@phnx-labs/agents-cli 1.22.46 → 1.22.49

package/dist/commands/traces.js

@@ -0,0 +1,184 @@
+import chalk from 'chalk';
+import { setHelpSections } from '../lib/help.js';
+import { syncTraces } from '../lib/traces/sync.js';
+import { readSyncLedger } from '../lib/traces/sync.js';
+import { managedTracesBaseUrl, resolveTracesBackend } from '../lib/traces/backend.js';
+import { showUrl } from '../lib/open-url.js';
+import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/share/config.js';
+import { PHOENIX_ID_BASE } from '../lib/identity/client.js';
+import { DEFAULT_BUCKET_NAME, DEFAULT_WORKER_NAME } from '../lib/traces/config.js';
+import { DEFAULT_TRACES_DOMAIN } from '../lib/traces/backend.js';
+import { provisionTraces } from '../lib/traces/provision.js';
+// ---------------------------------------------------------------------------
+// Help text
+// ---------------------------------------------------------------------------
+const SYNC_EXAMPLES = `
+  $ agents traces sync
+  Push this device's derived, redacted trajectories to your Phoenix account.
+
+  $ agents traces sync --limit 20
+  Sync at most 20 sessions (useful for a first run on a large fleet device).
+
+  $ agents traces sync --dry-run --out ./trace-preview
+  Compute the shards from your real sessions.db and WRITE them locally — no
+  Phoenix sign-in, no worker, no upload. Point a console at ./trace-preview to
+  see your real trajectories before wiring the hosted path.
+`.trimStart();
+const SYNC_NOTES = `
+  Reads from the local sessions.db, computes a derived SessionTrajectory (steps +
+  gaps + stats, no raw transcript text), redacts secrets, and PUTs each to
+  the agents-traces store.
+
+  An incremental gate (traces-sync.json ledger) means re-runs only upload
+  sessions whose file_mtime_ms changed since the last sync.
+
+  Sign in first with: agents auth login
+`.trimStart();
+const STATUS_EXAMPLES = `
+  $ agents traces status
+  Show what's been synced — session count and last sync time for this device.
+`.trimStart();
+const OPEN_EXAMPLES = `
+  $ agents traces open
+  Open the Phoenix Evals console for your account.
+`.trimStart();
+const SETUP_EXAMPLES = `
+  $ agents traces setup
+  Provision the private agents-traces Worker, R2 bucket, and managed domain.
+
+  $ agents traces setup --account <id> --token <token>
+  Provision non-interactively with explicit Cloudflare credentials.
+`.trimStart();
+// ---------------------------------------------------------------------------
+// Command handlers
+// ---------------------------------------------------------------------------
+async function handleSync(opts) {
+    const limit = opts.limit !== undefined ? parseInt(opts.limit, 10) : undefined;
+    const dryRun = opts.dryRun === true;
+    if (dryRun && !opts.out) {
+        console.error(chalk.red('traces sync --dry-run requires --out <dir>'));
+        process.exitCode = 1;
+        return;
+    }
+    // A dry-run computes locally and needs no Phoenix backend; a real sync does.
+    if (!dryRun) {
+        try {
+            resolveTracesBackend();
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+            return;
+        }
+    }
+    console.log(chalk.dim(dryRun ? `Computing traces locally → ${opts.out}` : 'Syncing traces…'));
+    let result;
+    try {
+        result = await syncTraces({ limit, dryRun, outDir: opts.out });
+    }
+    catch (err) {
+        console.error(chalk.red(`Sync failed: ${err.message}`));
+        process.exitCode = 1;
+        return;
+    }
+    const parts = [];
+    if (result.uploaded > 0) {
+        parts.push(chalk.green(`${result.uploaded} ${dryRun ? 'written' : 'uploaded'}`));
+    }
+    if (result.skipped > 0) {
+        parts.push(chalk.dim(`${result.skipped} skipped`));
+    }
+    if (result.errors > 0) {
+        parts.push(chalk.yellow(`${result.errors} errors`));
+    }
+    if (parts.length === 0) {
+        parts.push(chalk.dim('nothing new'));
+    }
+    console.log(parts.join(chalk.dim('  ·  ')));
+}
+async function handleStatus() {
+    const ledger = readSyncLedger();
+    if (!ledger.lastSyncMtime) {
+        console.log(chalk.dim('No sync recorded on this device. Run: agents traces sync'));
+        return;
+    }
+    const when = new Date(ledger.lastSyncMtime).toLocaleString();
+    console.log(`Last sync: ${chalk.bold(when)}`);
+    console.log(chalk.dim('Run `agents traces sync` to push new sessions.'));
+}
+async function handleOpen() {
+    // M2 console — for now open the base URL which will route to the console once deployed.
+    const url = managedTracesBaseUrl();
+    console.log(chalk.dim(`Opening ${url}`));
+    const outcome = await showUrl(url);
+    if (outcome.via === 'none') {
+        console.log(url);
+    }
+}
+async function handleSetup(opts) {
+    const { input } = await import('@inquirer/prompts');
+    const { apiToken, accountId: bundledAccountId } = readCloudflareCreds(opts.bundle, {
+        apiToken: opts.token,
+        accountId: opts.account,
+    });
+    const accountId = opts.account ?? bundledAccountId ?? await input({ message: 'Cloudflare account id' });
+    if (!accountId)
+        throw new Error('A Cloudflare account id is required.');
+    const result = await provisionTraces({
+        apiToken,
+        accountId,
+        workerName: opts.worker,
+        bucketName: opts.bucket,
+        domain: opts.domain,
+        phoenixIdBase: PHOENIX_ID_BASE,
+    });
+    console.log(chalk.green(`Traces endpoint ready → ${chalk.bold(result.baseUrl)}`));
+}
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+export function registerTracesCommands(program) {
+    const tracesCmd = program
+        .command('traces')
+        .description("Sync this device's derived, redacted trajectories to your Phoenix account");
+    const setupCmd = tracesCmd
+        .command('setup')
+        .description('Provision the private Cloudflare Worker and R2 bucket for traces')
+        .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
+        .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
+        .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
+        .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
+        .option('--token <token>', 'Cloudflare API token (else read from the --bundle)')
+        .option('--domain <host>', 'custom domain to map', DEFAULT_TRACES_DOMAIN)
+        .action(async (opts) => {
+        try {
+            await handleSetup(opts);
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+        }
+    });
+    setHelpSections(setupCmd, { examples: SETUP_EXAMPLES });
+    // sync
+    const syncCmd = tracesCmd
+        .command('sync')
+        .description('Push derived, redacted trajectories (incremental)')
+        .option('--limit <n>', 'Maximum number of sessions to sync in this run')
+        .option('--dry-run', 'Compute the shards from real sessions.db and WRITE them locally (no auth, no upload)')
+        .option('--out <dir>', 'Directory to write index.json + sessions/<id>.json (required with --dry-run)')
+        .action(handleSync);
+    setHelpSections(syncCmd, { examples: SYNC_EXAMPLES, notes: SYNC_NOTES });
+    // status
+    const statusCmd = tracesCmd
+        .command('status')
+        .description('Show last sync time for this device')
+        .action(handleStatus);
+    setHelpSections(statusCmd, { examples: STATUS_EXAMPLES });
+    // open
+    const openCmd = tracesCmd
+        .command('open')
+        .description('Open the Phoenix Evals console')
+        .action(handleOpen);
+    setHelpSections(openCmd, { examples: OPEN_EXAMPLES });
+}

package/dist/commands/view.d.ts

@@ -10,10 +10,12 @@ import type { Command } from 'commander';
 import { accountDisplayLabel } from '../lib/agents.js';
 import type { AccountInfo } from '../lib/agents.js';
 import type { AgentId } from '../lib/types.js';
+import type { FormatUsageSummaryOpts, UsageInfo } from '../lib/accounting/usage.js';
 import type { ResourceSection, ViewJsonAgent } from '../lib/view-types.js';
 export type { ResourceItemJson, ResourceSection, SyncState, VersionResourcesJson, ViewJsonAgent, ViewJsonVersion } from '../lib/view-types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
 import { type ByokUsageResult } from '../lib/byok-usage.js';
+export declare function viewUsageSummaryOptions(agentId: AgentId, signedIn: boolean, usageInfo: UsageInfo | undefined, maxWindows: number | undefined, version?: string): FormatUsageSummaryOpts;
 /** Shared account identity formatter, re-exported for the view-specific tests. */
 export declare const accountColumnLabel: typeof accountDisplayLabel;
 /**

package/dist/commands/view.js

@@ -7,8 +7,8 @@ import * as path from 'path';
 import { AGENTS, ALL_AGENT_IDS, accountDisplayLabel, getAllCliStates, getUnmanagedCliState, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
 import { ambientClaudeToken, loginHint } from '../lib/signin-badge.js';
 import { machineId } from '../lib/machine-id.js';
-import { authCacheKey, formatCheckedAge, readAuthHealthCache } from '../lib/auth-health.js';
-import { agentReportsUsage, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, isUsageHeadlessScopeError, } from '../lib/accounting/usage.js';
+import { authCacheKey, readAuthHealthCache } from '../lib/auth-health.js';
+import { agentReportsUsage, classifyUsageErrorKind, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageBenignState, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, isUsageHeadlessScopeError, } from '../lib/accounting/usage.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, isVersionIsolated, getIsolatedDefault, } from '../lib/installations/versions.js';
 import { ensureVersionedAliasCurrent, removeShim, } from '../lib/installations/shims.js';
@@ -32,6 +32,25 @@ import { renderHarnessDetail } from './harness.js';
 import { confirm } from '@inquirer/prompts';
 import { formatPath, isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
+export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows, version) {
+    const headless = isUsageHeadlessScopeError(usageInfo?.error);
+    const benignState = usageInfo ? getUsageBenignState(usageInfo) : null;
+    return {
+        unavailable: agentReportsUsage(agentId) && signedIn && !usageInfo?.snapshot && !headless && !benignState,
+        unverified: !headless && !!usageInfo?.snapshot && !!usageInfo.error,
+        headless,
+        maxWindows,
+        expectedWindows: agentId === 'claude'
+            ? [{ key: 'session', shortLabel: 'S' }, { key: 'week', shortLabel: 'W' }]
+            : undefined,
+        errorKind: classifyUsageErrorKind(usageInfo?.error),
+        errorDetail: usageInfo?.error ?? null,
+        benignState,
+        noRecentUsageLabel: agentId === 'grok'
+            ? `run grok${version ? `@${version}` : ''} once to refresh usage`
+            : null,
+    };
+}
 /** Shared account identity formatter, re-exported for the view-specific tests. */
 export const accountColumnLabel = accountDisplayLabel;
 /**
@@ -79,8 +98,6 @@ export function compareAccountOrderedVersions(a, b, globalDefault) {
  * views leave the cap unset and show every blocking window.
  */
 const OVERVIEW_MAX_USAGE_WINDOWS = 2;
-/** Fixed width for the last-active column ("just now", "8h ago", "2d ago"). */
-const LAST_ACTIVE_COL_WIDTH = 10;
 /**
  * Join fixed view columns with a consistent two-space gutter. Empty trailing
  * columns are dropped so a row without an auth chip does not grow a dangling
@@ -299,22 +316,6 @@ function renderHostClisSection(cwd) {
         console.log(`  ${chalk.red('error')}      ${chalk.gray(err.file)}: ${chalk.gray(err.reason)}`);
     }
 }
-/**
- * A compact live-auth chip for a version row, read from the fleet auth-health
- * cache (written by `agents fleet ping` / the daemon). Empty when the install
- * hasn't been probed — this is the local "signed in" flag's ground-truth
- * companion: ● live, ○ revoked (re-login), ◐ unverified/limited, plus its age.
- */
-function liveAuthChip(cache, host, agentId, version) {
-    const h = cache[authCacheKey(host, agentId, version)];
-    if (!h)
-        return '';
-    const glyph = h.verdict === 'live' ? chalk.green('●')
-        : h.verdict === 'revoked' ? chalk.red('○')
-            : h.verdict === 'expired' ? chalk.yellow('○')
-                : chalk.yellow('◐');
-    return `${glyph} ${chalk.gray(formatCheckedAge(h.checkedAt))}`;
-}
 async function showInstalledVersions(filterAgentId, viewOpts) {
     const spinnerText = filterAgentId
         ? `Checking ${agentLabel(filterAgentId)} agents...`
@@ -365,9 +366,6 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
         }
     }
     // Shim healing is silent — users don't need to know about internal repairs
-    const selfHost = machineId();
-    // Read the auth-health cache once (not per version row — see the batching note above).
-    const authCache = readAuthHealthCache();
     // Pre-fetch account info for all versions in parallel. Spinner stays up through
     // account + usage so a multi-account cold path doesn't leave a blank terminal
     // after "Checking…" vanishes (the hang the screenshots caught).
@@ -535,15 +533,7 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 const info = rawInfo ? mergeCanonical(rawInfo) : undefined;
                 const usageKey = getUsageLookupKey(info);
                 const usageInfo = usageKey ? usageByKey.get(usageKey) : undefined;
-                const headless = isUsageHeadlessScopeError(usageInfo?.error);
-                const usageUnavailable = agentReportsUsage(agentId) && !!info?.signedIn && !usageInfo?.snapshot && !headless;
-                const usageUnverified = !headless && !!usageInfo?.snapshot && !!usageInfo.error;
-                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, {
-                    unavailable: usageUnavailable,
-                    unverified: usageUnverified,
-                    headless,
-                    maxWindows: usageWindowCap,
-                });
+                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, !!info?.signedIn, usageInfo, usageWindowCap, v));
                 maxUsageWidth = Math.max(maxUsageWidth, stringWidth(usageStr));
                 const statusStr = formatUsageStatusBadge(info?.usageStatus);
                 maxStatusWidth = Math.max(maxStatusWidth, stringWidth(statusStr));
@@ -603,19 +593,12 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 }
                 const hasEmail = !!vInfo?.email;
                 const signedIn = !!vInfo?.signedIn;
-                const headless = isUsageHeadlessScopeError(usageInfo?.error);
-                const usageUnavailable = agentReportsUsage(agentId) && signedIn && !usageInfo?.snapshot && !headless;
-                const usageUnverified = !headless && !!usageInfo?.snapshot && !!usageInfo.error;
-                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, {
-                    unavailable: usageUnavailable,
-                    unverified: usageUnverified,
-                    headless,
-                    maxWindows: usageWindowCap,
-                });
+                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, signedIn, usageInfo, usageWindowCap, version));
                 const hasUsage = usageStr.length > 0;
                 // Only show lastActive for versions with an actual logged-in account.
                 // Otherwise it reflects install time (misleading "just now" for fresh installs).
-                const activeStr = vInfo && hasEmail ? formatLastActive(vInfo.lastActive) : '';
+                const lastActive = vInfo && hasEmail ? formatLastActive(vInfo.lastActive) : '';
+                const activeStr = lastActive;
                 const hasActive = activeStr.length > 0;
                 // The model now has its own column above; keep only the run mode here.
                 const runDefaults = resolveRunDefaults(agentId, version);
@@ -652,16 +635,12 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                         const statusStr = formatUsageStatusBadge(vInfo?.usageStatus);
                         parts.push(padToWidth(statusStr, maxStatusWidth));
                     }
-                    // Fixed-width lastActive so the auth chip (●/○/◐) lines up even when
-                    // some rows have no email-derived lastActive.
-                    parts.push(hasActive ? padToWidth(activeStr, LAST_ACTIVE_COL_WIDTH) : ' '.repeat(LAST_ACTIVE_COL_WIDTH));
+                    if (hasActive)
+                        parts.push(activeStr);
                 }
                 if (runDefaultBits.length > 0) {
                     parts.push(chalk.gray(`run ${runDefaultBits.join(' ')}`));
                 }
-                const authChip = liveAuthChip(authCache, selfHost, agentId, version);
-                if (authChip)
-                    parts.push(authChip);
                 console.log(joinViewColumns(parts));
                 if (showPaths) {
                     const versionDir = getVersionDir(agentId, version);
@@ -731,12 +710,7 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             gMaxStatusWidth = Math.max(gMaxStatusWidth, stringWidth(formatUsageStatusBadge(gInfo?.usageStatus)));
             const gUsageKey = getUsageLookupKey(gInfo);
             const gUsage = gUsageKey ? usageByKey.get(gUsageKey) : undefined;
-            const gHeadless = isUsageHeadlessScopeError(gUsage?.error);
-            const gUsageStr = formatUsageSummary(gInfo?.plan || null, gUsage?.snapshot || null, 3, {
-                unverified: !gHeadless && !!gUsage?.snapshot && !!gUsage.error,
-                headless: gHeadless,
-                maxWindows: usageWindowCap,
-            });
+            const gUsageStr = formatUsageSummary(gInfo?.plan || null, gUsage?.snapshot || null, 3, viewUsageSummaryOptions(agentId, !!gInfo?.signedIn, gUsage, usageWindowCap));
             gMaxUsageWidth = Math.max(gMaxUsageWidth, stringWidth(gUsageStr));
             const gDisplay = accountColumnLabel(gInfo);
             if (gDisplay)
@@ -754,13 +728,9 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             const parts = [`    ${verLabel}${padding}`];
             const gUsageKey = getUsageLookupKey(gInfo);
             const gUsage = gUsageKey ? usageByKey.get(gUsageKey) : undefined;
-            const gHeadless = isUsageHeadlessScopeError(gUsage?.error);
-            const gUsageStr = formatUsageSummary(gInfo?.plan || null, gUsage?.snapshot || null, 3, {
-                unverified: !gHeadless && !!gUsage?.snapshot && !!gUsage.error,
-                headless: gHeadless,
-                maxWindows: usageWindowCap,
-            });
-            const gActiveStr = gInfo ? formatLastActive(gInfo.lastActive) : '';
+            const gUsageStr = formatUsageSummary(gInfo?.plan || null, gUsage?.snapshot || null, 3, viewUsageSummaryOptions(agentId, !!gInfo?.signedIn, gUsage, usageWindowCap));
+            const gLastActive = gInfo ? formatLastActive(gInfo.lastActive) : '';
+            const gActiveStr = gLastActive;
             if (gInfo?.email || gUsageStr || gActiveStr || gInfo?.signedIn) {
                 const gDisplay = accountColumnLabel(gInfo);
                 parts.push(gDisplay ? chalk.cyan(padToWidth(gDisplay, gMaxEmail)) : ' '.repeat(gMaxEmail));
@@ -771,7 +741,7 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 parts.push(padToWidth(formatUsageStatusBadge(gInfo?.usageStatus), gMaxStatusWidth));
             }
             if (gActiveStr)
-                parts.push(padToWidth(gActiveStr, LAST_ACTIVE_COL_WIDTH));
+                parts.push(gActiveStr);
             console.log(joinViewColumns(parts));
             if (showPaths && cliState?.path) {
                 console.log(chalk.gray(`      ${cliState.path}`));

package/dist/commands/watchdog.js

@@ -144,8 +144,7 @@ export function registerWatchdogCommand(program) {
         .option('--cooldown <dur>', 'Minimum time between nudges to the same session', humanMs(DEFAULT_THRESHOLDS.cooldownMs))
         .option('--dormant <dur>', 'Idle time after which a session is left alone (dormant)', humanMs(DEFAULT_THRESHOLDS.dormantMs))
         .option('--text <text>', 'Nudge text delivered into the terminal', 'Continue.')
-        .option('--smart', 'Use the LLM decider (agents run) instead of the deterministic path (non-reproducible)')
-        .option('--smart-agent <agent>', 'Agent the --smart decider runs as', 'claude')
+        .option('--smart-agent <agent>', 'Agent the watchdog decider runs as', 'claude')
         .option('--allow-ghostty-focus', 'Permit the coarse, focus-stealing Ghostty path (off by default)')
         .option('--verbose', 'Show healthy and non-actionable session inspections too')
         .option('--json', 'Emit the tick result as JSON (for the menu-bar / scripts)')
@@ -163,7 +162,6 @@ export function registerWatchdogCommand(program) {
         const tickOnce = async (willInject, sessions) => runWatchdogPass({
             nudge: willInject,
             nudgeText: opts.text,
-            smart: opts.smart === true,
             smartAgent: opts.smartAgent,
             thresholds,
             allowGhosttyFocus: opts.allowGhosttyFocus === true,
@@ -233,17 +231,14 @@ export function registerWatchdogCommand(program) {
       agents watchdog rotate off
     `,
         notes: `
-      Decision path: a cheap deterministic pre-filter resolves the obvious cases
-      (clearly complete -> skip; a clear promise-without-toolcall -> nudge) and
-      ESCALATES the judgment-heavy cases -- a session parked on a question, or an
-      ambiguous stall -- to a smart brain. The brain drives the agent to finish
-      end-to-end when it asked a needless / already-authorized question or paused
-      with work left, and leaves it for the human on genuine cases (credentials,
-      an irreversible or outward-facing action, a real ambiguous decision, or a
-      completed task). The brain is a customizable 'watchdog' workflow (drop a
-      WORKFLOW.md in project/user workflows/ to override the prompt + model);
-      absent one, the built-in prompt runs via 'agents run --mode plan'. Pass
-      --smart to force every stalled candidate through the brain.
+      Decision path: the watchdog is an AGENT, not a heuristic script. Every idle
+      session on this machine (its task + transcript tail) is handed to ONE
+      'agents run --mode plan' call per tick, which judges each: idle-but-unfinished
+      (was given a task, went quiet, not finished/handed off) -> NUDGE that drives
+      it to finish; idle-and-done or genuinely-needs-human -> SKIP. The agent is a
+      customizable 'watchdog' workflow (drop a WORKFLOW.md in project/user
+      workflows/ to override the prompt + model); absent one, the built-in prompt
+      runs. Nothing is nudged when nothing is idle (no agent is spawned).
 
       Delivery (answer-router): a running agent is steered via its mailbox; a
       parked-on-question agent is answered into its EXACT split -- tmux / iTerm /

package/dist/index.d.ts

@@ -14,6 +14,7 @@
  *   - `__vault-age-helper`
  *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
  *   - `__shim`
+ *   - `__claude-statusline`
  *   - `__daemon-run`
  *
  * The tokens are imported from the leaf module sync-commands.ts — the SAME

package/dist/index.js

@@ -14,6 +14,7 @@
  *   - `__vault-age-helper`
  *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
  *   - `__shim`
+ *   - `__claude-statusline`
  *   - `__daemon-run`
  *
  * The tokens are imported from the leaf module sync-commands.ts — the SAME
@@ -70,6 +71,10 @@ if (process.argv[2] === '__shim') {
     const code = await execShimPassthrough(agent, rawArgs, process.cwd(), pinned || undefined);
     process.exit(code);
 }
+if (process.argv[2] === '__claude-statusline') {
+    const { runClaudeStatusLine } = await import('./lib/claude-statusline.js');
+    process.exit(await runClaudeStatusLine());
+}
 if (process.argv[2] === '__daemon-run') {
     const { runDaemon, log: daemonLog } = await import('./lib/daemon/daemon.js');
     // RUSH-2418: the daemon is the one always-on process here, and it ran with no

package/dist/lib/account-capabilities.d.ts

@@ -19,6 +19,10 @@ export interface NativeAccountCapability {
     scope: 'version' | 'device' | 'unsupported';
     status: 'supported' | 'conditional' | 'discovery-only' | 'unsupported';
 }
+/** Native-login selector coverage required by RUSH-3053. */
+export declare const NATIVE_ACCOUNT_SELECTOR_AGENTS: readonly ["claude", "codex", "cursor", "grok", "kimi"];
+/** Explicit dispositions for config-isolated harnesses outside that selector. */
+export declare const NATIVE_ACCOUNT_SELECTOR_EXCLUSIONS: Partial<Record<AgentId, string>>;
 /** Canonical truth for native-account naming and attachment semantics. */
 export declare const NATIVE_ACCOUNT_CAPABILITIES: Record<AgentId, NativeAccountCapability>;
 export declare function nativeAccountCapability(agent: AgentId): NativeAccountCapability;

package/dist/lib/account-capabilities.js

@@ -1,10 +1,21 @@
+/** Native-login selector coverage required by RUSH-3053. */
+export const NATIVE_ACCOUNT_SELECTOR_AGENTS = ['claude', 'codex', 'cursor', 'grok', 'kimi'];
+/** Explicit dispositions for config-isolated harnesses outside that selector. */
+export const NATIVE_ACCOUNT_SELECTOR_EXCLUSIONS = {
+    copilot: 'no inspectable native identity',
+    opencode: 'provider-set identity is not safely attributable to one native login',
+    muse: 'email-only conditional identity is outside the RUSH-3053 harness contract',
+};
 /** Canonical truth for native-account naming and attachment semantics. */
 export const NATIVE_ACCOUNT_CAPABILITIES = {
-    // Version-scoped with a strong account key — the only harnesses whose native
-    // identity is safe to pin per installed version.
+    // Config-isolated harnesses with a stable native identity. A labeled launch
+    // may use the auth/config home from one installed version with another binary.
     claude: { inspection: 'strong', scope: 'version', status: 'supported' },
     codex: { inspection: 'strong', scope: 'version', status: 'supported' },
     grok: { inspection: 'strong', scope: 'version', status: 'supported' },
+    cursor: { inspection: 'strong', scope: 'version', status: 'supported' },
+    // Kimi exposes a stable opaque id but no email, so it requires a manual label.
+    kimi: { inspection: 'opaque', scope: 'version', status: 'supported' },
     // Version-scoped but only an email identity — nameable only when that email is
     // present (the resolver rejects an emailless Muse login).
     muse: { inspection: 'email', scope: 'version', status: 'conditional' },
@@ -17,12 +28,8 @@ export const NATIVE_ACCOUNT_CAPABILITIES = {
     // "unsupported" is correct until a device-scoped identity key (with a stable
     // device id) exists to validate against.
     antigravity: { inspection: 'opaque', scope: 'device', status: 'unsupported' },
-    kimi: { inspection: 'opaque', scope: 'device', status: 'unsupported' },
     droid: { inspection: 'opaque', scope: 'device', status: 'unsupported' },
     opencode: { inspection: 'opaque', scope: 'device', status: 'unsupported' },
-    // Cursor multi-account isolation is unresolved (RUSH-2400) — blocked from
-    // native naming/attachment; its API-key path is a provider account instead.
-    cursor: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     // Discoverable in the list, but not nameable.
     gemini: { inspection: 'email', scope: 'unsupported', status: 'discovery-only' },
     copilot: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
@@ -62,9 +69,6 @@ export function nativeAccountNamingRefusal(agent) {
     if (cap.scope === 'device') {
         return `${agent} accounts can't be isolated by agents-cli yet (device-scoped login). ${suffix}`;
     }
-    if (agent === 'cursor') {
-        return `${agent} accounts can't be isolated by agents-cli yet (multi-account isolation unresolved). ${suffix}`;
-    }
     if (cap.status === 'discovery-only') {
         return `${agent} native accounts are discovery-only; agents-cli cannot name or attach this login. ${suffix}`;
     }

package/dist/lib/account-registry.d.ts

@@ -48,6 +48,8 @@ export declare function listNativeAccounts(meta: Pick<Meta, 'accounts'>): Native
  */
 export declare function findUnifiedAccount(nameOrId: string, meta: Pick<Meta, 'accounts'>, doc?: AccountRegistryDocument): UnifiedAccount | null;
 export declare function addNativeAccount(name: string, agent: AgentId, identityKey: string, identityLabel: string | undefined, scope: 'version' | 'device'): NativeAccount;
+/** Create or replace the version-independent label for one native identity. */
+export declare function labelNativeAccount(agent: AgentId, identityKey: string, identityLabel: string | undefined, label: string | undefined, scope: 'version' | 'device'): NativeAccount;
 export declare function bindAccount(nameOrId: string, target: string): UnifiedAccount;
 export declare function unbindAccount(nameOrId: string, target: string): void;
 export declare function accountBindings(accountId: string, meta: Pick<Meta, 'accounts'>): string[];

package/dist/lib/account-registry.js

@@ -25,12 +25,17 @@ import { bundleExists, deleteBundle, listBundles, readBundle, renameBundle, writ
 import { getAccountProvider } from './account-provider-registry.js';
 import { accountSecretItem, buildAccountBundle, parseAccountBundle } from './account-schema.js';
 const NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+const NATIVE_LABEL = /^[a-zA-Z0-9][a-zA-Z0-9@._+-]*$/;
 const AUTH_KINDS = ['api-key', 'setup-token', 'bearer-token'];
 export function accountRegistryPath(base = getUserAgentsDir()) { return path.join(base, 'accounts.yaml'); }
 function assertName(name) {
     if (!NAME.test(name))
         throw new Error('Account name must start with a letter or number and contain only letters, numbers, dot, underscore, or dash.');
 }
+function assertNativeLabel(label) {
+    if (!NATIVE_LABEL.test(label))
+        throw new Error('Account label must start with a letter or number and contain only letters, numbers, @, dot, underscore, plus, or dash.');
+}
 function isAccountAuthKind(value) {
     return typeof value === 'string' && AUTH_KINDS.includes(value);
 }
@@ -143,7 +148,8 @@ export function listNativeAccounts(meta) {
  * able to omit it.
  */
 export function findUnifiedAccount(nameOrId, meta, doc) {
-    const native = listNativeAccounts(meta).find(account => account.id === nameOrId || account.name === nameOrId);
+    const needle = nameOrId.toLowerCase();
+    const native = listNativeAccounts(meta).find(account => account.id === nameOrId || account.name.toLowerCase() === needle || account.identityLabel?.toLowerCase() === needle);
     if (native)
         return native;
     const provider = findAccount(nameOrId, doc ?? readAccountRegistry());
@@ -154,7 +160,7 @@ function assertUniqueUnifiedName(name, meta, doc) {
         throw new Error(`Account '${name}' already exists.`);
 }
 export function addNativeAccount(name, agent, identityKey, identityLabel, scope) {
-    assertName(name);
+    assertNativeLabel(name);
     const meta = readMeta();
     assertUniqueUnifiedName(name, meta);
     const duplicate = listNativeAccounts(meta).find(account => account.agent === agent && account.identityKey === identityKey);
@@ -170,6 +176,28 @@ export function addNativeAccount(name, agent, identityKey, identityLabel, scope)
     }));
     return account;
 }
+/** Create or replace the version-independent label for one native identity. */
+export function labelNativeAccount(agent, identityKey, identityLabel, label, scope) {
+    const resolvedLabel = label ?? identityLabel;
+    if (!resolvedLabel)
+        throw new Error(`${agent} does not expose an email; pass a manual label.`);
+    assertNativeLabel(resolvedLabel);
+    const meta = readMeta();
+    const existing = listNativeAccounts(meta).find(account => account.agent === agent && account.identityKey === identityKey);
+    const collision = findUnifiedAccount(resolvedLabel, meta);
+    if (collision && collision.id !== existing?.id)
+        throw new Error(`Account '${resolvedLabel}' already exists.`);
+    if (!existing)
+        return addNativeAccount(resolvedLabel, agent, identityKey, identityLabel, scope);
+    updateMeta(current => ({
+        ...current,
+        accounts: {
+            ...current.accounts,
+            native: { ...current.accounts?.native, [existing.id]: { ...current.accounts?.native?.[existing.id], name: resolvedLabel, identityLabel } },
+        },
+    }));
+    return { ...existing, name: resolvedLabel, identityLabel };
+}
 export function bindAccount(nameOrId, target) {
     const meta = readMeta();
     const account = findUnifiedAccount(nameOrId, meta);

package/dist/lib/accounting/rotate.d.ts

@@ -118,6 +118,15 @@ export declare const USAGE_DECISION_MAX_AGE_MS: number;
 /**
  * Whether this candidate's usage number is recent enough to route on. A missing
  * snapshot is unverified by definition — there is no number to trust.
+ *
+ * A snapshot with NO windows is unverified for the same reason, however fresh
+ * it is: it carries a subscription plan and no utilization, so there is still
+ * no number. Freshness alone would make a meterless harness (Grok reports a
+ * tier and no meters) verify against nothing — and since `preferVerified`
+ * narrows the pool to verified candidates, the one account whose billing log
+ * was touched most recently would win every draw, then win again because
+ * running it refreshes that log. That self-reinforcing pin is exactly what the
+ * narrowing rule below exists to prevent.
  */
 export declare function isUsageVerified(candidate: RotateCandidate, nowMs?: number): boolean;
 /**

package/dist/lib/accounting/rotate.js

@@ -113,10 +113,20 @@ export const USAGE_DECISION_MAX_AGE_MS = 5 * 60 * 1000;
 /**
  * Whether this candidate's usage number is recent enough to route on. A missing
  * snapshot is unverified by definition — there is no number to trust.
+ *
+ * A snapshot with NO windows is unverified for the same reason, however fresh
+ * it is: it carries a subscription plan and no utilization, so there is still
+ * no number. Freshness alone would make a meterless harness (Grok reports a
+ * tier and no meters) verify against nothing — and since `preferVerified`
+ * narrows the pool to verified candidates, the one account whose billing log
+ * was touched most recently would win every draw, then win again because
+ * running it refreshes that log. That self-reinforcing pin is exactly what the
+ * narrowing rule below exists to prevent.
  */
 export function isUsageVerified(candidate, nowMs = Date.now()) {
-    const capturedAt = candidate.usageSnapshot?.capturedAt;
-    if (!capturedAt)
+    const snapshot = candidate.usageSnapshot;
+    const capturedAt = snapshot?.capturedAt;
+    if (!capturedAt || !snapshot?.windows.length)
         return false;
     return nowMs - capturedAt.getTime() <= USAGE_DECISION_MAX_AGE_MS;
 }