@phnx-labs/agents-cli 1.22.105 → 1.22.107

package/dist/lib/accounting/usage.js

@@ -1790,10 +1790,17 @@ export function writeClaudeUsageCache(usageKey, snapshot, cachePath = getClaudeU
             // refresh cannot drop another account's row (lost update).
             const cache = readClaudeUsageCacheFile(cachePath);
             const prior = cache[usageKey];
-            cache[usageKey] = serializeClaudeUsageSnapshot({
-                ...snapshot,
-                unavailable: carryForwardUnavailable(prior?.unavailable, snapshot.unavailable),
-            });
+            cache[usageKey] = {
+                ...serializeClaudeUsageSnapshot({
+                    ...snapshot,
+                    unavailable: carryForwardUnavailable(prior?.unavailable, snapshot.unavailable),
+                }),
+                // A per-model refusal has its own independent lifecycle (see
+                // noteClaudeModelRefusal / clearClaudeModelRefusal) — a global usage
+                // write must never drop it, the same reason `unavailable` is carried
+                // forward above rather than overwritten.
+                modelRefusals: prior?.modelRefusals,
+            };
             atomicWriteFileSync(cachePath, JSON.stringify(cache, null, 2), 'utf-8');
         });
     }
@@ -1814,12 +1821,16 @@ export function mergeClaudeUsageCacheWindows(usageKey, snapshot, cachePath = get
             const windows = new Map(priorSnapshot?.windows.map((window) => [window.key, window]) ?? []);
             for (const window of snapshot.windows)
                 windows.set(window.key, window);
-            cache[usageKey] = serializeClaudeUsageSnapshot({
-                ...snapshot,
-                windows: [...windows.values()],
-                plan: snapshot.plan ?? priorSnapshot?.plan ?? null,
-                unavailable: carryForwardUnavailable(prior?.unavailable, snapshot.unavailable),
-            });
+            cache[usageKey] = {
+                ...serializeClaudeUsageSnapshot({
+                    ...snapshot,
+                    windows: [...windows.values()],
+                    plan: snapshot.plan ?? priorSnapshot?.plan ?? null,
+                    unavailable: carryForwardUnavailable(prior?.unavailable, snapshot.unavailable),
+                }),
+                // See writeClaudeUsageCache: a per-model refusal survives a windows-only merge too.
+                modelRefusals: prior?.modelRefusals,
+            };
             atomicWriteFileSync(cachePath, JSON.stringify(cache, null, 2), 'utf-8');
         });
     }
@@ -2004,7 +2015,8 @@ function deserializeClaudeUsageSnapshot(snapshot, now) {
         staleWindows.length === 0 &&
         !unavailable &&
         !snapshot.plan &&
-        !snapshot.refreshHint) {
+        !snapshot.refreshHint &&
+        !hasLiveModelRefusal(snapshot.modelRefusals, now)) {
         return null;
     }
     return {
@@ -2051,6 +2063,17 @@ function deserializeUnavailable(cached, now) {
         ? { reason: 'session_limit', resetsAt: reset }
         : undefined;
 }
+/** Whether any per-model refusal in the row is still live (not clock-expired). */
+function hasLiveModelRefusal(modelRefusals, now) {
+    if (!modelRefusals)
+        return false;
+    return Object.values(modelRefusals).some((entry) => {
+        if (!entry.resetsAt)
+            return true; // no clock given — sticky until cleared
+        const reset = parseDateValue(entry.resetsAt);
+        return !reset || reset.getTime() > now.getTime();
+    });
+}
 /**
  * Persist a Claude tokens/credits exhaustion (`out of usage credits` / `monthly
  * spend limit`) from a real run. Unlike a rate/session limit this does NOT reset
@@ -2115,6 +2138,132 @@ export function noteClaudeSessionLimit(usageKey, resetsAt, cachePath = getClaude
         /* best-effort cache write — lock busy or disk full */
     }
 }
+/**
+ * Persist a Claude MODEL-specific refusal — "You've reached your Fable limit.
+ * Run /usage-credits to continue or switch models with /model." — a distinct
+ * class from {@link noteClaudeOutOfCredits} / {@link noteClaudeSessionLimit}:
+ * those exclude the whole account, this excludes only ONE model on it (an
+ * organization quota group can meter models separately). `accountKey` MUST be
+ * the candidate's stable native-account key (see `candidateAccountKey` in
+ * rotate.ts), never the org-shared `usageKey` — using the org key here would
+ * poison every sibling account under that org for a limit that named one
+ * model on one login. No invented reset: `resetsAt` is written only when the
+ * refusal text carried one; otherwise the marker is sticky until a later
+ * successful run on this exact (account, model) clears it via
+ * {@link clearClaudeModelRefusal}.
+ */
+export function claudeModelRefusalKey(accountId, home) {
+    if (accountId)
+        return `account:${accountId}`;
+    if (!home)
+        return undefined;
+    try {
+        return `context:${fs.realpathSync(home)}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+function modelFamily(model) {
+    const normalized = model.trim().toLowerCase();
+    return /(?:^|[-\s])(fable|sonnet|opus|haiku)(?:$|[-\s\d])/.exec(normalized)?.[1] ?? normalized;
+}
+export function noteClaudeModelRefusal(accountKey, model, refusal, cachePath = getClaudeUsageCachePath()) {
+    try {
+        ensureLockTarget(cachePath, '{}');
+        withFileLock(cachePath, () => {
+            const cache = readClaudeUsageCacheFile(cachePath);
+            const existing = cache[accountKey] ?? { capturedAt: null, windows: [] };
+            const modelRefusals = { ...(existing.modelRefusals ?? {}) };
+            modelRefusals[modelFamily(refusal.family ?? model)] = {
+                family: refusal.family,
+                resetsAt: refusal.resetsAt?.toISOString(),
+            };
+            cache[accountKey] = { ...existing, modelRefusals };
+            atomicWriteFileSync(cachePath, JSON.stringify(cache, null, 2), 'utf-8');
+        });
+    }
+    catch {
+        /* best-effort cache write — lock busy or disk full */
+    }
+}
+/**
+ * Clear a persisted model-refusal marker for exactly ONE (account, model)
+ * pair after a run SUCCEEDS on that same account+model. Never clears a
+ * sibling model on the same account, and never fires for an interactive
+ * detach or an unknown outcome — the caller must have demonstrated an actual
+ * completed success on this exact model before calling this.
+ */
+export function clearClaudeModelRefusal(accountKey, model, cachePath = getClaudeUsageCachePath()) {
+    model = modelFamily(model);
+    try {
+        if (!fs.existsSync(cachePath))
+            return;
+        withFileLock(cachePath, () => {
+            const cache = readClaudeUsageCacheFile(cachePath);
+            const existing = cache[accountKey];
+            if (!existing?.modelRefusals?.[model])
+                return;
+            const modelRefusals = { ...existing.modelRefusals };
+            delete modelRefusals[model];
+            const rest = { ...existing, modelRefusals };
+            if (Object.keys(modelRefusals).length === 0)
+                delete rest.modelRefusals;
+            cache[accountKey] = rest;
+            atomicWriteFileSync(cachePath, JSON.stringify(cache, null, 2), 'utf-8');
+        });
+    }
+    catch {
+        /* best-effort cache write */
+    }
+}
+/**
+ * Read a live (non-expired) model-refusal marker for (accountKey, model), or
+ * null when none is recorded or the recorded one has passed its clock. A
+ * marker with no `resetsAt` never expires here — it is sticky until
+ * {@link clearClaudeModelRefusal} observes a real success.
+ */
+export function getClaudeModelRefusal(accountKey, model, nowMs = Date.now(), cachePath = getClaudeUsageCachePath()) {
+    const cache = readClaudeUsageCacheFile(cachePath);
+    const entry = cache[accountKey]?.modelRefusals?.[modelFamily(model)];
+    if (!entry)
+        return null;
+    if (entry.resetsAt) {
+        const reset = parseDateValue(entry.resetsAt);
+        if (reset && reset.getTime() <= nowMs)
+            return null;
+        return { family: entry.family, resetsAt: reset };
+    }
+    return { family: entry.family, resetsAt: null };
+}
+/**
+ * Parse Claude's model-specific refusal — the CLI's own phrasing when ONE
+ * model's quota is exhausted while the account otherwise keeps serving:
+ * "You've reached your Fable limit. Run /usage-credits to continue or switch
+ * models with /model." Deliberately narrow (unlike the broad RATE_LIMIT_PATTERNS
+ * scan) so a session that merely discusses `/usage-credits` cannot false-positive.
+ * Tolerates both a straight and curly apostrophe.
+ */
+export function parseClaudeModelRefusal(text) {
+    const candidates = [text];
+    for (const line of text.split('\n')) {
+        try {
+            const row = JSON.parse(line);
+            if (row.type === 'result' && row.is_error && typeof row.result === 'string')
+                candidates.push(row.result);
+            if (row.type === 'assistant' && row.isApiErrorMessage && Array.isArray(row.message?.content)) {
+                candidates.push(row.message.content.filter((block) => block.type === 'text').map((block) => block.text ?? '').join('\n'));
+            }
+        }
+        catch { /* Plain terminal output is checked directly. */ }
+    }
+    for (const candidate of candidates) {
+        const match = /(?:^|\n)\s*You['’]ve reached your ([^\n.]+) limit\.\s*Run \/usage-credits to continue or switch models with \/model\./i.exec(candidate);
+        if (match)
+            return { family: match[1].trim() };
+    }
+    return null;
+}
 /** Parse Claude's `hit your session limit · resets …` refusal. */
 export function parseClaudeSessionLimitReset(text, nowMs = Date.now()) {
     if (!/hit your session limit/i.test(text))

package/dist/lib/exec-account-home.d.ts

@@ -54,4 +54,6 @@ export declare function resolveNativeSpawnHome(agent: AgentId, account: {
     id: string;
     name: string;
     agent: AgentId;
-}, meta?: Pick<Meta, 'accounts' | 'deviceAccounts'>): Promise<NativeSpawnHome>;
+}, meta?: Pick<Meta, 'accounts' | 'deviceAccounts'>, options?: {
+    readOnly?: boolean;
+}): Promise<NativeSpawnHome>;

package/dist/lib/exec-account-home.js

@@ -173,13 +173,13 @@ async function matchLegacyIdentityHome(agent, account, meta) {
  * Existing slot, then a provisionable worker slot, then a leftover `homes`
  * label, then identity match across installed homes, then fail loud.
  */
-export async function resolveNativeSpawnHome(agent, account, meta = { accounts: undefined, deviceAccounts: undefined }) {
+export async function resolveNativeSpawnHome(agent, account, meta = { accounts: undefined, deviceAccounts: undefined }, options = {}) {
     const slot = readSlots(meta)[account.id];
     if (slot && fs.existsSync(slot.slotDir)) {
         return { execHome: slot.slotDir, source: 'slot', slot };
     }
     const row = nativeRow(account.id, meta);
-    if (row && isProvisionableWorker(row)) {
+    if (!options.readOnly && row && isProvisionableWorker(row)) {
         const provisioned = provisionWorkerSlot(row);
         return { execHome: provisioned.slotDir, source: 'provisioned', slot: provisioned };
     }

package/dist/lib/exec.d.ts

@@ -244,6 +244,17 @@ export interface ExecOptions {
     launchSignedIn?: boolean | null;
     /** Precomputed account email companion to {@link launchSignedIn}. */
     launchEmail?: string | null;
+    /**
+     * Stable native-account registry id this run authenticates as (the same
+     * identity `candidateAccountKey`/`modelRefusalAccountKey` key on) —
+     * independent of `version`, which is the binary rather than the account
+     * identity for a slot launch (PHNX-3940 T5). Exported to
+     * `AGENTS_RUN_ACCOUNT_ID` and stamped on the session-actor sidecar so a
+     * later model-refusal lookup or recovery pick can resolve the exact account
+     * a session ran under, not just the version home it launched from. Absent
+     * for a run whose account identity isn't resolved at launch time.
+     */
+    accountId?: string;
 }
 /**
  * Identity a custom-harness run stamps on env / pid-registry / sidecars.
@@ -656,12 +667,27 @@ export type ClaudeRefusalAction = {
     resetsAt: Date;
 } | {
     action: 'note_out_of_credits';
+} | {
+    action: 'note_model_limit';
+    model: string;
+    family: string;
 } | {
     action: 'clear';
 } | {
     action: 'none';
 };
-export declare function classifyClaudeRunRefusal(output: string, exitCode: number): ClaudeRefusalAction;
+/**
+ * Classify a Claude run's output + exit code, model-limit refusal included.
+ * Precedence: a session-limit reset first (it carries a clock), then a
+ * clock-less billing exhaustion, then a MODEL-specific refusal ("You've
+ * reached your Fable limit…") — checked BEFORE the exit-0 clear so a model
+ * refusal that ends the run with exit 0 is never misread as a clean success
+ * that clears every other stale marker on the account. A model refusal never
+ * maps to `note_out_of_credits`/`note_session`: those are account-wide, this
+ * names one model. Only a clean run with NO refusal text clears stale
+ * markers; anything else leaves them untouched.
+ */
+export declare function classifyClaudeRunRefusal(output: string, exitCode: number, model?: string): ClaudeRefusalAction;
 /**
  * Parse Codex's usage-limit refusal reset. Codex prints
  * `ERROR: You've hit your usage limit. … try again at Sep 12th, 2026 8:32 AM.`

package/dist/lib/exec.js

@@ -44,7 +44,8 @@ import { resolveHarnessAdapter, stripForeignConfigDir } from './harness/index.js
 import { claudeWorkerLoginTrapPreflight } from './harness/adapters/claude.js';
 import { resolveConfigVersion } from './harness/exec-config-version.js';
 import { getAccountInfo } from './agents.js';
-import { getUsageLookupKey, noteClaudeSessionLimit, noteClaudeOutOfCredits, clearClaudeAccountRefusal, parseClaudeSessionLimitReset } from './accounting/usage.js';
+import { getUsageLookupKey, noteClaudeSessionLimit, noteClaudeOutOfCredits, clearClaudeAccountRefusal, parseClaudeSessionLimitReset, noteClaudeModelRefusal, clearClaudeModelRefusal, parseClaudeModelRefusal, claudeModelRefusalKey, } from './accounting/usage.js';
+import { claudeProjectDirName } from './project-key.js';
 import { bootMark, flushBootProfile } from './boot-profile.js';
 /**
  * Map a raw mode string (CLI flag, YAML field, env var) to the canonical Mode.
@@ -445,6 +446,15 @@ export function buildExecEnv(options) {
     else {
         delete result.AGENTS_EXEC_HOME;
     }
+    // Durable account identity for this run (PHNX-3940 model-refusal tracking).
+    // Cleared when absent so a run spawned from inside an account-scoped session
+    // never inherits its parent's account id.
+    if (options.accountId) {
+        result.AGENTS_RUN_ACCOUNT_ID = options.accountId;
+    }
+    else {
+        delete result.AGENTS_RUN_ACCOUNT_ID;
+    }
     // Export the run's durable name (companion to AGENT_SESSION_ID) so a
     // SessionStart hook / the agent can associate its transcript with the handle
     // the user gave the run. Only set when --name was passed.
@@ -471,7 +481,7 @@ export function ensureVendorHomeDir(agent, versionHome) {
 }
 function resolveExecConfigHome(options) {
     if (options.execHome) {
-        const resolved = options.version
+        const resolved = options.configVersion ?? options.version
             ?? resolveConfigVersion(options.agent, options.cwd || process.cwd(), options.version).version;
         return { version: resolved ?? null, versionHome: options.execHome };
     }
@@ -1430,22 +1440,31 @@ async function runInTmux(options, executable, args) {
     const name = slugifyName(`ag-${options.agent}-${idSeed}`);
     const RED = '\x1b[31m', GRAY = '\x1b[90m', OFF = '\x1b[0m';
     const NO_TMUX_TIP = `${GRAY}  This run used the opt-in tmux wrap. Re-run with --no-tmux for a direct launch, or turn the wrap off: agents config set devices.${machineId()}.tmux off${OFF}\n\n`;
+    // Read a dead pane's scrollback. Must run BEFORE killSession — capture-pane
+    // needs the session still alive (remain-on-exit keeps the dead pane readable
+    // until we tear it down). Best-effort: a missing/gone pane just yields ''.
+    // Callers thread this into SpawnResult.stdout for a GENUINELY dead pane only
+    // (positive proof from paneExitStatus) — never for the "still alive, user
+    // detached" or "outcome unknown" paths below, so an interactive detach or an
+    // unresolved tmux race can never masquerade as refusal evidence.
+    const capturePaneTail = async (pane) => {
+        if (!pane)
+            return '';
+        try {
+            const r = await runTmux({ socket, args: ['capture-pane', '-p', '-t', pane, '-S', '-200'], throwOnError: false });
+            return r.code === 0 ? formatPaneTail(r.stdout) : '';
+        }
+        catch {
+            return '';
+        }
+    };
     // Recap a dead pane's tail into THIS shell's stderr. The pane-died hook
     // detaches the client the instant the agent exits, so a fast failure (a
     // gutted install that dies with ENOENT, a bad flag, a crash on startup) would
-    // otherwise leave only a bare `[detached]` with no clue why. Must run BEFORE
-    // killSession — capture-pane needs the session still alive (remain-on-exit
-    // keeps the dead pane readable until we tear it down). Best-effort throughout.
-    const surfacePaneFailure = async (pane, status, headline) => {
+    // otherwise leave only a bare `[detached]` with no clue why.
+    const surfacePaneFailure = async (pane, status, headline, tail) => {
         if (!pane)
             return;
-        let tail = '';
-        try {
-            const r = await runTmux({ socket, args: ['capture-pane', '-p', '-t', pane, '-S', '-200'], throwOnError: false });
-            if (r.code === 0)
-                tail = formatPaneTail(r.stdout);
-        }
-        catch { /* best-effort — a missing pane just means no recap */ }
         process.stderr.write(`\n${RED}agents: ${headline} (exit ${status ?? UNKNOWN_OUTCOME_EXIT_CODE}).${OFF}\n`);
         if (tail) {
             process.stderr.write(`${GRAY}  ── last output from ${options.agent} ──${OFF}\n`);
@@ -1477,18 +1496,25 @@ async function runInTmux(options, executable, args) {
     const resolveAfterAttach = async (pane) => {
         const after = pane ? await paneExitStatus(pane, socket) : { found: false, dead: false, status: undefined };
         if (after.dead) {
+            // Positive proof of a genuinely completed pane (paneExitStatus confirmed
+            // dead) — capture its scrollback as refusal evidence for the caller
+            // (classifyClaudeRunRefusal etc.) BEFORE tearing the session down.
+            // Deliberately not done for the "alive" (detach) or "unknown" branches
+            // below: neither is a demonstrated completion, so neither may carry
+            // evidence a caller could mistake for a real refusal or success.
+            const tail = await capturePaneTail(pane);
             // Nonzero exit after attach → the agent crashed rather than the user
             // detaching cleanly (a clean detach leaves the pane ALIVE, handled below).
             // F2: for interactive runs, also recap a clean exit-0 — the harness exited
             // without error but without starting a REPL, which is still a failure.
             if (shouldRecapDeadPane(after.status, resolveInteractive(options))) {
-                await surfacePaneFailure(pane, after.status, `${options.agent} exited`);
+                await surfacePaneFailure(pane, after.status, `${options.agent} exited`, tail);
             }
             await killSession(name, socket).catch(() => { });
             // A dead pane whose status tmux never reported is UNKNOWN, not success —
             // and surfacePaneFailure already printed `exit 1` for it, so the old
             // `?? 0` made the message and the returned code disagree (EXEC-23b).
-            return { exitCode: tmuxRunExitCode(after, false), stderr: '', stdout: '' };
+            return { exitCode: tmuxRunExitCode(after, false), stderr: '', stdout: tail };
         }
         // after.dead===false, but that could be a stale/unreadable-pane result.
         // Require positive proof before keeping the session as "user detached".
@@ -1618,6 +1644,7 @@ async function runInTmux(options, executable, args) {
                 initiatedBy: resolveActor().kind,
                 phoenixId: resolveActor().phoenixId,
                 harness: customHarnessName(options),
+                accountId: options.accountId,
                 startedAtMs: Date.now(),
             });
         }
@@ -1626,18 +1653,22 @@ async function runInTmux(options, executable, args) {
     // already-dead pane — surface its output + status directly and tear down.
     const before = pane ? await paneExitStatus(pane, socket) : { found: false, dead: false, status: undefined };
     if (before.dead) {
+        // Positive proof of a genuinely completed pane — capture scrollback as
+        // refusal evidence before tearing the session down (see the matching
+        // comment in resolveAfterAttach).
+        const tail = await capturePaneTail(pane);
         // F2 (RUSH-2185 / EXEC-23a): for interactive runs, ALWAYS recap — a clean
         // exit-0 before attach means the harness has no interactive REPL and the
         // user would see only a bare `[detached]` with no clue why. For headless
         // runs the old quiet behaviour stands: exit-0 is a successful quick run.
         if (shouldRecapDeadPane(before.status, resolveInteractive(options))) {
-            await surfacePaneFailure(pane, before.status, `${options.agent} exited before it could start`);
+            await surfacePaneFailure(pane, before.status, `${options.agent} exited before it could start`, tail);
         }
         await killSession(name, socket).catch(() => { });
         // A dead pane whose status tmux never reported is an UNKNOWN outcome, not a
         // success — and the banner one line up already printed `exit 1` for it, so
         // the old `?? 0` also made the message and the returned code disagree.
-        return { exitCode: tmuxRunExitCode(before, false), stderr: '', stdout: '' };
+        return { exitCode: tmuxRunExitCode(before, false), stderr: '', stdout: tail };
     }
     await attachTmux({ socket, args: ['attach-session', '-t', name] });
     return resolveAfterAttach(pane);
@@ -1756,10 +1787,74 @@ async function emitRunLaunch(ctx) {
     }
 }
 async function spawnAgent(options) {
+    if (options.agent === 'claude' && !options.resume && !options.sessionId)
+        options = { ...options, sessionId: randomUUID() };
     const version = options.version ?? resolveVersion(options.agent, options.cwd || process.cwd());
-    if (!version || !isVersionInstalled(options.agent, version))
-        return spawnAgentLeased(options);
-    return withInstallationLease(options.agent, version, () => spawnAgentLeased(options));
+    const home = resolveExecConfigHome(options).versionHome;
+    const modelKey = claudeModelRefusalKey(options.accountId, home);
+    const transcript = options.agent === 'claude' && home && options.sessionId
+        ? path.join(home, '.claude', 'projects', claudeProjectDirName(options.cwd || process.cwd()), `${options.sessionId}.jsonl`)
+        : undefined;
+    let offset = transcript && fs.existsSync(transcript) ? fs.statSync(transcript).size : 0;
+    const observeTranscript = () => {
+        if (!transcript || !modelKey)
+            return;
+        try {
+            const size = fs.statSync(transcript).size;
+            if (size <= offset)
+                return;
+            const start = Math.max(offset, size - 64 * 1024);
+            const fd = fs.openSync(transcript, 'r');
+            const bytes = Buffer.alloc(size - start);
+            try {
+                fs.readSync(fd, bytes, 0, bytes.length, start);
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+            const text = bytes.toString('utf8');
+            const lastNewline = text.lastIndexOf('\n');
+            if (lastNewline < 0)
+                return;
+            offset = start + Buffer.byteLength(text.slice(0, lastNewline + 1));
+            for (const line of text.slice(0, lastNewline).split('\n')) {
+                try {
+                    const row = JSON.parse(line);
+                    if (row.type !== 'assistant')
+                        continue;
+                    const content = Array.isArray(row.message?.content) ? row.message.content.filter((block) => block.type === 'text').map((block) => block.text ?? '').join('\n') : '';
+                    const refusal = row.isApiErrorMessage ? parseClaudeModelRefusal(content) : null;
+                    if (refusal)
+                        noteClaudeModelRefusal(modelKey, refusal.family, { family: refusal.family });
+                    else if (!row.isApiErrorMessage && row.message?.model && content.trim())
+                        clearClaudeModelRefusal(modelKey, row.message.model);
+                }
+                catch { /* Partial or non-message transcript rows provide no evidence. */ }
+            }
+        }
+        catch { /* Transcript observation must not interrupt the harness. */ }
+    };
+    const observer = transcript ? setInterval(observeTranscript, 2_000) : undefined;
+    observer?.unref();
+    try {
+        const observedOptions = options.agent === 'claude' ? { ...options, captureStdoutTail: true } : options;
+        const result = !version || !isVersionInstalled(options.agent, version)
+            ? await spawnAgentLeased(observedOptions)
+            : await withInstallationLease(options.agent, version, () => spawnAgentLeased(observedOptions));
+        observeTranscript();
+        if (options.agent === 'claude' && modelKey) {
+            const refusal = parseClaudeModelRefusal(`${result.stderr}\n${result.stdout}`);
+            if (refusal) {
+                noteClaudeModelRefusal(modelKey, refusal.family, { family: refusal.family });
+                return { ...result, exitCode: result.exitCode || 1 };
+            }
+        }
+        return result;
+    }
+    finally {
+        if (observer)
+            clearInterval(observer);
+    }
 }
 async function spawnAgentLeased(options) {
     bootMark('spawn-agent:enter');
@@ -1987,6 +2082,7 @@ async function spawnAgentLeased(options) {
                 initiatedBy: resolveActor().kind,
                 phoenixId: resolveActor().phoenixId,
                 harness: customHarnessName(options),
+                accountId: options.accountId,
                 startedAtMs: Date.now(),
             });
         }
@@ -2193,12 +2289,27 @@ const OUT_OF_CREDITS_PATTERNS = [
 export function detectOutOfCredits(text) {
     return OUT_OF_CREDITS_PATTERNS.some(pattern => pattern.test(text));
 }
-export function classifyClaudeRunRefusal(output, exitCode) {
+/**
+ * Classify a Claude run's output + exit code, model-limit refusal included.
+ * Precedence: a session-limit reset first (it carries a clock), then a
+ * clock-less billing exhaustion, then a MODEL-specific refusal ("You've
+ * reached your Fable limit…") — checked BEFORE the exit-0 clear so a model
+ * refusal that ends the run with exit 0 is never misread as a clean success
+ * that clears every other stale marker on the account. A model refusal never
+ * maps to `note_out_of_credits`/`note_session`: those are account-wide, this
+ * names one model. Only a clean run with NO refusal text clears stale
+ * markers; anything else leaves them untouched.
+ */
+export function classifyClaudeRunRefusal(output, exitCode, model) {
     const sessionLimitReset = parseClaudeSessionLimitReset(output);
     if (sessionLimitReset)
         return { action: 'note_session', resetsAt: sessionLimitReset };
     if (detectOutOfCredits(output))
         return { action: 'note_out_of_credits' };
+    const modelRefusal = parseClaudeModelRefusal(output);
+    if (modelRefusal) {
+        return { action: 'note_model_limit', model: model ?? modelRefusal.family, family: modelRefusal.family };
+    }
     if (exitCode === 0)
         return { action: 'clear' };
     return { action: 'none' };
@@ -2500,29 +2611,41 @@ export async function runWithFallback(options) {
         // harnesses), so one path notes either. Decisions extracted + unit-tested in
         // classify{Claude,Codex}RunRefusal.
         const refusal = agent === 'claude'
-            ? classifyClaudeRunRefusal(output, result.exitCode ?? 1)
+            ? classifyClaudeRunRefusal(output, result.exitCode ?? 1, execOpts.model)
             : agent === 'codex'
                 ? classifyCodexRunRefusal(output, result.exitCode ?? 1)
                 : null;
         const sessionLimitReset = refusal?.action === 'note_session' ? refusal.resetsAt : null;
         if (refusal && version && refusal.action !== 'none') {
-            const account = await getAccountInfo(agent, getVersionHomePath(agent, version));
+            // Resolve the account from the HOME this attempt actually authenticated
+            // from — execHome (a slot dir, PHNX-3940 T5) or configVersion wins over
+            // the bare managed-binary version home. Reading `getVersionHomePath(agent,
+            // version)` unconditionally attributed a refusal to the wrong account for
+            // every account-slot / configVersion launch, since `version` there is the
+            // BINARY, not the credential's home.
+            const { versionHome: refusalHome } = resolveExecConfigHome(execOpts);
+            const account = await getAccountInfo(agent, refusalHome ?? getVersionHomePath(agent, version));
             const usageKey = getUsageLookupKey(account);
-            if (usageKey) {
+            if (usageKey && refusal.action !== 'note_model_limit') {
                 if (refusal.action === 'note_session')
                     noteClaudeSessionLimit(usageKey, refusal.resetsAt);
                 else if (refusal.action === 'note_out_of_credits')
                     noteClaudeOutOfCredits(usageKey);
-                else if (refusal.action === 'clear')
+                else if (refusal.action === 'clear' && !resolveInteractive(execOpts))
                     clearClaudeAccountRefusal(usageKey);
             }
         }
-        if (result.exitCode === 0 && !sessionLimitReset)
+        // A model-limit refusal commonly ends the CLI turn with exit 0 (Claude
+        // just refuses to keep going on that model rather than crashing) — so,
+        // like a session-limit reset, it must not be read as a clean success that
+        // short-circuits the cascade before the fallback chain ever runs.
+        const modelLimited = refusal?.action === 'note_model_limit';
+        if (result.exitCode === 0 && !sessionLimitReset && !modelLimited)
             return 0;
         const isLast = i === chain.length - 1;
         if (isLast)
             return result.exitCode || 1;
-        if (!sessionLimitReset && !detectRateLimit(result.stderr) && !detectRateLimit(result.stdout)) {
+        if (!sessionLimitReset && !modelLimited && !detectRateLimit(result.stderr) && !detectRateLimit(result.stdout)) {
             return result.exitCode;
         }
         const next = chain[i + 1];

package/dist/lib/hosts/dispatch.d.ts

@@ -182,7 +182,7 @@ export interface InteractiveDispatchOptions {
     agent: string;
     /** Explicit agent version pin (e.g. "2.1.207") to forward as `agent@version`. */
     version?: string;
-    /** Preserve the trailing-@ account picker so selection happens on the execution host. */
+    /** Preserve the trailing-# account picker so selection happens on the execution host. */
     accountPicker?: boolean;
     /** Explicit run strategy (e.g. "balanced") to forward as `--strategy <strategy>`. */
     strategy?: string;

package/dist/lib/hosts/dispatch.js

@@ -362,7 +362,7 @@ async function launchDetached(host, target, opts) {
 /** Compose `agent[@version][#account]` so the peer resolves ITS slot (PHNX-3940 T5). */
 export function runAgentSpecArg(opts) {
     if (opts.accountPicker)
-        return `${opts.agent}@`;
+        return `${opts.agent}#`;
     let spec = opts.agent;
     if (opts.version)
         spec += `@${opts.version}`;

package/dist/lib/models.d.ts

@@ -187,7 +187,7 @@ export interface ConfiguredModel {
  * Each layer is a real source the agent consults; `version` must be concrete.
  * Returns null only when the agent exposes no model catalog at all.
  */
-export declare function resolveConfiguredModel(agent: AgentId, version: string): ConfiguredModel | null;
+export declare function resolveConfiguredModel(agent: AgentId, version: string, home?: string): ConfiguredModel | null;
 /**
  * Join the identity cluster — `agent@version · model · account` — with a dim
  * separator, dropping empty pieces. Pieces are pre-colored by the caller so the

package/dist/lib/models.js

@@ -1007,11 +1007,11 @@ export function resolveEffectiveModel(agent, version, requested) {
  * Each layer is a real source the agent consults; `version` must be concrete.
  * Returns null only when the agent exposes no model catalog at all.
  */
-export function resolveConfiguredModel(agent, version) {
+export function resolveConfiguredModel(agent, version, home) {
     const runModel = resolveRunDefaults(agent, version).model;
     if (runModel && runModel.trim() !== '')
         return { model: runModel, source: 'run-default' };
-    const nativeModel = readNativeConfigModel(agent, version);
+    const nativeModel = readNativeConfigModel(agent, version, home);
     if (nativeModel)
         return { model: nativeModel, source: 'config' };
     const catalog = getModelCatalog(agent, version);
@@ -1026,9 +1026,9 @@ export function resolveConfiguredModel(agent, version) {
  * (e.g. `~/.agents/.history/versions/claude/<ver>/home/.claude/settings.json`).
  * A missing/malformed file is a fall-through, not an error.
  */
-function readNativeConfigModel(agent, version) {
+function readNativeConfigModel(agent, version, home) {
     try {
-        const settingsPath = path.join(getVersionHomePath(agent, version), agentConfigDirName(agent), 'settings.json');
+        const settingsPath = path.join(home ?? getVersionHomePath(agent, version), agentConfigDirName(agent), 'settings.json');
         const parsed = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
         return typeof parsed.model === 'string' && parsed.model.trim() !== '' ? parsed.model : null;
     }