@phnx-labs/agents-cli 1.22.107 → 1.22.109

package/dist/commands/share.js

@@ -10,13 +10,13 @@ import { formatBytes } from '../lib/format.js';
 import { Argument, Option } from 'commander';
 import chalk from 'chalk';
 import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_SHARE_DOMAIN, DEFAULT_WORKER_NAME, generateWriteToken, readCloudflareCreds, readShareConfig, readWriteToken, readWriteTokenEnv, readWriteTokenFromBundle, storeWriteToken, writeShareConfig, } from '../lib/share/config.js';
-import { addCustomDomain, configureBucketLifecycle, createBucket, deployWorker, enableWorkersDev, findZoneId, hashWorkerScript, putWorkerSecret, updateWorker, WORKER_PHOENIX_ID_BASE_SECRET, setWorkerSecret, } from '../lib/share/provision.js';
+import { addCustomDomain, configureBucketLifecycle, createBucket, deployWorker, enableWorkersDev, findZoneId, hashWorkerScript, putWorkerSecret, updateWorker, WORKER_PHOENIX_ID_BASE_SECRET, WORKER_COLLAB_BASE_SECRET, WORKER_COLLAB_SERVICE_TOKEN_SECRET, setWorkerSecret, } from '../lib/share/provision.js';
 import { publishFile, resolveShareUsername, parseMetaEntries, sanitizeLabel, scanShareContent, formatSensitiveContentError, unlistedNotPrivateWarning, SHARE_VISIBILITY_LEVELS, PUBLISH_VISIBILITY_LEVELS, } from '../lib/share/publish.js';
 import { deleteShare, resolveDeleteTarget } from '../lib/share/delete.js';
 import { renderWorkerBundle } from '../lib/share/worker-template.js';
 import { analyticsEnabled } from '../lib/share/analytics.js';
 import { extractShareHttpError, formatShareHttpErrorDetail } from '../lib/share/http-error.js';
-import { phoenixIdBaseForDeploy, resolveShareBackend, shouldUseManaged, } from '../lib/share/backend.js';
+import { collabConfigForDeploy, phoenixIdBaseForDeploy, resolveShareBackend, shouldUseManaged, } from '../lib/share/backend.js';
 import { publishVisibility } from '../lib/storage/visibility.js';
 import { resolveGitHubUsername } from '../lib/git.js';
 import { refreshSessionAvatar } from '../lib/identity/index.js';
@@ -1271,6 +1271,15 @@ export async function runShareProvision(opts) {
             await putWorkerSecret(apiToken, accountId, workerName, WORKER_PHOENIX_ID_BASE_SECRET, phoenixIdBase, provisionOpts);
             spin.text = `Worker '${workerName}' Phoenix ID base set`;
         }
+        // Managed collaboration backend (PHNX-3835). Dormant unless BOTH
+        // PRIX_ARTIFACT_COLLAB_BASE and ARTIFACT_COLLAB_SERVICE_TOKEN are set in the
+        // deploy env; the service token rides the Secrets API, never rendered HTML.
+        const collab = collabConfigForDeploy({ managed: opts.managed }, { baseUrl, domain });
+        if (collab.collabBase && collab.collabServiceToken) {
+            await putWorkerSecret(apiToken, accountId, workerName, WORKER_COLLAB_BASE_SECRET, collab.collabBase, provisionOpts);
+            await putWorkerSecret(apiToken, accountId, workerName, WORKER_COLLAB_SERVICE_TOKEN_SECRET, collab.collabServiceToken, provisionOpts);
+            spin.text = `Worker '${workerName}' collaboration backend set`;
+        }
         spin.succeed('Provisioned');
         const cfg = {
             baseUrl,
@@ -1336,10 +1345,14 @@ export async function runShareUpdate(opts = {}) {
     }
     const writeToken = readWriteToken();
     const phoenixIdBase = phoenixIdBaseForDeploy({ managed: opts.managed }, cfg);
+    const collab = collabConfigForDeploy({ managed: opts.managed }, cfg);
     const provisionOpts = {
         ...(opts.request ? { request: opts.request } : {}),
         force: opts.force,
         ...(phoenixIdBase !== undefined ? { phoenixIdBase } : {}),
+        ...(collab.collabBase !== undefined
+            ? { collabBase: collab.collabBase, collabServiceToken: collab.collabServiceToken }
+            : {}),
     };
     const result = await updateWorker(apiToken, accountId, cfg.workerName, cfg.bucketName, worker, writeToken, cfg.templateHash, provisionOpts);
     if (!result.skipped) {

package/dist/commands/sync.js

@@ -190,7 +190,7 @@ export function registerSyncCommand(program) {
         .option('-y, --yes', 'Skip the interactive preview and auto-sync all detected resources', false)
         .option('--force', 'Re-sync even if no changes are detected since the last sync', false)
         .option('--quiet', 'Suppress all output (exit code indicates success)', false)
-        .option('--dry-run', 'Show what would be synced without making any changes', false)
+        .option('--dry-run', 'Show what would be synced without making any changes — requires an agent scope (e.g. agents sync claude --dry-run); the umbrella verb refuses it', false)
         .option('--allow-exec-surfaces', 'Allow syncing plugin exec surfaces (scripts, binaries) — off by default for safety', false)
         .option('--json', 'Emit machine-readable JSON (also accepted so fleet fan-out via --device all can parse each peer)', false)
         // Umbrella verb (no agent given): make this machine current.
@@ -480,6 +480,35 @@ function evictCentralBrowserProfilesForSync(quiet, json, outLog, errLog) {
  * a one-line summary. Stage failures are non-fatal and surfaced as warnings.
  */
 async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
+    // `--dry-run` on the umbrella verb is NOT supported and must fail LOUD before
+    // touching anything (PHNX-3923). The umbrella composes stages that only exist
+    // as mutating operations — repo `git pull`, a full `refresh()` reconcile into
+    // every installed version home, central browser-profile eviction, device sync,
+    // and `repairAfterSync` — none of which carry a non-mutating preview mode. The
+    // old code ignored `opts.dryRun` entirely, ran `runUmbrellaSync` + evict +
+    // repair, and so MUTATED every native home despite `--dry-run`. Rather than
+    // ship a partial preview that silently skips the stages it cannot model (a
+    // lying "would sync" that contradicts the flag's promise), refuse here and
+    // point at the scoped path, which DOES honor `--dry-run` non-destructively.
+    if (opts.dryRun) {
+        const installed = MANAGED_AGENT_IDS.filter((id) => listInstalledVersions(id).length > 0);
+        const example = installed[0] ?? 'claude';
+        const error = '`agents sync --dry-run` has no umbrella preview: the machine-wide sync pulls repos, ' +
+            'reconciles every installed version, syncs devices, and repairs homes — stages that ' +
+            'cannot be previewed without making changes.';
+        const hint = `Preview one agent instead (this is non-destructive): agents sync ${example} --dry-run [--repo <repo>]`;
+        if (json) {
+            emitJson({ ok: false, mode: 'umbrella', dryRun: true, error, hint, installedAgents: installed });
+        }
+        else {
+            errLog(chalk.red(error));
+            errLog(chalk.gray(hint));
+            if (installed.length > 0)
+                errLog(chalk.gray(`Installed agents: ${installed.join(', ')}`));
+        }
+        process.exitCode = 1;
+        return;
+    }
     // Interactive bare `agents sync` (a TTY, no --yes, no scope flag) drops into
     // the two-checklist picker: which repos to sync from, which agents to sync
     // into. Any explicit flag, --yes, or --json keeps the non-interactive path.

package/dist/lib/accounts/slots.js

@@ -15,6 +15,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { agentConfigDirName } from '../agents.js';
 import { harnessAuth, harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
+import { installSessionTrackerHookSync } from '../hooks/install.js';
 import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../installations/store.js';
 import { carryForwardSettings } from '../settings-manifest.js';
 import { getHistoryDir, readMeta, updateMeta } from '../state.js';
@@ -71,6 +72,12 @@ function projectResources(harness, version, destHome, fromHome) {
             continue;
         writer.write({ version, versionHome: destHome, selection: names, cwd });
     }
+    if (supports(harness, 'hooks', version).ok) {
+        const tracker = installSessionTrackerHookSync(harness, version, destHome);
+        if (!tracker.installed && tracker.error) {
+            console.warn(`agents: SessionStart hook not installed for ${harness} account home ${destHome}: ${tracker.error}`);
+        }
+    }
 }
 /**
  * Remove slot artifacts whose source name is gone. Only the name-keyed kinds

package/dist/lib/agent-spec/agents.d.ts

@@ -355,25 +355,77 @@ export declare function antigravityOsKeyringProbe(platform?: NodeJS.Platform): {
 } | null;
 /** @internal test hook — clear the per-process keyring probe cache. */
 export declare function __resetAntigravityKeychainCacheForTest(): void;
+/** The XDG base dirs OpenCode reads, and the env var that overrides each. */
+declare const OPENCODE_XDG_DIRS: {
+    readonly data: {
+        readonly env: "XDG_DATA_HOME";
+        readonly fallback: readonly [".local", "share"];
+    };
+    readonly state: {
+        readonly env: "XDG_STATE_HOME";
+        readonly fallback: readonly [".local", "state"];
+    };
+};
+/**
+ * Resolve one of OpenCode's (sst/opencode) XDG-rooted files.
+ *
+ * OpenCode keeps provider credentials under `$XDG_DATA_HOME/opencode/` and TUI
+ * state under `$XDG_STATE_HOME/opencode/`, defaulting to `~/.local/share` and
+ * `~/.local/state` on EVERY platform — its `xdg-basedir` dependency does not
+ * special-case macOS, so there is no `~/Library/Application Support` variant.
+ * Both roots are account-global (not per-version), matching how
+ * `session/discover.ts` already resolves `~/.local/share/opencode/opencode.db`.
+ *
+ * Resolution order, first existing wins:
+ *   1. `<base>/<fallback>/opencode/<file>` — the passed per-version home. This is
+ *      primarily a test hook (suites write a hermetic file under a temp home)
+ *      but also covers any relocated install.
+ *   2. `$XDG_<KIND>_HOME/opencode/<file>` — an explicit XDG override, exactly
+ *      what OpenCode itself honours.
+ *   3. `<realHome>/<fallback>/opencode/<file>` — the active default, under
+ *      `AGENTS_REAL_HOME` or `os.homedir()`, so every installed version reflects
+ *      the one account-global state (same fallback shape as
+ *      resolveAccountCredentialPath).
+ * Returns the first existing path, or null. Never throws.
+ */
+export declare function resolveOpenCodeXdgPath(base: string, kind: keyof typeof OPENCODE_XDG_DIRS, file: string): string | null;
+/** OpenCode's signed-in identity, as far as `auth.json` can describe it. */
+export interface OpenCodeIdentity {
+    /** Sorted, "+"-joined provider ids holding a valid credential. */
+    providers: string;
+    /** Account email, when some OAuth credential's token carries the claim. */
+    email: string | null;
+    /** Plan tier from the same token (e.g. `Pro`), when present. */
+    plan: string | null;
+}
 /**
- * OpenCode's account identity: the sorted, "+"-joined list of provider ids
- * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
- * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
- * so this join is the closest thing to "which account is this" available — the
- * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ * OpenCode's account identity, read from `auth.json`.
+ *
+ * The provider join (`"meta+openai+opencode-go"`) is the stable key: OpenCode is
+ * a multi-provider harness, so "which providers are configured" is what actually
+ * identifies an install, and `session/discover.ts` indexes sessions by it.
+ * Providers that sign in over OAuth additionally hand OpenCode a token with real
+ * identity claims, so the email and plan are surfaced alongside it instead of
+ * leaving `agents view` showing a bare `id:` key for a login that knows exactly
+ * whose it is. Providers are walked in sorted order so a multi-OAuth install
+ * resolves to the same email on every machine.
  *
  * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
  * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
  * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
  * migrations) all three are permanently empty — no migration ever populates
  * them, and no session has ever written a row. Reading from them instead of
- * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
- * uses this function rather than duplicating a sqlite lookup against those
- * dead tables.
+ * `auth.json` always yields `undefined`, credential or not.
  *
  * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
  * missing, unreadable, or carries no valid credential.
  */
+export declare function resolveOpenCodeIdentity(base: string): OpenCodeIdentity | undefined;
+/**
+ * The provider join alone — the value `session/discover.ts` indexes sessions by,
+ * kept as its own entry point so callers that only need the key do not have to
+ * know about the OAuth claim walk.
+ */
 export declare function resolveOpenCodeAccountId(base: string): string | undefined;
 /**
  * Whether a Claude version home's credential file is present but carries no

package/dist/lib/agent-spec/agents.js

@@ -1692,34 +1692,41 @@ async function antigravityKeychainSignedIn() {
     }
     return cachedAgyKeychainSignedIn;
 }
+/** The XDG base dirs OpenCode reads, and the env var that overrides each. */
+const OPENCODE_XDG_DIRS = {
+    data: { env: 'XDG_DATA_HOME', fallback: ['.local', 'share'] },
+    state: { env: 'XDG_STATE_HOME', fallback: ['.local', 'state'] },
+};
 /**
- * OpenCode (sst/opencode) stores provider credentials in a single JSON file at
- * `$XDG_DATA_HOME/opencode/auth.json`, defaulting to
- * `~/.local/share/opencode/auth.json` on EVERY platform — its `xdg-basedir`
- * dependency does not special-case macOS, so there is no
- * `~/Library/Application Support` variant. The path is account-global (not
- * per-version), matching how `session/discover.ts` already resolves
- * `~/.local/share/opencode/opencode.db`.
+ * Resolve one of OpenCode's (sst/opencode) XDG-rooted files.
+ *
+ * OpenCode keeps provider credentials under `$XDG_DATA_HOME/opencode/` and TUI
+ * state under `$XDG_STATE_HOME/opencode/`, defaulting to `~/.local/share` and
+ * `~/.local/state` on EVERY platform — its `xdg-basedir` dependency does not
+ * special-case macOS, so there is no `~/Library/Application Support` variant.
+ * Both roots are account-global (not per-version), matching how
+ * `session/discover.ts` already resolves `~/.local/share/opencode/opencode.db`.
  *
  * Resolution order, first existing wins:
- *   1. `<base>/.local/share/opencode/auth.json` — the passed per-version home.
- *      This is primarily a test hook (suites write a hermetic auth file under a
- *      temp home) but also covers any relocated install.
- *   2. `$XDG_DATA_HOME/opencode/auth.json` — an explicit XDG override, exactly
+ *   1. `<base>/<fallback>/opencode/<file>` — the passed per-version home. This is
+ *      primarily a test hook (suites write a hermetic file under a temp home)
+ *      but also covers any relocated install.
+ *   2. `$XDG_<KIND>_HOME/opencode/<file>` — an explicit XDG override, exactly
  *      what OpenCode itself honours.
- *   3. `<realHome>/.local/share/opencode/auth.json` — the active default, under
+ *   3. `<realHome>/<fallback>/opencode/<file>` — the active default, under
  *      `AGENTS_REAL_HOME` or `os.homedir()`, so every installed version reflects
- *      the one account-global login (same fallback shape as
+ *      the one account-global state (same fallback shape as
  *      resolveAccountCredentialPath).
  * Returns the first existing path, or null. Never throws.
  */
-function resolveOpenCodeAuthPath(base) {
-    const candidates = [path.join(base, '.local', 'share', 'opencode', 'auth.json')];
-    const xdgData = process.env.XDG_DATA_HOME;
-    if (xdgData)
-        candidates.push(path.join(xdgData, 'opencode', 'auth.json'));
+export function resolveOpenCodeXdgPath(base, kind, file) {
+    const { env, fallback } = OPENCODE_XDG_DIRS[kind];
+    const candidates = [path.join(base, ...fallback, 'opencode', file)];
+    const override = process.env[env];
+    if (override)
+        candidates.push(path.join(override, 'opencode', file));
     const realHome = process.env.AGENTS_REAL_HOME || os.homedir();
-    candidates.push(path.join(realHome, '.local', 'share', 'opencode', 'auth.json'));
+    candidates.push(path.join(realHome, ...fallback, 'opencode', file));
     for (const candidate of candidates) {
         try {
             if (fs.existsSync(candidate))
@@ -1729,6 +1736,9 @@ function resolveOpenCodeAuthPath(base) {
     }
     return null;
 }
+function resolveOpenCodeAuthPath(base) {
+    return resolveOpenCodeXdgPath(base, 'data', 'auth.json');
+}
 /**
  * Validate one OpenCode auth.json entry against its discriminated union
  * (`type: 'oauth' | 'api' | 'wellknown'`) and confirm the credential actually
@@ -1751,25 +1761,58 @@ function isValidOpenCodeCredential(value) {
     }
 }
 /**
- * OpenCode's account identity: the sorted, "+"-joined list of provider ids
- * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
- * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
- * so this join is the closest thing to "which account is this" available — the
- * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ * The human identity an OpenCode `type: 'oauth'` credential carries in its
+ * access token, when that token is a JWT. Provider-agnostic by shape: the
+ * OpenAI-issued token OpenCode stores under its `openai` provider carries the
+ * same namespaced claims Codex's own `auth.json` does (`…/profile.email`,
+ * `…/auth.chatgpt_plan_type`), so the extraction is shared with `case 'codex'`
+ * rather than reinvented. A plain `email` claim is accepted too, for providers
+ * that issue an ordinary OIDC token.
+ *
+ * Only claims are read — the token itself is never returned or logged. A
+ * non-JWT credential (Anthropic's `sk-ant-oat…` opaque token, any `type: 'api'`
+ * key) simply yields nothing.
+ */
+function openCodeOauthIdentity(cred) {
+    const access = cred?.access;
+    if (typeof access !== 'string' || access.length === 0)
+        return { email: null, plan: null };
+    const claims = decodeJwtPayload(access);
+    if (!claims)
+        return { email: null, plan: null };
+    const profile = claims['https://api.openai.com/profile'] || {};
+    const auth = claims['https://api.openai.com/auth'] || {};
+    const rawEmail = profile.email ?? claims.email;
+    const email = typeof rawEmail === 'string' && rawEmail.includes('@') ? rawEmail : null;
+    const rawPlan = auth.chatgpt_plan_type;
+    const plan = typeof rawPlan === 'string' && rawPlan
+        ? rawPlan.charAt(0).toUpperCase() + rawPlan.slice(1)
+        : null;
+    return { email, plan };
+}
+/**
+ * OpenCode's account identity, read from `auth.json`.
+ *
+ * The provider join (`"meta+openai+opencode-go"`) is the stable key: OpenCode is
+ * a multi-provider harness, so "which providers are configured" is what actually
+ * identifies an install, and `session/discover.ts` indexes sessions by it.
+ * Providers that sign in over OAuth additionally hand OpenCode a token with real
+ * identity claims, so the email and plan are surfaced alongside it instead of
+ * leaving `agents view` showing a bare `id:` key for a login that knows exactly
+ * whose it is. Providers are walked in sorted order so a multi-OAuth install
+ * resolves to the same email on every machine.
  *
  * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
  * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
  * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
  * migrations) all three are permanently empty — no migration ever populates
  * them, and no session has ever written a row. Reading from them instead of
- * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
- * uses this function rather than duplicating a sqlite lookup against those
- * dead tables.
+ * `auth.json` always yields `undefined`, credential or not.
  *
  * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
  * missing, unreadable, or carries no valid credential.
  */
-export function resolveOpenCodeAccountId(base) {
+export function resolveOpenCodeIdentity(base) {
     const authPath = resolveOpenCodeAuthPath(base);
     if (!authPath)
         return undefined;
@@ -1777,16 +1820,34 @@ export function resolveOpenCodeAccountId(base) {
         const data = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
         if (!data || typeof data !== 'object')
             return undefined;
-        const providers = Object.entries(data)
+        const valid = Object.entries(data)
             .filter(([, cred]) => isValidOpenCodeCredential(cred))
-            .map(([id]) => id)
-            .sort();
-        return providers.length ? providers.join('+') : undefined;
+            .sort(([a], [b]) => a.localeCompare(b));
+        if (valid.length === 0)
+            return undefined;
+        let email = null;
+        let plan = null;
+        for (const [, cred] of valid) {
+            const claimed = openCodeOauthIdentity(cred);
+            email ??= claimed.email;
+            plan ??= claimed.plan;
+            if (email && plan)
+                break;
+        }
+        return { providers: valid.map(([id]) => id).join('+'), email, plan };
     }
     catch {
         return undefined;
     }
 }
+/**
+ * The provider join alone — the value `session/discover.ts` indexes sessions by,
+ * kept as its own entry point so callers that only need the key do not have to
+ * know about the OAuth claim walk.
+ */
+export function resolveOpenCodeAccountId(base) {
+    return resolveOpenCodeIdentity(base)?.providers;
+}
 /**
  * Whether a Muse Code `~/.config/muse/auth.json` document holds any usable
  * access token. Live shape from `muse login` (device OAuth, Muse Code 0.1.0):
@@ -1972,6 +2033,11 @@ export async function getAccountInfo(agentId, home) {
         claude: path.join(base, '.claude.json'),
         codex: path.join(base, '.codex', 'auth.json'),
         gemini: path.join(base, '.gemini', 'google_accounts.json'),
+        // OpenCode keeps every session in ONE sqlite file rather than a directory of
+        // per-session transcripts, so the session-file walk resolveLastActive runs
+        // for other agents finds nothing. Its mtime fallback is the right read here:
+        // opencode.db is written on every turn, so it tracks real activity.
+        opencode: resolveOpenCodeXdgPath(base, 'data', 'opencode.db') ?? undefined,
     };
     const lastActive = resolveLastActive(agentId, base, configFiles[agentId]);
     try {
@@ -2238,20 +2304,27 @@ export async function getAccountInfo(agentId, home) {
             }
             case 'opencode': {
                 // OpenCode's auth.json is a record keyed by provider id ->
-                // { type: 'oauth'|'api'|'wellknown', ...secret fields }. There is no
-                // email/identity claim to surface, so — like antigravity/kimi — we
-                // report signed-in state plus the NON-SECRET provider metadata (which
-                // provider ids hold a valid credential) and never read the tokens/keys
-                // themselves. The user's complaint was the row read "not signed in"
-                // despite a live login; a valid provider entry now shows e.g.
-                // "id:muse-spark" so they can see exactly which provider is configured.
-                // resolveOpenCodeAccountId is the single source of truth for this join —
-                // session/discover.ts reuses it for the indexed `account` field.
-                const accountId = resolveOpenCodeAccountId(base);
-                if (!accountId)
+                // { type: 'oauth'|'api'|'wellknown', ...secret fields }. The provider
+                // join is the identity key (see resolveOpenCodeIdentity), and an OAuth
+                // provider's token additionally carries the real account email and plan
+                // — so the row shows who is signed in rather than only a bare `id:` key.
+                // Secrets are never read out; only JWT claims are.
+                const identity = resolveOpenCodeIdentity(base);
+                if (!identity)
                     return { ...empty, lastActive };
-                const accountKey = buildIdentityKey(agentId, [['providers', accountId]]);
-                return { ...empty, signedIn: true, accountId, accountKey, lastActive };
+                // Keyed on providers, not email: OpenCode bills through whichever
+                // provider credentials are configured, so two installs sharing one
+                // email but different provider sets are genuinely different accounts.
+                const accountKey = buildIdentityKey(agentId, [['providers', identity.providers]]);
+                return {
+                    ...empty,
+                    signedIn: true,
+                    accountId: identity.providers,
+                    accountKey,
+                    email: identity.email,
+                    plan: identity.plan,
+                    lastActive,
+                };
             }
             case 'muse': {
                 // Muse Code authenticates with META_API_KEY (env, highest priority) or

package/dist/lib/daemon/daemon.d.ts

@@ -11,6 +11,17 @@ import { getAgentsBinPath } from '../cli-entry.js';
 import type { ServiceHealth } from './service.js';
 /** Health for every service currently registered on the live supervisor, or `null` if the daemon isn't running in this process. */
 export declare function getServiceSupervisorHealth(): Record<string, ServiceHealth> | null;
+/**
+ * The service-manager identifiers of the REAL install's daemon — never
+ * namespaced. A caller under a redirected HOME (a test/e2e harness) uses these
+ * to recognize the box's production daemon as owned, where
+ * `daemonSystemdUnitName()`/`daemonServiceLabel()` would name only its own
+ * sandbox job (W4, PHNX-3736).
+ */
+export declare function productionDaemonServiceNames(): {
+    systemdUnit: string;
+    launchdLabel: string;
+};
 /**
  * RUSH-2639 (residual): launchd/systemd route `unload`/`load`/`list` by the
  * service identifier ALONE, never by the plist/unit file's path. Baking the
@@ -96,7 +107,7 @@ export declare function singleShot(fn: () => Promise<void>): () => Promise<void>
  */
 export declare function getDaemonLogPath(): string;
 /** Read the stored daemon PID from disk. Returns null if not present or invalid. */
-export declare function readDaemonPid(): number | null;
+export declare function readDaemonPid(daemonDir?: string): number | null;
 /** Write the daemon PID to the pid file. */
 export declare function writeDaemonPid(pid: number): void;
 /** Remove the daemon PID file. */
@@ -286,6 +297,28 @@ export declare function generateLaunchdPlist(agentsBin?: string): string;
  */
 export declare function generateSystemdUnit(agentsBin?: string): string;
 export { getAgentsBinPath };
+/**
+ * Ask the service manager for the daemon's live PID. Used as a fallback when
+ * the daemon hasn't yet written its pid file but launchd/systemd already report
+ * it running — so a start never has to surface a null PID for a daemon that is
+ * in fact up. Returns null when the service isn't running or the query fails.
+ *
+ * `names` defaults to THIS process's (possibly sandbox-namespaced) job; a
+ * caller under a redirected HOME passes `productionDaemonServiceNames()` to
+ * ask after the real install's unit instead. Read-only either way.
+ */
+export declare function readServiceManagerPid(platform?: NodeJS.Platform, names?: {
+    systemdUnit: string;
+    launchdLabel: string;
+}): number | null;
+/**
+ * Thrown when a daemon LAUNCH is attempted under a redirected HOME without the
+ * explicit test opt-in (W4, PHNX-3736). `bootstrap.ts` prints the message
+ * without a stack — this is user-actionable, not an engineering bug.
+ */
+export declare class RedirectedHomeDaemonError extends Error {
+    name: string;
+}
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(agentsBin?: string): {
     pid: number | null;

package/dist/lib/daemon/daemon.js

@@ -77,6 +77,16 @@ const LOG_MAX_SIZE = 5 * 1024 * 1024; // 5 MB
 const LOG_ROTATE_COUNT = 3;
 const PLIST_NAME = 'com.phnx-labs.agents-daemon';
 const SYSTEMD_UNIT = 'agents-daemon.service';
+/**
+ * The service-manager identifiers of the REAL install's daemon — never
+ * namespaced. A caller under a redirected HOME (a test/e2e harness) uses these
+ * to recognize the box's production daemon as owned, where
+ * `daemonSystemdUnitName()`/`daemonServiceLabel()` would name only its own
+ * sandbox job (W4, PHNX-3736).
+ */
+export function productionDaemonServiceNames() {
+    return { systemdUnit: SYSTEMD_UNIT, launchdLabel: PLIST_NAME };
+}
 /**
  * RUSH-2639 (residual): launchd/systemd route `unload`/`load`/`list` by the
  * service identifier ALONE, never by the plist/unit file's path. Baking the
@@ -286,8 +296,8 @@ function getSystemdUnitPath() {
     return path.join(os.homedir(), '.config', 'systemd', 'user', daemonSystemdUnitName());
 }
 /** Read the stored daemon PID from disk. Returns null if not present or invalid. */
-export function readDaemonPid() {
-    const pidPath = getPidPath();
+export function readDaemonPid(daemonDir) {
+    const pidPath = daemonDir ? path.join(daemonDir, PID_FILE) : getPidPath();
     if (!fs.existsSync(pidPath))
         return null;
     try {
@@ -1655,19 +1665,27 @@ export { getAgentsBinPath };
  * the daemon hasn't yet written its pid file but launchd/systemd already report
  * it running — so a start never has to surface a null PID for a daemon that is
  * in fact up. Returns null when the service isn't running or the query fails.
+ *
+ * `names` defaults to THIS process's (possibly sandbox-namespaced) job; a
+ * caller under a redirected HOME passes `productionDaemonServiceNames()` to
+ * ask after the real install's unit instead. Read-only either way.
  */
-function readServiceManagerPid(platform = os.platform()) {
-    const reg = serviceManagerRegistrationAllowed();
-    if (!reg.allowed)
+export function readServiceManagerPid(platform = os.platform(), names) {
+    const resolved = names ?? { systemdUnit: daemonSystemdUnitName(), launchdLabel: daemonServiceLabel() };
+    // The registration gate exists because a sandboxed process must not REGISTER
+    // or tear down jobs in the real per-user service manager. Asking after an
+    // explicitly named job is read-only — in particular the production unit from
+    // a redirected-HOME caller (W4) — and mutates nothing, so it is let through.
+    if (names === undefined && !serviceManagerRegistrationAllowed().allowed)
         return null;
     try {
         if (platform === 'linux') {
-            const out = execFileSync('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', daemonSystemdUnitName()], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+            const out = execFileSync('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', resolved.systemdUnit], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
             const pid = parseInt(out, 10);
             return !isNaN(pid) && pid > 0 ? pid : null;
         }
         if (platform === 'darwin') {
-            const out = execFileSync('launchctl', ['list', daemonServiceLabel()], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+            const out = execFileSync('launchctl', ['list', resolved.launchdLabel], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
             const m = out.match(/"PID"\s*=\s*(\d+)/);
             if (m) {
                 const pid = parseInt(m[1], 10);
@@ -1678,12 +1696,47 @@ function readServiceManagerPid(platform = os.platform()) {
     catch { /* not running / manager unavailable */ }
     return null;
 }
+/**
+ * Thrown when a daemon LAUNCH is attempted under a redirected HOME without the
+ * explicit test opt-in (W4, PHNX-3736). `bootstrap.ts` prints the message
+ * without a stack — this is user-actionable, not an engineering bug.
+ */
+export class RedirectedHomeDaemonError extends Error {
+    name = 'RedirectedHomeDaemonError';
+}
+/**
+ * W4 (PHNX-3736): never LAUNCH a daemon under a redirected (sandbox/test) HOME
+ * without an explicit opt-in. A daemon started there keeps its own pid file
+ * under the temp home, so the real install's pid-file takeover can never see
+ * it — the leaked `HOME=/tmp/pin-e2e-<pid>` daemon that ran 4+ days on
+ * yosemite-s1 was launched exactly this way by a headless e2e session that
+ * never cleaned up. RUSH-3021 closed this for `ensureDaemonStarted`'s
+ * AUTO-start path but left the explicit `startDaemon()` open, which is the
+ * path the e2e harness took.
+ *
+ * Placed after the `already-running` early-return: reporting a live daemon (so
+ * `daemon stop` can still kill a leaked one) must stay possible under any
+ * HOME. `AGENTS_ALLOW_TEST_DAEMON=1` is the deliberate test/e2e seam — a
+ * harness that sets it owns stopping what it starts.
+ */
+function assertDaemonLaunchHomeAllowed() {
+    const suffix = isolatedHomeSuffix();
+    if (!suffix)
+        return;
+    if (process.env.AGENTS_ALLOW_TEST_DAEMON === '1')
+        return;
+    throw new RedirectedHomeDaemonError(`refusing to start the daemon under a redirected HOME (sandbox-${suffix}): ` +
+        `a daemon launched here keeps its own pid file under ${process.env.HOME}, invisible to the real ` +
+        `install's pid-file takeover, and outlives whatever launched it (PHNX-3736). ` +
+        `For a deliberate test/e2e launch set AGENTS_ALLOW_TEST_DAEMON=1 — and stop the daemon when done.`);
+}
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export function startDaemon(agentsBin) {
     if (isDaemonRunning()) {
         const pid = readDaemonPid();
         return { pid, method: 'already-running' };
     }
+    assertDaemonLaunchHomeAllowed();
     const releaseLock = acquireStartLock();
     if (!releaseLock) {
         // Another process is already starting the daemon
@@ -1769,8 +1822,9 @@ export function ensureDaemonStarted() {
     // recursive teardown rm (ENOTEMPTY). Placed after the already-running branch
     // — reporting a live daemon stays allowed, same as the circuit breaker.
     // AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME=1 is the test seam for suites
-    // that exercise daemon startup deliberately; `agents daemon start` remains
-    // the operator override.
+    // that exercise daemon startup deliberately. The explicit `agents daemon
+    // start` path is gated separately by startDaemon's own redirected-HOME
+    // refusal (AGENTS_ALLOW_TEST_DAEMON=1, W4/PHNX-3736).
     if (!serviceManagerRegistrationAllowed().allowed)
         return null;
     // RUSH-2418: the auto-start circuit breaker. A daemon that dies during