@phnx-labs/agents-cli 1.22.117 → 1.22.119

package/dist/lib/account-catalog.d.ts

@@ -90,6 +90,19 @@ export interface NativeAccountCatalogRow {
     usageSnapshot?: UsageSnapshot | null;
     /** Raw usage fetch error, for headless/unverified labeling alongside the bars. */
     usageError?: string | null;
+    /**
+     * The token FACT for this account ON THIS BOX (PHNX-4116): the credential kind
+     * plus its file date — `sk-ant-oat01 (Sep 16)` for a Claude slot's
+     * `.claude/.oauth_token`, `api key (present)` for a provider-key harness — or
+     * `no token` when the credential file is absent. A fact, never a verdict word.
+     */
+    token: string;
+    /**
+     * The auth FACT for this account ON THIS BOX (PHNX-4116): `last used ok 12m
+     * ago` / `last auth failure 401 Sep 20 14:02` / `rate-limited until 15:00` /
+     * `not used on this box yet`, from the recorded run outcome (or a real probe).
+     */
+    lastAuth: string;
     fix: string | null;
 }
 export interface AccountDeviceVerdict {
@@ -155,6 +168,17 @@ export interface AccountListEntryJson {
     /** The live usage snapshot backing `usage`, when available — additive, not breaking. */
     usageSnapshot?: UsageSnapshot | null;
     usageError?: string | null;
+    /**
+     * The token FACT for this account on the box that emitted this JSON (PHNX-4116):
+     * `sk-ant-oat01 (Sep 16)` / `api key (present)` / `no token`. A fact, not a verdict.
+     */
+    token: string;
+    /**
+     * The auth FACT for this account on the box that emitted this JSON (PHNX-4116):
+     * `last used ok 12m ago` / `last auth failure 401 Sep 20 14:02` / `not used on
+     * this box yet`. Reflects the emitting box only; `devices[]` carries the fleet.
+     */
+    lastAuth: string;
     fix: string | null;
 }
 interface AccountListJson {
@@ -184,6 +208,14 @@ type CatalogMeta = Pick<Meta, 'accounts' | 'deviceAccounts'>;
  * silently dropped from the list nor shown as connected.
  */
 export declare function buildNativeCatalog(rows: NativeHomeRow[], meta: CatalogMeta, globalDefault?: (agent: AgentId) => string | null): NativeAccountCatalogRow[];
+/**
+ * The token FACT for a Claude account ON THIS BOX (PHNX-4116): the slot/home
+ * `.claude/.oauth_token` scheme prefix + its file date, else a present native
+ * credential, else `no token`. For non-Claude native rows it reports credential
+ * presence generically. `dir` is the slot dir when the account has one, else the
+ * local version home. A fact, never a verdict.
+ */
+export declare function readTokenFact(agent: AgentId, dir: string | null): string;
 export declare function toProviderRow(account: CredentialAccount, meta: Pick<Meta, 'accounts'>): ProviderAccountCatalogRow;
 /**
  * Wire the real collectors to the pure builder. This is the canonical
@@ -215,6 +247,12 @@ export declare const OVERVIEW_MAX_USAGE_WINDOWS = 2;
  * cannot drift.
  */
 export declare const ACCOUNT_LISTING_LEGEND = "* stale usage \u00B7 a healthy account carries no state \u00B7 identity + per-box state: agents accounts list --fleet";
+/**
+ * Colour the auth FACT by what it states (PHNX-4116): a recent success is green,
+ * a server rejection red, a throttle yellow, and "not used on this box yet" the
+ * neutral gray of a fact that carries no alarm.
+ */
+export declare function authFactNote(lastAuth: string): string;
 /** Shared text renderer used by both `accounts list` and account-first `view`. */
 export declare function renderAccountRows(rows: NativeAccountCatalogRow[], opts: {
     heading?: boolean;

package/dist/lib/account-catalog.js

@@ -8,7 +8,9 @@ import { readSlots } from './accounts/slots.js';
 import { harnessWorkerIsPerDevice } from './harness-auth-capabilities.js';
 import { hasKeychainTokenSync, isSecretsTransportError } from './secrets-client.js';
 import { isLaunchableSignedIn as isCredentialLaunchable } from './accounting/rotate.js';
-import { authCacheKey, readAuthHealthCache, slotAuthVersionKey } from './auth-health.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { authCacheKey, formatAuthFact, readAuthHealthCache, slotAuthVersionKey } from './auth-health.js';
 import { readFleetSharedDeviceStates } from './fleet-shared-state.js';
 import { machineId } from './machine-id.js';
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
@@ -180,15 +182,21 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
             state: signedIn ? 'connected' : 'reconnect-needed',
             identityLabel: email ?? account?.name ?? group.identityKey,
             provisioning: provisioningFor(group.agent),
-            verdict: signedIn ? 'unverified' : 'missing',
+            // A credential is present but nothing has probed or run it here yet — that
+            // is `no_evidence` ("we did not look"), not `unverified` (PHNX-4116). The
+            // real per-box verdict is recomputed in loadAccountCatalog; the display is
+            // a fact (token + run outcomes), never this word.
+            verdict: signedIn ? 'no_evidence' : 'missing',
             checkedAt: null,
             devices: [],
             usage: null,
             usageSnapshot: null,
             usageError: null,
+            token: 'no token',
+            lastAuth: 'not used on this box yet',
             fix: fixFor({
                 agent: group.agent,
-                verdict: signedIn ? 'unverified' : 'missing',
+                verdict: signedIn ? 'no_evidence' : 'missing',
                 name: account?.name,
                 version: home,
                 provisioning: provisioningFor(group.agent),
@@ -204,6 +212,54 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
 function provisioningFor(agent) {
     return harnessWorkerIsPerDevice(agent) ? 'per-device' : 'portable';
 }
+const TOKEN_FACT_MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+/** `Sep 16` — the credential file's date, the only mutable part of the token fact. */
+function tokenFileDate(mtimeMs) {
+    const d = new Date(mtimeMs);
+    return `${TOKEN_FACT_MONTHS[d.getMonth()]} ${d.getDate()}`;
+}
+/**
+ * The non-secret scheme prefix of a Claude token — `sk-ant-oat01` for a
+ * setup-token, `sk-ant` for another Claude scheme, `token` otherwise. NEVER the
+ * secret body: only a fixed, publicly-documented prefix is returned so the fact
+ * can be printed and fleet-synced safely (root AGENTS.md §Security).
+ */
+function safeTokenPrefix(raw) {
+    const value = raw.trim();
+    if (value.startsWith('sk-ant-oat01'))
+        return 'sk-ant-oat01';
+    if (value.startsWith('sk-ant'))
+        return 'sk-ant';
+    return 'token';
+}
+/**
+ * The token FACT for a Claude account ON THIS BOX (PHNX-4116): the slot/home
+ * `.claude/.oauth_token` scheme prefix + its file date, else a present native
+ * credential, else `no token`. For non-Claude native rows it reports credential
+ * presence generically. `dir` is the slot dir when the account has one, else the
+ * local version home. A fact, never a verdict.
+ */
+export function readTokenFact(agent, dir) {
+    if (!dir)
+        return 'no token';
+    if (agent === 'claude') {
+        const oauth = path.join(dir, '.claude', '.oauth_token');
+        try {
+            const stat = fs.statSync(oauth);
+            const prefix = safeTokenPrefix(fs.readFileSync(oauth, 'utf-8'));
+            return `${prefix} (${tokenFileDate(stat.mtimeMs)})`;
+        }
+        catch { /* fall through to the native-credential check */ }
+        try {
+            const creds = path.join(dir, '.claude', '.credentials.json');
+            const stat = fs.statSync(creds);
+            return `native login (${tokenFileDate(stat.mtimeMs)})`;
+        }
+        catch { /* no credential file */ }
+        return 'no token';
+    }
+    return credentialPresence(agent, dir).perVersion ? 'credential present' : 'no token';
+}
 export function toProviderRow(account, meta) {
     const harnesses = ALL_AGENT_IDS.filter((agent) => providerAuthenticatesHarness(account.provider, account.auth, agent));
     const defaults = meta.accounts?.defaults ?? {};
@@ -286,6 +342,13 @@ export async function loadAccountCatalog() {
         const inv = localHome ? inventoryByHome.get(`${row.agent}:${localHome.label}`) : undefined;
         row.usageSnapshot = inv?.snapshot ?? null;
         row.usageError = inv?.usageError ?? null;
+        // The per-box FACTS (PHNX-4116): the token file on disk and the recorded run
+        // (or probe) outcome — never a verdict word. `cached` is the same row the
+        // observation used (slot key first, then the version-home label), so the
+        // fact and the internal verdict read the same evidence.
+        const credentialDir = slot?.slotDir ?? (localHome ? getVersionHomePath(row.agent, localHome.label) : null);
+        row.token = readTokenFact(row.agent, credentialDir);
+        row.lastAuth = formatAuthFact(cached ?? null);
         row.fix = fixFor({
             agent: row.agent,
             verdict: row.verdict,
@@ -326,6 +389,10 @@ function providerListEntry(row, harness) {
         checkedAt: null,
         devices: [],
         usage: null,
+        // A durable provider credential is a key, not a run-tracked login: state its
+        // presence as the token fact; there is no per-run auth evidence to render.
+        token: row.verdict === 'ready' ? 'api key (present)' : 'no key',
+        lastAuth: 'not used on this box yet',
         fix: row.fix,
     };
 }
@@ -361,6 +428,8 @@ export function accountListJson(native, providers = [], harness) {
                 usage: row.usage,
                 ...(row.usageSnapshot ? { usageSnapshot: row.usageSnapshot } : {}),
                 ...((() => { const v = usageErrorForDisplay(row.usageError); return v ? { usageError: v } : {}; })()),
+                token: row.token,
+                lastAuth: row.lastAuth,
                 fix: row.fix,
             })),
             ...providers.flatMap((row) => providerJsonEntries(row, harness)),
@@ -403,7 +472,7 @@ export function coverageNote(row, localDevice) {
         return absent.length > 0 && absent.length < row.devices.length ? `not on ${absent.join(', ')}` : null;
     }
     const provisioned = row.devices.filter((device) => device.verdict !== 'missing').length;
-    const usable = row.devices.filter((device) => device.verdict === 'live' || device.verdict === 'rate_limited' || device.verdict === 'unverified').length;
+    const usable = row.devices.filter((device) => device.verdict === 'live' || device.verdict === 'rate_limited' || device.verdict === 'unverified' || device.verdict === 'no_evidence').length;
     if (usable === 0 || usable === provisioned)
         return null;
     return `usable on ${usable} of ${provisioned} boxes`;
@@ -416,10 +485,19 @@ export const OVERVIEW_MAX_USAGE_WINDOWS = 2;
  * cannot drift.
  */
 export const ACCOUNT_LISTING_LEGEND = '* stale usage · a healthy account carries no state · identity + per-box state: agents accounts list --fleet';
+/**
+ * When a usage reading arrived from ANOTHER box's poller over the fleet store,
+ * name its origin — `(from zion)` — so the number reads as a synced fact, not a
+ * local capture (PHNX-4116). Local captures (statusline/poll) carry no suffix.
+ */
+function usageOriginSuffix(snapshot) {
+    const poller = snapshot?.freshness?.source === 'sync' ? snapshot.freshness.poller : undefined;
+    return poller ? ` ${chalk.gray(`(from ${poller})`)}` : '';
+}
 function usageText(row, maxWindows) {
     if (row.usageSnapshot) {
         const usageInfo = { snapshot: row.usageSnapshot, error: row.usageError ?? null };
-        return formatUsageSummary(null, usageInfo.snapshot, 3, viewUsageSummaryOptions(row.agent, row.state === 'connected', usageInfo, maxWindows));
+        return formatUsageSummary(null, usageInfo.snapshot, 3, viewUsageSummaryOptions(row.agent, row.state === 'connected', usageInfo, maxWindows)) + usageOriginSuffix(row.usageSnapshot);
     }
     if (row.usage?.status === 'rate_limited' && (row.usage.usedPercent === null || row.usage.usedPercent === undefined)) {
         return 'limited';
@@ -432,31 +510,32 @@ function usageText(row, maxWindows) {
     return `${renderBar(row.usage.usedPercent, LISTING_USAGE_BAR_LEN)} ${percent}`;
 }
 /**
- * True only when the USAGE cell is certain to print a throttle marker, so the
- * `rate-limited` note would say the same thing twice. Mirrors `usageText`
- * branch for branch: with a snapshot, `formatUsageSummary` appends
- * 'out of credits' or 'session-limited (…)' exactly for these `unavailable`
- * reasons; without one, `usageText` prints 'limited' or 'no credits'. A verdict
- * thrown by a maxed WINDOW is deliberately NOT here: the overview caps the cell
- * at `OVERVIEW_MAX_USAGE_WINDOWS`, so the window that tripped it can be hidden
- * behind the `+N` count with no color at all, and the note is the only signal.
+ * Colour the auth FACT by what it states (PHNX-4116): a recent success is green,
+ * a server rejection red, a throttle yellow, and "not used on this box yet" the
+ * neutral gray of a fact that carries no alarm.
  */
-function usageCellNamesThrottle(row) {
-    if (row.usageSnapshot) {
-        const unavailable = row.usageSnapshot.unavailable;
-        return unavailable?.reason === 'out_of_credits'
-            || (unavailable?.reason === 'session_limit' && !!unavailable.resetsAt);
-    }
-    return row.usage?.status === 'out_of_credits'
-        || (row.usage?.status === 'rate_limited' && (row.usage.usedPercent === null || row.usage.usedPercent === undefined));
+export function authFactNote(lastAuth) {
+    if (lastAuth.startsWith('last used ok'))
+        return chalk.green(lastAuth);
+    if (lastAuth.startsWith('last auth failure'))
+        return chalk.red(lastAuth);
+    if (lastAuth.startsWith('rate-limited'))
+        return chalk.yellow(lastAuth);
+    return chalk.gray(lastAuth);
 }
 function nativeLine(row, localDevice, maxWindows) {
     return {
         // A discovered login nobody has named is still identified by what it is:
         // the row no longer carries an IDENTITY column, so the identity IS the name.
         name: row.name ?? row.identityLabel,
+        // FACTS, in order: the token on disk, what happened when it was last used, a
+        // signed-out flag when there is no credential at all, fleet coverage, then the
+        // repair. The auth fact already carries a throttle/failure with its time, so
+        // there is no separate verdict word (PHNX-4116).
         notes: [
-            usageCellNamesThrottle(row) && row.verdict === 'rate_limited' ? null : verdictNote(row.verdict),
+            chalk.gray(row.token),
+            authFactNote(row.lastAuth),
+            row.verdict === 'missing' ? chalk.red('signed out') : null,
             coverageNote(row, localDevice),
             row.fix ? chalk.gray(`fix: ${row.fix}`) : null,
         ].filter((note) => !!note),
@@ -565,7 +644,7 @@ export function readSharedAccountVerdicts(userAgentsDir) {
                 continue;
             if (!['native', 'durable', 'per-device'].includes(row.authMode))
                 continue;
-            if (!['live', 'expired', 'revoked', 'rate_limited', 'unverified', 'missing'].includes(row.verdict))
+            if (!['live', 'expired', 'revoked', 'rate_limited', 'unverified', 'no_evidence', 'missing'].includes(row.verdict))
                 continue;
             const key = `${row.harness}:${row.accountId}`;
             const values = out.get(key) ?? [];
@@ -600,11 +679,14 @@ function normalizeAuthVerdict(verdict, signedIn) {
     // result — the daemon never publishes it (probeLocalFleetAuth drops those
     // rows). So it says nothing about the credential on disk; the live signedIn
     // read of the slot decides, exactly as it does when no verdict exists at all.
+    // No probe row, or one that says nothing about the credential: a present
+    // credential with no evidence either way is `no_evidence`, never a word that
+    // claims we looked (PHNX-4116).
     if (verdict === 'unconfigured')
-        return signedIn ? 'unverified' : 'missing';
+        return signedIn ? 'no_evidence' : 'missing';
     if (verdict === 'error')
-        return signedIn ? 'unverified' : 'missing';
-    return verdict ?? (signedIn ? 'unverified' : 'missing');
+        return signedIn ? 'no_evidence' : 'missing';
+    return verdict ?? (signedIn ? 'no_evidence' : 'missing');
 }
 /**
  * Merge the two writers of the same local truth — the T1 slot store and the
@@ -650,6 +732,8 @@ export function aggregateAccountVerdict(provisioning, devices, localQuota) {
         return 'live';
     if (verdicts.includes('unverified'))
         return 'unverified';
+    if (verdicts.includes('no_evidence'))
+        return 'no_evidence';
     return provisioning === 'per-device' ? 'per-device' : 'missing';
 }
 function newestCheckedAt(devices) {

package/dist/lib/account-provider-registry.js

@@ -38,7 +38,7 @@ const ADAPTERS = new Map([
     ['deepinfra', fixed('deepinfra', ['api-key'], { codex: 'OPENAI_API_KEY' }, { codex: { OPENAI_BASE_URL: 'https://api.deepinfra.com/v1/openai' } })],
     ['openai', fixed('openai', ['api-key'], { codex: 'OPENAI_API_KEY', opencode: 'OPENAI_API_KEY' }, {}, { codex: 'OPENAI_BASE_URL', opencode: 'OPENAI_BASE_URL' })],
     ['xai', fixed('xai', ['api-key'], { grok: 'XAI_API_KEY', claude: 'ANTHROPIC_AUTH_TOKEN' })],
-    ['google', fixed('google', ['api-key'], { gemini: 'GEMINI_API_KEY', antigravity: 'ANTIGRAVITY_API_KEY' })],
+    ['google', fixed('google', ['api-key'], { antigravity: 'ANTIGRAVITY_API_KEY' })],
     ['opencode', fixed('opencode', ['api-key'], { opencode: 'OPENCODE_API_KEY' })],
     ['proxy', fixed('proxy', ['api-key', 'bearer-token'], { claude: 'ANTHROPIC_AUTH_TOKEN', codex: 'OPENAI_API_KEY' }, {}, { claude: 'ANTHROPIC_BASE_URL', codex: 'OPENAI_BASE_URL' })],
     ['truefoundry', fixed('truefoundry', ['api-key', 'bearer-token'], { claude: 'ANTHROPIC_AUTH_TOKEN' }, {}, { claude: 'ANTHROPIC_BASE_URL' })],

package/dist/lib/account-registry.d.ts

@@ -22,7 +22,7 @@ interface ResolvedCredentialAccount {
 export interface NativeAccount extends NativeAccountRecord {
     kind: 'native';
 }
-export { recordSlot, readSlots } from './accounts/slots.js';
+export { recordSlot, readSlots, dropSlots } from './accounts/slots.js';
 export { registeredNativeAccountForEmail, parseNativeIdentityKey } from './native-accounts.js';
 export type UnifiedAccount = (CredentialAccount & {
     kind: 'provider';

package/dist/lib/account-registry.js

@@ -27,7 +27,9 @@ import { isAgentId } from './types.js';
 import { bundleExistsSync, deleteBundleSync, deleteKeychainTokenSync, getKeychainTokenSync, hasKeychainTokenSync, listBundlesSync, readAndResolveBundleEnvSync, readBundleSync, renameBundleSync, writeBundleWithItemsSync, } from './secrets-client.js';
 import { getAccountProvider } from './account-provider-registry.js';
 import { accountSecretItem, buildAccountBundle, parseAccountBundle, secretVarFor } from './account-schema.js';
-export { recordSlot, readSlots } from './accounts/slots.js';
+import { readClaudeHomeConfig } from './agent-spec/agents.js';
+import { getVersionHomePath, listInstalledVersions } from './installations/store.js';
+export { recordSlot, readSlots, dropSlots } from './accounts/slots.js';
 export { registeredNativeAccountForEmail, parseNativeIdentityKey } from './native-accounts.js';
 const NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 const NATIVE_LABEL = /^[a-zA-Z0-9][a-zA-Z0-9@._+-]*$/;
@@ -663,6 +665,35 @@ export function resolveCredentialAccount(name, host, expectedProvider, base = ge
         env: { ...connectionEnv, [envVar]: secret },
     };
 }
+/**
+ * Sync fallback: scan installed version homes to discover a native identity
+ * that matches the given email, for accounts that predate the registration
+ * system (empty `accounts.native`). Returns a synthetic SpawnAccount or null.
+ */
+function discoverUnregisteredNativeAccount(email, agent) {
+    if (agent !== 'claude')
+        return null;
+    const needle = email.toLowerCase();
+    for (const label of listInstalledVersions(agent)) {
+        const home = getVersionHomePath(agent, label);
+        if (!fs.existsSync(home))
+            continue;
+        const config = readClaudeHomeConfig(home);
+        if (!config?.identity?.email)
+            continue;
+        if (config.identity.email.toLowerCase() === needle) {
+            return {
+                kind: 'native',
+                id: email,
+                name: email,
+                agent,
+                identityKey: config.identity.accountKey ?? email.toLowerCase(),
+                scope: 'version',
+            };
+        }
+    }
+    return null;
+}
 /**
  * Resolve the account a run should launch under, following the binding order
  * (explicit → exact `agent@version` → device-scoped `agent` → per-harness
@@ -689,7 +720,10 @@ export function resolveSpawnAccount(explicit, agent, version, meta, opts = {}) {
     // Scope the lookup to the harness being launched: a bare identity selector
     // (`claude#muqsitnawaz@gmail.com`) matches every harness that identity is signed
     // into, and only this one can authenticate the spawn.
-    const unified = findUnifiedAccount(selection.id, meta, undefined, agent);
+    let unified = findUnifiedAccount(selection.id, meta, undefined, agent);
+    if (!unified && selection.source === 'explicit' && selection.id.includes('@')) {
+        unified = discoverUnregisteredNativeAccount(selection.id, agent);
+    }
     if (!unified) {
         // A stale per-harness default is a preference, not a hard requirement: the
         // machine stays runnable by falling back to balanced rotation. Bindings and

package/dist/lib/accounting/rotate.js

@@ -212,9 +212,18 @@ export function hasStaleUsage(candidate, nowMs = Date.now()) {
     const capturedAt = snapshot?.capturedAt;
     if (!capturedAt || !snapshot?.windows.length)
         return false;
+    // A row that arrived via sync (D1, PHNX-4116) cannot be refreshed on THIS box —
+    // the account's poller lives on the headed device that published it, not here.
+    // Its age is shown, never used to refuse: a blind synced pool takes a
+    // floor-weight pick (capacityWeight → UNVERIFIED_WEIGHT) and
+    // rotationFailoverChain handles a real 429. Only a locally-captured reading a
+    // broken poller left hours old is genuinely "stale" for a refusal. See the
+    // GWT-E5d amendment.
+    if (snapshot.freshness?.source === 'sync')
+        return false;
     return nowMs - capturedAt.getTime() > USAGE_STALE_REFUSAL_MAX_AGE_MS;
 }
-function hasUsageAvailable(candidate) {
+function hasUsageAvailable(candidate, now = Date.now()) {
     const snapshot = candidate.usageSnapshot;
     if (snapshot) {
         // Eligibility mirrors the `agents view` throttle badge exactly
@@ -225,7 +234,7 @@ function hasUsageAvailable(candidate) {
         // stayed "eligible" and the router kept launching into it while `ag view`
         // showed it rate-limited. Capacity *weighting* still ranks eligible accounts
         // by weekly headroom; this gate only decides can-it-run-right-now.
-        const status = deriveUsageStatusFromSnapshot(snapshot);
+        const status = deriveUsageStatusFromSnapshot(snapshot, now);
         if (status !== null)
             return status !== 'rate_limited';
     }
@@ -279,11 +288,11 @@ export function readinessFromCandidate(candidate, now = Date.now(), model) {
             return { ready: false, reason: 'model_limited', email: candidate.email };
         }
     }
-    if (hasUsageAvailable(candidate)) {
+    if (hasUsageAvailable(candidate, now)) {
         return { ready: true };
     }
     const snap = candidate.usageSnapshot;
-    const snapRateLimited = !!snap && snap.windows.length > 0 && deriveUsageStatusFromSnapshot(snap) === 'rate_limited';
+    const snapRateLimited = !!snap && snap.windows.length > 0 && deriveUsageStatusFromSnapshot(snap, now) === 'rate_limited';
     const reason = !snapRateLimited && candidate.usageStatus === 'out_of_credits' ? 'out_of_credits' : 'rate_limited';
     return { ready: false, reason, email: candidate.email };
 }
@@ -573,11 +582,11 @@ export function pickAvailableCandidate(candidates, preferredVersion, nowMs = Dat
 export function classifyHarnessCandidates(byHarness, nowMs = Date.now()) {
     const summaries = [];
     for (const [agent, candidates] of byHarness) {
-        const eligible = candidates.filter((c) => isRotationEligible(c));
+        const eligible = candidates.filter((c) => isRotationEligible(c, nowMs));
         if (eligible.length === 0) {
             const counts = new Map();
             for (const c of candidates) {
-                const readiness = readinessFromCandidate(c);
+                const readiness = readinessFromCandidate(c, nowMs);
                 const reason = readiness.ready ? 'ineligible' : readiness.reason;
                 counts.set(reason, (counts.get(reason) ?? 0) + 1);
             }
@@ -668,7 +677,7 @@ export function formatNoHealthyAccountError(agent, strategy, excluded, nowMs = D
     const excludedStr = excluded.length === 0
         ? 'no installed versions'
         : excluded.map((c) => {
-            const readiness = readinessFromCandidate(c);
+            const readiness = readinessFromCandidate(c, nowMs);
             const reason = readiness.ready ? 'ineligible' : readiness.reason;
             return `${c.version} (${reason})`;
         }).join(', ');
@@ -700,7 +709,12 @@ export function formatNoVerifiedUsageError(agent, strategy, candidates, nowMs =
         ? 'no signed-in accounts'
         : candidates.map((c) => {
             const age = snapshotAgeMinutes(c, nowMs);
-            const staleness = age === null ? 'no usage snapshot' : `usage ${age}m old`;
+            // A synced row's age never drives a refusal (see hasStaleUsage), so name
+            // it as synced rather than letting the operator read it as the culprit.
+            const synced = c.usageSnapshot?.freshness?.source === 'sync';
+            const staleness = age === null
+                ? 'no usage snapshot'
+                : `usage ${age}m old${synced ? ', synced' : ''}`;
             return `${c.version} (${staleness})`;
         }).join(', ');
     const maxAgeMin = Math.round(USAGE_STALE_REFUSAL_MAX_AGE_MS / 60_000);

package/dist/lib/accounting/usage-ingest.d.ts

@@ -1 +1,6 @@
-export declare function runUsageIngest(): Promise<number>;
+/** Stdin grew past {@link REMOTE_STDOUT_MAX_BYTES}; the payload was refused unread. */
+export declare class UsageIngestInputTooLargeError extends Error {
+    readonly limitBytes: number;
+    constructor(limitBytes: number);
+}
+export declare function runUsageIngest(argv?: string[]): Promise<number>;