@phnx-labs/agents-cli 1.22.91 → 1.22.93

package/dist/lib/harness/adapters/kimi.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 export const kimiAdapter = {
     id: 'kimi',
     // Kimi honors KIMI_CODE_HOME (relocates ~/.kimi-code, including config,
@@ -14,7 +14,9 @@ export const kimiAdapter = {
         return `
 # Kimi Code CLI honors KIMI_CODE_HOME to relocate ~/.kimi-code (config.toml,
 # mcp.json, sessions, skills, hooks). Point it at the versioned home.
-export KIMI_CODE_HOME="$VERSION_DIR/home/${ctx.configDirName}"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pin
+# yields to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'KIMI_CODE_HOME', rel: ctx.configDirName }], '$VERSION_DIR/home')}
 `;
     },
     execModeArgs(ctx) {

package/dist/lib/harness/adapters/muse.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 export const museAdapter = {
     id: 'muse',
     // Muse has no MUSE_CONFIG_DIR. Config is XDG-based:
@@ -23,8 +23,9 @@ export const museAdapter = {
 # Pin XDG into the version home so managed runs never walk the adopt-time
 # ~/.config/muse -> version-home symlink — Muse refuses agent-definition
 # sources that are SymlinkOrReparse (exit 1). Same idea as CLAUDE_CONFIG_DIR.
-export XDG_CONFIG_HOME="$VERSION_DIR/home/.config"
-export XDG_DATA_HOME="$VERSION_DIR/home/.local/share"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pins
+# yield to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'XDG_CONFIG_HOME', rel: '.config' }, { env: 'XDG_DATA_HOME', rel: '.local/share' }], '$VERSION_DIR/home')}
 `;
     },
     // muse exec: plan ≈ no non-shell writes; auto skips approval prompts but

package/dist/lib/harness/adapters/opencode.js

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { stripForeignConfigDir } from '../adapter.js';
+import { stripForeignConfigDir, slotAwareConfigEnvBash } from '../adapter.js';
 // OpenCode reads plugins/agents/commands from OPENCODE_CONFIG_DIR and auth from
 // $XDG_DATA_HOME/opencode (HARNESS_AUTH.slotEnv). Pin both at the slot / version
 // home so two accounts in one install never share a credential (PHNX-3940 T5).
@@ -17,7 +17,9 @@ export const opencodeAdapter = {
 # OpenCode reads plugins, agents, commands, and other config-directory
 # resources from OPENCODE_CONFIG_DIR. Point it at the versioned global config
 # tree where agents-cli syncs OpenCode resources.
-export OPENCODE_CONFIG_DIR="$VERSION_DIR/home/.config/opencode"
+# An account-slot launch has already chosen the home (AGENTS_EXEC_HOME); the pin
+# yields to it — see slotAwareConfigEnvBash.
+${slotAwareConfigEnvBash([{ env: 'OPENCODE_CONFIG_DIR', rel: '.config/opencode' }], '$VERSION_DIR/home')}
 `;
     },
 };

package/dist/lib/helper-download.js

@@ -170,7 +170,7 @@ export async function downloadHelperApp(spec, version) {
     const { zip: zipUrl, sha256: shaUrl } = helperAssetUrls(spec, version);
     const missing = (status, url) => new Error(`no ${spec.assetName} release asset for tag ${tag} (HTTP ${status} on ${url}). ` +
         `The macOS helper ships as a GitHub release asset on its own helper tag; ` +
-        `from a repo checkout you can build it locally instead: ${spec.localBuildHint}`);
+        `from a repo checkout you can stage it locally instead: ${spec.localBuildHint}`);
     // Checksum first: it is tiny and 404s fast when the tag has no assets.
     const shaRes = await fetch(shaUrl, { signal: AbortSignal.timeout(30_000) });
     if (!shaRes.ok)

package/dist/lib/helper-versions.js

@@ -36,7 +36,7 @@
  * helper release now, off this table entirely.
  */
 export const HELPER_RELEASES = {
-    menubar: { tagPrefix: 'menubar', floor: '1.0.0' },
+    menubar: { tagPrefix: 'menubar', floor: '1.1.1' },
     'computer-mac': { tagPrefix: 'computer-mac', floor: '1.0.0' },
     // The Windows helper is a bare .exe, not an .app bundle, so it does not share
     // helper-download.ts's zip/codesign/notarize machinery -- but it has the same

package/dist/lib/installations/shims.d.ts

@@ -64,7 +64,7 @@ export interface ConflictInfo {
  *         top-level entry add/remove — deep edits to plugin contents won't
  *         trigger auto-resync, run `agents sync` for that.
  */
-export declare const SHIM_SCHEMA_VERSION = 31;
+export declare const SHIM_SCHEMA_VERSION = 32;
 /**
  * Generate the full bash shim script for the given agent. The returned string
  * is written to ~/.agents/shims/{cliCommand} and made executable.
@@ -179,7 +179,7 @@ export declare function removeShim(agent: AgentId): boolean;
  *        sorted alphabetically before the real self-updated grok binary and
  *        was silently launched instead.
  */
-export declare const VERSIONED_ALIAS_SCHEMA_VERSION = 20;
+export declare const VERSIONED_ALIAS_SCHEMA_VERSION = 21;
 /**
  * Agents whose config directory can be relocated by an environment variable
  * (the per-agent `managedEnv` block in `generateVersionedAliasScript` below).

package/dist/lib/installations/shims.js

@@ -13,6 +13,7 @@ import { AGENTS, agentConfigDirName, readAuthAccountIdentity } from '../agents.j
 import { acquireAuthOperationLock } from '../accounts/auth-operation-lock.js';
 import { codexHomeShimBash } from '../codex-home.js';
 import { resolveHarnessAdapter } from '../harness/index.js';
+import { slotAwareConfigEnvBash } from '../harness/adapter.js';
 import { randomUUID } from 'node:crypto';
 import { captureProcessStartTime } from '../platform/process.js';
 import { atomicWriteFileSync } from '../fs-atomic.js';
@@ -267,7 +268,10 @@ async function promptConflictStrategy(conflictInfos) {
 //        grok-0.2.118-* file — a 99-byte wrapper that exec'd cursor-agent —
 //        sorted alphabetically before the real self-updated grok binary and
 //        was silently launched instead.
-export const SHIM_SCHEMA_VERSION = 31;
+// v32 — every config-dir pin (claude, grok, opencode, kimi, muse, copilot) yields to
+//        an account-slot launch (AGENTS_EXEC_HOME from `agents run`), so a slot run
+//        reads and writes its own slot home instead of the shared version home.
+export const SHIM_SCHEMA_VERSION = 32;
 /** Internal marker string used to embed the schema version in shim scripts. */
 const SHIM_VERSION_MARKER = 'agents-shim-version:';
 function shellQuote(value) {
@@ -1095,7 +1099,12 @@ export function removeShim(agent) {
 // v18 — Cursor aliases select the file credential store and swap HOME to the
 //       version home because current Cursor writes auth.json under ~/.cursor
 //       and ignores XDG_CONFIG_HOME for credential storage.
-export const VERSIONED_ALIAS_SCHEMA_VERSION = 20;
+// v21 — every alias config-dir pin (claude, grok, opencode, kimi, muse, copilot)
+//       yields to an account-slot launch (AGENTS_EXEC_HOME from `agents run`). Before,
+//       the alias re-pinned every slot launch onto the shared version home, so a worker
+//       run picked as one account onboarded from scratch and kept its history in
+//       another account's home.
+export const VERSIONED_ALIAS_SCHEMA_VERSION = 21;
 /** Internal marker string used to embed the schema version in versioned alias scripts. */
 const VERSIONED_ALIAS_VERSION_MARKER = 'agents-versioned-alias-version:';
 // The version string is interpolated into a generated bash script and into
@@ -1229,35 +1238,34 @@ ${resolveHarnessAdapter(agent).shimConfigEnvBash?.({ configDirName }) ?? ''}`
 # Copilot honors COPILOT_HOME to relocate ~/.copilot (settings, mcp-config.json,
 # session-state, logs). Point direct aliases at the versioned home so per-
 # version MCP and session state are isolated.
-export COPILOT_HOME="$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home/${configDirName}"
+${slotAwareConfigEnvBash([{ env: 'COPILOT_HOME', rel: configDirName }], `$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home`)}
 `
                 : agent === 'grok'
                     ? `
 # Grok Build uses GROK_HOME to isolate its entire configuration tree (skills,
 # hooks, plugins, agents, memory, sessions, config.toml, MCP). Point direct
 # aliases at the versioned home for isolation parity with the main shim.
-export GROK_HOME="$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home/${configDirName}"
+${slotAwareConfigEnvBash([{ env: 'GROK_HOME', rel: configDirName }], `$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home`)}
 `
                     : agent === 'opencode'
                         ? `
 # OpenCode reads plugins, agents, commands, and other config-directory
 # resources from OPENCODE_CONFIG_DIR. Point direct aliases at the versioned
 # global config tree where agents-cli syncs OpenCode resources.
-export OPENCODE_CONFIG_DIR="$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home/.config/opencode"
+${slotAwareConfigEnvBash([{ env: 'OPENCODE_CONFIG_DIR', rel: '.config/opencode' }], `$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home`)}
 `
                         : agent === 'kimi'
                             ? `
 # Kimi Code CLI honors KIMI_CODE_HOME to relocate ~/.kimi-code (config.toml,
 # mcp.json, sessions, skills, hooks). Point direct aliases at the versioned home.
-export KIMI_CODE_HOME="$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home/${configDirName}"
+${slotAwareConfigEnvBash([{ env: 'KIMI_CODE_HOME', rel: configDirName }], `$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home`)}
 `
                             : agent === 'muse'
                                 ? `
 # Muse Code: no dedicated config env var. Pin XDG so config/sessions live under
 # the version home as real directories (not via the adopt symlink at
 # ~/.config/muse, which Muse rejects with SymlinkOrReparse).
-export XDG_CONFIG_HOME="$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home/.config"
-export XDG_DATA_HOME="$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home/.local/share"
+${slotAwareConfigEnvBash([{ env: 'XDG_CONFIG_HOME', rel: '.config' }, { env: 'XDG_DATA_HOME', rel: '.local/share' }], `$AGENTS_REAL_HOME/.agents/.history/versions/${agent}/${version}/home`)}
 `
                                 : agent === 'cursor'
                                     ? `

package/dist/lib/menubar/download-menubar.js

@@ -36,7 +36,10 @@ export const MENUBAR_HELPER_SPEC = {
     cacheSubdir: ['menubar', 'mac-helper'],
     expectedTeamId: EXPECTED_TEAM_ID,
     expectedBundleId: MENUBAR_HELPER_BUNDLE_ID,
-    localBuildHint: 'menubar/scripts/build.sh release, then cp -R menubar/dist/MenubarHelper.app bin/MenubarHelper.app',
+    // No local build exists in this repo: the source is phnx-labs/agi-menu. The
+    // staging script downloads + verifies the same published asset into
+    // bin/MenubarHelper.app, which the installer resolves from a checkout.
+    localBuildHint: 'scripts/stage-menubar-helper.sh (stages the published menubar/v<floor> asset into bin/MenubarHelper.app; source: https://github.com/phnx-labs/agi-menu)',
 };
 /** Release-asset URLs for the menu-bar helper zip + its checksum at `v<version>`. */
 export function menubarHelperAssetUrls(version) {

package/dist/lib/menubar/install-menubar.d.ts

@@ -24,8 +24,8 @@
  * (`SERVICE_LABEL_BASE`, `MENUBAR_HELPER_BUNDLE_ID` in download-menubar.ts) —
  * those are what keep the existing Accessibility grant alive across upgrades.
  * Every basename-matching check reads this constant rather than re-deriving
- * the string; the Swift side has its own equal in
- * `menubar/Sources/MenubarHelper/HelperIdentity.swift`.
+ * the string; the Swift side (phnx-labs/agi-menu,
+ * `Sources/MenubarHelper/HelperIdentity.swift`) has its own equal.
  */
 export declare const MENUBAR_HELPER_EXECUTABLE_NAME = "AGI Menu";
 /**
@@ -40,7 +40,7 @@ export declare function serviceLabel(): string;
  *
  * `source` matters because the two install paths have different notions of
  * "changed": a release bundle is identified by its helper version, while a local
- * dev build has none (menubar/scripts/build.sh hardcodes CFBundleShortVersionString),
+ * dev build has none (agi-menu's build.sh hardcodes CFBundleShortVersionString),
  * so it is identified by the source path + mtime it was copied from.
  */
 /** Version label for a bundle that has none of its own (a local dev build). */
@@ -75,10 +75,11 @@ export declare function codesignVerifies(appPath: string): boolean;
  * A Developer-ID-signed but un-notarized app is rejected by `spctl --assess`,
  * which macOS surfaces as "the app is damaged" and can crash AppKit during
  * launch. This is separate from `codesign --verify`: a signature can be valid
- * while Gatekeeper still refuses to run it. The release notarizes + staples the
- * helper (menubar/scripts/build.sh, gated by verify-menubar-helper.sh), so a
- * shipped bundle passes this; the launch guards use it to fail loud rather than
- * bootstrap a helper macOS would reject.
+ * while Gatekeeper still refuses to run it. The helper's own release
+ * (phnx-labs/agi-menu scripts/release.sh) notarizes + staples it and this repo's
+ * stage-menubar-helper.sh re-verifies it, so a shipped bundle passes this; the
+ * launch guards use it to fail loud rather than bootstrap a helper macOS would
+ * reject.
  */
 export declare function gatekeeperAssesses(appPath: string): boolean;
 /** True when the bundle carries a Developer ID TeamIdentifier (not ad-hoc). */
@@ -258,7 +259,7 @@ export declare function disableMenubarService(): void;
  * There is deliberately NO content comparison here. Comparing the shipped helper
  * against the installed one cannot distinguish "real upgrade" from "another
  * install's copy": the helper is rebuilt, re-signed and re-notarized on every
- * release (`menubar/scripts/build.sh` via `release.sh`), so consecutive releases
+ * helper release (phnx-labs/agi-menu scripts/release.sh), so consecutive releases
  * ship byte-different bundles from identical Swift source — 1.22.20/21/22 all
  * have the same 2876288-byte executable and three different sha256s AND three
  * different CDHashes. Any digest gate therefore reports "changed" for exactly
@@ -323,7 +324,7 @@ export declare function shouldMigrateMenubarTcc(opts: {
  * Reset the stale Accessibility grant TCC recorded against the pre-migration
  * ad-hoc identity, then stamp the marker so this never runs again on this
  * machine. Targets `SERVICE_LABEL_BASE` — the bundle's actual
- * `CFBundleIdentifier`/codesign `--identifier` (menubar/scripts/build.sh) that
+ * `CFBundleIdentifier`/codesign `--identifier` (set by agi-menu's build.sh) that
  * TCC keys grants to — not the namespaced `serviceLabel()`, which exists only
  * to keep launchd job labels apart under a redirected HOME (RUSH-2639) and is
  * never the app's real identity. Best-effort: a missing/failing `tccutil`

package/dist/lib/menubar/install-menubar.js

@@ -40,8 +40,8 @@ const SERVICE_LABEL_BASE = 'com.phnx-labs.agents-menubar';
  * (`SERVICE_LABEL_BASE`, `MENUBAR_HELPER_BUNDLE_ID` in download-menubar.ts) —
  * those are what keep the existing Accessibility grant alive across upgrades.
  * Every basename-matching check reads this constant rather than re-deriving
- * the string; the Swift side has its own equal in
- * `menubar/Sources/MenubarHelper/HelperIdentity.swift`.
+ * the string; the Swift side (phnx-labs/agi-menu,
+ * `Sources/MenubarHelper/HelperIdentity.swift`) has its own equal.
  */
 export const MENUBAR_HELPER_EXECUTABLE_NAME = 'AGI Menu';
 /**
@@ -64,8 +64,9 @@ export function serviceLabel() {
  * respawn rate while staying well inside "the menu bar came back on its own".
  *
  * This only paces the restarts. What actually stops the pile-up is the helper
- * bounding and group-killing its own children (menubar/Sources/MenubarHelper/
- * ChildProcess.swift); the two are complementary, not alternatives.
+ * bounding and group-killing its own children (agi-menu's
+ * `Sources/MenubarHelper/ChildProcess.swift`); the two are complementary, not
+ * alternatives.
  */
 const MENUBAR_THROTTLE_SECONDS = 30;
 function onDarwin() {
@@ -94,7 +95,7 @@ function installedVersionMarkerPath() {
  *
  * `source` matters because the two install paths have different notions of
  * "changed": a release bundle is identified by its helper version, while a local
- * dev build has none (menubar/scripts/build.sh hardcodes CFBundleShortVersionString),
+ * dev build has none (agi-menu's build.sh hardcodes CFBundleShortVersionString),
  * so it is identified by the source path + mtime it was copied from.
  */
 /** Version label for a bundle that has none of its own (a local dev build). */
@@ -163,9 +164,10 @@ export function menubarServiceInstalled() {
 /**
  * Locate the source `.app` shipped alongside the compiled JS.
  *   1. dist/lib/menubar/MenubarHelper.app — npm install layout (sibling of this file)
- *   2. <repo>/bin/MenubarHelper.app       — raw working tree (tsx/dev)
- *   3. cli/menubar/dist/MenubarHelper.app — fresh local build
- *   4. <on-disk install>/dist/lib/menubar/MenubarHelper.app — Bun single-file
+ *   2. <repo>/bin/MenubarHelper.app       — raw working tree (tsx/dev): the
+ *      published bundle staged by scripts/stage-menubar-helper.sh, or a build
+ *      copied in from a phnx-labs/agi-menu checkout
+ *   3. <on-disk install>/dist/lib/menubar/MenubarHelper.app — Bun single-file
  *      binary: `import.meta.url` is a virtual `/$bunfs/` path, so the sibling
  *      candidates above can't see the on-disk bundle; recover it via the
  *      `agents` launcher symlink.
@@ -176,7 +178,6 @@ function sourceAppPath() {
         const here = path.dirname(fileURLToPath(import.meta.url));
         candidates.push(path.join(here, APP_BUNDLE_NAME));
         candidates.push(path.resolve(here, '..', '..', '..', 'bin', APP_BUNDLE_NAME));
-        candidates.push(path.resolve(here, '..', '..', '..', 'menubar', 'dist', APP_BUNDLE_NAME));
     }
     catch {
         /* import.meta.url unavailable */
@@ -242,10 +243,11 @@ export function codesignVerifies(appPath) {
  * A Developer-ID-signed but un-notarized app is rejected by `spctl --assess`,
  * which macOS surfaces as "the app is damaged" and can crash AppKit during
  * launch. This is separate from `codesign --verify`: a signature can be valid
- * while Gatekeeper still refuses to run it. The release notarizes + staples the
- * helper (menubar/scripts/build.sh, gated by verify-menubar-helper.sh), so a
- * shipped bundle passes this; the launch guards use it to fail loud rather than
- * bootstrap a helper macOS would reject.
+ * while Gatekeeper still refuses to run it. The helper's own release
+ * (phnx-labs/agi-menu scripts/release.sh) notarizes + staples it and this repo's
+ * stage-menubar-helper.sh re-verifies it, so a shipped bundle passes this; the
+ * launch guards use it to fail loud rather than bootstrap a helper macOS would
+ * reject.
  */
 export function gatekeeperAssesses(appPath) {
     const r = spawnSync('spctl', ['--assess', '--type', 'exec', appPath], { stdio: ['ignore', 'ignore', 'ignore'] });
@@ -751,7 +753,7 @@ export function disableMenubarService() {
  * There is deliberately NO content comparison here. Comparing the shipped helper
  * against the installed one cannot distinguish "real upgrade" from "another
  * install's copy": the helper is rebuilt, re-signed and re-notarized on every
- * release (`menubar/scripts/build.sh` via `release.sh`), so consecutive releases
+ * helper release (phnx-labs/agi-menu scripts/release.sh), so consecutive releases
  * ship byte-different bundles from identical Swift source — 1.22.20/21/22 all
  * have the same 2876288-byte executable and three different sha256s AND three
  * different CDHashes. Any digest gate therefore reports "changed" for exactly
@@ -968,7 +970,7 @@ export function shouldMigrateMenubarTcc(opts) {
  * Reset the stale Accessibility grant TCC recorded against the pre-migration
  * ad-hoc identity, then stamp the marker so this never runs again on this
  * machine. Targets `SERVICE_LABEL_BASE` — the bundle's actual
- * `CFBundleIdentifier`/codesign `--identifier` (menubar/scripts/build.sh) that
+ * `CFBundleIdentifier`/codesign `--identifier` (set by agi-menu's build.sh) that
  * TCC keys grants to — not the namespaced `serviceLabel()`, which exists only
  * to keep launchd job labels apart under a redirected HOME (RUSH-2639) and is
  * never the app's real identity. Best-effort: a missing/failing `tccutil`

package/dist/lib/secrets-policy.d.ts

@@ -240,13 +240,16 @@ export interface ReconcileWorkerSlotsDeps {
     readMetaFn?: () => Pick<Meta, 'accounts' | 'deviceAccounts'>;
     hasLocalKey?: (bundle: string, key: string) => boolean;
     provision?: (account: NativeAccountRecord) => void;
+    /** True when an existing durable slot already carries everything provisioning seeds. */
+    slotSeeded?: (harness: AgentId, slotDir: string) => boolean;
 }
 /**
  * Worker-side: after a durable key lands, materialize a slot for each portable
  * account whose credential is now present locally. Runs only on a NON-headed
  * (worker or unmarked) device -- a headed device provisions its slots from an
  * interactive native login (`accounts add`), never from an injected durable key
- * (invariant 7). Idempotent: an account already backed by a `durable` slot is
- * skipped.
+ * (invariant 7). Idempotent: an account already backed by a fully seeded
+ * `durable` slot is skipped; a claude slot provisioned before onboarding was
+ * seeded (no `hasCompletedOnboarding`) is provisioned again so it converges.
  */
 export declare function reconcileLocalWorkerSlots(deps?: ReconcileWorkerSlotsDeps): ReconcileWorkerSlotsResult;

package/dist/lib/secrets-policy.js

@@ -19,7 +19,7 @@ import { machineId, normalizeHost } from './session/sync/config.js';
 import { readFleetSharedDeviceStates, updateFleetSharedDeviceStateAsync, } from './fleet-shared-state.js';
 import { getCacheDir, getUserAgentsDir, readMeta } from './state.js';
 import { listNativeAccounts, readSlots } from './account-registry.js';
-import { claudeAccountTokenKey, provisionWorkerSlot, readReservedCredential } from './claude-account-token.js';
+import { claudeAccountTokenKey, isClaudeWorkerHomeSeeded, provisionWorkerSlot, readReservedCredential } from './claude-account-token.js';
 import { configuredDeviceRole, isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
 import { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, } from './reserved-stores.js';
 // --- reserved per-harness credential stores (PHNX-3940 / PHNX-3989) --------
@@ -469,13 +469,17 @@ export async function syncReservedStores(deps = {}) {
     writeDeliveryMemo(memo, deps.cacheDir ?? getCacheDir());
     return result;
 }
+function defaultSlotSeeded(harness, slotDir) {
+    return harness === 'claude' ? isClaudeWorkerHomeSeeded(slotDir) : true;
+}
 /**
  * Worker-side: after a durable key lands, materialize a slot for each portable
  * account whose credential is now present locally. Runs only on a NON-headed
  * (worker or unmarked) device -- a headed device provisions its slots from an
  * interactive native login (`accounts add`), never from an injected durable key
- * (invariant 7). Idempotent: an account already backed by a `durable` slot is
- * skipped.
+ * (invariant 7). Idempotent: an account already backed by a fully seeded
+ * `durable` slot is skipped; a claude slot provisioned before onboarding was
+ * seeded (no `hasCompletedOnboarding`) is provisioned again so it converges.
  */
 export function reconcileLocalWorkerSlots(deps = {}) {
     const result = { provisioned: [], skipped: [], errors: [] };
@@ -486,6 +490,7 @@ export function reconcileLocalWorkerSlots(deps = {}) {
     const slots = readSlots(meta);
     const hasLocalKey = deps.hasLocalKey ?? defaultHasLocalKey;
     const provision = deps.provision ?? provisionWorkerSlot;
+    const slotSeeded = deps.slotSeeded ?? defaultSlotSeeded;
     const byId = new Map(listNativeAccounts(meta).map((account) => [account.id, account]));
     // Resolve each account to the one (bundle, key) the push plan uses: a T1 row's
     // reserved `__<harness>__` key, or the legacy `auth` key by email for a claude
@@ -502,12 +507,21 @@ export function reconcileLocalWorkerSlots(deps = {}) {
             result.skipped.push({ accountId: account.id, reason: 'durable key not synced yet' });
             continue;
         }
-        if (slots[account.id]?.authMode === 'durable') {
+        const existing = slots[account.id];
+        const reseed = existing?.authMode === 'durable';
+        if (reseed && slotSeeded(account.agent, existing.slotDir)) {
             result.skipped.push({ accountId: account.id, reason: 'slot already provisioned' });
             continue;
         }
         try {
             provision(account);
+            // A re-seed that still reads as unseeded is a slot file this box cannot
+            // repair (a .claude.json that exists but does not parse is left alone by
+            // the seeder). Surface it instead of logging "provisioned" every tick.
+            if (reseed && !slotSeeded(account.agent, existing.slotDir)) {
+                result.errors.push({ accountId: account.id, message: `slot ${existing.slotDir} is still not fully seeded after re-provisioning; a config file there exists but cannot be parsed` });
+                continue;
+            }
             result.provisioned.push(account.id);
         }
         catch (err) {

package/dist/lib/session/active.d.ts

@@ -267,6 +267,16 @@ export interface ActiveSession {
      * off this so an idle-but-old session doesn't read as freshly active.
      */
     lastActivityMs?: number;
+    /**
+     * The transcript's own cursor — the harness stamp on the last meaningful event
+     * (message / tool call / tool result), from {@link SessionState.lastEventMs}.
+     * Unlike {@link lastActivityMs} it does not move when a hook-firing record is
+     * appended, so the attention reconciler uses it to decide whether the agent
+     * worked past a hook-raised prompt (PHNX-3999). Absent when the harness stamps
+     * no times, when no transcript was parsed, and on rows from a peer running an
+     * older CLI.
+     */
+    lastEventMs?: number;
     status: ActiveStatus;
     /**
      * Coarse lifecycle bucket derived once from {@link status} (see {@link SessionPhase}).
@@ -642,26 +652,23 @@ interface LiveSignals {
     /** Rolling output-token throughput (tokens/sec). Undefined when no usage in the tail. */
     tokPerSec?: number;
 }
-/** Test seam: drop the in-process live-signals memo. */
+/** Test seam: drop the in-process parsed-tail memo. */
 export declare function clearLiveSignalsCacheForTest(): void;
 /**
  * Derive the inferred state (working / waiting / idle + preview/badges) and, for
  * the two harnesses whose raw lines carry it, the output-token throughput.
  *
- * Claude/Codex take the fast bounded byte-tail ({@link readSessionTailWithRaw}) —
- * the hot path, and the only two that also yield throughput (their raw lines
- * carry usage the event model drops). EVERY OTHER tracked harness (grok, droid,
- * rush, gemini, kimi, hermes, opencode, antigravity, cursor) is parsed with its own
- * parser and run through the SAME {@link inferSessionState}, so a live
- * non-claude/codex agent gets a real working/waiting/idle instead of the blanket
- * `unknown` it used to fall through to. An opaque/untracked kind or an
+ * Every tracked harness runs through the SAME {@link inferSessionState}, so a
+ * live non-claude/codex agent gets a real working/waiting/idle instead of the
+ * blanket `unknown` it used to fall through to. An opaque/untracked kind or an
  * unreadable/empty transcript yields an empty signal set, and the caller's
  * {@link resolveFallbackStatus} reports the honest live floor (`running`).
  *
- * Unchanged-mtime hits reuse the previous result (see {@link liveSignalsCache})
- * so a 30s active-session poll does not re-tail every quiet transcript.
+ * An unchanged-mtime call reuses the parsed tail (see {@link liveTailCache}) so a
+ * 30s active-session poll does not re-tail every quiet transcript — but it always
+ * re-classifies against `nowMs`, so an elapsed-time verdict is never frozen.
  */
-export declare function computeLiveSignals(kind: string, sessionFile: string | undefined, cwd: string | undefined, pidAlive: boolean): LiveSignals;
+export declare function computeLiveSignals(kind: string, sessionFile: string | undefined, cwd: string | undefined, pidAlive: boolean, nowMs?: number): LiveSignals;
 /**
  * One-line summary of a teammate's spawn prompt — the team's task/target. Takes
  * the first non-empty line, strips a leading `MISSION:`/`CONTEXT:`/`TASK:` label,

package/dist/lib/session/active.js

@@ -760,36 +760,56 @@ function parseTailEventsForKind(agent, sessionFile) {
     return events.length > LIVE_STATE_MAX_EVENTS ? events.slice(-LIVE_STATE_MAX_EVENTS) : events;
 }
 /**
- * Process-local memo for {@link computeLiveSignals}. The menu-bar / `--active`
- * poll re-reads every live session on a ~30s tick (#2047). When a transcript's
- * mtime (and pidAlive / kind / cwd) are unchanged, re-parsing the tail yields
- * the same signals — skip the parse. Bound the map so a long-lived daemon that
- * sees thousands of sessions over its life cannot retain them forever.
- */
-const LIVE_SIGNALS_CACHE_MAX = 512;
-const liveSignalsCache = new Map();
-/** Test seam: drop the in-process live-signals memo. */
+ * Process-local memo of the PARSED TAIL for {@link computeLiveSignals}. The
+ * menu-bar / `--active` poll re-reads every live session on a ~30s tick (#2047),
+ * and while a transcript's mtime is unchanged its bytes are unchanged — so the
+ * parse (the expensive half) is memoized on mtime. The CLASSIFICATION is not:
+ * `inferSessionState` is re-run on every call against the current clock and the
+ * current `pidAlive`, because a time-based verdict (the 30-minute prose-question
+ * decay) must expire on schedule even while the bytes sit still — a memo keyed
+ * on mtime froze that verdict for as long as nobody typed (PHNX-3999). Bound the
+ * map so a long-lived daemon that sees thousands of sessions cannot retain them
+ * forever.
+ */
+const LIVE_TAIL_CACHE_MAX = 512;
+const liveTailCache = new Map();
+/** Test seam: drop the in-process parsed-tail memo. */
 export function clearLiveSignalsCacheForTest() {
-    liveSignalsCache.clear();
+    liveTailCache.clear();
+}
+/**
+ * Parse the transcript tail for one harness. Claude/Codex take the fast bounded
+ * byte-tail ({@link readSessionTailWithRaw}) — the hot path, and the only two
+ * that also yield throughput (their raw lines carry usage the event model drops).
+ * EVERY OTHER tracked harness (grok, droid, rush, gemini, kimi, hermes, opencode,
+ * antigravity, cursor) is parsed with its own parser. An opaque/untracked kind
+ * yields no events.
+ */
+function parseLiveTail(kind, sessionFile, mtimeMs) {
+    if (kind === 'claude' || kind === 'codex') {
+        const { events, content } = readSessionTailWithRaw(sessionFile, kind);
+        const tokPerSec = events.length > 0 ? computeTokPerSec(content, kind) : 0;
+        return { mtimeMs, events, tokPerSec: tokPerSec > 0 ? tokPerSec : undefined };
+    }
+    if (isSessionTrackedAgent(kind))
+        return { mtimeMs, events: parseTailEventsForKind(kind, sessionFile) };
+    return { mtimeMs, events: [] };
 }
 /**
  * Derive the inferred state (working / waiting / idle + preview/badges) and, for
  * the two harnesses whose raw lines carry it, the output-token throughput.
  *
- * Claude/Codex take the fast bounded byte-tail ({@link readSessionTailWithRaw}) —
- * the hot path, and the only two that also yield throughput (their raw lines
- * carry usage the event model drops). EVERY OTHER tracked harness (grok, droid,
- * rush, gemini, kimi, hermes, opencode, antigravity, cursor) is parsed with its own
- * parser and run through the SAME {@link inferSessionState}, so a live
- * non-claude/codex agent gets a real working/waiting/idle instead of the blanket
- * `unknown` it used to fall through to. An opaque/untracked kind or an
+ * Every tracked harness runs through the SAME {@link inferSessionState}, so a
+ * live non-claude/codex agent gets a real working/waiting/idle instead of the
+ * blanket `unknown` it used to fall through to. An opaque/untracked kind or an
  * unreadable/empty transcript yields an empty signal set, and the caller's
  * {@link resolveFallbackStatus} reports the honest live floor (`running`).
  *
- * Unchanged-mtime hits reuse the previous result (see {@link liveSignalsCache})
- * so a 30s active-session poll does not re-tail every quiet transcript.
+ * An unchanged-mtime call reuses the parsed tail (see {@link liveTailCache}) so a
+ * 30s active-session poll does not re-tail every quiet transcript — but it always
+ * re-classifies against `nowMs`, so an elapsed-time verdict is never frozen.
  */
-export function computeLiveSignals(kind, sessionFile, cwd, pidAlive) {
+export function computeLiveSignals(kind, sessionFile, cwd, pidAlive, nowMs = Date.now()) {
     if (!sessionFile)
         return {};
     let mtimeMs;
@@ -798,30 +818,17 @@ export function computeLiveSignals(kind, sessionFile, cwd, pidAlive) {
     }
     catch { /* vanished between calls */ }
     const cacheKey = `${kind}\0${sessionFile}\0${cwd ?? ''}`;
-    const cached = liveSignalsCache.get(cacheKey);
-    if (cached && cached.mtimeMs === mtimeMs && cached.pidAlive === pidAlive) {
-        return cached.signals;
-    }
-    const ctx = { cwd, pidAlive, mtimeMs, activeWindowMs: ACTIVE_MTIME_WINDOW_MS };
-    let signals = {};
-    if (kind === 'claude' || kind === 'codex') {
-        const { events, content } = readSessionTailWithRaw(sessionFile, kind);
-        if (events.length > 0) {
-            const state = inferSessionState(events, ctx);
-            const tokPerSec = computeTokPerSec(content, kind);
-            signals = { state, tokPerSec: tokPerSec > 0 ? tokPerSec : undefined };
-        }
-    }
-    else if (isSessionTrackedAgent(kind)) {
-        const events = parseTailEventsForKind(kind, sessionFile);
-        if (events.length > 0) {
-            signals = { state: inferSessionState(events, ctx) };
-        }
-    }
-    if (liveSignalsCache.size >= LIVE_SIGNALS_CACHE_MAX)
-        liveSignalsCache.clear();
-    liveSignalsCache.set(cacheKey, { mtimeMs, pidAlive, signals });
-    return signals;
+    let tail = liveTailCache.get(cacheKey);
+    if (!tail || tail.mtimeMs !== mtimeMs) {
+        tail = parseLiveTail(kind, sessionFile, mtimeMs);
+        if (liveTailCache.size >= LIVE_TAIL_CACHE_MAX)
+            liveTailCache.clear();
+        liveTailCache.set(cacheKey, tail);
+    }
+    if (tail.events.length === 0)
+        return {};
+    const state = inferSessionState(tail.events, { cwd, pidAlive, mtimeMs, activeWindowMs: ACTIVE_MTIME_WINDOW_MS, nowMs });
+    return { state, tokPerSec: tail.tokPerSec };
 }
 /** Map inferred activity onto the coarse ActiveStatus used by the renderer and counts. */
 function statusFromActivity(activity) {
@@ -850,6 +857,7 @@ function applyState(base, state, fallbackFile, pidAlive) {
         activity: state.activity,
         awaitingReason: state.awaitingReason,
         question: state.question,
+        lastEventMs: state.lastEventMs,
         plan: state.plan,
         todos: state.todos,
         tail: state.tail,

package/dist/lib/session/session-cache.d.ts

@@ -59,7 +59,7 @@ export declare const IMMUTABLE_FIELD_KEYS: readonly ["topic", "firstUserMessage"
  * are short-window signals (preview, tok/s). The short snapshot TTL is the
  * only cache that may carry them — and only as a whole-row snapshot.
  */
-export declare const LIVE_STATUS_KEYS: readonly ["status", "activity", "preview", "tokPerSec", "awaitingReason", "question", "todos", "tail", "lastActivityMs", "hostLink", "presence", "pidAlive", "tmuxClients", "windowHeartbeatMs", "provenance", "rateLimited", "plan"];
+export declare const LIVE_STATUS_KEYS: readonly ["status", "activity", "preview", "tokPerSec", "awaitingReason", "question", "todos", "tail", "lastActivityMs", "lastEventMs", "hostLink", "presence", "pidAlive", "tmuxClients", "windowHeartbeatMs", "provenance", "rateLimited", "plan"];
 /**
  * How long after the last reader heartbeat the daemon considers the journal
  * to have no active consumer and skips the expensive `ps`+`lsof` gather.

package/dist/lib/session/session-cache.js

@@ -88,6 +88,7 @@ export const LIVE_STATUS_KEYS = [
     'todos',
     'tail',
     'lastActivityMs',
+    'lastEventMs',
     'hostLink',
     'presence',
     'pidAlive',