@phnx-labs/agents-cli 1.22.47 → 1.22.49

package/dist/commands/traces.js

@@ -0,0 +1,184 @@
+import chalk from 'chalk';
+import { setHelpSections } from '../lib/help.js';
+import { syncTraces } from '../lib/traces/sync.js';
+import { readSyncLedger } from '../lib/traces/sync.js';
+import { managedTracesBaseUrl, resolveTracesBackend } from '../lib/traces/backend.js';
+import { showUrl } from '../lib/open-url.js';
+import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/share/config.js';
+import { PHOENIX_ID_BASE } from '../lib/identity/client.js';
+import { DEFAULT_BUCKET_NAME, DEFAULT_WORKER_NAME } from '../lib/traces/config.js';
+import { DEFAULT_TRACES_DOMAIN } from '../lib/traces/backend.js';
+import { provisionTraces } from '../lib/traces/provision.js';
+// ---------------------------------------------------------------------------
+// Help text
+// ---------------------------------------------------------------------------
+const SYNC_EXAMPLES = `
+  $ agents traces sync
+  Push this device's derived, redacted trajectories to your Phoenix account.
+
+  $ agents traces sync --limit 20
+  Sync at most 20 sessions (useful for a first run on a large fleet device).
+
+  $ agents traces sync --dry-run --out ./trace-preview
+  Compute the shards from your real sessions.db and WRITE them locally — no
+  Phoenix sign-in, no worker, no upload. Point a console at ./trace-preview to
+  see your real trajectories before wiring the hosted path.
+`.trimStart();
+const SYNC_NOTES = `
+  Reads from the local sessions.db, computes a derived SessionTrajectory (steps +
+  gaps + stats, no raw transcript text), redacts secrets, and PUTs each to
+  the agents-traces store.
+
+  An incremental gate (traces-sync.json ledger) means re-runs only upload
+  sessions whose file_mtime_ms changed since the last sync.
+
+  Sign in first with: agents auth login
+`.trimStart();
+const STATUS_EXAMPLES = `
+  $ agents traces status
+  Show what's been synced — session count and last sync time for this device.
+`.trimStart();
+const OPEN_EXAMPLES = `
+  $ agents traces open
+  Open the Phoenix Evals console for your account.
+`.trimStart();
+const SETUP_EXAMPLES = `
+  $ agents traces setup
+  Provision the private agents-traces Worker, R2 bucket, and managed domain.
+
+  $ agents traces setup --account <id> --token <token>
+  Provision non-interactively with explicit Cloudflare credentials.
+`.trimStart();
+// ---------------------------------------------------------------------------
+// Command handlers
+// ---------------------------------------------------------------------------
+async function handleSync(opts) {
+    const limit = opts.limit !== undefined ? parseInt(opts.limit, 10) : undefined;
+    const dryRun = opts.dryRun === true;
+    if (dryRun && !opts.out) {
+        console.error(chalk.red('traces sync --dry-run requires --out <dir>'));
+        process.exitCode = 1;
+        return;
+    }
+    // A dry-run computes locally and needs no Phoenix backend; a real sync does.
+    if (!dryRun) {
+        try {
+            resolveTracesBackend();
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+            return;
+        }
+    }
+    console.log(chalk.dim(dryRun ? `Computing traces locally → ${opts.out}` : 'Syncing traces…'));
+    let result;
+    try {
+        result = await syncTraces({ limit, dryRun, outDir: opts.out });
+    }
+    catch (err) {
+        console.error(chalk.red(`Sync failed: ${err.message}`));
+        process.exitCode = 1;
+        return;
+    }
+    const parts = [];
+    if (result.uploaded > 0) {
+        parts.push(chalk.green(`${result.uploaded} ${dryRun ? 'written' : 'uploaded'}`));
+    }
+    if (result.skipped > 0) {
+        parts.push(chalk.dim(`${result.skipped} skipped`));
+    }
+    if (result.errors > 0) {
+        parts.push(chalk.yellow(`${result.errors} errors`));
+    }
+    if (parts.length === 0) {
+        parts.push(chalk.dim('nothing new'));
+    }
+    console.log(parts.join(chalk.dim('  ·  ')));
+}
+async function handleStatus() {
+    const ledger = readSyncLedger();
+    if (!ledger.lastSyncMtime) {
+        console.log(chalk.dim('No sync recorded on this device. Run: agents traces sync'));
+        return;
+    }
+    const when = new Date(ledger.lastSyncMtime).toLocaleString();
+    console.log(`Last sync: ${chalk.bold(when)}`);
+    console.log(chalk.dim('Run `agents traces sync` to push new sessions.'));
+}
+async function handleOpen() {
+    // M2 console — for now open the base URL which will route to the console once deployed.
+    const url = managedTracesBaseUrl();
+    console.log(chalk.dim(`Opening ${url}`));
+    const outcome = await showUrl(url);
+    if (outcome.via === 'none') {
+        console.log(url);
+    }
+}
+async function handleSetup(opts) {
+    const { input } = await import('@inquirer/prompts');
+    const { apiToken, accountId: bundledAccountId } = readCloudflareCreds(opts.bundle, {
+        apiToken: opts.token,
+        accountId: opts.account,
+    });
+    const accountId = opts.account ?? bundledAccountId ?? await input({ message: 'Cloudflare account id' });
+    if (!accountId)
+        throw new Error('A Cloudflare account id is required.');
+    const result = await provisionTraces({
+        apiToken,
+        accountId,
+        workerName: opts.worker,
+        bucketName: opts.bucket,
+        domain: opts.domain,
+        phoenixIdBase: PHOENIX_ID_BASE,
+    });
+    console.log(chalk.green(`Traces endpoint ready → ${chalk.bold(result.baseUrl)}`));
+}
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+export function registerTracesCommands(program) {
+    const tracesCmd = program
+        .command('traces')
+        .description("Sync this device's derived, redacted trajectories to your Phoenix account");
+    const setupCmd = tracesCmd
+        .command('setup')
+        .description('Provision the private Cloudflare Worker and R2 bucket for traces')
+        .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
+        .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
+        .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
+        .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
+        .option('--token <token>', 'Cloudflare API token (else read from the --bundle)')
+        .option('--domain <host>', 'custom domain to map', DEFAULT_TRACES_DOMAIN)
+        .action(async (opts) => {
+        try {
+            await handleSetup(opts);
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+        }
+    });
+    setHelpSections(setupCmd, { examples: SETUP_EXAMPLES });
+    // sync
+    const syncCmd = tracesCmd
+        .command('sync')
+        .description('Push derived, redacted trajectories (incremental)')
+        .option('--limit <n>', 'Maximum number of sessions to sync in this run')
+        .option('--dry-run', 'Compute the shards from real sessions.db and WRITE them locally (no auth, no upload)')
+        .option('--out <dir>', 'Directory to write index.json + sessions/<id>.json (required with --dry-run)')
+        .action(handleSync);
+    setHelpSections(syncCmd, { examples: SYNC_EXAMPLES, notes: SYNC_NOTES });
+    // status
+    const statusCmd = tracesCmd
+        .command('status')
+        .description('Show last sync time for this device')
+        .action(handleStatus);
+    setHelpSections(statusCmd, { examples: STATUS_EXAMPLES });
+    // open
+    const openCmd = tracesCmd
+        .command('open')
+        .description('Open the Phoenix Evals console')
+        .action(handleOpen);
+    setHelpSections(openCmd, { examples: OPEN_EXAMPLES });
+}

package/dist/commands/view.d.ts

@@ -15,7 +15,7 @@ import type { ResourceSection, ViewJsonAgent } from '../lib/view-types.js';
 export type { ResourceItemJson, ResourceSection, SyncState, VersionResourcesJson, ViewJsonAgent, ViewJsonVersion } from '../lib/view-types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
 import { type ByokUsageResult } from '../lib/byok-usage.js';
-export declare function viewUsageSummaryOptions(agentId: AgentId, signedIn: boolean, usageInfo: UsageInfo | undefined, maxWindows: number | undefined): FormatUsageSummaryOpts;
+export declare function viewUsageSummaryOptions(agentId: AgentId, signedIn: boolean, usageInfo: UsageInfo | undefined, maxWindows: number | undefined, version?: string): FormatUsageSummaryOpts;
 /** Shared account identity formatter, re-exported for the view-specific tests. */
 export declare const accountColumnLabel: typeof accountDisplayLabel;
 /**

package/dist/commands/view.js

@@ -7,7 +7,7 @@ import * as path from 'path';
 import { AGENTS, ALL_AGENT_IDS, accountDisplayLabel, getAllCliStates, getUnmanagedCliState, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
 import { ambientClaudeToken, loginHint } from '../lib/signin-badge.js';
 import { machineId } from '../lib/machine-id.js';
-import { authCacheKey, formatCheckedAge, readAuthHealthCache } from '../lib/auth-health.js';
+import { authCacheKey, readAuthHealthCache } from '../lib/auth-health.js';
 import { agentReportsUsage, classifyUsageErrorKind, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageBenignState, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, isUsageHeadlessScopeError, } from '../lib/accounting/usage.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, isVersionIsolated, getIsolatedDefault, } from '../lib/installations/versions.js';
@@ -32,7 +32,7 @@ import { renderHarnessDetail } from './harness.js';
 import { confirm } from '@inquirer/prompts';
 import { formatPath, isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
-export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows) {
+export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows, version) {
     const headless = isUsageHeadlessScopeError(usageInfo?.error);
     const benignState = usageInfo ? getUsageBenignState(usageInfo) : null;
     return {
@@ -40,9 +40,15 @@ export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows
         unverified: !headless && !!usageInfo?.snapshot && !!usageInfo.error,
         headless,
         maxWindows,
+        expectedWindows: agentId === 'claude'
+            ? [{ key: 'session', shortLabel: 'S' }, { key: 'week', shortLabel: 'W' }]
+            : undefined,
         errorKind: classifyUsageErrorKind(usageInfo?.error),
         errorDetail: usageInfo?.error ?? null,
         benignState,
+        noRecentUsageLabel: agentId === 'grok'
+            ? `run grok${version ? `@${version}` : ''} once to refresh usage`
+            : null,
     };
 }
 /** Shared account identity formatter, re-exported for the view-specific tests. */
@@ -92,8 +98,6 @@ export function compareAccountOrderedVersions(a, b, globalDefault) {
  * views leave the cap unset and show every blocking window.
  */
 const OVERVIEW_MAX_USAGE_WINDOWS = 2;
-/** Fixed width for the last-active column ("just now", "8h ago", "2d ago"). */
-const LAST_ACTIVE_COL_WIDTH = 10;
 /**
  * Join fixed view columns with a consistent two-space gutter. Empty trailing
  * columns are dropped so a row without an auth chip does not grow a dangling
@@ -312,22 +316,6 @@ function renderHostClisSection(cwd) {
         console.log(`  ${chalk.red('error')}      ${chalk.gray(err.file)}: ${chalk.gray(err.reason)}`);
     }
 }
-/**
- * A compact live-auth chip for a version row, read from the fleet auth-health
- * cache (written by `agents fleet ping` / the daemon). Empty when the install
- * hasn't been probed — this is the local "signed in" flag's ground-truth
- * companion: ● live, ○ revoked (re-login), ◐ unverified/limited, plus its age.
- */
-function liveAuthChip(cache, host, agentId, version) {
-    const h = cache[authCacheKey(host, agentId, version)];
-    if (!h)
-        return '';
-    const glyph = h.verdict === 'live' ? chalk.green('●')
-        : h.verdict === 'revoked' ? chalk.red('○')
-            : h.verdict === 'expired' ? chalk.yellow('○')
-                : chalk.yellow('◐');
-    return `${glyph} ${chalk.gray(formatCheckedAge(h.checkedAt))}`;
-}
 async function showInstalledVersions(filterAgentId, viewOpts) {
     const spinnerText = filterAgentId
         ? `Checking ${agentLabel(filterAgentId)} agents...`
@@ -378,9 +366,6 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
         }
     }
     // Shim healing is silent — users don't need to know about internal repairs
-    const selfHost = machineId();
-    // Read the auth-health cache once (not per version row — see the batching note above).
-    const authCache = readAuthHealthCache();
     // Pre-fetch account info for all versions in parallel. Spinner stays up through
     // account + usage so a multi-account cold path doesn't leave a blank terminal
     // after "Checking…" vanishes (the hang the screenshots caught).
@@ -548,7 +533,7 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 const info = rawInfo ? mergeCanonical(rawInfo) : undefined;
                 const usageKey = getUsageLookupKey(info);
                 const usageInfo = usageKey ? usageByKey.get(usageKey) : undefined;
-                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, !!info?.signedIn, usageInfo, usageWindowCap));
+                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, !!info?.signedIn, usageInfo, usageWindowCap, v));
                 maxUsageWidth = Math.max(maxUsageWidth, stringWidth(usageStr));
                 const statusStr = formatUsageStatusBadge(info?.usageStatus);
                 maxStatusWidth = Math.max(maxStatusWidth, stringWidth(statusStr));
@@ -608,11 +593,12 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 }
                 const hasEmail = !!vInfo?.email;
                 const signedIn = !!vInfo?.signedIn;
-                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, signedIn, usageInfo, usageWindowCap));
+                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, signedIn, usageInfo, usageWindowCap, version));
                 const hasUsage = usageStr.length > 0;
                 // Only show lastActive for versions with an actual logged-in account.
                 // Otherwise it reflects install time (misleading "just now" for fresh installs).
-                const activeStr = vInfo && hasEmail ? formatLastActive(vInfo.lastActive) : '';
+                const lastActive = vInfo && hasEmail ? formatLastActive(vInfo.lastActive) : '';
+                const activeStr = lastActive;
                 const hasActive = activeStr.length > 0;
                 // The model now has its own column above; keep only the run mode here.
                 const runDefaults = resolveRunDefaults(agentId, version);
@@ -649,16 +635,12 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                         const statusStr = formatUsageStatusBadge(vInfo?.usageStatus);
                         parts.push(padToWidth(statusStr, maxStatusWidth));
                     }
-                    // Fixed-width lastActive so the auth chip (●/○/◐) lines up even when
-                    // some rows have no email-derived lastActive.
-                    parts.push(hasActive ? padToWidth(activeStr, LAST_ACTIVE_COL_WIDTH) : ' '.repeat(LAST_ACTIVE_COL_WIDTH));
+                    if (hasActive)
+                        parts.push(activeStr);
                 }
                 if (runDefaultBits.length > 0) {
                     parts.push(chalk.gray(`run ${runDefaultBits.join(' ')}`));
                 }
-                const authChip = liveAuthChip(authCache, selfHost, agentId, version);
-                if (authChip)
-                    parts.push(authChip);
                 console.log(joinViewColumns(parts));
                 if (showPaths) {
                     const versionDir = getVersionDir(agentId, version);
@@ -747,7 +729,8 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             const gUsageKey = getUsageLookupKey(gInfo);
             const gUsage = gUsageKey ? usageByKey.get(gUsageKey) : undefined;
             const gUsageStr = formatUsageSummary(gInfo?.plan || null, gUsage?.snapshot || null, 3, viewUsageSummaryOptions(agentId, !!gInfo?.signedIn, gUsage, usageWindowCap));
-            const gActiveStr = gInfo ? formatLastActive(gInfo.lastActive) : '';
+            const gLastActive = gInfo ? formatLastActive(gInfo.lastActive) : '';
+            const gActiveStr = gLastActive;
             if (gInfo?.email || gUsageStr || gActiveStr || gInfo?.signedIn) {
                 const gDisplay = accountColumnLabel(gInfo);
                 parts.push(gDisplay ? chalk.cyan(padToWidth(gDisplay, gMaxEmail)) : ' '.repeat(gMaxEmail));
@@ -758,7 +741,7 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 parts.push(padToWidth(formatUsageStatusBadge(gInfo?.usageStatus), gMaxStatusWidth));
             }
             if (gActiveStr)
-                parts.push(padToWidth(gActiveStr, LAST_ACTIVE_COL_WIDTH));
+                parts.push(gActiveStr);
             console.log(joinViewColumns(parts));
             if (showPaths && cliState?.path) {
                 console.log(chalk.gray(`      ${cliState.path}`));

package/dist/index.d.ts

@@ -14,6 +14,7 @@
  *   - `__vault-age-helper`
  *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
  *   - `__shim`
+ *   - `__claude-statusline`
  *   - `__daemon-run`
  *
  * The tokens are imported from the leaf module sync-commands.ts — the SAME

package/dist/index.js

@@ -14,6 +14,7 @@
  *   - `__vault-age-helper`
  *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
  *   - `__shim`
+ *   - `__claude-statusline`
  *   - `__daemon-run`
  *
  * The tokens are imported from the leaf module sync-commands.ts — the SAME
@@ -70,6 +71,10 @@ if (process.argv[2] === '__shim') {
     const code = await execShimPassthrough(agent, rawArgs, process.cwd(), pinned || undefined);
     process.exit(code);
 }
+if (process.argv[2] === '__claude-statusline') {
+    const { runClaudeStatusLine } = await import('./lib/claude-statusline.js');
+    process.exit(await runClaudeStatusLine());
+}
 if (process.argv[2] === '__daemon-run') {
     const { runDaemon, log: daemonLog } = await import('./lib/daemon/daemon.js');
     // RUSH-2418: the daemon is the one always-on process here, and it ran with no

package/dist/lib/accounting/usage.d.ts

@@ -125,6 +125,8 @@ export interface UsageSnapshot {
     capturedAt: Date | null;
     windows: UsageWindow[];
     plan?: string | null;
+    /** Action that makes an event-fed source emit a current reading. */
+    refreshHint?: string | null;
     /**
      * A refusal observed from a real harness run, independent of API windows.
      * `session_limit` recovers on a clock (`resetsAt`). `out_of_credits` is a
@@ -306,6 +308,11 @@ export interface FormatUsageSummaryOpts {
      * column width; single-agent and detail views leave this unset.
      */
     maxWindows?: number;
+    /** Windows that must keep a visible slot even when the provider omits one. */
+    expectedWindows?: Array<{
+        key: string;
+        shortLabel: string;
+    }>;
     /**
      * The classified cause of `usageInfo.error` (RUSH-3040), from
      * {@link classifyUsageErrorKind}. Lets the no-bars branch below name the
@@ -326,6 +333,8 @@ export interface FormatUsageSummaryOpts {
     errorDetail?: string | null;
     /** Benign state from {@link getUsageBenignState}; never sourced from `UsageInfo.error`. */
     benignState?: UsageBenignState | null;
+    /** Provider-specific replacement for the generic no-local-event marker. */
+    noRecentUsageLabel?: string | null;
 }
 /** Format a one-line usage summary with compact bars for inline display. */
 export declare function formatUsageSummary(plan: string | null, snapshot: UsageSnapshot | null, planWidth?: number, opts?: FormatUsageSummaryOpts): string;
@@ -552,7 +561,7 @@ export declare function normalizeDroidWindows(data: DroidBillingLimitsResponse):
  * a file-based setup-token and, when none is provisioned, gets `null` — it never
  * reads Claude Code's interactive login (transmitting that ACL-bound OAuth token
  * to Anthropic's API is what gets it revoked; see the branch body and
- * docs/credential-management.md). It is OFF by default so full-credential
+ * docs/secrets.md). It is OFF by default so full-credential
  * callers that refresh (`isClaudeAuthValid` -> `getClaudeAccessToken`) still
  * read the interactive login. Rush Cloud dispatch does not call this helper
  * at all (SING-1b: the account manifest is email-only; RUSH-2359 removed the
@@ -588,6 +597,8 @@ export declare function readClaudeUsageCache(usageKey: string, cachePath?: strin
 export declare function pruneExpiredClaudeUsageCacheEntry(usageKey: string, cachePath?: string, now?: Date): void;
 /** Write a usage snapshot to the on-disk cache. */
 export declare function writeClaudeUsageCache(usageKey: string, snapshot: UsageSnapshot, cachePath?: string): void;
+/** Atomically merge partial native Claude windows into the current fresh row. */
+export declare function mergeClaudeUsageCacheWindows(usageKey: string, snapshot: UsageSnapshot, cachePath?: string): void;
 /**
  * Persist a Claude tokens/credits exhaustion (`out of usage credits` / `monthly
  * spend limit`) from a real run. Unlike a rate/session limit this does NOT reset
@@ -614,8 +625,8 @@ export declare function parseClaudeSessionLimitReset(text: string, nowMs?: numbe
  * Returns true only when a valid access token can be obtained.
  */
 export declare function isClaudeAuthValid(home?: string): Promise<boolean>;
-/** Render a colored block-character progress bar. */
-export declare function renderBar(usedPercent: number, length: number, minimumVisible?: number): string;
+/** Render a proportional colored progress bar at one-eighth-cell resolution. */
+export declare function renderBar(usedPercent: number, length: number): string;
 /** Return a chalk color function based on the usage percentage threshold. */
 export declare function getUsageColor(usedPercent: number): (text: string) => string;
 /** Parse the latest billing info from Grok's unified log. */

package/dist/lib/accounting/usage.js

@@ -26,6 +26,7 @@ import { getCacheDir } from '../state.js';
 import { mapBounded } from '../concurrency.js';
 import { atomicWriteFileSync, ensureLockTarget, withFileLock } from '../fs-atomic.js';
 import { withRefreshLease } from '../refresh-coordinator.js';
+import { padToWidth } from '../session/width.js';
 const execFileAsync = promisify(execFile);
 const CLAUDE_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
 const CLAUDE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
@@ -216,6 +217,7 @@ const COMPACT_BAR_LEN = 5;
 const USAGE_BAR_LEN = 10;
 const FULL = '\u2588';
 const EMPTY = '\u2591';
+const PARTIAL_BLOCKS = ['', '\u258F', '\u258E', '\u258D', '\u258C', '\u258B', '\u258A', '\u2589'];
 /** Construct the benign no-local-log result without overloading `error`. */
 export function usageNoRecentUsageInfo() {
     return { snapshot: null, error: null, [USAGE_BENIGN_STATE]: 'no-recent-usage' };
@@ -498,11 +500,20 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3, opts) {
         // multi-meter agent cannot force the whole table to wrap.
         const selected = pickCompactUsageWindows(snapshot.windows, opts?.maxWindows);
         const hidden = Math.max(0, snapshot.windows.filter((w) => w.key !== 'sonnet_week').length - selected.length);
-        const windowParts = selected.map((window) => {
+        const expected = opts?.expectedWindows;
+        const windowsToRender = expected
+            ? expected.map(({ key, shortLabel }) => ({ window: selected.find((item) => item.key === key), shortLabel }))
+            : selected.map((window) => ({ window, shortLabel: window.shortLabel }));
+        const windowParts = windowsToRender.map(({ window, shortLabel }, index) => {
+            if (!window) {
+                const missing = chalk.red(`${shortLabel}: ${FULL.repeat(COMPACT_BAR_LEN)} unavailable`);
+                return index < windowsToRender.length - 1 ? padToWidth(missing, 20) : missing;
+            }
             const bar = renderCompactUsageBar(window.usedPercent);
             const pct = colorUsage(`${Math.round(window.usedPercent)}%`, window.usedPercent);
             const reset = window.resetsAt ? chalk.dim(` (${formatResetHint(window.resetsAt)})`) : '';
-            return `${chalk.gray(`${window.shortLabel}:`)} ${bar} ${pct}${reset}`;
+            const rendered = `${chalk.gray(`${shortLabel}:`)} ${bar} ${pct}${reset}`;
+            return index < windowsToRender.length - 1 ? padToWidth(rendered, 20) : rendered;
         });
         if (hidden > 0) {
             windowParts.push(chalk.dim(`+${hidden}`));
@@ -510,6 +521,9 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3, opts) {
         if (windowParts.length > 0) {
             parts.push(windowParts.join('  '));
         }
+        else if (snapshot.refreshHint) {
+            parts.push(chalk.dim(snapshot.refreshHint));
+        }
         // The bars came from the cache and the live read that should have confirmed
         // them failed, so they are the last thing we saw — not the current state.
         // Drawing them unmarked is what let a 26h-old "48% used" read as fact.
@@ -528,7 +542,7 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3, opts) {
         parts.push(chalk.dim(USAGE_HEADLESS_SCOPE_MARKER));
     }
     else if (opts?.benignState === 'no-recent-usage') {
-        parts.push(chalk.dim(USAGE_NO_RECENT_USAGE_MARKER));
+        parts.push(chalk.dim(opts.noRecentUsageLabel || USAGE_NO_RECENT_USAGE_MARKER));
     }
     else if (opts?.unavailable) {
         // Signed-in account we could NOT fetch usage for (no live token in a reachable
@@ -1410,7 +1424,7 @@ function deleteCachedClaudeOauth(service) {
  * a file-based setup-token and, when none is provisioned, gets `null` — it never
  * reads Claude Code's interactive login (transmitting that ACL-bound OAuth token
  * to Anthropic's API is what gets it revoked; see the branch body and
- * docs/credential-management.md). It is OFF by default so full-credential
+ * docs/secrets.md). It is OFF by default so full-credential
  * callers that refresh (`isClaudeAuthValid` -> `getClaudeAccessToken`) still
  * read the interactive login. Rush Cloud dispatch does not call this helper
  * at all (SING-1b: the account manifest is email-only; RUSH-2359 removed the
@@ -1443,7 +1457,7 @@ export async function loadClaudeOauth(home, opts) {
         // interactive credential used programmatically, which Anthropic flags and
         // revokes (the fleet-wide-logout class, RUSH-1822), and which violates the
         // invariant that the interactive/rotating login is untouchable
-        // (docs/credential-management.md). Report unprovisioned (-> probe
+        // (docs/secrets.md). Report unprovisioned (-> probe
         // token 'missing' -> auth-health 'unconfigured', benign for rotation); seed a
         // setup-token via the mint-auth path to restore usage/probe for the account.
         return null;
@@ -1604,6 +1618,32 @@ export function writeClaudeUsageCache(usageKey, snapshot, cachePath = getClaudeU
         /* best-effort cache write — lock busy or disk full */
     }
 }
+/** Atomically merge partial native Claude windows into the current fresh row. */
+export function mergeClaudeUsageCacheWindows(usageKey, snapshot, cachePath = getClaudeUsageCachePath()) {
+    try {
+        ensureLockTarget(cachePath, '{}');
+        withFileLock(cachePath, () => {
+            const cache = readClaudeUsageCacheFile(cachePath);
+            const prior = cache[usageKey];
+            const priorSnapshot = prior
+                ? deserializeClaudeUsageSnapshot(prior, snapshot.capturedAt ?? new Date())
+                : null;
+            const windows = new Map(priorSnapshot?.windows.map((window) => [window.key, window]) ?? []);
+            for (const window of snapshot.windows)
+                windows.set(window.key, window);
+            cache[usageKey] = serializeClaudeUsageSnapshot({
+                ...snapshot,
+                windows: [...windows.values()],
+                plan: snapshot.plan ?? priorSnapshot?.plan ?? null,
+                unavailable: carryForwardUnavailable(prior?.unavailable, snapshot.unavailable),
+            });
+            atomicWriteFileSync(cachePath, JSON.stringify(cache, null, 2), 'utf-8');
+        });
+    }
+    catch {
+        /* best-effort cache write — lock busy or disk full */
+    }
+}
 /** Read the entire usage cache file from disk. */
 function readClaudeUsageCacheFile(cachePath) {
     if (!fs.existsSync(cachePath)) {
@@ -1632,6 +1672,7 @@ function serializeClaudeUsageSnapshot(snapshot) {
     return {
         capturedAt: snapshot.capturedAt?.toISOString() || null,
         plan: snapshot.plan ?? null,
+        refreshHint: snapshot.refreshHint ?? null,
         unavailable: snapshot.unavailable
             ? {
                 reason: snapshot.unavailable.reason,
@@ -1686,7 +1727,7 @@ function deserializeClaudeUsageSnapshot(snapshot, now) {
     // and `deriveUsageStatusFromSnapshot` still returns null for zero windows, so
     // it can never read as a 0% bar or an "available" badge (the RUSH-2858
     // property that made expired windows drop in the first place).
-    if (windows.length === 0 && !unavailable && !snapshot.plan) {
+    if (windows.length === 0 && !unavailable && !snapshot.plan && !snapshot.refreshHint) {
         return null;
     }
     return {
@@ -1695,6 +1736,7 @@ function deserializeClaudeUsageSnapshot(snapshot, now) {
         capturedAt,
         windows,
         plan: snapshot.plan ?? null,
+        refreshHint: snapshot.refreshHint ?? null,
         unavailable,
     };
 }
@@ -1973,14 +2015,17 @@ function renderUsageBar(usedPercent) {
 }
 /** Render a compact usage bar for inline summaries. */
 function renderCompactUsageBar(usedPercent) {
-    return renderBar(usedPercent, COMPACT_BAR_LEN, usedPercent > 0 ? 1 : 0);
-}
-/** Render a colored block-character progress bar. */
-export function renderBar(usedPercent, length, minimumVisible = 0) {
-    const rounded = Math.round((usedPercent / 100) * length);
-    const filled = Math.max(minimumVisible, Math.max(0, Math.min(length, rounded)));
+    return renderBar(usedPercent, COMPACT_BAR_LEN);
+}
+/** Render a proportional colored progress bar at one-eighth-cell resolution. */
+export function renderBar(usedPercent, length) {
+    const clamped = Math.max(0, Math.min(100, usedPercent));
+    const eighths = Math.round((clamped / 100) * length * 8);
+    const filled = Math.floor(eighths / 8);
+    const partial = eighths % 8;
     const color = getUsageColor(usedPercent);
-    return color(FULL.repeat(filled)) + chalk.dim(EMPTY.repeat(length - filled));
+    const gauge = FULL.repeat(filled) + PARTIAL_BLOCKS[partial];
+    return color(gauge) + chalk.dim(EMPTY.repeat(length - filled - (partial > 0 ? 1 : 0)));
 }
 /** Apply the appropriate color to a text string based on usage percentage. */
 function colorUsage(text, usedPercent) {
@@ -2080,10 +2125,10 @@ async function getGrokUsageInfo(options) {
         // (see readLatestGrokBilling).
         const now = new Date();
         const windows = match.windows.filter((window) => isCachedUsageWindowFresh(window, match.capturedAt, now));
-        // NOTE: an empty `windows` here (all windows expired) still returns a real
-        // snapshot, not the no-recent-usage marker — the plan/tier is still valid
-        // and callers (e.g. `formatUsageSummary`) render "no bars" correctly from
-        // an empty array. The marker above is only for "nothing was ever recorded".
+        const version = options?.cliVersion;
+        const refreshHint = windows.length === 0
+            ? `run grok${version ? `@${version}` : ''} once to refresh usage`
+            : null;
         return {
             snapshot: {
                 source: 'last_seen',
@@ -2091,6 +2136,7 @@ async function getGrokUsageInfo(options) {
                 capturedAt: match.capturedAt,
                 windows,
                 plan: match.subscriptionTier,
+                refreshHint,
             },
             error: null,
         };
@@ -2483,7 +2529,7 @@ export function normalizeCursorUsageSummary(data) {
 function readCursorCredentials(base) {
     try {
         const cfgPath = path.join(base, '.cursor', 'cli-config.json');
-        const authPath = path.join(base, '.config', 'cursor', 'auth.json');
+        const authPath = path.join(base, '.cursor', 'auth.json');
         if (!fs.existsSync(cfgPath) || !fs.existsSync(authPath))
             return null;
         const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));

package/dist/lib/agent-spec/agents.js

@@ -1504,12 +1504,9 @@ const CREDENTIAL_FILE_SEGMENTS = {
     // Muse Code stores OAuth / API credentials at ~/.config/muse/auth.json
     // (or META_API_KEY in the environment, which is not a file).
     muse: [['.config', 'muse', 'auth.json']],
-    // Cursor's OAuth token — the login gate — is at $XDG_CONFIG_HOME/cursor/auth.json
-    // (~/.config/cursor/auth.json by default). cli-config.json holds only account
-    // metadata; the token file is what a real launch authenticates from, so a
-    // version home with no token of its own is genuinely logged out once runs pin
-    // XDG_CONFIG_HOME per home (see buildExecEnv).
-    cursor: [['.config', 'cursor', 'auth.json']],
+    // With AGENT_CLI_CREDENTIAL_STORE=file, Cursor stores both OAuth tokens at
+    // ~/.cursor/auth.json. cli-config.json holds account metadata only.
+    cursor: [['.cursor', 'auth.json']],
 };
 /** Whether an agent's credential file exists under a given home. */
 function credentialFileExistsUnder(agentId, home) {
@@ -2112,7 +2109,7 @@ export async function getAccountInfo(agentId, home) {
             case 'cursor': {
                 // Cursor CLI keeps account metadata in ~/.cursor/cli-config.json
                 // (authInfo: { email, userId, authId }) and its OAuth tokens SEPARATELY
-                // in ~/.config/cursor/auth.json ({ accessToken, refreshToken }). Presence
+                // in ~/.cursor/auth.json ({ accessToken, refreshToken }). Presence
                 // of an access token is the signed-in signal; email/ids come from
                 // cli-config. authId is the OAuth subject (e.g. "google-oauth2|<n>") — the
                 // same value the usage endpoint keys on (see getCursorUsageInfo).
@@ -2126,7 +2123,7 @@ export async function getAccountInfo(agentId, home) {
                     const accountId = normalizeIdentityPart(authInfo?.authId ?? authInfo?.userId);
                     if (!email && !accountId)
                         return { ...empty, lastActive };
-                    const authPath = resolveAccountCredentialPath(base, '.config', 'cursor', 'auth.json');
+                    const authPath = resolveAccountCredentialPath(base, '.cursor', 'auth.json');
                     let hasToken = false;
                     if (authPath) {
                         try {
@@ -2135,8 +2132,13 @@ export async function getAccountInfo(agentId, home) {
                         }
                         catch { /* unreadable token file */ }
                     }
+                    // cli-config survives logout and may describe a different keychain
+                    // account. Without this version's file token, its identity is stale
+                    // metadata rather than a usable managed login.
+                    if (!hasToken)
+                        return { ...empty, lastActive };
                     const accountKey = buildIdentityKey(agentId, [['user', accountId]]);
-                    return { ...empty, email, accountId, accountKey, signedIn: hasToken || !!email, lastActive };
+                    return { ...empty, email, accountId, accountKey, signedIn: true, lastActive };
                 }
                 catch { }
                 return { ...empty, lastActive };