@phnx-labs/agents-cli 1.22.107 → 1.22.110

package/dist/lib/accounting/usage.js

@@ -431,6 +431,7 @@ export async function getUsageInfoForIdentity(input, opts) {
             organizationId: input.info.organizationId,
             fileOnly: opts?.fileOnly,
             allowInteractiveLogin: opts?.allowInteractiveLogin,
+            nativeFileLogin: opts?.nativeFileLogin,
             signal: opts?.signal,
         });
     }
@@ -469,6 +470,7 @@ export async function getUsageInfoForIdentity(input, opts) {
     // Explicit refresh: block on the shared device collector.
     return fetchLiveUsageDeduped(input, usageKey, cached, opts?.fileOnly === true, {
         allowInteractiveLogin: opts?.allowInteractiveLogin === true,
+        nativeFileLogin: opts?.nativeFileLogin === true,
         signal: opts?.signal,
     });
 }
@@ -501,6 +503,7 @@ async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly, opts) {
                 usageScope: usageKey,
                 fileOnly,
                 allowInteractiveLogin: opts?.allowInteractiveLogin === true,
+                nativeFileLogin: opts?.nativeFileLogin === true,
                 signal: opts?.signal,
             });
             if (usage.snapshot) {
@@ -935,9 +938,10 @@ async function getClaudeUsageInfo(options) {
         // requires (the setup-token is user:inference → 403, RUSH-2392). It is unset
         // for every background caller, so the RUSH-1822 guarantee is untouched there.
         const oauth = await loadClaudeOauth(options?.home, {
-            accessTokenCache: true,
-            fileOnly: options?.fileOnly === true,
+            accessTokenCache: options?.nativeFileLogin !== true,
+            fileOnly: options?.fileOnly === true || options?.nativeFileLogin === true,
             allowInteractiveLogin: options?.allowInteractiveLogin === true,
+            nativeFileLogin: options?.nativeFileLogin === true,
         });
         if (!oauth?.accessToken) {
             // NOT the shared no-credential message: "sign in" is not a remedy here.
@@ -1612,7 +1616,33 @@ function deleteCachedClaudeOauth(service) {
  * `.credentials.json` only. Used by the daemon usage refresher so a background
  * tick can never pop Touch ID.
  */
+/** True when `<home>/.claude/.credentials.json` is a native rotating OAuth blob. */
+export function claudeHomeHasNativeOauthFile(home) {
+    return readClaudeNativeCredentialsFile(home) !== null;
+}
+function readClaudeNativeCredentialsFile(home) {
+    const credsPath = path.join(home ?? os.homedir(), '.claude', '.credentials.json');
+    try {
+        if (!fs.existsSync(credsPath))
+            return null;
+        const parsed = parseClaudeOauthPayload(fs.readFileSync(credsPath, 'utf-8'));
+        // A native rotating blob has a refresh token. A setup-token-shaped file
+        // (access only) is not a native login and must not be polled as one.
+        if (!parsed?.accessToken?.trim() || !parsed.refreshToken?.trim())
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
 export async function loadClaudeOauth(home, opts) {
+    // Headed usage poller: the native rotating blob in `.credentials.json` is
+    // the only credential that carries `user:profile` without opening the ACL
+    // keychain (Touch ID) or firing a setup-token that 403s on /oauth/usage.
+    if (opts?.nativeFileLogin === true) {
+        return readClaudeNativeCredentialsFile(home);
+    }
     // Read-only usage/probe callers (accessTokenCache) authenticate ONLY with a
     // file-based setup-token from the `auth` bundle — never Claude Code's
     // interactive login. The usage endpoint accepts any sk-ant-oat01 bearer, and
@@ -1963,6 +1993,8 @@ function serializeClaudeUsageSnapshot(snapshot) {
             resetsAt: window.resetsAt?.toISOString() || null,
             windowMinutes: window.windowMinutes,
         })),
+        freshnessSource: snapshot.freshness?.source,
+        pollerDevice: snapshot.freshness?.poller,
     };
 }
 /**
@@ -2028,6 +2060,9 @@ function deserializeClaudeUsageSnapshot(snapshot, now) {
         plan: snapshot.plan ?? null,
         refreshHint: snapshot.refreshHint ?? null,
         unavailable,
+        freshness: snapshot.freshnessSource
+            ? { source: snapshot.freshnessSource, poller: snapshot.pollerDevice }
+            : undefined,
     };
 }
 /**

package/dist/lib/accounts/slots.js

@@ -15,6 +15,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { agentConfigDirName } from '../agents.js';
 import { harnessAuth, harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
+import { installSessionTrackerHookSync } from '../hooks/install.js';
 import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../installations/store.js';
 import { carryForwardSettings } from '../settings-manifest.js';
 import { getHistoryDir, readMeta, updateMeta } from '../state.js';
@@ -71,6 +72,12 @@ function projectResources(harness, version, destHome, fromHome) {
             continue;
         writer.write({ version, versionHome: destHome, selection: names, cwd });
     }
+    if (supports(harness, 'hooks', version).ok) {
+        const tracker = installSessionTrackerHookSync(harness, version, destHome);
+        if (!tracker.installed && tracker.error) {
+            console.warn(`agents: SessionStart hook not installed for ${harness} account home ${destHome}: ${tracker.error}`);
+        }
+    }
 }
 /**
  * Remove slot artifacts whose source name is gone. Only the name-keyed kinds

package/dist/lib/agent-spec/agents.d.ts

@@ -355,25 +355,77 @@ export declare function antigravityOsKeyringProbe(platform?: NodeJS.Platform): {
 } | null;
 /** @internal test hook — clear the per-process keyring probe cache. */
 export declare function __resetAntigravityKeychainCacheForTest(): void;
+/** The XDG base dirs OpenCode reads, and the env var that overrides each. */
+declare const OPENCODE_XDG_DIRS: {
+    readonly data: {
+        readonly env: "XDG_DATA_HOME";
+        readonly fallback: readonly [".local", "share"];
+    };
+    readonly state: {
+        readonly env: "XDG_STATE_HOME";
+        readonly fallback: readonly [".local", "state"];
+    };
+};
+/**
+ * Resolve one of OpenCode's (sst/opencode) XDG-rooted files.
+ *
+ * OpenCode keeps provider credentials under `$XDG_DATA_HOME/opencode/` and TUI
+ * state under `$XDG_STATE_HOME/opencode/`, defaulting to `~/.local/share` and
+ * `~/.local/state` on EVERY platform — its `xdg-basedir` dependency does not
+ * special-case macOS, so there is no `~/Library/Application Support` variant.
+ * Both roots are account-global (not per-version), matching how
+ * `session/discover.ts` already resolves `~/.local/share/opencode/opencode.db`.
+ *
+ * Resolution order, first existing wins:
+ *   1. `<base>/<fallback>/opencode/<file>` — the passed per-version home. This is
+ *      primarily a test hook (suites write a hermetic file under a temp home)
+ *      but also covers any relocated install.
+ *   2. `$XDG_<KIND>_HOME/opencode/<file>` — an explicit XDG override, exactly
+ *      what OpenCode itself honours.
+ *   3. `<realHome>/<fallback>/opencode/<file>` — the active default, under
+ *      `AGENTS_REAL_HOME` or `os.homedir()`, so every installed version reflects
+ *      the one account-global state (same fallback shape as
+ *      resolveAccountCredentialPath).
+ * Returns the first existing path, or null. Never throws.
+ */
+export declare function resolveOpenCodeXdgPath(base: string, kind: keyof typeof OPENCODE_XDG_DIRS, file: string): string | null;
+/** OpenCode's signed-in identity, as far as `auth.json` can describe it. */
+export interface OpenCodeIdentity {
+    /** Sorted, "+"-joined provider ids holding a valid credential. */
+    providers: string;
+    /** Account email, when some OAuth credential's token carries the claim. */
+    email: string | null;
+    /** Plan tier from the same token (e.g. `Pro`), when present. */
+    plan: string | null;
+}
 /**
- * OpenCode's account identity: the sorted, "+"-joined list of provider ids
- * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
- * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
- * so this join is the closest thing to "which account is this" available — the
- * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ * OpenCode's account identity, read from `auth.json`.
+ *
+ * The provider join (`"meta+openai+opencode-go"`) is the stable key: OpenCode is
+ * a multi-provider harness, so "which providers are configured" is what actually
+ * identifies an install, and `session/discover.ts` indexes sessions by it.
+ * Providers that sign in over OAuth additionally hand OpenCode a token with real
+ * identity claims, so the email and plan are surfaced alongside it instead of
+ * leaving `agents view` showing a bare `id:` key for a login that knows exactly
+ * whose it is. Providers are walked in sorted order so a multi-OAuth install
+ * resolves to the same email on every machine.
  *
  * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
  * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
  * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
  * migrations) all three are permanently empty — no migration ever populates
  * them, and no session has ever written a row. Reading from them instead of
- * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
- * uses this function rather than duplicating a sqlite lookup against those
- * dead tables.
+ * `auth.json` always yields `undefined`, credential or not.
  *
  * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
  * missing, unreadable, or carries no valid credential.
  */
+export declare function resolveOpenCodeIdentity(base: string): OpenCodeIdentity | undefined;
+/**
+ * The provider join alone — the value `session/discover.ts` indexes sessions by,
+ * kept as its own entry point so callers that only need the key do not have to
+ * know about the OAuth claim walk.
+ */
 export declare function resolveOpenCodeAccountId(base: string): string | undefined;
 /**
  * Whether a Claude version home's credential file is present but carries no

package/dist/lib/agent-spec/agents.js

@@ -1692,34 +1692,41 @@ async function antigravityKeychainSignedIn() {
     }
     return cachedAgyKeychainSignedIn;
 }
+/** The XDG base dirs OpenCode reads, and the env var that overrides each. */
+const OPENCODE_XDG_DIRS = {
+    data: { env: 'XDG_DATA_HOME', fallback: ['.local', 'share'] },
+    state: { env: 'XDG_STATE_HOME', fallback: ['.local', 'state'] },
+};
 /**
- * OpenCode (sst/opencode) stores provider credentials in a single JSON file at
- * `$XDG_DATA_HOME/opencode/auth.json`, defaulting to
- * `~/.local/share/opencode/auth.json` on EVERY platform — its `xdg-basedir`
- * dependency does not special-case macOS, so there is no
- * `~/Library/Application Support` variant. The path is account-global (not
- * per-version), matching how `session/discover.ts` already resolves
- * `~/.local/share/opencode/opencode.db`.
+ * Resolve one of OpenCode's (sst/opencode) XDG-rooted files.
+ *
+ * OpenCode keeps provider credentials under `$XDG_DATA_HOME/opencode/` and TUI
+ * state under `$XDG_STATE_HOME/opencode/`, defaulting to `~/.local/share` and
+ * `~/.local/state` on EVERY platform — its `xdg-basedir` dependency does not
+ * special-case macOS, so there is no `~/Library/Application Support` variant.
+ * Both roots are account-global (not per-version), matching how
+ * `session/discover.ts` already resolves `~/.local/share/opencode/opencode.db`.
  *
  * Resolution order, first existing wins:
- *   1. `<base>/.local/share/opencode/auth.json` — the passed per-version home.
- *      This is primarily a test hook (suites write a hermetic auth file under a
- *      temp home) but also covers any relocated install.
- *   2. `$XDG_DATA_HOME/opencode/auth.json` — an explicit XDG override, exactly
+ *   1. `<base>/<fallback>/opencode/<file>` — the passed per-version home. This is
+ *      primarily a test hook (suites write a hermetic file under a temp home)
+ *      but also covers any relocated install.
+ *   2. `$XDG_<KIND>_HOME/opencode/<file>` — an explicit XDG override, exactly
  *      what OpenCode itself honours.
- *   3. `<realHome>/.local/share/opencode/auth.json` — the active default, under
+ *   3. `<realHome>/<fallback>/opencode/<file>` — the active default, under
  *      `AGENTS_REAL_HOME` or `os.homedir()`, so every installed version reflects
- *      the one account-global login (same fallback shape as
+ *      the one account-global state (same fallback shape as
  *      resolveAccountCredentialPath).
  * Returns the first existing path, or null. Never throws.
  */
-function resolveOpenCodeAuthPath(base) {
-    const candidates = [path.join(base, '.local', 'share', 'opencode', 'auth.json')];
-    const xdgData = process.env.XDG_DATA_HOME;
-    if (xdgData)
-        candidates.push(path.join(xdgData, 'opencode', 'auth.json'));
+export function resolveOpenCodeXdgPath(base, kind, file) {
+    const { env, fallback } = OPENCODE_XDG_DIRS[kind];
+    const candidates = [path.join(base, ...fallback, 'opencode', file)];
+    const override = process.env[env];
+    if (override)
+        candidates.push(path.join(override, 'opencode', file));
     const realHome = process.env.AGENTS_REAL_HOME || os.homedir();
-    candidates.push(path.join(realHome, '.local', 'share', 'opencode', 'auth.json'));
+    candidates.push(path.join(realHome, ...fallback, 'opencode', file));
     for (const candidate of candidates) {
         try {
             if (fs.existsSync(candidate))
@@ -1729,6 +1736,9 @@ function resolveOpenCodeAuthPath(base) {
     }
     return null;
 }
+function resolveOpenCodeAuthPath(base) {
+    return resolveOpenCodeXdgPath(base, 'data', 'auth.json');
+}
 /**
  * Validate one OpenCode auth.json entry against its discriminated union
  * (`type: 'oauth' | 'api' | 'wellknown'`) and confirm the credential actually
@@ -1751,25 +1761,58 @@ function isValidOpenCodeCredential(value) {
     }
 }
 /**
- * OpenCode's account identity: the sorted, "+"-joined list of provider ids
- * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
- * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
- * so this join is the closest thing to "which account is this" available — the
- * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ * The human identity an OpenCode `type: 'oauth'` credential carries in its
+ * access token, when that token is a JWT. Provider-agnostic by shape: the
+ * OpenAI-issued token OpenCode stores under its `openai` provider carries the
+ * same namespaced claims Codex's own `auth.json` does (`…/profile.email`,
+ * `…/auth.chatgpt_plan_type`), so the extraction is shared with `case 'codex'`
+ * rather than reinvented. A plain `email` claim is accepted too, for providers
+ * that issue an ordinary OIDC token.
+ *
+ * Only claims are read — the token itself is never returned or logged. A
+ * non-JWT credential (Anthropic's `sk-ant-oat…` opaque token, any `type: 'api'`
+ * key) simply yields nothing.
+ */
+function openCodeOauthIdentity(cred) {
+    const access = cred?.access;
+    if (typeof access !== 'string' || access.length === 0)
+        return { email: null, plan: null };
+    const claims = decodeJwtPayload(access);
+    if (!claims)
+        return { email: null, plan: null };
+    const profile = claims['https://api.openai.com/profile'] || {};
+    const auth = claims['https://api.openai.com/auth'] || {};
+    const rawEmail = profile.email ?? claims.email;
+    const email = typeof rawEmail === 'string' && rawEmail.includes('@') ? rawEmail : null;
+    const rawPlan = auth.chatgpt_plan_type;
+    const plan = typeof rawPlan === 'string' && rawPlan
+        ? rawPlan.charAt(0).toUpperCase() + rawPlan.slice(1)
+        : null;
+    return { email, plan };
+}
+/**
+ * OpenCode's account identity, read from `auth.json`.
+ *
+ * The provider join (`"meta+openai+opencode-go"`) is the stable key: OpenCode is
+ * a multi-provider harness, so "which providers are configured" is what actually
+ * identifies an install, and `session/discover.ts` indexes sessions by it.
+ * Providers that sign in over OAuth additionally hand OpenCode a token with real
+ * identity claims, so the email and plan are surfaced alongside it instead of
+ * leaving `agents view` showing a bare `id:` key for a login that knows exactly
+ * whose it is. Providers are walked in sorted order so a multi-OAuth install
+ * resolves to the same email on every machine.
  *
  * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
  * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
  * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
  * migrations) all three are permanently empty — no migration ever populates
  * them, and no session has ever written a row. Reading from them instead of
- * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
- * uses this function rather than duplicating a sqlite lookup against those
- * dead tables.
+ * `auth.json` always yields `undefined`, credential or not.
  *
  * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
  * missing, unreadable, or carries no valid credential.
  */
-export function resolveOpenCodeAccountId(base) {
+export function resolveOpenCodeIdentity(base) {
     const authPath = resolveOpenCodeAuthPath(base);
     if (!authPath)
         return undefined;
@@ -1777,16 +1820,34 @@ export function resolveOpenCodeAccountId(base) {
         const data = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
         if (!data || typeof data !== 'object')
             return undefined;
-        const providers = Object.entries(data)
+        const valid = Object.entries(data)
             .filter(([, cred]) => isValidOpenCodeCredential(cred))
-            .map(([id]) => id)
-            .sort();
-        return providers.length ? providers.join('+') : undefined;
+            .sort(([a], [b]) => a.localeCompare(b));
+        if (valid.length === 0)
+            return undefined;
+        let email = null;
+        let plan = null;
+        for (const [, cred] of valid) {
+            const claimed = openCodeOauthIdentity(cred);
+            email ??= claimed.email;
+            plan ??= claimed.plan;
+            if (email && plan)
+                break;
+        }
+        return { providers: valid.map(([id]) => id).join('+'), email, plan };
     }
     catch {
         return undefined;
     }
 }
+/**
+ * The provider join alone — the value `session/discover.ts` indexes sessions by,
+ * kept as its own entry point so callers that only need the key do not have to
+ * know about the OAuth claim walk.
+ */
+export function resolveOpenCodeAccountId(base) {
+    return resolveOpenCodeIdentity(base)?.providers;
+}
 /**
  * Whether a Muse Code `~/.config/muse/auth.json` document holds any usable
  * access token. Live shape from `muse login` (device OAuth, Muse Code 0.1.0):
@@ -1972,6 +2033,11 @@ export async function getAccountInfo(agentId, home) {
         claude: path.join(base, '.claude.json'),
         codex: path.join(base, '.codex', 'auth.json'),
         gemini: path.join(base, '.gemini', 'google_accounts.json'),
+        // OpenCode keeps every session in ONE sqlite file rather than a directory of
+        // per-session transcripts, so the session-file walk resolveLastActive runs
+        // for other agents finds nothing. Its mtime fallback is the right read here:
+        // opencode.db is written on every turn, so it tracks real activity.
+        opencode: resolveOpenCodeXdgPath(base, 'data', 'opencode.db') ?? undefined,
     };
     const lastActive = resolveLastActive(agentId, base, configFiles[agentId]);
     try {
@@ -2238,20 +2304,27 @@ export async function getAccountInfo(agentId, home) {
             }
             case 'opencode': {
                 // OpenCode's auth.json is a record keyed by provider id ->
-                // { type: 'oauth'|'api'|'wellknown', ...secret fields }. There is no
-                // email/identity claim to surface, so — like antigravity/kimi — we
-                // report signed-in state plus the NON-SECRET provider metadata (which
-                // provider ids hold a valid credential) and never read the tokens/keys
-                // themselves. The user's complaint was the row read "not signed in"
-                // despite a live login; a valid provider entry now shows e.g.
-                // "id:muse-spark" so they can see exactly which provider is configured.
-                // resolveOpenCodeAccountId is the single source of truth for this join —
-                // session/discover.ts reuses it for the indexed `account` field.
-                const accountId = resolveOpenCodeAccountId(base);
-                if (!accountId)
+                // { type: 'oauth'|'api'|'wellknown', ...secret fields }. The provider
+                // join is the identity key (see resolveOpenCodeIdentity), and an OAuth
+                // provider's token additionally carries the real account email and plan
+                // — so the row shows who is signed in rather than only a bare `id:` key.
+                // Secrets are never read out; only JWT claims are.
+                const identity = resolveOpenCodeIdentity(base);
+                if (!identity)
                     return { ...empty, lastActive };
-                const accountKey = buildIdentityKey(agentId, [['providers', accountId]]);
-                return { ...empty, signedIn: true, accountId, accountKey, lastActive };
+                // Keyed on providers, not email: OpenCode bills through whichever
+                // provider credentials are configured, so two installs sharing one
+                // email but different provider sets are genuinely different accounts.
+                const accountKey = buildIdentityKey(agentId, [['providers', identity.providers]]);
+                return {
+                    ...empty,
+                    signedIn: true,
+                    accountId: identity.providers,
+                    accountKey,
+                    email: identity.email,
+                    plan: identity.plan,
+                    lastActive,
+                };
             }
             case 'muse': {
                 // Muse Code authenticates with META_API_KEY (env, highest priority) or

package/dist/lib/auth-health.js

@@ -25,6 +25,8 @@ import { getCacheDir, readMeta } from './state.js';
 import { probeClaudeStatus, probeDroidStatus, probeKimiStatus, USAGE_HEADLESS_SCOPE_MARKER, readClaudeUsageCache, } from './accounting/usage.js';
 import { getVersionHomePath, listInstalledVersions } from './installations/versions.js';
 import { atomicWriteFileSync, ensureLockTarget, withFileLock } from './fs-atomic.js';
+import { selfConfiguredDeviceRole } from './device-config.js';
+import { mayIssueUsageEndpointProbe, trySpendUsageApiCall } from './usage-refresh.js';
 /** Maximum age of an auth verdict used for automatic routing decisions. */
 export const AUTH_PROBE_MAX_AGE_MS = 20 * 60_000;
 /** Agents with a live network probe wired up today. The rest are best-effort. */
@@ -455,6 +457,23 @@ export async function probeAuthHealth(agent, home, opts) {
             if (derived)
                 return derived;
         }
+        if (!mayIssueUsageEndpointProbe({
+            role: selfConfiguredDeviceRole(),
+            forceLive: opts?.forceLive,
+        })) {
+            return {
+                verdict: 'unverified',
+                checkedAt,
+                detail: 'setup-token box does not probe the usage endpoint',
+            };
+        }
+        if (opts?.forceLive !== true && usageScope && !trySpendUsageApiCall(usageScope, agent, checkedAt)) {
+            return {
+                verdict: 'unverified',
+                checkedAt,
+                detail: 'usage-endpoint budget already spent this hour',
+            };
+        }
         let probe;
         if (agent === 'claude')
             probe = await probeClaudeStatus(home, opts?.cliVersion, usageScope, opts?.signal);

package/dist/lib/claude-statusline.js

@@ -8,6 +8,7 @@ import { atomicWriteFileSync } from './fs-atomic.js';
 import { mergeClaudeUsageCacheWindows } from './accounting/usage.js';
 import { loadReminders, pickReminderForSession } from './reminders.js';
 import { readMeta } from './state.js';
+import { machineId } from './machine-id.js';
 export const CLAUDE_STATUSLINE_COMMAND = 'agents __claude-statusline';
 const DELEGATE_FILE = path.join('.agents', 'claude-statusline-delegate');
 // The private subcommand this feature runs. It is only ever invoked internally,
@@ -77,7 +78,11 @@ export function ingestClaudeStatusLineUsage(payload, identity) {
         sourceLabel: 'Claude response rate limits',
         capturedAt: new Date(),
         windows,
+        freshness: { source: 'statusline', poller: machineId() },
     });
+    void import('./accounting/usage-sync.js')
+        .then((mod) => mod.pushUsageSnapshotNow())
+        .catch(() => { });
     return true;
 }
 /**

package/dist/lib/computer/sessions-list.js

@@ -61,6 +61,7 @@
 import { query, truncate } from '../feed/events.js';
 import { formatRelativeTime } from '../session/relative-time.js';
 import { getSessionById, listComputerSessionRecords, pruneToolSessions } from '../session/db.js';
+import { sessionHeadline } from '../session/title.js';
 import { buildLaunchSessionIndex, resolveLaunchSession, } from '../browser/sessions-list.js';
 /** Max chars of a `run --task` description persisted to the ledger — see the
  *  module docblock's retention/privacy note. */
@@ -315,7 +316,7 @@ export function renderComputerSessionRows(rows) {
         const where = r.remoteHost ? `${r.machine} -> ${r.remoteHost}` : r.machine;
         const label = r.task ? truncate(r.task, 60) : (r.bundle ?? `pid ${r.pid}`);
         const link = r.linkStatus === 'linked' && r.linkedSession
-            ? `${r.linkedSession.agent} — ${r.linkedSession.label || r.linkedSession.topic || r.linkedSession.shortId}`
+            ? `${r.linkedSession.agent} — ${sessionHeadline(r.linkedSession) || r.linkedSession.shortId}`
             : r.linkStatus === 'unresolved'
                 ? 'unresolved (session not indexed here)'
                 : 'unlinked';

package/dist/lib/daemon/auth-sync-service.d.ts

@@ -25,6 +25,8 @@
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
+export declare const AUTH_SYNC_TICK_MS: number;
+export declare const AUTH_SYNC_KICKOFF_MS = 60000;
 export declare class AuthSyncService extends BasePeriodicService {
     readonly id: DaemonServiceId;
     readonly intervalMs: number;

package/dist/lib/daemon/auth-sync-service.js

@@ -25,9 +25,9 @@
  */
 import { BasePeriodicService } from './service.js';
 import { USAGE_SYNC_TICK_MS } from './usage-sync-service.js';
-const AUTH_SYNC_TICK_MS = 15 * 60_000;
+export const AUTH_SYNC_TICK_MS = 15 * 60_000;
 const AUTH_SYNC_DEADLINE_MS = 2 * 60_000;
-const AUTH_SYNC_KICKOFF_MS = 60_000;
+export const AUTH_SYNC_KICKOFF_MS = 60_000;
 export class AuthSyncService extends BasePeriodicService {
     id = 'auth-sync';
     intervalMs = AUTH_SYNC_TICK_MS;

package/dist/lib/daemon/daemon.d.ts

@@ -11,6 +11,17 @@ import { getAgentsBinPath } from '../cli-entry.js';
 import type { ServiceHealth } from './service.js';
 /** Health for every service currently registered on the live supervisor, or `null` if the daemon isn't running in this process. */
 export declare function getServiceSupervisorHealth(): Record<string, ServiceHealth> | null;
+/**
+ * The service-manager identifiers of the REAL install's daemon — never
+ * namespaced. A caller under a redirected HOME (a test/e2e harness) uses these
+ * to recognize the box's production daemon as owned, where
+ * `daemonSystemdUnitName()`/`daemonServiceLabel()` would name only its own
+ * sandbox job (W4, PHNX-3736).
+ */
+export declare function productionDaemonServiceNames(): {
+    systemdUnit: string;
+    launchdLabel: string;
+};
 /**
  * RUSH-2639 (residual): launchd/systemd route `unload`/`load`/`list` by the
  * service identifier ALONE, never by the plist/unit file's path. Baking the
@@ -96,7 +107,7 @@ export declare function singleShot(fn: () => Promise<void>): () => Promise<void>
  */
 export declare function getDaemonLogPath(): string;
 /** Read the stored daemon PID from disk. Returns null if not present or invalid. */
-export declare function readDaemonPid(): number | null;
+export declare function readDaemonPid(daemonDir?: string): number | null;
 /** Write the daemon PID to the pid file. */
 export declare function writeDaemonPid(pid: number): void;
 /** Remove the daemon PID file. */
@@ -286,6 +297,28 @@ export declare function generateLaunchdPlist(agentsBin?: string): string;
  */
 export declare function generateSystemdUnit(agentsBin?: string): string;
 export { getAgentsBinPath };
+/**
+ * Ask the service manager for the daemon's live PID. Used as a fallback when
+ * the daemon hasn't yet written its pid file but launchd/systemd already report
+ * it running — so a start never has to surface a null PID for a daemon that is
+ * in fact up. Returns null when the service isn't running or the query fails.
+ *
+ * `names` defaults to THIS process's (possibly sandbox-namespaced) job; a
+ * caller under a redirected HOME passes `productionDaemonServiceNames()` to
+ * ask after the real install's unit instead. Read-only either way.
+ */
+export declare function readServiceManagerPid(platform?: NodeJS.Platform, names?: {
+    systemdUnit: string;
+    launchdLabel: string;
+}): number | null;
+/**
+ * Thrown when a daemon LAUNCH is attempted under a redirected HOME without the
+ * explicit test opt-in (W4, PHNX-3736). `bootstrap.ts` prints the message
+ * without a stack — this is user-actionable, not an engineering bug.
+ */
+export declare class RedirectedHomeDaemonError extends Error {
+    name: string;
+}
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(agentsBin?: string): {
     pid: number | null;