@phnx-labs/agents-cli 1.22.81 → 1.22.83

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.22.83
+
+- **The Claude status line shows the registered account NAME (PHNX-3987).** A login named with `agents accounts` (`work`, `dev`, …) now renders that name between the host and the model — `yosemite · work · Fable 5.1 · …` — which is what tells several same-harness logins apart at a glance; an unnamed login keeps the email label. The lookup is the one `agents view` and the device inventories already use, lifted into `findNativeAccountByIdentity` so the three copies share it. Source: `cli/src/lib/claude-statusline.ts`, `cli/src/lib/account-registry.ts`.
+
+- **`agents accounts rename` / `remove` / `view` honor per-harness account names (PHNX-3988).** Native labels are unique per harness (PHNX-3887), but rename/remove still ran a fleet-wide uniqueness check and resolved a bare name to whichever harness row the store ordered first — so renaming Codex's `cxicloud` to `icloud` failed because Claude already owned `icloud`. Rename now scopes uniqueness to the target row's harness, so one harness can take a name another already uses; a duplicate within the same harness is still refused. Rename, remove, and view accept `<harness>#<name>` and refuse an ambiguous bare name rather than guessing. Source: `cli/src/lib/account-registry.ts`, `cli/src/commands/accounts.ts`.
+
+- **Feed activity polling reuses unchanged log tails (PHNX-3939).** The activity reader caches file-version-validated tails and timestamp summaries within a bounded process-local budget. Cursor polls skip unchanged historical events without parsing them again; appends, rewrites, replacements and tail-budget changes invalidate the cached snapshot. Returned events remain independently mutable, with timestamp, filter and limit behavior preserved.
+
+## 1.22.82
+
+- **The Claude status line names the signed-in account before the model (PHNX-3987).** The managed `agents __claude-statusline` render now reads `host · account · model · 5h n% · 7d n% · ◆ reminder`, where the account is the email the running Claude is signed into (plus the org name for a Team/Enterprise seat, the same label `agents view` renders), read from the `.claude.json` of the home Claude is actually running with — the version home under the launch shim, `$HOME` otherwise. A never-signed-in home omits the part. Source: `cli/src/lib/claude-statusline.ts`.
+
 ## 1.22.81
 
 - **Same-task page reopen refreshes the SAME tab instead of duplicating it (PHNX-2399).** When an agent reopens a URL that is already live in one of its browser task's OWN tabs, `agents browser navigate` / `tab add` now issue a real `Page.reload` on that same tab — keeping its tab id and CDP target, marking it current without stealing window focus — and report `refreshed: true` with the note `Tab already open—refreshed`, rather than opening a second copy. Borrowed Arc/user tabs are excluded, a stale registered tab or a failed reload never reports a phantom refresh, and the lookup→reload/create→persist section is serialized per task (and first-use creation per caller) so concurrent requests converge on one tab and the same id. The implicit first-open at the create boundary is reported as a genuine open, not disguised as a refresh. `navigate` / `tab add` gain `--json` (`{ ok, task, tabId, url, created, refreshed, message }`), and `agents browser tabs` again marks the current tab. Source: `cli/src/lib/browser/service.ts`, `cli/src/lib/browser/ipc.ts`, `cli/src/lib/browser/types.ts`, `cli/src/commands/browser.ts`.

package/dist/commands/accounts.js

@@ -21,7 +21,7 @@ import { connectRefusal, connectSupported, runConnect } from '../lib/accounts/co
 import { acquireAuthOperationLock } from '../lib/accounts/auth-operation-lock.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
 import { getAccountProvider, listAccountProviders, providerAuthenticatesHarness } from '../lib/account-provider-registry.js';
-import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, labelNativeAccount, listNativeAccounts, nativeAccountHome, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
+import { accountBindings, addAccount, addNativeAccount, assertUnambiguousNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, labelNativeAccount, listNativeAccounts, nativeAccountHome, parseAccountSelector, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
 import { registerMintCommand } from './auth-mint.js';
 /** Comma-joined list of harnesses `accounts connect` can drive today. */
 function connectSupportedList() {
@@ -580,12 +580,21 @@ agents run claude --account work`,
             console.log(chalk.green(`Updated credential for account '${name}'.`));
         });
     });
-    accounts.command('view <name>').alias('inspect').description('Show safe account metadata, custody, and attachments').option('--json', 'Machine-readable output').action(async (name, o, command) => {
+    const viewCmd = accounts.command('view <name>')
+        .alias('inspect')
+        .description('Show safe account metadata, custody, and attachments. Target may be <harness>#<name> when the name exists for several harnesses')
+        .option('--json', 'Machine-readable output')
+        .action(async (name, o, command) => {
         await runAccountsAction(command, async () => {
             const meta = readMeta();
-            const unified = findUnifiedAccount(name, meta);
+            const selector = parseAccountSelector(name);
+            assertUnambiguousNativeAccount(meta, selector.name, selector.agent);
+            const unified = findUnifiedAccount(selector.name, meta, undefined, selector.agent);
             if (!unified)
                 throw new Error(`Unknown account '${name}'.`);
+            if (selector.agent && unified.kind === 'native' && unified.agent !== selector.agent) {
+                throw new Error(`Unknown ${selector.agent} account '${selector.name}'.`);
+            }
             const account = unified.kind === 'provider'
                 ? { ...publicAccount(inspectAccount(unified.name)), custody: 'agents secrets (policy never)', attached: accountBindings(unified.id, meta) }
                 : { ...unified, custody: `${unified.agent} (not stored by agents-cli)`, attached: accountBindings(unified.id, meta) };
@@ -607,6 +616,11 @@ agents run claude --account work`,
             console.log(`  attached: ${account.attached.length ? account.attached.join(', ') : 'none'}`);
         });
     });
+    setHelpSections(viewCmd, {
+        examples: `agents accounts view work --json
+agents accounts view codex#icloud`,
+        notes: 'Native names are unique per harness. A bare name that exists for several harnesses is refused — pick one with <harness>#<name>.',
+    });
     accounts.command('name <source> <name>')
         .description('Name a signed-in native installation without copying its OAuth credentials')
         .action(async (source, name, _o, command) => {
@@ -723,12 +737,25 @@ agents run codex#work`,
             console.log(chalk.green(`Detached ${name} from ${target}.`));
         });
     });
-    accounts.command('rename <old> <new>').description('Rename an account without changing its stable id').action(async (oldName, newName, _o, command) => {
+    const renameCmd = accounts.command('rename <old> <new>')
+        .description('Rename an account without changing its stable id. Target may be <harness>#<name> when the name exists for several harnesses')
+        .action(async (oldName, newName, _o, command) => {
         await runAccountsAction(command, () => { renameAccount(oldName, newName); });
     });
-    accounts.command('remove <name>').description('Remove an account and its device-local credential').action(async (name, _o, command) => {
+    setHelpSections(renameCmd, {
+        examples: `agents accounts rename cxicloud icloud
+agents accounts rename codex#icloud cloud`,
+        notes: 'Native names are unique per harness. A bare name that exists for several harnesses is refused — pick one with <harness>#<name>.',
+    });
+    const removeCmd = accounts.command('remove <name>')
+        .description('Remove an account and its device-local credential. Target may be <harness>#<name> when the name exists for several harnesses')
+        .action(async (name, _o, command) => {
         await runAccountsAction(command, () => { removeAccount(name); });
     });
+    setHelpSections(removeCmd, {
+        examples: `agents accounts remove claude#icloud`,
+        notes: 'Native names are unique per harness. A bare name that exists for several harnesses is refused — pick one with <harness>#<name>.',
+    });
     accounts.command('set-default <agent> <name>')
         .description('Use this account for a harness when --account is omitted')
         .action(async (agentRaw, name, _o, command) => {
@@ -849,6 +876,7 @@ agents accounts name claude@2.1.220 work
 agents accounts label codex@0.146.0 personal
 agents accounts attach work claude@2.1.225
 agents accounts view work --json
+agents accounts view codex#icloud
 agents accounts switch claude
 agents accounts switch claude work
 agents accounts set-default claude work

package/dist/commands/view.js

@@ -20,7 +20,7 @@ import { listCliStatus } from '../lib/cli-resources.js';
 import { isCapable } from '../lib/capabilities.js';
 import { discoverPlugins, pluginSupportsAgent } from '../lib/plugins/plugins.js';
 import { getAgentsDir, getUserAgentsDir, getEffectivePromptcutsPath, readMergedPromptcuts, readMeta } from '../lib/state.js';
-import { listNativeAccounts } from '../lib/account-registry.js';
+import { findNativeAccountByIdentity } from '../lib/account-registry.js';
 import { buildNativeCatalog } from '../lib/account-catalog.js';
 import { connectSupported } from '../lib/accounts/connect.js';
 import { readInstallation } from '../lib/installations/store.js';
@@ -67,11 +67,8 @@ export const accountColumnLabel = accountDisplayLabel;
  */
 export function namedAccountColumnLabel(agentId, info) {
     const display = accountColumnLabel(info);
-    const identityKey = info?.accountKey ?? info?.email?.toLowerCase();
-    if (!identityKey)
-        return display;
-    const saved = listNativeAccounts(readMeta()).find(item => item.agent === agentId && item.identityKey === identityKey);
-    return saved ? `${saved.name} · ${display || saved.identityLabel || identityKey}` : display;
+    const saved = findNativeAccountByIdentity(readMeta(), agentId, info);
+    return saved ? `${saved.name} · ${display || saved.identityLabel || saved.identityKey}` : display;
 }
 /** Human account identity; release labels belong only in installation diagnostics. */
 export function nativeAccountViewLabel(row) {

package/dist/lib/account-registry.d.ts

@@ -1,4 +1,4 @@
-import type { AgentId, Meta } from './types.js';
+import { type AgentId, type Meta } from './types.js';
 import { type AccountAuthKind } from './account-provider-registry.js';
 export interface CredentialAccount {
     id: string;
@@ -43,6 +43,18 @@ export declare function findAccount(name: string, doc?: AccountRegistryDocument)
  * accumulate). On an id collision the device slice wins.
  */
 export declare function listNativeAccounts(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): NativeAccount[];
+/**
+ * The native account registered for one harness login, or null when that login
+ * is unnamed. `info` is the login's identity as `getAccountInfo` /
+ * `readClaudeHomeConfig` report it; the match key is the same value every
+ * catalog and inventory groups a home on — the stable `accountKey`, else the
+ * lowercased email. The one lookup behind `agents view`, the device
+ * inventories, and the Claude status line.
+ */
+export declare function findNativeAccountByIdentity(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, agent: AgentId, info: {
+    accountKey?: string | null;
+    email?: string | null;
+} | null | undefined): NativeAccount | null;
 /**
  * Resolve one account by name or id across both stores, native first.
  *
@@ -55,6 +67,23 @@ export declare function listNativeAccounts(meta: Pick<Meta, 'accounts' | 'device
  * able to omit it.
  */
 export declare function findUnifiedAccount(nameOrId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, doc?: AccountRegistryDocument, preferAgent?: AgentId): UnifiedAccount | null;
+/**
+ * Split a management selector into its harness and name. `<harness>#<name>`
+ * pins the harness; a bare name (or row id) carries none. Native names are
+ * unique per harness (PHNX-3887), so a bare name alone can legitimately match a
+ * claude row AND a codex row — the selector is how rename/remove say which.
+ */
+export declare function parseAccountSelector(input: string): {
+    agent?: AgentId;
+    name: string;
+};
+/**
+ * Refuse a bare name that native rows in several harnesses share. A
+ * harness-qualified selector (`agent` set) never hits this — uniqueness is
+ * per harness. Ids are unique so they never collide either. Shared by
+ * rename/remove/view so the message stays one string.
+ */
+export declare function assertUnambiguousNativeAccount(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, name: string, agent?: AgentId): void;
 /**
  * Validate a native account NAME (charset + per-harness uniqueness) WITHOUT a
  * known identity — the pre-flight `agents accounts connect` runs before it
@@ -120,8 +149,16 @@ export interface AddAccountOptions {
 }
 export declare function addAccount(name: string, provider: string, auth: AccountAuthKind, secret: string, base?: string, opts?: AddAccountOptions): CredentialAccount;
 export declare function setAccountSecret(name: string, secret: string, base?: string): void;
-export declare function renameAccount(oldName: string, newName: string, base?: string): void;
-export declare function removeAccount(name: string, base?: string): void;
+/**
+ * `oldSelector` is a bare name, a row id, or `<harness>#<name>`. A native row
+ * carries its harness, so the new name only has to be free within THAT harness
+ * (PHNX-3887 / PHNX-3988): renaming codex's `cxicloud` to `icloud` is fine
+ * while claude's `icloud` stays untouched. Provider accounts have no harness
+ * and stay globally unique.
+ */
+export declare function renameAccount(oldSelector: string, newName: string, base?: string): void;
+/** `selector` is a bare name, a row id, or `<harness>#<name>` (see {@link renameAccount}). */
+export declare function removeAccount(selector: string, base?: string): void;
 export declare function inspectAccount(name: string, base?: string): CredentialAccount & {
     secretPresent: boolean;
     policy: 'never';

package/dist/lib/account-registry.js

@@ -23,6 +23,7 @@ import * as yaml from 'yaml';
 import chalk from 'chalk';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { getUserAgentsDir, readMeta, updateMeta } from './state.js';
+import { isAgentId } from './types.js';
 import { deleteKeychainToken, getKeychainToken, hasKeychainToken } from './secrets/index.js';
 import { bundleExists, deleteBundle, listBundles, readAndResolveBundleEnv, readBundle, renameBundle, writeBundleWithItems } from './secrets/bundles.js';
 import { getAccountProvider } from './account-provider-registry.js';
@@ -148,6 +149,20 @@ export function listNativeAccounts(meta) {
     const merged = { ...meta.accounts?.native, ...meta.deviceAccounts?.native };
     return Object.values(merged).map(account => ({ ...account, kind: 'native' }));
 }
+/**
+ * The native account registered for one harness login, or null when that login
+ * is unnamed. `info` is the login's identity as `getAccountInfo` /
+ * `readClaudeHomeConfig` report it; the match key is the same value every
+ * catalog and inventory groups a home on — the stable `accountKey`, else the
+ * lowercased email. The one lookup behind `agents view`, the device
+ * inventories, and the Claude status line.
+ */
+export function findNativeAccountByIdentity(meta, agent, info) {
+    const identityKey = info?.accountKey ?? info?.email?.toLowerCase();
+    if (!identityKey)
+        return null;
+    return listNativeAccounts(meta).find(account => account.agent === agent && account.identityKey === identityKey) ?? null;
+}
 /**
  * Resolve one account by name or id across both stores, native first.
  *
@@ -168,8 +183,9 @@ export function findUnifiedAccount(nameOrId, meta, doc, preferAgent) {
     // merged store happened to order first, so `agents run claude#<email>` died with
     // "Account 'personal' is a codex login and cannot authenticate the claude harness"
     // while that identity's own claude login sat right there. Prefer the harness being
-    // launched; fall back to the first match so a management lookup with no harness in
-    // hand (rename/remove/view) behaves exactly as before.
+    // launched; fall back to the first match when the caller has no harness in hand.
+    // rename/remove/view refuse an ambiguous *name* via assertUnambiguousNativeAccount
+    // before they get here — this fallback is for identityLabel collisions.
     const native = matches.find(account => account.agent === preferAgent) ?? matches[0];
     if (native)
         return native;
@@ -179,10 +195,46 @@ export function findUnifiedAccount(nameOrId, meta, doc, preferAgent) {
 function nativeIdentityRows(meta, agent, identityKey) {
     return listNativeAccounts(meta).filter(account => account.agent === agent && account.identityKey === identityKey);
 }
+/**
+ * Split a management selector into its harness and name. `<harness>#<name>`
+ * pins the harness; a bare name (or row id) carries none. Native names are
+ * unique per harness (PHNX-3887), so a bare name alone can legitimately match a
+ * claude row AND a codex row — the selector is how rename/remove say which.
+ */
+export function parseAccountSelector(input) {
+    const hash = input.indexOf('#');
+    if (hash < 0)
+        return { name: input };
+    const agentRaw = input.slice(0, hash);
+    const name = input.slice(hash + 1).trim();
+    if (!isAgentId(agentRaw))
+        throw new Error(`Unknown agent '${agentRaw}'.`);
+    if (!name)
+        throw new Error('Select an account after #.');
+    return { agent: agentRaw, name };
+}
+/**
+ * Refuse a bare name that native rows in several harnesses share. A
+ * harness-qualified selector (`agent` set) never hits this — uniqueness is
+ * per harness. Ids are unique so they never collide either. Shared by
+ * rename/remove/view so the message stays one string.
+ */
+export function assertUnambiguousNativeAccount(meta, name, agent) {
+    const matches = listNativeAccounts(meta).filter(account => (agent === undefined || account.agent === agent) && (account.id === name || account.name === name));
+    const harnesses = [...new Set(matches.map(account => account.agent))].sort();
+    if (harnesses.length > 1) {
+        throw new Error(`Account '${name}' exists for several harnesses (${harnesses.join(', ')}). `
+            + `Pick one with <harness>#${name}, e.g. ${harnesses[0]}#${name}.`);
+    }
+}
 /** Every row (central + this box's device store) for the identity that `name`
- * (id or account name) resolves to. */
-function nativeRowsForNameOrId(meta, name) {
-    const found = listNativeAccounts(meta).find(account => account.id === name || account.name === name);
+ * (id or account name) resolves to. With `agent` set only that harness's rows
+ * are considered; without it, a name owned by rows in several harnesses is
+ * refused rather than resolved to whichever the store ordered first. */
+function nativeRowsForNameOrId(meta, name, agent) {
+    assertUnambiguousNativeAccount(meta, name, agent);
+    const matches = listNativeAccounts(meta).filter(account => (agent === undefined || account.agent === agent) && (account.id === name || account.name === name));
+    const found = matches[0];
     if (!found)
         return [];
     return nativeIdentityRows(meta, found.agent, found.identityKey);
@@ -197,9 +249,9 @@ function nativeRowsForNameOrId(meta, name) {
  * actually ambiguous at the point of use: the selector is `<harness>#<label>`,
  * and `findUnifiedAccount` already disambiguates via `preferAgent`.
  *
- * Pass `agent` to scope the check to that harness. Omit it for management
- * lookups with no harness in hand (rename/remove), which keep the old
- * fleet-wide check so a rename cannot collide with an unrelated harness's row.
+ * Pass `agent` to scope the check to that harness. Every native path has one
+ * in hand — connect/label from the caller, rename from the row being renamed —
+ * so the un-scoped form is only for provider accounts.
  *
  * Provider (non-native) accounts stay globally unique — they are selected by
  * bare name via `--account`, with no harness to scope them by.
@@ -493,21 +545,32 @@ export function setAccountSecret(name, secret, base = getUserAgentsDir()) {
     bundle.created_at = readBundle(account.name).created_at; // rotate the secret, keep the bundle's birth time
     writeBundleWithItems(bundle, items);
 }
-export function renameAccount(oldName, newName, base = getUserAgentsDir()) {
+/**
+ * `oldSelector` is a bare name, a row id, or `<harness>#<name>`. A native row
+ * carries its harness, so the new name only has to be free within THAT harness
+ * (PHNX-3887 / PHNX-3988): renaming codex's `cxicloud` to `icloud` is fine
+ * while claude's `icloud` stays untouched. Provider accounts have no harness
+ * and stay globally unique.
+ */
+export function renameAccount(oldSelector, newName, base = getUserAgentsDir()) {
     assertName(newName);
-    const doc = readAccountRegistry(base);
     const meta = readMeta();
-    const rows = nativeRowsForNameOrId(meta, oldName);
+    const selector = parseAccountSelector(oldSelector);
+    const rows = nativeRowsForNameOrId(meta, selector.name, selector.agent);
     if (rows.length) {
-        assertUniqueUnifiedName(newName, meta, doc, new Set(rows.map(account => account.id)));
+        assertUniqueUnifiedName(newName, meta, undefined, new Set(rows.map(account => account.id)), rows[0].agent);
         // Sweep every row for the identity (PHNX-3206) in its owning store (PHNX-3315)
         // and any per-harness default that points to the old name or row ids.
         const rowScope = rows[0].scope;
-        const idsToRename = new Set([oldName, ...rows.map(row => row.id)]);
+        const renamedAgent = rows[0].agent;
+        const renamedIds = new Set(rows.map(row => row.id));
         updateMeta(current => {
             const defaults = { ...current.accounts?.defaults };
             for (const [agent, value] of Object.entries(defaults)) {
-                if (idsToRename.has(value))
+                // Ids are unique so an id match may rewrite any harness's default. A
+                // bare-name match must only rewrite THIS harness — two harnesses may
+                // legitimately share the same native name (PHNX-3988).
+                if (renamedIds.has(value) || (agent === renamedAgent && value === selector.name))
                     defaults[agent] = newName;
             }
             const next = { ...current, accounts: { ...current.accounts, defaults } };
@@ -527,9 +590,12 @@ export function renameAccount(oldName, newName, base = getUserAgentsDir()) {
         });
         return;
     }
-    const account = findAccount(oldName, doc);
+    if (selector.agent)
+        throw new Error(`Unknown ${selector.agent} account '${selector.name}'.`);
+    const doc = readAccountRegistry(base);
+    const account = findAccount(selector.name, doc);
     if (!account)
-        throw new Error(`Unknown account '${oldName}'.`);
+        throw new Error(`Unknown account '${selector.name}'.`);
     assertUniqueUnifiedName(newName, meta, doc);
     const idsToRename = new Set([account.name, account.id]);
     updateMeta(current => {
@@ -543,9 +609,11 @@ export function renameAccount(oldName, newName, base = getUserAgentsDir()) {
     renameBundle(account.name, newName); // moves metadata + secret, preserves ACCOUNT_ID
     renameProfileConsumers(account.name, newName, base);
 }
-export function removeAccount(name, base = getUserAgentsDir()) {
+/** `selector` is a bare name, a row id, or `<harness>#<name>` (see {@link renameAccount}). */
+export function removeAccount(selector, base = getUserAgentsDir()) {
     const meta = readMeta();
-    const rows = nativeRowsForNameOrId(meta, name);
+    const parsed = parseAccountSelector(selector);
+    const rows = nativeRowsForNameOrId(meta, parsed.name, parsed.agent);
     if (rows.length) {
         const bindings = [...new Set(rows.flatMap(row => accountBindings(row.id, meta)))].sort();
         if (bindings.length)
@@ -571,6 +639,9 @@ export function removeAccount(name, base = getUserAgentsDir()) {
         });
         return;
     }
+    if (parsed.agent)
+        throw new Error(`Unknown ${parsed.agent} account '${parsed.name}'.`);
+    const name = parsed.name;
     const account = findAccount(name, readAccountRegistry(base));
     if (!account)
         throw new Error(`Unknown account '${name}'.`);

package/dist/lib/claude-statusline.d.ts

@@ -1,3 +1,5 @@
+import { type ClaudeHomeIdentity } from './agent-spec/agents.js';
+import { type NativeAccount } from './account-registry.js';
 export declare const CLAUDE_STATUSLINE_COMMAND = "agents __claude-statusline";
 /**
  * True when `command` re-invokes THIS status-line producer (our private
@@ -28,7 +30,35 @@ interface ClaudeStatusLinePayload {
         };
     };
 }
-export declare function ingestClaudeStatusLineUsage(payload: ClaudeStatusLinePayload, versionHome: string): boolean;
+export declare function ingestClaudeStatusLineUsage(payload: ClaudeStatusLinePayload, identity: ClaudeHomeIdentity | null): boolean;
+/**
+ * Where the running Claude keeps the config this render attributes to: the version
+ * home when the launch shim set CLAUDE_CONFIG_DIR, otherwise the real HOME — the
+ * same resolution Claude Code applies, so a Claude launched without the shim (IDE
+ * extension, direct binary) still shows the account it is actually signed into.
+ */
+export declare function claudeHomeFromEnv(env: NodeJS.ProcessEnv): string;
+/**
+ * The identity of the running Claude, read ONCE per render from the `.claude.json`
+ * of the home it is actually running with: it keys the usage ingest above and
+ * names the account part below. Null when the home has never signed in. Sync and
+ * file-only on purpose — this runs on every status-line refresh.
+ */
+export declare function readClaudeIdentity(claudeHome: string): ClaudeHomeIdentity | null;
+/**
+ * The registered native account for the running Claude's identity (`agents
+ * accounts` — `work`, `dev`, …), or null when that login is unnamed.
+ */
+export declare function resolveNativeAccount(identity: ClaudeHomeIdentity | null): NativeAccount | null;
+/**
+ * Format the signed-in account as a statusline part ('' when never signed in).
+ * A named login renders its registered NAME — the short handle the owner chose
+ * (`work`, `dev`), which is what tells eight same-harness logins apart at a
+ * glance. An unnamed login renders the label every other account-aware surface
+ * (`agents view`, `agents accounts`) uses: the email, plus the org name for a
+ * multi-seat Team/Enterprise seat.
+ */
+export declare function formatAccountPart(identity: ClaudeHomeIdentity | null, account: NativeAccount | null): string;
 export declare function renderDelegate(payload: string, versionHome: string): string;
 /**
  * Format a reminder as a dimmed statusline part (empty string when none). The
@@ -36,7 +66,7 @@ export declare function renderDelegate(payload: string, versionHome: string): st
  * keeps it quiet next to the live figures.
  */
 export declare function formatReminderPart(short: string | undefined): string;
-export declare function renderClaudeStatusLine(payload: ClaudeStatusLinePayload, host?: string, delegated?: string, reminder?: string): string;
+export declare function renderClaudeStatusLine(payload: ClaudeStatusLinePayload, host?: string, delegated?: string, reminder?: string, account?: string): string;
 /**
  * Resolve the per-session reminder for the statusline, or '' when none is
  * configured. A malformed reminders file is swallowed here on purpose — a broken

package/dist/lib/claude-statusline.js

@@ -2,10 +2,12 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { spawnSync } from 'child_process';
-import { readClaudeHomeConfig } from './agent-spec/agents.js';
+import { accountDisplayLabel, readClaudeHomeConfig, } from './agent-spec/agents.js';
+import { findNativeAccountByIdentity } from './account-registry.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { mergeClaudeUsageCacheWindows } from './accounting/usage.js';
 import { loadReminders, pickReminderForSession } from './reminders.js';
+import { readMeta } from './state.js';
 export const CLAUDE_STATUSLINE_COMMAND = 'agents __claude-statusline';
 const DELEGATE_FILE = path.join('.agents', 'claude-statusline-delegate');
 // The private subcommand this feature runs. It is only ever invoked internally,
@@ -61,8 +63,7 @@ function windowFromNative(key, value) {
         windowMinutes: key === 'session' ? 300 : 10_080,
     };
 }
-export function ingestClaudeStatusLineUsage(payload, versionHome) {
-    const identity = readClaudeHomeConfig(versionHome)?.identity;
+export function ingestClaudeStatusLineUsage(payload, identity) {
     if (!identity?.usageKey || !payload.rate_limits)
         return false;
     const windows = [
@@ -79,6 +80,46 @@ export function ingestClaudeStatusLineUsage(payload, versionHome) {
     });
     return true;
 }
+/**
+ * Where the running Claude keeps the config this render attributes to: the version
+ * home when the launch shim set CLAUDE_CONFIG_DIR, otherwise the real HOME — the
+ * same resolution Claude Code applies, so a Claude launched without the shim (IDE
+ * extension, direct binary) still shows the account it is actually signed into.
+ */
+export function claudeHomeFromEnv(env) {
+    return versionHomeFromEnv(env) ?? os.homedir();
+}
+/**
+ * The identity of the running Claude, read ONCE per render from the `.claude.json`
+ * of the home it is actually running with: it keys the usage ingest above and
+ * names the account part below. Null when the home has never signed in. Sync and
+ * file-only on purpose — this runs on every status-line refresh.
+ */
+export function readClaudeIdentity(claudeHome) {
+    return readClaudeHomeConfig(claudeHome)?.identity ?? null;
+}
+/**
+ * The registered native account for the running Claude's identity (`agents
+ * accounts` — `work`, `dev`, …), or null when that login is unnamed.
+ */
+export function resolveNativeAccount(identity) {
+    return identity ? findNativeAccountByIdentity(readMeta(), 'claude', identity) : null;
+}
+/**
+ * Format the signed-in account as a statusline part ('' when never signed in).
+ * A named login renders its registered NAME — the short handle the owner chose
+ * (`work`, `dev`), which is what tells eight same-harness logins apart at a
+ * glance. An unnamed login renders the label every other account-aware surface
+ * (`agents view`, `agents accounts`) uses: the email, plus the org name for a
+ * multi-seat Team/Enterprise seat.
+ */
+export function formatAccountPart(identity, account) {
+    if (!identity)
+        return '';
+    if (account)
+        return account.name;
+    return accountDisplayLabel({ ...identity, signedIn: true });
+}
 function delegatePath(versionHome) {
     return path.join(versionHome, DELEGATE_FILE);
 }
@@ -113,9 +154,14 @@ export function formatReminderPart(short) {
     const text = short?.trim();
     return text ? `\x1b[2m◆ ${text}\x1b[22m` : '';
 }
-export function renderClaudeStatusLine(payload, host = os.hostname().split('.')[0] || os.hostname(), delegated = '', reminder = '') {
+export function renderClaudeStatusLine(payload, host = os.hostname().split('.')[0] || os.hostname(), delegated = '', reminder = '', account = '') {
     const model = payload.model?.display_name?.trim() || payload.model?.id?.trim() || 'model pending';
-    const parts = [host, model];
+    // host · account · model: who is running, as which account, on which model —
+    // the account sits before the model so a glance answers "whose quota is this".
+    const parts = [host];
+    if (account)
+        parts.push(account);
+    parts.push(model);
     if (delegated)
         parts.push(delegated);
     const fiveHour = payload.rate_limits?.five_hour?.used_percentage;
@@ -158,9 +204,10 @@ export async function runClaudeStatusLine() {
         payload = {};
     }
     const versionHome = versionHomeFromEnv(process.env);
+    const identity = readClaudeIdentity(claudeHomeFromEnv(process.env));
     if (versionHome)
-        ingestClaudeStatusLineUsage(payload, versionHome);
-    process.stdout.write(renderClaudeStatusLine(payload, undefined, versionHome ? renderDelegate(raw, versionHome) : '', resolveReminderPart(payload.session_id)));
+        ingestClaudeStatusLineUsage(payload, identity);
+    process.stdout.write(renderClaudeStatusLine(payload, undefined, versionHome ? renderDelegate(raw, versionHome) : '', resolveReminderPart(payload.session_id), formatAccountPart(identity, resolveNativeAccount(identity))));
     return 0;
 }
 export function installClaudeStatusLine(versionHome) {

package/dist/lib/devices/fleet-inventory.js

@@ -12,7 +12,7 @@ import { getAvailableResources, getVersionHomePath, isVersionIsolated, listInsta
 import { supports } from '../capabilities.js';
 import { checkVersionHookWiring } from '../hooks/install.js';
 import { getUserAgentsDir, getSystemAgentsDir, readMeta } from '../state.js';
-import { listNativeAccounts } from '../account-registry.js';
+import { findNativeAccountByIdentity } from '../account-registry.js';
 import { readRepoState } from '../git.js';
 import { ALL_AGENT_IDS, accountDisplayLabel, credentialPresence, getAccountInfo, supportsAccountInspection, } from '../agents.js';
 import { FLEET_RESOURCE_KINDS, } from './fleet-divergence.js';
@@ -46,9 +46,8 @@ export async function collectLocalFleetSignIn() {
                 signedIn = info.signedIn;
                 // Prefix the durable account name when this identity has been named.
                 const display = accountDisplayLabel(info);
-                const identityKey = info.accountKey ?? info.email?.toLowerCase();
-                const saved = identityKey ? listNativeAccounts(readMeta()).find(item => item.agent === agent && item.identityKey === identityKey) : undefined;
-                account = (saved ? `${saved.name} · ${display || saved.identityLabel || identityKey}` : display) || null;
+                const saved = findNativeAccountByIdentity(readMeta(), agent, info);
+                account = (saved ? `${saved.name} · ${display || saved.identityLabel || saved.identityKey}` : display) || null;
             }
             catch {
                 /* advisory only — treat as logged out, provability decided below */

package/dist/lib/devices/harness-inventory.js

@@ -18,7 +18,7 @@ import { ALL_AGENT_IDS, accountDisplayLabel, getAccountInfo, } from '../agents.j
 import { deriveUsageStatusFromSnapshot, getUsageInfoByIdentity, getUsageLookupKey, usageErrorForDisplay, } from '../accounting/usage.js';
 import { getVersionHomePath, listInstalledVersions } from '../installations/store.js';
 import { readMeta } from '../state.js';
-import { listNativeAccounts } from '../account-registry.js';
+import { findNativeAccountByIdentity } from '../account-registry.js';
 /**
  * Roll one usage snapshot into a {@link QuotaSummary}. Mirrors the blocking-window
  * selection of {@link deriveUsageStatusFromSnapshot} (the model-specific
@@ -118,7 +118,7 @@ export async function collectLocalHarnessInventory(opts) {
     const usageByKey = usageInputs.length
         ? (await getUsageInfoByIdentity(usageInputs, opts?.refresh ? { forceRefresh: true } : undefined)).usageByKey
         : new Map();
-    const savedNative = listNativeAccounts(readMeta());
+    const meta = readMeta();
     return pending.map(({ agent, version, info }) => {
         const key = getUsageLookupKey(info);
         const usage = key ? usageByKey.get(key) : undefined;
@@ -130,9 +130,8 @@ export async function collectLocalHarnessInventory(opts) {
         const signedIn = !!info?.signedIn;
         const { ready, reason } = computeReady(signedIn, quota);
         const display = info ? accountDisplayLabel(info) || null : null;
-        const identityKey = info?.accountKey ?? info?.email?.toLowerCase();
-        const saved = identityKey ? savedNative.find(item => item.agent === agent && item.identityKey === identityKey) : undefined;
-        const account = saved ? `${saved.name} · ${display || saved.identityLabel || identityKey}` : display;
+        const saved = findNativeAccountByIdentity(meta, agent, info);
+        const account = saved ? `${saved.name} · ${display || saved.identityLabel || saved.identityKey}` : display;
         return { agent, version, account, signedIn, quota, ready, reason };
     });
 }

package/dist/lib/feed/activity.js

@@ -181,24 +181,105 @@ function readTail(file, maxBytes) {
         return text;
     }
     catch {
-        return '';
+        return undefined;
     }
     finally {
         if (fd !== undefined)
             fs.closeSync(fd);
     }
 }
+// Process-local tail cache: bounded independently of the number of historical
+// sessions or directories a long-lived consumer visits. Never expose cached
+// objects: callers enrich and mutate returned events (including nested values).
+const ACTIVITY_CACHE_BYTES = 32 * 1024 * 1024;
+const ACTIVITY_CACHE_FILES = 1024;
+const activityTails = new Map();
+let activityTailBytes = 0;
+function forgetActivityTail(key) {
+    const old = activityTails.get(key);
+    if (old)
+        activityTailBytes -= old.weight;
+    activityTails.delete(key);
+}
+function activityStamp(file) {
+    // ctime catches same-size rewrites even when a producer restores mtime;
+    // device/inode catches atomic replacement. Nanoseconds avoid rounding away
+    // changes made between consecutive polls on high-resolution filesystems.
+    const st = fs.statSync(file, { bigint: true });
+    return `${st.dev}:${st.ino}:${st.size}:${st.mtimeNs}:${st.ctimeNs}`;
+}
+function readActivityTail(file, maxBytes, sinceMs = -Infinity) {
+    const key = `${path.resolve(file)}\0${maxBytes}`;
+    let stamp;
+    try {
+        stamp = activityStamp(file);
+    }
+    catch {
+        forgetActivityTail(key);
+        return { stamp: '', events: [], newestMs: -Infinity, weight: 0 };
+    }
+    const cached = activityTails.get(key);
+    if (cached?.stamp === stamp && (cached.events || cached.newestMs < sinceMs)) {
+        activityTails.delete(key);
+        activityTails.set(key, cached);
+        return cached;
+    }
+    forgetActivityTail(key);
+    const text = readTail(file, maxBytes);
+    // Transient I/O failure is not an empty file snapshot; retry next read.
+    if (text === undefined)
+        return { stamp, events: [], newestMs: -Infinity, weight: 0 };
+    const events = [];
+    let newestMs = -Infinity;
+    for (const line of text.split('\n')) {
+        const event = parseLine(line);
+        if (!event)
+            continue;
+        events.push(event);
+        try {
+            const ms = Date.parse(event.ts);
+            if (Number.isFinite(ms))
+                newestMs = Math.max(newestMs, ms);
+        }
+        catch {
+            // The tolerant parser historically accepts truthy non-string values.
+            // Do not introduce a conversion error before the caller's event filters
+            // (or into session reads, which never converted timestamps at all).
+            newestMs = Infinity;
+        }
+    }
+    // Bound retained source-derived strings, objects, and entry overhead. Large
+    // one-off tails still read normally, but cannot displace the entire cache.
+    const weight = text.length * 2 + events.length * 1024 + key.length * 2 + 256;
+    const result = { stamp, events, newestMs, weight };
+    try {
+        // A writer racing the read must not pin a mixed snapshot as unchanged.
+        if (activityStamp(file) === stamp) {
+            if (activityTails.size >= ACTIVITY_CACHE_FILES)
+                forgetActivityTail(activityTails.keys().next().value);
+            const summaryWeight = key.length * 2 + 256;
+            const retained = weight <= ACTIVITY_CACHE_BYTES / 2 ? { ...result } : { ...result, events: undefined, weight: summaryWeight };
+            // Retain timestamp summaries even when parsed tails exceed the budget:
+            // otherwise a large historical corpus thrashes on every cursor poll.
+            for (const [oldKey, old] of activityTails) {
+                if (activityTailBytes + retained.weight <= ACTIVITY_CACHE_BYTES)
+                    break;
+                const summary = oldKey.length * 2 + 256;
+                activityTailBytes -= old.weight - summary;
+                old.events = undefined;
+                old.weight = summary;
+            }
+            activityTails.set(key, retained);
+            activityTailBytes += retained.weight;
+        }
+    }
+    catch { /* Deleted during the read: return this snapshot without caching. */ }
+    return result;
+}
 /** Read all events for one session (bounded tail). */
 export function readSessionActivity(sessionId, root, maxBytes = 256 * 1024) {
     const dir = root ?? getActivityDir();
-    const text = readTail(activityPath(dir, sessionId), maxBytes);
-    const out = [];
-    for (const line of text.split('\n')) {
-        const ev = parseLine(line);
-        if (ev)
-            out.push(ev);
-    }
-    return out;
+    return structuredClone(readActivityTail(activityPath(dir, sessionId), maxBytes).events ?? []);
 }
 /** List session ids that have an activity log. */
 export function listActivitySessions(root) {
@@ -220,7 +301,10 @@ export function readRecentActivity(opts = {}) {
     const wanted = opts.events && opts.events.length > 0 ? new Set(opts.events) : null;
     const all = [];
     for (const sessionId of listActivitySessions(dir)) {
-        for (const ev of readSessionActivity(sessionId, dir, opts.maxBytesPerSession)) {
+        const tail = readActivityTail(activityPath(dir, sessionId), opts.maxBytesPerSession ?? 256 * 1024, sinceMs);
+        if (tail.newestMs < sinceMs)
+            continue;
+        for (const ev of tail.events ?? []) {
             if (wanted && !wanted.has(ev.event))
                 continue;
             if (opts.tier && ev.tier !== opts.tier)
@@ -231,7 +315,7 @@ export function readRecentActivity(opts = {}) {
         }
     }
     all.sort((a, b) => Date.parse(b.ts) - Date.parse(a.ts));
-    return typeof opts.limit === 'number' ? all.slice(0, opts.limit) : all;
+    return structuredClone(typeof opts.limit === 'number' ? all.slice(0, opts.limit) : all);
 }
 /**
  * Split a chronological event list into individual milestones plus a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.81",
+  "version": "1.22.83",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",