@prohost/cli 0.12.1 → 0.12.3

package/CHANGELOG.md

@@ -4,6 +4,93 @@ Versions follow [semver](https://semver.org/). Publishing is automated: merging
 a version bump to `main` triggers `.github/workflows/npm-publish-cli.yml`, which
 builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
+## 0.12.3
+
+- **A run stopped by the Claude usage limit says so.** It used to fail with
+  "agent command exited 1", the reason left in the stream the CLI never read.
+  It now reports `Claude usage limit reached on <machine>: You've hit your
+  weekly limit · resets Oct 16 at 11am (America/New_York)`, and the thread's
+  notice shows it.
+- **That run keeps its conversation's session, and runs once.** A resumed run
+  that failed for any reason was taken for a session Claude Code could no
+  longer find, because every stream event names the session. The CLI then
+  dropped the conversation's session and ran the turn again from scratch, which
+  spent quota and, at a usage limit, failed a second time. A resume now counts
+  as rejected only when no session started. A run stopped by the usage limit
+  is not run again, and the next run after the reset continues the
+  conversation.
+- **Any Claude Code or Codex run that exits non-zero reports its own error**
+  (an API error, a failed turn), not just the exit code. Only that message is
+  read from the stream; tool output stays on this machine.
+
+## 0.12.2
+
+- **Two agents on one computer no longer delete each other's account.** Every
+  agent home on a computer shares one account registry, and ProhostAI keeps
+  exactly the accounts a status frame lists. A running `agent run` re-read that
+  list only every 15 minutes, so when a second agent started on a login of its
+  own (a Codex agent beside a Claude Code one), the first kept sending a list
+  without it and the server deleted it on every frame. For up to 15 minutes
+  the second agent showed as "Not on a listed account", on and off.
+- The list is now checked against the registry for every frame. A routine
+  frame, and the first frame after a reconnect, re-reads it when it has
+  changed, so an added account is listed and a removed one is gone within 5
+  minutes instead of 15. Only an account new to the list is asked whether it
+  is signed in; one whose CLI can't answer is listed as `unknown`. The check
+  of every login stays on its 15-minute cadence.
+- A frame sent between routine ones (a run ended on another model, capacity
+  crossed a band) leaves the list out when the registry has changed since it
+  was read, and so does one sent after a re-read that failed. A frame without
+  a list deletes nothing; the next routine frame carries it.
+- **A registry that can't be read is no longer reported as "no accounts".**
+  A registry file that is unreadable, cut short or not a registry used to
+  read as empty, and a status frame built from it listed no accounts, which
+  had ProhostAI delete every account on the computer. Now the frame keeps the
+  account it last knew and leaves the list out until the file reads again;
+  the first frame after start names no account at all. A registry with no
+  file yet is still an empty one.
+- **An account this version can't read is no longer deleted for it.** A
+  registry entry that is damaged, or that names a runtime or billing this
+  version doesn't know (one a newer CLI on the same computer wrote), used to
+  be skipped, and the list sent without it had ProhostAI delete that account.
+  While such an entry is in the registry the agent sends no list. It still
+  names the account it runs on, checks its sign-in and follows a switch, and
+  every other command sees the accounts it can read, as before. After the
+  entry is gone the list returns within 15 minutes.
+- **And it is no longer erased from the registry either.** Every write to the
+  registry (the default login being recorded on first use, `account add`,
+  `account remove`, a login `usage` discovers) used to write back only the
+  accounts this version understands, so one write erased a newer CLI's
+  account from the computer for good. Now a write changes only the entry it
+  is about: entries this version can't read, top-level fields it doesn't
+  know and a `version` that isn't its own are written back as they were, in
+  place. A registry this version wrote is written exactly as before.
+- **One login keeps one identity beside a newer CLI's record of it.** Where
+  an entry this version can't read already stands for the same login (the
+  same runtime and label, or the same runtime and directory), nothing is
+  recorded beside it:
+  - the agent's `default` account takes that entry's key when ProhostAI
+    would accept it and the entry is the agent CLI's own login, and no second
+    default is made. Only the key is taken: the billing reported is what the
+    login itself says, or `subscription`. With no key to use, the agent names
+    no account, says why once in its log, and still runs;
+  - `account add <label>` is refused when such an entry uses the label, with
+    a message to update the CLI, and `usage` discovery skips a login such an
+    entry already holds;
+  - an entry whose runtime or label isn't text claims no login.
+- **One account the server would refuse no longer costs the whole status
+  frame.** ProhostAI drops a status frame if any account in it has a key that
+  is not a UUID or a label that is empty, longer than 64 characters or not
+  storable text, and the agent's own account and capacity are lost with it.
+  Accounts made by this CLI always pass; a hand-edited registry may not.
+  While the registry holds such an account, or says it is at a version other
+  than 1, the agent sends no list, and it never names an account that would
+  be refused. Runs still go out on that account.
+- An agent still running 0.12.1 or older keeps sending its old list for up to
+  15 minutes after another agent's account appears, and any write it makes to
+  the registry still erases the entries it can't read. Upgrade and restart
+  every agent on the computer, not only the newest one.
+
 ## 0.12.1
 
 - **An account the 0.10.1-row upload un-reports waits for its next report.**

package/README.md

@@ -233,7 +233,9 @@ and gets a reply that has forgotten asking. The CLI reads the `session_id` out
 of Claude Code's JSON output, records it per conversation in
 `~/.prohost/sessions.json`, and `--resume`s it next time. Sessions don't live
 forever; when one is gone the run is retried once from scratch rather than
-failing.
+failing. A run stopped by your Claude usage limit is not retried: it fails
+with Claude Code's own message, which says when the limit resets, and the
+conversation keeps its session for the next run.
 
 **It lets the agent actually do things.** Runs are invoked with
 `--dangerously-skip-permissions`, so tool calls execute without stopping to ask.

package/dist/agent/account_runtime.d.ts

@@ -6,7 +6,7 @@
  * `--account`, or in ProhostAI through `agent.config_updated`) takes effect on
  * the next run without restarting or reinstalling the daemon.
  */
-import type { AccountRecord, AccountRuntime, CommandRunner, ConfigUpdateOutcome } from './accounts.js';
+import type { AccountBlock, AccountRecord, AccountRuntime, CommandRunner, ConfigUpdateOutcome } from './accounts.js';
 import type { AccountsSnapshot } from './runtime_status.js';
 export type AccountResolution = {
     ok: true;
@@ -35,6 +35,9 @@ export declare class HarnessAccount {
     private readonly inFlight;
     /** `requested_at` of the newest pick applied, so a late older one is dropped. */
     private appliedRequestedAt;
+    private readonly warn;
+    /** The last thing {@link warn} was told, so each reason is said once. */
+    private warned;
     constructor(options: {
         runtime: AccountRuntime;
         /** Environment that locates `$PROHOST_HOME` and the accounts root. */
@@ -43,6 +46,8 @@ export declare class HarnessAccount {
         /** Agent CLI binary used for sign-in checks. */
         binary?: string;
         run?: CommandRunner;
+        /** Told, once per reason, why this agent's account is not named to ProhostAI. */
+        warn?: (message: string) => void;
     });
     /** The label this agent home names now. */
     label(): string;
@@ -84,8 +89,26 @@ export declare class HarnessAccount {
      * credit that run's capacity to an account it isn't using. With several runs
      * executing it is the oldest one's: the pick is not fulfilled until the last
      * run on the previous account has ended.
+     *
+     * `known` are accounts whose sign-in state was checked recently enough to
+     * keep: they are not asked again, so a list that gained or lost an account
+     * costs one check at most, not one per account.
+     *
+     * Rejects when the registry can't be read. There is no snapshot of a
+     * registry nobody could read: "no accounts" would have the server delete
+     * every account on this machine. Checked before anything is resolved, since
+     * resolving the default account against an unreadable registry writes a new
+     * one over it.
+     */
+    snapshot(busy?: boolean, known?: AccountBlock[]): Promise<AccountsSnapshot>;
+    private warnOnce;
+    /**
+     * Keys of every account in the machine's registry right now, or `undefined`
+     * when it can't be read or holds an entry this build doesn't understand —
+     * either way these would not be known to be all of them. A file read; no
+     * login is asked.
      */
-    snapshot(busy?: boolean): Promise<AccountsSnapshot>;
+    keys(): string[] | undefined;
     /** The command that signs the current account in, for a log line. */
     signInHint(): string | undefined;
 }

package/dist/agent/account_runtime.js

@@ -6,7 +6,7 @@
  * `--account`, or in ProhostAI through `agent.config_updated`) takes effect on
  * the next run without restarting or reinstalling the daemon.
  */
-import { DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, accountBlock, accountEnv, applyAccountKey, checkAuth, loadAccounts, resolveAgentAccount, runtimeName, signInCommand, } from './accounts.js';
+import { AccountError, DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, accountBlock, accountEnv, applyAccountKey, checkAuth, fitsStatusFrame, readRegistry, resolveAgentAccount, runtimeName, signInCommand, } from './accounts.js';
 import { tryLoadCredentials } from './credentials.js';
 export class HarnessAccount {
     runtime;
@@ -28,12 +28,16 @@ export class HarnessAccount {
     inFlight = [];
     /** `requested_at` of the newest pick applied, so a late older one is dropped. */
     appliedRequestedAt;
+    warn;
+    /** The last thing {@link warn} was told, so each reason is said once. */
+    warned;
     constructor(options) {
         this.runtime = options.runtime;
         this.env = { ...process.env, ...options.env };
         this.binary = options.binary;
         this.run = options.run;
         this.initialLabel = options.initialLabel;
+        this.warn = options.warn;
     }
     /** The label this agent home names now. */
     label() {
@@ -119,18 +123,35 @@ export class HarnessAccount {
      * credit that run's capacity to an account it isn't using. With several runs
      * executing it is the oldest one's: the pick is not fulfilled until the last
      * run on the previous account has ended.
+     *
+     * `known` are accounts whose sign-in state was checked recently enough to
+     * keep: they are not asked again, so a list that gained or lost an account
+     * costs one check at most, not one per account.
+     *
+     * Rejects when the registry can't be read. There is no snapshot of a
+     * registry nobody could read: "no accounts" would have the server delete
+     * every account on this machine. Checked before anything is resolved, since
+     * resolving the default account against an unreadable registry writes a new
+     * one over it.
      */
-    async snapshot(busy = false) {
+    async snapshot(busy = false, known = []) {
+        const registry = readRegistry(this.env);
+        if (!registry)
+            throw new AccountError('The account registry on this machine could not be read.');
+        const records = registry.accounts;
         const label = busy ? (this.inFlight[0] ?? this.spawnedLabel ?? this.label()) : this.label();
         const record = resolveAgentAccount(label, this.runtime, this.env);
         const resolved = record ? { ok: true, record } : { ok: false, error: '' };
-        const records = loadAccounts(this.env);
         // The current account first, so a machine with more than the cap still
         // reports the one this agent is on.
         const ordered = resolved.ok
             ? [resolved.record, ...records.filter((r) => r.key !== resolved.record.key)]
             : records;
+        const checked = new Map(known.map((block) => [block.key, block]));
         const all = await Promise.all(ordered.slice(0, MAX_REPORTED_ACCOUNTS).map(async (record) => {
+            const kept = checked.get(record.key);
+            if (kept)
+                return accountBlock(record, kept.auth_state, kept.billing);
             // Only the login of this runtime's CLI is checked with this binary;
             // another runtime's accounts are checked with that CLI's default name.
             const check = await checkAuth(record, {
@@ -139,10 +160,45 @@ export class HarnessAccount {
             });
             return accountBlock(record, check.state, check.billing);
         }));
-        const current = resolved.ok ? all.find((a) => a.key === resolved.record.key) : undefined;
-        // More accounts than a frame carries (a hand-edited registry): send none
-        // rather than a partial list the server would prune to.
-        return { current, all: ordered.length > MAX_REPORTED_ACCOUNTS ? undefined : all };
+        // The server drops a whole frame over one account it refuses, so the
+        // account in use is named only when it would be taken. Runs still go out
+        // on it either way.
+        const named = resolved.ok && fitsStatusFrame(resolved.record);
+        const current = named ? all.find((a) => a.key === resolved.record.key) : undefined;
+        if (resolved.ok && !named) {
+            const { label: unnamed, runtime } = resolved.record;
+            // Not among the accounts this build reads: the default, held in an
+            // entry it can't read that has no key to report it under.
+            const unread = !records.some((r) => r.label === unnamed && r.runtime === runtime);
+            this.warnOnce(`this agent's ${runtimeName(runtime)} account "${unnamed}" is not named to ProhostAI: ` +
+                (unread
+                    ? "the account registry holds it in an entry this version of the CLI can't read, with no key to " +
+                        'report it under. Runs still use it. Update @prohost/cli.'
+                    : 'its entry in the account registry has a key or label ProhostAI would not accept. Runs still use it.'));
+        }
+        // More accounts than a frame carries (a hand-edited registry), an entry
+        // this build can't read (a newer CLI's account) or one the server would
+        // refuse: send none rather than a partial list the server would prune to,
+        // or a list that costs the whole frame. The account in use is still
+        // known, so it is still named, checked and followed through a switch.
+        const whole = registry.whole && ordered.length <= MAX_REPORTED_ACCOUNTS;
+        return { current, all: whole ? all : undefined };
+    }
+    warnOnce(message) {
+        if (message === this.warned)
+            return;
+        this.warned = message;
+        this.warn?.(message);
+    }
+    /**
+     * Keys of every account in the machine's registry right now, or `undefined`
+     * when it can't be read or holds an entry this build doesn't understand —
+     * either way these would not be known to be all of them. A file read; no
+     * login is asked.
+     */
+    keys() {
+        const registry = readRegistry(this.env);
+        return registry?.whole ? registry.accounts.map((record) => record.key) : undefined;
     }
     /** The command that signs the current account in, for a log line. */
     signInHint() {

package/dist/agent/accounts.d.ts

@@ -58,7 +58,42 @@ export declare function isValidLabel(label: string): boolean;
 export declare function parseAccountRuntime(value: string | undefined): AccountRuntime | undefined;
 /** Machine-wide root shared by every agent home. */
 export declare function accountsRoot(env?: NodeJS.ProcessEnv): string;
-/** Every account on this machine. An unreadable registry is an empty one. */
+/** What the registry file holds, as far as this build can tell. */
+export interface RegistryRead {
+    /** The accounts this build understands. */
+    accounts: AccountRecord[];
+    /**
+     * Whether `accounts` is every account on the machine, each one fit to send.
+     * `false` when an entry was left out — damaged, or written by a newer CLI
+     * with a runtime or billing this build doesn't know — when the file is not
+     * at {@link REGISTRY_VERSION}, or when an account fails
+     * {@link fitsStatusFrame}. The accounts are real and runs still go out on
+     * them, but they are not a list anyone should act on.
+     */
+    whole: boolean;
+}
+/**
+ * Whether the server would take this account in a status frame: a UUID key,
+ * and a label of 1 to {@link MAX_FRAME_LABEL_CHARS} characters it can store.
+ * The server drops a whole frame over one field it refuses — the account in
+ * use and its capacity with it — so an account that fails this is never put
+ * in one. Accounts made here always pass; a hand-edited registry, or one
+ * another tool wrote, may not.
+ */
+export declare function fitsStatusFrame(record: AccountRecord): boolean;
+/**
+ * The registry, or `undefined` when the file is there but can't be read or
+ * isn't a registry — which says nothing about the accounts on this machine,
+ * least of all that there are none. For a caller whose answer someone else
+ * acts on: the server deletes the accounts a status frame leaves out, so that
+ * caller must know when the list is missing or short. No file yet is an empty
+ * registry.
+ */
+export declare function readRegistry(env?: NodeJS.ProcessEnv): RegistryRead | undefined;
+/**
+ * Every account on this machine that this build understands. An unreadable
+ * registry is an empty one, and an entry it can't read is skipped.
+ */
 export declare function loadAccounts(env?: NodeJS.ProcessEnv): AccountRecord[];
 /**
  * This computer's id: a random UUID made once and kept in the machine-wide
@@ -70,9 +105,16 @@ export declare function loadAccounts(env?: NodeJS.ProcessEnv): AccountRecord[];
  */
 export declare function machineId(env?: NodeJS.ProcessEnv): string | undefined;
 export declare function findAccount(label: string, runtime: AccountRuntime, env?: NodeJS.ProcessEnv): AccountRecord | undefined;
+/** {@link unreadEntryFor} against the registry as it is now, for a caller about to register a login. */
+export declare function heldByUnreadableEntry(runtime: AccountRuntime, claim: {
+    label?: string;
+    dir?: string;
+}, env?: NodeJS.ProcessEnv): boolean;
 /**
  * The implicit default account for a runtime, created on first use so it has
- * a stable key the server can recognise across restarts.
+ * a stable key the server can recognise across restarts. Where the registry
+ * already holds it in an entry this build can't read, that one is used (see
+ * {@link borrowedDefault}) and none is created.
  */
 export declare function ensureDefaultAccount(runtime: AccountRuntime, env?: NodeJS.ProcessEnv): AccountRecord;
 /** Create an account and its config directory. Signing in is the operator's next step. */

package/dist/agent/accounts.js

@@ -25,7 +25,7 @@
  */
 import { execFile } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { loadCredentials, saveCredentials } from './credentials.js';
@@ -37,6 +37,8 @@ export const DEFAULT_ACCOUNT_LABEL = 'default';
 export const MAX_REPORTED_ACCOUNTS = 16;
 /** How long one `auth status` / `login status` probe may take. */
 const AUTH_PROBE_TIMEOUT_MS = 10_000;
+/** The registry layout this build writes, and the only one it vouches for. */
+const REGISTRY_VERSION = 1;
 /** Labels are filenames and UI text: short, and nothing a shell or a path could misread. */
 const LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/;
 export class AccountError extends Error {
@@ -59,25 +61,84 @@ export function accountsRoot(env = process.env) {
 function registryPath(env) {
     return path.join(accountsRoot(env), 'accounts.json');
 }
-/** Every account on this machine. An unreadable registry is an empty one. */
-export function loadAccounts(env = process.env) {
+/** `undefined` when the file is there but can't be read or isn't a registry. No file yet is an empty one. */
+function readRawRegistry(env) {
+    let content;
+    try {
+        content = readFileSync(registryPath(env), 'utf8');
+    }
+    catch (err) {
+        return err.code === 'ENOENT'
+            ? { fields: { version: REGISTRY_VERSION }, entries: [] }
+            : undefined;
+    }
     let parsed;
     try {
-        parsed = JSON.parse(readFileSync(registryPath(env), 'utf8'));
+        parsed = JSON.parse(content);
     }
     catch {
-        return [];
+        return undefined;
     }
-    const list = parsed?.accounts;
-    if (!Array.isArray(list))
-        return [];
-    return list.filter((a) => !!a &&
+    const entries = parsed?.accounts;
+    if (!Array.isArray(entries))
+        return undefined;
+    return { fields: parsed, entries };
+}
+/** An entry this build understands: every field present, with a value it knows. */
+function isAccountRecord(entry) {
+    const a = entry;
+    return (!!a &&
         typeof a.key === 'string' &&
         typeof a.label === 'string' &&
         (a.runtime === 'claude_code' || a.runtime === 'codex') &&
         (a.billing === 'subscription' || a.billing === 'api_key') &&
         (a.dir === null || typeof a.dir === 'string'));
 }
+/** Longest label the server takes in a status frame, in characters. */
+const MAX_FRAME_LABEL_CHARS = 64;
+/** A NUL or half a surrogate pair: text the server's database cannot store. */
+const UNSTORABLE = /[\0\p{Cs}]/u;
+/**
+ * Whether the server would take this account in a status frame: a UUID key,
+ * and a label of 1 to {@link MAX_FRAME_LABEL_CHARS} characters it can store.
+ * The server drops a whole frame over one field it refuses — the account in
+ * use and its capacity with it — so an account that fails this is never put
+ * in one. Accounts made here always pass; a hand-edited registry, or one
+ * another tool wrote, may not.
+ */
+export function fitsStatusFrame(record) {
+    if (!UUID_RE.test(record.key) || UNSTORABLE.test(record.label))
+        return false;
+    const length = [...record.label].length;
+    return length >= 1 && length <= MAX_FRAME_LABEL_CHARS;
+}
+/**
+ * The registry, or `undefined` when the file is there but can't be read or
+ * isn't a registry — which says nothing about the accounts on this machine,
+ * least of all that there are none. For a caller whose answer someone else
+ * acts on: the server deletes the accounts a status frame leaves out, so that
+ * caller must know when the list is missing or short. No file yet is an empty
+ * registry.
+ */
+export function readRegistry(env = process.env) {
+    const raw = readRawRegistry(env);
+    if (!raw)
+        return undefined;
+    const accounts = raw.entries.filter(isAccountRecord);
+    return {
+        accounts,
+        whole: raw.fields.version === REGISTRY_VERSION &&
+            accounts.length === raw.entries.length &&
+            accounts.every(fitsStatusFrame),
+    };
+}
+/**
+ * Every account on this machine that this build understands. An unreadable
+ * registry is an empty one, and an entry it can't read is skipped.
+ */
+export function loadAccounts(env = process.env) {
+    return readRegistry(env)?.accounts ?? [];
+}
 /**
  * Run ``fn`` holding the registry lock, so two processes adding accounts (or
  * two agents creating their implicit default at once) can't each write an
@@ -122,7 +183,23 @@ function withRegistryLock(env, fn) {
 }
 const REGISTRY_LOCK_WAIT_MS = 5_000;
 const REGISTRY_LOCK_STALE_MS = 30_000;
-function saveAccounts(accounts, env) {
+/**
+ * Rewrite the registry with `change` applied to its entries — the one place
+ * the file is written. Call it holding the registry lock.
+ *
+ * Every agent home and every CLI version on the machine shares this file, so
+ * what this build doesn't understand is written back as it was read: entries
+ * that fail the shape check (damaged, or a newer CLI's account on a runtime
+ * this build has never heard of), top-level fields other than `accounts`, and
+ * a `version` that isn't ours. Writing only what {@link loadAccounts} returns
+ * would erase another CLI's account from the machine for good. `change` sees
+ * those entries too and must leave them be.
+ *
+ * A file that can't be read or parsed at all is an empty registry here, as it
+ * is for {@link loadAccounts}, and is replaced.
+ */
+function rewriteRegistry(env, change) {
+    const raw = readRawRegistry(env) ?? { fields: {}, entries: [] };
     const root = accountsRoot(env);
     mkdirSync(root, { recursive: true, mode: 0o700 });
     chmodSync(root, 0o700);
@@ -130,11 +207,14 @@ function saveAccounts(accounts, env) {
     // Write-then-rename: two agents creating the implicit default at once must
     // not leave a half-written registry for the next reader.
     const temp = `${file}.${process.pid}.tmp`;
-    writeFileSync(temp, `${JSON.stringify({ version: 1, accounts }, null, 2)}\n`, {
-        mode: 0o600,
-    });
+    const registry = { version: REGISTRY_VERSION, ...raw.fields, accounts: change(raw.entries) };
+    writeFileSync(temp, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
     renameSync(temp, file);
 }
+/** Add one account to the registry, after everything already in it. Call it holding the lock. */
+function appendAccount(record, env) {
+    rewriteRegistry(env, (entries) => [...entries, record]);
+}
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readMachineId(env) {
     try {
@@ -177,17 +257,96 @@ export function machineId(env = process.env) {
 export function findAccount(label, runtime, env = process.env) {
     return loadAccounts(env).find((a) => a.label === label && a.runtime === runtime);
 }
+/** Whether two paths are one directory, through symlinks where both exist. */
+function sameDirectory(a, b) {
+    if (path.resolve(a) === path.resolve(b))
+        return true;
+    try {
+        return realpathSync(a) === realpathSync(b);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The entry this build can't read that says it is this account: the same
+ * runtime and the same label, or the same runtime and the same directory.
+ *
+ * Such an entry is a login this build knows how to run, recorded by a CLI
+ * that knows something this one doesn't (a billing value, say) — or a damaged
+ * record of one. Recording the login again beside it would give one login two
+ * identities, here and on the server. An entry whose `runtime` or `label`
+ * isn't even text says nothing about which account it is and claims none.
+ */
+function unreadEntryFor(entries, runtime, claim) {
+    for (const entry of entries) {
+        if (isAccountRecord(entry) || !entry || typeof entry !== 'object')
+            continue;
+        const e = entry;
+        if (e.runtime !== runtime || typeof e.label !== 'string')
+            continue;
+        if (e.label === claim.label)
+            return e;
+        if (claim.dir !== undefined && typeof e.dir === 'string' && sameDirectory(e.dir, claim.dir))
+            return e;
+    }
+    return undefined;
+}
+/** {@link unreadEntryFor} against the registry as it is now, for a caller about to register a login. */
+export function heldByUnreadableEntry(runtime, claim, env = process.env) {
+    return unreadEntryFor(readRawRegistry(env)?.entries ?? [], runtime, claim) !== undefined;
+}
+function heldByUnreadableEntryError(what) {
+    return new AccountError(`The account registry already has ${what} in an entry this version of the CLI can't read — ` +
+        'most likely one a newer version wrote. Update @prohost/cli and try again.');
+}
+/**
+ * The default account where an entry this build can't read already stands for
+ * it. One login gets one identity, so no second default is recorded beside
+ * the entry and nothing is written.
+ *
+ * Only the key is taken from the entry, and only when the server would take
+ * it and the entry is the login this build means by "default": the agent
+ * CLI's own directory (`dir: null`). Its billing is not taken — this build
+ * can't tell what it means. Otherwise the key is empty: the account has no
+ * identity here, {@link fitsStatusFrame} keeps it out of every status frame,
+ * and runs still go out on the CLI's own login.
+ */
+function borrowedDefault(entry, runtime) {
+    const record = {
+        key: typeof entry.key === 'string' ? entry.key : '',
+        label: DEFAULT_ACCOUNT_LABEL,
+        runtime,
+        billing: 'subscription',
+        dir: null,
+        created_at: '',
+    };
+    return entry.dir === null && fitsStatusFrame(record) ? record : { ...record, key: '' };
+}
+/** This runtime's default account as the registry holds it: read, borrowed, or not there yet. */
+function defaultAccount(runtime, env) {
+    const entries = readRawRegistry(env)?.entries ?? [];
+    const known = entries
+        .filter(isAccountRecord)
+        .find((a) => a.label === DEFAULT_ACCOUNT_LABEL && a.runtime === runtime);
+    if (known)
+        return known;
+    const unread = unreadEntryFor(entries, runtime, { label: DEFAULT_ACCOUNT_LABEL });
+    return unread && borrowedDefault(unread, runtime);
+}
 /**
  * The implicit default account for a runtime, created on first use so it has
- * a stable key the server can recognise across restarts.
+ * a stable key the server can recognise across restarts. Where the registry
+ * already holds it in an entry this build can't read, that one is used (see
+ * {@link borrowedDefault}) and none is created.
  */
 export function ensureDefaultAccount(runtime, env = process.env) {
-    const existing = findAccount(DEFAULT_ACCOUNT_LABEL, runtime, env);
+    const existing = defaultAccount(runtime, env);
     if (existing)
         return existing;
     return withRegistryLock(env, () => {
         // Re-read under the lock: another agent may have just created it.
-        const again = findAccount(DEFAULT_ACCOUNT_LABEL, runtime, env);
+        const again = defaultAccount(runtime, env);
         if (again)
             return again;
         const record = {
@@ -198,7 +357,7 @@ export function ensureDefaultAccount(runtime, env = process.env) {
             dir: null,
             created_at: new Date().toISOString(),
         };
-        saveAccounts([...loadAccounts(env), record], env);
+        appendAccount(record, env);
         return record;
     });
 }
@@ -217,6 +376,9 @@ function addAccountLocked(label, runtime, billing, env) {
     if (findAccount(label, runtime, env)) {
         throw new AccountError(`A ${runtimeName(runtime)} account named "${label}" already exists on this machine.`);
     }
+    if (heldByUnreadableEntry(runtime, { label }, env)) {
+        throw heldByUnreadableEntryError(`a ${runtimeName(runtime)} account named "${label}"`);
+    }
     // The server keeps exactly the accounts a machine reports, and a frame
     // carries at most MAX_REPORTED_ACCOUNTS (room left for both defaults).
     if (loadAccounts(env).filter((a) => a.label !== DEFAULT_ACCOUNT_LABEL).length >= MAX_REPORTED_ACCOUNTS - 2) {
@@ -233,7 +395,7 @@ function addAccountLocked(label, runtime, billing, env) {
         dir,
         created_at: new Date().toISOString(),
     };
-    saveAccounts([...loadAccounts(env), record], env);
+    appendAccount(record, env);
     return record;
 }
 /**
@@ -253,9 +415,15 @@ export function registerAccountDir(options, env = process.env) {
         const same = accounts.find((a) => a.runtime === runtime && a.dir !== null && path.resolve(a.dir) === dir);
         if (same)
             return same;
+        if (heldByUnreadableEntry(runtime, { dir }, env)) {
+            throw heldByUnreadableEntryError(`a ${runtimeName(runtime)} account for ${dir}`);
+        }
         if (findAccount(label, runtime, env)) {
             throw new AccountError(`A ${runtimeName(runtime)} account named "${label}" already exists on this machine.`);
         }
+        if (heldByUnreadableEntry(runtime, { label }, env)) {
+            throw heldByUnreadableEntryError(`a ${runtimeName(runtime)} account named "${label}"`);
+        }
         if (accounts.filter((a) => a.label !== DEFAULT_ACCOUNT_LABEL).length >= MAX_REPORTED_ACCOUNTS - 2) {
             throw new AccountError(`This machine already has ${MAX_REPORTED_ACCOUNTS - 2} accounts, the most ProhostAI can show. Remove one first.`);
         }
@@ -267,7 +435,7 @@ export function registerAccountDir(options, env = process.env) {
             dir,
             created_at: new Date().toISOString(),
         };
-        saveAccounts([...accounts, record], env);
+        appendAccount(record, env);
         return record;
     });
 }
@@ -290,7 +458,12 @@ export function removeAccount(label, runtime, env = process.env) {
         const found = accounts.find((a) => a.label === label && a.runtime === runtime);
         if (!found)
             throw new AccountError(`No ${runtimeName(runtime)} account named "${label}" on this machine.`);
-        saveAccounts(accounts.filter((a) => a !== found), env);
+        rewriteRegistry(env, (entries) => {
+            // Only the entry asked for: the first one this build reads as that
+            // account, which is the one `found` came from.
+            const index = entries.findIndex((e) => isAccountRecord(e) && e.label === label && e.runtime === runtime);
+            return entries.filter((_, i) => i !== index);
+        });
         return found;
     });
     // Only ever a directory this module created under the root.
@@ -421,7 +594,10 @@ export function resolveAgentAccount(label, runtime, env = process.env) {
 export function applyAccountKey(key, runtime, env = process.env) {
     if (typeof key !== 'string' || !key)
         return { applied: false, reason: 'no account_key in the update' };
-    const record = loadAccounts(env).find((a) => a.key === key);
+    // The default this agent reports under a key borrowed from an entry this
+    // build can't read is one an operator can pick, like any other it reports.
+    const borrowed = defaultAccount(runtime, env);
+    const record = loadAccounts(env).find((a) => a.key === key) ?? (borrowed?.key === key ? borrowed : undefined);
     if (!record)
         return { applied: false, reason: `account ${key.slice(0, 8)}… is not on this machine` };
     if (record.runtime !== runtime) {

package/dist/agent/claude.d.ts

@@ -177,6 +177,28 @@ export interface ClaudeStream {
      * `rate_limit_event`. Fields the stream never mentioned are absent.
      */
     observed(): RuntimeObservation;
+    /**
+     * Why the turn failed, in Claude Code's own words: the error a `result`
+     * event reported, or else the API error an `assistant` event carried in
+     * place of an answer. `undefined` when the stream said neither.
+     *
+     * Read for a run that exited non-zero, whose stdout is otherwise never
+     * looked at — without it such a run reports only "exited 1". Never the raw
+     * stream: that carries the output of every tool call, and this text is
+     * echoed into a workspace thread.
+     */
+    error(): string | undefined;
+    /**
+     * Claude Code's message when the subscription's usage limit stopped the
+     * turn — "You've hit your weekly limit · resets Oct 16 at 11am
+     * (America/New_York)" — or `undefined` when something else did.
+     *
+     * Recognised by the `rate_limit` error on the `assistant` event Claude Code
+     * writes in place of an answer, or by a `rate_limit_event` whose status is
+     * `rejected` with no overage to fall back on. Running the turn again cannot
+     * help until the limit resets, so a caller must not retry it.
+     */
+    usageLimit(): string | undefined;
     /**
      * The turn's outcome. ``stdout`` is the complete captured output, used only
      * when the stream held no `result` event — a crashed binary, a login prompt,
@@ -218,11 +240,20 @@ export declare function readClaudeStream(): ClaudeStream;
  * and the ledger has no way to know. A stale entry must not turn into a
  * permanently broken surface, so the caller retries once without `--resume`.
  *
- * The observed failure is exit 1, empty stdout, and
- * `No conversation found with session ID: <uuid>` on stderr. Matching is
- * broader than that string because the wording is not ours to depend on, and it
- * is gated by the caller on the run having actually failed — so a *successful*
- * run whose reply text happens to quote a session id is never mistaken for one.
+ * The observed failure (Claude Code 2.1.296) is exit 1, `No conversation found
+ * with session ID: <uuid>` on stderr, and on stdout a lone `result` event with
+ * that message in `errors` — no `system`/`init` event, because no session ever
+ * started. Matching is broader than that string because the wording is not
+ * ours to depend on, and it is gated by the caller on the run having actually
+ * failed — so a *successful* run whose reply text happens to quote a session id
+ * is never mistaken for one.
+ *
+ * A stream that announced its session or produced an assistant message is a
+ * resume that **worked**, whatever went wrong after it. That guard is what
+ * keeps an ordinary failed turn from matching: every stream-json event carries
+ * `session_id`, so "the output mentions the session id" — which this used to
+ * accept — is true of every resumed run, and a resumed run that then hit a
+ * usage limit was retried from scratch and lost its thread's session.
  */
 export declare function looksLikeResumeFailure(output: string, sessionId: string): boolean;
 /** Absolute path of the generated MCP config. */

package/dist/agent/claude.js

@@ -209,6 +209,19 @@ function resultEnvelope(stdout) {
 function text(value) {
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+/**
+ * The `errors` an `error_during_execution` envelope carries instead of a
+ * `result` — e.g. `No conversation found with session ID: <uuid>` for a
+ * rejected `--resume` (Claude Code 2.1.296).
+ */
+function envelopeErrors(parsed) {
+    if (!Array.isArray(parsed.errors))
+        return undefined;
+    return text(parsed.errors.filter((entry) => typeof entry === 'string' && entry.length > 0).join('; '));
+}
 /**
  * Turn a `result` envelope into the harness's view of the turn.
  *
@@ -229,7 +242,7 @@ function outputFromEnvelope(parsed) {
             ok: false,
             sessionId,
             denials,
-            error: result ?? `claude reported an error (${String(parsed.subtype ?? 'unknown')})`,
+            error: result ?? envelopeErrors(parsed) ?? `claude reported an error (${String(parsed.subtype ?? 'unknown')})`,
         };
     }
     if (!result) {
@@ -452,6 +465,10 @@ export function readClaudeStream() {
     let lastActivity;
     let lastText;
     let result;
+    /** The last `assistant` event that was an API error rather than an answer. */
+    let apiError;
+    /** When a `rate_limit_event` said the limit is hit: its reset, epoch seconds. */
+    let limitRejected;
     let toolEvents = [];
     // `tool_use.id` → tool name, so a result can be reported under the name of
     // the call it answers. Deleted on the result: bounded by tools in flight.
@@ -534,6 +551,13 @@ export function readClaudeStream() {
             const windows = fromClaudeRateLimitInfo(event.rate_limit_info);
             if (windows.length > 0)
                 observed.quota_windows = windows;
+            const info = asRecord(event.rate_limit_info);
+            // `rejected` with overage still `allowed` is a turn that carries on, on
+            // overage; only a rejection with nothing to fall back on stops it.
+            const overage = info?.overageStatus;
+            if (info?.status === 'rejected' && overage !== 'allowed' && overage !== 'allowed_warning') {
+                limitRejected = { resetsAt: typeof info.resetsAt === 'number' ? info.resetsAt : undefined };
+            }
         }
         // Present on the `system`/`init` event, and repeated on most others. Taken
         // from whichever arrives first — they all name the same session.
@@ -551,6 +575,15 @@ export function readClaudeStream() {
         }
         if (event.type !== 'assistant')
             return;
+        // Claude Code writes an API failure — a usage limit, a billing or auth
+        // error — as an assistant message whose text is the explanation, marked by
+        // `error` (stream-json) or `isApiErrorMessage` (the transcript shape).
+        if (typeof event.error === 'string' || event.isApiErrorMessage === true) {
+            apiError = {
+                kind: event.apiError === 'usage_limit_reached' ? 'rate_limit' : text(event.error),
+                text: assistantContent(event).text?.trim() || undefined,
+            };
+        }
         collectToolUses(event);
         const { text: written, tool } = assistantContent(event);
         if (written)
@@ -562,6 +595,14 @@ export function readClaudeStream() {
         else if (written)
             lastActivity = written.replace(/\s+/g, ' ').trim().slice(0, MAX_ACTIVITY_CHARS);
     };
+    /** A trailing event with no newline after it is still an event. */
+    const flushTail = () => {
+        const tail = buffer.trim();
+        if (tail) {
+            handle(tail);
+            buffer = '';
+        }
+    };
     return {
         push(chunk) {
             buffer += chunk;
@@ -594,14 +635,30 @@ export function readClaudeStream() {
                 return undefined;
             return trimmed.length > MAX_SALVAGE_CHARS ? trimmed.slice(-MAX_SALVAGE_CHARS) : trimmed;
         },
-        finish(stdout) {
-            // A trailing event with no newline after it is still an event — a binary
-            // that exits without flushing a final `\n` must not lose its result.
-            const tail = buffer.trim();
-            if (tail) {
-                handle(tail);
-                buffer = '';
+        error: () => {
+            flushTail();
+            if (result) {
+                const outcome = outputFromEnvelope(result);
+                if (!outcome.ok)
+                    return outcome.error;
             }
+            return apiError?.text;
+        },
+        usageLimit: () => {
+            flushTail();
+            if (apiError?.kind === 'rate_limit')
+                return apiError.text ?? 'usage limit reached';
+            if (!limitRejected)
+                return undefined;
+            const { resetsAt } = limitRejected;
+            return resetsAt === undefined
+                ? 'usage limit reached'
+                : `usage limit reached · resets ${new Date(resetsAt * 1000).toISOString()}`;
+        },
+        finish(stdout) {
+            // A binary that exits without flushing a final `\n` must not lose its
+            // result.
+            flushTail();
             if (result)
                 return outputFromEnvelope(result);
             // No `result` event: either the command isn't emitting the stream we
@@ -621,19 +678,42 @@ export function readClaudeStream() {
  * and the ledger has no way to know. A stale entry must not turn into a
  * permanently broken surface, so the caller retries once without `--resume`.
  *
- * The observed failure is exit 1, empty stdout, and
- * `No conversation found with session ID: <uuid>` on stderr. Matching is
- * broader than that string because the wording is not ours to depend on, and it
- * is gated by the caller on the run having actually failed — so a *successful*
- * run whose reply text happens to quote a session id is never mistaken for one.
+ * The observed failure (Claude Code 2.1.296) is exit 1, `No conversation found
+ * with session ID: <uuid>` on stderr, and on stdout a lone `result` event with
+ * that message in `errors` — no `system`/`init` event, because no session ever
+ * started. Matching is broader than that string because the wording is not
+ * ours to depend on, and it is gated by the caller on the run having actually
+ * failed — so a *successful* run whose reply text happens to quote a session id
+ * is never mistaken for one.
+ *
+ * A stream that announced its session or produced an assistant message is a
+ * resume that **worked**, whatever went wrong after it. That guard is what
+ * keeps an ordinary failed turn from matching: every stream-json event carries
+ * `session_id`, so "the output mentions the session id" — which this used to
+ * accept — is true of every resumed run, and a resumed run that then hit a
+ * usage limit was retried from scratch and lost its thread's session.
  */
 export function looksLikeResumeFailure(output, sessionId) {
     if (!sessionId)
         return false;
-    if (output.includes(sessionId))
-        return true;
+    if (sessionStarted(output))
+        return false;
     return /no (conversation|session)[^\n]{0,40}found|session[^\n]{0,40}not found|--resume|resume[^\n]{0,20}(failed|invalid|expired)/i.test(output);
 }
+/** Did this output include the `system`/`init` or an `assistant` event of a running session? */
+function sessionStarted(output) {
+    for (const line of output.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('{'))
+            continue;
+        const event = asObject(trimmed);
+        if (!event)
+            continue;
+        if ((event.type === 'system' && event.subtype === 'init') || event.type === 'assistant')
+            return true;
+    }
+    return false;
+}
 /** Absolute path of the generated MCP config. */
 export function mcpConfigPath(env = process.env) {
     return path.join(prohostHome(env), MCP_CONFIG_FILENAME);

package/dist/agent/codex.d.ts

@@ -518,6 +518,15 @@ export type CodexOutput = {
  * the model (verified against 0.144.1, same convention as Claude Code).
  */
 export declare function parseCodexOutput(stdout: string): CodexOutput;
+/**
+ * The failure a Codex run reported about itself — the last `turn.failed` or
+ * `error` event's message — or `undefined` if it reported none.
+ *
+ * For a run that exited non-zero, whose stdout is otherwise never read: without
+ * this such a run reports only "exited 1". Only that message, never the stream
+ * around it, which carries command output and would be echoed into a thread.
+ */
+export declare function codexFailureMessage(stdout: string): string | undefined;
 /**
  * Does this look like the resume having been rejected, rather than the agent
  * having failed at its actual work?

package/dist/agent/codex.js

@@ -1053,6 +1053,27 @@ export function parseCodexOutput(stdout) {
             : 'codex returned no output',
     };
 }
+/**
+ * The failure a Codex run reported about itself — the last `turn.failed` or
+ * `error` event's message — or `undefined` if it reported none.
+ *
+ * For a run that exited non-zero, whose stdout is otherwise never read: without
+ * this such a run reports only "exited 1". Only that message, never the stream
+ * around it, which carries command output and would be echoed into a thread.
+ */
+export function codexFailureMessage(stdout) {
+    let failure;
+    for (const line of stdout.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('{'))
+            continue;
+        const event = asObject(trimmed);
+        if (event && (event.type === 'turn.failed' || event.type === 'error')) {
+            failure = failureMessage(event) ?? failure;
+        }
+    }
+    return failure;
+}
 /**
  * Name the tool this item was refused, or `undefined` if it wasn't refused.
  *

package/dist/agent/run.js

@@ -33,7 +33,7 @@ import { HarnessAccount } from './account_runtime.js';
 import { EVENT_AGENT_CONFIG_UPDATED, machineId } from './accounts.js';
 import { completeRun, describeFailure, isIdempotencyInFlight, postReply } from './api.js';
 import { MAX_SALVAGE_CHARS, claudeCommand, isClaudeExec, looksLikeResumeFailure, readClaudeStream, writeMcpConfig, } from './claude.js';
-import { APPS_FEATURE, MCP_API_KEY_ENV_VAR, PLUGINS_DISABLED_OVERRIDE, codexBinary, codexCommand, codexMcpInventoryFlag, codexProfileName, codexShellSyntax, extraMcpEntries, isCodexExec, isolateConfiguredServers, listMcpServers, mcpServersOverride, prohostMcpEntry, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
+import { APPS_FEATURE, MCP_API_KEY_ENV_VAR, PLUGINS_DISABLED_OVERRIDE, codexBinary, codexCommand, codexMcpInventoryFlag, codexProfileName, codexShellSyntax, extraMcpEntries, isCodexExec, isolateConfiguredServers, listMcpServers, mcpServersOverride, prohostMcpEntry, codexFailureMessage, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
 import { ToolEventQueue } from './events.js';
 import { EXTRA_MCP_FILENAME, loadExtraMcpServers } from './extras.js';
 import { MCP_SERVER_NAME, MCP_TOOL_PATTERN } from './mcp.js';
@@ -293,6 +293,7 @@ function buildRuntime(options, log) {
         initialLabel: options.credentials.account,
         binary: brain === 'claude' ? (options.exec.trim().split(/\s+/)[0] ?? 'claude') : codexBinary(options.exec),
         run: options.accountCommandRunner,
+        warn: (message) => log(`${timestamp()} ! ${message}`),
     });
     const mcpUrl = options.credentials.mcp_url;
     let announced = '';
@@ -722,6 +723,18 @@ runEnv) {
     if (mcp.error) {
         return { ok: false, reason: 'MCP isolation could not be established', detail: mcp.error, durationMs: 0 };
     }
+    /**
+     * A turn the Claude subscription's usage limit stopped, worded for the
+     * thread: whose limit (this machine's login) and, in Claude Code's own
+     * words, when it resets. The only fix is waiting, so the reason says that
+     * rather than "exited 1".
+     */
+    const usageLimitFailure = (said, stderr = '') => ({
+        ok: false,
+        reason: `Claude usage limit reached on ${options.machine ?? os.hostname()}`,
+        detail: [said, stderr.includes(said) ? '' : stderr].filter((part) => part.length > 0).join('\n'),
+        durationMs: elapsed(),
+    });
     const failure = (result) => {
         // A killed run has no reply, but it usually has most of one. Reporting the
         // tail of what the agent was writing turns "no output for 15 minutes" into
@@ -750,7 +763,20 @@ runEnv) {
         // completion `error` is capped server-side, and of the two, what the agent
         // was saying beats the last 500 characters of its logging.
         const stderrTail = result.stderr.trim().slice(salvaged ? -200 : -500);
-        const detail = [stderrTail, salvaged ? `unfinished answer: ${salvaged}` : '']
+        const limit = killed ? undefined : stream?.usageLimit();
+        if (limit)
+            return usageLimitFailure(limit, stderrTail);
+        // What the brain itself said went wrong — a shaped brain reports it on
+        // stdout, which a non-zero exit otherwise leaves unread. First, because the
+        // thread shows only the opening of this text.
+        const said = killed
+            ? undefined
+            : (stream?.error() ?? (runtime.brain === 'codex' ? codexFailureMessage(result.stdout) : undefined))?.slice(0, MAX_SALVAGE_CHARS);
+        const detail = [
+            said ?? '',
+            said && stderrTail.includes(said) ? '' : stderrTail,
+            salvaged ? `unfinished answer: ${salvaged}` : '',
+        ]
             .filter((part) => part.length > 0)
             .join('\n');
         return {
@@ -793,6 +819,9 @@ runEnv) {
     const resumeFailed = codex ? looksLikeCodexResumeFailure : looksLikeResumeFailure;
     if (!result.ok &&
         sessionId &&
+        // A usage limit fails a fresh session exactly as it failed this one, and
+        // the retry would cost the thread its session for nothing.
+        !stream?.usageLimit() &&
         resumeFailed(`${result.stderr}\n${result.stdout}`, sessionId) &&
         // Skipped rather than squeezed into a token budget: a retry with no time
         // left would be killed on the spot and reported as a timeout, which is a
@@ -810,8 +839,11 @@ runEnv) {
         // transcript is real, it holds however long the agent worked, and the next
         // delivery on that surface can resume it. Only a turn that failed on its
         // own — a crash, an unparseable answer — has no continuity worth keeping.
-        if (!result.timedOut && !result.idleTimedOut && !result.cancelled)
+        // A usage limit is not the turn failing on its own either: the session is
+        // the thread's, and the next turn after the reset should continue it.
+        if (!result.timedOut && !result.idleTimedOut && !result.cancelled && !stream?.usageLimit()) {
             forgetRecordedSession();
+        }
         return failure(result);
     }
     // A denied tool is not an error either brain reports — the turn succeeds and
@@ -851,6 +883,9 @@ runEnv) {
         toolEvents?.push(stream.drainToolEvents());
     reportDenials(parsed.denials);
     if (!parsed.ok) {
+        const limit = stream?.usageLimit();
+        if (limit)
+            return usageLimitFailure(limit);
         forgetRecordedSession();
         return {
             ok: false,
@@ -1098,8 +1133,9 @@ export async function runAgentHarness(options) {
             ? defaultQuotaProvider(runtime.brain, options.exec, () => runtime.account?.spawnEnv() ?? {})
             : (options.quotaProvider ?? undefined),
         accounts: runtime.account
-            ? () => runtime.account.snapshot([...accepted.values()].some((entry) => entry.executing))
+            ? (known) => runtime.account.snapshot([...accepted.values()].some((entry) => entry.executing), known)
             : undefined,
+        accountKeys: runtime.account ? () => runtime.account.keys() : undefined,
         // A run in flight reports fresh numbers when it ends; don't probe beside it.
         isBusy: () => [...accepted.values()].some((entry) => entry.executing),
         log,

package/dist/agent/runtime_status.d.ts

@@ -190,8 +190,20 @@ export interface RuntimeStatusReporterOptions {
      * Accounts on this machine and which one this agent uses. Re-read on the
      * same cadence as the idle quota probe (it asks each login whether it is
      * signed in), and straight away after {@link RuntimeStatusReporter.accountsChanged}.
+     * Also re-read on the first tick after {@link accountKeys} shows the list
+     * moved, with `known`: the accounts whose sign-in state is recent enough to
+     * keep, so only the ones new to the list are asked.
      */
-    accounts?: () => Promise<AccountsSnapshot | undefined>;
+    accounts?: (known?: AccountBlock[]) => Promise<AccountsSnapshot | undefined>;
+    /**
+     * Keys of every account on this machine right now — one local file read,
+     * done for every frame. Every agent home on the machine shares the registry
+     * and the server deletes whatever a frame's list leaves out, so a list from
+     * before another home added its account would delete the account that home
+     * runs on. `undefined` when the registry can't be read, or not all of it:
+     * no list is sent until it can.
+     */
+    accountKeys?: () => string[] | undefined;
     /** A run is executing — it will bring fresh numbers, so don't probe beside it. */
     isBusy?: () => boolean;
     now?: () => number;
@@ -222,6 +234,7 @@ export declare class RuntimeStatusReporter {
     private refreshing;
     private accountGeneration;
     private accounts;
+    /** When every login was last asked whether it is signed in. */
     private accountsObservedAt;
     constructor(options: RuntimeStatusReporterOptions);
     /** Merge what a source learned. Absent fields keep their previous value. */
@@ -247,6 +260,13 @@ export declare class RuntimeStatusReporter {
     detach(): void;
     /** The frame as it would be sent now. */
     frame(): Record<string, unknown>;
+    /**
+     * Whether the machine's registry no longer holds exactly the accounts the
+     * snapshot lists: another agent home started on a login of its own, or an
+     * operator added or removed one. A registry that can't be read counts as
+     * moved — it vouches for no list at all.
+     */
+    private accountsMoved;
     /** Routine tick: refresh idle quota if it is stale, send, and re-arm. */
     private tick;
     private refresh;

package/dist/agent/runtime_status.js

@@ -499,6 +499,7 @@ export class RuntimeStatusReporter {
     refreshing;
     accountGeneration = 0;
     accounts;
+    /** When every login was last asked whether it is signed in. */
     accountsObservedAt;
     constructor(options) {
         this.options = options;
@@ -537,7 +538,6 @@ export class RuntimeStatusReporter {
     setAccounts(snapshot, options = {}) {
         const before = this.accounts;
         this.accounts = snapshot;
-        this.accountsObservedAt = this.now();
         const switched = before?.current?.key !== snapshot?.current?.key;
         if (switched) {
             this.accountGeneration += 1;
@@ -597,9 +597,34 @@ export class RuntimeStatusReporter {
             observed_at: new Date(nowMs).toISOString(),
             // Optional additions: an older server ignores keys it doesn't know.
             ...(this.accounts?.current ? { account: this.accounts.current } : {}),
-            ...(this.accounts?.all ? { machine_accounts: this.accounts.all } : {}),
+            // Never a list the registry has moved on from — the server would delete
+            // what it leaves out. Left out, nothing is deleted; the next tick re-reads it.
+            ...(this.accounts?.all && !this.accountsMoved() ? { machine_accounts: this.accounts.all } : {}),
         };
     }
+    /**
+     * Whether the machine's registry no longer holds exactly the accounts the
+     * snapshot lists: another agent home started on a login of its own, or an
+     * operator added or removed one. A registry that can't be read counts as
+     * moved — it vouches for no list at all.
+     */
+    accountsMoved() {
+        const listed = this.accounts?.all;
+        if (!listed || !this.options.accountKeys)
+            return false;
+        let registry;
+        try {
+            registry = this.options.accountKeys();
+        }
+        catch {
+            registry = undefined;
+        }
+        if (!registry)
+            return true;
+        const keys = new Set(registry);
+        const known = new Set(listed.map((account) => account.key));
+        return keys.size !== known.size || [...keys].some((key) => !known.has(key));
+    }
     /** Routine tick: refresh idle quota if it is stale, send, and re-arm. */
     async tick() {
         if (!this.send)
@@ -607,11 +632,16 @@ export class RuntimeStatusReporter {
         const stale = this.quotaObservedAt === undefined || this.now() - this.quotaObservedAt >= QUOTA_REFRESH_AFTER_MS;
         const sentBefore = this.lastSentAt;
         const accountsStale = this.accountsObservedAt === undefined || this.now() - this.accountsObservedAt >= QUOTA_REFRESH_AFTER_MS;
-        if (accountsStale && this.options.accounts) {
+        if ((accountsStale || this.accountsMoved()) && this.options.accounts) {
             // Before the quota probe: after a switch it must ask the new login.
             try {
                 // Quiet: the tick sends one frame once the quota probe below is in.
-                this.setAccounts(await this.options.accounts(), { quiet: true });
+                // A list that only moved keeps the sign-in states it has, and the
+                // check every login is due stays on its own clock.
+                const known = accountsStale ? undefined : this.accounts?.all;
+                this.setAccounts(await this.options.accounts(known), { quiet: true });
+                if (accountsStale)
+                    this.accountsObservedAt = this.now();
             }
             catch {
                 /* fail soft — keep what we had */

package/dist/usage/discovery.js

@@ -16,7 +16,7 @@
 import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { AccountError, DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, ensureDefaultAccount, isValidLabel, loadAccounts, registerAccountDir, } from '../agent/accounts.js';
+import { AccountError, DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, ensureDefaultAccount, heldByUnreadableEntry, isValidLabel, loadAccounts, registerAccountDir, } from '../agent/accounts.js';
 /** Entries whose presence says "this is a Claude Code config directory". None of them hold a login. */
 const CLAUDE_MARKERS = ['projects', 'settings.json', '.claude.json', 'history.jsonl', 'todos', 'statsig', 'shell-snapshots'];
 /** Same for Codex. `auth.json` is deliberately not one of them. */
@@ -153,6 +153,16 @@ export function discoverAccounts(options = {}, env = process.env) {
             result.known.push({ ...found, label: existing.label, record: existing });
             continue;
         }
+        // Already recorded, by a CLI that knows something this one doesn't:
+        // registering it again would give one login two identities.
+        const claim = found.isDefault ? { label: DEFAULT_ACCOUNT_LABEL } : { dir: found.dir };
+        if (heldByUnreadableEntry(found.runtime, claim, env)) {
+            result.skipped.push({
+                ...found,
+                reason: "already in the account registry, in an entry this version of the CLI can't read (update @prohost/cli)",
+            });
+            continue;
+        }
         if (found.isDefault) {
             if (options.dryRun)
                 result.added.push(found);

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.12.1";
+export declare const CLI_VERSION = "0.12.3";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.12.1";
+export declare const USER_AGENT = "prohost-cli/0.12.3";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.12.1';
+export const CLI_VERSION = '0.12.3';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",