@phnx-labs/agents-cli 1.20.77 → 1.20.82

package/dist/lib/secrets/scope.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Harness scoping for an unlocked bundle — the shared vocabulary of the broker
+ * (agent.ts), the durable session store (session-store.ts), and the read path
+ * (bundles.ts).
+ *
+ * A grant is stored under a scope and read under a scope; the two must agree or
+ * the bundle is invisible. `agents secrets unlock --for <agent>` exists to NARROW
+ * a grant to one harness, so an unlock without it is global by definition.
+ *
+ * This module deliberately has NO imports: agent.ts and session-store.ts already
+ * import each other, and hanging the scope constants off either one would close
+ * that cycle — under ESM a cyclic `const` read can land in the temporal dead zone
+ * and throw at runtime even though tsc is happy.
+ */
+/**
+ * Scope of an unlock that was not narrowed with `--for`: readable by every
+ * harness. Not a valid harness name, so it can never collide with one.
+ */
+export declare const GLOBAL_HARNESS = "*";
+/**
+ * Scopes a reader consults, most specific first: its own harness, then the global
+ * grant. This is the resolution order of the scoped-grant model — a narrow
+ * `--for claude` unlock stays claude-only while an unscoped unlock serves
+ * everyone — not a fallback papering over a miss.
+ */
+export declare function bundleScopeChain(harness: string | undefined): string[];

package/dist/lib/secrets/scope.js

@@ -0,0 +1,29 @@
+/**
+ * Harness scoping for an unlocked bundle — the shared vocabulary of the broker
+ * (agent.ts), the durable session store (session-store.ts), and the read path
+ * (bundles.ts).
+ *
+ * A grant is stored under a scope and read under a scope; the two must agree or
+ * the bundle is invisible. `agents secrets unlock --for <agent>` exists to NARROW
+ * a grant to one harness, so an unlock without it is global by definition.
+ *
+ * This module deliberately has NO imports: agent.ts and session-store.ts already
+ * import each other, and hanging the scope constants off either one would close
+ * that cycle — under ESM a cyclic `const` read can land in the temporal dead zone
+ * and throw at runtime even though tsc is happy.
+ */
+/**
+ * Scope of an unlock that was not narrowed with `--for`: readable by every
+ * harness. Not a valid harness name, so it can never collide with one.
+ */
+export const GLOBAL_HARNESS = '*';
+/**
+ * Scopes a reader consults, most specific first: its own harness, then the global
+ * grant. This is the resolution order of the scoped-grant model — a narrow
+ * `--for claude` unlock stays claude-only while an unscoped unlock serves
+ * everyone — not a fallback papering over a miss.
+ */
+export function bundleScopeChain(harness) {
+    const own = harness || GLOBAL_HARNESS;
+    return own === GLOBAL_HARNESS ? [GLOBAL_HARNESS] : [own, GLOBAL_HARNESS];
+}

package/dist/lib/secrets/session-store.d.ts

@@ -74,6 +74,16 @@ export declare function readIndex(): SessionIndex;
 export declare function writeIndex(index: SessionIndex): void;
 /** Persist one unlocked bundle: write its blob no-ACL and record it in the index. */
 export declare function saveSession(name: string, entry: SessionEntry): void;
+/**
+ * Read a session honoring the scope chain: the caller's own harness first, then
+ * the global grant (see bundleScopeChain in scope.ts). This is the durable-store
+ * twin of the broker's `get` — both must resolve identically, or a bundle would
+ * be readable from RAM but not after a restart.
+ */
+export declare function resolveSession(name: string, now?: number, harness?: string): {
+    entry: SessionEntry;
+    harness: string;
+} | null;
 /** Read one session blob by known name. Null when absent/expired/malformed. */
 export declare function loadSession(name: string, now?: number, harness?: string): SessionEntry | null;
 /** Remove every persisted harness grant for one bundle. */

package/dist/lib/secrets/session-store.js

@@ -25,6 +25,7 @@
  * persistence is an optimization, not a correctness dependency.
  */
 import { getKeychainToken, setKeychainToken, deleteKeychainToken, isKeychainBackendOverridden } from './index.js';
+import { GLOBAL_HARNESS, bundleScopeChain } from './scope.js';
 /** Prefix for all durable session items (device-local, no-ACL). */
 export const SESSION_ITEM_PREFIX = 'agents-cli.session.';
 /** Fixed-name index item — the ONLY thing we ever need to find without a known
@@ -116,7 +117,7 @@ export function saveSession(name, entry) {
     if (!shouldPersist())
         return;
     try {
-        const harness = entry.harness || 'cli';
+        const harness = entry.harness || GLOBAL_HARNESS;
         const key = `${harness}:${name}`;
         setKeychainToken(sessionBlobItem(name, harness), JSON.stringify({ ...entry, harness }), { noAcl: true });
         writeIndex(upsertEntry(readIndex(), key, { expiresAt: entry.expiresAt, sleepPersist: entry.sleepPersist, harness }));
@@ -125,8 +126,22 @@ export function saveSession(name, entry) {
         /* best-effort — persistence is an optimization */
     }
 }
+/**
+ * Read a session honoring the scope chain: the caller's own harness first, then
+ * the global grant (see bundleScopeChain in scope.ts). This is the durable-store
+ * twin of the broker's `get` — both must resolve identically, or a bundle would
+ * be readable from RAM but not after a restart.
+ */
+export function resolveSession(name, now = Date.now(), harness = GLOBAL_HARNESS) {
+    for (const scope of bundleScopeChain(harness)) {
+        const entry = loadSession(name, now, scope);
+        if (entry)
+            return { entry, harness: scope };
+    }
+    return null;
+}
 /** Read one session blob by known name. Null when absent/expired/malformed. */
-export function loadSession(name, now = Date.now(), harness = 'cli') {
+export function loadSession(name, now = Date.now(), harness = GLOBAL_HARNESS) {
     if (!shouldPersist())
         return null;
     try {
@@ -154,7 +169,7 @@ export function deleteBundleSessions(name) {
         const scopedName = key.includes(':') ? key.split(':').slice(1).join(':') : key;
         if (scopedName !== name)
             continue;
-        const harness = meta.harness || 'cli';
+        const harness = meta.harness || GLOBAL_HARNESS;
         try {
             deleteKeychainToken(key.includes(':') ? sessionBlobItem(name, harness) : `${SESSION_ITEM_PREFIX}${name}`);
         }
@@ -164,7 +179,7 @@ export function deleteBundleSessions(name) {
     writeIndex(next);
 }
 /** Delete one bundle's session blob and prune it from the index. */
-export function deleteSession(name, harness = 'cli') {
+export function deleteSession(name, harness = GLOBAL_HARNESS) {
     if (!shouldPersist())
         return;
     try {
@@ -185,7 +200,7 @@ export function deleteAllSessions() {
             const bundleName = name.includes(':') ? name.split(':').slice(1).join(':') : name;
             try {
                 deleteKeychainToken(name.includes(':')
-                    ? sessionBlobItem(bundleName, meta.harness || 'cli')
+                    ? sessionBlobItem(bundleName, meta.harness || GLOBAL_HARNESS)
                     : `${SESSION_ITEM_PREFIX}${bundleName}`);
             }
             catch { /* keep going */ }
@@ -214,23 +229,61 @@ export function rehydrateSessions(now = Date.now()) {
             try {
                 const raw = getKeychainToken(`${SESSION_ITEM_PREFIX}${key}`);
                 const legacy = JSON.parse(raw);
-                setKeychainToken(sessionBlobItem(key, 'cli'), JSON.stringify({ ...legacy, harness: 'cli' }), { noAcl: true });
+                setKeychainToken(sessionBlobItem(key, GLOBAL_HARNESS), JSON.stringify({ ...legacy, harness: GLOBAL_HARNESS }), { noAcl: true });
                 deleteKeychainToken(`${SESSION_ITEM_PREFIX}${key}`);
-                migratedIndex = upsertEntry(removeEntry(migratedIndex, key), `cli:${key}`, {
+                migratedIndex = upsertEntry(removeEntry(migratedIndex, key), `${GLOBAL_HARNESS}:${key}`, {
                     expiresAt: meta.expiresAt,
                     sleepPersist: meta.sleepPersist,
-                    harness: 'cli',
+                    harness: GLOBAL_HARNESS,
                 });
             }
             catch { /* malformed/absent legacy entry is pruned below */ }
         }
+        // Second source migration: `cli`-scoped grants predate the global scope. `cli`
+        // was never a harness — it was the default when no AGENTS_AGENT_NAME was set,
+        // i.e. "unlocked from a terminal for general use", which is exactly the global
+        // grant. Rewriting them means an unlock a user already paid Touch ID for keeps
+        // working after upgrade instead of silently becoming unreadable to every agent.
+        for (const [key, meta] of Object.entries(migratedIndex.bundles)) {
+            if (!key.startsWith('cli:'))
+                continue;
+            const bundleName = key.slice('cli:'.length);
+            const globalKey = `${GLOBAL_HARNESS}:${bundleName}`;
+            // A global grant for this bundle can already exist: the user re-runs
+            // `unlock` on the new code (which writes the global scope) before the
+            // broker restarts to run this migration. The existing global grant is the
+            // NEWER one, so the stale `cli` entry is discarded, never merged over it —
+            // overwriting would restore a superseded token and, if the stale entry had
+            // expired, hand its expiry to the fresh grant so the prune below deletes a
+            // valid unlock outright.
+            if (migratedIndex.bundles[globalKey]) {
+                try {
+                    deleteKeychainToken(sessionBlobItem(bundleName, 'cli'));
+                }
+                catch { /* already gone */ }
+                migratedIndex = removeEntry(migratedIndex, key);
+                continue;
+            }
+            try {
+                const raw = getKeychainToken(sessionBlobItem(bundleName, 'cli'));
+                const legacy = JSON.parse(raw);
+                setKeychainToken(sessionBlobItem(bundleName, GLOBAL_HARNESS), JSON.stringify({ ...legacy, harness: GLOBAL_HARNESS }), { noAcl: true });
+                deleteKeychainToken(sessionBlobItem(bundleName, 'cli'));
+                migratedIndex = upsertEntry(removeEntry(migratedIndex, key), globalKey, {
+                    expiresAt: meta.expiresAt,
+                    sleepPersist: meta.sleepPersist,
+                    harness: GLOBAL_HARNESS,
+                });
+            }
+            catch { /* malformed/absent entry is pruned below */ }
+        }
         writeIndex(migratedIndex);
         index.bundles = migratedIndex.bundles;
         const { survivors, expiredNames } = pruneExpired(index, now);
         for (const name of expiredNames) {
             const meta = index.bundles[name];
             try {
-                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || 'cli'));
+                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || GLOBAL_HARNESS));
             }
             catch { /* keep going */ }
         }
@@ -239,7 +292,7 @@ export function rehydrateSessions(now = Date.now()) {
         for (const name of selectRehydratable(survivors, now)) {
             const meta = survivors.bundles[name];
             const bundleName = name.split(':').slice(1).join(':');
-            const entry = loadSession(bundleName, now, meta.harness || 'cli');
+            const entry = loadSession(bundleName, now, meta.harness || GLOBAL_HARNESS);
             if (entry)
                 out.push({ name: bundleName, entry });
         }
@@ -259,7 +312,7 @@ export function pruneSessionsOnSleep() {
         for (const name of deletedNames) {
             const meta = readIndex().bundles[name];
             try {
-                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || 'cli'));
+                deleteKeychainToken(sessionBlobItem(name.split(':').slice(1).join(':'), meta.harness || GLOBAL_HARNESS));
             }
             catch { /* keep going */ }
         }

package/dist/lib/secrets/sync.js

@@ -14,7 +14,7 @@ import * as crypto from 'crypto';
 import { deleteKeychainToken, getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from './index.js';
 import { readBundle, writeBundle, keychainItemsForBundle, validateBundleName, } from './bundles.js';
 import { rushSyncBackend } from './drivers/rush.js';
-import { emit } from '../events.js';
+import { emitSecretAudit } from './audit.js';
 // PBKDF2 cost. 600k SHA-256 iters matches OWASP 2023+ guidance and keeps a
 // passphrase prompt under a second on the hardware the CLI targets.
 const PBKDF2_ITER = 600_000;
@@ -190,8 +190,8 @@ export async function pushBundle(name, opts) {
     // bundle off-machine — the most sensitive read there is. It bypasses
     // readAndResolveBundleEnv, so audit it explicitly. Values never enter the
     // payload; only the bundle name and how many keys were read.
-    emit('secrets.get', {
-        module: 'secrets',
+    emitSecretAudit({
+        event: 'secrets.get',
         bundle: name,
         operation: 'sync push',
         source: 'sync-push',

package/dist/lib/session/active.d.ts

@@ -1,11 +1,20 @@
 import type { CloudTaskStatus } from '../cloud/types.js';
 import { type PidSessionEntry } from './pid-registry.js';
 import { type HookSessionIndex } from './hook-sessions.js';
-import { type SessionActivity, type AwaitingReason, type StructuredQuestion, type TodoProgress, type DetectedPr, type DetectedWorktree, type DetectedTicket } from './state.js';
-import type { SessionAttachment } from './types.js';
+import { type SessionState, type SessionActivity, type AwaitingReason, type StructuredQuestion, type TodoProgress, type DetectedPr, type DetectedWorktree, type DetectedTicket } from './state.js';
+import { type SessionAttachment } from './types.js';
 import { type SessionProvenance } from './provenance.js';
 import { type DeviceRegistry } from '../devices/registry.js';
 import { type Presence } from './detached.js';
+/**
+ * The owner (actor id) to show for a session in `--active`. Prefers the actor
+ * recorded on the live-attribution source (the pid registry / teammate record),
+ * but falls back to the durable per-session actor sidecar — written at spawn and,
+ * unlike the pid entry, NOT overwritten by the SessionStart hook's own by-pid
+ * write. Without this fallback a real `agents run` shows no owner whenever the
+ * hook's actor-less entry wins the by-pid file (RUSH-2018 fix).
+ */
+export declare function resolveOwner(pidActor: string | null | undefined, sessionId: string | undefined): string | undefined;
 /**
  * Per-PID `lsof` probes run bounded and staggered rather than as one parallel
  * fan-out: a simultaneous system-wide `lsof` burst reads to behavioral EDR
@@ -15,14 +24,27 @@ import { type Presence } from './detached.js';
 export declare const LSOF_CONCURRENCY = 4;
 export type ActiveContext = 'terminal' | 'teams' | 'cloud' | 'headless';
 /**
- * `unknown` = the process is alive but we cannot introspect what it is doing —
- * a live harness whose transcript format we do not parse (everything but
- * claude/codex), or a resolvable transcript whose `stat` momentarily failed. It
- * is NOT a synonym for idle: idle is a positive "not mid-turn, not waiting on
- * you" conclusion drawn from a readable transcript; unknown is the honest "we
- * can't tell", which we refuse to fake as idle.
+ * Every status here is COMPUTED by the framework from observable signals — PID
+ * liveness and transcript last-write (mtime) — never self-reported by the agent.
+ *
+ *   - `running` / `idle` / `input_required` — a live process's working / stopped
+ *     / waiting-on-you activity, from its transcript (see {@link computeLiveSignals}).
+ *   - `queued` — dispatched, work in the pipeline (cloud/headless launch).
+ *   - `closed` — the PID is dead. The process has exited; report that, don't
+ *     fabricate `idle` ("done, waiting for you") for a process that is simply gone.
+ *   - `abandoned` — no transcript write in {@link ABANDONED_STALE_MS} (days): the
+ *     session is dangling, whether its PID is dead (long gone) or still alive but
+ *     stuck making no progress. A soft signal — it clears the moment it writes again.
+ *   - `unknown` — the residual: genuinely NO signal (no PID info AND no file).
+ *
+ * A LIVE, fresh process is never `unknown` — "the process is alive" is itself a
+ * positive signal, so an opaque/unparseable live harness resolves to `running`
+ * (its honest floor), and every tracked harness with a locatable, parseable
+ * transcript (claude, codex, grok, droid, rush, gemini, kimi, hermes, opencode,
+ * antigravity) gets a real working/waiting/idle from its own parser — see
+ * {@link computeLiveSignals}, {@link lifecycleStatus} and {@link resolveFallbackStatus}.
  */
-export type ActiveStatus = 'running' | 'idle' | 'queued' | 'input_required' | 'unknown';
+export type ActiveStatus = 'running' | 'idle' | 'queued' | 'input_required' | 'closed' | 'abandoned' | 'unknown';
 export interface ActiveSession {
     context: ActiveContext;
     kind: string;
@@ -109,6 +131,14 @@ export interface ActiveSession {
      * Absent for cloud sessions (no local pid) and any pid whose env is unreadable.
      */
     provenance?: SessionProvenance;
+    /**
+     * Who initiated this session — the resolved actor id stamped at spawn
+     * (`resolveActor().id`, read back from the pid registry / teammate record).
+     * A tailnet login/email for a resolved human, `UNRESOLVED@<host>` when it
+     * couldn't be determined, absent when the launch predates actor stamping.
+     * Surfaced as the owner column in `--active` (RUSH-2018).
+     */
+    owner?: string;
     /**
      * The machine this session runs on, as a normalized device id (machineId()
      * form). Set when merging cross-machine results so the grouped `--active`
@@ -172,6 +202,16 @@ export interface ActiveQueryOptions {
  * transcript just because a GUI app service with the same basename is alive.
  */
 export declare const ACTIVE_SESSION_STALE_MS: number;
+/**
+ * A session whose transcript hasn't been written in this long is ABANDONED /
+ * dangling — the framework can no longer treat it as live work, whether its PID
+ * is dead (long gone) or still alive but making no progress (a hung agent).
+ * Two days: past a normal work gap, well short of a session legitimately kept
+ * open across a long weekend. Deliberately far wider than
+ * {@link ACTIVE_SESSION_STALE_MS} (which bounds transcript-borrowing, a different
+ * concern) — this is the lifecycle threshold, not the freshness window.
+ */
+export declare const ABANDONED_STALE_MS: number;
 /**
  * Resolve an agent kind from a process's reported executable. `comm` may be an
  * absolute path (shim-launched agents), and Windows image names carry an
@@ -189,6 +229,13 @@ export declare function agentKindFromComm(commRaw: string): string | undefined;
  * the start time can't be read, we keep the existence answer.
  */
 export declare function isPidAlive(pid: number, startedAtMs?: number): boolean;
+/**
+ * Resolve a Claude transcript for `cwd` across the given project roots, newest
+ * mtime winning when the same id/cwd resolves in more than one version home
+ * (the actively-written copy is the newest). Pure over `projectRoots`, so it is
+ * testable against temp dirs without touching the real home directory.
+ */
+export declare function pickClaudeSessionFileAcrossRoots(projectRoots: string[], cwd: string, sessionId?: string): string | undefined;
 /**
  * Pick a Claude transcript file within a project dir.
  *
@@ -212,30 +259,74 @@ export declare function sessionFileTimes(sessionFile: string | undefined): {
     birthtimeMs?: number;
     mtimeMs?: number;
 };
+/**
+ * The lifecycle status computed purely from the two hard signals the framework
+ * always has — PID liveness and transcript last-write (mtime) — independent of
+ * anything the agent self-reports or what its last transcript turn happened to
+ * look like. Returns the definitive lifecycle label when one applies, or
+ * `undefined` when the process is live and fresh (so the caller uses the richer
+ * activity-derived status instead).
+ *
+ *   - No write in {@link ABANDONED_STALE_MS} ⇒ `abandoned` (dangling): a
+ *     days-stale session is not live work, whether its PID is dead (long gone)
+ *     or still alive but stuck. Checked first — it outranks a bare `closed`.
+ *   - Otherwise, PID dead ⇒ `closed`: the process has exited. This is the fix
+ *     for the old "dead PID reports idle" lie — `idle` reads as "done, waiting
+ *     for you", but a dead process is done, period.
+ *   - Otherwise (alive + fresh) ⇒ `undefined`: defer to the activity engine.
+ */
+export declare function lifecycleStatus(pidAlive: boolean, mtimeMs: number | undefined, nowMs?: number): ActiveStatus | undefined;
 /**
  * The ONE place a fallback status is decided when no rich transcript state is
- * available — a non-Claude/Codex kind we cannot parse, or a Claude/Codex tail
- * that was empty or unreadable. Honest by construction: it never asserts a status
- * it cannot justify from a measured signal.
+ * available — an opaque kind we cannot parse (cursor, openclaw), or a transcript
+ * whose parse/tail was empty or unreadable. Honest by construction: computed from
+ * PID + mtime, never a fabricated `idle`.
  *
- *   - Resolvable transcript, readable mtime → the MEASURED freshness signal:
- *     written within ACTIVE_MTIME_WINDOW_MS ⇒ `running`, else `idle`.
- *   - Resolvable transcript whose `stat` throws (file vanished / permission) → we
- *     genuinely cannot tell ⇒ `unknown`. (This branch previously returned
- *     `running`, which contradicted the `idle` default one branch up.)
- *   - No resolvable transcript but the process is alive → alive-but-opaque ⇒
- *     `unknown`. This is the truthful answer for a live gemini / droid / cursor /
- *     opencode whose format we don't parse — NOT a fabricated `idle` (which the
- *     UI reads as "done and waiting"), and it never lies as `running` either.
- *   - No transcript and the process is not known alive → nothing to report ⇒ `idle`.
+ *   - Dead PID, or a days-stale transcript ⇒ {@link lifecycleStatus} (`closed` /
+ *     `abandoned`). A dead process is `closed`, not the old fabricated `idle`
+ *     (which the UI reads as "done, waiting for you"); a dead process whose file
+ *     also vanished is still `closed` (death is a definitive answer, not `unknown`).
+ *   - Live + fresh ⇒ `running`. A live process is, at minimum, running: we may
+ *     not see WHAT an opaque harness (or an empty tail) is doing, but the process
+ *     being alive is a positive signal — never a blank `unknown` (the old blanket
+ *     bug for every non-claude/codex live agent) nor a downgraded `idle`.
  */
-export declare function resolveFallbackStatus(sessionFile: string | undefined, pidAlive: boolean): ActiveStatus;
+export declare function resolveFallbackStatus(sessionFile: string | undefined, pidAlive: boolean, nowMs?: number): ActiveStatus;
 /**
- * Locate the live transcript for an agent process. Claude files are keyed by
- * cwd (+ optional session uuid); Codex files are date-partitioned, so we resolve
- * the newest indexed Codex session for the cwd instead.
+ * Locate the live transcript for an agent process. Claude files are keyed by cwd
+ * (+ optional session uuid), so they resolve straight off disk. Every OTHER
+ * tracked harness — Codex (date-partitioned), plus grok / droid / rush / gemini /
+ * kimi / hermes / opencode / antigravity (per-session dirs, SQLite, single-JSON)
+ * — is resolved through the session index by cwd: the newest indexed transcript
+ * for that cwd, bounded by ACTIVE_SESSION_STALE_MS so a live pid never borrows a
+ * weeks-old transcript. This is what lets a live NON-claude/codex agent get a real
+ * status instead of falling through to `unknown` (the file feeds
+ * {@link computeLiveSignals}). An opaque kind we don't track (cursor) still yields
+ * undefined here and degrades honestly to a live `running`.
  */
 export declare function findSessionFileForKind(kind: string, cwd?: string, sessionId?: string): string | undefined;
+/** Live per-session signals derived from one transcript-tail read. */
+interface LiveSignals {
+    /** Rich inferred state (activity/preview/badges). Undefined when unreadable. */
+    state?: SessionState;
+    /** Rolling output-token throughput (tokens/sec). Undefined when no usage in the tail. */
+    tokPerSec?: number;
+}
+/**
+ * Derive the inferred state (working / waiting / idle + preview/badges) and, for
+ * the two harnesses whose raw lines carry it, the output-token throughput.
+ *
+ * Claude/Codex take the fast bounded byte-tail ({@link readSessionTailWithRaw}) —
+ * the hot path, and the only two that also yield throughput (their raw lines
+ * carry usage the event model drops). EVERY OTHER tracked harness (grok, droid,
+ * rush, gemini, kimi, hermes, opencode, antigravity) is parsed with its own
+ * parser and run through the SAME {@link inferSessionState}, so a live
+ * non-claude/codex agent gets a real working/waiting/idle instead of the blanket
+ * `unknown` it used to fall through to. An opaque/untracked kind (cursor) or an
+ * unreadable/empty transcript yields an empty signal set, and the caller's
+ * {@link resolveFallbackStatus} reports the honest live floor (`running`).
+ */
+export declare function computeLiveSignals(kind: string, sessionFile: string | undefined, cwd: string | undefined, pidAlive: boolean): LiveSignals;
 /** Live teams teammates. Reuses AgentManager which already polls PIDs via `kill -0`. */
 export declare function listTeamsActive(): Promise<ActiveSession[]>;
 /** Live editor-terminal agents across every IDE window. */