.
+        // The mux/reply rails are known exactly here (the pane IS a tmux pane), so we
+        // stamp them off the pane. `transport:'local'` is only a placeholder: the pane
+        // can't reveal how the shell above it was reached. enrichProvenance later reads
+        // the pane process's env and upgrades this to 'ssh' (with the real origin) when
+        // SSH_CONNECTION is present, while preserving this mux/reply.
         const provenance = {
             host: os.hostname(),
             transport: 'local',
@@ -1135,6 +1174,7 @@ export async function getActiveSessions(opts = {}) {
     const unattributed = opts.skipHeadless ? [] : await listUnattributedActive(knownPids);
     const merged = dedupeBySession([...tmuxAgents, ...teams, ...terminals, ...cloud, ...unattributed]);
     await enrichProvenance(merged);
+    await resolveOrigins(merged);
     foldPresence(merged);
     return merged;
 }
@@ -1161,14 +1201,72 @@ function foldPresence(rows) {
  * each session once, not once per fork pid. Probes run in parallel — each is a
  * single /proc read (Linux) or `ps` call (macOS); failures leave `provenance`
  * undefined rather than blocking the listing.
+ *
+ * A row that already carries provenance (the tmux path, which knows its exact
+ * mux/reply from the pane) is not skipped — it is probe-and-MERGED. The tmux
+ * path can only stamp a `transport:'local'` placeholder because the pane alone
+ * doesn't reveal how the shell above it was reached; the process env does. So we
+ * still read the env and fill in the real SSH origin/term, while preserving the
+ * authoritative mux/reply the pane already gave us. Skipping this (the old
+ * behavior) is exactly why ssh-launched tmux sessions rendered as local.
  */
 async function enrichProvenance(sessions) {
     await Promise.all(sessions.map(async (s) => {
-        if (s.provenance || !s.pid)
+        if (!s.pid)
             return;
-        s.provenance = await detectProvenance(s.pid);
+        const probed = await detectProvenance(s.pid);
+        if (!probed)
+            return;
+        if (!s.provenance) {
+            s.provenance = probed;
+            return;
+        }
+        // Row already carries exact mux/reply (the tmux path). Fill only what a
+        // pre-set provenance can't know from the pane alone: the real launch origin.
+        if (probed.transport === 'ssh' && !s.provenance.ssh) {
+            s.provenance.transport = 'ssh';
+            s.provenance.ssh = probed.ssh;
+        }
+        if (probed.term && !s.provenance.term)
+            s.provenance.term = probed.term;
     }));
 }
+/**
+ * Match an SSH client IP to a registered device (pure — testable with a plain
+ * registry object). Returns the device name + ssh login user when the IP is a
+ * known device address.
+ */
+export function matchOriginDevice(clientIp, reg) {
+    for (const d of Object.values(reg)) {
+        if (d.address?.ip && d.address.ip === clientIp) {
+            return { device: d.name, ...(d.user ? { user: d.user } : {}) };
+        }
+    }
+    return undefined;
+}
+/**
+ * Resolve the initiating device for every ssh-transport session by matching its
+ * `ssh.clientIp` against the device registry. Read-only and best-effort: a
+ * registry that can't be loaded, or an IP that matches no device, leaves
+ * `origin` undefined (the raw client IP is still on `ssh`). Mutates in place.
+ */
+async function resolveOrigins(sessions) {
+    const needing = sessions.filter((s) => s.provenance?.ssh && !s.provenance.origin);
+    if (needing.length === 0)
+        return;
+    let reg;
+    try {
+        reg = await loadDevices();
+    }
+    catch {
+        return;
+    }
+    for (const s of needing) {
+        const match = matchOriginDevice(s.provenance.ssh.clientIp, reg);
+        if (match)
+            s.provenance.origin = match;
+    }
+}
 /**
  * Identity for a row the scan could not tie to a session: a daemon's worker
  * processes (an OpenClaw gateway spawning `codex`, a supervisor pool) have no

package/dist/lib/session/db.d.ts

@@ -40,6 +40,11 @@ export interface SessionRow {
     worktree_slug: string | null;
     ticket_id: string | null;
     plan: string | null;
+    machine: string | null;
+    todos: string | null;
+    recent_directories_touched: string | null;
+    linear_project: string | null;
+    linear_project_url: string | null;
 }
 /** File stat snapshot used to detect changes between scan runs. */
 export interface ScanStamp {
@@ -215,6 +220,8 @@ export declare function isSessionActivityFresh(row: {
     timestamp: string;
     file_mtime_ms: number | null;
 }, maxAgeMs: number, nowMs: number): boolean;
+/** Persist a lazily resolved Linear project without reparsing the transcript. */
+export declare function cacheLinearProject(sessionId: string, project: string, projectUrl: string): void;
 /**
  * Newest indexed session file for an agent working in `cwd`. Lets the live
  * `--active` scanner locate a Codex transcript (whose files are date-partitioned,
@@ -242,6 +249,42 @@ export interface UsageRollupRow {
 }
 /** What to group a usage rollup by. */
 export type UsageRollupGroup = 'agent' | 'project' | 'day';
+/**
+ * Smart-launch affinity priors: group sessions by origin machine, harness, or
+ * joint (machine + agent). Ordered by launch count desc.
+ *
+ * SQL shape (device example):
+ *   SELECT machine, COUNT(*) launches, SUM(duration_ms), SUM(token_count)
+ *   FROM sessions
+ *   WHERE timestamp >= ? AND origin = 'cli' AND is_team_origin = 0
+ *   GROUP BY machine ORDER BY launches DESC
+ *
+ * Account rotation is NOT done here — that stays on live rate-limit windows
+ * via `--strategy balanced` / rotate.ts.
+ */
+export type AffinityGroup = 'machine' | 'agent' | 'machine_agent';
+export interface AffinityRow {
+    /** Group key: machine name, agent id, or "machine\\tagent". */
+    key: string;
+    machine?: string;
+    agent?: string;
+    launches: number;
+    durationMs: number;
+    tokenCount: number;
+    costUsd: number;
+}
+export declare function queryAffinityRollup(options: {
+    groupBy: AffinityGroup;
+    /** ISO cutoff or ms; defaults to 14 days ago when omitted. */
+    sinceMs?: number;
+    /** Restrict to these harnesses (e.g. claude/codex/kimi). */
+    agents?: SessionAgentId[];
+    /** Default true: only origin=cli rows. */
+    onlyCli?: boolean;
+    /** Default true: drop team-spawned sessions. */
+    excludeTeamOrigin?: boolean;
+    project?: string;
+}): AffinityRow[];
 /**
  * Aggregate cost / duration / tokens across sessions, grouped by agent,
  * project, or calendar day. Honors the same filter shape as querySessions

package/dist/lib/session/db.js

@@ -9,11 +9,14 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import Database from '../sqlite.js';
+import { parseSession } from './parse.js';
+import { extractRecentDirectoriesTouched, extractTodoProgressFromEvents } from './state.js';
 import { getSessionsDir, getSessionsDbPath } from '../state.js';
+import { machineForSessionFile } from './origin-machine.js';
 const SESSIONS_DIR = getSessionsDir();
 const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. */
-const SCHEMA_VERSION = 16;
+const SCHEMA_VERSION = 18;
 /**
  * Canonicalize a file path for use as a scan_ledger key. The same physical
  * session file is reachable via multiple aliases — `~/.claude/projects/x.jsonl`
@@ -69,13 +72,20 @@ CREATE TABLE IF NOT EXISTS sessions (
   pr_number INTEGER,
   worktree_slug TEXT,
   ticket_id TEXT,
-  plan TEXT
+  plan TEXT,
+  machine TEXT,
+  todos TEXT,
+  recent_directories_touched TEXT,
+  linear_project TEXT,
+  linear_project_url TEXT
 );
 CREATE INDEX IF NOT EXISTS idx_sessions_timestamp ON sessions(timestamp DESC);
 CREATE INDEX IF NOT EXISTS idx_sessions_cwd ON sessions(cwd);
 CREATE INDEX IF NOT EXISTS idx_sessions_agent ON sessions(agent);
 CREATE INDEX IF NOT EXISTS idx_sessions_file_path ON sessions(file_path);
 CREATE INDEX IF NOT EXISTS idx_sessions_short_id ON sessions(short_id);
+-- idx_sessions_machine_ts / idx_sessions_agent_ts are created after migration
+-- v17 guarantees the machine column exists (same pattern as last_activity).
 
 CREATE VIRTUAL TABLE IF NOT EXISTS session_text USING fts5(
   session_id UNINDEXED,
@@ -316,6 +326,40 @@ function migrateSchema(db, fromVersion) {
         // primary key — so every corrupt row becomes addressable. No rescan needed.
         db.exec(`UPDATE sessions SET short_id = substr(id, 1, 8) WHERE short_id IS NULL OR short_id = ''`);
     }
+    if (fromVersion < 17) {
+        // v16 → v17 (main): todos / recent dirs / linear project metadata.
+        const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
+        if (!cols.some(c => c.name === 'todos'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN todos TEXT`);
+        if (!cols.some(c => c.name === 'recent_directories_touched'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN recent_directories_touched TEXT`);
+        if (!cols.some(c => c.name === 'linear_project'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN linear_project TEXT`);
+        if (!cols.some(c => c.name === 'linear_project_url'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN linear_project_url TEXT`);
+        db.exec(`DELETE FROM scan_ledger; DELETE FROM dir_ledger;`);
+    }
+    if (fromVersion < 18) {
+        // v17 → v18: persist origin machine for smart-launch affinity GROUP BY machine.
+        const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
+        if (!cols.some(c => c.name === 'machine')) {
+            db.exec(`ALTER TABLE sessions ADD COLUMN machine TEXT`);
+        }
+        db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_sessions_machine_ts ON sessions(machine, timestamp DESC);
+      CREATE INDEX IF NOT EXISTS idx_sessions_agent_ts ON sessions(agent, timestamp DESC);
+    `);
+        const rows = db
+            .prepare(`SELECT id, agent, file_path FROM sessions WHERE machine IS NULL OR machine = ''`)
+            .all();
+        const upd = db.prepare(`UPDATE sessions SET machine = ? WHERE id = ?`);
+        const txn = db.transaction((items) => {
+            for (const r of items) {
+                upd.run(machineForSessionFile(r.file_path, r.agent), r.id);
+            }
+        });
+        txn(rows);
+    }
 }
 /** Open (or return the cached) sessions database, applying migrations as needed. */
 export function getDB() {
@@ -349,6 +393,27 @@ export function getDB() {
     db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_last_activity ON sessions(last_activity DESC)`);
     db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_origin ON sessions(origin)`);
     db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_routine_run_id ON sessions(routine_run_id)`);
+    // machine column + indexes: only after the column is guaranteed present.
+    // Fresh SCHEMA (v17) includes the column; older DBs get it from migrate v17.
+    // If a partial upgrade left schema_version ahead of the column, repair here.
+    {
+        const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
+        if (!cols.some((c) => c.name === 'machine')) {
+            db.exec(`ALTER TABLE sessions ADD COLUMN machine TEXT`);
+            const rows = db
+                .prepare(`SELECT id, agent, file_path FROM sessions WHERE machine IS NULL OR machine = ''`)
+                .all();
+            const upd = db.prepare(`UPDATE sessions SET machine = ? WHERE id = ?`);
+            const txn = db.transaction((items) => {
+                for (const r of items) {
+                    upd.run(machineForSessionFile(r.file_path, r.agent), r.id);
+                }
+            });
+            txn(rows);
+        }
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_machine_ts ON sessions(machine, timestamp DESC)`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_agent_ts ON sessions(agent, timestamp DESC)`);
+    }
     // One-shot cleanup of the pre-SQLite JSONL indexes. Safe — nothing reads
     // them anymore. Guarded by a meta flag so we only try once.
     const cleaned = db.prepare(`SELECT value FROM meta WHERE key = 'legacy_indexes_removed'`).get();
@@ -656,14 +721,16 @@ const upsertSessionStmt = (db) => db.prepare(`
     project, cwd, git_branch, topic, label, message_count, token_count,
     output_tokens, cost_usd, duration_ms,
     file_path, file_mtime_ms, file_size, scanned_at, is_team_origin,
-    pr_url, pr_number, worktree_slug, ticket_id, plan
+    pr_url, pr_number, worktree_slug, ticket_id, plan, todos,
+    recent_directories_touched, linear_project, linear_project_url, machine
   ) VALUES (
     @id, @short_id, @agent, @origin, @routine_name, @routine_run_id,
     @version, @account, @timestamp, @last_activity,
     @project, @cwd, @git_branch, @topic, @label, @message_count, @token_count,
     @output_tokens, @cost_usd, @duration_ms,
     @file_path, @file_mtime_ms, @file_size, @scanned_at, @is_team_origin,
-    @pr_url, @pr_number, @worktree_slug, @ticket_id, @plan
+    @pr_url, @pr_number, @worktree_slug, @ticket_id, @plan, @todos,
+    @recent_directories_touched, @linear_project, @linear_project_url, @machine
   )
   ON CONFLICT(id) DO UPDATE SET
     short_id = excluded.short_id,
@@ -702,8 +769,35 @@ const upsertSessionStmt = (db) => db.prepare(`
     pr_number = excluded.pr_number,
     worktree_slug = excluded.worktree_slug,
     ticket_id = excluded.ticket_id,
-    plan = excluded.plan
+    plan = excluded.plan,
+    todos = excluded.todos,
+    recent_directories_touched = excluded.recent_directories_touched,
+    linear_project = CASE
+      WHEN excluded.ticket_id IS NOT sessions.ticket_id THEN excluded.linear_project
+      ELSE COALESCE(excluded.linear_project, sessions.linear_project)
+    END,
+    linear_project_url = CASE
+      WHEN excluded.ticket_id IS NOT sessions.ticket_id THEN excluded.linear_project_url
+      ELSE COALESCE(excluded.linear_project_url, sessions.linear_project_url)
+    END,
+    machine = excluded.machine
 `);
+function enrichCachedSessionMeta(meta) {
+    if (!meta.filePath)
+        return meta;
+    try {
+        const events = parseSession(meta.filePath, meta.agent);
+        return {
+            ...meta,
+            todos: extractTodoProgressFromEvents(events),
+            recentDirectoriesTouched: extractRecentDirectoriesTouched(events, meta.cwd),
+        };
+    }
+    catch {
+        // Synthetic/cloud rows can intentionally name a transcript that is not local.
+        return meta;
+    }
+}
 const deleteTextStmt = (db) => db.prepare(`DELETE FROM session_text WHERE session_id = ?`);
 const insertTextStmt = (db) => db.prepare(`INSERT INTO session_text (session_id, label, topic, project, content) VALUES (?, ?, ?, ?, ?)`);
 // Read back the label the upsert actually stored (which may be the preserved
@@ -732,11 +826,18 @@ function storedFtsLabel(readLabel, id) {
     const row = readLabel.get(id);
     return row?.label ?? '';
 }
+/** Resolve origin machine for a row: prefer caller-stamped meta, else path. */
+function resolveMachine(meta) {
+    if (meta.machine && meta.machine.trim())
+        return meta.machine.trim();
+    return machineForSessionFile(meta.filePath, meta.agent);
+}
 /**
  * Upsert a session row and replace its FTS5 content in a single transaction.
  * `content` is the tokenizable user-prompt text; pass '' to leave the row unsearchable.
  */
 export function upsertSession(meta, content, scan) {
+    meta = enrichCachedSessionMeta(meta);
     const db = getDB();
     const { upsert, delText, insText, readLabel } = stmts(db);
     const row = {
@@ -770,6 +871,11 @@ export function upsertSession(meta, content, scan) {
         worktree_slug: meta.worktreeSlug ?? null,
         ticket_id: meta.ticketId ?? null,
         plan: meta.plan ?? null,
+        todos: meta.todos ? JSON.stringify(meta.todos) : null,
+        recent_directories_touched: meta.recentDirectoriesTouched ? JSON.stringify(meta.recentDirectoriesTouched) : null,
+        linear_project: meta.linearProject ?? null,
+        linear_project_url: meta.linearProjectUrl ?? null,
+        machine: resolveMachine(meta),
     };
     const txn = db.transaction(() => {
         upsert.run(row);
@@ -812,6 +918,9 @@ export function upsertSessionsBatch(entries) {
     const byPath = new Map(entries
         .filter(e => e.scan && e.meta.filePath)
         .map(e => [canonicalLedgerKey(e.meta.filePath), e]));
+    const enrichedEntries = entries.map(entry => entry.meta.agent === 'claude' || entry.meta.agent === 'codex'
+        ? entry
+        : { ...entry, meta: enrichCachedSessionMeta(entry.meta) });
     const txn = db.transaction((items) => {
         // Re-read the ledger now that we hold the write lock. Any file committed
         // by a concurrent process since our pre-scan is visible here.
@@ -873,6 +982,11 @@ export function upsertSessionsBatch(entries) {
                     worktree_slug: meta.worktreeSlug ?? null,
                     ticket_id: meta.ticketId ?? null,
                     plan: meta.plan ?? null,
+                    todos: meta.todos ? JSON.stringify(meta.todos) : null,
+                    recent_directories_touched: meta.recentDirectoriesTouched ? JSON.stringify(meta.recentDirectoriesTouched) : null,
+                    linear_project: meta.linearProject ?? null,
+                    linear_project_url: meta.linearProjectUrl ?? null,
+                    machine: resolveMachine(meta),
                 });
                 delText.run(meta.id);
                 insText.run(meta.id, 
@@ -890,7 +1004,7 @@ export function upsertSessionsBatch(entries) {
             }
         }
     });
-    txn(entries);
+    txn(enrichedEntries);
 }
 /**
  * Sync labels for a set of sessions. For each id in the map, if the stored
@@ -1053,8 +1167,23 @@ function rowToMeta(row) {
         worktreeSlug: row.worktree_slug ?? undefined,
         ticketId: row.ticket_id ?? undefined,
         plan: row.plan ?? undefined,
+        todos: parseJsonColumn(row.todos),
+        recentDirectoriesTouched: parseJsonColumn(row.recent_directories_touched),
+        linearProject: row.linear_project ?? undefined,
+        linearProjectUrl: row.linear_project_url ?? undefined,
+        machine: row.machine ?? undefined,
     };
 }
+function parseJsonColumn(value) {
+    if (!value)
+        return undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * The recency signal used to sort and label the listing: last-message time when
  * a parser computed it (`meta.lastActivity` from `lastTsMs`), else the file's
@@ -1075,6 +1204,11 @@ export function isSessionActivityFresh(row, maxAgeMs, nowMs) {
     const activityMs = Number.isFinite(parsedActivityMs) ? parsedActivityMs : row.file_mtime_ms ?? undefined;
     return activityMs != null && nowMs - activityMs <= maxAgeMs;
 }
+/** Persist a lazily resolved Linear project without reparsing the transcript. */
+export function cacheLinearProject(sessionId, project, projectUrl) {
+    getDB().prepare(`UPDATE sessions SET linear_project = ?, linear_project_url = ? WHERE id = ?`)
+        .run(project, projectUrl, sessionId);
+}
 /**
  * Newest indexed session file for an agent working in `cwd`. Lets the live
  * `--active` scanner locate a Codex transcript (whose files are date-partitioned,
@@ -1210,6 +1344,57 @@ export function countSessions(options = {}) {
     const row = db.prepare(sql).get(...params);
     return row ? row.n : 0;
 }
+export function queryAffinityRollup(options) {
+    const db = getDB();
+    const where = [];
+    const params = [];
+    const sinceMs = options.sinceMs ?? (Date.now() - 14 * 24 * 60 * 60 * 1000);
+    // ISO timestamps sort lexicographically; compare as string prefix of datetime.
+    where.push(`timestamp >= ?`);
+    params.push(new Date(sinceMs).toISOString());
+    if (options.onlyCli !== false) {
+        where.push(`IFNULL(origin, 'cli') = 'cli'`);
+    }
+    if (options.excludeTeamOrigin !== false) {
+        where.push(`IFNULL(is_team_origin, 0) = 0`);
+    }
+    if (options.agents && options.agents.length > 0) {
+        where.push(`agent IN (${options.agents.map(() => '?').join(',')})`);
+        params.push(...options.agents);
+    }
+    if (options.project) {
+        where.push(`LOWER(IFNULL(project, '')) LIKE ?`);
+        params.push(`%${options.project.toLowerCase()}%`);
+    }
+    let keyExpr;
+    let selectExtra;
+    if (options.groupBy === 'machine') {
+        keyExpr = `IFNULL(NULLIF(machine, ''), '(unknown)')`;
+        selectExtra = `${keyExpr} AS key, ${keyExpr} AS machine, NULL AS agent`;
+    }
+    else if (options.groupBy === 'agent') {
+        keyExpr = `agent`;
+        selectExtra = `agent AS key, NULL AS machine, agent AS agent`;
+    }
+    else {
+        keyExpr = `IFNULL(NULLIF(machine, ''), '(unknown)') || char(9) || agent`;
+        selectExtra = `${keyExpr} AS key, IFNULL(NULLIF(machine, ''), '(unknown)') AS machine, agent AS agent`;
+    }
+    const clause = where.length ? `WHERE ${where.join(' AND ')}` : '';
+    const sql = `
+    SELECT
+      ${selectExtra},
+      COUNT(*) AS launches,
+      IFNULL(SUM(duration_ms), 0) AS durationMs,
+      IFNULL(SUM(token_count), 0) AS tokenCount,
+      IFNULL(SUM(cost_usd), 0) AS costUsd
+    FROM sessions
+    ${clause}
+    GROUP BY key
+    ORDER BY launches DESC, key ASC
+  `;
+    return db.prepare(sql).all(...params);
+}
 /**
  * Aggregate cost / duration / tokens across sessions, grouped by agent,
  * project, or calendar day. Honors the same filter shape as querySessions