@phnx-labs/agents-cli 1.22.111 → 1.22.113

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.22.113
+
+- **Remote sessions have one execution-owned row (PHNX-3939).** Fleet session and feed streams reconcile launcher observations with the worker's state, retaining terminal/viewing metadata separately. Reconnects and stale history cannot replace a genuine worker row. Registry cleanup retains records whose PID namespace cannot be verified; nested agent runs keep launch lineage without claiming their parent's editor terminal.
+- **Codex forks retain their child identity.** Full and incremental scans keep the first native metadata record. Reindexing repairs cold files and removes a stale parent binding to child bytes even when the parent rollout is absent. Team descendants also keep their immediate parent lineage without inheriting its editor ownership.
+- **Nested daemon starts preserve shared session state.** Legacy migration and reboot recovery require the initial host namespace or kernel-verified live daemon ownership before touching singleton state. Foreign snapshots remain read-only, and invisible processes are never treated as dead. Automatic reuse of a private-container HOME across namespaces is unsupported, including after the prior namespace exits; writers fail safely with a diagnostic.
+
+- Repair session indexes whose schema version is current but whose identity columns are missing, preserving existing session metadata (PHNX-3940).
+
+## 1.22.112
+
+- **Runs expand portable home paths on the executing device (PHNX-3940).** A remote resume terminal could open successfully while its child failed to start because `--cwd '$HOME'` was treated as a literal directory. The shared run path now expands `$HOME` and `~` locally, while preserving those anchors until remote dispatch reaches its target. This fixes direct runs and resumed conversations alike.
+
 ## 1.22.111
 
 - **Remote session resume accepts the resolver’s launch metadata (PHNX-3940).** A reachable peer’s valid session row could be rejected because it included a mode or custom harness, leaving the session undiscoverable. The reader now accepts both fields while keeping private transcript paths out of the resolver contract. Malformed responses are reported as invalid data instead of an unreachable device.

package/dist/commands/exec.d.ts

@@ -6,8 +6,97 @@
  * injection, and multi-agent fallback chains for rate-limit resilience.
  */
 import { type Command } from 'commander';
-import type { ExecEffort } from '../lib/exec.js';
+import type { ExecMode, ExecEffort } from '../lib/exec.js';
 import { RUN_AUTO_KEYWORD } from '../lib/types.js';
+interface ExecCommandActionOptions {
+    mode: ExecMode;
+    effort: ExecEffort;
+    model?: string;
+    cwd?: string;
+    /** --project <slug>[@worktree]: resolve cwd from the projects root shorthand. */
+    project?: string;
+    addDir: string[];
+    env: string[];
+    secrets: string[];
+    /** Commander maps `--no-auto-secrets` to `autoSecrets` (default true, false when passed). */
+    autoSecrets?: boolean;
+    json?: boolean;
+    quiet?: boolean;
+    headless?: boolean;
+    interactive?: boolean;
+    /** --no-auth-check: Commander maps it to `authCheck` (default true, false when passed). Silences the logged-out preflight warning on an interactive launch. */
+    authCheck?: boolean;
+    /** --resume [id]: string id/prefix, or `true` for the bare flag (interactive picker). */
+    resume?: string | boolean;
+    sessionId?: string;
+    /** --name <slug>: durable launch handle, resolvable via `agents sessions <name>`. */
+    name?: string;
+    /** --notify: post a desktop notification when a headless run finishes. */
+    notify?: boolean;
+    /** `--no-trace-sync` → commander maps it to `traceSync` (default true, false when passed). Skips the run-exit trace auto-sync for this run (PHNX-3628). */
+    traceSync?: boolean;
+    /** --terminal [backend]: open this run in a terminal tab; `true` = auto-detect. */
+    terminal?: string | boolean;
+    verbose?: boolean;
+    raw?: boolean;
+    /** `--no-tmux` → commander sets this false (default true) to bypass the tmux wrapper. */
+    tmux?: boolean;
+    /** `--disable-tmux` → explicit alias of --no-tmux. */
+    disableTmux?: boolean;
+    timeout?: string;
+    fallback?: string;
+    balanced?: boolean;
+    strategy?: string;
+    /** Restrict selection to a named provider account discovered from live version homes. */
+    account?: string;
+    /**
+     * @deprecated Hidden alias for `--device auto`. Resolved before host dispatch.
+     * Remove after one release.
+     */
+    smart?: boolean;
+    acp?: boolean;
+    yes?: boolean;
+    loop?: boolean;
+    resumeCheckpoint?: string;
+    maxIterations?: string;
+    budget?: string;
+    until?: string;
+    interval?: string;
+    where?: string;
+    host?: string;
+    device?: string;
+    on?: string;
+    computer?: string;
+    remoteCwd?: string;
+    follow?: boolean;
+    any?: boolean;
+    copyCreds?: boolean;
+    lease?: string | boolean;
+    box?: string;
+    keepBox?: boolean;
+    fresh?: boolean;
+    reuse?: boolean;
+    bare?: boolean;
+    tailscale?: boolean;
+    cloud?: boolean;
+    provider?: string;
+    repo?: string[];
+    branch?: string;
+    cloudEnv?: string;
+    secretsKeys?: string;
+    allowExpired?: boolean;
+    emitSessionId?: boolean;
+    /** --broadcast: matrix-run the same prompt/task across agents × models. */
+    broadcast?: boolean;
+    /** --task <id>: house broadcast task (with --broadcast). */
+    task?: string;
+    /** --list-tasks: list broadcast tasks. */
+    listTasks?: boolean;
+    /** --results [run-id]: show saved broadcast runs. */
+    results?: string | true;
+    /** --concurrency <n>: broadcast cell parallelism. */
+    concurrency?: string;
+}
 /** Validate a caller-supplied session id before it reaches tmux, paths, indexes, or remote dispatch. */
 export declare function parseExplicitSessionId(value: string): string;
 export interface RunPickerMarkers {
@@ -210,5 +299,21 @@ export declare function runWorkflowForEach(spec: import('../lib/workflows.js').F
     cwd: string;
     effort?: ExecEffort;
 }): Promise<number>;
+/**
+ * The run's working directory from `--cwd` / `--project`. `--project <slug>` owns
+ * the directory and is mutually exclusive with `--cwd`/`--remote-cwd`; both the
+ * main dispatch and the `--terminal` handoff need the same answer, so the rule
+ * and its error live here once instead of in two places that can drift.
+ *
+ * A project that binds several directories also contributes the ones it is not
+ * landing in as `--add-dir` grants, so an agent on a multi-repo project can
+ * actually reach the sibling checkouts. Claude / Cursor / Kimi take the native
+ * flag; Codex folds them into workspace_roots; Grok widens its sandbox profile
+ * (and always injects a rules note). Other harnesses have no multi-root surface
+ * and ignore the grants (cwd only).
+ */
+export declare function resolveRunCwd(options: Pick<ExecCommandActionOptions, 'cwd' | 'project' | 'remoteCwd' | 'addDir'>, opts: {
+    forRemote: boolean;
+}): Promise<string | undefined>;
 /** Register the `agents run <agent> [prompt]` command. */
 export declare function registerRunCommand(program: Command): void;

package/dist/commands/exec.js

@@ -467,9 +467,13 @@ export async function runWorkflowForEach(spec, opts) {
  * (and always injects a rules note). Other harnesses have no multi-root surface
  * and ignore the grants (cwd only).
  */
-async function resolveRunCwd(options, opts) {
-    if (!options.project)
-        return options.cwd;
+export async function resolveRunCwd(options, opts) {
+    if (!options.project) {
+        if (!options.cwd || opts.forRemote)
+            return options.cwd;
+        const { expandLocalHome } = await import('../lib/project-root.js');
+        return expandLocalHome(options.cwd);
+    }
     if (options.cwd || options.remoteCwd) {
         console.error(chalk.red('Pass --project alone — not with --cwd or --remote-cwd.'));
         process.exit(1);
@@ -1614,13 +1618,9 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             const { armRunFinishTraceSync } = await import('../lib/run-trace-sync.js');
             armRunFinishTraceSync({ disabled: options.traceSync === false });
         }
-        // --project <slug>[@worktree]: resolve the projects-root shorthand into a
-        // cwd. On a host run it resolves home-relative (`~/…`, so the host expands
-        // it); locally it becomes an absolute path. It owns the working directory,
-        // so it is mutually exclusive with both --cwd and --remote-cwd.
-        if (options.project) {
-            options.cwd = await resolveRunCwd(options, { forRemote: hostGiven.length > 0 });
-        }
+        // Home anchors belong to the executing host; preserve them until a remote
+        // invocation reaches its local execution path.
+        options.cwd = await resolveRunCwd(options, { forRemote: hostGiven.length > 0 });
         if (hostGiven.length > 0) {
             if (new Set(hostGiven).size > 1) {
                 console.error(chalk.red('Conflicting --device values values — pass just one.'));

package/dist/commands/sessions.d.ts

@@ -31,6 +31,7 @@ interface SessionsOptions extends SessionFilterOptions {
     resolve?: string;
     /** Versioned internal peer protocol; old/unsafe peers must reject it. */
     resolveSafeV1?: string;
+    resolveLaunchId?: string;
     limit?: string;
     sort?: string;
     json?: boolean;

package/dist/commands/sessions.js

@@ -2367,6 +2367,17 @@ limitSource) {
         process.stdout.write(JSON.stringify(getSessionRoots(), null, 2) + '\n');
         return;
     }
+    if (options.resolveLaunchId !== undefined) {
+        if (!options.json)
+            throw new Error('--resolve-launch-id requires --json.');
+        const launchId = options.resolveLaunchId.trim();
+        if (!launchId)
+            throw new Error('--resolve-launch-id requires a non-empty launch id.');
+        const { loadHookSessionIndex } = await import('../lib/session/hook-sessions.js');
+        const record = loadHookSessionIndex().byLaunchId.get(launchId);
+        process.stdout.write(JSON.stringify({ launchId, sessionId: record?.session_id ?? null }) + '\n');
+        return;
+    }
     // --resolve is the metadata-only contract for downstream context workflows.
     // It reads indexed SessionMeta rows and never calls renderSession, buildPreview,
     // parseSession, or any other transcript renderer/parser.
@@ -5160,6 +5171,7 @@ export function registerSessionsCommands(program) {
         .option('--query <clause>', 'Search text; repeat with --include tools to require distinct matching calls', collectQueryClause, [])
         .option('--resolve <selector>', 'Resolve one full ID, unique prefix, or keyword query to safe session metadata (requires --json; searches the fleet unless --local)')
         .addOption(new Option('--resolve-safe-v1 <selector>').hideHelp())
+        .addOption(new Option('--resolve-launch-id <id>').hideHelp())
         .description('Find, browse, and read agent conversation transcripts. Live roster: `agents sessions --active`.')
         .option('-a, --agent <agent>', 'Filter by agent type and version (e.g., claude, codex@0.116.0)')
         .addOption(new Option('--session-version <version>', 'Internal spelling for the public sessions --version filter')

package/dist/lib/daemon/daemon.d.ts

@@ -1,11 +1,3 @@
-/**
- * Daemon lifecycle management for the routines scheduler.
- *
- * The daemon is a long-running process that holds a JobScheduler and
- * triggers jobs on their cron schedules. It can be managed via launchd
- * (macOS), systemd (Linux), or as a plain detached process. PID tracking,
- * log output, reload (SIGHUP), and graceful shutdown are handled here.
- */
 import { isolatedHomeSuffix } from '../service-manifest.js';
 import { getAgentsBinPath } from '../cli-entry.js';
 import type { ServiceHealth } from './service.js';

package/dist/lib/daemon/daemon.js

@@ -1,3 +1,4 @@
+import { daemonProcessViewAllowed, recordDaemonProcessView } from '../session/process-view.js';
 /**
  * Daemon lifecycle management for the routines scheduler.
  *
@@ -22,7 +23,6 @@ import { detectOverdueJobs, notifyOverdue } from '../overdue.js';
 import { runCatchup } from '../catchup.js';
 import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from '../routine-notify.js';
 import { notifyOwnerRoutineFinish, notifyOwnerRoutineStartFailed } from '../routine-notify-owner.js';
-import { BrowserService } from '../browser/service.js';
 import { getSocketPath as getBrowserIpcSocketPath } from '../browser/ipc.js';
 import { redactSecrets } from '../redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from '../cli-entry.js';
@@ -30,27 +30,6 @@ import { localBinDir } from '../platform/posixpath.js';
 import { isSchedulerEnabled, assertSchedulerEnabled, isDaemonEnabled } from '../device-config.js';
 import { recordSubsystemOk, recordSubsystemError, recordSubsystemErrorReason, readSubsystemHealth, SUBSYSTEM_DAEMON_START } from '../daemon-health.js';
 import { ServiceSupervisor } from './supervisor.js';
-import { SessionIndexService } from './session-index-service.js';
-import { SessionSummarizerService } from './session-summarizer-service.js';
-import { SessionTitleService } from './session-title-service.js';
-import { MonitorEngineService } from './monitor-engine-service.js';
-import { AccountUsageService, AccountAuthService } from './account-state-daemon-service.js';
-import { CatchupService } from './catchup-service.js';
-import { BrowserIPCService } from './browser-ipc-service.js';
-import { WatchdogService } from './watchdog-service.js';
-import { DeviceProbeService } from './device-probe-service.js';
-import { SelfHealService } from './self-heal-service.js';
-import { SelfUpdateService } from './self-update-service.js';
-import { HarnessUpdateService } from './harness-update-service.js';
-import { AuthSyncService } from './auth-sync-service.js';
-import { UsageSyncService } from './usage-sync-service.js';
-import { StateDirCheckService } from './state-dir-check-service.js';
-import { SessionStateService } from './session-state-service.js';
-import { AttentionNotifyService } from './attention-notify-service.js';
-import { WebhookReceiverService } from './webhook-receiver-service.js';
-import { HeartbeatService } from './heartbeat-service.js';
-import { TmuxReapService } from './tmux-reap-service.js';
-import { BrowserTaskReapService } from './browser-task-reap-service.js';
 import { emit, emitAsync, emitRoutineEnd } from '../feed/events.js';
 import { readDaemonServicesConfig, drainDaemonServiceRestartQueue } from '../daemon-services.js';
 import { sleepSync } from '../fs-atomic.js';
@@ -478,6 +457,12 @@ export function isDaemonRunning() {
  * liveness check and the write.
  */
 export function claimDaemonInstance() {
+    // A nested caller cannot interpret legacy numeric lock/PID files. Authenticate
+    // before acquiring the lock (whose stale-PID cleanup itself mutates state).
+    if (!daemonProcessViewAllowed()) {
+        console.error('Daemon startup requires the owning process namespace. Automatic reuse of a private-container HOME across namespaces is unsupported; run in its owning namespace or use a fresh HOME.');
+        return false;
+    }
     // A stop owns this same lock through teardown. Waiting here is load-bearing:
     // returning false while stopDaemon() holds it lets this replacement exit 0,
     // then the stop completes with no singleton left alive. The bounded lifecycle
@@ -488,6 +473,10 @@ export function claimDaemonInstance() {
     if (!release)
         return false;
     try {
+        // Recheck under lifecycle serialization; invocation is not provenance.
+        if (!daemonProcessViewAllowed())
+            return false;
+        recordDaemonProcessView();
         // Do not overwrite a live-but-uninspectable owner. This is the non-
         // destructive side of the same fail-closed rule stopDaemon applies.
         if (unverifiedLiveDaemonPid() !== null)
@@ -887,6 +876,32 @@ export async function runDaemon() {
     // HOME override must refuse to run against the operator's real state rather than
     // schedule against the real host. No-op in production (the marker is never set).
     assertTestDaemonHome();
+    // Lifecycle readers and launchers do not run services. Load their code only
+    // in the daemon process, before it claims or publishes lifecycle state.
+    const [{ BrowserService }, { SessionIndexService }, { SessionSummarizerService }, { SessionTitleService }, { MonitorEngineService }, { AccountUsageService, AccountAuthService }, { CatchupService }, { BrowserIPCService }, { WatchdogService }, { DeviceProbeService }, { SelfHealService }, { SelfUpdateService }, { HarnessUpdateService }, { AuthSyncService }, { UsageSyncService }, { StateDirCheckService }, { SessionStateService }, { AttentionNotifyService }, { WebhookReceiverService }, { HeartbeatService }, { TmuxReapService }, { BrowserTaskReapService },] = await Promise.all([
+        import('../browser/service.js'),
+        import('./session-index-service.js'),
+        import('./session-summarizer-service.js'),
+        import('./session-title-service.js'),
+        import('./monitor-engine-service.js'),
+        import('./account-state-daemon-service.js'),
+        import('./catchup-service.js'),
+        import('./browser-ipc-service.js'),
+        import('./watchdog-service.js'),
+        import('./device-probe-service.js'),
+        import('./self-heal-service.js'),
+        import('./self-update-service.js'),
+        import('./harness-update-service.js'),
+        import('./auth-sync-service.js'),
+        import('./usage-sync-service.js'),
+        import('./state-dir-check-service.js'),
+        import('./session-state-service.js'),
+        import('./attention-notify-service.js'),
+        import('./webhook-receiver-service.js'),
+        import('./heartbeat-service.js'),
+        import('./tmux-reap-service.js'),
+        import('./browser-task-reap-service.js'),
+    ]);
     // Install the shared-daemon reload signal boundary BEFORE publishing our PID
     // in claimDaemonInstance(). Browser/routines clients use that PID to decide a
     // daemon exists and may request a service reload immediately. POSIX otherwise
@@ -1739,6 +1754,10 @@ function assertDaemonLaunchHomeAllowed() {
 }
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export function startDaemon(agentsBin) {
+    // The public launcher must obey the same namespace boundary as its child:
+    // even probing/repairing legacy PID state or pruning a lock can mutate it.
+    if (!daemonProcessViewAllowed())
+        throw new Error('Daemon startup requires the owning process namespace. Automatic reuse of a private-container HOME across namespaces is unsupported; run in its owning namespace or use a fresh HOME.');
     if (isDaemonRunning()) {
         const pid = readDaemonPid();
         return { pid, method: 'already-running' };

package/dist/lib/daemon/testdata/process-view-daemon.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/daemon/testdata/process-view-daemon.js

@@ -0,0 +1,14 @@
+// Runs the production daemon entrypoint against an isolated HOME. No installed
+// CLI, service manager, scheduler, or production socket participates.
+import { runDaemon, startDaemon } from '../daemon.js';
+if (process.argv[2] === '__start-daemon') {
+    try {
+        startDaemon();
+    }
+    catch (error) {
+        console.log(error.message);
+        process.exitCode = 2;
+    }
+}
+else
+    await runDaemon();

package/dist/lib/daemon/testdata/process-view-start.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/daemon/testdata/process-view-start.js

@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import net from 'node:net';
+import { spawn } from 'node:child_process';
+import { serviceManagerRegistrationAllowed } from '../../service-manifest.js';
+import { startDaemon, stopDaemon } from '../daemon.js';
+import { getDaemonDir, getTerminalsDir, getCacheDir } from '../../state.js';
+// Tripwire precedes ALL lifecycle calls. Some older Bun versions return HOME
+// from os.userInfo(), which would incorrectly allow the real service manager.
+assert.equal(serviceManagerRegistrationAllowed().allowed, false, 'isolated fixture must never access the production service manager');
+const cold = process.argv[3] === 'cold';
+const child = cold ? spawn('bun', [process.argv[4], '__daemon-run'], { stdio: 'ignore', env: process.env }) : undefined;
+const started = child ? { pid: child.pid, method: 'detached' } : startDaemon(process.argv[2]);
+assert.equal(started.method, 'detached');
+assert.ok(started.pid);
+fs.writeFileSync(path.join(process.env.HOME, 'test-child.pid'), String(started.pid));
+try {
+    if (!cold)
+        assert.ok(fs.existsSync(path.join(getDaemonDir(), 'health.json')), 'ordinary launcher publishes health before daemon starts');
+    const socket = path.join(getCacheDir(), 'helpers', 'browser', 'browser.sock');
+    let ready = false;
+    for (let i = 0; i < 80 && !ready; i++) {
+        ready = await new Promise(resolve => {
+            const client = net.createConnection(socket);
+            const done = (value) => { client.destroy(); resolve(value); };
+            client.setTimeout(100, () => done(false));
+            client.once('connect', () => done(true));
+            client.once('error', () => done(false));
+        });
+        if (!ready)
+            await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    assert.ok(ready, 'ordinary fresh-home daemon must serve its actual browser socket');
+    assert.equal(fs.readFileSync(path.join(getDaemonDir(), 'daemon.pid'), 'utf8').trim(), String(started.pid));
+    const owner = JSON.parse(fs.readFileSync(path.join(getTerminalsDir(), 'process-view.json'), 'utf8'));
+    assert.equal(owner.pidNamespace, fs.readlinkSync('/proc/self/ns/pid'));
+    assert.equal(owner.bootId, fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim());
+    console.log(`${cold ? 'cold runDaemon' : 'ordinary startDaemon: health published'}; canonical socket ready; namespace owner verified`);
+}
+finally {
+    stopDaemon();
+}

package/dist/lib/event-provenance.d.ts

@@ -10,6 +10,8 @@ export interface EventProvenance {
     agent?: string;
     launchId?: string;
     parentSessionId?: string;
+    parentLaunchId?: string;
+    originTerminalId?: string;
 }
 /**
  * Stamp the shared identity floor used by both operational and activity events.

package/dist/lib/event-provenance.js

@@ -40,6 +40,10 @@ export function stampProvenance(env = process.env) {
         provenance.launchId = env.AGENT_LAUNCH_ID;
     if (env.AGENTS_PARENT_SESSION_ID)
         provenance.parentSessionId = env.AGENTS_PARENT_SESSION_ID;
+    if (env.AGENTS_PARENT_LAUNCH_ID)
+        provenance.parentLaunchId = env.AGENTS_PARENT_LAUNCH_ID;
+    if (env.AGENTS_ORIGIN_TERMINAL_ID)
+        provenance.originTerminalId = env.AGENTS_ORIGIN_TERMINAL_ID;
     return provenance;
 }
 export function resetEventProvenanceForTest() {

package/dist/lib/exec.js

@@ -1,3 +1,4 @@
+import { captureLaunchBinding, recordCompletedLaunch } from './session/hook-sessions.js';
 /**
  * Agent execution -- command building, process spawning, and rate-limit fallback.
  *
@@ -17,6 +18,7 @@ import { isTierToken, resolveTier } from './model-tiers.js';
 import { emit, createTimer, redactPrompt, redactArgs } from './feed/events.js';
 import { sanitizeProcessEnv } from './secrets-client.js';
 import { resolveActor, actorEnv } from './actor.js';
+import { launchIdentityEnv, LAUNCH_IDENTITY_KEYS } from './launch-identity.js';
 import { expandLocalHome } from './project-root.js';
 import { getShimsDir, getHistoryDir, getUserAgentsDir, getRuntimeStateDir } from './state.js';
 import { readCodexConfiguredModel } from './installations/shims.js';
@@ -378,6 +380,14 @@ export function buildExecEnv(options) {
     else {
         stripForeignConfigDir(result);
     }
+    // A new harness must not inherit its spawner's own session/mailbox or editor
+    // ownership. Keep those relationships as lineage, including across SSH.
+    delete result.AGENT_SESSION_ID;
+    delete result.AGENTS_SESSION_ID;
+    delete result.AGENTS_MAILBOX_DIR;
+    delete result.AGENT_TERMINAL_ID;
+    const launchIdentity = launchIdentityEnv();
+    Object.assign(result, launchIdentity);
     // Point the agent at its own mailbox so the PreToolUse `mailbox-inject` hook
     // knows which box to drain and inject mid-run. Keyed by the session id — the
     // same id the writer resolves via mailboxIdForActiveSession(). A loop run
@@ -394,9 +404,9 @@ export function buildExecEnv(options) {
     // (events.ts::resolveProvenance) reads AGENTS_PARENT_SESSION_ID and stamps it on
     // every event the child emits. `options.sessionId` is the CHILD's id, so read the
     // spawner from the live env; guard a same-session resume from naming itself parent.
-    // Local-spawn scope here; forwarding it across the `--device` SSH hop is Phase 4.
+    // An SSH continuation has no runtime marker; keep its forwarded parent edge.
     delete result.AGENTS_PARENT_SESSION_ID;
-    const spawnerSessionId = process.env.AGENTS_SESSION_ID || process.env.AGENT_SESSION_ID;
+    const spawnerSessionId = launchIdentity.AGENTS_PARENT_SESSION_ID;
     if (spawnerSessionId && spawnerSessionId !== options.sessionId) {
         result.AGENTS_PARENT_SESSION_ID = spawnerSessionId;
     }
@@ -1210,7 +1220,7 @@ async function execShimPassthroughLeased(agent, rawArgs, cwd, pinnedVersion) {
                 actor: resolveActor().id,
                 initiatedBy: resolveActor().kind,
                 launchId,
-                terminalId: process.env.AGENT_TERMINAL_ID,
+                terminalId: launchIdentityEnv().AGENT_TERMINAL_ID,
                 startedAtMs: Date.now(),
             });
             // Durable sessionId -> actor record (RUSH-2019) so the scanner can attribute
@@ -1347,6 +1357,7 @@ export function isHarnessKnownSessionId(agent, sessionId, resume) {
  */
 export function buildTmuxAgentCommand(executable, args, env, opts = {}) {
     const agentCmd = [executable, ...args].map(shellQuote).join(' ');
+    const absentIdentity = LAUNCH_IDENTITY_KEYS.filter(key => env[key] === undefined);
     // envFile: source the values instead of inlining them, so no VALUE ever lands
     // in the pane's argv. `exec env K=V …` put every resolved secret into the
     // process table, readable by any process of this user — on one fleet box six
@@ -1361,13 +1372,13 @@ export function buildTmuxAgentCommand(executable, args, env, opts = {}) {
         // strands the plaintext env (incl. the secrets-store master passphrase) on
         // disk on any source failure, worse than the argv leak this replaces
         // (RUSH-2100). Capture the source rc, unlink, then honor it.
-        return `set -a; . ${f}; __agents_rc=$?; set +a; rm -f ${f}; [ "$__agents_rc" -eq 0 ] || exit 1; exec ${agentCmd}`;
+        return `${absentIdentity.length ? `unset ${absentIdentity.join(' ')}; ` : ''}set -a; . ${f}; __agents_rc=$?; set +a; rm -f ${f}; [ "$__agents_rc" -eq 0 ] || exit 1; exec ${agentCmd}`;
     }
     const envPrefix = Object.entries(env)
         .filter(([k, v]) => v !== undefined && EXEC_ENV_KEY_PATTERN.test(k))
         .map(([k, v]) => `${k}=${opts.redactEnvValues ? '<redacted>' : shellQuote(String(v))}`)
         .join(' ');
-    return `exec env ${envPrefix} ${agentCmd}`;
+    return `exec env ${absentIdentity.map(key => `-u ${key}`).join(' ')} ${envPrefix} ${agentCmd}`;
 }
 /**
  * Serialize the pane env to a shell-sourceable file, created 0600 and exclusively
@@ -1493,9 +1504,14 @@ async function runInTmux(options, executable, args) {
      * "the session went away underneath us", so an attach that skips this cannot
      * do better than assume success — which is exactly the defect EXEC-23b fixes.
      */
+    let paneLaunchBinding;
+    const bindCompletedPane = () => {
+        recordCompletedLaunch(paneLaunchBinding);
+    };
     const resolveAfterAttach = async (pane) => {
         const after = pane ? await paneExitStatus(pane, socket) : { found: false, dead: false, status: undefined };
         if (after.dead) {
+            bindCompletedPane();
             // Positive proof of a genuinely completed pane (paneExitStatus confirmed
             // dead) — capture its scrollback as refusal evidence for the caller
             // (classifyClaudeRunRefusal etc.) BEFORE tearing the session down.
@@ -1633,10 +1649,11 @@ async function runInTmux(options, executable, args) {
             // pid) reconciles by launchId. This pane's pid usually IS the agent pid,
             // but the launchId join is robust even when it isn't.
             launchId: options.env?.AGENT_LAUNCH_ID,
-            terminalId: process.env.AGENT_TERMINAL_ID,
+            terminalId: launchIdentityEnv().AGENT_TERMINAL_ID,
             tmuxPane: pane,
             startedAtMs: Date.now(),
         });
+        paneLaunchBinding = captureLaunchBinding(panePid, options.env?.AGENT_LAUNCH_ID ?? '');
         if (options.sessionId) {
             writeSessionActorRecord({
                 sessionId: options.sessionId,
@@ -1653,6 +1670,7 @@ async function runInTmux(options, executable, args) {
     // already-dead pane — surface its output + status directly and tear down.
     const before = pane ? await paneExitStatus(pane, socket) : { found: false, dead: false, status: undefined };
     if (before.dead) {
+        bindCompletedPane();
         // Positive proof of a genuinely completed pane — capture scrollback as
         // refusal evidence before tearing the session down (see the matching
         // comment in resolveAfterAttach).
@@ -2071,10 +2089,11 @@ async function spawnAgentLeased(options) {
             actor: resolveActor().id,
             initiatedBy: resolveActor().kind,
             launchId,
-            terminalId: process.env.AGENT_TERMINAL_ID,
+            terminalId: launchIdentityEnv().AGENT_TERMINAL_ID,
             tmuxPane: process.env.TMUX_PANE,
             startedAtMs: Date.now(),
         });
+        const launchBinding = captureLaunchBinding(child.pid, launchId);
         if (options.sessionId) {
             writeSessionActorRecord({
                 sessionId: options.sessionId,
@@ -2146,6 +2165,7 @@ async function spawnAgentLeased(options) {
             reject(err);
         });
         child.on('close', (code) => {
+            recordCompletedLaunch(launchBinding);
             if (timeoutTimer)
                 clearTimeout(timeoutTimer);
             // Clear the budget-kill SIGKILL escalation timer (mirror the --timeout

package/dist/lib/feed/activity-stream.js

@@ -56,6 +56,15 @@ export class ActivityStream {
         this.maxBytesPerRead = options.maxBytesPerRead ?? ACTIVITY_TAIL_BYTES;
         this.sweepMs = options.sweepMs ?? ACTIVITY_SWEEP_MS;
         this.watchRequested = options.watch ?? true;
+        // A log directory that does not exist yet (nothing has logged activity
+        // since boot) means fs.watch below throws ENOENT and never retries except
+        // on the bounded sweep cadence — the very first session's activity can
+        // then sit unwatched for up to `sweepMs` before it is even noticed.
+        // Creating it up front lets the watcher arm immediately.
+        try {
+            fs.mkdirSync(this.dir, { recursive: true });
+        }
+        catch { /* best-effort: sweep() covers a dir that still isn't there */ }
         this.sweep(Date.now());
         this.armWatcher();
     }

package/dist/lib/feed/activity.d.ts

@@ -136,6 +136,14 @@ export declare function appendActivityEvent(event: Omit<ActivityEvent, 'v' | 'ti
 export declare function parseActivityLine(line: string): ActivityEvent | undefined;
 /** Per-session byte budget for a bounded tail read of an activity log. */
 export declare const ACTIVITY_TAIL_BYTES: number;
+/** Read-only process-local diagnostics; no event content or file paths. */
+export declare function getActivityCacheStats(): {
+    entries: number;
+    parsedTails: number;
+    bytes: number;
+    maxBytes: number;
+    tailReads: number;
+};
 /** Read all events for one session (bounded tail). */
 export declare function readSessionActivity(sessionId: string, root?: string, maxBytes?: number): ActivityEvent[];
 /** List session ids that have an activity log. */