@phnx-labs/agents-cli 1.22.56 → 1.22.58

package/dist/lib/session/active.d.ts

@@ -8,14 +8,7 @@ import { type SessionProvenance } from './provenance.js';
 import { type DeviceRegistry } from '../devices/registry.js';
 import { type Presence } from './detached.js';
 import { type HostLink } from './host-link.js';
-/**
- * The owner (actor id) to show for a session in `--active`. Prefers the actor
- * recorded on the live-attribution source (the pid registry / teammate record),
- * but falls back to the durable per-session actor sidecar — written at spawn and,
- * unlike the pid entry, NOT overwritten by the SessionStart hook's own by-pid
- * write. Without this fallback a real `agents run` shows no owner whenever the
- * hook's actor-less entry wins the by-pid file (RUSH-2018 fix).
- */
+/** Prefer live actor attribution; the durable sidecar survives actor-less hook rewrites. */
 export declare function resolveOwner(pidActor: string | null | undefined, sessionId: string | undefined): string | undefined;
 /**
  * Per-PID `lsof` probes run bounded and staggered rather than as one parallel
@@ -62,7 +55,7 @@ export declare function attributedSetLostPids(prev: Set<number>, next: Set<numbe
 export declare function filterCachedUnattributed(sessions: ActiveSession[], attributed: Set<number>, alive: (pid: number, startedAtMs?: number) => boolean): ActiveSession[];
 type ActiveContext = 'terminal' | 'teams' | 'cloud' | 'headless';
 /** The SessionMeta fields the live-row backfill reads — the enrichment a running process cannot report. */
-export type BackfillMeta = Pick<SessionMeta, 'version' | 'timestamp' | 'label' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName' | 'harness'>;
+export type BackfillMeta = Pick<SessionMeta, 'version' | 'account' | 'timestamp' | 'label' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName' | 'harness'>;
 export declare function backfillActiveRowsFromMeta(sessions: ActiveSession[], metaById: Map<string, BackfillMeta>): void;
 export declare function backfillActiveRowsFromIndex(sessions: ActiveSession[]): void;
 export declare function isRunningLiveSession(s: ActiveSession): boolean;
@@ -208,6 +201,18 @@ export interface ActiveSession {
      * id (RUSH-2205), never asserted by a source.
      */
     version?: string;
+    /**
+     * Email of the account that produced the session (display-only). Like
+     * {@link version}, a running process does not report which account a
+     * `--strategy balanced` launch selected, so it is backfilled at render time
+     * from the indexed {@link SessionMeta} by session id (PHNX-3184). This is what
+     * the AGI EXT status bar renders as the session's account — it reads it off the
+     * `sessions watch --json` row instead of spawning a per-tab `agents sessions
+     * <id> --device <host> --json` (the 2026-08-25 CPU incident, agi-cli#3019).
+     * Never group on this — two orgs can share one email; group on the index's
+     * `accountKey`.
+     */
+    account?: string;
     /**
      * Last-activity epoch — the transcript's last write (mtime). Distinct from
      * {@link startedAtMs} (session START): a session begun 3h ago but last touched
@@ -830,18 +835,7 @@ export declare function sessionProcessIsLocal(s: Pick<ActiveSession, 'machine' |
  */
 export declare function sessionProcessHost(s: Pick<ActiveSession, 'machine' | 'offloadedFrom'>, self: string): string | undefined;
 export declare function foldHostLink(rows: ActiveSession[]): void;
-/**
- * The recap ladder (RUSH-3011): compute a row's shown {@link ActiveSession.title}
- * + {@link RecapSource} from the best available source, plus the cleaned first
- * prompt (`userPromptClean`/`userPromptKind`) and the `lastAgentLine`. Pure over
- * one row; exported for tests and folded in by {@link foldRecap}.
- *
- * Ladder, best-first: a `/rename`/harness `label` → the last assistant line →
- * the first-prompt topic. The `last` rung is agent-derived, so a session that
- * produced work stops showing its stale first prompt as the title. (`topic` is
- * the row's already-extracted first line, so image detection here is
- * path-based; a pure-attachment turn with no first-line text stays on `prompt`.)
- */
+/** Labels win, then the last assistant line, then the first-prompt topic. */
 export declare function deriveSessionRecap(row: Pick<ActiveSession, 'label' | 'topic' | 'tail'>): {
     title?: string;
     recapSource?: RecapSource;
@@ -851,17 +845,7 @@ export declare function deriveSessionRecap(row: Pick<ActiveSession, 'label' | 't
 };
 /** Fold the recap ladder onto every row (see {@link deriveSessionRecap}). */
 export declare function foldRecap(rows: ActiveSession[]): void;
-/**
- * True when a crash-leaked orphan is genuinely DEAD and should be reaped from the
- * reconnectable set rather than shown as resumable forever (RUSH-3011 / issue #3b).
- *
- * The gate is `abandoned` (no transcript write in {@link ABANDONED_STALE_MS}) AND
- * a dead pid — exactly "past the stale threshold whose pid is gone". A live pid
- * (an idle-but-unfinished session, the highest-risk state) is NEVER reaped, and
- * neither is a recently-`closed`/`crashed` session that just exited (still
- * resumable). `pidAlive` absent (a cloud row or an older peer that can't prove
- * death) also stays un-reaped — reaping is fail-safe, never a guess.
- */
+/** Reap only stale sessions with proven-dead pids; unknown or live processes remain recoverable. */
 export declare function isReapableOrphan(row: Pick<ActiveSession, 'status' | 'pidAlive'>): boolean;
 /**
  * Resolve each teams row's `orchestratorLabel` from the orchestrator's own row,

package/dist/lib/session/active.js

@@ -47,14 +47,7 @@ import { linearIssueUrl } from './linear.js';
 import { viewingInLabel } from './viewing-in.js';
 import { claudeProjectDirName } from '../project-key.js';
 const execFileAsync = promisify(execFile);
-/**
- * The owner (actor id) to show for a session in `--active`. Prefers the actor
- * recorded on the live-attribution source (the pid registry / teammate record),
- * but falls back to the durable per-session actor sidecar — written at spawn and,
- * unlike the pid entry, NOT overwritten by the SessionStart hook's own by-pid
- * write. Without this fallback a real `agents run` shows no owner whenever the
- * hook's actor-less entry wins the by-pid file (RUSH-2018 fix).
- */
+/** Prefer live actor attribution; the durable sidecar survives actor-less hook rewrites. */
 export function resolveOwner(pidActor, sessionId) {
     return pidActor ?? (sessionId ? readSessionActorRecord(sessionId)?.actor : undefined) ?? undefined;
 }
@@ -152,6 +145,8 @@ export function backfillActiveRowsFromMeta(sessions, metaById) {
             continue;
         if (!s.version && m.version)
             s.version = m.version;
+        if (!s.account && m.account)
+            s.account = m.account;
         if (!s.label && m.label)
             s.label = m.label;
         if (!s.ticket && m.ticketId)
@@ -476,18 +471,8 @@ export function isPidAlive(pid, startedAtMs) {
     return true;
 }
 /**
- * Read the live-terminals registry, dedupe by sessionId.
- *
- * A pid-alive entry is a live session. A pid-DEAD entry is normally noise — a
- * terminal that closed a moment ago, before its window republished — and is
- * dropped. But a dead pid whose owning window ALSO stopped republishing is the
- * signature of a crash: the window went down hard and never ran the teardown that
- * would have removed this entry. Those are KEPT, so the session reaches the
- * listing at all — it used to vanish outright, a VS Code crash simply erasing its
- * agents from `--active`. Such a row arrives as `closed` (dead pid) carrying the
- * stale `windowHeartbeatMs`, which is what {@link foldHostLink} promotes to
- * `crashed`. `pidDead` is local to the dedupe below: a live entry must win a dead
- * one for the same session.
+ * Keep dead entries only when their window heartbeat also stopped, proving a crash;
+ * a live duplicate always wins.
  */
 function readLiveTerminals() {
     let raw;
@@ -541,20 +526,8 @@ function readLiveTerminals() {
 const CLAUDE_SESSION_FILE_CACHE_MAX = 256;
 const claudeSessionFileCache = new Map();
 /**
- * Locate the active Claude session file for a process. If we know the session
- * UUID (from terminal env or team parent), prefer the exact match. Otherwise
- * fall back to the most-recent-mtime .jsonl in the project's folder.
- *
- * Searches EVERY version-home project root, not just the live `~/.claude`
- * symlink. `~/.claude` points at the currently-installed agent version; a
- * session launched under an EARLIER version keeps its transcript under that
- * version's home (`…/.history/versions/claude/<ver>/home/.claude/projects/`).
- * Resolving only `~/.claude/projects` meant that the instant a newer version
- * was installed, every still-running older-version session lost its transcript
- * here — no `sessionFile`, so no start/activity time, so `agents sessions`
- * rendered it `unknown` and the watchdog skipped it as "no activity timestamp".
- * `getAgentSessionDirs('claude','projects')` is the same version-aware enumerator
- * the rest of the CLI uses, so this stays in lockstep with discovery.
+ * Search every version home because the live ~/.claude symlink moves after upgrades
+ * while older running sessions keep writing to their original home.
  */
 function findClaudeSessionFile(cwd, sessionId) {
     // Only memoize when the exact session UUID is known. Without an id the
@@ -2080,17 +2053,7 @@ export function foldHostLink(rows) {
         }
         if (link === 'host-gone' && s.status === 'closed')
             s.status = 'crashed';
-        // Only idle/input_required are promoted — a `running` session keeps its
-        // status (SES-18a). Extending this to a running agent with no client was
-        // tried and reverted: since RUSH-3125 wraps every remote interactive run in
-        // a detached tmux pane, "running with zero attached clients" is the NORMAL
-        // steady state between check-ins, and that path writes no detach record, so
-        // `deliberatelyDetached` is false for it. Promoting it would relabel every
-        // remote agent as orphaned whenever nobody is looking — the over-reporting
-        // this file's header calls worthless. Telling a stranded agent from a
-        // healthy unattended one needs to know a client was EXPECTED and LOST, which
-        // no signal available here carries; that belongs with the peer-side pane
-        // ownership work, not this function.
+        // A clientless running remote pane is normal; only stopped work can be called orphaned.
         else if (link === 'no-client' && (s.status === 'idle' || s.status === 'input_required')) {
             s.status = 'orphaned';
         }
@@ -2103,18 +2066,7 @@ function recapLine(s, max = 120) {
         return undefined;
     return t.length > max ? t.slice(0, max - 1).trimEnd() + '…' : t;
 }
-/**
- * The recap ladder (RUSH-3011): compute a row's shown {@link ActiveSession.title}
- * + {@link RecapSource} from the best available source, plus the cleaned first
- * prompt (`userPromptClean`/`userPromptKind`) and the `lastAgentLine`. Pure over
- * one row; exported for tests and folded in by {@link foldRecap}.
- *
- * Ladder, best-first: a `/rename`/harness `label` → the last assistant line →
- * the first-prompt topic. The `last` rung is agent-derived, so a session that
- * produced work stops showing its stale first prompt as the title. (`topic` is
- * the row's already-extracted first line, so image detection here is
- * path-based; a pure-attachment turn with no first-line text stays on `prompt`.)
- */
+/** Labels win, then the last assistant line, then the first-prompt topic. */
 export function deriveSessionRecap(row) {
     const lastAgentLine = recapLine(row.tail?.length ? row.tail[row.tail.length - 1] : undefined);
     const { clean: userPromptClean, kind: userPromptKind } = classifyUserPrompt(row.topic ?? '');
@@ -2147,17 +2099,7 @@ export function foldRecap(rows) {
         s.lastAgentLine = recap.lastAgentLine;
     }
 }
-/**
- * True when a crash-leaked orphan is genuinely DEAD and should be reaped from the
- * reconnectable set rather than shown as resumable forever (RUSH-3011 / issue #3b).
- *
- * The gate is `abandoned` (no transcript write in {@link ABANDONED_STALE_MS}) AND
- * a dead pid — exactly "past the stale threshold whose pid is gone". A live pid
- * (an idle-but-unfinished session, the highest-risk state) is NEVER reaped, and
- * neither is a recently-`closed`/`crashed` session that just exited (still
- * resumable). `pidAlive` absent (a cloud row or an older peer that can't prove
- * death) also stays un-reaped — reaping is fail-safe, never a guess.
- */
+/** Reap only stale sessions with proven-dead pids; unknown or live processes remain recoverable. */
 export function isReapableOrphan(row) {
     return row.status === 'abandoned' && row.pidAlive === false;
 }

package/dist/lib/session/db.d.ts

@@ -9,10 +9,11 @@
 import Database from '../sqlite.js';
 import type { SessionAgentId, SessionEvent, SessionMeta } from './types.js';
 import { type IndexedToolCall } from './tool-calls.js';
+import { type ToolScanResumePoint } from './tool-store.js';
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/sessions.md calls the constant the source of truth). */
-export declare const SCHEMA_VERSION = 42;
+export declare const SCHEMA_VERSION = 43;
 /**
  * Bump to force the content extractor (assistant-answer text, alongside the
  * user-prompt text every harness already accumulates) to re-derive on every
@@ -35,6 +36,8 @@ export declare const CONTENT_INDEX_VERSION = 1;
 export declare const INSIGHTS_EXTRACTOR_VERSION = 7;
 /** Bump when classifyTopic's output changes so cached topics recompute (human task taxonomy v2). */
 export declare const SESSION_TOPIC_EXTRACTOR_VERSION = 2;
+/** Bump when classifyPhenotype's output changes so cached phenotypes recompute (PHNX-3327 v1). */
+export declare const SESSION_PHENOTYPE_EXTRACTOR_VERSION = 1;
 /** File stat snapshot used to detect changes between scan runs. */
 export interface ScanStamp {
     fileMtimeMs: number;
@@ -249,6 +252,13 @@ export declare function upsertSessionsBatch(entries: Array<{
     toolCalls?: IndexedToolCall[];
     toolScan?: ScanStamp;
     toolIndexMode?: 'replace' | 'append';
+    /**
+     * Where the NEXT scan of this full-file-harness session may resume its tool
+     * index (PHNX-3411). Computed internally in the enrichment map below; not
+     * supplied by callers. Persisted alongside the tool ledger so an active
+     * session re-derives only its newly appended tool calls next tick.
+     */
+    toolResume?: ToolScanResumePoint | null;
 }>): void;
 /**
  * Sync labels for a set of sessions. For each id in the map, if the stored
@@ -377,6 +387,15 @@ export declare function writeSessionTopics<T>(entries: Array<{
     fileSize: number | null;
     topic: T;
 }>): void;
+/** Read cached failure phenotypes only when their transcript byte stamps still match. */
+export declare function readSessionPhenotypes<T>(ids: string[]): Map<string, T>;
+/** Persist failure phenotypes against the exact transcript bytes used to classify them. */
+export declare function writeSessionPhenotypes<T>(entries: Array<{
+    id: string;
+    fileMtimeMs: number | null;
+    fileSize: number | null;
+    phenotype: T;
+}>): void;
 /** Read one derived preview only when it matches the transcript bytes on disk. */
 export declare function readSessionPreviewCache<T>(id: string, sourceStamp: {
     fileMtimeMs: number | null;
@@ -567,46 +586,15 @@ interface TopCostSession {
  * vanished, mirroring querySessions' liveness filter.
  */
 export declare function topSessionsByCost(n: number, options?: QueryOptions): TopCostSession[];
-/** Look up a single session by its unique ID. */
 /**
- * Batch-resolve session ids to the machine each one runs on, in ONE indexed
- * query. `getActiveSessions` needs only this column for every live row, and
- * `getSessionById` would re-`prepare` a `SELECT *` and materialize a full
- * `SessionMeta` per id to read it — mirrors {@link findSessionsByShortIds}'s
- * single-round-trip pattern. Ids absent from the index are simply absent from
- * the map. Best-effort: an unavailable DB yields an empty map, so the live view
- * still renders (the caller then leaves rows attributed to this box).
+ * Read machine attribution in batches without materializing full sessions.
+ * Failure is best-effort so the live view can still render local attribution.
  */
 export declare function findSessionMachinesByIds(ids: string[]): Map<string, string>;
 export declare function getSessionById(id: string): SessionMeta | null;
-/**
- * Resolve a full-or-partial session id against the index, exact-first then
- * prefix — the DB-backed equivalent of resolveSessionById() that runs over the
- * SQLite table instead of a pre-loaded array. Matches both the full id and the
- * short id. An exact hit short-circuits so a complete id never also drags in its
- * prefix siblings. `scope` narrows by agent / version / project (cwd) so an
- * ambiguous prefix disambiguates against the caller's context.
- *
- * Routes through the full querySessions existence check (NOT skipExistenceCheck)
- * on purpose (RUSH-2436): that check now KEEPS a file-gone session whose user
- * turns still live in session_text (flagged archived) and only suppresses a
- * contentless phantom — so `agents sessions <id>` resolves an archived session
- * instead of failing with "No session found", while a phantom id still misses.
- */
+/** Exact ids win over prefixes; the normal existence check preserves archived content but excludes phantoms. */
 export declare function findSessionsById(idQuery: string, scope?: Pick<QueryOptions, 'agent' | 'version' | 'cwd' | 'project'>): SessionMeta[];
-/**
- * Batch-resolve many 8-char short ids to their sessions in ONE indexed query.
- * The live-scan path (listTmuxAgentSessions) turns every `ag-<agent>-<shortid>`
- * tmux pane name back into a full session id this way, so it pays a single
- * `short_id IN (…)` round-trip per scan instead of N per-pane lookups.
- *
- * Returns a map keyed by short_id (lowercased). Short ids are the first 8 chars
- * of the lowercase session UUID (deriveShortId), so a lowercased `IN` matches and
- * still uses idx_sessions_short_id. When several sessions share a short id — only
- * time-ordered ids (ULID/UUIDv7) ever collide; random UUIDv4 short ids are unique
- * in practice — the most-recently-active one wins (the caller can further
- * disambiguate by cwd).
- */
+/** Batch-resolve pane short ids; on collision the most recently active session wins. */
 export declare function findSessionsByShortIds(shortIds: string[]): Map<string, SessionMeta>;
 /** A single full-text search result with ranking score. */
 interface FtsHit {

package/dist/lib/session/db.js

@@ -15,8 +15,8 @@ import { getSessionsDir, getSessionsDbPath } from '../state.js';
 import { query as queryEvents, queryToolUsageForSessions } from '../feed/events.js';
 import { machineForSessionFile } from '../origin-machine.js';
 import { loadSessionActorIndex, readSessionActorRecord } from './actor-sidecar.js';
-import { toolCallsFromEvents } from './tool-calls.js';
-import { persistToolCalls, toolEvidenceSourcePath } from './tool-store.js';
+import { scanEventToolCalls } from './tool-calls.js';
+import { persistToolCalls, planEventToolResume, toolEvidenceSourcePath } from './tool-store.js';
 import { buildClaudeAccountIndex, resolveClaudeAccount } from './claude-accounts.js';
 import { extractBackgroundShells, extractSkills, extractSlashCommands, harnessTracksBackgroundShells, isSubAgentTool, } from './highlights.js';
 import { resolveResource } from '../resources.js';
@@ -27,7 +27,7 @@ const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/sessions.md calls the constant the source of truth). */
-export const SCHEMA_VERSION = 42;
+export const SCHEMA_VERSION = 43;
 /**
  * Bump to force the content extractor (assistant-answer text, alongside the
  * user-prompt text every harness already accumulates) to re-derive on every
@@ -207,6 +207,11 @@ CREATE TABLE IF NOT EXISTS tool_calls (
   ordinal INTEGER NOT NULL,
   source_call_id TEXT,
   timestamp TEXT NOT NULL,
+  -- When the call's RESULT record arrived (its own end time). end_timestamp
+  -- minus timestamp is the call's own blocking duration, which the traces
+  -- insight engine attributes as a failed call's wasted time (PHNX-3437). NULL
+  -- for a call that never produced a result and for rows an older extractor stored.
+  end_timestamp TEXT,
   tool TEXT NOT NULL,
   input TEXT NOT NULL,
   outcome TEXT NOT NULL,
@@ -352,6 +357,26 @@ CREATE TABLE IF NOT EXISTS session_topics (
   topic_json TEXT NOT NULL
 );
 
+-- Derived failure phenotype for traces sync (PHNX-3327). Like session_topics /
+-- session_insights, this is a lazy, stamp-validated cache keyed on
+-- (file_mtime_ms, file_size) and intentionally independent of SCHEMA_VERSION.
+-- Classifying a phenotype needs the full derived SessionTrajectory (ordered
+-- steps, gaps), which buildIndexShard does NOT have from flat tool_calls rows —
+-- so it is computed per-session ONCE (parse -> trajectory -> classify) and cached
+-- here, then read for the WHOLE corpus on every sync. That is what lets the
+-- phenotype grouping dimension fold two identically-signatured sessions into one
+-- cluster regardless of which incremental batch each was first synced in, without
+-- re-parsing transcripts at 10k+ session scale. phenotype_json holds
+-- { phenotype: FailurePhenotype | null } (null = no failure phenotype matched).
+CREATE TABLE IF NOT EXISTS session_phenotypes (
+  session_id TEXT PRIMARY KEY,
+  file_mtime_ms INTEGER,
+  file_size INTEGER,
+  extractor_version INTEGER NOT NULL,
+  computed_at INTEGER NOT NULL,
+  phenotype_json TEXT NOT NULL
+);
+
 -- Normalized data behind sessions preview. Like session_insights this is a
 -- lazy, stamp-validated cache: opening one session parses only that transcript,
 -- while subsequent processes reuse the derived preview until its bytes change.
@@ -437,7 +462,12 @@ CREATE INDEX IF NOT EXISTS idx_computer_sessions_started ON computer_sessions(st
 export const INSIGHTS_EXTRACTOR_VERSION = 7;
 /** Bump when classifyTopic's output changes so cached topics recompute (human task taxonomy v2). */
 export const SESSION_TOPIC_EXTRACTOR_VERSION = 2;
-const PREVIEW_EXTRACTOR_VERSION = 1;
+// Bumped to 2 (PHNX-2973): the digest now carries `changedFiles` (per-file
+// paths). Bumping invalidates v1 cache rows so a fresh recompute populates the
+// new field instead of serving a stale digest that predates it.
+const PREVIEW_EXTRACTOR_VERSION = 2;
+/** Bump when classifyPhenotype's output changes so cached phenotypes recompute (PHNX-3327 v1). */
+export const SESSION_PHENOTYPE_EXTRACTOR_VERSION = 1;
 let dbInstance = null;
 /**
  * Apply schema migrations from `fromVersion` → SCHEMA_VERSION. The new
@@ -1152,6 +1182,29 @@ function migrateSchema(db, fromVersion) {
         // Claude/Codex resumable continuation) stay intact for rows that don't
         // need a full reparse for any OTHER reason.
     }
+    if (fromVersion < 43) {
+        // v42 -> v43: persist a per-tool-call END timestamp (PHNX-3437). The traces
+        // insight engine could only book a failed call's wasted time from the
+        // bounded gap to the NEXT call — so a call that BLOCKED for minutes and was
+        // the last in its session (or was followed quickly by an unrelated call)
+        // registered as ~0 waste. The call's result record already carried its own
+        // timestamp at ingestion; this column persists it so `end_timestamp -
+        // timestamp` (the call's own blocking duration) becomes the primary
+        // attribution, with the gap heuristic kept as the fallback for NULL rows.
+        //
+        // Additive, nullable column — no ledger flush (the v33->v34 contract that
+        // adding a column keeps warm session ledgers warm). Pre-upgrade rows stay
+        // NULL until re-indexed, and `insights.ts` degrades a NULL end back to the
+        // bounded-gap behavior, so nothing crashes or yields NaN. The paired
+        // TOOL_INDEX_VERSION bump (7 -> 8) is what re-derives it on a re-index; the
+        // tool index is deliberately independent of SCHEMA_VERSION and is never
+        // force-rescanned by a migration (only by the explicit tool backfill or a
+        // normal incremental append), so a bare ALTER here would otherwise leave
+        // existing rows dark forever.
+        const cols = new Set(db.prepare(`PRAGMA table_info(tool_calls)`).all().map((c) => c.name));
+        if (!cols.has('end_timestamp'))
+            db.exec(`ALTER TABLE tool_calls ADD COLUMN end_timestamp TEXT`);
+    }
 }
 /**
  * Stamp `account_key` / `account_org` / `account` on every Claude row from its
@@ -2123,6 +2176,21 @@ export function upsertSessionsBatch(entries) {
             // metadata fall back to exactly one normalized parse here.
             const events = entry.events ?? parseSession(entry.meta.filePath, entry.meta.agent);
             writeResourceUsage(entry.meta.id, events, entry.meta.cwd);
+            // Resume the tool index from the last scan of this append-only stream when
+            // it is safe to (PHNX-3411). A live session's transcript grows every tick,
+            // so a full re-derive re-sanitizes its ENTIRE tool history each time — the
+            // synchronous O(session) work that wedged the daemon event loop for the
+            // 11 non-streaming harnesses. `planEventToolResume` returns the prior
+            // snapshot only when the file is still an append of what was scanned
+            // before; otherwise `prior` is null and this is a full replace from
+            // event 0 (identical index, just re-derived).
+            // No tool stamp (a scanner that carried no scan record) means the resume
+            // point cannot be size-guarded, so full-scan rather than trust a stale
+            // offset. persistToolCalls below also skips a resume-less write.
+            const prior = toolScan
+                ? planEventToolResume(db, entry.meta.id, toolSourcePath, toolScan, events.length)
+                : null;
+            const scanned = scanEventToolCalls(events, prior ?? undefined);
             return {
                 ...entry,
                 meta: {
@@ -2131,11 +2199,14 @@ export function upsertSessionsBatch(entries) {
                     recentDirectoriesTouched: extractRecentDirectoriesTouched(events, entry.meta.cwd),
                     ...fanOutCounts(events, entry.meta.agent),
                 },
-                toolCalls: toolCallsFromEvents(events),
+                // The CHANGED calls only. On a resume these are the newly appended tail
+                // (append-safe upsert); on a full scan they are the whole history.
+                toolCalls: scanned.calls,
                 toolScan,
-                // These are complete event arrays, not an appended tail. Append would
-                // duplicate existing evidence even when persistToolCalls supports it.
-                toolIndexMode: 'replace',
+                toolIndexMode: (prior ? 'append' : 'replace'),
+                // Persist where the NEXT scan resumes: the collector snapshot + how many
+                // events this scan folded.
+                toolResume: { parserState: JSON.stringify(scanned.snapshot), parsedOffset: scanned.eventCount },
             };
         }
         catch {
@@ -2284,7 +2355,13 @@ export function upsertSessionsBatch(entries) {
         if (!toolScan || !entry.toolCalls)
             continue;
         try {
-            persistToolCalls(db, entry.meta, entry.toolCalls, toolScan, { mode: entry.toolIndexMode ?? 'replace' });
+            // `resume` is set only by the full-file harness path above; claude/codex
+            // pass none, so their tool ledger keeps carrying no event-offset resume
+            // point (their resume rides the content-scan ledger instead) — unchanged.
+            persistToolCalls(db, entry.meta, entry.toolCalls, toolScan, {
+                mode: entry.toolIndexMode ?? 'replace',
+                resume: entry.toolResume,
+            });
         }
         catch {
             // Boundary is intentionally retryable via tool_scan_ledger.
@@ -2950,6 +3027,59 @@ export function writeSessionTopics(entries) {
         }
     })();
 }
+/** Read cached failure phenotypes only when their transcript byte stamps still match. */
+export function readSessionPhenotypes(ids) {
+    const db = getDB();
+    const out = new Map();
+    if (ids.length === 0)
+        return out;
+    const CHUNK = 400;
+    for (let i = 0; i < ids.length; i += CHUNK) {
+        const chunk = ids.slice(i, i + CHUNK);
+        const placeholders = chunk.map(() => '?').join(',');
+        const rows = db.prepare(`
+      SELECT sp.session_id AS id, sp.phenotype_json AS phenotypeJson
+      FROM session_phenotypes sp
+      JOIN sessions s ON s.id = sp.session_id
+      WHERE sp.session_id IN (${placeholders})
+        AND sp.extractor_version = ?
+        AND sp.file_mtime_ms IS s.file_mtime_ms
+        AND sp.file_size IS s.file_size
+    `).all(...chunk, SESSION_PHENOTYPE_EXTRACTOR_VERSION);
+        for (const row of rows) {
+            try {
+                out.set(row.id, JSON.parse(row.phenotypeJson));
+            }
+            catch {
+                // Invalid derived cache data is a miss and self-heals on the next write.
+            }
+        }
+    }
+    return out;
+}
+/** Persist failure phenotypes against the exact transcript bytes used to classify them. */
+export function writeSessionPhenotypes(entries) {
+    if (entries.length === 0)
+        return;
+    const db = getDB();
+    const stmt = db.prepare(`
+    INSERT INTO session_phenotypes
+      (session_id, file_mtime_ms, file_size, extractor_version, computed_at, phenotype_json)
+    VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(session_id) DO UPDATE SET
+      file_mtime_ms = excluded.file_mtime_ms,
+      file_size = excluded.file_size,
+      extractor_version = excluded.extractor_version,
+      computed_at = excluded.computed_at,
+      phenotype_json = excluded.phenotype_json
+  `);
+    const now = Date.now();
+    db.transaction(() => {
+        for (const entry of entries) {
+            stmt.run(entry.id, entry.fileMtimeMs, entry.fileSize, SESSION_PHENOTYPE_EXTRACTOR_VERSION, now, JSON.stringify(entry.phenotype));
+        }
+    })();
+}
 /** Read one derived preview only when it matches the transcript bytes on disk. */
 export function readSessionPreviewCache(id, sourceStamp) {
     const row = getDB().prepare(`
@@ -3390,15 +3520,9 @@ export function topSessionsByCost(n, options = {}) {
         durationMs: r.duration_ms ?? 0,
     }));
 }
-/** Look up a single session by its unique ID. */
 /**
- * Batch-resolve session ids to the machine each one runs on, in ONE indexed
- * query. `getActiveSessions` needs only this column for every live row, and
- * `getSessionById` would re-`prepare` a `SELECT *` and materialize a full
- * `SessionMeta` per id to read it — mirrors {@link findSessionsByShortIds}'s
- * single-round-trip pattern. Ids absent from the index are simply absent from
- * the map. Best-effort: an unavailable DB yields an empty map, so the live view
- * still renders (the caller then leaves rows attributed to this box).
+ * Read machine attribution in batches without materializing full sessions.
+ * Failure is best-effort so the live view can still render local attribution.
  */
 export function findSessionMachinesByIds(ids) {
     const out = new Map();
@@ -3429,20 +3553,7 @@ export function getSessionById(id) {
     const row = db.prepare(`SELECT * FROM sessions WHERE id = ?`).get(id);
     return row ? rowToMeta(row) : null;
 }
-/**
- * Resolve a full-or-partial session id against the index, exact-first then
- * prefix — the DB-backed equivalent of resolveSessionById() that runs over the
- * SQLite table instead of a pre-loaded array. Matches both the full id and the
- * short id. An exact hit short-circuits so a complete id never also drags in its
- * prefix siblings. `scope` narrows by agent / version / project (cwd) so an
- * ambiguous prefix disambiguates against the caller's context.
- *
- * Routes through the full querySessions existence check (NOT skipExistenceCheck)
- * on purpose (RUSH-2436): that check now KEEPS a file-gone session whose user
- * turns still live in session_text (flagged archived) and only suppresses a
- * contentless phantom — so `agents sessions <id>` resolves an archived session
- * instead of failing with "No session found", while a phantom id still misses.
- */
+/** Exact ids win over prefixes; the normal existence check preserves archived content but excludes phantoms. */
 export function findSessionsById(idQuery, scope = {}) {
     const q = idQuery.trim();
     if (!q)
@@ -3452,19 +3563,7 @@ export function findSessionsById(idQuery, scope = {}) {
         return exact;
     return querySessions({ ...scope, idPrefix: q });
 }
-/**
- * Batch-resolve many 8-char short ids to their sessions in ONE indexed query.
- * The live-scan path (listTmuxAgentSessions) turns every `ag-<agent>-<shortid>`
- * tmux pane name back into a full session id this way, so it pays a single
- * `short_id IN (…)` round-trip per scan instead of N per-pane lookups.
- *
- * Returns a map keyed by short_id (lowercased). Short ids are the first 8 chars
- * of the lowercase session UUID (deriveShortId), so a lowercased `IN` matches and
- * still uses idx_sessions_short_id. When several sessions share a short id — only
- * time-ordered ids (ULID/UUIDv7) ever collide; random UUIDv4 short ids are unique
- * in practice — the most-recently-active one wins (the caller can further
- * disambiguate by cwd).
- */
+/** Batch-resolve pane short ids; on collision the most recently active session wins. */
 export function findSessionsByShortIds(shortIds) {
     const out = new Map();
     const uniq = [...new Set(shortIds.map((s) => s.trim().toLowerCase()).filter(Boolean))];