@phnx-labs/agents-cli 1.22.28 → 1.22.30

package/dist/lib/secrets/agent.js

@@ -142,6 +142,27 @@ export function shouldSelfHealForUpgrade(persistent, storeSize, runningVersion,
 export function shouldTeardownVersionSkewedBroker(realHeldBundles) {
     return realHeldBundles === 0;
 }
+/**
+ * Whether a version-skewed client may evict the reachable broker at all. The
+ * held-bundle gate above is necessary but not sufficient: a broker the always-on
+ * daemon is hosting must NEVER be client-evicted, even when it holds zero
+ * unlocks. teardownStaleBroker() recognizes only the standalone broker's
+ * pidPath() O_EXCL claim (the daemon writes ownerPath(), never pidPath()), so
+ * evicting a daemon-hosted broker unlinks its socket WITHOUT stopping the daemon;
+ * the daemon then keeps hostedBroker != null and shouldTakeOverBroker() refuses
+ * to re-host, orphaning its broker until the daemon restarts while every reader
+ * falls onto cold one-off brokers that re-prompt Touch ID — the storm. Deferring
+ * is safe: daemon code-version upgrades are handled by postinstall.js restarting
+ * it, and agentPing() already gated on PROTOCOL_VERSION, so a code-skewed daemon
+ * broker is still wire-compatible. Only when NO daemon owns the broker (churning
+ * dev installs with a dead/absent daemon — the case #435's client twin was built
+ * for) does the zero-held-bundles teardown apply, exactly as before.
+ */
+export function shouldClientEvictSkewedBroker(daemonRunning, realHeldBundles) {
+    if (daemonRunning)
+        return false;
+    return shouldTeardownVersionSkewedBroker(realHeldBundles);
+}
 function onDarwin() {
     return process.platform === 'darwin';
 }
@@ -175,6 +196,10 @@ function agentDir() {
 function socketPath() {
     return path.join(agentDir(), 'agent.sock');
 }
+/** Public accessor for the broker's socket path — `agents daemon status`/`services` reads it for display. */
+export function secretsBrokerSocketPath() {
+    return socketPath();
+}
 function pidPath() {
     return path.join(agentDir(), 'agent.pid');
 }
@@ -345,7 +370,7 @@ export function handleAgentRequest(store, req, now = Date.now()) {
             // the broker is running pre-upgrade code and should be restarted.
             return { ok: true, cmd: 'ping', version: PROTOCOL_VERSION, cliVersion: getCliVersion() };
         case 'get': {
-            // Walk own-harness → global so a `--for` grant wins over a global one and
+            // Walk own-harness → global so an `--agent` grant wins over a global one and
             // an unscoped unlock serves every harness (bundleScopeChain).
             for (const scope of bundleScopeChain(req.harness)) {
                 const key = scopedBundleKey(req.name, scope);
@@ -1334,7 +1359,12 @@ export async function ensureAgentRunning(timeoutMs = 5000) {
     if (ping.reachable) {
         if (ping.cliVersion === undefined || ping.cliVersion === getCliVersionFresh())
             return true;
-        if (!shouldTeardownVersionSkewedBroker((await agentStatus()).length))
+        // A reachable but version-skewed broker: tear it down ONLY when no daemon
+        // hosts it and it holds no unlocks. Evicting a daemon-hosted broker orphans
+        // the daemon's socket and starts the Touch ID storm — see
+        // shouldClientEvictSkewedBroker.
+        const { isDaemonRunning } = await import('../daemon.js');
+        if (!shouldClientEvictSkewedBroker(isDaemonRunning(), (await agentStatus()).length))
             return true;
         await teardownStaleBroker();
     }

package/dist/lib/secrets/scope.d.ts

@@ -4,7 +4,7 @@
  * (bundles.ts).
  *
  * A grant is stored under a scope and read under a scope; the two must agree or
- * the bundle is invisible. `agents secrets unlock --for <agent>` exists to NARROW
+ * the bundle is invisible. `agents secrets unlock --agent <agent>` exists to NARROW
  * a grant to one harness, so an unlock without it is global by definition.
  *
  * This module deliberately has NO imports: agent.ts and session-store.ts already
@@ -13,14 +13,14 @@
  * and throw at runtime even though tsc is happy.
  */
 /**
- * Scope of an unlock that was not narrowed with `--for`: readable by every
+ * Scope of an unlock that was not narrowed with `--agent`: readable by every
  * harness. Not a valid harness name, so it can never collide with one.
  */
 export declare const GLOBAL_HARNESS = "*";
 /**
  * Scopes a reader consults, most specific first: its own harness, then the global
  * grant. This is the resolution order of the scoped-grant model — a narrow
- * `--for claude` unlock stays claude-only while an unscoped unlock serves
+ * `--agent claude` unlock stays claude-only while an unscoped unlock serves
  * everyone — not a fallback papering over a miss.
  */
 export declare function bundleScopeChain(harness: string | undefined): string[];

package/dist/lib/secrets/scope.js

@@ -4,7 +4,7 @@
  * (bundles.ts).
  *
  * A grant is stored under a scope and read under a scope; the two must agree or
- * the bundle is invisible. `agents secrets unlock --for <agent>` exists to NARROW
+ * the bundle is invisible. `agents secrets unlock --agent <agent>` exists to NARROW
  * a grant to one harness, so an unlock without it is global by definition.
  *
  * This module deliberately has NO imports: agent.ts and session-store.ts already
@@ -13,14 +13,14 @@
  * and throw at runtime even though tsc is happy.
  */
 /**
- * Scope of an unlock that was not narrowed with `--for`: readable by every
+ * Scope of an unlock that was not narrowed with `--agent`: readable by every
  * harness. Not a valid harness name, so it can never collide with one.
  */
 export const GLOBAL_HARNESS = '*';
 /**
  * Scopes a reader consults, most specific first: its own harness, then the global
  * grant. This is the resolution order of the scoped-grant model — a narrow
- * `--for claude` unlock stays claude-only while an unscoped unlock serves
+ * `--agent claude` unlock stays claude-only while an unscoped unlock serves
  * everyone — not a fallback papering over a miss.
  */
 export function bundleScopeChain(harness) {

package/dist/lib/session/db.d.ts

@@ -28,6 +28,7 @@ export declare const RESOURCE_INDEX_VERSION = 1;
  */
 /** Bump when facet extraction changes so cached rows recompute (stalls-by-model v6). */
 export declare const INSIGHTS_EXTRACTOR_VERSION = 6;
+export declare const PREVIEW_EXTRACTOR_VERSION = 1;
 /** Raw row shape returned from the sessions table. */
 export interface SessionRow {
     id: string;
@@ -390,6 +391,20 @@ export declare function writeSessionInsights<T>(entries: Array<{
 }>): void;
 /** Drop every cached facet row. Backs `agents insights --refresh`. */
 export declare function clearSessionInsights(): void;
+/** Read one derived preview only when it matches the transcript bytes on disk. */
+export declare function readSessionPreviewCache<T>(id: string, sourceStamp: {
+    fileMtimeMs: number | null;
+    fileSize: number | null;
+}): T | undefined;
+/** Persist normalized preview data against the exact transcript bytes parsed. */
+export declare function writeSessionPreviewCache<T>(entry: {
+    id: string;
+    fileMtimeMs: number | null;
+    fileSize: number | null;
+    preview: T;
+}): void;
+/** Plugin provenance already indexed for resources used by one session. */
+export declare function getSessionPlugins(id: string): string[];
 export type UsageRollupGroup = 'agent' | 'project' | 'day' | 'account';
 /**
  * Smart-launch affinity priors: group sessions by origin machine, harness, or

package/dist/lib/session/db.js

@@ -9,7 +9,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import Database from '../sqlite.js';
-import { parseSession } from './parse.js';
+import { parseSession, sessionFilePathContainer } from './parse.js';
 import { extractRecentDirectoriesTouched, extractTodoProgressFromEvents } from './state.js';
 import { getSessionsDir, getSessionsDbPath } from '../state.js';
 import { query as queryEvents, queryToolUsageForSessions } from '../events.js';
@@ -305,6 +305,18 @@ CREATE TABLE IF NOT EXISTS session_insights (
   computed_at INTEGER NOT NULL,
   facets TEXT NOT NULL
 );
+
+-- Normalized data behind sessions preview. Like session_insights this is a
+-- lazy, stamp-validated cache: opening one session parses only that transcript,
+-- while subsequent processes reuse the derived preview until its bytes change.
+CREATE TABLE IF NOT EXISTS session_preview_cache (
+  session_id TEXT PRIMARY KEY,
+  file_mtime_ms INTEGER,
+  file_size INTEGER,
+  extractor_version INTEGER NOT NULL,
+  computed_at INTEGER NOT NULL,
+  preview_json TEXT NOT NULL
+);
 `;
 /**
  * Bumping this invalidates every cached facet row without touching the schema
@@ -314,6 +326,7 @@ CREATE TABLE IF NOT EXISTS session_insights (
  */
 /** Bump when facet extraction changes so cached rows recompute (stalls-by-model v6). */
 export const INSIGHTS_EXTRACTOR_VERSION = 6;
+export const PREVIEW_EXTRACTOR_VERSION = 1;
 let dbInstance = null;
 /**
  * Apply schema migrations from `fromVersion` → SCHEMA_VERSION. The new
@@ -2291,18 +2304,36 @@ function clearSessionExistenceCache() {
     directoryMembershipSweepCount = 0;
 }
 function findMissingFilePaths(filePaths) {
+    // Existence is decided on the CONTAINER file, never the raw stored path. A
+    // composite `file_path` (`<container>#<id>`, e.g. OpenCode's `opencode.db#ses_…`)
+    // names a row INSIDE a shared file — its basename is never a directory entry,
+    // so a dirname/basename membership check on the composite string classified
+    // every such row as deleted and pruned it (RUSH-2357). Group the original
+    // paths under the container we actually stat, and map the verdict back so the
+    // returned set still holds the original `file_path` strings the caller keys on.
     const byDir = new Map();
     for (const p of filePaths) {
-        const dir = path.dirname(p);
-        let basenames = byDir.get(dir);
-        if (!basenames) {
-            basenames = new Set();
-            byDir.set(dir, basenames);
+        const container = sessionFilePathContainer(p);
+        const dir = path.dirname(container);
+        const base = path.basename(container);
+        let bases = byDir.get(dir);
+        if (!bases) {
+            bases = new Map();
+            byDir.set(dir, bases);
         }
-        basenames.add(path.basename(p));
+        let originals = bases.get(base);
+        if (!originals) {
+            originals = [];
+            bases.set(base, originals);
+        }
+        originals.push(p);
     }
     const missing = new Set();
-    for (const [dir, basenames] of byDir) {
+    const markMissing = (originals) => {
+        for (const original of originals)
+            missing.add(original);
+    };
+    for (const [dir, bases] of byDir) {
         let entries;
         try {
             const stat = fs.statSync(dir);
@@ -2324,17 +2355,16 @@ function findMissingFilePaths(filePaths) {
             // Directory itself is gone (or unreadable) — every file in it is missing.
             // Also covers the race where readdir loses to a concurrent delete: fall
             // back to a direct stat rather than assuming existence.
-            for (const base of basenames) {
+            for (const [base, originals] of bases) {
                 const filePath = path.join(dir, base);
                 if (!fs.existsSync(filePath))
-                    missing.add(filePath);
+                    markMissing(originals);
             }
             continue;
         }
-        for (const base of basenames) {
-            const filePath = path.join(dir, base);
+        for (const [base, originals] of bases) {
             if (!entries.has(base))
-                missing.add(filePath);
+                markMissing(originals);
         }
     }
     return missing;
@@ -2471,6 +2501,49 @@ export function writeSessionInsights(entries) {
 export function clearSessionInsights() {
     getDB().exec(`DELETE FROM session_insights`);
 }
+/** Read one derived preview only when it matches the transcript bytes on disk. */
+export function readSessionPreviewCache(id, sourceStamp) {
+    const row = getDB().prepare(`
+    SELECT pc.preview_json AS previewJson
+    FROM session_preview_cache pc
+    WHERE pc.session_id = ?
+      AND pc.extractor_version = ?
+      AND pc.file_mtime_ms IS ?
+      AND pc.file_size IS ?
+  `).get(id, PREVIEW_EXTRACTOR_VERSION, sourceStamp.fileMtimeMs, sourceStamp.fileSize);
+    if (!row)
+        return undefined;
+    try {
+        return JSON.parse(row.previewJson);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Persist normalized preview data against the exact transcript bytes parsed. */
+export function writeSessionPreviewCache(entry) {
+    getDB().prepare(`
+    INSERT INTO session_preview_cache
+      (session_id, file_mtime_ms, file_size, extractor_version, computed_at, preview_json)
+    VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(session_id) DO UPDATE SET
+      file_mtime_ms = excluded.file_mtime_ms,
+      file_size = excluded.file_size,
+      extractor_version = excluded.extractor_version,
+      computed_at = excluded.computed_at,
+      preview_json = excluded.preview_json
+  `).run(entry.id, entry.fileMtimeMs, entry.fileSize, PREVIEW_EXTRACTOR_VERSION, Date.now(), JSON.stringify(entry.preview));
+}
+/** Plugin provenance already indexed for resources used by one session. */
+export function getSessionPlugins(id) {
+    const rows = getDB().prepare(`
+    SELECT DISTINCT plugin
+    FROM session_resource_usage
+    WHERE session_id = ? AND plugin IS NOT NULL AND plugin <> ''
+    ORDER BY plugin COLLATE NOCASE
+  `).all(id);
+    return rows.map(row => row.plugin);
+}
 export function queryAffinityRollup(options) {
     const db = getDB();
     const where = [];
@@ -2708,7 +2781,9 @@ export function backfillResourceUsage(filter = {}, onProgress) {
         result.scanned++;
         let stamp;
         try {
-            const st = fs.statSync(meta.filePath);
+            // Composite rows (`<container>#<id>`) stat their container file — the
+            // per-session bytes/mtime stamp is derived during discovery, not here.
+            const st = fs.statSync(sessionFilePathContainer(meta.filePath));
             stamp = { fileMtimeMs: st.mtimeMs, fileSize: st.size };
         }
         catch {
@@ -2787,7 +2862,7 @@ export function topSessionsByCost(n, options = {}) {
     // Over-fetch a small buffer to survive the on-disk liveness filter below.
     const sql = `SELECT * FROM sessions ${whereCost} ORDER BY cost_usd DESC, timestamp DESC LIMIT ${limit + 16}`;
     const rows = db.prepare(sql).all(...params);
-    const live = rows.filter(r => !r.file_path || fs.existsSync(r.file_path));
+    const live = rows.filter(r => !r.file_path || fs.existsSync(sessionFilePathContainer(r.file_path)));
     return live.slice(0, limit).map(r => ({
         meta: rowToMeta(r),
         costUsd: r.cost_usd ?? 0,

package/dist/lib/session/discover.js

@@ -18,7 +18,7 @@ import { getAgentsDir, getUserAgentsDir, getHistoryDir, getRunsDir } from '../st
 import { shortCodexHome } from '../codex-home.js';
 import { parseTimeFilter } from './relative-time.js';
 const execFileAsync = promisify(execFile);
-import { AGENTS, agentConfigDirName, getCliVersion } from '../agents.js';
+import { AGENTS, agentConfigDirName, getCliVersion, resolveOpenCodeAccountId } from '../agents.js';
 import { walkForFilesWithStat } from '../fs-walk.js';
 import { hasCommand } from '../cli-resources.js';
 import { execFileShellSpec } from '../platform/exec.js';
@@ -28,7 +28,7 @@ import { deriveShortId } from './short-id.js';
 import { buildClaudeAccountIndex, resolveClaudeAccount } from './claude-accounts.js';
 import { extractSessionTopic, extractSlashCommandName, extractSlashCommandFromToolInput } from './prompt.js';
 import { isSkillInvocation, extractSkills, extractSlashCommands } from './highlights.js';
-import { parseAntigravity, parseCursor } from './parse.js';
+import { parseAntigravity, parseCursor, splitSessionFilePath } from './parse.js';
 import { extractPrUrl, detectWorktree, detectTicket, isPrCreateCommand, detectSpawnedTeam, isTicketCreateTool, extractCreatedTicket, extractRecentDirectoriesTouched, extractTodoProgressFromEvents } from './state.js';
 import { costOfUsage, costOfUsageNoCache } from '../pricing/index.js';
 import { machineForSessionFile } from './origin-machine.js';
@@ -335,6 +335,15 @@ export function isManagedSessionFile(filePath) {
     // someone's dotfile dir, so scoping must not silently swallow them.
     if (!filePath || !path.isAbsolute(filePath))
         return true;
+    // A composite file_path (`<container>#<id>`) names a row inside a single shared
+    // DB the scanner reads from one fixed location (OpenCode's `opencode.db`) — that
+    // store is never a per-install dotfile under a version home, so the managed-vs-
+    // unmanaged split does not apply: there is exactly one store, not a "your own"
+    // copy to hide. Classifying it as unmanaged hid every OpenCode row from default
+    // listings once any agent was managed (RUSH-2357). Keyed off the composite FORM,
+    // so any future single-DB harness inherits this.
+    if (splitSessionFilePath(filePath).fragment !== undefined)
+        return true;
     const roots = [
         ...VERSIONS_ROOTS.map((root) => path.join(root, 'versions')),
         path.join(getHistoryDir(), 'backups'),
@@ -1838,39 +1847,24 @@ function readAntigravityMeta(filePath, currentVersion) {
 const OPENCODE_DB = path.join(HOME, '.local', 'share', 'opencode', 'opencode.db');
 let cachedOpenCodeAccount;
 /**
- * Query the active OpenCode account email from its SQLite database.
+ * The active OpenCode account: the provider ids with a valid credential in
+ * `auth.json`, joined (e.g. `"anthropic+muse-spark"`) — see
+ * `resolveOpenCodeAccountId` in `../agents.js`, the single source of truth
+ * `agents view`/`agents doctor` also read.
  *
- * Takes the scan's already-open handle so a scan opens `opencode.db` exactly
- * once (RUSH-2210); opens its own only when called without one.
+ * OpenCode's `opencode.db` also carries `account`/`account_state`/
+ * `control_account` tables that look like the obvious source, but on a real,
+ * actively-used install (yosemite-s1, 1.16.0, 35 applied migrations) all
+ * three are permanently empty — no migration populates them and no session
+ * has ever written a row. Querying them (the pre-fix behavior here) always
+ * returned undefined, credential or not; `auth.json` is what OpenCode
+ * actually reads at runtime.
  */
-function getOpenCodeAccount(handle) {
+function getOpenCodeAccount() {
     if (cachedOpenCodeAccount !== undefined)
         return cachedOpenCodeAccount || undefined;
-    // Read through the node/bun SQLite wrapper (not the `sqlite3` CLI) so this
-    // works on every OS — the CLI is absent on Windows.
-    let owned;
-    try {
-        const db = handle ?? (fs.existsSync(OPENCODE_DB) ? (owned = new Database(OPENCODE_DB)) : undefined);
-        if (db) {
-            const row = db
-                .prepare('SELECT email FROM control_account WHERE active=1 LIMIT 1;')
-                .get();
-            const out = typeof row?.email === 'string' ? row.email.trim() : '';
-            if (out) {
-                cachedOpenCodeAccount = out;
-                return out;
-            }
-        }
-    }
-    catch { /* DB not accessible, sqlite module unavailable, or query failed */ }
-    finally {
-        try {
-            owned?.close();
-        }
-        catch { /* best-effort close */ }
-    }
-    cachedOpenCodeAccount = '';
-    return undefined;
+    cachedOpenCodeAccount = resolveOpenCodeAccountId(HOME) ?? '';
+    return cachedOpenCodeAccount || undefined;
 }
 /**
  * The per-session ledger stamp for an OpenCode row: the newest write time across
@@ -1945,12 +1939,28 @@ async function scanOpenCodeIncremental() {
     // works on every OS — the CLI is absent on Windows.
     let db;
     try {
+        db = new Database(OPENCODE_DB);
+        // OpenCode's `session` schema varies by version: `cost` and `model` are newer
+        // columns. Probe once and select NULL where absent, so an older opencode.db
+        // still scans instead of throwing "no such column" and dropping every session.
+        const sessionCols = new Set(db.prepare('PRAGMA table_info(session);').all()
+            .map(c => (typeof c.name === 'string' ? c.name : '')));
+        const costExpr = sessionCols.has('cost') ? 's.cost' : 'NULL';
+        const modelExpr = sessionCols.has('model') ? 's.model' : 'NULL';
+        // Every `json_extract` / `json_type` below is guarded by `json_valid`.
+        // SQLite raises "malformed JSON" on a non-JSON value, and that aborts the
+        // WHOLE query — so a single unparseable `part`/`message` row anywhere in the
+        // shared DB would drop EVERY OpenCode session from the index, silently in a
+        // non-TTY run (the handler below only prints when stderr is a TTY). A
+        // poisoned row must cost that row, not the harness.
         const query = `
       SELECT
         s.id AS id,
         s.title AS title,
         s.directory AS directory,
         s.version AS version,
+        ${costExpr} AS cost,
+        ${modelExpr} AS model,
         s.time_created AS time_created,
         s.time_updated AS time_updated,
         COALESCE(stats.message_count, 0) AS message_count,
@@ -1958,15 +1968,20 @@ async function scanOpenCodeIncremental() {
         COALESCE(stats.message_bytes, 0) AS message_bytes,
         COALESCE(parts.last_part_at, 0) AS last_part_at,
         COALESCE(parts.part_bytes, 0) AS part_bytes,
+        COALESCE(parts.tool_call_count, 0) AS tool_call_count,
         stats.token_count AS token_count,
         stats.output_tokens AS output_tokens,
+        stats.input_tokens AS input_tokens,
+        stats.cache_read_tokens AS cache_read_tokens,
+        stats.cache_write_tokens AS cache_write_tokens,
         COALESCE(stats.has_token_data, 0) AS has_token_data
       FROM session s
       LEFT JOIN (
         SELECT
           session_id,
           MAX(time_created) AS last_part_at,
-          SUM(LENGTH(CAST(data AS BLOB))) AS part_bytes
+          SUM(LENGTH(CAST(data AS BLOB))) AS part_bytes,
+          SUM(CASE WHEN json_valid(data) AND json_extract(data, '$.type') = 'tool' THEN 1 ELSE 0 END) AS tool_call_count
         FROM part
         GROUP BY session_id
       ) parts ON parts.session_id = s.id
@@ -1976,15 +1991,18 @@ async function scanOpenCodeIncremental() {
           COUNT(*) AS message_count,
           MAX(time_created) AS last_message_at,
           SUM(LENGTH(CAST(data AS BLOB))) AS message_bytes,
-          SUM(
+          SUM(CASE WHEN json_valid(data) THEN
             COALESCE(json_extract(data, '$.tokens.input'), 0) +
             COALESCE(json_extract(data, '$.tokens.output'), 0) +
             COALESCE(json_extract(data, '$.tokens.reasoning'), 0) +
             COALESCE(json_extract(data, '$.tokens.cache.read'), 0) +
             COALESCE(json_extract(data, '$.tokens.cache.write'), 0)
-          ) AS token_count,
-          SUM(COALESCE(json_extract(data, '$.tokens.output'), 0)) AS output_tokens,
-          MAX(CASE WHEN json_type(data, '$.tokens') IS NOT NULL THEN 1 ELSE 0 END) AS has_token_data
+          ELSE 0 END) AS token_count,
+          SUM(CASE WHEN json_valid(data) THEN COALESCE(json_extract(data, '$.tokens.output'), 0) ELSE 0 END) AS output_tokens,
+          SUM(CASE WHEN json_valid(data) THEN COALESCE(json_extract(data, '$.tokens.input'), 0) ELSE 0 END) AS input_tokens,
+          SUM(CASE WHEN json_valid(data) THEN COALESCE(json_extract(data, '$.tokens.cache.read'), 0) ELSE 0 END) AS cache_read_tokens,
+          SUM(CASE WHEN json_valid(data) THEN COALESCE(json_extract(data, '$.tokens.cache.write'), 0) ELSE 0 END) AS cache_write_tokens,
+          MAX(CASE WHEN json_valid(data) AND json_type(data, '$.tokens') IS NOT NULL THEN 1 ELSE 0 END) AS has_token_data
         FROM message
         GROUP BY session_id
       ) stats ON stats.session_id = s.id
@@ -1992,8 +2010,7 @@ async function scanOpenCodeIncremental() {
       ORDER BY time_created DESC
       LIMIT 1000;
     `.replace(/\n/g, ' ');
-        db = new Database(OPENCODE_DB);
-        const account = getOpenCodeAccount(db);
+        const account = getOpenCodeAccount();
         const rows = db.prepare(query).all();
         // Two passes. First derive each row's identity + per-session stamp, then
         // bulk-load the prior stamps in ONE query and keep only the rows that
@@ -2034,13 +2051,40 @@ async function scanOpenCodeIncremental() {
             const messageCount = asInt(row.message_count);
             const tokenCount = asInt(row.token_count);
             const outputTokens = asInt(row.output_tokens);
+            const inputTokens = asInt(row.input_tokens);
+            const cacheReadTokens = asInt(row.cache_read_tokens);
+            const cacheWriteTokens = asInt(row.cache_write_tokens);
             const hasTokenData = asInt(row.has_token_data) === 1;
+            const toolCallCount = asInt(row.tool_call_count);
             const timestamp = isNaN(timeCreated) ? new Date().toISOString() : new Date(timeCreated).toISOString();
             // OpenCode is one shared DB, not one file per session — its row carries a
             // per-session updated time. Set lastActivity explicitly (falling back to
             // creation, never the whole-DB mtime the ScanStamp would otherwise supply).
             const lastActivity = Number.isNaN(timeUpdated) ? timestamp : new Date(timeUpdated).toISOString();
             const topic = title || undefined;
+            // Duration is the session-row span; a missing/degenerate pair yields no value
+            // rather than a negative or NaN.
+            const durationMs = Number.isFinite(timeCreated) && Number.isFinite(timeUpdated) && timeUpdated > timeCreated
+                ? timeUpdated - timeCreated
+                : undefined;
+            // OpenCode stores the model as JSON (`{"id":"…","providerID":"…"}`); the
+            // index tracks the model id.
+            let model;
+            if (typeof row.model === 'string' && row.model.trim()) {
+                try {
+                    const parsed = JSON.parse(row.model);
+                    if (typeof parsed?.id === 'string' && parsed.id.trim())
+                        model = parsed.id;
+                }
+                catch { /* non-JSON model string — leave unset */ }
+            }
+            // `cost` is a REAL rollup OpenCode maintains on the session row (0 for a
+            // zero-priced provider, which is a real value, not "unknown").
+            const costUsd = typeof row.cost === 'number' ? row.cost : undefined;
+            // Worktree slug is a pure function of cwd (`.agents/worktrees/<slug>/`),
+            // so it derives for OpenCode exactly as it does for every other harness.
+            const cwd = directory ? normalizeCwd(directory) : undefined;
+            const worktreeSlug = detectWorktree(cwd)?.slug;
             const meta = {
                 id,
                 shortId: deriveShortId(id, /^ses_/),
@@ -2048,14 +2092,22 @@ async function scanOpenCodeIncremental() {
                 timestamp,
                 lastActivity,
                 project: directory ? path.basename(directory) : undefined,
-                cwd: directory ? normalizeCwd(directory) : undefined,
+                cwd,
                 filePath,
                 version: resolveSessionVersion('opencode', OPENCODE_DB, version || undefined, currentVersion),
                 account,
                 topic,
+                model,
+                costUsd,
+                durationMs,
+                worktreeSlug,
+                toolCallCount: Number.isNaN(toolCallCount) ? undefined : toolCallCount,
                 messageCount: Number.isNaN(messageCount) ? undefined : messageCount,
                 tokenCount: hasTokenData && !Number.isNaN(tokenCount) ? tokenCount : undefined,
                 outputTokens: hasTokenData && !Number.isNaN(outputTokens) ? outputTokens : undefined,
+                inputTokens: hasTokenData && !Number.isNaN(inputTokens) ? inputTokens : undefined,
+                cacheReadTokens: hasTokenData && !Number.isNaN(cacheReadTokens) ? cacheReadTokens : undefined,
+                cacheWriteTokens: hasTokenData && !Number.isNaN(cacheWriteTokens) ? cacheWriteTokens : undefined,
             };
             entries.push({ meta, content: topic || '', scan });
         }

package/dist/lib/session/favorites.d.ts

@@ -1,6 +1,6 @@
 /**
- * Favorited (starred) sessions — the durable "keep this one handy" mark a human
- * puts on a session, deliberately kept OUT of the session index.
+ * Favorited sessions — the durable "keep this one handy" mark a human puts on a
+ * session, deliberately kept OUT of the session index.
  *
  * `sessions.db` is a rebuildable CACHE: a reindex or a schema bump throws its
  * rows away and re-derives them from the transcripts on disk. A favorite is not

package/dist/lib/session/favorites.js

@@ -1,6 +1,6 @@
 /**
- * Favorited (starred) sessions — the durable "keep this one handy" mark a human
- * puts on a session, deliberately kept OUT of the session index.
+ * Favorited sessions — the durable "keep this one handy" mark a human puts on a
+ * session, deliberately kept OUT of the session index.
  *
  * `sessions.db` is a rebuildable CACHE: a reindex or a schema bump throws its
  * rows away and re-derives them from the transcripts on disk. A favorite is not

package/dist/lib/session/parse.d.ts

@@ -103,6 +103,33 @@ export declare function parseGemini(filePath: string): SessionEvent[];
  * request step and a completion step that share the id).
  */
 export declare function parseAntigravity(dbPath: string): SessionEvent[];
+/**
+ * Separator between a container file and the id it holds inside a *composite*
+ * session `file_path`. Some harnesses keep every session in ONE file (OpenCode's
+ * single `opencode.db`), so the index stores `<container>#<session-id>` rather
+ * than one path per session — e.g.
+ * `/home/u/.local/share/opencode/opencode.db#ses_02410a2c…`.
+ */
+export declare const SESSION_FILE_PATH_SEP = "#";
+/**
+ * Split a stored session `file_path` into its on-disk container and the optional
+ * in-container fragment. For a plain per-session file the container is the path
+ * itself and `fragment` is undefined; for a composite path it is the part before
+ * the first `#` and the id after it.
+ */
+export declare function splitSessionFilePath(filePath: string): {
+    container: string;
+    fragment: string | undefined;
+};
+/**
+ * The filesystem path whose existence/stat decides whether a session row is
+ * stale. For a composite `file_path` this is the CONTAINER file — the row is a
+ * record inside it, never a filesystem entry of its own — so a composite session
+ * is stale only when its container is gone. For a plain path it is the path
+ * itself. Keying off the composite FORM (a `#` fragment), not any harness name,
+ * means any future single-file-DB harness inherits the correct behavior.
+ */
+export declare function sessionFilePathContainer(filePath: string): string;
 /**
  * Parse an OpenCode session from its SQLite database.
  * filePath format: "/path/to/opencode.db#session_id"
@@ -130,6 +157,42 @@ export declare function parseAntigravity(dbPath: string): SessionEvent[];
  * (from summary.json), falling back to the transcript's mtime.
  */
 export declare function parseGrok(filePath: string): SessionEvent[];
+/**
+ * The transcript query {@link parseOpenCode} runs, exported so a test can assert
+ * the projection's real cost against a database instead of re-typing the SQL.
+ *
+ * A tool part is PROJECTED to exactly the fields the `case 'tool'` branch below
+ * reads — `tool`, `callID`, `state.status`, `state.input`, `state.output` —
+ * rather than carried whole. Two things this has to get right at once:
+ *
+ *   - Keep `state.input`. It carries `filePath` / `command`, and losing it is
+ *     what left `recentDirectoriesTouched` empty (RUSH-2358).
+ *   - Stay bounded. A tool part is not bounded by its output: on a real
+ *     `opencode.db` the largest part is 1,346,068 bytes of which
+ *     `state.attachments` (a base64 data URL from `read`) is 1,345,674, while
+ *     `state.output` is 23. Truncating only `state.output` therefore bounded
+ *     nothing — it took one session's loaded tool payload from 299,365 to
+ *     1,911,209 bytes. The projection drops `attachments` (and every other
+ *     unread key) outright, caps `state.output`, and collapses an oversized
+ *     `state.input` to just its addressing fields. Those are the keys the
+ *     enrichment reads — `filePath`/`path` for an edit and `cwd`/`workdir`/
+ *     `working_directory` for a shell (`extractRecentDirectoriesTouched` in
+ *     state.ts), plus `command`/`description`, themselves capped since a command
+ *     can be arbitrarily long. Above the cap every other input key (an `edit`'s
+ *     `oldString`/`newString`) is gone, deliberately — nothing downstream reads
+ *     them, and they are the weight.
+ *
+ * `json_valid` guards every `json_extract`: SQLite raises "malformed JSON" on a
+ * non-JSON value, which aborts the WHOLE query, so one bad `part` row would
+ * otherwise cost the entire transcript. Note the single-argument form is
+ * RFC-8259-strict — it rejects a JSONB blob that `json_extract` would accept.
+ * That is correct for today's schema (`part.data` / `message.data` are TEXT on
+ * a real database); if OpenCode ever migrates them to JSONB, these guards must
+ * move to `json_valid(data, 6)` or they will drop every row.
+ *
+ * The session id is bound as a parameter; the two caps are numeric literals.
+ */
+export declare const OPENCODE_TRANSCRIPT_QUERY: string;
 export declare function parseOpenCode(filePath: string): SessionEvent[];
 /** Parse a Rush JSONL session file into normalized events. */
 export declare function parseRush(filePath: string): SessionEvent[];