@phnx-labs/agents-cli 1.20.77 → 1.20.78

package/dist/lib/secrets/bundles.js

@@ -31,7 +31,8 @@ import { emit } from '../events.js';
 import { readMeta, getHelpersDir } from '../state.js';
 import { assertNameActiveInResourceProfile, filterNamesForActiveResourceProfile } from '../resource-profiles.js';
 import { agentGetSync, agentAutoLoadSync, agentGetMetaSync, agentAutoLoadMetaSync, agentEvictSync, secretsAgentAutoEnabled, secretsHoldMs } from './agent.js';
-import { loadSession, deleteSession } from './session-store.js';
+import { GLOBAL_HARNESS } from './scope.js';
+import { resolveSession, deleteSession } from './session-store.js';
 import { createHash } from 'node:crypto';
 const keychainStore = {
     has: hasKeychainToken,
@@ -1043,7 +1044,7 @@ export function resolveBundleEnv(bundle, _opts = {}) {
  *
  * A read in a macOS headless context resolves broker-only (agentOnly) and fails
  * fast with an actionable error instead of hijacking Touch ID. This generalizes
- * the per-caller pattern already used by the daemon (daemon.ts:readDaemonClaudeOAuthToken).
+ * the per-caller broker-only pattern used across the headless secrets readers.
  */
 export function isHeadlessSecretsContext(env = process.env, platform = process.platform, 
 // Injected so the TTY branch below is testable: it is the branch that decides a
@@ -1097,7 +1098,11 @@ export function readAndResolveBundleEnv(name, opts = {}) {
     // file-backed bundle has none to dedup. The never-unlocked path is a single
     // stat (agentSocketExists) so it costs nothing when the agent isn't running.
     if (backend === 'keychain' && !opts.noAgent && process.env.AGENTS_SECRETS_NO_AGENT !== '1') {
-        const harness = opts.agent || process.env.AGENTS_AGENT_NAME || 'cli';
+        // The scope this reader asks under. Falls back to the GLOBAL scope, not to a
+        // literal `'cli'` harness — the broker and the durable store both resolve
+        // own-harness → global (bundleScopeChain), so an unscoped unlock is visible
+        // here whether this process was launched by an agent or typed in a terminal.
+        const harness = opts.agent || process.env.AGENTS_AGENT_NAME || GLOBAL_HARNESS;
         const hit = agentGetSync(name, harness);
         if (hit) {
             // The agent stores the FULL bundle env. Apply the same subset filter and
@@ -1122,13 +1127,16 @@ export function readAndResolveBundleEnv(name, opts = {}) {
         // Touch ID. Serve from it and re-warm the broker, so a warm bundle stays warm
         // across restart — this fixes BOTH the interactive re-prompt and the headless
         // throw below (which now fires only when there is genuinely no session).
-        const session = loadSession(name, Date.now(), harness);
-        if (session) {
+        const resolved = resolveSession(name, Date.now(), harness);
+        if (resolved) {
+            const session = resolved.entry;
             const filtered = filterAgentHitBySubsetAndExpiry({ bundle: session.bundle, env: session.env }, opts);
             stampLastUsed(filtered.bundle);
             // Re-warm the broker with the remaining TTL so later reads hit RAM and
-            // `agents secrets status` is honest. Best-effort; no-ops off darwin.
-            agentAutoLoadSync(name, session.bundle, session.env, Math.max(1, session.expiresAt - Date.now()), harness);
+            // `agents secrets status` is honest. Re-warm under the scope the grant was
+            // MADE in (resolved.harness), never the asking scope — re-warming a global
+            // grant as `claude` would silently narrow it for every other harness.
+            agentAutoLoadSync(name, session.bundle, session.env, Math.max(1, session.expiresAt - Date.now()), resolved.harness);
             emit('secrets.get', {
                 module: 'secrets',
                 bundle: name,
@@ -1323,7 +1331,7 @@ export function readAndResolveBundleEnv(name, opts = {}) {
             bundlePolicy(bundle) === 'daily' &&
             secretsAgentAutoEnabled() &&
             canCacheResolvedEnv(bundle, selectedKeys, opts.keyMode)) {
-            agentAutoLoadSync(name, bundle, env, secretsHoldMs(), opts.agent || process.env.AGENTS_AGENT_NAME || 'cli');
+            agentAutoLoadSync(name, bundle, env, secretsHoldMs(), opts.agent || process.env.AGENTS_AGENT_NAME || GLOBAL_HARNESS);
         }
         return { bundle, env };
     }

package/dist/lib/secrets/scope.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Harness scoping for an unlocked bundle — the shared vocabulary of the broker
+ * (agent.ts), the durable session store (session-store.ts), and the read path
+ * (bundles.ts).
+ *
+ * A grant is stored under a scope and read under a scope; the two must agree or
+ * the bundle is invisible. `agents secrets unlock --for <agent>` exists to NARROW
+ * a grant to one harness, so an unlock without it is global by definition.
+ *
+ * This module deliberately has NO imports: agent.ts and session-store.ts already
+ * import each other, and hanging the scope constants off either one would close
+ * that cycle — under ESM a cyclic `const` read can land in the temporal dead zone
+ * and throw at runtime even though tsc is happy.
+ */
+/**
+ * Scope of an unlock that was not narrowed with `--for`: readable by every
+ * harness. Not a valid harness name, so it can never collide with one.
+ */
+export declare const GLOBAL_HARNESS = "*";
+/**
+ * Scopes a reader consults, most specific first: its own harness, then the global
+ * grant. This is the resolution order of the scoped-grant model — a narrow
+ * `--for claude` unlock stays claude-only while an unscoped unlock serves
+ * everyone — not a fallback papering over a miss.
+ */
+export declare function bundleScopeChain(harness: string | undefined): string[];

package/dist/lib/secrets/scope.js

@@ -0,0 +1,29 @@
+/**
+ * Harness scoping for an unlocked bundle — the shared vocabulary of the broker
+ * (agent.ts), the durable session store (session-store.ts), and the read path
+ * (bundles.ts).
+ *
+ * A grant is stored under a scope and read under a scope; the two must agree or
+ * the bundle is invisible. `agents secrets unlock --for <agent>` exists to NARROW
+ * a grant to one harness, so an unlock without it is global by definition.
+ *
+ * This module deliberately has NO imports: agent.ts and session-store.ts already
+ * import each other, and hanging the scope constants off either one would close
+ * that cycle — under ESM a cyclic `const` read can land in the temporal dead zone
+ * and throw at runtime even though tsc is happy.
+ */
+/**
+ * Scope of an unlock that was not narrowed with `--for`: readable by every
+ * harness. Not a valid harness name, so it can never collide with one.
+ */
+export const GLOBAL_HARNESS = '*';
+/**
+ * Scopes a reader consults, most specific first: its own harness, then the global
+ * grant. This is the resolution order of the scoped-grant model — a narrow
+ * `--for claude` unlock stays claude-only while an unscoped unlock serves
+ * everyone — not a fallback papering over a miss.
+ */
+export function bundleScopeChain(harness) {
+    const own = harness || GLOBAL_HARNESS;
+    return own === GLOBAL_HARNESS ? [GLOBAL_HARNESS] : [own, GLOBAL_HARNESS];
+}

package/dist/lib/secrets/session-store.d.ts

@@ -74,6 +74,16 @@ export declare function readIndex(): SessionIndex;
 export declare function writeIndex(index: SessionIndex): void;
 /** Persist one unlocked bundle: write its blob no-ACL and record it in the index. */
 export declare function saveSession(name: string, entry: SessionEntry): void;
+/**
+ * Read a session honoring the scope chain: the caller's own harness first, then
+ * the global grant (see bundleScopeChain in scope.ts). This is the durable-store
+ * twin of the broker's `get` — both must resolve identically, or a bundle would
+ * be readable from RAM but not after a restart.
+ */
+export declare function resolveSession(name: string, now?: number, harness?: string): {
+    entry: SessionEntry;
+    harness: string;
+} | null;
 /** Read one session blob by known name. Null when absent/expired/malformed. */
 export declare function loadSession(name: string, now?: number, harness?: string): SessionEntry | null;
 /** Remove every persisted harness grant for one bundle. */

package/dist/lib/secrets/session-store.js

@@ -25,6 +25,7 @@
  * persistence is an optimization, not a correctness dependency.
  */
 import { getKeychainToken, setKeychainToken, deleteKeychainToken, isKeychainBackendOverridden } from './index.js';
+import { GLOBAL_HARNESS, bundleScopeChain } from './scope.js';
 /** Prefix for all durable session items (device-local, no-ACL). */
 export const SESSION_ITEM_PREFIX = 'agents-cli.session.';
 /** Fixed-name index item — the ONLY thing we ever need to find without a known
@@ -116,7 +117,7 @@ export function saveSession(name, entry) {
     if (!shouldPersist())
         return;
     try {
-        const harness = entry.harness || 'cli';
+        const harness = entry.harness || GLOBAL_HARNESS;
         const key = `${harness}:${name}`;
         setKeychainToken(sessionBlobItem(name, harness), JSON.stringify({ ...entry, harness }), { noAcl: true });
         writeIndex(upsertEntry(readIndex(), key, { expiresAt: entry.expiresAt, sleepPersist: entry.sleepPersist, harness }));
@@ -125,8 +126,22 @@ export function saveSession(name, entry) {
         /* best-effort — persistence is an optimization */
     }
 }
+/**
+ * Read a session honoring the scope chain: the caller's own harness first, then
+ * the global grant (see bundleScopeChain in scope.ts). This is the durable-store
+ * twin of the broker's `get` — both must resolve identically, or a bundle would
+ * be readable from RAM but not after a restart.
+ */
+export function resolveSession(name, now = Date.now(), harness = GLOBAL_HARNESS) {
+    for (const scope of bundleScopeChain(harness)) {
+        const entry = loadSession(name, now, scope);
+        if (entry)
+            return { entry, harness: scope };
+    }
+    return null;
+}
 /** Read one session blob by known name. Null when absent/expired/malformed. */
-export function loadSession(name, now = Date.now(), harness = 'cli') {
+export function loadSession(name, now = Date.now(), harness = GLOBAL_HARNESS) {
     if (!shouldPersist())
         return null;
     try {
@@ -154,7 +169,7 @@ export function deleteBundleSessions(name) {
         const scopedName = key.includes(':') ? key.split(':').slice(1).join(':') : key;
         if (scopedName !== name)
             continue;
-        const harness = meta.harness || 'cli';
+        const harness = meta.harness || GLOBAL_HARNESS;
         try {
             deleteKeychainToken(key.includes(':') ? sessionBlobItem(name, harness) : `${SESSION_ITEM_PREFIX}${name}`);
         }
@@ -164,7 +179,7 @@ export function deleteBundleSessions(name) {
     writeIndex(next);
 }
 /** Delete one bundle's session blob and prune it from the index. */
-export function deleteSession(name, harness = 'cli') {
+export function deleteSession(name, harness = GLOBAL_HARNESS) {
     if (!shouldPersist())
         return;
     try {
@@ -185,7 +200,7 @@ export function deleteAllSessions() {
             const bundleName = name.includes(':') ? name.split(':').slice(1).join(':') : name;
             try {
                 deleteKeychainToken(name.includes(':')
-                    ? sessionBlobItem(bundleName, meta.harness || 'cli')
+                    ? sessionBlobItem(bundleName, meta.harness || GLOBAL_HARNESS)
                     : `${SESSION_ITEM_PREFIX}${bundleName}`);
             }
             catch { /* keep going */ }
@@ -214,23 +229,61 @@ export function rehydrateSessions(now = Date.now()) {
             try {
                 const raw = getKeychainToken(`${SESSION_ITEM_PREFIX}${key}`);
                 const legacy = JSON.parse(raw);
-                setKeychainToken(sessionBlobItem(key, 'cli'), JSON.stringify({ ...legacy, harness: 'cli' }), { noAcl: true });
+                setKeychainToken(sessionBlobItem(key, GLOBAL_HARNESS), JSON.stringify({ ...legacy, harness: GLOBAL_HARNESS }), { noAcl: true });
                 deleteKeychainToken(`${SESSION_ITEM_PREFIX}${key}`);
-                migratedIndex = upsertEntry(removeEntry(migratedIndex, key), `cli:${key}`, {
+                migratedIndex = upsertEntry(removeEntry(migratedIndex, key), `${GLOBAL_HARNESS}:${key}`, {
                     expiresAt: meta.expiresAt,
                     sleepPersist: meta.sleepPersist,
-                    harness: 'cli',
+                    harness: GLOBAL_HARNESS,
                 });
             }
             catch { /* malformed/absent legacy entry is pruned below */ }
         }
+        // Second source migration: `cli`-scoped grants predate the global scope. `cli`
+        // was never a harness — it was the default when no AGENTS_AGENT_NAME was set,
+        // i.e. "unlocked from a terminal for general use", which is exactly the global
+        // grant. Rewriting them means an unlock a user already paid Touch ID for keeps
+        // working after upgrade instead of silently becoming unreadable to every agent.
+        for (const [key, meta] of Object.entries(migratedIndex.bundles)) {
+            if (!key.startsWith('cli:'))
+                continue;
+            const bundleName = key.slice('cli:'.length);
+            const globalKey = `${GLOBAL_HARNESS}:${bundleName}`;
+            // A global grant for this bundle can already exist: the user re-runs
+            // `unlock` on the new code (which writes the global scope) before the
+            // broker restarts to run this migration. The existing global grant is the
+            // NEWER one, so the stale `cli` entry is discarded, never merged over it —
+            // overwriting would restore a superseded token and, if the stale entry had
+            // expired, hand its expiry to the fresh grant so the prune below deletes a
+            // valid unlock outright.
+            if (migratedIndex.bundles[globalKey]) {
+                try {
+                    deleteKeychainToken(sessionBlobItem(bundleName, 'cli'));
+                }
+                catch { /* already gone */ }
+                migratedIndex = removeEntry(migratedIndex, key);
+                continue;
+            }
+            try {
+                const raw = getKeychainToken(sessionBlobItem(bundleName, 'cli'));
+                const legacy = JSON.parse(raw);
+                setKeychainToken(sessionBlobItem(bundleName, GLOBAL_HARNESS), JSON.stringify({ ...legacy, harness: GLOBAL_HARNESS }), { noAcl: true });
+                deleteKeychainToken(sessionBlobItem(bundleName, 'cli'));
+                migratedIndex = upsertEntry(removeEntry(migratedIndex, key), globalKey, {
+                    expiresAt: meta.expiresAt,
+                    sleepPersist: meta.sleepPersist,
+                    harness: GLOBAL_HARNESS,
+                });
+            }
+            catch { /* malformed/absent entry is pruned below */ }
+        }
         writeIndex(migratedIndex);
         index.bundles = migratedIndex.bundles;
         const { survivors, expiredNames } = pruneExpired(index, now);
         for (const name of expiredNames) {
             const meta = index.bundles[name];
             try {
-                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || 'cli'));
+                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || GLOBAL_HARNESS));
             }
             catch { /* keep going */ }
         }
@@ -239,7 +292,7 @@ export function rehydrateSessions(now = Date.now()) {
         for (const name of selectRehydratable(survivors, now)) {
             const meta = survivors.bundles[name];
             const bundleName = name.split(':').slice(1).join(':');
-            const entry = loadSession(bundleName, now, meta.harness || 'cli');
+            const entry = loadSession(bundleName, now, meta.harness || GLOBAL_HARNESS);
             if (entry)
                 out.push({ name: bundleName, entry });
         }
@@ -259,7 +312,7 @@ export function pruneSessionsOnSleep() {
         for (const name of deletedNames) {
             const meta = readIndex().bundles[name];
             try {
-                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || 'cli'));
+                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || GLOBAL_HARNESS));
             }
             catch { /* keep going */ }
         }

package/dist/lib/session/active.d.ts

@@ -189,6 +189,13 @@ export declare function agentKindFromComm(commRaw: string): string | undefined;
  * the start time can't be read, we keep the existence answer.
  */
 export declare function isPidAlive(pid: number, startedAtMs?: number): boolean;
+/**
+ * Resolve a Claude transcript for `cwd` across the given project roots, newest
+ * mtime winning when the same id/cwd resolves in more than one version home
+ * (the actively-written copy is the newest). Pure over `projectRoots`, so it is
+ * testable against temp dirs without touching the real home directory.
+ */
+export declare function pickClaudeSessionFileAcrossRoots(projectRoots: string[], cwd: string, sessionId?: string): string | undefined;
 /**
  * Pick a Claude transcript file within a project dir.
  *

package/dist/lib/session/active.js

@@ -26,7 +26,7 @@ import { AgentManager } from '../teams/agents.js';
 import { getTerminalsDir } from '../state.js';
 import { readPidSessionEntry, listPidSessionEntries, prunePidSessionRegistry } from './pid-registry.js';
 import { loadHookSessionIndex, resolveHookSessionRecord } from './hook-sessions.js';
-import { buildClaudeLabelMap } from './discover.js';
+import { buildClaudeLabelMap, getAgentSessionDirs } from './discover.js';
 import { buildRunNameMap } from './run-names.js';
 import { latestSessionFileForCwd } from './db.js';
 import { extractSessionTopic } from './prompt.js';
@@ -67,7 +67,6 @@ export function activeStatusFromCloudStatus(status) {
             return 'queued';
     }
 }
-const HOME = os.homedir();
 const LIVE_TERMINALS_FILE = path.join(getTerminalsDir(), 'live-terminals.json');
 /**
  * A process is classified `running` if its session file was touched in the
@@ -217,9 +216,45 @@ function claudeProjectDirName(cwd) {
  * Locate the active Claude session file for a process. If we know the session
  * UUID (from terminal env or team parent), prefer the exact match. Otherwise
  * fall back to the most-recent-mtime .jsonl in the project's folder.
+ *
+ * Searches EVERY version-home project root, not just the live `~/.claude`
+ * symlink. `~/.claude` points at the currently-installed agent version; a
+ * session launched under an EARLIER version keeps its transcript under that
+ * version's home (`…/.history/versions/claude/<ver>/home/.claude/projects/`).
+ * Resolving only `~/.claude/projects` meant that the instant a newer version
+ * was installed, every still-running older-version session lost its transcript
+ * here — no `sessionFile`, so no start/activity time, so `agents sessions`
+ * rendered it `unknown` and the watchdog skipped it as "no activity timestamp".
+ * `getAgentSessionDirs('claude','projects')` is the same version-aware enumerator
+ * the rest of the CLI uses, so this stays in lockstep with discovery.
  */
 function findClaudeSessionFile(cwd, sessionId) {
-    return pickSessionFile(path.join(HOME, '.claude', 'projects', claudeProjectDirName(cwd)), sessionId);
+    return pickClaudeSessionFileAcrossRoots(getAgentSessionDirs('claude', 'projects'), cwd, sessionId);
+}
+/**
+ * Resolve a Claude transcript for `cwd` across the given project roots, newest
+ * mtime winning when the same id/cwd resolves in more than one version home
+ * (the actively-written copy is the newest). Pure over `projectRoots`, so it is
+ * testable against temp dirs without touching the real home directory.
+ */
+export function pickClaudeSessionFileAcrossRoots(projectRoots, cwd, sessionId) {
+    const enc = claudeProjectDirName(cwd);
+    let best;
+    for (const root of projectRoots) {
+        const hit = pickSessionFile(path.join(root, enc), sessionId);
+        if (!hit)
+            continue;
+        let mtime;
+        try {
+            mtime = fs.statSync(hit).mtimeMs;
+        }
+        catch {
+            continue;
+        }
+        if (!best || mtime > best.mtime)
+            best = { path: hit, mtime };
+    }
+    return best?.path;
 }
 /**
  * Pick a Claude transcript file within a project dir.

package/dist/lib/session/db.d.ts

@@ -40,6 +40,7 @@ export interface SessionRow {
     worktree_slug: string | null;
     ticket_id: string | null;
     plan: string | null;
+    machine: string | null;
     todos: string | null;
     recent_directories_touched: string | null;
     linear_project: string | null;
@@ -248,6 +249,42 @@ export interface UsageRollupRow {
 }
 /** What to group a usage rollup by. */
 export type UsageRollupGroup = 'agent' | 'project' | 'day';
+/**
+ * Smart-launch affinity priors: group sessions by origin machine, harness, or
+ * joint (machine + agent). Ordered by launch count desc.
+ *
+ * SQL shape (device example):
+ *   SELECT machine, COUNT(*) launches, SUM(duration_ms), SUM(token_count)
+ *   FROM sessions
+ *   WHERE timestamp >= ? AND origin = 'cli' AND is_team_origin = 0
+ *   GROUP BY machine ORDER BY launches DESC
+ *
+ * Account rotation is NOT done here — that stays on live rate-limit windows
+ * via `--strategy balanced` / rotate.ts.
+ */
+export type AffinityGroup = 'machine' | 'agent' | 'machine_agent';
+export interface AffinityRow {
+    /** Group key: machine name, agent id, or "machine\\tagent". */
+    key: string;
+    machine?: string;
+    agent?: string;
+    launches: number;
+    durationMs: number;
+    tokenCount: number;
+    costUsd: number;
+}
+export declare function queryAffinityRollup(options: {
+    groupBy: AffinityGroup;
+    /** ISO cutoff or ms; defaults to 14 days ago when omitted. */
+    sinceMs?: number;
+    /** Restrict to these harnesses (e.g. claude/codex/kimi). */
+    agents?: SessionAgentId[];
+    /** Default true: only origin=cli rows. */
+    onlyCli?: boolean;
+    /** Default true: drop team-spawned sessions. */
+    excludeTeamOrigin?: boolean;
+    project?: string;
+}): AffinityRow[];
 /**
  * Aggregate cost / duration / tokens across sessions, grouped by agent,
  * project, or calendar day. Honors the same filter shape as querySessions

package/dist/lib/session/db.js

@@ -12,10 +12,11 @@ import Database from '../sqlite.js';
 import { parseSession } from './parse.js';
 import { extractRecentDirectoriesTouched, extractTodoProgressFromEvents } from './state.js';
 import { getSessionsDir, getSessionsDbPath } from '../state.js';
+import { machineForSessionFile } from './origin-machine.js';
 const SESSIONS_DIR = getSessionsDir();
 const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. */
-const SCHEMA_VERSION = 17;
+const SCHEMA_VERSION = 18;
 /**
  * Canonicalize a file path for use as a scan_ledger key. The same physical
  * session file is reachable via multiple aliases — `~/.claude/projects/x.jsonl`
@@ -72,6 +73,7 @@ CREATE TABLE IF NOT EXISTS sessions (
   worktree_slug TEXT,
   ticket_id TEXT,
   plan TEXT,
+  machine TEXT,
   todos TEXT,
   recent_directories_touched TEXT,
   linear_project TEXT,
@@ -82,6 +84,8 @@ CREATE INDEX IF NOT EXISTS idx_sessions_cwd ON sessions(cwd);
 CREATE INDEX IF NOT EXISTS idx_sessions_agent ON sessions(agent);
 CREATE INDEX IF NOT EXISTS idx_sessions_file_path ON sessions(file_path);
 CREATE INDEX IF NOT EXISTS idx_sessions_short_id ON sessions(short_id);
+-- idx_sessions_machine_ts / idx_sessions_agent_ts are created after migration
+-- v17 guarantees the machine column exists (same pattern as last_activity).
 
 CREATE VIRTUAL TABLE IF NOT EXISTS session_text USING fts5(
   session_id UNINDEXED,
@@ -323,6 +327,7 @@ function migrateSchema(db, fromVersion) {
         db.exec(`UPDATE sessions SET short_id = substr(id, 1, 8) WHERE short_id IS NULL OR short_id = ''`);
     }
     if (fromVersion < 17) {
+        // v16 → v17 (main): todos / recent dirs / linear project metadata.
         const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
         if (!cols.some(c => c.name === 'todos'))
             db.exec(`ALTER TABLE sessions ADD COLUMN todos TEXT`);
@@ -334,6 +339,27 @@ function migrateSchema(db, fromVersion) {
             db.exec(`ALTER TABLE sessions ADD COLUMN linear_project_url TEXT`);
         db.exec(`DELETE FROM scan_ledger; DELETE FROM dir_ledger;`);
     }
+    if (fromVersion < 18) {
+        // v17 → v18: persist origin machine for smart-launch affinity GROUP BY machine.
+        const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
+        if (!cols.some(c => c.name === 'machine')) {
+            db.exec(`ALTER TABLE sessions ADD COLUMN machine TEXT`);
+        }
+        db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_sessions_machine_ts ON sessions(machine, timestamp DESC);
+      CREATE INDEX IF NOT EXISTS idx_sessions_agent_ts ON sessions(agent, timestamp DESC);
+    `);
+        const rows = db
+            .prepare(`SELECT id, agent, file_path FROM sessions WHERE machine IS NULL OR machine = ''`)
+            .all();
+        const upd = db.prepare(`UPDATE sessions SET machine = ? WHERE id = ?`);
+        const txn = db.transaction((items) => {
+            for (const r of items) {
+                upd.run(machineForSessionFile(r.file_path, r.agent), r.id);
+            }
+        });
+        txn(rows);
+    }
 }
 /** Open (or return the cached) sessions database, applying migrations as needed. */
 export function getDB() {
@@ -367,6 +393,27 @@ export function getDB() {
     db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_last_activity ON sessions(last_activity DESC)`);
     db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_origin ON sessions(origin)`);
     db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_routine_run_id ON sessions(routine_run_id)`);
+    // machine column + indexes: only after the column is guaranteed present.
+    // Fresh SCHEMA (v17) includes the column; older DBs get it from migrate v17.
+    // If a partial upgrade left schema_version ahead of the column, repair here.
+    {
+        const cols = db.prepare(`PRAGMA table_info(sessions)`).all();
+        if (!cols.some((c) => c.name === 'machine')) {
+            db.exec(`ALTER TABLE sessions ADD COLUMN machine TEXT`);
+            const rows = db
+                .prepare(`SELECT id, agent, file_path FROM sessions WHERE machine IS NULL OR machine = ''`)
+                .all();
+            const upd = db.prepare(`UPDATE sessions SET machine = ? WHERE id = ?`);
+            const txn = db.transaction((items) => {
+                for (const r of items) {
+                    upd.run(machineForSessionFile(r.file_path, r.agent), r.id);
+                }
+            });
+            txn(rows);
+        }
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_machine_ts ON sessions(machine, timestamp DESC)`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_agent_ts ON sessions(agent, timestamp DESC)`);
+    }
     // One-shot cleanup of the pre-SQLite JSONL indexes. Safe — nothing reads
     // them anymore. Guarded by a meta flag so we only try once.
     const cleaned = db.prepare(`SELECT value FROM meta WHERE key = 'legacy_indexes_removed'`).get();
@@ -675,7 +722,7 @@ const upsertSessionStmt = (db) => db.prepare(`
     output_tokens, cost_usd, duration_ms,
     file_path, file_mtime_ms, file_size, scanned_at, is_team_origin,
     pr_url, pr_number, worktree_slug, ticket_id, plan, todos,
-    recent_directories_touched, linear_project, linear_project_url
+    recent_directories_touched, linear_project, linear_project_url, machine
   ) VALUES (
     @id, @short_id, @agent, @origin, @routine_name, @routine_run_id,
     @version, @account, @timestamp, @last_activity,
@@ -683,7 +730,7 @@ const upsertSessionStmt = (db) => db.prepare(`
     @output_tokens, @cost_usd, @duration_ms,
     @file_path, @file_mtime_ms, @file_size, @scanned_at, @is_team_origin,
     @pr_url, @pr_number, @worktree_slug, @ticket_id, @plan, @todos,
-    @recent_directories_touched, @linear_project, @linear_project_url
+    @recent_directories_touched, @linear_project, @linear_project_url, @machine
   )
   ON CONFLICT(id) DO UPDATE SET
     short_id = excluded.short_id,
@@ -732,7 +779,8 @@ const upsertSessionStmt = (db) => db.prepare(`
     linear_project_url = CASE
       WHEN excluded.ticket_id IS NOT sessions.ticket_id THEN excluded.linear_project_url
       ELSE COALESCE(excluded.linear_project_url, sessions.linear_project_url)
-    END
+    END,
+    machine = excluded.machine
 `);
 function enrichCachedSessionMeta(meta) {
     if (!meta.filePath)
@@ -778,6 +826,12 @@ function storedFtsLabel(readLabel, id) {
     const row = readLabel.get(id);
     return row?.label ?? '';
 }
+/** Resolve origin machine for a row: prefer caller-stamped meta, else path. */
+function resolveMachine(meta) {
+    if (meta.machine && meta.machine.trim())
+        return meta.machine.trim();
+    return machineForSessionFile(meta.filePath, meta.agent);
+}
 /**
  * Upsert a session row and replace its FTS5 content in a single transaction.
  * `content` is the tokenizable user-prompt text; pass '' to leave the row unsearchable.
@@ -821,6 +875,7 @@ export function upsertSession(meta, content, scan) {
         recent_directories_touched: meta.recentDirectoriesTouched ? JSON.stringify(meta.recentDirectoriesTouched) : null,
         linear_project: meta.linearProject ?? null,
         linear_project_url: meta.linearProjectUrl ?? null,
+        machine: resolveMachine(meta),
     };
     const txn = db.transaction(() => {
         upsert.run(row);
@@ -931,6 +986,7 @@ export function upsertSessionsBatch(entries) {
                     recent_directories_touched: meta.recentDirectoriesTouched ? JSON.stringify(meta.recentDirectoriesTouched) : null,
                     linear_project: meta.linearProject ?? null,
                     linear_project_url: meta.linearProjectUrl ?? null,
+                    machine: resolveMachine(meta),
                 });
                 delText.run(meta.id);
                 insText.run(meta.id, 
@@ -1115,6 +1171,7 @@ function rowToMeta(row) {
         recentDirectoriesTouched: parseJsonColumn(row.recent_directories_touched),
         linearProject: row.linear_project ?? undefined,
         linearProjectUrl: row.linear_project_url ?? undefined,
+        machine: row.machine ?? undefined,
     };
 }
 function parseJsonColumn(value) {
@@ -1287,6 +1344,57 @@ export function countSessions(options = {}) {
     const row = db.prepare(sql).get(...params);
     return row ? row.n : 0;
 }
+export function queryAffinityRollup(options) {
+    const db = getDB();
+    const where = [];
+    const params = [];
+    const sinceMs = options.sinceMs ?? (Date.now() - 14 * 24 * 60 * 60 * 1000);
+    // ISO timestamps sort lexicographically; compare as string prefix of datetime.
+    where.push(`timestamp >= ?`);
+    params.push(new Date(sinceMs).toISOString());
+    if (options.onlyCli !== false) {
+        where.push(`IFNULL(origin, 'cli') = 'cli'`);
+    }
+    if (options.excludeTeamOrigin !== false) {
+        where.push(`IFNULL(is_team_origin, 0) = 0`);
+    }
+    if (options.agents && options.agents.length > 0) {
+        where.push(`agent IN (${options.agents.map(() => '?').join(',')})`);
+        params.push(...options.agents);
+    }
+    if (options.project) {
+        where.push(`LOWER(IFNULL(project, '')) LIKE ?`);
+        params.push(`%${options.project.toLowerCase()}%`);
+    }
+    let keyExpr;
+    let selectExtra;
+    if (options.groupBy === 'machine') {
+        keyExpr = `IFNULL(NULLIF(machine, ''), '(unknown)')`;
+        selectExtra = `${keyExpr} AS key, ${keyExpr} AS machine, NULL AS agent`;
+    }
+    else if (options.groupBy === 'agent') {
+        keyExpr = `agent`;
+        selectExtra = `agent AS key, NULL AS machine, agent AS agent`;
+    }
+    else {
+        keyExpr = `IFNULL(NULLIF(machine, ''), '(unknown)') || char(9) || agent`;
+        selectExtra = `${keyExpr} AS key, IFNULL(NULLIF(machine, ''), '(unknown)') AS machine, agent AS agent`;
+    }
+    const clause = where.length ? `WHERE ${where.join(' AND ')}` : '';
+    const sql = `
+    SELECT
+      ${selectExtra},
+      COUNT(*) AS launches,
+      IFNULL(SUM(duration_ms), 0) AS durationMs,
+      IFNULL(SUM(token_count), 0) AS tokenCount,
+      IFNULL(SUM(cost_usd), 0) AS costUsd
+    FROM sessions
+    ${clause}
+    GROUP BY key
+    ORDER BY launches DESC, key ASC
+  `;
+    return db.prepare(sql).all(...params);
+}
 /**
  * Aggregate cost / duration / tokens across sessions, grouped by agent,
  * project, or calendar day. Honors the same filter shape as querySessions