@phnx-labs/agents-cli 1.22.47 → 1.22.50

package/dist/commands/teams.js

@@ -364,17 +364,21 @@ export function wireCloudDispatcher(mgr) {
             throw new Error(`Teammate ${a.agentId} has no cloud provider set`);
         }
         const prov = resolveProvider(a.cloudProvider);
-        const dispatchOpts = {
-            prompt: a.prompt,
-            agent: a.agentType,
-            repo: a.cloudRepo ?? undefined,
-            branch: a.cloudBranch ?? undefined,
-            model: a.model ?? undefined,
-        };
+        const dispatchOpts = cloudDispatchOptions(a);
         const cloudTask = await prov.dispatch(dispatchOpts);
         return { cloudSessionId: cloudTask.id };
     });
 }
+export function cloudDispatchOptions(agent) {
+    return {
+        prompt: agent.prompt,
+        agent: agent.agentType,
+        repo: agent.cloudRepo ?? undefined,
+        branch: agent.cloudBranch ?? undefined,
+        model: agent.model ?? undefined,
+        env: shareRuntimeEnv(),
+    };
+}
 /**
  * Advisory: warn once per agent type of any still-pending (staged `--after`)
  * teammate whose CLI may not be signed in. Warn-only — never blocks `start`.
@@ -446,20 +450,32 @@ async function warnUnsignedTeammates(mgr, team) {
         }
     }
 }
-/** Single-wave start used by `teams start` without --watch. */
-async function runOneWave(mgr, team, json) {
+/**
+ * Single-wave start used by `teams start` without --watch. startReady()
+ * terminalizes a placement/spawn/cloud/dependency failure to FAILED with
+ * evidence rather than leaving it PENDING, so a teammate that failed this wave
+ * appears in neither `launched` nor `still_pending` — it must be diffed against
+ * the pre-wave roster and reported explicitly, or the wave reads as a success.
+ * A wave that only produced failures sets a non-zero exit code.
+ */
+export async function runOneWave(mgr, team, json) {
+    const preWavePending = new Set((await mgr.listByTask(team)).filter((a) => a.status === 'pending').map((a) => a.agentId));
     const launched = await mgr.startReady(team);
     const all = await mgr.listByTask(team);
     const stillPending = all.filter((a) => a.status === 'pending');
+    const failed = all.filter((a) => a.status === 'failed' && preWavePending.has(a.agentId));
+    if (failed.length > 0 && launched.length === 0)
+        process.exitCode = 1;
     if (json) {
         console.log(JSON.stringify({
             team,
             launched: launched.map((a) => ({ agent_id: a.agentId, name: a.name, after: a.after })),
             still_pending: stillPending.map((a) => ({ agent_id: a.agentId, name: a.name, after: a.after })),
+            failed: failed.map((a) => ({ agent_id: a.agentId, name: a.name, after: a.after, failure: a.failure })),
         }, null, 2));
         return;
     }
-    if (launched.length === 0 && stillPending.length === 0) {
+    if (launched.length === 0 && stillPending.length === 0 && failed.length === 0) {
         console.log(chalk.gray(`No pending teammates in team ${team}.`));
         return;
     }
@@ -471,6 +487,16 @@ async function runOneWave(mgr, team, json) {
             console.log(`  ${chalk.cyan(h)}  ${who}`);
         }
     }
+    if (failed.length > 0) {
+        if (launched.length > 0)
+            console.log();
+        console.log(chalk.red(`Failed this wave (${failed.length}):`));
+        for (const a of failed) {
+            const h = a.name || shortId(a.agentId);
+            const why = a.failure ? `${a.failure.code}: ${a.failure.message}` : 'no failure evidence recorded';
+            console.log(`  ${chalk.red(h)}  ${why}`);
+        }
+    }
     if (stillPending.length > 0) {
         console.log();
         console.log(chalk.gray(`Still pending (${stillPending.length}):`));
@@ -710,6 +736,9 @@ function printAgentDetail(a, session) {
     if (a.host) {
         console.log(`    ${chalk.gray('host    ')} ${chalk.cyan(a.host)}`);
     }
+    if (a.failure) {
+        console.log(`    ${chalk.red('failure ')} ${a.failure.code}: ${a.failure.message}`);
+    }
     // If the agent's internal session id differs from ours (non-Claude), show
     // it as a hint for `agents sessions <id>`.
     if (a.remote_session_id && a.remote_session_id !== a.agent_id) {
@@ -798,6 +827,9 @@ function printAgentSummary(s) {
     const tools = chalk.gray(` · ${s.tool_count} tools`);
     const hostBadge = s.host ? chalk.gray(' · on ') + chalk.cyan(s.host) : '';
     console.log(`  ${chalk.cyan(handle.padEnd(14))} ${ident.padEnd(11)} ${label}${duration}${tools}${hostBadge}${errBadge}`);
+    if (s.failure) {
+        console.log(`    ${chalk.red('failure ')} ${s.failure.code}: ${s.failure.message}`);
+    }
     // Files: counts + basenames. Read is count only.
     const fileLines = [];
     const renderCat = (label, cat) => {
@@ -1856,36 +1888,8 @@ export function registerTeamsCommands(program) {
                 return { cloudSessionId: cloudTask.id };
             });
         }
-        let cloudSessionId = null;
+        const cloudSessionId = null;
         const isStaged = after.length > 0;
-        if (cloudProviderId && !isStaged) {
-            // Ready to run now: dispatch to the cloud provider before registering
-            // the teammate so we have the remote session id up front.
-            //
-            // resolveProvider() and shareRuntimeEnv() are INSIDE the try on purpose:
-            // both read config (the cloud registry; `agents.yaml`'s share block) and
-            // both throw on a malformed one, and by this point the worktree already
-            // exists — leaving them outside stranded the branch with no catch at all.
-            try {
-                const prov = resolveProvider(cloudProviderId);
-                const dispatchOpts = {
-                    prompt: effectiveTask,
-                    agent,
-                    repo: opts.repo,
-                    branch: opts.branch,
-                    model: opts.model,
-                    env: shareRuntimeEnv(),
-                };
-                const cloudTask = await prov.dispatch(dispatchOpts);
-                cloudSessionId = cloudTask.id;
-            }
-            catch (err) {
-                // Same orphan class as a failed spawn: this add already created its
-                // worktree, so a dispatch failure must not strand the branch either.
-                await tearDownCreatedWorktree();
-                dieFriction('teams', 'cloud-dispatch-failed', `Cloud dispatch failed: ${err.message}`);
-            }
-        }
         try {
             const result = await handleSpawn(mgr, team, agent, effectiveTask, cwd, opts.mode, opts.effort, null, cwd, version, opts.name ?? null, after, opts.model ?? null, envOverrides ?? null, taskType, cloudProviderId, cloudSessionId, opts.repo ?? null, opts.branch ?? null, worktreeName, worktreePath, profileName, hostName, hostTarget, hostRepoPath, teamMeta?.project ?? null);
             emit('teams.add', { module: 'teams', team, agent, name: result.name, agent_id: result.agent_id, status: result.status });
@@ -2057,7 +2061,7 @@ export function registerTeamsCommands(program) {
     });
     // start — fire any staged teammates whose --after deps have all completed
     addHostOption(teams.command('start [team]'))
-        .description('Launch any pending teammates whose --after dependencies are satisfied. Use --watch to keep draining the DAG as teammates finish and as new tasks are added mid-flight.')
+        .description('Launch ready teammates independently. Failed launch/placement and blocked --after dependencies persist in status; --watch keeps draining viable DAG branches.')
         .option('--json', 'Output machine-readable JSON')
         .option('--watch', 'Keep running: poll every --interval seconds, fire new waves, exit when the DAG drains.')
         .option('--interval <seconds>', 'Seconds between waves in --watch mode (default 8)', '8')
@@ -2094,33 +2098,6 @@ export function registerTeamsCommands(program) {
             await warnUnsignedTeammates(mgr, team);
             await warnThrottledTeammates(mgr, team);
         }
-        // Health-/harness-aware pre-flight (RUSH-2002): if the team declares a
-        // device pool and no device in it can run a pending teammate's agent, fail
-        // loud here rather than launching a wave that strands teammates pending.
-        // --force downgrades it to a warning so the user can still try.
-        const placementError = await mgr.preflightPlacement(team);
-        if (placementError) {
-            if (isJsonMode(opts)) {
-                console.log(JSON.stringify({
-                    team,
-                    error: 'no-viable-device',
-                    message: placementError.message,
-                    excluded: placementError.excluded,
-                }));
-                if (!opts.force) {
-                    process.exitCode = 1;
-                    return;
-                }
-            }
-            else if (opts.force) {
-                console.error(chalk.yellow(`⚠ ${placementError.message}\n  Continuing anyway (--force).`));
-            }
-            else {
-                console.error(chalk.red(placementError.message));
-                process.exitCode = 1;
-                return;
-            }
-        }
         emit('teams.start', { module: 'teams', team, watch: Boolean(opts.watch) });
         if (!opts.watch) {
             await runOneWave(mgr, team, Boolean(opts.json));

package/dist/commands/traces.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerTracesCommands(program: Command): void;

package/dist/commands/traces.js

@@ -0,0 +1,188 @@
+import chalk from 'chalk';
+import { setHelpSections } from '../lib/help.js';
+import { syncTraces } from '../lib/traces/sync.js';
+import { readSyncLedger } from '../lib/traces/sync.js';
+import { managedTracesBaseUrl, resolveTracesBackend } from '../lib/traces/backend.js';
+import { showUrl } from '../lib/open-url.js';
+import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/share/config.js';
+import { PHOENIX_ID_BASE } from '../lib/identity/client.js';
+import { DEFAULT_BUCKET_NAME, DEFAULT_WORKER_NAME } from '../lib/traces/config.js';
+import { DEFAULT_TRACES_DOMAIN } from '../lib/traces/backend.js';
+import { provisionTraces } from '../lib/traces/provision.js';
+// ---------------------------------------------------------------------------
+// Help text
+// ---------------------------------------------------------------------------
+const SYNC_EXAMPLES = `
+  $ agents traces sync
+  Push this device's derived, redacted trajectories to your Phoenix account.
+
+  $ agents traces sync --limit 20
+  Sync at most 20 sessions (useful for a first run on a large fleet device).
+
+  $ agents traces sync --dry-run --out ./trace-preview
+  Compute the shards from your real sessions.db and WRITE them locally — no
+  Phoenix sign-in, no worker, no upload. Point a console at ./trace-preview to
+  see your real trajectories before wiring the hosted path.
+`.trimStart();
+const SYNC_NOTES = `
+  Reads from the local sessions.db, computes a derived SessionTrajectory (steps +
+  gaps + stats, no raw transcript text), redacts secrets, and PUTs each to
+  the agents-traces store.
+
+  An incremental gate (traces-sync.json ledger) means re-runs only upload
+  sessions whose file_mtime_ms changed since the last sync.
+
+  On a real (non-dry-run) sync with the managed Phoenix backend, also
+  fire-and-forget registers this session with Prix (api.prix.dev) so the
+  console can serve live trajectories — a link failure never blocks sync.
+
+  Sign in first with: agents auth login
+`.trimStart();
+const STATUS_EXAMPLES = `
+  $ agents traces status
+  Show what's been synced — session count and last sync time for this device.
+`.trimStart();
+const OPEN_EXAMPLES = `
+  $ agents traces open
+  Open the Phoenix Evals console for your account.
+`.trimStart();
+const SETUP_EXAMPLES = `
+  $ agents traces setup
+  Provision the private agents-traces Worker, R2 bucket, and managed domain.
+
+  $ agents traces setup --account <id> --token <token>
+  Provision non-interactively with explicit Cloudflare credentials.
+`.trimStart();
+// ---------------------------------------------------------------------------
+// Command handlers
+// ---------------------------------------------------------------------------
+async function handleSync(opts) {
+    const limit = opts.limit !== undefined ? parseInt(opts.limit, 10) : undefined;
+    const dryRun = opts.dryRun === true;
+    if (dryRun && !opts.out) {
+        console.error(chalk.red('traces sync --dry-run requires --out <dir>'));
+        process.exitCode = 1;
+        return;
+    }
+    // A dry-run computes locally and needs no Phoenix backend; a real sync does.
+    if (!dryRun) {
+        try {
+            resolveTracesBackend();
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+            return;
+        }
+    }
+    console.log(chalk.dim(dryRun ? `Computing traces locally → ${opts.out}` : 'Syncing traces…'));
+    let result;
+    try {
+        result = await syncTraces({ limit, dryRun, outDir: opts.out });
+    }
+    catch (err) {
+        console.error(chalk.red(`Sync failed: ${err.message}`));
+        process.exitCode = 1;
+        return;
+    }
+    const parts = [];
+    if (result.uploaded > 0) {
+        parts.push(chalk.green(`${result.uploaded} ${dryRun ? 'written' : 'uploaded'}`));
+    }
+    if (result.skipped > 0) {
+        parts.push(chalk.dim(`${result.skipped} skipped`));
+    }
+    if (result.errors > 0) {
+        parts.push(chalk.yellow(`${result.errors} errors`));
+    }
+    if (parts.length === 0) {
+        parts.push(chalk.dim('nothing new'));
+    }
+    console.log(parts.join(chalk.dim('  ·  ')));
+}
+async function handleStatus() {
+    const ledger = readSyncLedger();
+    if (!ledger.lastSyncMtime) {
+        console.log(chalk.dim('No sync recorded on this device. Run: agents traces sync'));
+        return;
+    }
+    const when = new Date(ledger.lastSyncMtime).toLocaleString();
+    console.log(`Last sync: ${chalk.bold(when)}`);
+    console.log(chalk.dim('Run `agents traces sync` to push new sessions.'));
+}
+async function handleOpen() {
+    // M2 console — for now open the base URL which will route to the console once deployed.
+    const url = managedTracesBaseUrl();
+    console.log(chalk.dim(`Opening ${url}`));
+    const outcome = await showUrl(url);
+    if (outcome.via === 'none') {
+        console.log(url);
+    }
+}
+async function handleSetup(opts) {
+    const { input } = await import('@inquirer/prompts');
+    const { apiToken, accountId: bundledAccountId } = readCloudflareCreds(opts.bundle, {
+        apiToken: opts.token,
+        accountId: opts.account,
+    });
+    const accountId = opts.account ?? bundledAccountId ?? await input({ message: 'Cloudflare account id' });
+    if (!accountId)
+        throw new Error('A Cloudflare account id is required.');
+    const result = await provisionTraces({
+        apiToken,
+        accountId,
+        workerName: opts.worker,
+        bucketName: opts.bucket,
+        domain: opts.domain,
+        phoenixIdBase: PHOENIX_ID_BASE,
+    });
+    console.log(chalk.green(`Traces endpoint ready → ${chalk.bold(result.baseUrl)}`));
+}
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+export function registerTracesCommands(program) {
+    const tracesCmd = program
+        .command('traces')
+        .description("Sync this device's derived, redacted trajectories to your Phoenix account");
+    const setupCmd = tracesCmd
+        .command('setup')
+        .description('Provision the private Cloudflare Worker and R2 bucket for traces')
+        .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
+        .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
+        .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
+        .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
+        .option('--token <token>', 'Cloudflare API token (else read from the --bundle)')
+        .option('--domain <host>', 'custom domain to map', DEFAULT_TRACES_DOMAIN)
+        .action(async (opts) => {
+        try {
+            await handleSetup(opts);
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+        }
+    });
+    setHelpSections(setupCmd, { examples: SETUP_EXAMPLES });
+    // sync
+    const syncCmd = tracesCmd
+        .command('sync')
+        .description('Push derived, redacted trajectories (incremental)')
+        .option('--limit <n>', 'Maximum number of sessions to sync in this run')
+        .option('--dry-run', 'Compute the shards from real sessions.db and WRITE them locally (no auth, no upload)')
+        .option('--out <dir>', 'Directory to write index.json + sessions/<id>.json (required with --dry-run)')
+        .action(handleSync);
+    setHelpSections(syncCmd, { examples: SYNC_EXAMPLES, notes: SYNC_NOTES });
+    // status
+    const statusCmd = tracesCmd
+        .command('status')
+        .description('Show last sync time for this device')
+        .action(handleStatus);
+    setHelpSections(statusCmd, { examples: STATUS_EXAMPLES });
+    // open
+    const openCmd = tracesCmd
+        .command('open')
+        .description('Open the Phoenix Evals console')
+        .action(handleOpen);
+    setHelpSections(openCmd, { examples: OPEN_EXAMPLES });
+}

package/dist/commands/view.d.ts

@@ -15,7 +15,7 @@ import type { ResourceSection, ViewJsonAgent } from '../lib/view-types.js';
 export type { ResourceItemJson, ResourceSection, SyncState, VersionResourcesJson, ViewJsonAgent, ViewJsonVersion } from '../lib/view-types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
 import { type ByokUsageResult } from '../lib/byok-usage.js';
-export declare function viewUsageSummaryOptions(agentId: AgentId, signedIn: boolean, usageInfo: UsageInfo | undefined, maxWindows: number | undefined): FormatUsageSummaryOpts;
+export declare function viewUsageSummaryOptions(agentId: AgentId, signedIn: boolean, usageInfo: UsageInfo | undefined, maxWindows: number | undefined, version?: string): FormatUsageSummaryOpts;
 /** Shared account identity formatter, re-exported for the view-specific tests. */
 export declare const accountColumnLabel: typeof accountDisplayLabel;
 /**

package/dist/commands/view.js

@@ -7,7 +7,7 @@ import * as path from 'path';
 import { AGENTS, ALL_AGENT_IDS, accountDisplayLabel, getAllCliStates, getUnmanagedCliState, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
 import { ambientClaudeToken, loginHint } from '../lib/signin-badge.js';
 import { machineId } from '../lib/machine-id.js';
-import { authCacheKey, formatCheckedAge, readAuthHealthCache } from '../lib/auth-health.js';
+import { authCacheKey, readAuthHealthCache } from '../lib/auth-health.js';
 import { agentReportsUsage, classifyUsageErrorKind, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageBenignState, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, isUsageHeadlessScopeError, } from '../lib/accounting/usage.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, isVersionIsolated, getIsolatedDefault, } from '../lib/installations/versions.js';
@@ -32,7 +32,7 @@ import { renderHarnessDetail } from './harness.js';
 import { confirm } from '@inquirer/prompts';
 import { formatPath, isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
-export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows) {
+export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows, version) {
     const headless = isUsageHeadlessScopeError(usageInfo?.error);
     const benignState = usageInfo ? getUsageBenignState(usageInfo) : null;
     return {
@@ -40,9 +40,15 @@ export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows
         unverified: !headless && !!usageInfo?.snapshot && !!usageInfo.error,
         headless,
         maxWindows,
+        expectedWindows: agentId === 'claude'
+            ? [{ key: 'session', shortLabel: 'S' }, { key: 'week', shortLabel: 'W' }]
+            : undefined,
         errorKind: classifyUsageErrorKind(usageInfo?.error),
         errorDetail: usageInfo?.error ?? null,
         benignState,
+        noRecentUsageLabel: agentId === 'grok'
+            ? `run grok${version ? `@${version}` : ''} once to refresh usage`
+            : null,
     };
 }
 /** Shared account identity formatter, re-exported for the view-specific tests. */
@@ -92,8 +98,6 @@ export function compareAccountOrderedVersions(a, b, globalDefault) {
  * views leave the cap unset and show every blocking window.
  */
 const OVERVIEW_MAX_USAGE_WINDOWS = 2;
-/** Fixed width for the last-active column ("just now", "8h ago", "2d ago"). */
-const LAST_ACTIVE_COL_WIDTH = 10;
 /**
  * Join fixed view columns with a consistent two-space gutter. Empty trailing
  * columns are dropped so a row without an auth chip does not grow a dangling
@@ -312,22 +316,6 @@ function renderHostClisSection(cwd) {
         console.log(`  ${chalk.red('error')}      ${chalk.gray(err.file)}: ${chalk.gray(err.reason)}`);
     }
 }
-/**
- * A compact live-auth chip for a version row, read from the fleet auth-health
- * cache (written by `agents fleet ping` / the daemon). Empty when the install
- * hasn't been probed — this is the local "signed in" flag's ground-truth
- * companion: ● live, ○ revoked (re-login), ◐ unverified/limited, plus its age.
- */
-function liveAuthChip(cache, host, agentId, version) {
-    const h = cache[authCacheKey(host, agentId, version)];
-    if (!h)
-        return '';
-    const glyph = h.verdict === 'live' ? chalk.green('●')
-        : h.verdict === 'revoked' ? chalk.red('○')
-            : h.verdict === 'expired' ? chalk.yellow('○')
-                : chalk.yellow('◐');
-    return `${glyph} ${chalk.gray(formatCheckedAge(h.checkedAt))}`;
-}
 async function showInstalledVersions(filterAgentId, viewOpts) {
     const spinnerText = filterAgentId
         ? `Checking ${agentLabel(filterAgentId)} agents...`
@@ -378,9 +366,6 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
         }
     }
     // Shim healing is silent — users don't need to know about internal repairs
-    const selfHost = machineId();
-    // Read the auth-health cache once (not per version row — see the batching note above).
-    const authCache = readAuthHealthCache();
     // Pre-fetch account info for all versions in parallel. Spinner stays up through
     // account + usage so a multi-account cold path doesn't leave a blank terminal
     // after "Checking…" vanishes (the hang the screenshots caught).
@@ -548,7 +533,7 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 const info = rawInfo ? mergeCanonical(rawInfo) : undefined;
                 const usageKey = getUsageLookupKey(info);
                 const usageInfo = usageKey ? usageByKey.get(usageKey) : undefined;
-                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, !!info?.signedIn, usageInfo, usageWindowCap));
+                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, !!info?.signedIn, usageInfo, usageWindowCap, v));
                 maxUsageWidth = Math.max(maxUsageWidth, stringWidth(usageStr));
                 const statusStr = formatUsageStatusBadge(info?.usageStatus);
                 maxStatusWidth = Math.max(maxStatusWidth, stringWidth(statusStr));
@@ -608,11 +593,12 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 }
                 const hasEmail = !!vInfo?.email;
                 const signedIn = !!vInfo?.signedIn;
-                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, signedIn, usageInfo, usageWindowCap));
+                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, viewUsageSummaryOptions(agentId, signedIn, usageInfo, usageWindowCap, version));
                 const hasUsage = usageStr.length > 0;
                 // Only show lastActive for versions with an actual logged-in account.
                 // Otherwise it reflects install time (misleading "just now" for fresh installs).
-                const activeStr = vInfo && hasEmail ? formatLastActive(vInfo.lastActive) : '';
+                const lastActive = vInfo && hasEmail ? formatLastActive(vInfo.lastActive) : '';
+                const activeStr = lastActive;
                 const hasActive = activeStr.length > 0;
                 // The model now has its own column above; keep only the run mode here.
                 const runDefaults = resolveRunDefaults(agentId, version);
@@ -649,16 +635,12 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                         const statusStr = formatUsageStatusBadge(vInfo?.usageStatus);
                         parts.push(padToWidth(statusStr, maxStatusWidth));
                     }
-                    // Fixed-width lastActive so the auth chip (●/○/◐) lines up even when
-                    // some rows have no email-derived lastActive.
-                    parts.push(hasActive ? padToWidth(activeStr, LAST_ACTIVE_COL_WIDTH) : ' '.repeat(LAST_ACTIVE_COL_WIDTH));
+                    if (hasActive)
+                        parts.push(activeStr);
                 }
                 if (runDefaultBits.length > 0) {
                     parts.push(chalk.gray(`run ${runDefaultBits.join(' ')}`));
                 }
-                const authChip = liveAuthChip(authCache, selfHost, agentId, version);
-                if (authChip)
-                    parts.push(authChip);
                 console.log(joinViewColumns(parts));
                 if (showPaths) {
                     const versionDir = getVersionDir(agentId, version);
@@ -747,7 +729,8 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             const gUsageKey = getUsageLookupKey(gInfo);
             const gUsage = gUsageKey ? usageByKey.get(gUsageKey) : undefined;
             const gUsageStr = formatUsageSummary(gInfo?.plan || null, gUsage?.snapshot || null, 3, viewUsageSummaryOptions(agentId, !!gInfo?.signedIn, gUsage, usageWindowCap));
-            const gActiveStr = gInfo ? formatLastActive(gInfo.lastActive) : '';
+            const gLastActive = gInfo ? formatLastActive(gInfo.lastActive) : '';
+            const gActiveStr = gLastActive;
             if (gInfo?.email || gUsageStr || gActiveStr || gInfo?.signedIn) {
                 const gDisplay = accountColumnLabel(gInfo);
                 parts.push(gDisplay ? chalk.cyan(padToWidth(gDisplay, gMaxEmail)) : ' '.repeat(gMaxEmail));
@@ -758,7 +741,7 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 parts.push(padToWidth(formatUsageStatusBadge(gInfo?.usageStatus), gMaxStatusWidth));
             }
             if (gActiveStr)
-                parts.push(padToWidth(gActiveStr, LAST_ACTIVE_COL_WIDTH));
+                parts.push(gActiveStr);
             console.log(joinViewColumns(parts));
             if (showPaths && cliState?.path) {
                 console.log(chalk.gray(`      ${cliState.path}`));

package/dist/index.d.ts

@@ -14,6 +14,7 @@
  *   - `__vault-age-helper`
  *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
  *   - `__shim`
+ *   - `__claude-statusline`
  *   - `__daemon-run`
  *
  * The tokens are imported from the leaf module sync-commands.ts — the SAME

package/dist/index.js

@@ -14,6 +14,7 @@
  *   - `__vault-age-helper`
  *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
  *   - `__shim`
+ *   - `__claude-statusline`
  *   - `__daemon-run`
  *
  * The tokens are imported from the leaf module sync-commands.ts — the SAME
@@ -70,6 +71,10 @@ if (process.argv[2] === '__shim') {
     const code = await execShimPassthrough(agent, rawArgs, process.cwd(), pinned || undefined);
     process.exit(code);
 }
+if (process.argv[2] === '__claude-statusline') {
+    const { runClaudeStatusLine } = await import('./lib/claude-statusline.js');
+    process.exit(await runClaudeStatusLine());
+}
 if (process.argv[2] === '__daemon-run') {
     const { runDaemon, log: daemonLog } = await import('./lib/daemon/daemon.js');
     // RUSH-2418: the daemon is the one always-on process here, and it ran with no

package/dist/lib/account-provider-registry.d.ts

@@ -15,4 +15,13 @@ export interface AccountProviderAdapter {
     validate(kind: AccountAuthKind, value: string): void;
 }
 export declare function getAccountProvider(provider: string): AccountProviderAdapter;
+/**
+ * Whether a provider account of kind `auth` can authenticate `agent` — i.e. the
+ * adapter has an `envFor(agent, auth)` mapping. Used both by the account UI and by
+ * the run-candidate pool so a Cursor key never enters Claude's pool and a harness
+ * with no provider adapter at all (e.g. kimi, native-login only) yields nothing.
+ * A "cannot authenticate" is a clean false; any other error (unknown provider,
+ * unsupported kind) is a real bug and re-throws rather than being swallowed.
+ */
+export declare function providerAuthenticatesHarness(provider: string, auth: AccountAuthKind, agent: AgentId): boolean;
 export declare function listAccountProviders(): string[];

package/dist/lib/account-provider-registry.js

@@ -54,6 +54,26 @@ export function getAccountProvider(provider) {
         throw new Error(`Unknown account provider '${provider}'. Supported: ${listAccountProviders().join(', ')}.`);
     return adapter;
 }
+/**
+ * Whether a provider account of kind `auth` can authenticate `agent` — i.e. the
+ * adapter has an `envFor(agent, auth)` mapping. Used both by the account UI and by
+ * the run-candidate pool so a Cursor key never enters Claude's pool and a harness
+ * with no provider adapter at all (e.g. kimi, native-login only) yields nothing.
+ * A "cannot authenticate" is a clean false; any other error (unknown provider,
+ * unsupported kind) is a real bug and re-throws rather than being swallowed.
+ */
+export function providerAuthenticatesHarness(provider, auth, agent) {
+    try {
+        getAccountProvider(provider).envFor(agent, auth);
+        return true;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes('cannot authenticate'))
+            return false;
+        throw err;
+    }
+}
 export function listAccountProviders() {
     return [...ADAPTERS.keys()].sort();
 }

package/dist/lib/accounting/account-pool-collect.d.ts

@@ -0,0 +1,34 @@
+import type { AgentId } from '../types.js';
+import { type RotateCandidate } from './rotate.js';
+import { type RegistryAccountRecord } from './account-pool.js';
+/** Inputs to {@link foldRegistryCandidates} — injectable so the fold is unit-tested. */
+export interface RunCandidateInputs {
+    native: RotateCandidate[];
+    records: RegistryAccountRecord[];
+    runVersion: string | undefined;
+}
+/**
+ * PURE: fold provider-account candidates into the native version-home list.
+ *
+ * A registry account runs in `runVersion` (the agent's default installed home);
+ * the token/key overrides that home's own login at exec, so any home works. It
+ * carries `providerAccount` so the run path routes it through the existing
+ * `--account` injection (`resolveSpawnAccount` → `accountEnv`). An account already
+ * covered by a native login is skipped by accountKey. With no installed version
+ * there is nowhere to execute a registry account, so the native list passes
+ * through unchanged.
+ */
+export declare function foldRegistryCandidates(agent: AgentId, inputs: RunCandidateInputs): RotateCandidate[];
+/**
+ * Candidate list for the `agents run` strategy pick, account-centric: the usual
+ * native version-home candidates PLUS one candidate per provider account whose
+ * provider can authenticate `agent` and whose credential is present locally
+ * (RUSH-3182). This is what makes a setup-token / API-key account balance-eligible.
+ *
+ * Passed as the `collect` argument to {@link resolveRunVersion} on the RUN path
+ * ONLY — the other consumers of {@link collectRunCandidates} (watchdog, session
+ * recovery, teams placement) keep calling it directly and are unaffected. The
+ * existing {@link pickBalancedCandidate} selects over the combined list, so the
+ * revoked / rate-limit / exhausted logic is unchanged.
+ */
+export declare function collectRunCandidatesForRun(agent: AgentId): Promise<RotateCandidate[]>;