@phnx-labs/agents-cli 1.22.105 → 1.22.107

package/dist/lib/session/actor-sidecar.d.ts

@@ -14,18 +14,10 @@ export interface SessionActorRecord {
     phoenixId?: string;
     /** Effective permissions mode used by the launcher. */
     mode?: SessionRunMode;
-    /**
-     * The agents-cli version-home id this session launched under (e.g. `2.1.207`,
-     * codex `0.146.0`) — the same namespace `listInstalledVersions` /
-     * `collectRunCandidates` use, so a native resume can pin the exact origin
-     * version. Recorded at launch by the SessionStart hook (from `AGENTS_RUN_VERSION`),
-     * because a harness coins its real session id only AFTER spawn — the same reason
-     * `mode` rides the hook rather than a spawn-time `writeSessionActorRecord`. Joined
-     * onto the session index at scan time so a session whose transcript carries no
-     * embedded/derivable version (codex's `.codex-homes/<version>/` layout) no longer
-     * degrades native resume to `/continue` for lack of a recorded origin (PHNX-3626).
-     */
+    /** Installed executable label at launch; provenance only, never account identity. */
     version?: string;
+    /** Credential account used at launch, independent of the installed executable. */
+    accountId?: string;
     /**
      * Custom harness / profile name when launched via `agents run <profile>`
      * (e.g. `deepseek`). Joined onto the session index at scan time so a

package/dist/lib/session/actor-sidecar.js

@@ -42,6 +42,7 @@ function hasRecordData(record) {
         || typeof record.phoenixId === 'string'
         || typeof record.mode === 'string'
         || typeof record.version === 'string'
+        || typeof record.accountId === 'string'
         || typeof record.harness === 'string'
         || (Array.isArray(record.aliases) && record.aliases.some(alias => typeof alias === 'string'));
 }
@@ -69,6 +70,7 @@ export function writeSessionActorRecord(record) {
         writeRecord({
             ...previous,
             ...record,
+            accountId: previous?.accountId ?? record.accountId,
             aliases: normalizedAliases([...(previous?.aliases ?? []), ...(record.aliases ?? [])]),
         });
     }
@@ -88,6 +90,7 @@ export function writeSessionAliasRecord(sessionId, alias) {
             phoenixId: previous?.phoenixId,
             mode: previous?.mode,
             version: previous?.version,
+            accountId: previous?.accountId,
             harness: previous?.harness,
             aliases: normalizedAliases([...(previous?.aliases ?? []), alias]),
             startedAtMs: previous?.startedAtMs ?? Date.now(),

package/dist/lib/session/claude-accounts.d.ts

@@ -1,63 +1,3 @@
-/**
- * Which Claude account produced a transcript.
- *
- * A Claude `.jsonl` records `sessionId`, `cwd`, `version`, `gitBranch` and per-message
- * `usage`, but carries **no account identity** — no `accountUuid`, no
- * `organizationUuid`, no email. What agents-cli does have is the version layout: every
- * installed version gets its own home with its own `.claude.json` (`CLAUDE_CONFIG_DIR`
- * is swapped per version, see lib/exec.ts), so a home identifies an account.
- *
- * This matters because the default run strategy is `balanced` (lib/rotate.ts), which
- * sprays sessions across every signed-in account. Before this module the scanner
- * resolved ONE email process-globally and stamped it on every Claude session, so a
- * machine with several accounts reported all of its history under whichever one
- * happened to resolve first.
- *
- * Grouping is keyed on the **org** (`usageKey`), never the email: two orgs under one
- * email (a Team seat and a personal Max plan) are separate quota buckets and must stay
- * distinct — the same invariant `candidateIdentity` enforces in lib/rotate.ts.
- *
- * ## Evidence tiers
- *
- * Attribution is a pure function of (path, recorded version). It performs no per-file
- * I/O and does not need the transcript to still exist, which is what lets the v33
- * migration backfill already-indexed rows without re-parsing anything.
- *
- * 1. **The path names a home we can identify.** Strongest: the file physically lives in
- *    that home, including a retired `trash/` snapshot, which keeps its `.claude.json`.
- * 1b. **The path names a home that exists but is signed out.** Dark, named after that
- *    home. The location proves which config dir Claude used, so this deliberately beats
- *    a recorded version — attributing it to some other version's account would be a
- *    guess dressed as evidence.
- * 2. **The path is outside every known home, and the row records a version.** Resolve
- *    that version's own home. Covers the mutable `~/.claude` symlink and the routine
- *    archives under `<historyDir>/runs` that `readRoutineArchiveMeta` feeds in. The
- *    symlink's target moves with `agents use`, so "whatever it points at now" is weak
- *    evidence for old rows: on the machine this was developed against only 684 of 1,334
- *    such rows came from the version the symlink currently names, and 322 came from
- *    versions belonging to a *different* org.
- * 3. **Under the symlink with no recorded version at all.** Its current target is the
- *    only evidence there is, and the bucket says so via `evidence`. A version that IS
- *    recorded but resolves to no home stops at tier 2 and stays dark — it never
- *    reaches here.
- * 4. **None of the above.** An explicitly dark bucket, labelled with why. Never folded
- *    into a real account and never dropped.
- *
- * ## Harness scope: Claude only, deliberately
- *
- * Attribution is implemented for Claude and no other harness. It depends on the
- * per-version home carrying an `oauthAccount` in `.claude.json`, which is what makes a
- * home equal an account. The other harnesses do have per-version credential files
- * (`CREDENTIAL_FILE_SEGMENTS` in lib/agents.ts), so the mechanism generalizes — codex
- * stores an `auth.json` JWT, gemini a `google_accounts.json` — but each needs its own
- * identity extractor and its own notion of a quota bucket, and none of them has the
- * two-orgs-one-email problem that motivated keying on the org here.
- *
- * Until that lands, a non-Claude session has a NULL `account_key` and rolls up under
- * `unattributed:<agent>` — named after its harness rather than implying we tried and
- * failed. `--by account` on `agents insights cost` / `agents insights output` therefore reports Claude
- * accounts plus one bucket per other harness.
- */
 /** The account a transcript is attributed to. */
 export interface ClaudeAccountBucket {
     /**
@@ -84,7 +24,7 @@ interface HomeEntry {
 }
 /** Resolver over the Claude homes present on this machine. */
 export interface ClaudeAccountIndex {
-    /** Version- and trash-home prefixes, longest first. Excludes the `~/.claude` symlink. */
+    /** Version-, account-slot-, and trash-home prefixes, longest first. Excludes the `~/.claude` symlink. */
     entries: HomeEntry[];
     /**
      * Config-dir prefixes of homes that exist but carry no `oauthAccount`. Kept
@@ -102,6 +42,15 @@ export interface ClaudeAccountIndex {
      * as dark rather than guessed.
      */
     byVersion: Map<string, ClaudeAccountBucket | 'ambiguous'>;
+    /**
+     * Account-slot id (`<historyDir>/accounts/claude/<accountId>/`, PHNX-3940) →
+     * the identity read from that slot's own `.claude.json`. A slot's identity is
+     * proven the same way a version home's is — tier 1 evidence, see
+     * {@link resolveClaudeAccount} — so this map exists only to let a launch-
+     * recorded accountId (once the actor sidecar carries one) resolve straight to
+     * a bucket without re-deriving it from a path.
+     */
+    byAccountId: Map<string, ClaudeAccountBucket>;
     /** Whatever `~/.claude` points at right now; tier-3 evidence only. */
     symlinkBucket: ClaudeAccountBucket | null;
     /** Literal prefix of the live symlinked config dir. */
@@ -113,16 +62,6 @@ export interface ClaudeAccountIndex {
  * its version was rotated out stays attributable.
  */
 export declare function buildClaudeAccountIndex(): ClaudeAccountIndex;
-/**
- * The account bucket a transcript belongs to. `recordedVersion` is the Claude CLI
- * version stored on the session row (`sessions.version`), which is what disambiguates
- * rows sitting under the mutable `~/.claude` symlink.
- *
- * Never returns null: a transcript that matches no known home resolves to an
- * explicitly dark bucket rather than being dropped or folded into a real account.
- * Backup mirrors (`<historyDir>/backups/claude/<stamp>/projects/…`) carry no
- * `.claude.json` of their own, so they resolve by recorded version like any other
- * out-of-home path, and go dark only when that version names no home.
- */
-export declare function resolveClaudeAccount(index: ClaudeAccountIndex, filePath: string, recordedVersion?: string | null): ClaudeAccountBucket;
+/** Resolve a quota bucket without replacing recorded login provenance. */
+export declare function resolveClaudeAccount(index: ClaudeAccountIndex, filePath: string, recordedVersion?: string | null, launchAccountId?: string | null): ClaudeAccountBucket;
 export {};

package/dist/lib/session/claude-accounts.js

@@ -1,62 +1,8 @@
 /**
- * Which Claude account produced a transcript.
- *
- * A Claude `.jsonl` records `sessionId`, `cwd`, `version`, `gitBranch` and per-message
- * `usage`, but carries **no account identity** — no `accountUuid`, no
- * `organizationUuid`, no email. What agents-cli does have is the version layout: every
- * installed version gets its own home with its own `.claude.json` (`CLAUDE_CONFIG_DIR`
- * is swapped per version, see lib/exec.ts), so a home identifies an account.
- *
- * This matters because the default run strategy is `balanced` (lib/rotate.ts), which
- * sprays sessions across every signed-in account. Before this module the scanner
- * resolved ONE email process-globally and stamped it on every Claude session, so a
- * machine with several accounts reported all of its history under whichever one
- * happened to resolve first.
- *
- * Grouping is keyed on the **org** (`usageKey`), never the email: two orgs under one
- * email (a Team seat and a personal Max plan) are separate quota buckets and must stay
- * distinct — the same invariant `candidateIdentity` enforces in lib/rotate.ts.
- *
- * ## Evidence tiers
- *
- * Attribution is a pure function of (path, recorded version). It performs no per-file
- * I/O and does not need the transcript to still exist, which is what lets the v33
- * migration backfill already-indexed rows without re-parsing anything.
- *
- * 1. **The path names a home we can identify.** Strongest: the file physically lives in
- *    that home, including a retired `trash/` snapshot, which keeps its `.claude.json`.
- * 1b. **The path names a home that exists but is signed out.** Dark, named after that
- *    home. The location proves which config dir Claude used, so this deliberately beats
- *    a recorded version — attributing it to some other version's account would be a
- *    guess dressed as evidence.
- * 2. **The path is outside every known home, and the row records a version.** Resolve
- *    that version's own home. Covers the mutable `~/.claude` symlink and the routine
- *    archives under `<historyDir>/runs` that `readRoutineArchiveMeta` feeds in. The
- *    symlink's target moves with `agents use`, so "whatever it points at now" is weak
- *    evidence for old rows: on the machine this was developed against only 684 of 1,334
- *    such rows came from the version the symlink currently names, and 322 came from
- *    versions belonging to a *different* org.
- * 3. **Under the symlink with no recorded version at all.** Its current target is the
- *    only evidence there is, and the bucket says so via `evidence`. A version that IS
- *    recorded but resolves to no home stops at tier 2 and stays dark — it never
- *    reaches here.
- * 4. **None of the above.** An explicitly dark bucket, labelled with why. Never folded
- *    into a real account and never dropped.
- *
- * ## Harness scope: Claude only, deliberately
- *
- * Attribution is implemented for Claude and no other harness. It depends on the
- * per-version home carrying an `oauthAccount` in `.claude.json`, which is what makes a
- * home equal an account. The other harnesses do have per-version credential files
- * (`CREDENTIAL_FILE_SEGMENTS` in lib/agents.ts), so the mechanism generalizes — codex
- * stores an `auth.json` JWT, gemini a `google_accounts.json` — but each needs its own
- * identity extractor and its own notion of a quota bucket, and none of them has the
- * two-orgs-one-email problem that motivated keying on the org here.
- *
- * Until that lands, a non-Claude session has a NULL `account_key` and rolls up under
- * `unattributed:<agent>` — named after its harness rather than implying we tried and
- * failed. `--by account` on `agents insights cost` / `agents insights output` therefore reports Claude
- * accounts plus one bucket per other harness.
+ * Claude quota attribution, separate from the stable login identity in accountId.
+ * Launch-recorded identity wins over current credentials in a reused home.
+ * Older rows retain their evidence-labelled path/version inference for historical
+ * quota reports; recovery never treats that org-scoped accountKey as login proof.
  */
 import * as os from 'os';
 import * as path from 'path';
@@ -126,6 +72,7 @@ export function buildClaudeAccountIndex() {
     const darkHomes = [];
     const liveByVersion = new Map();
     const trashByVersion = new Map();
+    const byAccountId = new Map();
     const addHome = (home, version, retired) => {
         const bucket = bucketForHome(home, 'version-home');
         if (!bucket) {
@@ -161,6 +108,26 @@ export function buildClaudeAccountIndex() {
             addHome(path.join(trashBase, version, stamp, 'home'), version, true);
         }
     }
+    // Account slots (PHNX-3940): a named account gets its own HOME-shaped dir at
+    // <historyDir>/accounts/claude/<accountId>/, sharing the one managed install
+    // rather than owning a version home of its own (lib/accounts/slots.ts
+    // `slotDir`). Each slot's `.claude.json` proves ITS identity exactly as
+    // directly as a version home's — tier 1 evidence in `resolveClaudeAccount` —
+    // so without this, every transcript a slot-launched session wrote was
+    // discoverable (the account is registered and runnable) yet permanently
+    // unattributed here, and `isManagedSessionFile`/`getAgentSessionDirs` would
+    // never even have scanned it in the first place. An unconfigured slot (never
+    // signed in) yields no bucket and is simply skipped, not recorded dark — a
+    // slot with nothing written to it yet owns no transcript to misattribute.
+    const accountsBase = path.join(getHistoryDir(), 'accounts', 'claude');
+    for (const accountId of listDirs(accountsBase)) {
+        const home = path.join(accountsBase, accountId);
+        const bucket = bucketForHome(home, 'version-home');
+        if (!bucket)
+            continue;
+        entries.push({ prefix: path.join(home, '.claude'), bucket });
+        byAccountId.set(accountId, bucket);
+    }
     // A live home is authoritative for its version. Otherwise the retired snapshots
     // decide, but only when they agree — disagreement is reported, not resolved.
     const byVersion = new Map();
@@ -178,6 +145,7 @@ export function buildClaudeAccountIndex() {
         entries,
         darkHomes,
         byVersion,
+        byAccountId,
         symlinkBucket: bucketForHome(HOME, 'symlink-target'),
         symlinkPrefix: path.join(HOME, '.claude'),
     };
@@ -187,18 +155,12 @@ function versionFromPath(filePath) {
     const m = /[/\\]versions[/\\]claude[/\\]([^/\\]+)[/\\]/.exec(filePath);
     return m ? m[1] : null;
 }
-/**
- * The account bucket a transcript belongs to. `recordedVersion` is the Claude CLI
- * version stored on the session row (`sessions.version`), which is what disambiguates
- * rows sitting under the mutable `~/.claude` symlink.
- *
- * Never returns null: a transcript that matches no known home resolves to an
- * explicitly dark bucket rather than being dropped or folded into a real account.
- * Backup mirrors (`<historyDir>/backups/claude/<stamp>/projects/…`) carry no
- * `.claude.json` of their own, so they resolve by recorded version like any other
- * out-of-home path, and go dark only when that version names no home.
- */
-export function resolveClaudeAccount(index, filePath, recordedVersion) {
+/** Resolve a quota bucket without replacing recorded login provenance. */
+export function resolveClaudeAccount(index, filePath, recordedVersion, launchAccountId) {
+    // Launch provenance survives credential changes and transcript relocation.
+    if (launchAccountId) {
+        return index.byAccountId.get(launchAccountId) ?? unattributed(`recorded account ${launchAccountId}`);
+    }
     // Tier 1 — the file physically lives in a home we can identify.
     for (const entry of index.entries) {
         if (filePath.startsWith(entry.prefix + path.sep))

package/dist/lib/session/db.d.ts

@@ -14,7 +14,7 @@ import { type TimelineState } from './timeline.js';
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/sessions.md calls the constant the source of truth). */
-export declare const SCHEMA_VERSION = 48;
+export declare const SCHEMA_VERSION = 49;
 /**
  * Bump to force the content extractor (assistant-answer text, alongside the
  * user-prompt text every harness already accumulates) to re-derive on every

package/dist/lib/session/db.js

@@ -29,7 +29,7 @@ const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/sessions.md calls the constant the source of truth). */
-export const SCHEMA_VERSION = 48;
+export const SCHEMA_VERSION = 49;
 /**
  * Bump to force the content extractor (assistant-answer text, alongside the
  * user-prompt text every harness already accumulates) to re-derive on every
@@ -95,6 +95,7 @@ CREATE TABLE IF NOT EXISTS sessions (
   version TEXT,
   account TEXT,
   account_key TEXT,
+  account_id TEXT,
   account_org TEXT,
   mode TEXT,
   timestamp TEXT NOT NULL,
@@ -1309,6 +1310,11 @@ function migrateSchema(db, fromVersion) {
         // The idx_sessions_mirror_synced index is created unconditionally after this
         // block (fresh DBs skip migrations), alongside idx_sessions_last_activity.
     }
+    if (fromVersion < 49) {
+        const cols = new Set(db.prepare(`PRAGMA table_info(sessions)`).all().map(c => c.name));
+        if (!cols.has('account_id'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN account_id TEXT`);
+    }
     if (fromVersion < 48) {
         // v47 -> v48: retain the LATEST genuine user turn beside the first
         // (PHNX-3939). For a /continue, a redirect, or an interrupted-and-restated
@@ -1365,7 +1371,7 @@ function backfillClaudeAccounts(db, scope = 'all') {
     // `account = excluded.account` unconditionally. A dark row reads NULL.
     const update = db.prepare(`UPDATE sessions SET account_key = ?, account_org = ?, account = ? WHERE id = ?`);
     for (const row of rows) {
-        const bucket = resolveClaudeAccount(index, row.file_path ?? '', row.version);
+        const bucket = resolveClaudeAccount(index, row.file_path ?? '', row.version, readSessionActorRecord(row.id)?.accountId);
         update.run(bucket.key, bucket.orgName, bucket.email, row.id);
     }
 }
@@ -1418,6 +1424,9 @@ export function getDB() {
     // scan column here rather than in SCHEMA (PHNX-3792).
     db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_mirror_synced ON sessions(mirror_synced_at)`);
     db.exec(`CREATE INDEX IF NOT EXISTS idx_sessions_routine_run_id ON sessions(routine_run_id)`);
+    const sessionColumns = db.prepare('PRAGMA table_info(sessions)').all();
+    if (!sessionColumns.some(column => column.name === 'account_id'))
+        db.exec('ALTER TABLE sessions ADD COLUMN account_id TEXT');
     // Account attribution repair. Two ways a Claude row ends up wrong even at v33:
     // an older CLI (whose INSERT does not name the column) writes NULL, and a DB
     // migrated by a build that predates the "clear the stale email on a dark row" fix
@@ -1883,7 +1892,7 @@ export function recordDirScans(entries) {
 const upsertSessionStmt = (db) => db.prepare(`
   INSERT INTO sessions (
     id, short_id, agent, harness, origin, routine_name, routine_run_id,
-    version, account, account_key, account_org, mode, timestamp, last_activity,
+    version, account, account_key, account_id, account_org, mode, timestamp, last_activity,
     project, cwd, git_branch, topic, first_user_message, last_user_message, label, message_count, token_count,
     output_tokens, input_tokens, cache_read_tokens, cache_write_tokens,
     cost_usd, cost_usd_nocache, duration_ms, model, tool_call_count,
@@ -1894,7 +1903,7 @@ const upsertSessionStmt = (db) => db.prepare(`
     actor, initiated_by, phoenix_id, used_browser, used_computer
   ) VALUES (
     @id, @short_id, @agent, @harness, @origin, @routine_name, @routine_run_id,
-    @version, @account, @account_key, @account_org, @mode, @timestamp, @last_activity,
+    @version, @account, @account_key, @account_id, @account_org, @mode, @timestamp, @last_activity,
     @project, @cwd, @git_branch, @topic, @first_user_message, @last_user_message, @label, @message_count, @token_count,
     @output_tokens, @input_tokens, @cache_read_tokens, @cache_write_tokens,
     @cost_usd, @cost_usd_nocache, @duration_ms, @model, @tool_call_count,
@@ -1925,6 +1934,7 @@ const upsertSessionStmt = (db) => db.prepare(`
     account = excluded.account,
     account_key = excluded.account_key,
     account_org = excluded.account_org,
+    account_id = COALESCE(sessions.account_id, excluded.account_id),
     mode = COALESCE(excluded.mode, sessions.mode),
     timestamp = excluded.timestamp,
     last_activity = excluded.last_activity,
@@ -2220,7 +2230,7 @@ export function upsertSession(meta, content, scan, assistantContent = '') {
     // person. The ON CONFLICT COALESCEs actor/initiated_by, so this fills a fresh
     // row AND backfills one indexed null-first (before its sidecar existed), while a
     // rescan carrying no actor still keeps the stored owner.
-    const actorRec = meta.actor ? undefined : readSessionActorRecord(meta.id);
+    const actorRec = meta.actor && meta.accountId ? undefined : readSessionActorRecord(meta.id);
     const toolUsage = detectToolUsage(meta.id);
     const db = getDB();
     const { upsert, delText, insText, readLabel } = stmts(db);
@@ -2239,6 +2249,7 @@ export function upsertSession(meta, content, scan, assistantContent = '') {
         version: meta.version ?? actorRec?.version ?? null,
         account: meta.account ?? null,
         account_key: meta.accountKey ?? null,
+        account_id: meta.accountId ?? actorRec?.accountId ?? null,
         account_org: meta.accountOrg ?? null,
         mode: meta.mode ?? actorRec?.mode ?? null,
         timestamp: meta.timestamp,
@@ -2480,6 +2491,7 @@ export function upsertSessionsBatch(entries) {
                     version: meta.version ?? actorIndex.get(meta.id)?.version ?? null,
                     account: meta.account ?? null,
                     account_key: meta.accountKey ?? null,
+                    account_id: meta.accountId ?? actorIndex.get(meta.id)?.accountId ?? null,
                     account_org: meta.accountOrg ?? null,
                     mode: meta.mode ?? actorIndex.get(meta.id)?.mode ?? null,
                     timestamp: meta.timestamp,
@@ -2735,6 +2747,7 @@ function rowToMeta(row) {
         version: row.version ?? undefined,
         account: row.account ?? undefined,
         accountKey: row.account_key ?? undefined,
+        accountId: row.account_id ?? undefined,
         accountOrg: row.account_org ?? undefined,
         mode: isSessionRunMode(row.mode) ? row.mode : undefined,
         topic: row.topic ?? undefined,

package/dist/lib/session/discover.d.ts

@@ -172,6 +172,10 @@ interface CodexSessionScan {
  * TTL, no external lock files needed.
  */
 export declare function discoverSessions(options?: DiscoverOptions): Promise<SessionMeta[]>;
+/** Read only matching Claude/Codex transcripts on a cold ID lookup; indexing stays with the daemon. */
+export declare function findLocalSessionTranscripts(selector: string, agent?: SessionAgentId): Promise<SessionMeta[]>;
+/** Repair local metadata before deciding that a conversation has no context. */
+export declare function hydrateSessionTranscript(session: SessionMeta): Promise<SessionMeta>;
 /** What one incremental scan actually did. */
 interface IncrementalScanResult {
     /** True when this process won the single-flight claim and ran the scan. */

package/dist/lib/session/discover.js

@@ -15,7 +15,6 @@ import { execFile } from 'child_process';
 import { promisify } from 'util';
 import Database from '../sqlite.js';
 import { getAgentsDir, getUserAgentsDir, getHistoryDir, getRunsDir } from '../state.js';
-import { shortCodexHome } from '../codex-home.js';
 import { parseTimeFilter } from './relative-time.js';
 const execFileAsync = promisify(execFile);
 import { AGENTS, agentConfigDirName, getCliVersion, resolveOpenCodeAccountId } from '../agents.js';
@@ -31,6 +30,8 @@ import { isBackgroundShellStart, isSkillInvocation, extractSkills, extractSlashC
 import { parseAntigravity, parseCursor, splitSessionFilePath } from './parse.js';
 import { extractPrUrl, detectWorktree, detectTicket, isPrCreateCommand, detectSpawnedTeam, isTicketCreateTool, extractCreatedTicket, extractRecentDirectoriesTouched, extractTodoProgressFromEvents } from './state.js';
 import { costOfUsage, costOfUsageNoCache } from '../pricing/index.js';
+import { isSelfHost } from '../devices/self-host.js';
+import { readSessionActorRecord } from './actor-sidecar.js';
 import { machineForSessionFile } from './origin-machine.js';
 export { machineForSessionFile } from './origin-machine.js';
 import { mapBounded } from '../concurrency.js';
@@ -170,6 +171,72 @@ export async function discoverSessions(options) {
         skipExistenceCheck: options?.skipExistenceCheck ?? false,
     });
 }
+/** Read only matching Claude/Codex transcripts on a cold ID lookup; indexing stays with the daemon. */
+export async function findLocalSessionTranscripts(selector, agent) {
+    const matches = new Map();
+    const seen = new Set();
+    for (const harness of ['claude', 'codex']) {
+        if (agent && agent !== harness)
+            continue;
+        const subdir = harness === 'claude' ? 'projects' : 'sessions';
+        const roots = [...getAgentSessionDirs(harness, subdir), ...getRoutineArchiveSessionDirs(harness, subdir)];
+        for (const root of roots) {
+            for (const file of walkForFilesWithStat(root, '.jsonl', Number.MAX_SAFE_INTEGER)) {
+                const name = path.basename(file.path, '.jsonl');
+                const id = harness === 'claude' ? name : name.match(/([0-9a-f]{8}-[0-9a-f-]{27})$/i)?.[1];
+                if (!id?.toLowerCase().startsWith(selector.toLowerCase()))
+                    continue;
+                const real = fs.realpathSync(file.path);
+                if (seen.has(real))
+                    continue;
+                seen.add(real);
+                const result = harness === 'claude'
+                    ? await readClaudeMeta(real, id, { fileMtimeMs: Math.floor(file.mtimeMs), fileSize: file.size }, undefined)
+                    : await readCodexMeta(real);
+                if (!result?.meta.id.toLowerCase().startsWith(selector.toLowerCase()) || !result.meta.messageCount)
+                    continue;
+                const sidecar = readSessionActorRecord(result.meta.id);
+                const row = {
+                    ...result.meta, accountId: sidecar?.accountId, mode: sidecar?.mode,
+                    actor: sidecar?.actor, initiatedBy: sidecar?.initiatedBy,
+                    phoenixId: sidecar?.phoenixId, harness: sidecar?.harness ?? result.meta.harness,
+                    machine: machineForSessionFile(real, harness),
+                };
+                if (!matches.has(row.id))
+                    matches.set(row.id, row);
+            }
+        }
+    }
+    return [...matches.values()];
+}
+/** Repair local metadata before deciding that a conversation has no context. */
+export async function hydrateSessionTranscript(session) {
+    const accountId = session.accountId ?? readSessionActorRecord(session.id)?.accountId;
+    if (accountId && !session.accountId)
+        session = { ...session, accountId };
+    const file = splitSessionFilePath(session.filePath).container;
+    try {
+        if (file && fs.statSync(file).isFile() && fs.statSync(file).size > 0)
+            return session;
+    }
+    catch { /* A moved account home needs a canonical rescan. */ }
+    if (session.machine && !isSelfHost(session.machine))
+        return session;
+    if (session.agent === 'claude' || session.agent === 'codex') {
+        const local = (await findLocalSessionTranscripts(session.id, session.agent)).find(row => row.id === session.id);
+        return local ? { ...session, ...local, accountId: session.accountId ?? local.accountId } : session;
+    }
+    let { claimed } = await scanSessionsIncremental({ agent: session.agent });
+    if (!claimed) {
+        if (!await waitForScanToSettle())
+            throw new Error(`Transcript verification for ${session.shortId} is incomplete: another index scan is still running. Retry when it finishes.`);
+        ({ claimed } = await scanSessionsIncremental({ agent: session.agent }));
+        if (!claimed)
+            throw new Error(`Transcript verification for ${session.shortId} is incomplete: the index is busy. Retry shortly.`);
+    }
+    const indexed = getSessionById(session.id);
+    return indexed ? { ...session, ...indexed, accountId: session.accountId ?? indexed.accountId } : session;
+}
 /** Separate write half so daemon warming does not pay for listing or external enrichment. */
 export async function scanSessionsIncremental(options) {
     // Touch the DB so the schema is ready and connection is cached for this run.
@@ -410,8 +477,16 @@ export function isManagedSessionFile(filePath) {
         path.join(getHistoryDir(), 'backups'),
         // Codex's managed home is not always under versions/. On macOS the versioned path
         // overflows SUN_LEN for codex's control socket, so the shim relocates it to
-        // `<agentsUserDir>/.codex-homes/<version>/` (lib/codex-home.ts).
+        // `<agentsUserDir>/.codex-homes/<key>/` (lib/codex-home.ts) — keyed by version OR
+        // by account short key (`a-<accountId prefix>`, lib/codex-home.ts `codexShortKey`).
         path.join(getUserAgentsDir(), '.codex-homes'),
+        // Account slots (PHNX-3940): a named account's HOME-shaped dir under
+        // `<historyDir>/accounts/<agent>/<accountId>/` (lib/accounts/slots.ts
+        // `slotDir`), sharing the one managed install rather than owning a version
+        // home of its own. Without this root, every account-slot transcript read as
+        // unmanaged the moment any version was managed, hiding a fully registered,
+        // runnable account's entire history from the default listing.
+        path.join(getHistoryDir(), 'accounts'),
         // Routine archives are agents-cli's OWN run output — managed by definition.
         getRunsDir(),
     ];
@@ -809,21 +884,47 @@ export function getAgentSessionDirs(agent, subdir) {
         try {
             for (const version of fs.readdirSync(versionsBase)) {
                 addDir(path.join(versionsBase, version, 'home', configDirName, subdir));
-                // Codex's managed home is not always where the version layout says. On macOS
-                // the versioned path overflows SUN_LEN (104 bytes) for codex's control
-                // socket, so the shim relocates the home to
-                // `<agentsUserDir>/.codex-homes/<version>/.codex` (lib/codex-home.ts). Every
-                // transcript an isolated codex writes lands there, and nothing scanned it —
-                // `agents sessions --roots` listed only the user's own ~/.codex, so a managed
-                // copy's own history was invisible. addDir skips what does not exist, so this
-                // is inert on Linux and for versions that never needed relocating.
-                if (agent === 'codex') {
-                    addDir(path.join(shortCodexHome(getUserAgentsDir(), version), subdir));
-                }
             }
         }
         catch { /* dir unreadable */ }
     }
+    // Codex's managed home is not always where the version layout says. On macOS
+    // the versioned path overflows SUN_LEN (104 bytes) for codex's control socket,
+    // so the shim relocates the home to `<agentsUserDir>/.codex-homes/<key>/.codex`
+    // (lib/codex-home.ts) — `<key>` is the version for a version home, or
+    // `a-<accountId prefix>` (`codexShortKey`) for an account slot under
+    // `<historyDir>/accounts/codex/`. Walking `.codex-homes/` directly — rather
+    // than deriving keys from the installed-version list — is what catches BOTH:
+    // an account short key is not a vendor version and never appears in
+    // `versions/codex/`, so iterating only installed versions silently dropped
+    // every transcript a codex account slot wrote. addDir skips what does not
+    // exist, so this is inert on Linux and for homes that never needed relocating.
+    if (agent === 'codex') {
+        const codexHomesBase = path.join(getUserAgentsDir(), '.codex-homes');
+        try {
+            for (const key of fs.readdirSync(codexHomesBase)) {
+                addDir(path.join(codexHomesBase, key, '.codex', subdir));
+            }
+        }
+        catch { /* dir absent or unreadable */ }
+    }
+    // Account slots (PHNX-3940): a named account gets its own HOME-shaped dir
+    // under `<historyDir>/accounts/<agent>/<accountId>/`, sharing the one managed
+    // binary install rather than owning a version home of its own
+    // (lib/accounts/slots.ts `slotDir`). A slot-launched transcript lives ONLY
+    // there — never under `versions/` — so without this root it is fully
+    // discoverable by the account machinery (the account is registered and
+    // runnable) yet invisible to `agents sessions`, reading as if the history had
+    // vanished. `addDir` follows the realpath, so a codex slot whose `.codex` is a
+    // symlink onto its `.codex-homes/<key>` short home (SUN_LEN relocation, above)
+    // is deduplicated against that same target rather than double-counted.
+    const accountsBase = path.join(getHistoryDir(), 'accounts', agent);
+    try {
+        for (const accountId of fs.readdirSync(accountsBase)) {
+            addDir(path.join(accountsBase, accountId, configDirName, subdir));
+        }
+    }
+    catch { /* dir absent or unreadable */ }
     const backupsBase = path.join(getHistoryDir(), 'backups', agent);
     if (fs.existsSync(backupsBase)) {
         try {
@@ -1180,7 +1281,7 @@ async function readClaudeMeta(filePath, sessionId, scanStamp, priorRow, label) {
     // Which account produced this transcript. Resolved from the path plus the version
     // recorded inside the file, so rows under the mutable ~/.claude symlink are
     // attributed to the version that actually wrote them. See claude-accounts.ts.
-    const acct = resolveClaudeAccount(claudeAccountIndex(), filePath, scan.version);
+    const acct = resolveClaudeAccount(claudeAccountIndex(), filePath, scan.version, readSessionActorRecord(sessionId)?.accountId);
     let meta;
     if (scan.timestamp) {
         const cwd = normalizeCwd(scan.cwd || '');
@@ -4315,7 +4416,7 @@ export function extractVersionFromManagedPath(agent, sourcePath) {
             if (start === -1)
                 continue;
             const version = normalized.slice(start + marker.length).split('/')[0];
-            if (version)
+            if (version && !(marker.endsWith('/.codex-homes/') && version.startsWith('a-')))
                 return version;
         }
     }