@phnx-labs/agents-cli 1.22.29 → 1.22.31

package/dist/commands/view.d.ts

@@ -15,6 +15,17 @@ import { type ProfileSummary } from '../lib/profiles.js';
 import { type ByokUsageResult } from '../lib/byok-usage.js';
 /** Shared account identity formatter, re-exported for the view-specific tests. */
 export declare const accountColumnLabel: typeof accountDisplayLabel;
+export interface AccountOrderedVersion {
+    version: string;
+    email: string | null;
+}
+/**
+ * Human `agents view` row order: selected default first, then email-bearing
+ * accounts alphabetically, then installs whose account has no email. Version
+ * descending is the deterministic tie-breaker and preserves the old order for
+ * every non-email harness.
+ */
+export declare function compareAccountOrderedVersions(a: AccountOrderedVersion, b: AccountOrderedVersion, globalDefault: string | null): number;
 /**
  * Join fixed view columns with a consistent two-space gutter. Empty trailing
  * columns are dropped so a row without an auth chip does not grow a dangling

package/dist/commands/view.js

@@ -33,6 +33,30 @@ import { formatPath, isInteractiveTerminal, isPromptCancelled } from './utils.js
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
 /** Shared account identity formatter, re-exported for the view-specific tests. */
 export const accountColumnLabel = accountDisplayLabel;
+/**
+ * Human `agents view` row order: selected default first, then email-bearing
+ * accounts alphabetically, then installs whose account has no email. Version
+ * descending is the deterministic tie-breaker and preserves the old order for
+ * every non-email harness.
+ */
+export function compareAccountOrderedVersions(a, b, globalDefault) {
+    const aIsDefault = a.version === globalDefault;
+    const bIsDefault = b.version === globalDefault;
+    if (aIsDefault !== bIsDefault)
+        return aIsDefault ? -1 : 1;
+    const aEmail = a.email?.toLowerCase() ?? null;
+    const bEmail = b.email?.toLowerCase() ?? null;
+    if (aEmail !== null && bEmail === null)
+        return -1;
+    if (aEmail === null && bEmail !== null)
+        return 1;
+    if (aEmail !== null && bEmail !== null) {
+        const emailOrder = aEmail.localeCompare(bEmail);
+        if (emailOrder !== 0)
+            return emailOrder;
+    }
+    return compareVersions(b.version, a.version);
+}
 /**
  * Overview (`agents view` with no agent filter) caps compact usage windows so
  * multi-meter agents (Antigravity's four model quotas, Droid's three buckets)
@@ -56,15 +80,12 @@ export function joinViewColumns(cols) {
     return cols.slice(0, end).join('  ');
 }
 /**
- * Custom harnesses (the `~/.agents/profiles/*.yml` bundles), sorted by name and
- * optionally narrowed to the ones that run on one host agent. YAMLs that fail
- * validation are silently skipped by `listProfiles`, so this never throws on a
- * malformed file.
+ * Custom harnesses (the `~/.agents/profiles/*.yml` bundles), sorted by name.
+ * YAMLs that fail validation are silently skipped by `listProfiles`, so this
+ * never throws on a malformed file.
  */
-function getHarnesses(filterAgentId) {
-    return listProfiles()
-        .filter((profile) => !filterAgentId || profile.host.agent === filterAgentId)
-        .map(profileSummary);
+function getHarnesses() {
+    return listProfiles().map(profileSummary);
 }
 /** Version-first label: "<version> (forked from <host>[, tracks default])" */
 function harnessVersionLabel(harness, globalDefault) {
@@ -307,7 +328,9 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
         .filter((agentId) => !hasNonIsolatedVersion(agentId))
         .map(async (agentId) => [agentId, await getUnmanagedCliState(agentId)])));
     const showPaths = !!filterAgentId;
-    const harnesses = getHarnesses(filterAgentId);
+    // A filtered native view is about that native harness's installed versions.
+    // Custom forks are standalone agent types and only belong in the overview.
+    const harnesses = filterAgentId ? [] : getHarnesses();
     // Auto-heal stale versioned aliases. Pre-v2 aliases (e.g. pre-CLAUDE_CONFIG_DIR
     // claude shims) silently route login through the default version's symlinked
     // home, so `agents view` would never reflect the right account. Regenerate on
@@ -524,14 +547,16 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 ? chalk.yellow(' (no default)')
                 : '';
             console.log(`  ${chalk.bold(agentLabel(agentId))}${strategyLabel}${noDefaultLabel}`);
-            // Sort versions with default first, then by semver descending
-            const sortedVersions = [...versions].sort((a, b) => {
-                if (a === globalDefault)
-                    return -1;
-                if (b === globalDefault)
-                    return 1;
-                return compareVersions(b, a);
-            });
+            // Account information is already loaded above. Keep the selected default
+            // first, then make multi-account installs scannable by email. Harnesses
+            // without email identities retain their prior version-descending order.
+            const sortedVersions = versions
+                .map((version) => ({
+                version,
+                email: infoMap.get(`${agentId}:${version}`)?.email ?? null,
+            }))
+                .sort((a, b) => compareAccountOrderedVersions(a, b, globalDefault))
+                .map(({ version }) => version);
             for (const version of sortedVersions) {
                 const isDefault = version === globalDefault;
                 const isolated = !isDefault && isVersionIsolated(agentId, version);
@@ -1273,7 +1298,9 @@ export async function collectAgentsJson(filterAgentId, resourceSections) {
         else
             byAgent.set(agentId, [entry]);
     }
-    const harnesses = getHarnesses(filterAgentId);
+    // Keep filtered native JSON consistent with the text view: custom forks are
+    // not children of the native harness they execute through.
+    const harnesses = filterAgentId ? [] : getHarnesses();
     const out = [];
     for (const agentId of agentsToShow) {
         const versions = byAgent.get(agentId) ?? [];
@@ -1544,19 +1571,19 @@ export async function viewAction(agentArg, options) {
     // Parse agent@version syntax
     const parts = agentArg.split('@');
     const agentName = parts[0];
-    const agentId = resolveAgentName(agentName);
-    if (!agentId) {
-        // A custom harness is an agent type here, not an unknown name: `agents run
-        // <name>` launches it, so `agents view <name>` describes it.
-        if (profileExists(agentName)) {
-            const harness = profileSummary(readProfile(agentName));
-            if (json) {
-                console.log(JSON.stringify(harness, null, 2));
-                return;
-            }
-            renderHarnessDetail(agentName);
+    // Match run resolution: an exact custom harness name wins over a native id or
+    // alias with the same spelling, so every fork remains independently viewable.
+    if (profileExists(agentName)) {
+        const harness = profileSummary(readProfile(agentName));
+        if (json) {
+            console.log(JSON.stringify(harness, null, 2));
             return;
         }
+        renderHarnessDetail(agentName);
+        return;
+    }
+    const agentId = resolveAgentName(agentName);
+    if (!agentId) {
         if (json) {
             console.log(JSON.stringify({ error: formatAgentError(agentName) }));
             process.exit(1);

package/dist/index.js

@@ -94,7 +94,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadExport, loadPackages, loadRoutines, loadMonitors, loadProjects, loadRun, loadFork, loadDefaults, loadSet, loadModels, loadModes, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadStatus, loadSnapshot, loadProfiles, loadHarness, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadFactory, loadUsage, loadCost, loadInsights, loadPerf, loadTrends, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadHumans, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadBench, loadShare, loadSend, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadExport, loadPackages, loadRoutines, loadDaemon, loadMonitors, loadProjects, loadRun, loadFork, loadDefaults, loadSet, loadModels, loadModes, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadStatus, loadSnapshot, loadProfiles, loadHarness, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadFactory, loadUsage, loadCost, loadInsights, loadPerf, loadTrends, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadHumans, loadAccounts, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadBench, loadShare, loadSend, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { getCliLaunch } from './lib/cli-entry.js';
@@ -120,6 +120,22 @@ if (process.argv[2] === '__daemon-run') {
     await runDaemon();
     process.exit(process.exitCode ?? 0);
 }
+// One-shot invocation of a migrated daemon housekeeping tick (RUSH-2353). The
+// shipped system routines (`watchdog`, `device-probe`, `fleet-cache-warm`, ...)
+// run this as their `command:` instead of the daemon holding a setInterval —
+// same tick body, now scheduled/tracked/pinnable through the routines system.
+if (process.argv[2] === '__daemon-tick') {
+    const name = process.argv[3] || '';
+    const { runDaemonTick } = await import('./lib/daemon-ticks.js');
+    try {
+        await runDaemonTick(name);
+        process.exit(0);
+    }
+    catch (err) {
+        process.stderr.write(`[agents] daemon tick '${name}' failed: ${err.message}\n`);
+        process.exit(1);
+    }
+}
 // White-label: the shim for a brand (e.g. `jack`) exports AGENTS_BRAND, so the
 // CLI presents its own name/help/errors as the brand. Unbranded (AGENTS_BRAND
 // unset) resolves to 'agents' and everything below is byte-identical to before.
@@ -303,6 +319,7 @@ Run and dispatch:
   defaults                        Configure run defaults by agent/version selector
   teams                           Coordinate multiple agents on shared work
   routines                        Run agents on a cron schedule (scheduler auto-starts)
+  daemon                          Runtime status/control for the always-on daemon (secrets broker, browser IPC, scheduler)
   webhook                         Receive signed GitHub/Linear webhooks for trigger routines
   funnel                          Expose a webhook receiver through Tailscale Funnel
   sessions                        Browse, search, and replay past runs (live-search in TTY; grouped by workspace)
@@ -929,6 +946,7 @@ async function registerAllEagerCommands() {
     await reg(loadExport);
     await reg(loadPackages);
     await reg(loadRoutines);
+    await reg(loadDaemon);
     await reg(loadMonitors);
     await reg(loadProjects);
     await reg(loadRun);
@@ -980,6 +998,7 @@ async function registerAllEagerCommands() {
     await reg(loadWebhook);
     await reg(loadFunnel);
     await reg(loadHumans);
+    await reg(loadAccounts);
     registerHqTombstoneCommand(program);
     await reg(loadFeed);
     await reg(loadMailboxes);
@@ -1060,6 +1079,22 @@ program.on('command:*', (operands) => {
 // and the doc flags (--version/--help/-h) drive both the registration strategy
 // and whether the update check + background sync run at all.
 const passedArgs = process.argv.slice(2);
+// Commander owns `--version` on the root command and otherwise intercepts it
+// even after `sessions`, before the subcommand can parse its version filter.
+// Rewrite only that value-taking nested form; bare `agents --version` and every
+// other command retain the root documentation flag unchanged.
+if (passedArgs[0] === 'sessions') {
+    const nestedVersionIndex = passedArgs.indexOf('--version', 1);
+    if (nestedVersionIndex >= 0) {
+        const nestedVersion = passedArgs[nestedVersionIndex + 1];
+        if (!nestedVersion || nestedVersion.startsWith('-')) {
+            console.error("error: option '--version <version>' argument missing");
+            process.exit(1);
+        }
+        passedArgs[nestedVersionIndex] = '--session-version';
+        process.argv[nestedVersionIndex + 2] = '--session-version';
+    }
+}
 const requestedCommand = passedArgs.find((arg) => !arg.startsWith('-'));
 const verboseStartup = passedArgs.includes('--verbose');
 // Help and version output are pure documentation — they must never gate on
@@ -1212,7 +1247,7 @@ if (process.env.AGENTS_SKIP_MIGRATION !== '1') {
         // Bumping the suffix re-runs migrations for every user; binary releases that
         // don't change the schema must NOT re-run (they would destroy user content
         // when migration steps overlap with user-authored paths). See issue #20.
-        const sentinelValue = 'v15';
+        const sentinelValue = 'v18';
         let needRun = true;
         try {
             if (fs.existsSync(sentinel) && fs.readFileSync(sentinel, 'utf-8').trim() === sentinelValue) {

package/dist/lib/account-labels.d.ts

@@ -0,0 +1,24 @@
+import type { AgentId } from './types.js';
+export interface AccountLabel {
+    agent: AgentId;
+    fingerprint: string;
+}
+export interface AccountLabelsDocument {
+    labels: Record<string, AccountLabel>;
+}
+export interface DiscoveredAccount {
+    agent: AgentId;
+    fingerprint: string;
+    display: string;
+    versions: string[];
+    label: string | null;
+}
+export declare function identityFingerprint(agent: string, accountKey: string): string;
+export declare function accountLabelsPath(base?: string): string;
+export declare function readAccountLabels(base?: string): AccountLabelsDocument;
+export declare function nameAccount(label: string, agent: AgentId, fingerprint: string, base?: string): void;
+export declare function renameAccountLabel(oldLabel: string, newLabel: string, base?: string): void;
+export declare function removeAccountLabel(label: string, base?: string): void;
+export declare function labelForFingerprint(agent: AgentId, fingerprint: string, doc?: AccountLabelsDocument): string | null;
+export declare function discoverAccounts(agentIds?: readonly AgentId[]): Promise<DiscoveredAccount[]>;
+export declare function resolveAccountLabel(agent: AgentId, label: string): Promise<string>;

package/dist/lib/account-labels.js

@@ -0,0 +1,72 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'yaml';
+import { atomicWriteFileSync } from './fs-atomic.js';
+import { getUserAgentsDir } from './state.js';
+import { ACCOUNT_INSPECTION_AGENT_IDS } from './agents.js';
+import { collectRunCandidates, pickBalancedCandidate } from './rotate.js';
+function emptyDocument() { return { labels: {} }; }
+export function identityFingerprint(agent, accountKey) { return crypto.createHash('sha256').update(`${agent}\0${accountKey}`).digest('hex'); }
+export function accountLabelsPath(base = getUserAgentsDir()) { return path.join(base, 'accounts.yaml'); }
+export function readAccountLabels(base = getUserAgentsDir()) {
+    const file = accountLabelsPath(base);
+    if (!fs.existsSync(file))
+        return emptyDocument();
+    const value = yaml.parse(fs.readFileSync(file, 'utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`Account labels corrupted at ${file}: expected a YAML map.`);
+    const doc = value;
+    doc.labels ??= {};
+    return doc;
+}
+function writeAccountLabels(doc, base = getUserAgentsDir()) { const file = accountLabelsPath(base); fs.mkdirSync(path.dirname(file), { recursive: true }); atomicWriteFileSync(file, yaml.stringify(doc)); }
+function assertLabel(label) { if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(label))
+    throw new Error('Label must start with a letter or number and contain only letters, numbers, dot, underscore, or dash.'); }
+export function nameAccount(label, agent, fingerprint, base = getUserAgentsDir()) {
+    assertLabel(label);
+    const doc = readAccountLabels(base);
+    for (const [other, account] of Object.entries(doc.labels))
+        if (other !== label && account.agent === agent && account.fingerprint === fingerprint)
+            throw new Error(`This ${agent} account is already named '${other}'.`);
+    if (doc.labels[label] && (doc.labels[label].agent !== agent || doc.labels[label].fingerprint !== fingerprint))
+        throw new Error(`Account label '${label}' already names another account.`);
+    doc.labels[label] = { agent, fingerprint };
+    writeAccountLabels(doc, base);
+}
+export function renameAccountLabel(oldLabel, newLabel, base = getUserAgentsDir()) { assertLabel(newLabel); const doc = readAccountLabels(base); if (!doc.labels[oldLabel])
+    throw new Error(`Unknown account label '${oldLabel}'.`); if (doc.labels[newLabel])
+    throw new Error(`Account label '${newLabel}' already exists.`); doc.labels[newLabel] = doc.labels[oldLabel]; delete doc.labels[oldLabel]; writeAccountLabels(doc, base); }
+export function removeAccountLabel(label, base = getUserAgentsDir()) { const doc = readAccountLabels(base); if (!doc.labels[label])
+    throw new Error(`Unknown account label '${label}'.`); delete doc.labels[label]; writeAccountLabels(doc, base); }
+export function labelForFingerprint(agent, fingerprint, doc = readAccountLabels()) { return Object.entries(doc.labels).find(([, account]) => account.agent === agent && account.fingerprint === fingerprint)?.[0] ?? null; }
+export async function discoverAccounts(agentIds = ACCOUNT_INSPECTION_AGENT_IDS) {
+    const labels = readAccountLabels();
+    const grouped = new Map();
+    await Promise.all(agentIds.map(async (agent) => {
+        for (const candidate of await collectRunCandidates(agent)) {
+            if (!candidate.signedIn || !candidate.accountKey)
+                continue;
+            const fingerprint = identityFingerprint(agent, candidate.accountKey);
+            const key = `${agent}:${fingerprint}`;
+            const existing = grouped.get(key);
+            if (existing)
+                existing.versions.push(candidate.version);
+            else
+                grouped.set(key, { agent, fingerprint, display: candidate.accountLabel || 'signed-in account', versions: [candidate.version], label: labelForFingerprint(agent, fingerprint, labels) });
+        }
+    }));
+    return [...grouped.values()].sort((a, b) => a.agent.localeCompare(b.agent) || a.display.localeCompare(b.display));
+}
+export async function resolveAccountLabel(agent, label) {
+    const account = readAccountLabels().labels[label];
+    if (!account)
+        throw new Error(`Unknown account label '${label}'.`);
+    if (account.agent !== agent)
+        throw new Error(`Account label '${label}' names a ${account.agent} account, not ${agent}.`);
+    const candidates = (await collectRunCandidates(agent)).filter(candidate => candidate.accountKey && identityFingerprint(agent, candidate.accountKey) === account.fingerprint);
+    const result = pickBalancedCandidate(candidates);
+    if (!result)
+        throw new Error(`No healthy installed ${agent} version is currently signed into account '${label}'.`);
+    return result.picked.version;
+}

package/dist/lib/agents.d.ts

@@ -23,7 +23,18 @@ export declare const GEMINI_HOOKS_MIN_VERSION = "0.26.0";
  * dispatcher) showed up under `agents view`'s "Not Managed by Agents CLI"
  * section, even though the user had nothing to import.
  */
-export declare function findInPath(command: string): string | null;
+interface NativeBinaryResolutionOptions {
+    shimsDir?: string;
+    historyDir?: string;
+}
+/**
+ * Resolve a PATH candidate to the immutable native executable agents-cli may
+ * safely register. An adopted launcher can live outside the shims directory
+ * while resolving back into it; in that case its durable adoption record is
+ * the source of truth for the original executable.
+ */
+export declare function resolveNativeBinaryPath(command: string, candidate: string, options?: NativeBinaryResolutionOptions): string | null;
+export declare function findInPath(command: string, options?: NativeBinaryResolutionOptions): string | null;
 /**
  * Master registry of all supported agents keyed by AgentId.
  *
@@ -289,6 +300,26 @@ export declare function antigravityOsKeyringProbe(platform?: NodeJS.Platform): {
 } | null;
 /** @internal test hook — clear the per-process keyring probe cache. */
 export declare function __resetAntigravityKeychainCacheForTest(): void;
+/**
+ * OpenCode's account identity: the sorted, "+"-joined list of provider ids
+ * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
+ * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
+ * so this join is the closest thing to "which account is this" available — the
+ * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ *
+ * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
+ * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
+ * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
+ * migrations) all three are permanently empty — no migration ever populates
+ * them, and no session has ever written a row. Reading from them instead of
+ * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
+ * uses this function rather than duplicating a sqlite lookup against those
+ * dead tables.
+ *
+ * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
+ * missing, unreadable, or carries no valid credential.
+ */
+export declare function resolveOpenCodeAccountId(base: string): string | undefined;
 /**
  * Whether a Claude version home's credential file is present but carries no
  * token — the "must have a real credential" floor (see

package/dist/lib/agents.js

@@ -21,7 +21,7 @@ import chalk from 'chalk';
 import { execFileShellSpec } from './platform/index.js';
 import { latestFileMtimeMs } from './fs-walk.js';
 import { damerauLevenshtein } from './fuzzy.js';
-import { getCacheDir, getVersionsDir, getShimsDir, getCliVersionCachePath } from './state.js';
+import { getCacheDir, getVersionsDir, getShimsDir, getHistoryDir, getCliVersionCachePath } from './state.js';
 import { resolveVersion, getVersionHomePath, getBinaryPath } from './versions.js';
 import { supports } from './capabilities.js';
 const execFileAsync = promisify(execFile);
@@ -61,20 +61,57 @@ function saveCliVersionCache() {
         /* best-effort cache persist */
     }
 }
+function pathIsWithin(candidate, directory) {
+    const relative = path.relative(directory, candidate);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
 /**
- * Synchronous PATH search -- no subprocess. Returns first matching binary path.
- *
- * Skips our own shims dir (`~/.agents/.cache/shims/`) — those shims are
- * dispatch helpers, not real installs. Counting them as installed produced a
- * false positive where agents with NO real binary on the host (e.g. a
- * never-installed Cursor whose only PATH entry was our `cursor-agent` shim
- * dispatcher) showed up under `agents view`'s "Not Managed by Agents CLI"
- * section, even though the user had nothing to import.
+ * Resolve a PATH candidate to the immutable native executable agents-cli may
+ * safely register. An adopted launcher can live outside the shims directory
+ * while resolving back into it; in that case its durable adoption record is
+ * the source of truth for the original executable.
  */
-export function findInPath(command) {
+export function resolveNativeBinaryPath(command, candidate, options = {}) {
+    const shimsDir = options.shimsDir ?? getShimsDir();
+    const historyDir = options.historyDir ?? getHistoryDir();
+    let canonicalCandidate;
+    try {
+        canonicalCandidate = fs.realpathSync(candidate);
+    }
+    catch {
+        return null;
+    }
+    let canonicalShimsDir = path.resolve(shimsDir);
+    try {
+        canonicalShimsDir = fs.realpathSync(shimsDir);
+    }
+    catch {
+        /* An absent shims dir cannot make an existing native binary invalid. */
+    }
+    if (!pathIsWithin(canonicalCandidate, canonicalShimsDir))
+        return canonicalCandidate;
+    const recordPath = path.join(historyDir, 'adopted-launchers', command);
+    try {
+        const [original] = fs.readFileSync(recordPath, 'utf-8').split(/\r?\n/, 1);
+        if (!original)
+            return null;
+        const canonicalOriginal = fs.realpathSync(original);
+        if (pathIsWithin(canonicalOriginal, canonicalShimsDir))
+            return null;
+        const stat = fs.statSync(canonicalOriginal);
+        if (!stat.isFile())
+            return null;
+        fs.accessSync(canonicalOriginal, fs.constants.X_OK);
+        return canonicalOriginal;
+    }
+    catch {
+        return null;
+    }
+}
+export function findInPath(command, options = {}) {
     const pathEnv = process.env.PATH || '';
     const pathExt = process.platform === 'win32' ? (process.env.PATHEXT || '').split(';') : [''];
-    const shimsDir = getShimsDir();
+    const shimsDir = options.shimsDir ?? getShimsDir();
     for (const dir of pathEnv.split(path.delimiter)) {
         if (!dir)
             continue;
@@ -84,8 +121,11 @@ export function findInPath(command) {
             const full = path.join(dir, command + ext);
             try {
                 const stat = fs.statSync(full);
-                if (stat.isFile())
-                    return full;
+                if (!stat.isFile())
+                    continue;
+                const native = resolveNativeBinaryPath(command, full, options);
+                if (native)
+                    return native;
             }
             catch {
                 /* not in this dir */
@@ -305,9 +345,8 @@ export const AGENTS = {
         // + warns for pre-2.4 installs); the direct `subagents add --agents cursor` path
         // writes unconditionally, same as the other since-gated agents.
         // See transformSubagentForCursor / https://cursor.com/docs/subagents.
-        // interactiveRepl: false — cursor-agent exits immediately with no argv. It requires a
-        // prompt to do anything useful; a bare invocation is not a REPL (RUSH-2185, EXEC-23a).
-        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: { since: '2026.1.22' }, rules: { file: '.cursorrules' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], interactiveRepl: false }, // allowlist: ~/.cursor/cli-config.json
+        // Current cursor-agent builds open their interactive TUI with no argv.
+        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: { since: '2026.1.22' }, rules: { file: '.cursorrules' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], interactiveRepl: true }, // allowlist: ~/.cursor/cli-config.json
     },
     opencode: {
         id: 'opencode',
@@ -1602,6 +1641,43 @@ function isValidOpenCodeCredential(value) {
         default: return false;
     }
 }
+/**
+ * OpenCode's account identity: the sorted, "+"-joined list of provider ids
+ * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
+ * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
+ * so this join is the closest thing to "which account is this" available — the
+ * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ *
+ * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
+ * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
+ * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
+ * migrations) all three are permanently empty — no migration ever populates
+ * them, and no session has ever written a row. Reading from them instead of
+ * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
+ * uses this function rather than duplicating a sqlite lookup against those
+ * dead tables.
+ *
+ * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
+ * missing, unreadable, or carries no valid credential.
+ */
+export function resolveOpenCodeAccountId(base) {
+    const authPath = resolveOpenCodeAuthPath(base);
+    if (!authPath)
+        return undefined;
+    try {
+        const data = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
+        if (!data || typeof data !== 'object')
+            return undefined;
+        const providers = Object.entries(data)
+            .filter(([, cred]) => isValidOpenCodeCredential(cred))
+            .map(([id]) => id)
+            .sort();
+        return providers.length ? providers.join('+') : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Whether a Muse Code `~/.config/muse/auth.json` document holds any usable
  * access token. Live shape from `muse login` (device OAuth, Muse Code 0.1.0):
@@ -2020,22 +2096,11 @@ export async function getAccountInfo(agentId, home) {
                 // themselves. The user's complaint was the row read "not signed in"
                 // despite a live login; a valid provider entry now shows e.g.
                 // "id:muse-spark" so they can see exactly which provider is configured.
-                const authPath = resolveOpenCodeAuthPath(base);
-                if (!authPath)
-                    return { ...empty, lastActive };
-                const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
-                if (!data || typeof data !== 'object')
-                    return { ...empty, lastActive };
-                const providers = Object.entries(data)
-                    .filter(([, cred]) => isValidOpenCodeCredential(cred))
-                    .map(([id]) => id)
-                    .sort();
-                if (providers.length === 0)
+                // resolveOpenCodeAccountId is the single source of truth for this join —
+                // session/discover.ts reuses it for the indexed `account` field.
+                const accountId = resolveOpenCodeAccountId(base);
+                if (!accountId)
                     return { ...empty, lastActive };
-                // Provider ids are config keys (e.g. "anthropic", "muse-spark"), not
-                // secrets. Join them into a stable, human-readable account label +
-                // identity key for usage dedup.
-                const accountId = providers.join('+');
                 const accountKey = buildIdentityKey(agentId, [['providers', accountId]]);
                 return { ...empty, signedIn: true, accountId, accountKey, lastActive };
             }

package/dist/lib/daemon-health.d.ts

@@ -0,0 +1,24 @@
+/** Stable subsystem identifiers shared by the daemon (writer) and `agents daemon` (reader). */
+export declare const SUBSYSTEM_SECRETS_BROKER = "secrets-broker";
+export declare const SUBSYSTEM_BROWSER_IPC = "browser-ipc";
+/** One subsystem's health as of the last time it reported in. */
+export interface SubsystemHealth {
+    /** Stable identifier, e.g. 'secrets-broker', 'browser-ipc'. */
+    subsystem: string;
+    /** Most recent error message, or null if it has never failed. */
+    lastError: string | null;
+    /** ISO timestamp of the most recent error, or null. */
+    lastErrorAt: string | null;
+    /** Consecutive failures since the last success (0 when currently healthy). */
+    consecutiveFailures: number;
+    /** ISO timestamp of the most recent success, or null if it has never succeeded. */
+    lastOkAt: string | null;
+}
+/** Record a successful subsystem check-in — clears the failure streak. */
+export declare function recordSubsystemOk(subsystem: string, at?: string): void;
+/** Record a subsystem failure — bumps the consecutive-failure streak. */
+export declare function recordSubsystemError(subsystem: string, error: string, at?: string): void;
+/** Read one subsystem's health record, or null if it has never reported in. */
+export declare function readSubsystemHealth(subsystem: string): SubsystemHealth | null;
+/** Read every subsystem's health record, sorted by subsystem name. */
+export declare function readAllSubsystemHealth(): SubsystemHealth[];