@phnx-labs/agents-cli 1.22.66 → 1.22.69

package/dist/lib/secrets/reserved-sync.js

@@ -1,129 +1,147 @@
 /**
- * Fleet sync of the reserved file-backed `auth` bundle (PHNX-2371).
+ * Fleet sync of the reserved file-backed `auth` bundle (PHNX-2371/PHNX-3609).
  *
- * Setup-tokens drift per box when sync is manual. This module plans + executes
- * a push of the local file-backed `auth` bundle to registered devices that do
- * not yet have it, always with `--remote-backend file` and never forwarding
- * AGENTS_SECRETS_PASSPHRASE. Each destination auto-provisions its own
- * machine-local key and the push read-back-verifies decryptability.
- *
- * Double-fire: each device's daemon only writes that device's own store (the
- * destination). Two boxes that both have `auth` skip each other (already
- * present). A box without `auth` is a pull target for a provisioned peer.
- *
- * The planner is pure so tests cover every skip/push branch with no SSH.
+ * Every daemon publishes only a safe auth readiness verdict into its owned
+ * fleet-shared state file. A deterministic ready publisher reads those verdicts
+ * and transfers the actual bundle only to a peer reporting `missing`. Secret
+ * values never enter Git; the exceptional provisioning transfer remains SSH,
+ * now async and kill-bounded instead of blocking the daemon event loop.
  */
 import { AUTH_BUNDLE_NAME, inspectReservedAuthBundle } from './bundles.js';
-import { pushBundleToHost } from './push.js';
-import { loadDevicesSync } from '../devices/registry.js';
+import { pushBundleToHostAsync } from './push.js';
+import { isDialableDevice, loadDevicesSync } from '../devices/registry.js';
 import { sshTargetFor } from '../devices/connect.js';
 import { isHostPinned, isDevicePinned, managedKnownHostsPath } from '../devices/known-hosts.js';
 import { machineId, normalizeHost } from '../session/sync/config.js';
-import { probeDevice } from '../fleet/apply.js';
-export function planAuthBundlePush(localAuthOk, devices) {
+import { readFleetSharedDeviceStates, updateFleetSharedDeviceState, } from '../fleet-shared-state.js';
+import { getUserAgentsDir } from '../state.js';
+/** Each import/read-back SSH operation gets this deadline plus the SSH hard-kill grace. */
+export const AUTH_SYNC_PUSH_DEADLINE_MS = 20_000;
+export function planAuthBundlePush(localAuthOk, localIsPublisher, devices) {
     if (!localAuthOk) {
-        return devices.map((d) => ({
-            action: 'skip',
-            device: d.name,
-            reason: 'no local file-backed auth bundle',
-        }));
+        return devices.map((device) => ({ action: 'skip', device: device.name, reason: 'no local file-backed auth bundle' }));
+    }
+    if (!localIsPublisher) {
+        return devices.map((device) => ({ action: 'skip', device: device.name, reason: 'another ready device is the elected auth publisher' }));
     }
-    return devices.map((d) => {
-        if (!d.reachable)
-            return { action: 'skip', device: d.name, reason: 'unreachable' };
-        if (!d.pinned) {
-            return {
-                action: 'skip',
-                device: d.name,
-                reason: `host key not pinned; run \`agents ssh ${d.name}\` once`,
-            };
+    return devices.map((device) => {
+        if (!device.reachable)
+            return { action: 'skip', device: device.name, reason: 'unreachable' };
+        if (!device.pinned) {
+            return { action: 'skip', device: device.name, reason: `host key not pinned; run \`agents ssh ${device.name}\` once` };
         }
-        if (d.remoteHasAuth)
-            return { action: 'skip', device: d.name, reason: 'already present' };
-        return { action: 'push', device: d.name };
+        if (device.remoteAuth === 'ready')
+            return { action: 'skip', device: device.name, reason: 'already present' };
+        if (device.remoteAuth === 'invalid')
+            return { action: 'skip', device: device.name, reason: 'remote auth bundle uses the wrong backend' };
+        if (device.remoteAuth === 'unknown') {
+            return { action: 'skip', device: device.name, reason: 'no shared auth verdict has arrived from this peer' };
+        }
+        return { action: 'push', device: device.name };
     });
 }
-/**
- * Map a `fleet apply` device probe onto the auth-sync skip/push inputs.
- *
- * Presence is an own-property check on `remoteBundles` (same gate as
- * `decideSecretPush`): a missing listing, a parse failure, or a prototype
- * name must all mean "not present, so push" — never "present, so skip".
- */
-export function authPresenceFromProbe(probe) {
-    return {
-        reachable: probe.reachable,
-        remoteHasAuth: !!(probe.remoteBundles &&
-            Object.prototype.hasOwnProperty.call(probe.remoteBundles, AUTH_BUNDLE_NAME)),
-    };
-}
-/** Production default: live SSH probe of reachability + `secrets list --json`. */
-export function defaultAuthSyncProbe(device) {
-    return authPresenceFromProbe(probeDevice(device, { withSecrets: true }));
-}
 function defaultDevices() {
     return Object.values(loadDevicesSync());
 }
+function authStatus(local) {
+    if (!local.exists)
+        return 'missing';
+    return local.ok ? 'ready' : 'invalid';
+}
+/** Publish only safe readiness metadata; useful immediately before a repo push. */
+export function publishReservedAuthVerdict(options = {}) {
+    const local = (options.inspectLocal ?? inspectReservedAuthBundle)();
+    const status = authStatus(local);
+    const device = options.localName ?? machineId();
+    try {
+        const write = updateFleetSharedDeviceState(device, { auth: { status } }, options.userAgentsDir ?? getUserAgentsDir());
+        return { device, status, changed: write.changed, error: null };
+    }
+    catch (err) {
+        return { device, status, changed: false, error: err.message };
+    }
+}
 /**
- * Push the local file-backed `auth` bundle to every pinned registered device
- * that does not already have it. No-op when the local bundle is missing or on
- * the wrong backend (doctor flags that separately).
+ * Publish local readiness, elect one ready source, then asynchronously provision
+ * only peers whose shared verdict says the bundle is missing.
  */
-export function syncReservedAuthBundle(deps = {}) {
-    const inspect = deps.inspectLocal ?? inspectReservedAuthBundle;
-    const local = inspect();
-    const localOk = local.exists && local.ok;
-    const localName = normalizeHost(deps.localName ?? machineId());
-    const devices = (deps.listDevices ?? defaultDevices)().filter((d) => normalizeHost(d.name) !== localName);
+export async function syncReservedAuthBundle(deps = {}) {
+    const result = {
+        publisher: null,
+        stateChanged: false,
+        pushed: [],
+        skipped: [],
+        errors: [],
+    };
+    const published = publishReservedAuthVerdict(deps);
+    const localStatus = published.status;
+    const localName = published.device;
+    const localNorm = normalizeHost(localName);
+    const root = deps.userAgentsDir ?? getUserAgentsDir();
+    const devices = (deps.listDevices ?? defaultDevices)().filter((device) => normalizeHost(device.name) !== localNorm);
+    result.stateChanged = published.changed;
+    if (published.error)
+        result.errors.push({ device: localName, message: `could not publish auth verdict: ${published.error}` });
+    const read = readFleetSharedDeviceStates(root);
+    result.errors.push(...read.errors);
+    const stateByDevice = new Map(read.states.map((state) => [normalizeHost(state.device), state]));
+    const registered = new Map(devices.map((device) => [normalizeHost(device.name), device]));
+    const readyPublishers = read.states
+        .filter((state) => {
+        if (state.auth?.status !== 'ready')
+            return false;
+        if (normalizeHost(state.device) === localNorm)
+            return localStatus === 'ready';
+        const device = registered.get(normalizeHost(state.device));
+        // Removed and known-offline device files are stale observations, not live
+        // executors. Letting one win election would suppress provisioning forever.
+        return !!device && isDialableDevice(device);
+    })
+        .map((state) => state.device);
+    if (localStatus === 'ready' && !readyPublishers.some((name) => normalizeHost(name) === localNorm)) {
+        readyPublishers.push(localName);
+    }
+    readyPublishers.sort((a, b) => normalizeHost(a).localeCompare(normalizeHost(b)));
+    result.publisher = readyPublishers[0] ?? null;
+    const localIsPublisher = result.publisher !== null && normalizeHost(result.publisher) === localNorm;
     const pinned = deps.isPinned ?? ((name) => isHostPinned(name, managedKnownHostsPath()));
-    const probe = deps.probe ?? defaultAuthSyncProbe;
-    const plan = planAuthBundlePush(localOk, devices.map((d) => {
-        // No live probe until we know a push is even possible: missing local auth
-        // skips every device, and an unpinned host is refused before we SSH.
-        if (!localOk) {
-            return { name: d.name, reachable: true, pinned: isDevicePinned(d, pinned), remoteHasAuth: false };
-        }
-        const isPinnedDev = isDevicePinned(d, pinned);
-        if (!isPinnedDev) {
-            return { name: d.name, reachable: true, pinned: false, remoteHasAuth: false };
-        }
-        const p = probe(d);
-        return {
-            name: d.name,
-            reachable: p.reachable,
-            pinned: true,
-            remoteHasAuth: p.remoteHasAuth,
-        };
-    }));
-    const pushed = [];
-    const skipped = [];
-    const errors = [];
-    const push = deps.push ?? ((bundle, host) => pushBundleToHost(bundle, host, {
+    const plan = planAuthBundlePush(localStatus === 'ready', localIsPublisher, devices.map((device) => ({
+        name: device.name,
+        reachable: isDialableDevice(device),
+        pinned: isDevicePinned(device, pinned),
+        remoteAuth: stateByDevice.get(normalizeHost(device.name))?.auth?.status ?? 'unknown',
+    })));
+    const byName = new Map(devices.map((device) => [device.name, device]));
+    const push = deps.push ?? ((bundle, host) => pushBundleToHostAsync(bundle, host, {
         remoteBackend: 'file',
         operation: 'auth-sync',
+        agentOnly: true,
+        timeoutMs: AUTH_SYNC_PUSH_DEADLINE_MS,
     }));
     const targetOf = deps.sshTarget ?? sshTargetFor;
-    for (const item of plan) {
-        if (item.action === 'skip') {
-            skipped.push({ device: item.device, reason: item.reason });
-            continue;
-        }
-        const profile = devices.find((d) => d.name === item.device);
-        if (!profile) {
-            skipped.push({ device: item.device, reason: 'not in registry' });
-            continue;
-        }
+    const outcomes = await Promise.all(plan.map(async (item) => {
+        if (item.action === 'skip')
+            return { kind: 'skip', device: item.device, message: item.reason };
+        const profile = byName.get(item.device);
+        if (!profile)
+            return { kind: 'skip', device: item.device, message: 'not in registry' };
         try {
-            const host = targetOf(profile);
-            const out = push(AUTH_BUNDLE_NAME, host);
-            if (out.ok)
-                pushed.push(item.device);
-            else
-                errors.push({ device: item.device, message: out.message });
+            const out = await push(AUTH_BUNDLE_NAME, targetOf(profile));
+            return out.ok
+                ? { kind: 'pushed', device: item.device, message: out.message }
+                : { kind: 'error', device: item.device, message: out.message };
         }
         catch (err) {
-            errors.push({ device: item.device, message: err.message });
+            return { kind: 'error', device: item.device, message: err.message };
         }
+    }));
+    for (const outcome of outcomes) {
+        if (outcome.kind === 'pushed')
+            result.pushed.push(outcome.device);
+        else if (outcome.kind === 'skip')
+            result.skipped.push({ device: outcome.device, reason: outcome.message });
+        else
+            result.errors.push({ device: outcome.device, message: outcome.message });
     }
-    return { pushed, skipped, errors };
+    return result;
 }

package/dist/lib/session/active.d.ts

@@ -55,7 +55,7 @@ export declare function attributedSetLostPids(prev: Set<number>, next: Set<numbe
 export declare function filterCachedUnattributed(sessions: ActiveSession[], attributed: Set<number>, alive: (pid: number, startedAtMs?: number) => boolean): ActiveSession[];
 type ActiveContext = 'terminal' | 'teams' | 'cloud' | 'headless';
 /** The SessionMeta fields the live-row backfill reads — the enrichment a running process cannot report. */
-export type BackfillMeta = Pick<SessionMeta, 'version' | 'account' | 'timestamp' | 'label' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName' | 'harness' | 'tokenCount' | 'durationMs' | 'subAgentCount'>;
+export type BackfillMeta = Pick<SessionMeta, 'version' | 'account' | 'timestamp' | 'label' | 'firstUserMessage' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName' | 'harness' | 'tokenCount' | 'durationMs' | 'subAgentCount'>;
 export declare function backfillActiveRowsFromMeta(sessions: ActiveSession[], metaById: Map<string, BackfillMeta>): void;
 export declare function backfillActiveRowsFromIndex(sessions: ActiveSession[]): void;
 export declare function isRunningLiveSession(s: ActiveSession): boolean;
@@ -138,6 +138,8 @@ export interface ActiveSession {
     name?: string;
     /** First meaningful line of the initial prompt (extracted topic). */
     topic?: string;
+    /** Full, cleaned first genuine user turn, backfilled from the session index. */
+    firstUserMessage?: string;
     /**
      * The row's shown title — WHAT the session is, best-source-wins (RUSH-3011).
      * The ladder ({@link deriveSessionRecap}): a `/rename` or harness `label` →
@@ -408,6 +410,16 @@ export interface ActiveSession {
      * once a session id resolves (the id is the identity then).
      */
     paneId?: string;
+    /**
+     * The `ag-<agent>-<shortid>` tmux session name this row was discovered under,
+     * when it came from the tmux source. Kept even when the full session id could
+     * NOT be resolved (the row's `sessionId` is then absent), because the name's
+     * `<shortid>` suffix is the only stable selector such a row exposes — it is
+     * what `agents sessions --active` prints as the tmux target and what
+     * `agents sessions inject <shortid>` matches on to nudge an id-less remote
+     * session (PHNX-3688). Absent for non-tmux rows.
+     */
+    tmuxName?: string;
 }
 export declare function activeStatusFromCloudStatus(status: CloudTaskStatus): ActiveStatus;
 interface ActiveQueryOptions {

package/dist/lib/session/active.js

@@ -149,6 +149,8 @@ export function backfillActiveRowsFromMeta(sessions, metaById) {
             s.account = m.account;
         if (!s.label && m.label)
             s.label = m.label;
+        if (!s.firstUserMessage && m.firstUserMessage)
+            s.firstUserMessage = m.firstUserMessage;
         if (!s.ticket && m.ticketId)
             s.ticket = { id: m.ticketId, url: linearIssueUrl(m.ticketId) };
         if (!s.pr && m.prUrl)
@@ -1775,6 +1777,9 @@ export async function listTmuxAgentSessions() {
             // An id-less pane keys its dedupe on the unique pane, so two anonymous
             // co-located panes stay two rows instead of folding into one.
             paneId: id.sessionId ?? sessionIdFromFile(sessionFile) ? undefined : pane,
+            // The tmux session name is the one selector an id-less row still exposes —
+            // its `<shortid>` suffix is what `sessions inject` matches on (PHNX-3688).
+            tmuxName: sessName,
         }, state, sessionFile, pidAlive));
     }
     return out;

package/dist/lib/session/actor-sidecar.d.ts

@@ -7,6 +7,18 @@ export interface SessionActorRecord {
     initiatedBy?: 'human' | 'agent';
     /** Effective permissions mode used by the launcher. */
     mode?: SessionRunMode;
+    /**
+     * The agents-cli version-home id this session launched under (e.g. `2.1.207`,
+     * codex `0.146.0`) — the same namespace `listInstalledVersions` /
+     * `collectRunCandidates` use, so a native resume can pin the exact origin
+     * version. Recorded at launch by the SessionStart hook (from `AGENTS_RUN_VERSION`),
+     * because a harness coins its real session id only AFTER spawn — the same reason
+     * `mode` rides the hook rather than a spawn-time `writeSessionActorRecord`. Joined
+     * onto the session index at scan time so a session whose transcript carries no
+     * embedded/derivable version (codex's `.codex-homes/<version>/` layout) no longer
+     * degrades native resume to `/continue` for lack of a recorded origin (PHNX-3626).
+     */
+    version?: string;
     /**
      * Custom harness / profile name when launched via `agents run <profile>`
      * (e.g. `deepseek`). Joined onto the session index at scan time so a

package/dist/lib/session/actor-sidecar.js

@@ -40,6 +40,7 @@ function isSafeAlias(alias) {
 function hasRecordData(record) {
     return typeof record.actor === 'string'
         || typeof record.mode === 'string'
+        || typeof record.version === 'string'
         || typeof record.harness === 'string'
         || (Array.isArray(record.aliases) && record.aliases.some(alias => typeof alias === 'string'));
 }
@@ -84,6 +85,7 @@ export function writeSessionAliasRecord(sessionId, alias) {
             actor: previous?.actor,
             initiatedBy: previous?.initiatedBy,
             mode: previous?.mode,
+            version: previous?.version,
             harness: previous?.harness,
             aliases: normalizedAliases([...(previous?.aliases ?? []), alias]),
             startedAtMs: previous?.startedAtMs ?? Date.now(),

package/dist/lib/session/db.d.ts

@@ -13,7 +13,7 @@ import { type ToolScanResumePoint } from './tool-store.js';
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/sessions.md calls the constant the source of truth). */
-export declare const SCHEMA_VERSION = 44;
+export declare const SCHEMA_VERSION = 45;
 /**
  * Bump to force the content extractor (assistant-answer text, alongside the
  * user-prompt text every harness already accumulates) to re-derive on every
@@ -24,8 +24,13 @@ export declare const SCHEMA_VERSION = 44;
  * here backfills every existing session's assistant text on its next scan
  * without a `DELETE FROM scan_ledger` (which would also throw away the
  * resumable parser_state/content_text for Claude/Codex).
+ *
+ * v3 (PHNX-3621) invalidates OpenCode rows that merged v2 stamped before its
+ * genuine first-user-turn extractor was added.
+ * v4 (PHNX-3621 leftover) invalidates Grok rows stamped before the bounded
+ * chat_history.jsonl prefix read filled firstUserMessage.
  */
-export declare const CONTENT_INDEX_VERSION = 1;
+export declare const CONTENT_INDEX_VERSION = 4;
 /**
  * Bumping this invalidates every cached facet row without touching the schema
  * version, so a change to the extraction logic (a new metric, a corrected bucket)
@@ -620,6 +625,15 @@ export declare function findSessionMachinesByIds(ids: string[]): Map<string, str
 export declare function getSessionById(id: string): SessionMeta | null;
 /** Exact ids win over prefixes; the normal existence check preserves archived content but excludes phantoms. */
 export declare function findSessionsById(idQuery: string, scope?: Pick<QueryOptions, 'agent' | 'version' | 'cwd' | 'project'>): SessionMeta[];
+/**
+ * Upgrade a session-id crumb to the full indexed id. The 8-char hex `short_id`
+ * a "Sent from …" footer shows would 404 as a `…/console/sessions/<id>` URL, so
+ * an owner ping resolves it through the index first (PHNX-3698). A value that is
+ * already a full id (or any non-crumb shape, e.g. a native `ses_…` id), or a
+ * crumb the index cannot resolve, is returned unchanged — the caller keeps
+ * exactly what it had rather than getting a fabricated id.
+ */
+export declare function resolveFullSessionId(idOrCrumb: string | undefined): string | undefined;
 /** Batch-resolve pane short ids; on collision the most recently active session wins. */
 export declare function findSessionsByShortIds(shortIds: string[]): Map<string, SessionMeta>;
 /** A single full-text search result with ranking score. */

package/dist/lib/session/db.js

@@ -22,12 +22,13 @@ import { extractBackgroundShells, extractSkills, extractSlashCommands, harnessTr
 import { resolveResource } from '../resources.js';
 import { discoverPlugins } from '../plugins/plugins.js';
 import { machineId } from '../machine-id.js';
+import { firstUserMessageFromEvents } from './prompt.js';
 const SESSIONS_DIR = getSessionsDir();
 const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/sessions.md calls the constant the source of truth). */
-export const SCHEMA_VERSION = 44;
+export const SCHEMA_VERSION = 45;
 /**
  * Bump to force the content extractor (assistant-answer text, alongside the
  * user-prompt text every harness already accumulates) to re-derive on every
@@ -38,8 +39,13 @@ export const SCHEMA_VERSION = 44;
  * here backfills every existing session's assistant text on its next scan
  * without a `DELETE FROM scan_ledger` (which would also throw away the
  * resumable parser_state/content_text for Claude/Codex).
+ *
+ * v3 (PHNX-3621) invalidates OpenCode rows that merged v2 stamped before its
+ * genuine first-user-turn extractor was added.
+ * v4 (PHNX-3621 leftover) invalidates Grok rows stamped before the bounded
+ * chat_history.jsonl prefix read filled firstUserMessage.
  */
-export const CONTENT_INDEX_VERSION = 1;
+export const CONTENT_INDEX_VERSION = 4;
 /**
  * Bump to force `agents sessions backfill resources` to re-derive every
  * session's skill/slash-command tallies on its next run (resource_scan_ledger
@@ -96,6 +102,7 @@ CREATE TABLE IF NOT EXISTS sessions (
   cwd TEXT,
   git_branch TEXT,
   topic TEXT,
+  first_user_message TEXT,
   label TEXT,
   message_count INTEGER,
   token_count INTEGER,
@@ -1231,6 +1238,15 @@ function migrateSchema(db, fromVersion) {
             }
         }
     }
+    if (fromVersion < 45) {
+        // v44 -> v45: retain the full first genuine user turn separately from the
+        // one-line topic. The CONTENT_INDEX_VERSION bump re-parses every transcript
+        // through its normal incremental scan path so existing rows backfill without
+        // a second consumer-side transcript reader.
+        const cols = new Set(db.prepare(`PRAGMA table_info(sessions)`).all().map((c) => c.name));
+        if (!cols.has('first_user_message'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN first_user_message TEXT`);
+    }
 }
 /**
  * Stamp `account_key` / `account_org` / `account` on every Claude row from its
@@ -1567,9 +1583,11 @@ export function getDBPath() {
 export function getScanStampByPath(filePath) {
     const db = getDB();
     const row = db
-        .prepare(`SELECT file_mtime_ms, file_size, scanned_at FROM scan_ledger WHERE file_path = ? LIMIT 1`)
+        .prepare(`SELECT file_mtime_ms, file_size, scanned_at, extractor_version FROM scan_ledger WHERE file_path = ? LIMIT 1`)
         .get(canonicalLedgerKey(filePath));
-    return row ? { fileMtimeMs: row.file_mtime_ms, fileSize: row.file_size, scannedAt: row.scanned_at } : null;
+    return row
+        ? { fileMtimeMs: row.file_mtime_ms, fileSize: row.file_size, scannedAt: row.scanned_at, extractorVersion: row.extractor_version }
+        : null;
 }
 /**
  * Bulk-load the stamp ledger for a set of file paths in a single SQL query.
@@ -1771,7 +1789,7 @@ const upsertSessionStmt = (db) => db.prepare(`
   INSERT INTO sessions (
     id, short_id, agent, harness, origin, routine_name, routine_run_id,
     version, account, account_key, account_org, mode, timestamp, last_activity,
-    project, cwd, git_branch, topic, label, message_count, token_count,
+    project, cwd, git_branch, topic, first_user_message, label, message_count, token_count,
     output_tokens, input_tokens, cache_read_tokens, cache_write_tokens,
     cost_usd, cost_usd_nocache, duration_ms, model, tool_call_count,
     file_path, file_mtime_ms, file_size, scanned_at, is_team_origin,
@@ -1782,7 +1800,7 @@ const upsertSessionStmt = (db) => db.prepare(`
   ) VALUES (
     @id, @short_id, @agent, @harness, @origin, @routine_name, @routine_run_id,
     @version, @account, @account_key, @account_org, @mode, @timestamp, @last_activity,
-    @project, @cwd, @git_branch, @topic, @label, @message_count, @token_count,
+    @project, @cwd, @git_branch, @topic, @first_user_message, @label, @message_count, @token_count,
     @output_tokens, @input_tokens, @cache_read_tokens, @cache_write_tokens,
     @cost_usd, @cost_usd_nocache, @duration_ms, @model, @tool_call_count,
     @file_path, @file_mtime_ms, @file_size, @scanned_at, @is_team_origin,
@@ -1802,7 +1820,13 @@ const upsertSessionStmt = (db) => db.prepare(`
     origin = excluded.origin,
     routine_name = excluded.routine_name,
     routine_run_id = excluded.routine_run_id,
-    version = excluded.version,
+    -- Origin version is write-once launch metadata, like mode/harness/actor:
+    -- backfill a NULL-first row once the launch sidecar lands, and keep the
+    -- recorded version across a rescan that cannot re-derive it (a codex
+    -- transcript outside a versions/agent/ path, or the durable sidecar aged
+    -- out) — the same COALESCE the launch-metadata columns use, so native resume
+    -- stops falling back for a missing recorded origin (PHNX-3626).
+    version = COALESCE(excluded.version, sessions.version),
     account = excluded.account,
     account_key = excluded.account_key,
     account_org = excluded.account_org,
@@ -1813,6 +1837,7 @@ const upsertSessionStmt = (db) => db.prepare(`
     cwd = excluded.cwd,
     git_branch = excluded.git_branch,
     topic = excluded.topic,
+    first_user_message = COALESCE(excluded.first_user_message, sessions.first_user_message),
     -- Never let an empty/placeholder incoming label clobber a good stored one.
     -- A real incoming label (non-empty after trim) still wins; a blank one keeps
     -- the label seeded by --name (seedLabelsFromNames) or refined by an agent
@@ -2006,18 +2031,23 @@ function fanOutCounts(events, agent) {
             : undefined,
     };
 }
+/** Fold transcript-derived metadata that every parser can supply uniformly. */
+function enrichMetaFromEvents(meta, events) {
+    return {
+        ...meta,
+        firstUserMessage: meta.firstUserMessage ?? firstUserMessageFromEvents(events),
+        todos: extractTodoProgressFromEvents(events),
+        recentDirectoriesTouched: extractRecentDirectoriesTouched(events, meta.cwd),
+        ...fanOutCounts(events, meta.agent),
+    };
+}
 function enrichCachedSessionMeta(meta) {
     if (!meta.filePath)
         return meta;
     try {
         const events = parseSession(meta.filePath, meta.agent);
         writeResourceUsage(meta.id, events, meta.cwd);
-        return {
-            ...meta,
-            todos: extractTodoProgressFromEvents(events),
-            recentDirectoriesTouched: extractRecentDirectoriesTouched(events, meta.cwd),
-            ...fanOutCounts(events, meta.agent),
-        };
+        return enrichMetaFromEvents(meta, events);
     }
     catch {
         // Synthetic/cloud rows can intentionally name a transcript that is not local.
@@ -2081,7 +2111,11 @@ export function upsertSession(meta, content, scan, assistantContent = '') {
         origin: meta.origin ?? 'cli',
         routine_name: meta.routineName ?? null,
         routine_run_id: meta.routineRunId ?? null,
-        version: meta.version ?? null,
+        // Backfill the origin version from the launch-time sidecar when the transcript
+        // scan couldn't derive one (codex's `.codex-homes/<version>/` home) — the same
+        // write-once join as mode/harness, so native resume stops falling back to
+        // `/continue` for a missing recorded version (PHNX-3626).
+        version: meta.version ?? actorRec?.version ?? null,
         account: meta.account ?? null,
         account_key: meta.accountKey ?? null,
         account_org: meta.accountOrg ?? null,
@@ -2092,6 +2126,7 @@ export function upsertSession(meta, content, scan, assistantContent = '') {
         cwd: meta.cwd ?? null,
         git_branch: meta.gitBranch ?? null,
         topic: meta.topic ?? null,
+        first_user_message: meta.firstUserMessage ?? null,
         label: meta.label ?? null,
         message_count: meta.messageCount ?? null,
         token_count: meta.tokenCount ?? null,
@@ -2186,7 +2221,7 @@ export function upsertSessionsBatch(entries) {
             // and means "not computed yet", and the next scan that carries events fills
             // it. Never collapse that to 0: see fanOutCounts.
             return entry.events
-                ? { ...entry, meta: { ...entry.meta, ...fanOutCounts(entry.events, entry.meta.agent) } }
+                ? { ...entry, meta: enrichMetaFromEvents(entry.meta, entry.events) }
                 : entry;
         }
         // Harnesses whose scanners produce no events AND whose parseSession reads a
@@ -2233,12 +2268,7 @@ export function upsertSessionsBatch(entries) {
             const scanned = scanEventToolCalls(events, prior ?? undefined);
             return {
                 ...entry,
-                meta: {
-                    ...entry.meta,
-                    todos: extractTodoProgressFromEvents(events),
-                    recentDirectoriesTouched: extractRecentDirectoriesTouched(events, entry.meta.cwd),
-                    ...fanOutCounts(events, entry.meta.agent),
-                },
+                meta: enrichMetaFromEvents(entry.meta, events),
                 // The CHANGED calls only. On a resume these are the newly appended tail
                 // (append-safe upsert); on a full scan they are the whole history.
                 toolCalls: scanned.calls,
@@ -2322,7 +2352,9 @@ export function upsertSessionsBatch(entries) {
                     origin: meta.origin ?? 'cli',
                     routine_name: meta.routineName ?? null,
                     routine_run_id: meta.routineRunId ?? null,
-                    version: meta.version ?? null,
+                    // Backfill the origin version from the launch-time sidecar when the scan
+                    // couldn't derive one — see the single-row upsert above (PHNX-3626).
+                    version: meta.version ?? actorIndex.get(meta.id)?.version ?? null,
                     account: meta.account ?? null,
                     account_key: meta.accountKey ?? null,
                     account_org: meta.accountOrg ?? null,
@@ -2333,6 +2365,7 @@ export function upsertSessionsBatch(entries) {
                     cwd: meta.cwd ?? null,
                     git_branch: meta.gitBranch ?? null,
                     topic: meta.topic ?? null,
+                    first_user_message: meta.firstUserMessage ?? null,
                     label: meta.label ?? null,
                     message_count: meta.messageCount ?? null,
                     token_count: meta.tokenCount ?? null,
@@ -2580,6 +2613,7 @@ function rowToMeta(row) {
         accountOrg: row.account_org ?? undefined,
         mode: isSessionRunMode(row.mode) ? row.mode : undefined,
         topic: row.topic ?? undefined,
+        firstUserMessage: row.first_user_message ?? undefined,
         label: row.label ?? undefined,
         isTeamOrigin: row.is_team_origin === 1,
         prUrl: row.pr_url ?? undefined,
@@ -3679,6 +3713,23 @@ export function findSessionsById(idQuery, scope = {}) {
         return exact;
     return querySessions({ ...scope, idPrefix: q });
 }
+/**
+ * Upgrade a session-id crumb to the full indexed id. The 8-char hex `short_id`
+ * a "Sent from …" footer shows would 404 as a `…/console/sessions/<id>` URL, so
+ * an owner ping resolves it through the index first (PHNX-3698). A value that is
+ * already a full id (or any non-crumb shape, e.g. a native `ses_…` id), or a
+ * crumb the index cannot resolve, is returned unchanged — the caller keeps
+ * exactly what it had rather than getting a fabricated id.
+ */
+export function resolveFullSessionId(idOrCrumb) {
+    const id = idOrCrumb?.trim();
+    if (!id)
+        return undefined;
+    if (!/^[0-9a-f]{8}$/i.test(id))
+        return id; // already a full id (or non-hex shape) — nothing to resolve
+    const hit = findSessionsByShortIds([id]).get(id.toLowerCase());
+    return hit?.id ?? id;
+}
 /** Batch-resolve pane short ids; on collision the most recently active session wins. */
 export function findSessionsByShortIds(shortIds) {
     const out = new Map();