@phnx-labs/agents-cli 1.22.84 → 1.22.85

package/dist/lib/devices/harness-inventory.js

@@ -15,10 +15,14 @@
  */
 import chalk from 'chalk';
 import { ALL_AGENT_IDS, accountDisplayLabel, getAccountInfo, } from '../agents.js';
-import { deriveUsageStatusFromSnapshot, getUsageInfoByIdentity, getUsageLookupKey, usageErrorForDisplay, } from '../accounting/usage.js';
+import { deriveUsageStatusFromSnapshot, classifyUsageErrorKind, getUsageInfoByIdentity, getUsageLookupKey, usageErrorForDisplay, } from '../accounting/usage.js';
 import { getVersionHomePath, listInstalledVersions } from '../installations/store.js';
 import { readMeta } from '../state.js';
 import { findNativeAccountByIdentity } from '../account-registry.js';
+import { authCacheKey, readAuthHealthCache } from '../auth-health.js';
+import { machineId } from '../machine-id.js';
+import { fixFor } from '../signin-badge.js';
+import { harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
 /**
  * Roll one usage snapshot into a {@link QuotaSummary}. Mirrors the blocking-window
  * selection of {@link deriveUsageStatusFromSnapshot} (the model-specific
@@ -79,6 +83,51 @@ export function summarizeQuota(snapshot, unavailableReason = null, accountStatus
         unavailableReason: null,
     };
 }
+/**
+ * Scope/permission failures on a worker mean the usage endpoint cannot be read.
+ * They are not evidence of exhausted credits, even when stale account metadata
+ * previously carried that coarse status.
+ */
+export function summarizeObservedQuota(snapshot, error, accountStatus = null) {
+    const displayError = usageErrorForDisplay(error);
+    const unverified = classifyUsageErrorKind(error) === 'headless-scope'
+        || /scope|permission/i.test(displayError ?? '');
+    return {
+        quota: unverified
+            ? summarizeQuota(null, displayError, null)
+            : summarizeQuota(snapshot, displayError, accountStatus),
+        unverified,
+    };
+}
+/**
+ * A scope/permission failure on the usage endpoint is not a credit claim.
+ * Strip utilization and, only when auth still looks healthy, surface
+ * `unverified` instead of `live`/`rate_limited`. A real auth failure
+ * (expired/revoked/missing) stays the auth failure.
+ */
+export function applyUsageHonesty(verdict, usage) {
+    if (!usage)
+        return { verdict, usage };
+    const reason = usage.unavailableReason;
+    const scopeUnknown = !!reason && (classifyUsageErrorKind(reason) === 'headless-scope'
+        || /scope|permission|headless/i.test(reason));
+    if (scopeUnknown) {
+        const stripped = {
+            ...usage,
+            status: null,
+            verdict: 'unavailable',
+            usedPercent: null,
+        };
+        if (verdict === 'live' || verdict === 'rate_limited') {
+            return { verdict: 'unverified', usage: stripped };
+        }
+        return { verdict, usage: stripped };
+    }
+    if (usage.status === 'rate_limited' && (verdict === 'live' || verdict === 'unverified')) {
+        return { verdict: 'rate_limited', usage };
+    }
+    return { verdict, usage };
+}
 /**
  * "Ready" = signed in AND not rate-limited. A missing quota snapshot does NOT
  * block readiness: the account is signed in and usable, we just have no live
@@ -119,6 +168,8 @@ export async function collectLocalHarnessInventory(opts) {
         ? (await getUsageInfoByIdentity(usageInputs, opts?.refresh ? { forceRefresh: true } : undefined)).usageByKey
         : new Map();
     const meta = readMeta();
+    const authCache = readAuthHealthCache();
+    const host = machineId();
     return pending.map(({ agent, version, info }) => {
         const key = getUsageLookupKey(info);
         const usage = key ? usageByKey.get(key) : undefined;
@@ -126,13 +177,34 @@ export async function collectLocalHarnessInventory(opts) {
         // Normalize the internal 'stale' not-collected sentinel out before it reaches
         // the JSON `quota.unavailableReason` — same leak PHNX-3348 fixed for
         // `agents view --json`, here for `agents devices harnesses/accounts --json`.
-        const quota = summarizeQuota(snapshot, usageErrorForDisplay(usage?.error), info?.usageStatus ?? null);
+        const observed = summarizeObservedQuota(snapshot, usage?.error, info?.usageStatus ?? null);
+        const quota = observed.quota;
         const signedIn = !!info?.signedIn;
-        const { ready, reason } = computeReady(signedIn, quota);
         const display = info ? accountDisplayLabel(info) || null : null;
         const saved = findNativeAccountByIdentity(meta, agent, info);
         const account = saved ? `${saved.name} · ${display || saved.identityLabel || saved.identityKey}` : display;
-        return { agent, version, account, signedIn, quota, ready, reason };
+        const cachedVerdict = authCache[authCacheKey(host, agent, version)]?.verdict;
+        const fromAuth = cachedVerdict === 'unconfigured' || !signedIn
+            ? 'missing'
+            : cachedVerdict === 'error' || !cachedVerdict
+                ? 'unverified'
+                : cachedVerdict;
+        const honest = applyUsageHonesty(fromAuth, quota);
+        const verdict = honest.verdict;
+        const honestQuota = honest.usage ?? quota;
+        const { ready, reason } = computeReady(signedIn, honestQuota);
+        const provisioning = harnessWorkerIsPerDevice(agent) ? 'per-device' : 'portable';
+        return {
+            agent,
+            version,
+            account,
+            signedIn,
+            quota: honestQuota,
+            ready,
+            reason,
+            verdict,
+            fix: fixFor({ agent, verdict, name: saved?.name, version, provisioning }),
+        };
     });
 }
 /**
@@ -280,3 +352,53 @@ export function renderAccountsMatrix(results) {
     lines.push(chalk.gray('  one row per account · agents = harnesses signed into it · ready = signed in and not rate-limited'));
     return lines;
 }
+function fleetVerdictLabel(verdict) {
+    if (verdict === 'rate_limited')
+        return 'LIMITED';
+    return verdict.toUpperCase();
+}
+/**
+ * Account × device matrix used by `agents accounts list --fleet`.
+ * Rows are logical accounts, not installations. Columns come from the
+ * daemon-state observations already joined onto each account row.
+ */
+export function renderAccountFleetMatrix(rows, opts = {}) {
+    const devices = [...new Set(rows.flatMap((row) => row.devices.map((device) => device.device)))].sort();
+    const accountLabels = rows.map((row) => `${row.harness}#${row.name ?? 'unnamed'} ${row.identityLabel}`);
+    const accountW = colWidth(accountLabels, 16);
+    const deviceWidths = new Map(devices.map((device) => [
+        device,
+        colWidth([
+            device,
+            ...rows.map((row) => fleetVerdictLabel(row.devices.find((item) => item.device === device)?.verdict ?? 'missing')),
+        ], 7),
+    ]));
+    const lines = [chalk.bold('Fleet accounts')];
+    if (rows.length === 0) {
+        lines.push(chalk.gray('  no accounts'));
+    }
+    else {
+        lines.push(`  ${'ACCOUNT'.padEnd(accountW)}  `
+            + devices.map((device) => device.padEnd(deviceWidths.get(device))).join('  '));
+        for (const [index, row] of rows.entries()) {
+            const label = accountLabels[index].padEnd(accountW);
+            const cells = devices.map((device) => {
+                const verdict = row.devices.find((item) => item.device === device)?.verdict ?? 'missing';
+                const plain = fleetVerdictLabel(verdict).padEnd(deviceWidths.get(device));
+                if (verdict === 'live')
+                    return chalk.green(plain);
+                if (verdict === 'revoked' || verdict === 'expired' || verdict === 'missing')
+                    return chalk.red(plain);
+                if (verdict === 'rate_limited')
+                    return chalk.yellow(plain);
+                return chalk.gray(plain);
+            });
+            lines.push(`  ${chalk.cyan(label)}  ${cells.join('  ')}`);
+        }
+    }
+    const uncovered = (opts.uncoveredDevices ?? []).filter((device) => !devices.includes(device));
+    if (uncovered.length > 0) {
+        lines.push(chalk.gray(`  ${uncovered.join(', ')}: daemon-state carries no account verdicts (older release)`));
+    }
+    return lines;
+}

package/dist/lib/doctor-diff.js

@@ -45,7 +45,8 @@ import { dirsContentMatch, filesContentMatch } from './resource-content-diff.js'
 import { subagentContentMatches } from './subagents-registry.js';
 import { getMcpServersByName, mcpServerMatches } from './mcp.js';
 import { permissionsGroupMatches, PERMISSIONS_REPRESENTABLE } from './permissions.js';
-import { workflowContentMatches, resolveWorkflowRef } from './workflows.js';
+import { resolveWorkflowRef } from './workflows.js';
+import { workflowContentMatches } from './workflows-registry.js';
 import { listMemoryFacts, memoryTargetDir } from './memory.js';
 import { getAvailableResources, getActuallySyncedResources, getVersionHomePath, compareVersions, } from './installations/versions.js';
 import { discoverPlugins, marketplaceSpecForName } from './plugins/plugins.js';

package/dist/lib/exec-account-home.d.ts

@@ -0,0 +1,38 @@
+import { isSymlinkAdoptedHarness } from './installations/shims.js';
+import type { AgentId, DeviceAccountSlot, Meta } from './types.js';
+export { isAccountSlotDir } from './agents.js';
+export { isSymlinkAdoptedHarness };
+export type SpawnHomeSource = 'slot' | 'legacy-home' | 'provisioned';
+export interface NativeSpawnHome {
+    execHome: string;
+    source: SpawnHomeSource;
+    slot?: DeviceAccountSlot;
+    /** Installation label when `source` is `legacy-home`. */
+    label?: string;
+}
+export declare function missingSlotHint(agent: AgentId, name: string): string;
+export declare function symlinkAdoptedAccountError(agent: AgentId, name: string, defaultName: string | undefined): string;
+export declare function adoptedSymlinkMismatchError(agent: AgentId, name: string, execHome: string): string;
+/** The adopted `~/.<config>` symlink's resolved target, or null when missing / not a symlink. */
+export declare function adoptedConfigTarget(agent: AgentId): string | null;
+export declare function adoptedConfigPointsAtHome(agent: AgentId, home: string): boolean;
+/**
+ * For a symlink-adopted harness, point `~/.<config>` at this account's slot
+ * or throw. Does not write the harness default — the caller records that only
+ * after this succeeds.
+ */
+export declare function ensureAdoptedDefaultRepoint(agent: AgentId, account: {
+    id: string;
+    name: string;
+    agent: AgentId;
+}, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): void;
+/**
+ * Resolve the spawn HOME for a native account on THIS device.
+ * Existing slot, then a provisionable worker slot, then a leftover `homes`
+ * label, then identity match across installed homes, then fail loud.
+ */
+export declare function resolveNativeSpawnHome(agent: AgentId, account: {
+    id: string;
+    name: string;
+    agent: AgentId;
+}, meta?: Pick<Meta, 'accounts' | 'deviceAccounts'>): Promise<NativeSpawnHome>;

package/dist/lib/exec-account-home.js

@@ -0,0 +1,164 @@
+/**
+ * Spawn-time native-account HOME resolution (PHNX-3940 T5).
+ *
+ * Order: existing slot → provisionable worker slot → recorded leftover `homes`
+ * label → identity match across installed version homes → fail loud with the
+ * T4 hint. Never a wrong home that looks like success. Identity matching is
+ * the pre-T5 fallback (`resolveAccountVersion` over each installed home's own
+ * credential file) so a native account whose backfill never wrote a `homes`
+ * label still spawns from the home that actually holds its login.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { listNativeAccounts, nativeAccountHome } from './account-registry.js';
+import { readSlots } from './accounts/slots.js';
+import { workerProvisioningHint } from './accounts/add.js';
+import { AGENTS, credentialPresence, getAccountInfo } from './agents.js';
+import { AUTH_BUNDLE, claudeAccountTokenKey, provisionWorkerSlot, readReservedCredential } from './claude-account-token.js';
+import { isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
+import { harnessWorkerKinds } from './harness-auth-capabilities.js';
+import { getAgentConfigPath, isSymlinkAdoptedHarness, repointAdoptedConfigToHome } from './installations/shims.js';
+import { getVersionHomePath, listInstalledVersions } from './installations/versions.js';
+export { isAccountSlotDir } from './agents.js';
+export { isSymlinkAdoptedHarness };
+export function missingSlotHint(agent, name) {
+    const role = selfConfiguredDeviceRole();
+    if (!isHeadedDeviceRole(role)) {
+        return `${agent}#${name} has no slot on this device. `
+            + `Add the account on your personal device with \`agents accounts add ${agent} ${name}\`; `
+            + `workers are provisioned from the durable credential automatically `
+            + `(${agent}: ${workerProvisioningHint(agent)}).`;
+    }
+    return `${agent}#${name} has no slot on this device. Sign in with: agents accounts login ${agent}#${name}`;
+}
+export function symlinkAdoptedAccountError(agent, name, defaultName) {
+    if (!defaultName) {
+        return `${agent} holds one active account per device (adopted ~/.<config> symlink). `
+            + `Set the default first: agents accounts default ${agent} ${name}`;
+    }
+    return `${agent} holds one active account per device (adopted ~/.<config> symlink). `
+        + `'${name}' is not the default ('${defaultName}'). `
+        + `Switch with: agents accounts default ${agent} ${name}`;
+}
+export function adoptedSymlinkMismatchError(agent, name, execHome) {
+    return `${agent} default is '${name}' but the adopted ~/.<config> does not point at that account's home (${execHome}). `
+        + `Switch with: agents accounts default ${agent} ${name}`;
+}
+/** The adopted `~/.<config>` symlink's resolved target, or null when missing / not a symlink. */
+export function adoptedConfigTarget(agent) {
+    const configPath = getAgentConfigPath(agent);
+    try {
+        const stat = fs.lstatSync(configPath);
+        if (!stat.isSymbolicLink())
+            return null;
+        return path.resolve(path.dirname(configPath), fs.readlinkSync(configPath));
+    }
+    catch {
+        return null;
+    }
+}
+export function adoptedConfigPointsAtHome(agent, home) {
+    if (!isSymlinkAdoptedHarness(agent))
+        return true;
+    const current = adoptedConfigTarget(agent);
+    if (!current)
+        return false;
+    const configDirName = path.relative(os.homedir(), AGENTS[agent].configDir);
+    return current === path.resolve(home, configDirName);
+}
+/**
+ * For a symlink-adopted harness, point `~/.<config>` at this account's slot
+ * or throw. Does not write the harness default — the caller records that only
+ * after this succeeds.
+ */
+export function ensureAdoptedDefaultRepoint(agent, account, meta) {
+    if (!isSymlinkAdoptedHarness(agent))
+        return;
+    const slot = readSlots(meta)[account.id];
+    if (!slot || !fs.existsSync(slot.slotDir)) {
+        throw new Error(`${agent}#${account.name} has no slot on this device, so the adopted ~/.<config> cannot be pointed at it. `
+            + missingSlotHint(agent, account.name));
+    }
+    const result = repointAdoptedConfigToHome(agent, slot.slotDir);
+    if (!result.success) {
+        throw new Error(result.error ?? `Failed to point ${agent} at account '${account.name}'.`);
+    }
+}
+function nativeRow(accountId, meta) {
+    return listNativeAccounts(meta).find((row) => row.id === accountId);
+}
+function isProvisionableWorker(account) {
+    if (isHeadedDeviceRole(selfConfiguredDeviceRole()))
+        return false;
+    const durable = harnessWorkerKinds(account.agent).some((kind) => kind === 'setup-token' || kind.startsWith('api-key'));
+    if (!durable)
+        return false;
+    if (account.workerCredential) {
+        return readReservedCredential(account.workerCredential.bundle, account.workerCredential.key) != null;
+    }
+    // Pre-T1 Claude rows key the legacy `auth` bundle by email.
+    if (account.agent === 'claude' && account.identityLabel) {
+        return readReservedCredential(AUTH_BUNDLE, claudeAccountTokenKey(account.identityLabel)) != null;
+    }
+    return false;
+}
+async function matchLegacyIdentityHome(agent, account, meta) {
+    const row = nativeRow(account.id, meta);
+    const needles = [row?.identityKey, row?.identityLabel]
+        .filter((value) => typeof value === 'string' && value.trim().length > 0)
+        .map((value) => value.trim().toLowerCase());
+    if (needles.length === 0)
+        return null;
+    const needleSet = new Set(needles);
+    const preferred = nativeAccountHome(account.id, meta);
+    const versions = listInstalledVersions(agent);
+    const ordered = preferred && versions.includes(preferred)
+        ? [preferred, ...versions.filter((version) => version !== preferred)]
+        : versions;
+    for (const label of ordered) {
+        const home = getVersionHomePath(agent, label);
+        if (!fs.existsSync(home))
+            continue;
+        const info = await getAccountInfo(agent, home);
+        const presence = credentialPresence(agent, home);
+        if (!info.signedIn)
+            continue;
+        if (presence.knownLocation && !presence.perVersion)
+            continue;
+        const keys = [info.accountKey, info.email]
+            .filter((value) => typeof value === 'string' && value.length > 0)
+            .map((value) => value.toLowerCase());
+        if (keys.some((key) => needleSet.has(key)))
+            return { home, label };
+    }
+    return null;
+}
+/**
+ * Resolve the spawn HOME for a native account on THIS device.
+ * Existing slot, then a provisionable worker slot, then a leftover `homes`
+ * label, then identity match across installed homes, then fail loud.
+ */
+export async function resolveNativeSpawnHome(agent, account, meta = { accounts: undefined, deviceAccounts: undefined }) {
+    const slot = readSlots(meta)[account.id];
+    if (slot && fs.existsSync(slot.slotDir)) {
+        return { execHome: slot.slotDir, source: 'slot', slot };
+    }
+    const row = nativeRow(account.id, meta);
+    if (row && isProvisionableWorker(row)) {
+        const provisioned = provisionWorkerSlot(row);
+        return { execHome: provisioned.slotDir, source: 'provisioned', slot: provisioned };
+    }
+    const label = nativeAccountHome(account.id, meta);
+    if (label) {
+        const legacyHome = getVersionHomePath(agent, label);
+        if (fs.existsSync(legacyHome)) {
+            return { execHome: legacyHome, source: 'legacy-home', label };
+        }
+    }
+    const matched = await matchLegacyIdentityHome(agent, account, meta);
+    if (matched) {
+        return { execHome: matched.home, source: 'legacy-home', label: matched.label };
+    }
+    throw new Error(missingSlotHint(agent, account.name));
+}

package/dist/lib/exec.d.ts

@@ -133,6 +133,12 @@ export interface ExecOptions {
     version?: string;
     /** Version home whose native auth/config is overlaid onto this run's binary. */
     configVersion?: string;
+    /**
+     * HOME-shaped slot dir whose native auth/config is overlaid onto this run's
+     * binary (PHNX-3940 T5). Wins over {@link configVersion}. The binary still
+     * comes from {@link version} (the managed install unless `@<label>` pins one).
+     */
+    execHome?: string;
     /** Omit to launch the CLI interactively -- no prompt, no --print, stdio fully inherited. */
     prompt?: string;
     /** Force interactive mode even when a prompt is provided. Wins over `headless`. */
@@ -656,6 +662,30 @@ export type ClaudeRefusalAction = {
     action: 'none';
 };
 export declare function classifyClaudeRunRefusal(output: string, exitCode: number): ClaudeRefusalAction;
+/**
+ * Parse Codex's usage-limit refusal reset. Codex prints
+ * `ERROR: You've hit your usage limit. … try again at Sep 12th, 2026 8:32 AM.`
+ * (or `…try again at 8:32 AM.` for the 5-hour window). The reset is what makes
+ * this a session-style limit that auto-clears on its clock rather than a
+ * clock-less billing exhaustion. Ordinal suffixes (`12th`) are stripped so
+ * `Date.parse` accepts the date; a time-only reset resolves against today/tomorrow.
+ * Returns null when there is no future reset to parse (caller then leaves the
+ * marker untouched rather than persisting a sticky one it cannot expire).
+ */
+export declare function parseCodexUsageLimitReset(text: string, nowMs?: number): Date | null;
+/**
+ * Classify what a Codex run's output + exit code means for the account's
+ * persisted refusal marker — the Codex sibling of {@link classifyClaudeRunRefusal}
+ * (the `ClaudeRefusalAction` shape is harness-generic; the usage cache it drives
+ * is identity-keyed and shared across harnesses). Codex's usage limit is
+ * time-windowed and carries a reset ("try again at <date>"), so it is noted as a
+ * clock-bearing session limit that auto-clears — NOT a clock-less out_of_credits,
+ * which would stay sticky until a successful run the excluded account can never
+ * get. A genuine credit/quota exhaustion IS clock-less. A clean run clears any
+ * stale marker; a limit with no parseable reset is left untouched (the run still
+ * cascades via detectRateLimit) rather than persisting an unexpirable marker.
+ */
+export declare function classifyCodexRunRefusal(output: string, exitCode: number, nowMs?: number): ClaudeRefusalAction;
 /**
  * Patterns that indicate an authentication failure — the agent is logged out,
  * its token was revoked, or the session expired. These are the user-visible

package/dist/lib/exec.js

@@ -15,7 +15,7 @@ import { compareVersions, getBinaryPath, getVersionHomePath, isVersionInstalled,
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { isTierToken, resolveTier } from './model-tiers.js';
 import { emit, createTimer, redactPrompt, redactArgs } from './feed/events.js';
-import { sanitizeProcessEnv } from './secrets/bundles.js';
+import { sanitizeProcessEnv } from './secrets-client.js';
 import { resolveActor, actorEnv } from './actor.js';
 import { expandLocalHome } from './project-root.js';
 import { getShimsDir, getHistoryDir, getRuntimeStateDir } from './state.js';
@@ -360,8 +360,9 @@ export function buildExecEnv(options) {
     if (configAdapter.applyExecConfigEnv) {
         // Resolve version/versionHome here (this module already imports
         // installations/versions); the adapters must not import it themselves or they
-        // close a versions -> shims -> harness -> adapter import cycle.
-        const { version, versionHome } = resolveConfigVersion(options.agent, options.cwd || process.cwd(), options.configVersion ?? options.version);
+        // close a versions -> shims -> harness -> adapter import cycle. execHome is
+        // the account slot (PHNX-3940 T5) and wins over a legacy configVersion label.
+        const { version, versionHome } = resolveExecConfigHome(options);
         configAdapter.applyExecConfigEnv(result, {
             agent: options.agent,
             version,
@@ -373,16 +374,6 @@ export function buildExecEnv(options) {
     }
     else {
         stripForeignConfigDir(result);
-        // Grok's adapter owns the same GROK_HOME export in generated shims, but a
-        // labeled account deliberately runs one version's binary with another
-        // version's config. Apply that overlay here because the shim's binary-slot
-        // export cannot express a distinct account slot.
-        if (options.agent === 'grok' && options.configVersion) {
-            const { versionHome } = resolveConfigVersion(options.agent, options.cwd || process.cwd(), options.configVersion);
-            if (!versionHome)
-                throw new Error(`Cannot resolve Grok account config home for ${options.configVersion}.`);
-            result.GROK_HOME = path.join(versionHome, '.grok');
-        }
     }
     // Point the agent at its own mailbox so the PreToolUse `mailbox-inject` hook
     // knows which box to drain and inject mid-run. Keyed by the session id — the
@@ -458,8 +449,16 @@ export function ensureVendorHomeDir(agent, versionHome) {
     fs.mkdirSync(vendorHome, { recursive: true });
     return vendorHome;
 }
+function resolveExecConfigHome(options) {
+    if (options.execHome) {
+        const resolved = options.version
+            ?? resolveConfigVersion(options.agent, options.cwd || process.cwd(), options.version).version;
+        return { version: resolved ?? null, versionHome: options.execHome };
+    }
+    return resolveConfigVersion(options.agent, options.cwd || process.cwd(), options.configVersion ?? options.version);
+}
 function ensureVendorHomeForSpawn(options) {
-    const { versionHome } = resolveConfigVersion(options.agent, options.cwd || process.cwd(), options.configVersion ?? options.version);
+    const { versionHome } = resolveExecConfigHome(options);
     if (versionHome)
         ensureVendorHomeDir(options.agent, versionHome);
 }
@@ -2158,6 +2157,73 @@ export function classifyClaudeRunRefusal(output, exitCode) {
         return { action: 'clear' };
     return { action: 'none' };
 }
+/**
+ * Parse Codex's usage-limit refusal reset. Codex prints
+ * `ERROR: You've hit your usage limit. … try again at Sep 12th, 2026 8:32 AM.`
+ * (or `…try again at 8:32 AM.` for the 5-hour window). The reset is what makes
+ * this a session-style limit that auto-clears on its clock rather than a
+ * clock-less billing exhaustion. Ordinal suffixes (`12th`) are stripped so
+ * `Date.parse` accepts the date; a time-only reset resolves against today/tomorrow.
+ * Returns null when there is no future reset to parse (caller then leaves the
+ * marker untouched rather than persisting a sticky one it cannot expire).
+ */
+export function parseCodexUsageLimitReset(text, nowMs = Date.now()) {
+    // Gate on the CLI's own refusal phrasing, NOT a bare "usage limit" substring:
+    // this runs against a 16KB stdout tail of `codex exec`, which streams the whole
+    // agent transcript, so a session that merely *discusses* usage-limit code would
+    // otherwise false-positive and wrongly mark a HEALTHY account excluded. Mirrors
+    // the narrow Claude convention (`hit your session limit`).
+    if (!/hit your usage limit/i.test(text))
+        return null;
+    const match = /try again (?:at|on)\s+([^.\n]+)/i.exec(text);
+    if (!match)
+        return null;
+    const segment = match[1].trim().replace(/(\d{1,2})(st|nd|rd|th)\b/gi, '$1');
+    const absolute = Date.parse(segment);
+    if (!Number.isNaN(absolute)) {
+        // A full date parsed — honor it only while still in the future; a past reset
+        // means the window already recovered, so there is nothing to note. Do NOT
+        // fall through to the clock path, which would understate the real date as
+        // today/tomorrow.
+        return absolute > nowMs ? new Date(absolute) : null;
+    }
+    // No date parsed — the 5-hour "try again at 8:32 AM" (time-only) form. Resolve
+    // it against today, rolling to tomorrow when the clock has already passed.
+    const clock = /(\d{1,2})(?::(\d{2}))?\s*(am|pm)/i.exec(segment);
+    if (!clock)
+        return null;
+    let hour = Number(clock[1]) % 12;
+    if (clock[3].toLowerCase() === 'pm')
+        hour += 12;
+    const minute = clock[2] ? Number(clock[2]) : 0;
+    const result = new Date(nowMs);
+    result.setHours(hour, minute, 0, 0);
+    if (result.getTime() <= nowMs)
+        result.setDate(result.getDate() + 1);
+    return result;
+}
+/**
+ * Classify what a Codex run's output + exit code means for the account's
+ * persisted refusal marker — the Codex sibling of {@link classifyClaudeRunRefusal}
+ * (the `ClaudeRefusalAction` shape is harness-generic; the usage cache it drives
+ * is identity-keyed and shared across harnesses). Codex's usage limit is
+ * time-windowed and carries a reset ("try again at <date>"), so it is noted as a
+ * clock-bearing session limit that auto-clears — NOT a clock-less out_of_credits,
+ * which would stay sticky until a successful run the excluded account can never
+ * get. A genuine credit/quota exhaustion IS clock-less. A clean run clears any
+ * stale marker; a limit with no parseable reset is left untouched (the run still
+ * cascades via detectRateLimit) rather than persisting an unexpirable marker.
+ */
+export function classifyCodexRunRefusal(output, exitCode, nowMs = Date.now()) {
+    const reset = parseCodexUsageLimitReset(output, nowMs);
+    if (reset)
+        return { action: 'note_session', resetsAt: reset };
+    if (detectOutOfCredits(output))
+        return { action: 'note_out_of_credits' };
+    if (exitCode === 0)
+        return { action: 'clear' };
+    return { action: 'none' };
+}
 /**
  * Patterns that indicate an authentication failure — the agent is logged out,
  * its token was revoked, or the session expired. These are the user-visible
@@ -2380,24 +2446,28 @@ export async function runWithFallback(options) {
         }
         const output = `${result.stderr}\n${result.stdout}`;
         // Persist a per-account refusal marker so rotation stops re-picking a
-        // known-dead account: a session-limit recovers on its clock, a billing
+        // known-dead account: a session/usage limit recovers on its clock, a billing
         // exhaustion (tokens/credits) recovers only on a later successful run, and a
-        // clean run clears any stale marker. Decision extracted + unit-tested in
-        // classifyClaudeRunRefusal.
-        const sessionLimitReset = agent === 'claude' ? parseClaudeSessionLimitReset(output) : null;
-        if (agent === 'claude' && version) {
-            const refusal = classifyClaudeRunRefusal(output, result.exitCode ?? 1);
-            if (refusal.action !== 'none') {
-                const account = await getAccountInfo(agent, getVersionHomePath(agent, version));
-                const usageKey = getUsageLookupKey(account);
-                if (usageKey) {
-                    if (refusal.action === 'note_session')
-                        noteClaudeSessionLimit(usageKey, refusal.resetsAt);
-                    else if (refusal.action === 'note_out_of_credits')
-                        noteClaudeOutOfCredits(usageKey);
-                    else if (refusal.action === 'clear')
-                        clearClaudeAccountRefusal(usageKey);
-                }
+        // clean run clears any stale marker. Claude and Codex both surface these as
+        // run-ending text, and the usage cache is identity-keyed (shared across
+        // harnesses), so one path notes either. Decisions extracted + unit-tested in
+        // classify{Claude,Codex}RunRefusal.
+        const refusal = agent === 'claude'
+            ? classifyClaudeRunRefusal(output, result.exitCode ?? 1)
+            : agent === 'codex'
+                ? classifyCodexRunRefusal(output, result.exitCode ?? 1)
+                : null;
+        const sessionLimitReset = refusal?.action === 'note_session' ? refusal.resetsAt : null;
+        if (refusal && version && refusal.action !== 'none') {
+            const account = await getAccountInfo(agent, getVersionHomePath(agent, version));
+            const usageKey = getUsageLookupKey(account);
+            if (usageKey) {
+                if (refusal.action === 'note_session')
+                    noteClaudeSessionLimit(usageKey, refusal.resetsAt);
+                else if (refusal.action === 'note_out_of_credits')
+                    noteClaudeOutOfCredits(usageKey);
+                else if (refusal.action === 'clear')
+                    clearClaudeAccountRefusal(usageKey);
             }
         }
         if (result.exitCode === 0 && !sessionLimitReset)

package/dist/lib/fleet/apply.d.ts

@@ -8,7 +8,7 @@
  * (`readyProbe`, `bootstrapAgentsCli`, `buildRemoteAgentsInvocation`, `sshExec`).
  */
 import type { DeviceProfile } from '../devices/registry.js';
-import { type RemoteBackend } from '../secrets/push.js';
+import type { RemoteBackend } from '../secrets-types.js';
 import type { DeviceDesired, DeviceProbe, DeviceDiff, FleetAction, FleetPlan, AuthFilePayload } from './types.js';
 /** Strip a version suffix from an agent spec: `claude@latest` -> `claude`. */
 export declare function agentIdOf(spec: string): string;
@@ -149,7 +149,7 @@ export interface ExecContext {
     dryRun?: boolean;
 }
 /** Execute one device's planned actions in order. Real SSH — no mocks. */
-export declare function reconcileDevice(row: DeviceDiff, device: DeviceProfile, ctx: ExecContext): DeviceApplyResult;
+export declare function reconcileDevice(row: DeviceDiff, device: DeviceProfile, ctx: ExecContext): Promise<DeviceApplyResult>;
 /** Run a pool of async tasks with a concurrency cap, preserving input order. */
 export declare function pool<T, R>(items: T[], limit: number, fn: (item: T, index: number) => Promise<R>): Promise<R[]>;
 /** Reconcile every device row in parallel (capped). */

package/dist/lib/fleet/apply.js

@@ -8,8 +8,8 @@
  * (`readyProbe`, `bootstrapAgentsCli`, `buildRemoteAgentsInvocation`, `sshExec`).
  */
 import * as os from 'os';
-import { pushBundleToHost } from '../secrets/push.js';
-import { AUTH_BUNDLE_NAME, inspectReservedAuthBundle, isReservedBundleName } from '../secrets/bundles.js';
+import { pushBundleToHost } from '../secrets-client.js';
+import { AUTH_BUNDLE_NAME, inspectReservedAuthBundle, isReservedBundleName } from '../secrets-policy.js';
 import { deviceIdentityArgs, sshTargetFor } from '../devices/connect.js';
 import { readyProbe, bootstrapAgentsCli } from '../hosts/ready.js';
 import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
@@ -371,7 +371,7 @@ export function parseRemoteBundles(stdout) {
     }
 }
 /** Execute one device's planned actions in order. Real SSH — no mocks. */
-export function reconcileDevice(row, device, ctx) {
+export async function reconcileDevice(row, device, ctx) {
     if (!row.probe.reachable) {
         return { device: row.device, ok: false, steps: [], note: row.probe.note ?? 'unreachable' };
     }
@@ -438,7 +438,7 @@ export function reconcileDevice(row, device, ctx) {
         }
         const backend = isReservedBundleName(bundle) || device.platform === 'linux' ? 'file' : 'keychain';
         try {
-            const out = pushBundleToHost(bundle, target, {
+            const out = await pushBundleToHost(bundle, target, {
                 remoteBackend: backend,
                 operation: `fleet apply ${row.device}`,
                 // No passphrase, ever, from this path. On the file backend the remote