@phnx-labs/agents-cli 1.20.76 → 1.20.78

package/dist/commands/secrets.js

@@ -18,16 +18,18 @@ import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon.js';
 import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveHostSshTarget, } from '../lib/secrets/remote.js';
 import { remoteShellFor, buildWindowsStdinImportCommand } from '../lib/hosts/remote-cmd.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
-import { bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, readBundleIfDecryptable, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, } from '../lib/secrets/bundles.js';
+import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, readBundleIfDecryptable, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, } from '../lib/secrets/bundles.js';
 import { encryptForFallback, decryptForFallback } from '../lib/secrets/filestore.js';
 import { getKeychainToken, getKeychainTokens, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from '../lib/secrets/index.js';
 import { assertOpAvailable, createPasswordItem, deleteItemByTitle, extractSecrets, itemExistsByTitle, listItems, listVaults, } from '../lib/onepassword.js';
+import { GLOBAL_HARNESS } from '../lib/secrets/scope.js';
 import { secretsHoldMs, secretsAgentDurable, agentLoad, agentLock, agentPing, agentStatus, ensureAgentRunning, runAgentLoadFromStdin, runSecretsAgent, uninstallSecretsAgentService, } from '../lib/secrets/agent.js';
-import { saveSession, deleteSession, deleteAllSessions } from '../lib/secrets/session-store.js';
+import { saveSession, deleteBundleSessions, deleteAllSessions } from '../lib/secrets/session-store.js';
 import { getCliVersionFresh } from '../lib/version.js';
 import { readMeta } from '../lib/state.js';
 import { parseDuration } from '../lib/hooks/cache.js';
-import { emit } from '../lib/events.js';
+import { emit, query } from '../lib/events.js';
+import { frequentlyPromptedBundles } from '../lib/secrets/unlock-hints.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { discoverSyncedBundles, importSyncedBundle, } from '../lib/secrets/icloud-import.js';
@@ -1096,8 +1098,9 @@ export function registerSecretsCommands(program) {
                 process.exit(1);
             }
             // `secrets get` is the scriptable automation primitive ($(agents secrets
-            // get bundle KEY)); when embedded in a headless routine/CI script it must
-            // not pop an unwatched Touch ID prompt. Interactive use still prompts.
+            // get bundle KEY)); when embedded in a headless routine/CI script — or run
+            // beneath any agent, which inherits AGENTS_RUNTIME — it must not pop an
+            // unwatched Touch ID prompt. Typed in a plain shell it still prompts.
             const { env } = readAndResolveBundleEnv(item, { caller: 'secrets get', keys: [key], keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
             if (!(key in env)) {
                 console.error(chalk.red(`Key '${key}' not in bundle '${item}'.`));
@@ -1816,10 +1819,10 @@ Examples:
                 process.exit(1);
             }
             // `agents secrets export --plaintext` is what release/CI scripts eval.
-            // When it runs detached (both stdio non-TTY) or under a headless agent,
-            // resolve broker-only so it can never pop a Touch ID sheet on the
-            // interactive user's screen. An interactive `eval "$(...)"` keeps its
-            // terminal stdin, so it is not headless and still prompts.
+            // When it runs detached (both stdio non-TTY) or beneath ANY agent — which
+            // inherits AGENTS_RUNTIME — resolve broker-only so it can never pop a Touch
+            // ID sheet on the interactive user's screen. An `eval "$(...)"` typed in a
+            // plain shell carries no AGENTS_RUNTIME, so it is not headless and still prompts.
             const { env } = readAndResolveBundleEnv(resolvedBundleName, {
                 caller: `export to shell`,
                 keyMode: 'process',
@@ -2055,6 +2058,7 @@ Examples:
         .description('Hold a bundle in the secrets-agent after one Touch ID, so concurrent runs read it without re-prompting (macOS). With --host, unlock FILE-backed bundle(s) on a remote (the passphrase prompt surfaces over the SSH TTY); keychain/biometry bundles are GUI-only and can\'t be remote-unlocked.')
         .option('--ttl <duration>', 'How long to hold it (e.g. 30m, 8h, 3d). Default 7d.')
         .option('--durable', 'Keep the unlock across sleep + reboot too (default: survives upgrade/restart but re-locks on sleep). Set secrets.agent.durable in agents.yaml to make this the default.')
+        .option('--for <agent>', 'Narrow the unlock to ONE harness type (for example claude, codex, or kimi). Default: the grant is global — every harness and a plain shell can read it, so one Touch ID covers them all.')
         .option('--all', 'Unlock every configured bundle')
         .option('--host <target>', 'Unlock the bundle(s) on this remote machine over SSH instead of locally (file-backed bundles only — the remote\'s passphrase prompt surfaces on your terminal over a -tt session). Single-valued (NOT variadic) so it never swallows the bundle name: `unlock <name> --host <machine>`.')
         .action(async (names, opts) => {
@@ -2127,12 +2131,24 @@ Examples:
         // (single-instance start lock, #414) and best-effort — never blocks unlock.
         ensureDaemonStarted();
         let loaded = 0;
+        // An unlock is a deliberate act, so it grants GLOBALLY unless `--for`
+        // narrows it to one harness. It must NOT inherit the ambient
+        // AGENTS_AGENT_NAME: that silently scoped a terminal unlock to whichever
+        // agent happened to launch the shell, leaving the grant unreadable to
+        // every other reader for its whole TTL.
+        const harness = opts.for || GLOBAL_HARNESS;
         for (const name of targets) {
             try {
                 // noAgent: read the real keychain (one Touch ID) rather than the
                 // agent we're about to populate.
-                const { bundle, env } = readAndResolveBundleEnv(name, { noAgent: true, caller: 'unlock', keyMode: 'storage' });
-                if (await agentLoad(name, bundle, env, ttlMs)) {
+                const { bundle, env } = readAndResolveBundleEnv(name, {
+                    noAgent: true,
+                    caller: 'unlock secrets',
+                    agent: harness,
+                    duration: humanRemaining(Date.now() + ttlMs),
+                    keyMode: 'storage',
+                });
+                if (await agentLoad(name, bundle, env, ttlMs, harness)) {
                     loaded++;
                     // Persist a durable session snapshot so the unlock survives a daemon
                     // restart / upgrade (and sleep too, with --durable). session-store.ts.
@@ -2141,6 +2157,7 @@ Examples:
                         env,
                         expiresAt: Date.now() + ttlMs,
                         sleepPersist: opts.durable ?? secretsAgentDurable(),
+                        harness,
                     });
                     console.log(`${chalk.green('unlocked')} ${chalk.cyan(name)} ${chalk.gray(`(${Object.keys(env).length} keys, ${humanRemaining(Date.now() + ttlMs)})`)}`);
                 }
@@ -2170,7 +2187,7 @@ Examples:
             let total = 0;
             for (const name of names) {
                 total += await agentLock(name);
-                deleteSession(name); // also drop the durable snapshot, or a restart re-warms it
+                deleteBundleSessions(name); // drop every harness scope
             }
             console.log(total > 0 ? chalk.green(`Locked ${total} bundle(s).`) : chalk.gray('Nothing to lock.'));
         }
@@ -2216,16 +2233,47 @@ Examples:
         } })();
         console.log(chalk.gray(`hold: ${holdStr}${configured ? ' (secrets.agent.holdMs)' : ' (default)'} — a daily bundle prompts once, then stays silent for this long or until sleep/logout.`));
         const entries = await agentStatus();
+        const held = new Set(entries.map((e) => e.name));
         if (entries.length === 0) {
             console.log(chalk.gray('No bundles held. The next read of each daily bundle will prompt once, then hold.'));
             console.log(chalk.gray('Pre-warm now with: agents secrets unlock <bundle>  (or --all)'));
-            return;
         }
-        console.log(chalk.bold(`${'BUNDLE'.padEnd(24)} ${'KEYS'.padEnd(5)} LOCKS IN`));
-        for (const e of entries) {
-            console.log(`${chalk.cyan(e.name.padEnd(24))} ${String(e.keyCount).padEnd(5)} ${humanRemaining(e.expiresAt)}`);
+        else {
+            console.log(chalk.bold(`${'BUNDLE'.padEnd(24)} ${'KEYS'.padEnd(5)} LOCKS IN`));
+            for (const e of entries) {
+                console.log(`${chalk.cyan(e.name.padEnd(24))} ${String(e.keyCount).padEnd(5)} ${humanRemaining(e.expiresAt)}`);
+            }
+            console.log(chalk.gray('Reads of held bundles are silent; any bundle not listed prompts once on its next read.'));
+        }
+        // Usage hint: bundles you keep getting a Touch ID prompt for — a keychain
+        // read that fell through to biometry (not served by the broker/session)
+        // >= a few times in the last week, and not currently held. Unlocking each
+        // once silences it for the hold window. This runs even when NO bundle is
+        // held — that user re-prompts on every read and most needs the nudge.
+        // Excludes `never`/no-ACL bundles (never prompt) and file/vault bundles
+        // (resolve by passphrase, not the keychain broker — `unlock` is a no-op).
+        try {
+            const weekAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
+            const reads = query({ eventTypes: ['secrets.get'], startDate: weekAgo });
+            const hot = frequentlyPromptedBundles(reads, held, { minReads: 3 }).filter((h) => {
+                try {
+                    return bundleBackend(h.name) === 'keychain' && bundlePolicy(readBundle(h.name)) !== 'never';
+                }
+                catch {
+                    return false; // bundle gone / unreadable metadata — nothing to suggest
+                }
+            });
+            if (hot.length > 0) {
+                console.log();
+                console.log(chalk.bold('Prompted often — unlock once to silence:'));
+                for (const h of hot) {
+                    console.log(`${chalk.cyan(h.name.padEnd(24))} ${chalk.gray(`${h.count}× in the last 7d`)}  →  ${chalk.green(`agents secrets unlock ${h.name}`)}`);
+                }
+            }
+        }
+        catch {
+            // Best-effort hint — never let usage analysis break `secrets status`.
         }
-        console.log(chalk.gray('Reads of held bundles are silent; any bundle not listed prompts once on its next read.'));
     });
     cmd
         .command('policy <bundle> [policy]')

package/dist/commands/sessions-browser.d.ts

@@ -9,7 +9,8 @@
  * Built on {@link dynamicPicker}; every data source (discover, fleet, live index,
  * preview, resume dispatch) is reused from the existing sessions plumbing.
  */
-import type { SessionMeta } from '../lib/session/types.js';
+import { type SessionMeta } from '../lib/session/types.js';
+import type { ActiveSession } from '../lib/session/active.js';
 /**
  * The single canonical filter state. Every field has a flag equivalent, so the
  * same view is reachable interactively (hotkeys) or from the command line (flags).
@@ -59,11 +60,14 @@ export declare function activeBrowserSeed(opts: {
     agent?: string;
     host?: string[];
     since?: string;
+    all?: boolean;
 }): Partial<BrowserFilter>;
 /**
  * The initial filter for the bare interactive listing: current-repo subtree by
- * default (matches the static overview's cwd scoping), `--all` widens to every
- * directory, `--since` seeds the window.
+ * default (matches the static overview's cwd scoping). `--all` sets every
+ * non-status filter to its "all" value — every directory (project) AND all-time
+ * (window) — so one flag maxes the view; `--since` still overrides the window and
+ * `-a`/`--device` still narrow their axis.
  */
 export declare function bareBrowserSeed(opts: {
     teams?: boolean;
@@ -71,6 +75,44 @@ export declare function bareBrowserSeed(opts: {
     all?: boolean;
     since?: string;
 }): Partial<BrowserFilter>;
+/**
+ * A live session's stable row key: its session id when the agent reported one,
+ * else a per-machine handle so an id-less live session (a just-booted harness, a
+ * cloud task) still gets exactly one row instead of being dropped. Cloud rows key
+ * on the task id because they have no pid — keying them all on the machine alone
+ * would collapse two cloud tasks into one row, the same silent-drop this whole
+ * change exists to remove.
+ */
+export declare function liveRowKey(a: ActiveSession, self: string): string;
+/** Index live sessions by {@link liveRowKey} — the join key between the live scan
+ *  and the transcript pool. Id-carrying rows key on the session id, so a live row
+ *  and its transcript row collapse to one. */
+export declare function indexLiveRows(rows: ActiveSession[], self: string): Map<string, ActiveSession>;
+/**
+ * Project a live session onto the picker's row shape, for a session the transcript
+ * pool doesn't carry — a peer's session, a transcript outside the current window,
+ * or an agent that has not written one yet. `filePath` is the live transcript path
+ * when the scan resolved one and empty otherwise, which is what
+ * {@link handlePickedSession} keys "there is nothing to open yet" off.
+ */
+export declare function liveSessionToMeta(a: ActiveSession, self: string): SessionMeta;
+/**
+ * Fold the live scan INTO the transcript pool. The running filter used to be a
+ * pure intersection (`pool ∩ live`), which meant a session had to already be in
+ * the pool to be shown as running — so every session on another machine, and
+ * every local one outside the pool's window, was invisible in the browser while
+ * `--active --json` listed it. Live sessions the pool lacks are appended as their
+ * own rows, then the whole set is grouped local-machine-first.
+ */
+export declare function mergeLiveIntoPool(rows: SessionMeta[], live: Map<string, ActiveSession>, self: string): SessionMeta[];
+/**
+ * Whether to render the host-program column. It belongs to the running view
+ * only, so this gates on the FILTER — not on the live index being populated.
+ * `liveCache` outlives a toggle of the `r` hotkey, so testing `live` alone would
+ * keep the column after running is turned back off, widening a plain transcript
+ * listing that has no live rows to explain it.
+ */
+export declare function shouldShowHostColumn(f: BrowserFilter, live: Map<string, ActiveSession> | null, rows: SessionMeta[]): boolean;
 /**
  * Launch the interactive session browser. `initial` seeds the filter (e.g.
  * `{ running: true }` for `--active`). Resolves after the user resumes a session

package/dist/commands/sessions-browser.js

@@ -9,14 +9,15 @@
  * Built on {@link dynamicPicker}; every data source (discover, fleet, live index,
  * preview, resume dispatch) is reused from the existing sessions plumbing.
  */
+import path from 'path';
 import { spawnSync } from 'child_process';
 import { dynamicPicker } from '../lib/picker.js';
-import { getActiveSessions } from '../lib/session/active.js';
+import { isSessionTrackedAgent } from '../lib/session/types.js';
 import { discoverSessions } from '../lib/session/discover.js';
 import { gatherRemoteList } from '../lib/session/remote-list.js';
 import { machineId, normalizeHost } from '../lib/session/sync/config.js';
 import { buildPreview } from './sessions-picker.js';
-import { formatPickerLabel, pickerColumnsFor, ticketLabel, mergeLocalFirst, indexActiveBySessionId, handlePickedSession, shouldIncludeLocal, remoteHostsToDial, } from './sessions.js';
+import { formatPickerLabel, pickerColumnsFor, ticketLabel, mergeLocalFirst, gatherActiveSessions, liveHostLabel, LIVE_ROW_PREFIX, cleanPreview, handlePickedSession, shouldIncludeLocal, remoteHostsToDial, } from './sessions.js';
 /** Ordered window cycle for the `W` key. `undefined` = all time. */
 const WINDOW_CYCLE = [undefined, '1d', '7d', '30d'];
 /** Return the next value in `[undefined, ...options]`, wrapping. */
@@ -102,20 +103,25 @@ export function activeBrowserSeed(opts) {
         agent: opts.agent,
         projectScope: 'all',
         device: normalizeDeviceSeed(opts.host?.[0]),
-        window: opts.since ?? '30d',
+        // --all widens the window to all-time (project is already 'all' here);
+        // --since still overrides.
+        window: opts.since ?? (opts.all ? undefined : '30d'),
     };
 }
 /**
  * The initial filter for the bare interactive listing: current-repo subtree by
- * default (matches the static overview's cwd scoping), `--all` widens to every
- * directory, `--since` seeds the window.
+ * default (matches the static overview's cwd scoping). `--all` sets every
+ * non-status filter to its "all" value — every directory (project) AND all-time
+ * (window) — so one flag maxes the view; `--since` still overrides the window and
+ * `-a`/`--device` still narrow their axis.
  */
 export function bareBrowserSeed(opts) {
     return {
         teams: !!opts.teams,
         agent: opts.agent,
+        // --all maxes every non-status filter: all dirs AND all-time. --since wins.
         projectScope: opts.all ? 'all' : 'repo',
-        window: opts.since ?? '30d',
+        window: opts.since ?? (opts.all ? undefined : '30d'),
     };
 }
 /** Copy text to the OS clipboard (best-effort; silently no-ops if unavailable). */
@@ -182,6 +188,99 @@ async function fetchRawPool(f, self, local, hosts) {
     }
     return { key: `${since ?? 'all'}|${f.teams}`, rows };
 }
+/**
+ * A live session's stable row key: its session id when the agent reported one,
+ * else a per-machine handle so an id-less live session (a just-booted harness, a
+ * cloud task) still gets exactly one row instead of being dropped. Cloud rows key
+ * on the task id because they have no pid — keying them all on the machine alone
+ * would collapse two cloud tasks into one row, the same silent-drop this whole
+ * change exists to remove.
+ */
+export function liveRowKey(a, self) {
+    if (a.sessionId)
+        return a.sessionId;
+    const handle = a.cloudTaskId ?? (a.pid != null ? String(a.pid) : 'unknown');
+    return `${LIVE_ROW_PREFIX}${a.machine ?? self}:${handle}`;
+}
+/** Index live sessions by {@link liveRowKey} — the join key between the live scan
+ *  and the transcript pool. Id-carrying rows key on the session id, so a live row
+ *  and its transcript row collapse to one. */
+export function indexLiveRows(rows, self) {
+    const byKey = new Map();
+    for (const a of rows)
+        byKey.set(liveRowKey(a, self), a);
+    return byKey;
+}
+/**
+ * Project a live session onto the picker's row shape, for a session the transcript
+ * pool doesn't carry — a peer's session, a transcript outside the current window,
+ * or an agent that has not written one yet. `filePath` is the live transcript path
+ * when the scan resolved one and empty otherwise, which is what
+ * {@link handlePickedSession} keys "there is nothing to open yet" off.
+ */
+export function liveSessionToMeta(a, self) {
+    const machine = a.machine ?? self;
+    const started = a.startedAtMs ?? a.lastActivityMs;
+    const topic = a.topic ?? a.preview;
+    return {
+        id: liveRowKey(a, self),
+        // No session id to short — name the row by what it IS (a cloud task, a pid),
+        // so the id column still identifies the process you'd go looking for.
+        shortId: a.sessionId
+            ? a.sessionId.slice(0, 8)
+            : a.cloudTaskId
+                ? a.cloudTaskId.slice(0, 8)
+                : `p:${a.pid ?? '?'}`,
+        agent: isSessionTrackedAgent(a.kind) ? a.kind : 'claude',
+        timestamp: new Date(started ?? Date.now()).toISOString(),
+        lastActivity: a.lastActivityMs ? new Date(a.lastActivityMs).toISOString() : undefined,
+        project: a.cwd ? path.basename(a.cwd) : undefined,
+        cwd: a.cwd,
+        filePath: a.sessionFile ?? '',
+        // A live topic is raw transcript text: a newline in it would break the row
+        // into two and misalign every column after it. Indexed rows are already
+        // cleaned at scan time, so this puts projected rows on the same footing.
+        topic: topic ? cleanPreview(topic) : undefined,
+        label: a.label ? cleanPreview(a.label) : undefined,
+        machine,
+        // Reading/resuming a peer's session hops back over SSH — same contract the
+        // cross-machine listing sets, so handlePickedSession routes it correctly.
+        _remote: machine !== self,
+        prUrl: a.pr?.url,
+        prNumber: a.pr?.number,
+        ticketId: a.ticket?.id,
+        worktreeSlug: a.worktree?.slug,
+    };
+}
+/**
+ * Fold the live scan INTO the transcript pool. The running filter used to be a
+ * pure intersection (`pool ∩ live`), which meant a session had to already be in
+ * the pool to be shown as running — so every session on another machine, and
+ * every local one outside the pool's window, was invisible in the browser while
+ * `--active --json` listed it. Live sessions the pool lacks are appended as their
+ * own rows, then the whole set is grouped local-machine-first.
+ */
+export function mergeLiveIntoPool(rows, live, self) {
+    const known = new Set(rows.map((r) => r.id));
+    const extra = [];
+    for (const [key, a] of live) {
+        if (!known.has(key))
+            extra.push(liveSessionToMeta(a, self));
+    }
+    return extra.length === 0 ? rows : mergeLocalFirst([...rows, ...extra], self);
+}
+/**
+ * Whether to render the host-program column. It belongs to the running view
+ * only, so this gates on the FILTER — not on the live index being populated.
+ * `liveCache` outlives a toggle of the `r` hotkey, so testing `live` alone would
+ * keep the column after running is turned back off, widening a plain transcript
+ * listing that has no live rows to explain it.
+ */
+export function shouldShowHostColumn(f, live, rows) {
+    if (!f.running || !live)
+        return false;
+    return rows.some((r) => liveHostLabel(live.get(r.id)) !== '');
+}
 /** Apply the cheap in-memory filters (agent / device / project / running). */
 function applyFilters(rows, live, f, self) {
     let out = rows;
@@ -197,6 +296,16 @@ function applyFilters(rows, live, f, self) {
         out = out.filter((r) => live.has(r.id));
     return out;
 }
+/** Derive the SSH-launch origin tag for a picker row from the live index. Set
+ * only when the live session's provenance is ssh transport; `device` is the
+ * resolved origin device (absent → the row shows a bare `ssh`). Rows without a
+ * live entry (the running filter off) get no tag — provenance is live-only. */
+function sshOriginTagFor(live, id) {
+    const p = live?.get(id)?.provenance;
+    if (p?.transport !== 'ssh')
+        return undefined;
+    return p.origin?.device ? { device: p.origin.device } : {};
+}
 function headerFor(f) {
     const bits = [
         `device:${f.device ?? 'all'}`,
@@ -259,11 +368,14 @@ export async function runSessionBrowser(initial = {}, opts = {}) {
                 return []; // superseded — don't touch shared state
             pool = fetched;
         }
-        // Only pay for the live scan when the running filter needs it.
+        // Only pay for the live scan when the running filter needs it. Same fleet
+        // sweep the static `--active` view uses, so the two never disagree about
+        // what is running.
         let live = liveCache;
         if (f.running && !live) {
             try {
-                live = indexActiveBySessionId(await getActiveSessions());
+                const { sessions } = await gatherActiveSessions({ local, hosts });
+                live = indexLiveRows(sessions, self);
             }
             catch {
                 live = new Map();
@@ -276,10 +388,14 @@ export async function runSessionBrowser(initial = {}, opts = {}) {
         rawCache = pool;
         if (live)
             liveCache = live;
-        agentsInPool = distinct(pool.rows.map((r) => r.agent));
-        devicesInPool = distinct(pool.rows.map((r) => r.machine ?? self));
-        const filtered = applyFilters(pool.rows, live ?? new Map(), f, self);
+        // Live sessions the transcript pool lacks become rows of their own, so the
+        // running view lists every active session, not just the ones already indexed.
+        const rows = f.running && live ? mergeLiveIntoPool(pool.rows, live, self) : pool.rows;
+        agentsInPool = distinct(rows.map((r) => r.agent));
+        devicesInPool = distinct(rows.map((r) => r.machine ?? self));
+        const filtered = applyFilters(rows, live ?? new Map(), f, self);
         cols = pickerColumnsFor(filtered);
+        cols.showHost = shouldShowHostColumn(f, live, filtered);
         return filtered;
     };
     const picked = await dynamicPicker({
@@ -287,7 +403,7 @@ export async function runSessionBrowser(initial = {}, opts = {}) {
         initialFilter,
         load,
         keyFor: (s) => s.id,
-        labelFor: (s, q) => formatPickerLabel(s, q, cols),
+        labelFor: (s, q) => formatPickerLabel(s, q, cols, sshOriginTagFor(liveCache, s.id), liveHostLabel(liveCache?.get(s.id))),
         matches: sessionMatchesQuery,
         buildPreview,
         headerFor,

package/dist/commands/sessions-export.d.ts

@@ -1,2 +1,5 @@
 import type { Command } from 'commander';
+import type { SessionMeta } from '../lib/session/types.js';
 export declare function registerSessionsExportCommand(sessionsCmd: Command): void;
+/** ids > query > everything-in-scope. Exported for the id-resolution test. */
+export declare function selectSessions(metas: SessionMeta[], selectors: string[]): SessionMeta[];

package/dist/commands/sessions-export.js

@@ -20,7 +20,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
-import { discoverSessions, resolveSessionById, isCompleteSessionId } from '../lib/session/discover.js';
+import { discoverSessions, resolveSessionById, looksLikeSessionId } from '../lib/session/discover.js';
 import { findSessionsById } from '../lib/session/db.js';
 import { filterSessionsByQuery, parseAgentFilter } from './sessions.js';
 import { listLocalTranscripts, SYNC_AGENTS } from '../lib/session/sync/agents.js';
@@ -222,8 +222,8 @@ function resolveAgentShorthand(g) {
         return 'antigravity';
     return undefined;
 }
-/** ids > query > everything-in-scope. */
-function selectSessions(metas, selectors) {
+/** ids > query > everything-in-scope. Exported for the id-resolution test. */
+export function selectSessions(metas, selectors) {
     if (selectors.length === 0)
         return metas;
     const byId = [];
@@ -231,9 +231,11 @@ function selectSessions(metas, selectors) {
     for (const sel of selectors) {
         const trimmed = sel.trim();
         // Same reason as resolveSessionQuery: the discovered pool is a minority of
-        // the index, so a complete id absent from it may still be indexed here.
+        // the index, so an id-shaped selector absent from it may still be indexed
+        // here. Gate on looksLikeSessionId, not isCompleteSessionId, so a SHORT id
+        // ("d3470b57") also resolves through the index instead of falling to content.
         const hits = resolveSessionById(metas, trimmed);
-        const resolved = hits.length > 0 || !isCompleteSessionId(trimmed) ? hits : findSessionsById(trimmed);
+        const resolved = hits.length > 0 || !looksLikeSessionId(trimmed) ? hits : findSessionsById(trimmed);
         if (resolved.length > 0)
             byId.push(...resolved);
         else
@@ -243,11 +245,12 @@ function selectSessions(metas, selectors) {
         const seen = new Set();
         return byId.filter(s => (seen.has(s.id) ? false : (seen.add(s.id), true)));
     }
-    // A selector that is a COMPLETE session id and still missed cannot be widened:
-    // the id is unique, so the text query below could only bundle sessions that
-    // merely mention it. Bundling those would ship unrelated transcripts to
-    // whoever receives the export, so select nothing and let the caller report it.
-    const missingIds = unmatched.filter(isCompleteSessionId);
+    // A selector that is an id (complete OR a short hex id/prefix) and still missed
+    // cannot be widened: the id is unique, so the text query below could only bundle
+    // sessions that merely mention it. Bundling those would ship unrelated
+    // transcripts to whoever receives the export, so select nothing and let the
+    // caller report it — a short id like "d3470b57" must never content-search.
+    const missingIds = unmatched.filter(looksLikeSessionId);
     if (missingIds.length > 0) {
         process.stderr.write(chalk.red(`No session with id ${missingIds.join(', ')} on this machine.\n`));
         return [];

package/dist/commands/sessions-picker.d.ts

@@ -1,4 +1,18 @@
-import type { SessionMeta } from '../lib/session/types.js';
+import type { SessionEvent, SessionMeta, TodoProgress } from '../lib/session/types.js';
+import { classifyFileChanges } from '../lib/session/digest.js';
+/**
+ * Compact checklist tally for list rows and previews (RUSH-2045).
+ * Example: `✓6/8 · A5 wiring runner`. Empty string when there is no list.
+ * Consumes `SessionMeta.todos` / `ActiveSession.todos` as populated by the
+ * state engine — does not re-parse transcripts.
+ */
+export declare function formatTodoCompact(todos?: Pick<TodoProgress, 'done' | 'total' | 'activeForm'> | null): string;
+/**
+ * Best-effort GitHub repo URL from a checkout path shaped like
+ * `…/github.com/<owner>/<repo>/…`. Used to make the project name clickable
+ * when no Linear project URL is available.
+ */
+export declare function githubRepoUrlFromCwd(cwd?: string): string | undefined;
 export interface PickedSession {
     session: SessionMeta;
     action: 'resume' | 'view';
@@ -17,5 +31,18 @@ export interface SessionPickerConfig {
 }
 /** Build a cached multi-line preview string for display in the session picker. */
 export declare function buildPreview(session: SessionMeta): string;
+/** Optional dirs-touched field the parser teammate may attach; we prefer it. */
+type SessionMetaWithDirs = SessionMeta & {
+    dirsTouched?: string[];
+};
+/**
+ * Unique directories the session touched, compact and human-readable.
+ * Prefer `session.dirsTouched` when the parser teammate has populated it;
+ * otherwise derive from file-change + tool paths already available here.
+ */
+export declare function directoriesTouched(session: SessionMetaWithDirs, events: SessionEvent[], changes: ReturnType<typeof classifyFileChanges>): string[];
+/** Relativize a file path to its parent dir, short enough for one preview line. */
+export declare function relativizeDir(filePath: string, cwd?: string): string | undefined;
 /** Show an interactive session picker and return the selected session with its action (resume or view). */
 export declare function sessionPicker(config: SessionPickerConfig): Promise<PickedSession | null>;
+export {};