@phnx-labs/agents-cli 1.22.105 → 1.22.107

package/dist/lib/session/recovery.d.ts

@@ -1,38 +1,40 @@
+import type { UnifiedAccount } from '../account-registry.js';
 import { type RotateCandidate } from '../accounting/rotate.js';
 import type { AgentId } from '../types.js';
 import type { SessionAgentId, SessionMeta } from './types.js';
 /** One capability boundary for every surface that advertises faithful Resume. */
 export declare function sessionAgentSupportsResume(agent: SessionAgentId): boolean;
-/**
- * The account a recovery should authenticate as. Present when resume rotates
- * AWAY from the session's original login (an account limit) to a healthy
- * sibling of the SAME harness. A `providerAccount` is a durable setup-token /
- * API-key account (RUSH-3182) injected via the `--account` spawn path
- * (`resolveSpawnAccount` → `accountEnv`); it is the only kind that can
- * authenticate a NATIVE resume in the origin version home, because a native
- * login lives in its own isolated home and cannot be forwarded. It is also
- * required on `/continue` when the balanced pick is a provider: exec only
- * injects from this field, so omitting it would launch the version home's
- * native login — the exhausted origin in the PHNX-3674 fixture. Absent means
- * "use the launched version home's own native login" (the healthy-origin happy
- * path, or `/continue` on a healthy native sibling).
- */
+/** Injectable credentials can authenticate the existing native context. */
 export interface RecoveryAccount {
     providerAccount: string;
     label: string;
     email: string | null;
 }
+export interface SessionRecoverySelection {
+    /** Installed binary only; account homes retain their own context label. */
+    executableVersion?: string;
+    /** Explicit account selector resolved against the local candidate pool. */
+    account?: string;
+    /** Effective model for readiness checks. */
+    model?: string;
+}
 export type SessionRecoveryTarget = {
     mode: 'native';
     agent: AgentId;
     version: string;
     cwd?: string;
+    /** The actual native context root used (a version home, or an account slot dir). */
+    execHome?: string;
+    configVersion?: string;
+    /** The exact account/version candidate recovery resolved to — never re-derive from `version` alone (PHNX-3940: several accounts can share one managed binary). */
+    candidate: RotateCandidate;
     account?: RecoveryAccount;
     reason: string;
 } | {
     mode: 'continue';
     agent: AgentId;
     version: string;
+    candidate: RotateCandidate;
     account?: RecoveryAccount;
     reason: string;
 };
@@ -52,28 +54,22 @@ export declare function sessionOriginDevice(session: Pick<SessionMeta, 'machine'
 export declare function sessionRecoveryPeer(session: Pick<SessionMeta, 'machine'>, selfCheck?: (host: string) => boolean): string | undefined;
 /** Whether an explicit placement names the session's origin device. */
 export declare function sessionRecoveryDestinationMatches(session: Pick<SessionMeta, 'machine'>, requestedHost: string, self?: string): boolean;
+/** History filtering uses login identity, never an organization quota key. */
+export declare function sessionMatchesAccount(session: Pick<SessionMeta, 'agent' | 'filePath' | 'accountId'>, account: Pick<UnifiedAccount, 'id' | 'kind'> & {
+    agent?: AgentId;
+}, home?: string): boolean;
 /**
- * Prove that the indexed transcript is reachable from the exact active version
- * home that would receive native resume. Retained trash/backup transcripts are
- * intentionally rejected here: they remain readable by `/continue`, but a new
- * installation with the same version number must not native-resume an empty
- * isolated home.
+ * Prove that the indexed transcript is reachable from the exact active
+ * native context root that would receive native resume (a version home, or
+ * an account slot dir). Retained trash/backup transcripts are intentionally
+ * rejected here: they remain readable by `/continue`, but a new installation
+ * or account slot must not native-resume an empty isolated home.
  */
 export declare function inspectNativeResumeSession(session: SessionMeta, versionHome: string): NativeResumeInspection;
-/**
- * Decide how a durable session resumes on the device that owns it.
- *
- * Native resume is legal only in the exact origin version's isolated home,
- * and only while that home owns the indexed transcript AND some injectable
- * credential for this harness is healthy: the origin login itself, or a
- * provider account rotated in when the origin is usage-limited (PHNX-3626).
- * Every other successful path stays on the same harness and uses `/continue`,
- * whose indexed transcript reader can reach retained version trash. A
- * `/continue` pick of a provider account carries RecoveryAccount so exec
- * injects it instead of launching the version home's native login
- * (PHNX-3674). No healthy same-harness account is a loud failure.
- */
-export declare function resolveSessionRecoveryFromCandidates(session: SessionMeta, candidates: RotateCandidate[], supportsNative?: (agent: AgentId, version?: string) => boolean, nativeInspection?: NativeResumeInspection): SessionRecoveryTarget;
+/** Keep the native conversation where possible; replay remains a separate choice. */
+export declare function resolveSessionRecoveryFromCandidates(session: SessionMeta, candidates: RotateCandidate[], supportsNative?: (agent: AgentId, version?: string) => boolean, nativeInspection?: NativeResumeInspection, options?: SessionRecoverySelection): SessionRecoveryTarget;
+/** A mirror digest or live registry entry is not conversation content. */
+export declare function assertRecoverableTranscript(session: SessionMeta): void;
 /**
  * Resolve recovery for a durable session, reading the live account pool.
  *
@@ -83,7 +79,7 @@ export declare function resolveSessionRecoveryFromCandidates(session: SessionMet
  * healthy provider account and stay NATIVE (PHNX-3626). `collect` is injectable
  * for tests and for callers that must stay native-only.
  */
-export declare function resolveSessionRecovery(session: SessionMeta, collect?: (agent: AgentId) => Promise<RotateCandidate[]>): Promise<SessionRecoveryTarget>;
+export declare function resolveSessionRecovery(session: SessionMeta, collect?: (agent: AgentId) => Promise<RotateCandidate[]>, options?: SessionRecoverySelection): Promise<SessionRecoveryTarget>;
 /** Stable self-command used by focus, resume, and attach. The owning device runs
  * the recovery resolver above; callers must not native-resume another version's
  * isolated home themselves. */

package/dist/lib/session/recovery.js

@@ -4,9 +4,13 @@ import { AGENTS, agentConfigDirName } from '../agents.js';
 import { isSelfHost } from '../devices/self-host.js';
 import { nativeResume } from '../exec.js';
 import { machineId, normalizeHost } from '../machine-id.js';
-import { formatNoHealthyAccountError, pickBalancedCandidate, readinessFromCandidate, } from '../accounting/rotate.js';
+import { readSlots, slotDir } from '../accounts/slots.js';
+import { readMeta } from '../state.js';
+import { formatNoHealthyAccountError, matchAccountCandidate, pickBalancedCandidate, readinessFromCandidate, } from '../accounting/rotate.js';
 import { collectRunCandidatesForRun } from '../accounting/account-pool-collect.js';
-import { getVersionHomePath } from '../installations/store.js';
+import { getVersionHomePath, resolveManagedInstallation } from '../installations/store.js';
+import { readSessionContent } from './db.js';
+import { parseOpenCode, splitSessionFilePath } from './parse.js';
 const RESUMABLE_SESSION_AGENTS = new Set(['claude', 'codex', 'muse', 'opencode']);
 /** One capability boundary for every surface that advertises faithful Resume. */
 export function sessionAgentSupportsResume(agent) {
@@ -39,16 +43,13 @@ function runnableSessionAgent(session) {
     }
     return session.agent;
 }
-function sourceReason(session, candidates) {
-    if (!session.version)
-        return 'the origin version was not recorded';
-    const source = candidates.find((candidate) => candidate.version === session.version);
+function sourceReason(session, source, model) {
     if (!source)
-        return `origin ${session.agent}@${session.version} is not installed`;
-    const readiness = readinessFromCandidate(source);
-    return readiness.ready
-        ? `origin ${session.agent}@${session.version} has no native resume form`
-        : `origin ${session.agent}@${session.version} is ${readiness.reason}`;
+        return session.accountId
+            ? 'the recorded account is not available on this device'
+            : 'the original account attribution is unknown';
+    const readiness = readinessFromCandidate(source, undefined, model);
+    return readiness.ready ? 'the account has no usable native resume context' : `the original account is ${readiness.reason}`;
 }
 function recoveryAccountFromCandidate(candidate) {
     const providerAccount = candidate.providerAccount;
@@ -74,6 +75,83 @@ function existingDirectory(dir) {
         return undefined;
     }
 }
+/**
+ * Realpath of `filePath` when it is genuinely reachable from `homeRoot` (or
+ * that root's agent config subdir), else `null`. The one place transcript
+ * ownership is decided — reused by native-resume inspection, account
+ * attribution, and disambiguation between several accounts sharing one
+ * managed binary. Retained trash/backup transcripts are intentionally
+ * rejected: they remain readable by `/continue`, but a home must not claim to
+ * natively own a transcript it does not.
+ */
+function resolveOwnedTranscriptRealpath(filePath, homeRoot, agent) {
+    let realFile;
+    try {
+        realFile = fs.realpathSync(splitSessionFilePath(filePath).container);
+    }
+    catch {
+        return null;
+    }
+    const roots = [path.join(homeRoot, agentConfigDirName(agent))];
+    if (agent === 'muse' || agent === 'opencode')
+        roots.push(path.join(homeRoot, '.local', 'share', agent));
+    const owned = roots.some((root) => {
+        try {
+            return isPathInside(realFile, fs.realpathSync(root));
+        }
+        catch {
+            return false;
+        }
+    });
+    return owned ? realFile : null;
+}
+function transcriptOwnedByHome(filePath, homeRoot, agent) {
+    return resolveOwnedTranscriptRealpath(filePath, homeRoot, agent) !== null;
+}
+/** History filtering uses login identity, never an organization quota key. */
+export function sessionMatchesAccount(session, account, home) {
+    if (account.kind === 'native' && session.agent !== account.agent)
+        return false;
+    if (session.accountId)
+        return session.accountId === account.id;
+    if (account.kind !== 'native')
+        return false;
+    const slot = readSlots(readMeta())[account.id];
+    const context = home ?? slot?.slotDir ?? slotDir(session.agent, account.id);
+    return transcriptOwnedByHome(session.filePath, context, session.agent);
+}
+function candidateAccountId(candidate) {
+    return candidate.providerAccountId ?? candidate.nativeAccountId ?? (candidate.fromSlot && candidate.slotDir ? path.basename(candidate.slotDir) : undefined);
+}
+/** The actual native context root for a candidate: its account slot dir when it has one, else the managed version home. */
+function candidateHome(candidate) {
+    return candidate.slotDir || getVersionHomePath(candidate.agent, candidate.version);
+}
+/**
+ * Whether `candidate` is the proven native owner of `session`'s transcript.
+ * A provider (injected credential) candidate never qualifies: it has no
+ * isolated context of its own, so a transcript sitting in the version home it
+ * happens to ride in is not evidence it produced that transcript (the exact
+ * "current credentials in an old home as historical proof" mistake this must
+ * not repeat).
+ */
+function candidateOwnsTranscript(candidate, session) {
+    if (candidate.providerAccount && !session.accountId)
+        return false;
+    const home = candidateHome(candidate);
+    const acctId = candidateAccountId(candidate);
+    if (session.accountId)
+        return session.accountId === acctId;
+    return transcriptOwnedByHome(session.filePath, home, candidate.agent);
+}
+/** Stored login identity wins; otherwise require actual native context ownership. */
+function pickOriginCandidate(session, candidates) {
+    if (session.accountId)
+        return candidates.find(candidate => candidateAccountId(candidate) === session.accountId);
+    const native = candidates.filter(candidate => !candidate.providerAccount);
+    const owners = native.filter(candidate => candidateOwnsTranscript(candidate, session));
+    return owners.length === 1 ? owners[0] : undefined;
+}
 /** Read the launch cwd Claude used to choose its projects/<cwd-key> directory.
  * Claude can record attachment envelopes before the first user turn, and those
  * envelopes retain the actual launch cwd even after the session changes dirs. */
@@ -111,30 +189,24 @@ function readClaudeLaunchCwd(filePath) {
     return undefined;
 }
 /**
- * Prove that the indexed transcript is reachable from the exact active version
- * home that would receive native resume. Retained trash/backup transcripts are
- * intentionally rejected here: they remain readable by `/continue`, but a new
- * installation with the same version number must not native-resume an empty
- * isolated home.
+ * Prove that the indexed transcript is reachable from the exact active
+ * native context root that would receive native resume (a version home, or
+ * an account slot dir). Retained trash/backup transcripts are intentionally
+ * rejected here: they remain readable by `/continue`, but a new installation
+ * or account slot must not native-resume an empty isolated home.
  */
 export function inspectNativeResumeSession(session, versionHome) {
-    let realFile;
-    try {
-        realFile = fs.realpathSync(session.filePath);
-    }
-    catch {
-        return { available: false, reason: 'the indexed transcript is no longer present in the origin home' };
+    if (session.agent === 'opencode' && (!fs.existsSync(splitSessionFilePath(session.filePath).container) || parseOpenCode(session.filePath).length === 0)) {
+        return { available: false, reason: 'the native database has no readable conversation for this session' };
     }
-    const roots = [versionHome, path.join(versionHome, agentConfigDirName(session.agent))];
-    const owned = roots.some((root) => {
+    const realFile = resolveOwnedTranscriptRealpath(session.filePath, versionHome, session.agent);
+    if (!realFile) {
         try {
-            return isPathInside(realFile, fs.realpathSync(root));
+            fs.realpathSync(splitSessionFilePath(session.filePath).container);
         }
         catch {
-            return false;
+            return { available: false, reason: 'the indexed transcript is no longer present in the origin home' };
         }
-    });
-    if (!owned) {
         return {
             available: false,
             reason: `the indexed transcript is retained outside the active ${session.agent}@${session.version ?? 'unknown'} home`,
@@ -153,43 +225,73 @@ export function inspectNativeResumeSession(session, versionHome) {
     const cwd = existingDirectory(session.cwd);
     return { available: true, cwd };
 }
-/**
- * Decide how a durable session resumes on the device that owns it.
- *
- * Native resume is legal only in the exact origin version's isolated home,
- * and only while that home owns the indexed transcript AND some injectable
- * credential for this harness is healthy: the origin login itself, or a
- * provider account rotated in when the origin is usage-limited (PHNX-3626).
- * Every other successful path stays on the same harness and uses `/continue`,
- * whose indexed transcript reader can reach retained version trash. A
- * `/continue` pick of a provider account carries RecoveryAccount so exec
- * injects it instead of launching the version home's native login
- * (PHNX-3674). No healthy same-harness account is a loud failure.
- */
-export function resolveSessionRecoveryFromCandidates(session, candidates, supportsNative = nativeResume, nativeInspection) {
+function resolveExplicitAccountRecovery(session, candidates, agent, device, supportsNative, nativeInspection, options) {
+    const requested = options.account.trim();
+    const matched = matchAccountCandidate(candidates, requested);
+    if (!matched) {
+        throw new SessionRecoveryError(`Cannot recover session ${session.shortId} on ${device} as '${requested}': no signed-in ${agent} account matches that name/email/key.`);
+    }
+    const readiness = readinessFromCandidate(matched, undefined, options.model ?? session.model);
+    if (!readiness.ready) {
+        throw new SessionRecoveryError(`Cannot recover session ${session.shortId} on ${device} as '${requested}': ${matched.accountLabel} is ${readiness.reason}.`);
+    }
+    const account = recoveryAccountFromCandidate(matched);
+    const modelSuffix = options.model ? ` on model ${options.model}` : '';
+    const isOrigin = candidateOwnsTranscript(matched, session);
+    if (isOrigin && supportsNative(agent, options.executableVersion ?? matched.version)) {
+        const home = candidateHome(matched);
+        const inspection = nativeInspection ?? inspectNativeResumeSession(session, home);
+        if (inspection.available) {
+            return {
+                mode: 'native',
+                agent,
+                version: options.executableVersion ?? matched.version,
+                cwd: inspection.cwd,
+                execHome: home,
+                configVersion: matched.fromSlot ? undefined : matched.version,
+                candidate: matched,
+                ...(account ? { account } : {}),
+                reason: `explicit account '${requested}' is the session origin; resuming natively${modelSuffix}`,
+            };
+        }
+    }
+    return {
+        mode: 'continue',
+        agent,
+        version: options.executableVersion ?? matched.version,
+        candidate: matched,
+        ...(account ? { account } : {}),
+        reason: isOrigin
+            ? `explicit account '${requested}' is the session origin but has no usable native context; continuing${modelSuffix}`
+            : `explicit account '${requested}' differs from the session's recorded origin; continuing on ${matched.accountLabel}${modelSuffix} requires interactive confirmation before replay`,
+    };
+}
+/** Keep the native conversation where possible; replay remains a separate choice. */
+export function resolveSessionRecoveryFromCandidates(session, candidates, supportsNative = nativeResume, nativeInspection, options = {}) {
     const agent = runnableSessionAgent(session);
     const device = sessionOriginDevice(session);
-    const source = session.version
-        ? candidates.find((candidate) => candidate.version === session.version)
-        : undefined;
-    const sourceReady = source ? readinessFromCandidate(source).ready : false;
+    if (options.account) {
+        return resolveExplicitAccountRecovery(session, candidates, agent, device, supportsNative, nativeInspection, options);
+    }
+    const source = pickOriginCandidate(session, candidates);
+    const sourceReady = source ? readinessFromCandidate(source, undefined, options.model ?? session.model).ready : false;
     // Native-first with account rotation (PHNX-3626). When the origin login is
     // usage/rate/session-LIMITED (not signed-out or revoked — those need a login,
-    // not a rotation, so they keep going to /continue per SES-39) but its version
-    // home is installed, native-resume-capable, and still owns the indexed
+    // not a rotation, so they keep going to /continue per SES-39) but its native
+    // context is installed, native-resume-capable, and still owns the indexed
     // transcript, keep resume NATIVE by rotating to a healthy INJECTABLE (provider)
-    // account in that SAME home — rather than dropping to /continue on a different
-    // version. Only a provider token/key qualifies: a native login lives in its own
-    // isolated home and cannot be forwarded, so it could never authenticate a
-    // resume that must read the origin home's transcript (see §11).
-    const originReadiness = source ? readinessFromCandidate(source) : null;
+    // account in that SAME context — rather than dropping to /continue on a
+    // different version. Only a provider token/key qualifies: a native login
+    // lives in its own isolated context and cannot be forwarded, so it could
+    // never authenticate a resume that must read the origin's transcript (see §11).
+    const originReadiness = source ? readinessFromCandidate(source, undefined, options.model ?? session.model) : null;
     const originLimited = !!originReadiness && !originReadiness.ready
-        && (originReadiness.reason === 'rate_limited' || originReadiness.reason === 'out_of_credits');
-    if (originLimited && source && session.version && supportsNative(agent, session.version)) {
-        const inspection = nativeInspection
-            ?? inspectNativeResumeSession(session, getVersionHomePath(agent, session.version));
+        && (originReadiness.reason === 'rate_limited' || originReadiness.reason === 'out_of_credits' || originReadiness.reason === 'model_limited');
+    if (originLimited && source && supportsNative(agent, options.executableVersion ?? source.version)) {
+        const originHome = candidateHome(source);
+        const inspection = nativeInspection ?? inspectNativeResumeSession(session, originHome);
         if (inspection.available) {
-            const rotated = pickBalancedCandidate(candidates.filter((c) => c.providerAccount && c.accountKey !== source.accountKey));
+            const rotated = pickBalancedCandidate(candidates.filter((c) => c.providerAccount && c.accountKey !== source.accountKey), undefined, options.model ?? session.model);
             const account = rotated ? recoveryAccountFromCandidate(rotated.picked) : undefined;
             if (account) {
                 // `originLimited` guarantees the origin is unhealthy with a limit reason.
@@ -197,48 +299,59 @@ export function resolveSessionRecoveryFromCandidates(session, candidates, suppor
                 return {
                     mode: 'native',
                     agent,
-                    version: session.version,
+                    version: options.executableVersion ?? source.version,
                     cwd: inspection.cwd,
+                    execHome: originHome,
+                    configVersion: source.fromSlot ? undefined : source.version,
+                    candidate: rotated.picked,
                     account,
-                    reason: `origin ${agent}@${session.version} account is ${why}; rotated to healthy ${account.label} and resuming natively in the same home`,
+                    reason: `the original account is ${why}; using ${account.label} in the same native context`,
                 };
             }
         }
     }
-    // An exact healthy origin is deterministic: preserve its isolated home. If
-    // native resume is unavailable for that harness, /continue still launches in
-    // that same healthy home. Only an unusable/missing origin enters balanced
+    // An exact healthy origin is deterministic: preserve its isolated context.
+    // If native resume is unavailable for that harness, /continue still
+    // launches there. Only an unusable/missing/ambiguous origin enters balanced
     // account selection.
     const selection = sourceReady
         ? { picked: source }
-        : pickBalancedCandidate(candidates);
+        : pickBalancedCandidate(candidates, undefined, options.model ?? session.model);
     if (!selection) {
         const detail = formatNoHealthyAccountError(agent, 'balanced', candidates);
         throw new SessionRecoveryError(`Cannot recover session ${session.shortId} on ${device}; origin ${agent}@${session.version ?? 'unknown'}. ${detail}`);
     }
-    const version = selection.picked.version;
+    const version = options.executableVersion ?? selection.picked.version;
     const account = recoveryAccountFromCandidate(selection.picked);
-    const continueWith = account ? `healthy ${account.label}` : `healthy ${agent}@${version}`;
+    const continueWith = account ? `healthy ${account.label}` : `the selected ${agent} account`;
     // Native resume without an injected RecoveryAccount is valid only for the
-    // exact healthy origin login. A balanced same-version provider selected for
-    // a signed-out/revoked origin must stay on /continue; otherwise we would open
-    // the origin home with no usable credential and fail (or fork state).
-    if (sourceReady && session.version === version && supportsNative(agent, version)) {
-        const inspection = nativeInspection
-            ?? inspectNativeResumeSession(session, getVersionHomePath(agent, version));
+    // exact healthy origin login — when sourceReady, `selection.picked` IS
+    // `source` by construction above, so no separate version comparison is
+    // needed (and none would be safe: an accountId-matched origin can carry a
+    // version different from the session's recorded one after a vendor
+    // relabel). A balanced same-version provider selected for a signed-out/
+    // revoked origin must stay on /continue; otherwise we would open the origin
+    // context with no usable credential and fail (or fork state).
+    if (sourceReady && supportsNative(agent, version)) {
+        const home = candidateHome(selection.picked);
+        const inspection = nativeInspection ?? inspectNativeResumeSession(session, home);
         if (inspection.available) {
             return {
                 mode: 'native',
                 agent,
                 version,
                 cwd: inspection.cwd,
-                reason: `origin ${agent}@${version} is installed, healthy, and owns the indexed transcript`,
+                execHome: home,
+                configVersion: selection.picked.fromSlot ? undefined : selection.picked.version,
+                candidate: selection.picked,
+                reason: `the selected account owns the native transcript and has no known launch restriction`,
             };
         }
         return {
             mode: 'continue',
             agent,
             version,
+            candidate: selection.picked,
             ...(account ? { account } : {}),
             reason: `${inspection.reason}; continuing with ${continueWith}`,
         };
@@ -247,10 +360,25 @@ export function resolveSessionRecoveryFromCandidates(session, candidates, suppor
         mode: 'continue',
         agent,
         version,
+        candidate: selection.picked,
         ...(account ? { account } : {}),
-        reason: `${sourceReason(session, candidates)}; continuing with ${continueWith}`,
+        reason: `${sourceReason(session, source, options.model ?? session.model)}; continuing with ${continueWith}`,
     };
 }
+/** A mirror digest or live registry entry is not conversation content. */
+export function assertRecoverableTranscript(session) {
+    const file = splitSessionFilePath(session.filePath).container;
+    try {
+        if (file && fs.statSync(file).isFile() && fs.statSync(file).size > 0
+            && (session.agent !== 'opencode' || parseOpenCode(session.filePath).length > 0))
+            return;
+    }
+    catch { /* The canonical scan already tried to repair this path. */ }
+    if (!session.mirrorSyncedAt && !session.mirrorSource && readSessionContent(session.id)?.trim())
+        return;
+    throw new SessionRecoveryError(`Session ${session.shortId} has no readable transcript after checking its account homes and index. ` +
+        `No agent was started. Start a new conversation with: agents run ${session.agent}`);
+}
 /**
  * Resolve recovery for a durable session, reading the live account pool.
  *
@@ -260,9 +388,17 @@ export function resolveSessionRecoveryFromCandidates(session, candidates, suppor
  * healthy provider account and stay NATIVE (PHNX-3626). `collect` is injectable
  * for tests and for callers that must stay native-only.
  */
-export async function resolveSessionRecovery(session, collect = collectRunCandidatesForRun) {
+export async function resolveSessionRecovery(session, collect = collectRunCandidatesForRun, options = {}) {
     const agent = runnableSessionAgent(session);
-    return resolveSessionRecoveryFromCandidates(session, await collect(agent));
+    const { hydrateSessionTranscript } = await import('./discover.js');
+    session = await hydrateSessionTranscript(session);
+    assertRecoverableTranscript(session);
+    const installation = resolveManagedInstallation(agent);
+    if (!installation)
+        throw new SessionRecoveryError(`No managed ${agent} installation is available. Install it with: agents add ${agent}`);
+    return resolveSessionRecoveryFromCandidates(session, await collect(agent), undefined, undefined, {
+        ...options, executableVersion: installation.label,
+    });
 }
 /** Stable self-command used by focus, resume, and attach. The owning device runs
  * the recovery resolver above; callers must not native-resume another version's

package/dist/lib/session/types.d.ts

@@ -395,6 +395,8 @@ export interface SessionMeta {
      * See lib/session/claude-accounts.ts for how a transcript is attributed.
      */
     accountKey?: string;
+    /** Stable credential account recorded at launch; independent of organization quota and binary release. */
+    accountId?: string;
     /** Organization display name of the producing account, when known. */
     accountOrg?: string;
     /** Effective normalized launch mode captured by the SessionStart hook. */

package/dist/lib/teams/placement-probe.js

@@ -118,7 +118,7 @@ export async function probePoolSignals(pool, agent, opts = {}) {
                 if (!candidates) {
                     return [d.name, { installed: true, signedIn: undefined, pickerEligible: undefined }];
                 }
-                const readiness = candidates.map(readinessFromCandidate);
+                const readiness = candidates.map((candidate) => readinessFromCandidate(candidate));
                 return [d.name, {
                         installed: true,
                         signedIn: readiness.some((candidate) => candidate.ready),

package/dist/session-tracker/dist/adapters/claude.d.ts

@@ -0,0 +1,10 @@
+export declare const CLAUDE_PROJECTS_ROOT: string;
+export declare function claudeWorkspaceFolder(cwd: string): string;
+export declare function claudeSessionDir(cwd: string): string;
+export declare function snapshotSessions(cwd: string): Promise<Set<string>>;
+export interface NewSession {
+    sessionId: string;
+    latencyMs: number;
+    file: string;
+}
+export declare function awaitNewSession(cwd: string, before: Set<string>, timeoutMs: number, pollMs?: number): Promise<NewSession | null>;

package/dist/session-tracker/dist/adapters/claude.js

@@ -0,0 +1,45 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+export const CLAUDE_PROJECTS_ROOT = path.join(os.homedir(), '.claude', 'projects');
+// Mirrors swarmify's workspaceToClaudeFolder: replace / and . with -
+export function claudeWorkspaceFolder(cwd) {
+    return cwd.replace(/[\/.]/g, '-');
+}
+export function claudeSessionDir(cwd) {
+    return path.join(CLAUDE_PROJECTS_ROOT, claudeWorkspaceFolder(cwd));
+}
+export async function snapshotSessions(cwd) {
+    try {
+        const files = await fs.promises.readdir(claudeSessionDir(cwd));
+        return new Set(files.filter((f) => f.endsWith('.jsonl')));
+    }
+    catch {
+        return new Set();
+    }
+}
+export async function awaitNewSession(cwd, before, timeoutMs, pollMs = 50) {
+    const start = Date.now();
+    const dir = claudeSessionDir(cwd);
+    while (Date.now() - start < timeoutMs) {
+        try {
+            const files = await fs.promises.readdir(dir);
+            for (const f of files) {
+                if (!f.endsWith('.jsonl'))
+                    continue;
+                if (before.has(f))
+                    continue;
+                return {
+                    sessionId: f.replace(/\.jsonl$/, ''),
+                    latencyMs: Date.now() - start,
+                    file: path.join(dir, f),
+                };
+            }
+        }
+        catch {
+            /* dir may not exist yet */
+        }
+        await new Promise((r) => setTimeout(r, pollMs));
+    }
+    return null;
+}