@phnx-labs/agents-cli 1.22.112 → 1.22.114

package/dist/lib/session/session-cache.js

@@ -24,6 +24,7 @@
  * through to a live gather.
  */
 import * as fs from 'fs';
+import { writerProcessView, requireWriterProcessView } from './process-view.js';
 import * as path from 'path';
 import { createMemoryCache } from '../memory-cache.js';
 import { getCacheDir } from '../state.js';
@@ -130,12 +131,6 @@ export function setImmutableMemoPathForTest(p) {
     immutablePathOverride = p;
     return prev;
 }
-/** Test seam: redirect the append-only live-state journal. */
-export function setActiveSessionsJournalPathForTest(p) {
-    const prev = journalPathOverride;
-    journalPathOverride = p;
-    return prev;
-}
 /** Test seam: redirect the reader-presence file. Returns the previous override. */
 export function setActiveSessionsReaderPresencePathForTest(p) {
     const prev = readerPresencePathOverride;
@@ -193,7 +188,7 @@ export function isActiveSessionsJournalReaderRecent(nowMs = Date.now(), idleWind
     }
 }
 /** Default poll cadence for {@link watchActiveSessionsReaderPresence}. */
-export const ACTIVE_SESSIONS_READER_TRANSITION_POLL_MS = 1_000;
+const ACTIVE_SESSIONS_READER_TRANSITION_POLL_MS = 1_000;
 /**
  * Watch for a reader going from absent/idle to present and fire `onConnect`
  * out of band, instead of waiting for the next scheduled warm tick (RUSH-2484).
@@ -248,6 +243,7 @@ export function readActiveSessionsCache(scope) {
  * so a local warm never drops a fleet snapshot a reader just wrote.
  */
 export function writeActiveSessionsCache(scope, sessions, opts = {}) {
+    requireWriterProcessView();
     const snap = {
         version: 1,
         scope,
@@ -412,6 +408,7 @@ export function assertNoLiveStatusFields(fields) {
  * refill identity fields without re-deriving them.
  */
 export function updateImmutableMemos(sessions, nowMs = Date.now()) {
+    requireWriterProcessView();
     for (const s of sessions) {
         if (!s.sessionId)
             continue;
@@ -436,7 +433,7 @@ export function updateImmutableMemos(sessions, nowMs = Date.now()) {
  * non-stream ActiveSession consumer is unaffected. Best-effort: a DB error leaves
  * the row untouched.
  */
-export function mergeSessionSummary(s) {
+function mergeSessionSummary(s) {
     if (!s.sessionId)
         return s;
     try {
@@ -534,6 +531,12 @@ export async function loadLocalActiveSessions(opts = {}) {
     const maxAge = opts.maxAgeMs ?? DEFAULT_ACTIVE_CACHE_MAX_AGE_MS;
     const readCache = opts.readCache ?? readActiveSessionsCache;
     const writeCache = opts.writeCache ?? writeActiveSessionsCache;
+    if (!writerProcessView()) {
+        const cached = readCache('local');
+        if (cached)
+            return { sessions: cached.sessions, servedFromCache: true, capturedAt: cached.capturedAt };
+        requireWriterProcessView();
+    }
     if (!opts.forceRefresh) {
         const cached = readCache('local');
         if (cached && isActiveSnapshotFresh(cached.capturedAt, now, maxAge)) {
@@ -570,6 +573,12 @@ export async function loadFleetActiveSessions(opts) {
     const maxAge = opts.maxAgeMs ?? DEFAULT_ACTIVE_CACHE_MAX_AGE_MS;
     const readCache = opts.readCache ?? readActiveSessionsCache;
     const writeCache = opts.writeCache ?? writeActiveSessionsCache;
+    if (!writerProcessView()) {
+        const cached = readCache('fleet');
+        if (cached)
+            return { sessions: cached.sessions, remoteDeviceCount: cached.remoteDeviceCount ?? 0, servedFromCache: true, capturedAt: cached.capturedAt };
+        requireWriterProcessView();
+    }
     if (!opts.forceRefresh) {
         const cached = readCache('fleet');
         if (cached && isActiveSnapshotFresh(cached.capturedAt, now, maxAge)) {

package/dist/lib/session/share-html.d.ts

@@ -1,5 +1,5 @@
 import type { SessionMeta } from './types.js';
-export interface SessionHtmlOptions {
+interface SessionHtmlOptions {
     /** Whether the Markdown was rendered with redaction on — shown in the footer. */
     redacted?: boolean;
 }
@@ -9,26 +9,6 @@ interface Chip {
     value: string;
 }
 export declare function escapeHtml(text: string): string;
-/**
- * Lift every folded reasoning block out of the Markdown, leaving a sentinel.
- *
- * `renderer.html` escapes raw HTML unconditionally — the transcript body is model
- * and tool output, so nothing in it may round-trip as markup. That also escaped
- * the `<details>` wrapper `--reasoning fold` emits, which is why the disclosure
- * element has to be reconstructed here instead of allowlisted through.
- *
- * Allowlisting was tried twice and is the wrong shape: marked hands the same
- * markup over as several different raw strings depending on context (a whole-token
- * gate passed the opening tag and escaped the closing one in a real document), and
- * a bare `<details>` in ordinary prose is a complete INLINE html token — so prose
- * that merely mentions the tag would emit a live, unclosed element that swallows
- * every later turn into it. Reconstructing both ends here makes the pairing
- * structural: it cannot be unbalanced by anything the transcript contains.
- */
-export declare function liftFoldBlocks(markdown: string): {
-    text: string;
-    blocks: string[];
-};
 /** Human duration — "13 minutes", never "12m 49s". */
 export declare function formatDuration(ms: number): string;
 /**

package/dist/lib/session/share-html.js

@@ -75,7 +75,7 @@ const FOLD_BLOCK = /<details>\n<summary>Reasoning<\/summary>\n\n([\s\S]*?)\n\n<\
  * every later turn into it. Reconstructing both ends here makes the pairing
  * structural: it cannot be unbalanced by anything the transcript contains.
  */
-export function liftFoldBlocks(markdown) {
+function liftFoldBlocks(markdown) {
     const blocks = [];
     // A transcript that literally contains the sentinel must not be able to forge a
     // disclosure element, so break any occurrence before inserting our own.

package/dist/lib/session/shell-programs.d.ts

@@ -1,5 +1,5 @@
 import { type Word } from 'unbash';
-export interface ShellProgramExtraction {
+interface ShellProgramExtraction {
     programs: string[];
     occurrences: ShellProgramOccurrence[];
     diagnostics: string[];
@@ -30,3 +30,4 @@ export declare function isShellExecTool(tool: string | undefined): boolean;
 export declare function staticShellWord(word: Word | undefined): string | undefined;
 /** Parse Bash without executing it and return every statically identifiable program. */
 export declare function extractShellPrograms(source: string, depth?: number): ShellProgramExtraction;
+export {};

package/dist/lib/session/state.d.ts

@@ -49,9 +49,22 @@ export interface QuestionOption {
  * {@link AwaitingReason}; `options` is present when the agent offered discrete choices.
  */
 export interface StructuredQuestion {
+    /**
+     * The question itself — the trailing ask, not the whole message. For a prose
+     * question this is the extracted trailing question block (see
+     * {@link extractProseQuestion}); for a structured harness question it is the
+     * agent-supplied question text, unchanged.
+     */
     text: string;
     reason: AwaitingReason;
     options?: QuestionOption[];
+    /**
+     * Optional preceding prose for a prose question — the report/explanation that
+     * came BEFORE the trailing ask, with its Markdown and newlines preserved so a
+     * consumer can render it as context under the question. Absent for a structured
+     * harness question and when a prose question carries no preceding context.
+     */
+    context?: string;
 }
 export interface DetectedPr {
     url: string;
@@ -139,7 +152,7 @@ export interface SessionState {
     /** Displayable files/screenshots attached to the session prompt. */
     attachments?: SessionAttachment[];
 }
-export interface StateContext {
+interface StateContext {
     /** Session file mtime; drives running-vs-stale. */
     mtimeMs?: number;
     cwd?: string;
@@ -196,13 +209,6 @@ export declare function isTicketCreateTool(name?: string, command?: string): boo
  * take `#<number>`. Returns undefined when neither shape is present.
  */
 export declare function extractCreatedTicket(text?: string): string | undefined;
-/**
- * Pull the plan markdown out of an `ExitPlanMode` tool_use event's args. The
- * Claude tool schema is `{ plan: string }`; the transcript parser already
- * lifts `input` onto `event.args`. Returns undefined for a missing/empty plan
- * so consumers can rely on `plan?: string` truthiness.
- */
-export declare function extractPlanText(args?: Record<string, any>): string | undefined;
 /**
  * Structured question from a Claude `AskUserQuestion` tool call. Its input is
  * `{ questions: [{ question, header, options: [{label, description}] }] }` and the
@@ -212,6 +218,33 @@ export declare function extractPlanText(args?: Record<string, any>): string | un
  * 1-based selection digit as `key`.
  */
 export declare function structuredQuestionFromAsk(args?: Record<string, any>): StructuredQuestion | undefined;
+/** The separated question the CLI shows: the trailing ask + optional preceding context. */
+export interface ProseQuestion {
+    /** The trailing ask, with its original Markdown and line breaks. */
+    text: string;
+    /** The preceding report/explanation, Markdown + newlines preserved; absent when none. */
+    context?: string;
+}
+/**
+ * Split a run of prose into its trailing QUESTION and the CONTEXT before it,
+ * instead of flattening a whole report into one line (the old `oneLine(content)`
+ * that copied a merged report and lost its Markdown). Returns undefined when the
+ * text has no real trailing ask.
+ *
+ * Rules, each pinned by a test:
+ *   - The ask must be TRAILING: the last eligible non-empty line is the question,
+ *     or the search stops (a report line after the question means it isn't the ask).
+ *   - A `?` that lives ONLY inside a fenced code block, an inline `code` span, or a
+ *     `>` blockquote does NOT count — those lines are ineligible to end the ask
+ *     (they still ride along in `context`).
+ *   - Multiple/multiline related asks are kept together (a contiguous run of
+ *     question / list-item / `:`-lead-in lines), never dropped.
+ *   - When the ask shares ONE line with preceding prose, the leading non-question
+ *     sentences peel into `context` and only the trailing question sentence(s) stay
+ *     in `text`.
+ *   - Both fields preserve newlines and Markdown.
+ */
+export declare function extractProseQuestion(raw: string): ProseQuestion | undefined;
 /**
  * Infer live activity + a preview from a chronological event slice. `pr` /
  * `ticket` / `worktree` are attached by `inferSessionState`; this focuses on the

package/dist/lib/session/state.js

@@ -15,6 +15,7 @@
  * shape + mtime — same function, driven off the normalized events.
  */
 import * as path from 'path';
+import { Lexer } from 'marked';
 import { isCompletedTodoStatus, SNAPSHOT_TODO_TOOLS, summarizeToolUse } from './parse.js';
 import { isShellExecTool } from './shell-programs.js';
 import { classifyFileChanges } from './digest.js';
@@ -367,7 +368,7 @@ export function extractCreatedTicket(text) {
  * lifts `input` onto `event.args`. Returns undefined for a missing/empty plan
  * so consumers can rely on `plan?: string` truthiness.
  */
-export function extractPlanText(args) {
+function extractPlanText(args) {
     const plan = args?.plan;
     if (typeof plan !== 'string')
         return undefined;
@@ -432,13 +433,110 @@ function eventStampMs(e, mtimeMs) {
     return ms;
 }
 /** Does an assistant message read as a question directed at the user? */
-function looksLikeQuestion(text) {
-    const t = text.trim();
-    if (!t)
-        return false;
-    // Only weigh the final line — a long answer that ends with a question is a question.
-    const lastLine = t.split('\n').filter(Boolean).pop() ?? t;
-    return QUESTION_TRAILING.test(lastLine) || QUESTION_PHRASE.test(lastLine);
+/** Strip inline-code spans so a `?` living only inside `code` never reads as a question. */
+function stripInlineCode(s) {
+    return s.replace(/`[^`]*`/g, '');
+}
+/** Whether one line's prose ENDS an ask (trailing '?' or an interrogative phrase). */
+function lineIsQuestion(line) {
+    const probe = stripInlineCode(line.trim());
+    return QUESTION_TRAILING.test(probe) || QUESTION_PHRASE.test(probe);
+}
+/**
+ * Split a run of prose into its trailing QUESTION and the CONTEXT before it,
+ * instead of flattening a whole report into one line (the old `oneLine(content)`
+ * that copied a merged report and lost its Markdown). Returns undefined when the
+ * text has no real trailing ask.
+ *
+ * Rules, each pinned by a test:
+ *   - The ask must be TRAILING: the last eligible non-empty line is the question,
+ *     or the search stops (a report line after the question means it isn't the ask).
+ *   - A `?` that lives ONLY inside a fenced code block, an inline `code` span, or a
+ *     `>` blockquote does NOT count — those lines are ineligible to end the ask
+ *     (they still ride along in `context`).
+ *   - Multiple/multiline related asks are kept together (a contiguous run of
+ *     question / list-item / `:`-lead-in lines), never dropped.
+ *   - When the ask shares ONE line with preceding prose, the leading non-question
+ *     sentences peel into `context` and only the trailing question sentence(s) stay
+ *     in `text`.
+ *   - Both fields preserve newlines and Markdown.
+ */
+export function extractProseQuestion(raw) {
+    const content = (raw ?? '').replace(/\r\n/g, '\n');
+    if (!content.trim())
+        return undefined;
+    const lines = content.split('\n');
+    // Mark lines that may NOT end the ask: fenced-code (delimiters + body) and
+    // blockquotes. They remain part of context; they just can't BE the question.
+    const eligible = [];
+    let fence;
+    for (const line of lines) {
+        const t = line.trim();
+        const delimiter = /^(`{3,}|~{3,})(.*)$/.exec(t);
+        if (fence) {
+            if (delimiter && delimiter[1][0] === fence.marker && delimiter[1].length >= fence.length && !delimiter[2].trim())
+                fence = undefined;
+            eligible.push(false);
+            continue;
+        }
+        if (delimiter) {
+            fence = { marker: delimiter[1][0], length: delimiter[1].length };
+            eligible.push(false);
+            continue;
+        }
+        eligible.push(!/^>/.test(t)); // blockquote line is ineligible
+    }
+    // The trailing ask: the last eligible non-empty line must itself be a question.
+    let qEnd = -1;
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (!eligible[i] || !lines[i].trim())
+            continue;
+        if (lineIsQuestion(lines[i]))
+            qEnd = i;
+        break; // first eligible non-empty line from the end decides it
+    }
+    if (qEnd === -1)
+        return undefined;
+    // Expand upward over contiguous eligible non-empty ask/lead-in lines so a
+    // multi-line ask ("Questions:\n- A?\n- B?") stays whole.
+    let blockStart = qEnd;
+    for (let i = qEnd - 1; i >= 0; i--) {
+        if (!eligible[i])
+            break;
+        if (!lines[i].trim())
+            break; // blank line ends the paragraph/block
+        blockStart = i;
+    }
+    const contextAbove = lines.slice(0, blockStart).join('\n').trim();
+    let block = lines.slice(blockStart, qEnd + 1).join('\n').trim();
+    // Only plain text can contribute a sentence boundary. Code, links and other
+    // inline Markdown remain whole, even when their content contains punctuation.
+    let inlineContext = '';
+    if (!/^\s*(?:[-*]|\d+[.)])\s/m.test(block)) {
+        const boundaries = [];
+        let offset = 0;
+        for (const token of Lexer.lexInline(block)) {
+            if (token.type === 'text') {
+                for (const match of token.raw.matchAll(/(?<=[.!?])\s+/g))
+                    boundaries.push(offset + match.index + match[0].length);
+            }
+            offset += token.raw.length;
+        }
+        const starts = [0, ...boundaries];
+        const sentences = starts.map((start, i) => block.slice(start, starts[i + 1] ?? block.length));
+        let firstQ = sentences.length - 1;
+        for (let i = sentences.length - 1; i >= 0; i--) {
+            if (lineIsQuestion(sentences[i]))
+                firstQ = i;
+            else
+                break;
+        }
+        inlineContext = sentences.slice(0, firstQ).join('').trim();
+        block = sentences.slice(firstQ).join('').trim();
+    }
+    const trailingContext = lines.slice(qEnd + 1).join('\n').trim();
+    const context = [contextAbove, inlineContext, trailingContext].filter(Boolean).join('\n\n').trim() || undefined;
+    return { text: block, context };
 }
 /** Human-readable one-liner for the latest event (message text or tool action). */
 function describeEvent(e) {
@@ -559,9 +657,12 @@ export function inferActivity(events, ctx = {}) {
         // kept the question forever).
         const askedAtMs = eventStampMs(last, ctx.mtimeMs) ?? ctx.mtimeMs;
         const questionFresh = askedAtMs != null && nowMs - askedAtMs < PROSE_QUESTION_FRESH_MS;
-        if (questionFresh && looksLikeQuestion(last.content ?? '')) {
-            const text = oneLine(last.content ?? '');
-            return { ...base, activity: 'waiting_input', awaitingReason: 'question', question: { text, reason: 'question' } };
+        const prose = questionFresh ? extractProseQuestion(last.content ?? '') : undefined;
+        if (prose) {
+            const question = { text: prose.text, reason: 'question' };
+            if (prose.context)
+                question.context = prose.context;
+            return { ...base, activity: 'waiting_input', awaitingReason: 'question', question };
         }
         return { ...base, activity: 'idle' };
     }

package/dist/lib/session/stream-render.d.ts

@@ -1,3 +1,4 @@
 import type { SessionAgentId } from './types.js';
-export type StreamLineRenderer = (line: string) => string | null;
+type StreamLineRenderer = (line: string) => string | null;
 export declare function makeStreamRenderer(agent: SessionAgentId, cwd?: string): StreamLineRenderer;
+export {};

package/dist/lib/session/sync/agents.d.ts

@@ -67,8 +67,6 @@ export declare const SYNC_AGENTS: SyncAgentSpec[];
  * by session id so a session present in multiple version homes is uploaded once.
  */
 export declare function listLocalTranscripts(spec: SyncAgentSpec): LocalTranscript[];
-/** Session ids this machine holds locally (live home), used to skip mirror writes. */
-export declare function localSessionIds(spec: SyncAgentSpec): Set<string>;
 /**
  * Absolute mirror path for a remote machine's transcript — lands in a scan root.
  *
@@ -90,7 +88,5 @@ export declare function mirrorPath(spec: SyncAgentSpec, machine: string, relKey:
  *    one object per constituent file of the session directory.
  */
 export declare function objectKey(machine: string, agentId: string, sessionId: string, relKey?: string): string;
-/** R2 object key for a machine's manifest. */
-export declare function manifestKey(machine: string): string;
 /** Prefix under which all machine manifests live (for discovery). */
 export declare const SESSIONS_PREFIX = "sessions/";

package/dist/lib/session/sync/backend.d.ts

@@ -24,10 +24,9 @@
  */
 import { type PhoenixSession } from '../../identity/client.js';
 import { type R2Config } from './config.js';
-export type SessionsBackendKind = 'managed' | 'byo';
 /** Env var that forces the BYO path. Value must be exactly `byo`. */
 export declare const SESSIONS_BACKEND_ENV = "AGENTS_SESSIONS_BACKEND";
-export interface ManagedSessionsBackend {
+interface ManagedSessionsBackend {
     kind: 'managed';
     /** Public base URL of the managed sessions Worker, no trailing slash. */
     baseUrl: string;
@@ -36,13 +35,13 @@ export interface ManagedSessionsBackend {
     /** Phoenix userId — the object-store namespace prefix (path segment 0). */
     userId: string;
 }
-export interface ByoSessionsBackend {
+interface ByoSessionsBackend {
     kind: 'byo';
     /** The resolved r2.backups credentials for the S3-compatible client. */
     r2: R2Config;
 }
-export type SessionsBackend = ManagedSessionsBackend | ByoSessionsBackend;
-export interface ResolveSessionsBackendOpts {
+type SessionsBackend = ManagedSessionsBackend | ByoSessionsBackend;
+interface ResolveSessionsBackendOpts {
     /** Force the BYO r2.backups path even when signed in. */
     byo?: boolean;
     /** DI seam — a static write token selects BYO (tests / self-host). */
@@ -59,3 +58,4 @@ export declare function shouldUseManagedSessions(opts?: ResolveSessionsBackendOp
  * lives here, not in the shared policy.
  */
 export declare function resolveSessionsBackend(opts?: ResolveSessionsBackendOpts): SessionsBackend;
+export {};

package/dist/lib/session/sync/managed-config.d.ts

@@ -17,13 +17,5 @@ export declare const DEFAULT_SESSIONS_DOMAIN = "sessions.agents-cli.sh";
 export declare const DEFAULT_SESSIONS_WORKER_NAME = "agents-sessions";
 /** R2 bucket name backing the managed sessions Worker. */
 export declare const DEFAULT_SESSIONS_BUCKET_NAME = "agents-sessions";
-/** Isolated Cloudflare resources for the managed session-backup store. */
-export interface SessionsConfig {
-    baseUrl: string;
-    accountId: string;
-    workerName: string;
-    bucketName: string;
-    domain?: string;
-}
 /** Public base URL of the managed sessions Worker, no trailing slash. */
 export declare function managedSessionsBaseUrl(): string;

package/dist/lib/session/sync/managed-key.d.ts

@@ -31,8 +31,6 @@ export declare const ESCROW_REL_KEY = "__key/backup-dek";
 export declare function backupKeyCachePath(): string;
 /** The DEK cached locally for this Phoenix user, or null. */
 export declare function readCachedBackupKey(userId: string): Buffer | null;
-/** Persist a DEK (base64) for this Phoenix user in the local 0600 cache. */
-export declare function cacheBackupKey(userId: string, b64: string): void;
 /**
  * Resolve the managed backup DEK for `userId`, minting + escrowing one on first
  * use. NEVER returns null — the managed path must not upload plaintext.

package/dist/lib/session/sync/managed-key.js

@@ -66,7 +66,7 @@ export function readCachedBackupKey(userId) {
     return decodeDek(readCache()[userId]);
 }
 /** Persist a DEK (base64) for this Phoenix user in the local 0600 cache. */
-export function cacheBackupKey(userId, b64) {
+function cacheBackupKey(userId, b64) {
     const file = backupKeyCachePath();
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     ensureLockTarget(file, '{}', 0o700);

package/dist/lib/session/sync/r2.d.ts

@@ -10,7 +10,7 @@
  * Linux-only; rclone-mount needs macFUSE).
  */
 import type { R2Config } from './config.js';
-export interface HeadResult {
+interface HeadResult {
     size: number;
     etag: string;
 }
@@ -35,3 +35,6 @@ export declare class R2Client {
      *  {@link SessionsBackupClient} interface (managed lists with no prefix). */
     list(prefix?: string): Promise<string[]>;
 }
+/** Single pass: sequential replaces would double-decode `&amp;lt;` into `<`. */
+export declare function decodeXml(s: string): string;
+export {};

package/dist/lib/session/sync/r2.js

@@ -108,13 +108,10 @@ export class R2Client {
         return keys;
     }
 }
-function decodeXml(s) {
-    return s
-        .replace(/&/g, '&')
-        .replace(/&lt;/g, '<')
-        .replace(/&gt;/g, '>')
-        .replace(/&quot;/g, '"')
-        .replace(/&apos;/g, "'");
+const XML_ENTITIES = { '&amp;': '&', '&lt;': '<', '&gt;': '>', '&quot;': '"', '&apos;': "'" };
+/** Single pass: sequential replaces would double-decode `&amp;lt;` into `<`. */
+export function decodeXml(s) {
+    return s.replace(/&(?:amp|lt|gt|quot|apos);/g, (entity) => XML_ENTITIES[entity] ?? entity);
 }
 async function safeText(res) {
     try {

package/dist/lib/session/sync/transcript-crypto.d.ts

@@ -25,7 +25,7 @@
  */
 import type { R2Config } from './config.js';
 /** Serialized envelope stored as the R2 object body when encryption is on. */
-export interface TranscriptEnvelope {
+interface TranscriptEnvelope {
     /** Envelope format version. */
     v: 1;
     alg: 'aes-256-gcm';
@@ -75,3 +75,4 @@ export declare function decryptEnvelope(envelope: TranscriptEnvelope, key: Buffe
  *  - Plaintext body  → returned verbatim (legacy/unencrypted object).
  */
 export declare function decryptTranscriptBody(body: string, key: Buffer | null): string;
+export {};

package/dist/lib/session/tail.d.ts

@@ -9,7 +9,7 @@
  */
 import type { SessionAgentId, SessionEvent } from './types.js';
 /** A tail read: the last few normalized events plus the raw text they came from. */
-export interface SessionTail {
+interface SessionTail {
     events: SessionEvent[];
     /** The raw JSONL chunk (leading partial line dropped), for content-level math. */
     content: string;
@@ -35,3 +35,4 @@ export declare function readSessionTailWithRaw(filePath: string, agent: SessionA
  * wrapper over {@link readSessionTailWithRaw} for callers that only need events.
  */
 export declare function readSessionTail(filePath: string, agent: SessionAgentId, maxBytes?: number, maxEvents?: number): SessionEvent[];
+export {};

package/dist/lib/session/team-filter.d.ts

@@ -40,7 +40,7 @@ export declare function _resetTeamOriginIndex(): void;
  */
 export declare function enrichTeamOrigins(sessions: SessionMeta[]): SessionMeta[];
 /** Result of splitting sessions into visible and hidden (team-origin) groups. */
-export interface FilterResult {
+interface FilterResult {
     visible: SessionMeta[];
     hiddenCount: number;
 }

package/dist/lib/session/testdata/pid-registry-namespace.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/session/testdata/pid-registry-namespace.js

@@ -0,0 +1,27 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { prunePidSessionRegistry, readPidSessionEntry, writePidSessionEntry } from '../pid-registry.js';
+import { getActiveSessions } from '../active.js';
+import { loadLocalActiveSessions, loadFleetActiveSessions, writeActiveSessionsCache, updateImmutableMemos, readActiveSessionsCache } from '../session-cache.js';
+// Invoked only by the isolated-HOME test fork, inside a real unshare namespace.
+const hostPid = Number(process.argv[2]);
+// Names convey no authority: this is PID 1 with its own procfs in one variant.
+fs.writeFileSync('/proc/self/comm', 'init');
+assert.equal(readPidSessionEntry(hostPid)?.sessionId, 'host-session');
+assert.throws(() => process.kill(hostPid, 0), { code: 'ESRCH' });
+writePidSessionEntry({ pid: hostPid, agent: 'codex', sessionId: 'namespace-collision', startedAtMs: Date.now() });
+assert.equal(readPidSessionEntry(hostPid)?.sessionId, 'host-session');
+prunePidSessionRegistry(() => false);
+assert.equal(readPidSessionEntry(hostPid)?.sessionId, 'host-session');
+const local = await loadLocalActiveSessions({ forceRefresh: true, gather: async () => { throw new Error('partial gather must never run'); } });
+assert.equal(local.sessions[0].sessionId, 'host-session');
+assert.equal(local.capturedAt, 1);
+assert.equal(local.servedFromCache, true);
+const fleet = await loadFleetActiveSessions({ forceRefresh: true, gather: async () => { throw new Error('partial fleet gather must never run'); } });
+assert.equal(fleet.remoteDeviceCount, 2);
+assert.equal(fleet.capturedAt, 1);
+assert.equal((await getActiveSessions())[0].sessionId, 'host-session');
+assert.throws(() => writeActiveSessionsCache('local', []), /process namespace/);
+assert.throws(() => updateImmutableMemos([]), /process namespace/);
+assert.equal(readActiveSessionsCache('local')?.capturedAt, 1);
+console.log('host pid: ESRCH; overwrite: refused; registry and snapshots: retained');

package/dist/lib/session/testdata/process-view-namespace.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/session/testdata/process-view-namespace.js

@@ -0,0 +1,56 @@
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { getTerminalsDir } from '../../state.js';
+import { hostProcessView, requireWriterProcessView, recordDaemonProcessView } from '../process-view.js';
+const mode = process.argv[2];
+try {
+    if (mode === 'hook-first') {
+        const hook = process.env.AGENTS_SESSION_IDENTITY_TEST_HOOK;
+        const child = hook
+            ? spawnSync('bash', [hook], { input: JSON.stringify({ session_id: 'init-hook', cwd: process.cwd() }), encoding: 'utf8', env: process.env })
+            : spawnSync('bun', [import.meta.filename, 'once'], { encoding: 'utf8', env: process.env });
+        if (child.status !== 0)
+            throw new Error(child.stderr);
+        if (!fs.existsSync(`${getTerminalsDir()}/process-view.json`))
+            throw new Error('child did not enroll its namespace');
+    }
+    if (mode === 'daemon')
+        recordDaemonProcessView();
+    if (mode === 'read') {
+        console.log(hostProcessView() ? 'owned' : 'unowned');
+        process.exit(0);
+    }
+    if (mode === 'publish' || mode === 'snapshot') {
+        const { loadLocalActiveSessions, loadFleetActiveSessions, writeActiveSessionsCache } = await import('../session-cache.js');
+        if (mode === 'publish') {
+            writeActiveSessionsCache('local', [], { capturedAt: 1 });
+            writeActiveSessionsCache('fleet', [], { capturedAt: 1 });
+        }
+        else {
+            const gather = async () => { throw new Error('foreign observer gathered'); };
+            const local = await loadLocalActiveSessions({ forceRefresh: true, gather });
+            const fleet = await loadFleetActiveSessions({ forceRefresh: true, gather });
+            if (!local.servedFromCache || !fleet.servedFromCache || local.capturedAt !== 1 || fleet.capturedAt !== 1)
+                throw new Error('foreign snapshot changed');
+            console.log('observed');
+            process.exit(0);
+        }
+    }
+    if (mode === 'sessions') {
+        const { loadLocalActiveSessions } = await import('../session-cache.js');
+        const result = await loadLocalActiveSessions({ forceRefresh: true });
+        if (result.servedFromCache || !Array.isArray(result.sessions))
+            throw new Error('cold discovery did not run');
+    }
+    requireWriterProcessView();
+    console.log('owned');
+    if (mode === 'hold' || mode === 'hook-first') {
+        process.on('SIGTERM', () => process.exit(0));
+        setInterval(() => { }, 1000);
+    }
+}
+catch (error) {
+    console.error(error.message);
+    console.log('denied');
+    process.exitCode = 2;
+}

package/dist/lib/session/testdata/process-view-private.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/session/testdata/process-view-private.js

@@ -0,0 +1,12 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { writePidSessionEntry, readLivePidSessionEntry } from '../pid-registry.js';
+import { writeActiveSessionsCache, readActiveSessionsCache } from '../session-cache.js';
+// A container owns its private home regardless of the name of PID 1.
+assert.equal(process.pid, 1);
+fs.writeFileSync('/proc/self/comm', process.argv[2]);
+writePidSessionEntry({ pid: process.pid, agent: 'codex', sessionId: 'private-home', startedAtMs: Date.now() });
+assert.equal(readLivePidSessionEntry(process.pid)?.sessionId, 'private-home');
+writeActiveSessionsCache('local', [{ context: 'headless', kind: 'codex', sessionId: 'private-home', status: 'running' }]);
+assert.equal(readActiveSessionsCache('local')?.sessions[0]?.sessionId, 'private-home');
+console.log('private home: registry and snapshot published');