@prohost/cli 0.6.0 → 0.8.0

package/dist/agent/lock.js

@@ -0,0 +1,91 @@
+/**
+ * One `agent run` per agent home.
+ *
+ * Two harnesses on the same `$PROHOST_HOME` share one credential, one run
+ * ledger and one session store, and both receive every run — so both execute
+ * it. That happens easily: a daemon is installed and the operator also starts
+ * `agent run` in a terminal to watch it. `$PROHOST_HOME/run.lock` makes the
+ * second one refuse to start, with the pid it lost to.
+ *
+ * Created with `O_EXCL`, holding the owner's pid and start time. A lock whose
+ * pid is no longer alive was left by a crash (or `kill -9`) and is taken over.
+ */
+import { openSync, closeSync, readFileSync, rmSync, writeSync } from 'node:fs';
+import path from 'node:path';
+import { prohostHome } from './credentials.js';
+export function runLockPath(env = process.env) {
+    return path.join(prohostHome(env), 'run.lock');
+}
+/** Whether a pid names a live process. EPERM means it exists but isn't ours. */
+export function pidAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+/** The current holder, if the lock file exists and is readable. */
+export function readRunLock(env = process.env) {
+    try {
+        const parsed = JSON.parse(readFileSync(runLockPath(env), 'utf8'));
+        if (typeof parsed.pid !== 'number')
+            return undefined;
+        return { pid: parsed.pid, started_at: String(parsed.started_at ?? '') };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Take the home's run lock, or report who holds it.
+ *
+ * @param isAlive Liveness check seam for tests.
+ */
+export function acquireRunLock(env = process.env, options = {}) {
+    const file = runLockPath(env);
+    const pid = options.pid ?? process.pid;
+    const isAlive = options.isAlive ?? pidAlive;
+    // Two tries: the second only after removing a lock whose owner is dead.
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        let fd;
+        try {
+            fd = openSync(file, 'wx', 0o600);
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+            const holder = readRunLock(env);
+            if (holder && holder.pid !== pid && isAlive(holder.pid))
+                return { ok: false, holder };
+            // Stale (dead owner, or unreadable half-write): clear it and retry once.
+            rmSync(file, { force: true });
+            continue;
+        }
+        const holder = { pid, started_at: new Date().toISOString() };
+        try {
+            writeSync(fd, `${JSON.stringify(holder)}\n`);
+        }
+        finally {
+            closeSync(fd);
+        }
+        let released = false;
+        return {
+            ok: true,
+            release: () => {
+                if (released)
+                    return;
+                released = true;
+                // Only remove it if it is still ours — a takeover after a false
+                // "dead" reading must not be undone by the original owner exiting.
+                if (readRunLock(env)?.pid === pid)
+                    rmSync(file, { force: true });
+            },
+        };
+    }
+    const holder = readRunLock(env);
+    return { ok: false, holder: holder ?? { pid: 0, started_at: '' } };
+}

package/dist/agent/prompt.js

@@ -6,6 +6,7 @@
  * a shell script that greps it. The reply contract is stated explicitly so an
  * agent that would otherwise narrate its reasoning returns something sendable.
  */
+import { NO_REPLY_TOKEN } from './contract.js';
 /**
  * Say the run's budget in a unit a reader thinks in.
  *
@@ -129,15 +130,23 @@ export function buildPrompt(run, context) {
     const name = run.agent_name ?? context.agentName;
     const canReply = Boolean(run.reply_surface !== 'none' && run.reply_path && run.reply_body_key);
     const title = run.agent_title ? ` (${run.agent_title})` : '';
+    // Woken as a bystander: a message landed in a thread the agent belongs to,
+    // addressed to somebody else. Telling it "someone is waiting on a reply"
+    // here is what made a paired agent post a long, unrequested summary onto a
+    // message that @-mentioned three people — so the opening says the opposite.
+    const bystander = canReply && run.reply_expected === false;
     const lines = [
         `You are "${name}"${title}, an AI teammate in a ProhostAI workspace.`,
-        canReply && run.reply_surface === 'conversation'
-            ? 'You were mentioned in a conversation and someone is waiting on a reply.'
-            : run.reply_surface === 'none'
-                ? 'You have been given work to do. There is nowhere to reply.'
-                : canReply
-                    ? `You were mentioned on a ${run.reply_surface} and someone is waiting on a reply.`
-                    : `You have been given work on a ${run.reply_surface}. There is nowhere to post a reply.`,
+        bystander
+            ? `A new message was posted in a ${run.reply_surface} you are a member of. It was not ` +
+                'addressed to you, and nobody is waiting on a reply from you.'
+            : canReply && run.reply_surface === 'conversation'
+                ? 'You were mentioned in a conversation and someone is waiting on a reply.'
+                : run.reply_surface === 'none'
+                    ? 'You have been given work to do. There is nowhere to reply.'
+                    : canReply
+                        ? `You were mentioned on a ${run.reply_surface} and someone is waiting on a reply.`
+                        : `You have been given work on a ${run.reply_surface}. There is nowhere to post a reply.`,
         '',
     ];
     // The operator's own configuration comes first, above everything the server
@@ -187,6 +196,12 @@ export function buildPrompt(run, context) {
     if (run.recent_messages?.length) {
         lines.push('Conversation so far (oldest first):', ...run.recent_messages.map(renderMessage), '--- end of conversation history ---', '');
     }
+    // The server's own work order, when it wrote one that is not simply the
+    // message restated (a run with no message of its own already received the
+    // brief as its excerpt).
+    if (run.trigger_brief && run.trigger_brief !== run.trigger_text) {
+        lines.push('Your instructions for this run, from ProhostAI:', run.trigger_brief, '');
+    }
     const triggerAttachments = run.trigger_attachments ?? [];
     if (run.trigger_text) {
         // The server caps this excerpt, so say so rather than let an agent assume
@@ -305,6 +320,13 @@ export function buildPrompt(run, context) {
     // Postability is a separate question from what the run is about: a task run
     // has no comment route in the external API yet, so the agent must be told its
     // output won't be posted rather than left to assume it will.
+    if (bystander) {
+        // Silence is stated as the default and given a concrete spelling, because
+        // "reply only if useful" without a way to NOT reply still ends in stdout
+        // that gets posted.
+        lines.push('Staying silent is the expected outcome here. Reply only if you can add', 'something clearly distinct that nobody else in the thread was asked for. If', `you decide not to reply, output ONLY the token ${NO_REPLY_TOKEN} — nothing is`, 'posted and the run is recorded as a deliberate silence. Never write a message', 'explaining that you are staying quiet.', 'If you do reply, write the message text only — no preamble, no explanation of', `your reasoning, no surrounding quotes. Anything other than ${NO_REPLY_TOKEN} is`, `posted verbatim as your reply on the ${run.reply_surface}.`);
+        return `${lines.join('\n')}\n`;
+    }
     lines.push(canReply
         ? 'Write your reply to that message. Reply with the message text only — no'
         : 'Summarize what you did, in one short message. Output the message only — no', 'preamble, no explanation of your reasoning, no surrounding quotes. Your', canReply

package/dist/agent/run.d.ts

@@ -24,6 +24,7 @@
  */
 import type { spawn } from 'node:child_process';
 import WebSocket from 'ws';
+import type { CommandRunner } from './accounts.js';
 import type { AgentCredentials } from './credentials.js';
 import type { QuotaProvider } from './runtime_status.js';
 /**
@@ -110,7 +111,7 @@ export interface AgentRunOptions {
      * The second argument is the exact cwd the eventual Codex process receives;
      * Codex discovers project-local config from it.
      */
-    probeImpl?: (command: string, cwd?: string) => {
+    probeImpl?: (command: string, cwd?: string, env?: NodeJS.ProcessEnv) => {
         status: number | null;
         stdout: string;
     };
@@ -138,6 +139,11 @@ export interface AgentRunOptions {
      * Tests inject a fake so no real `claude` / `codex` is spawned.
      */
     quotaProvider?: QuotaProvider | null;
+    /**
+     * Runs the agent CLI's sign-in check for each account (`claude auth status`,
+     * `codex login status`). Tests inject a fake so no real CLI is asked.
+     */
+    accountCommandRunner?: CommandRunner;
 }
 export interface AgentRunMetrics {
     connections: number;
@@ -181,7 +187,7 @@ interface PreparedMcp {
  * extras file is the operator's live grant list. Fresh reads make both a new
  * configured server and a revoked extra visible to the very next run.
  */
-export declare function codexMcpEntryProvider(options: AgentRunOptions, log: (line: string) => void, workdir?: string): () => PreparedMcp;
+export declare function codexMcpEntryProvider(options: AgentRunOptions, log: (line: string) => void, workdir?: string, accountEnv?: () => NodeJS.ProcessEnv): () => PreparedMcp;
 /**
  * Run the harness until the abort signal fires (or ``maxConnections`` is hit).
  *

package/dist/agent/run.js

@@ -25,12 +25,15 @@
 import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import WebSocket from 'ws';
+import { HarnessAccount } from './account_runtime.js';
+import { EVENT_AGENT_CONFIG_UPDATED, machineId } from './accounts.js';
 import { completeRun, describeFailure, isIdempotencyInFlight, postReply } from './api.js';
 import { MAX_SALVAGE_CHARS, claudeCommand, isClaudeExec, looksLikeResumeFailure, readClaudeStream, writeMcpConfig, } from './claude.js';
 import { APPS_FEATURE, MCP_API_KEY_ENV_VAR, PLUGINS_DISABLED_OVERRIDE, codexBinary, codexCommand, codexMcpInventoryFlag, codexProfileName, codexShellSyntax, extraMcpEntries, isCodexExec, isolateConfiguredServers, listMcpServers, mcpServersOverride, prohostMcpEntry, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
+import { ToolEventQueue } from './events.js';
 import { EXTRA_MCP_FILENAME, loadExtraMcpServers } from './extras.js';
 import { MCP_SERVER_NAME, MCP_TOOL_PATTERN } from './mcp.js';
-import { EVENT_AGENT_RUN_REQUESTED, EVENT_MENTION_CREATED, EVENT_MESSAGE_TEAM_CHAT, RUN_ERROR_CANCELLED_BY_USER, eventData, heartbeatPathFor, parseRunRequest, } from './contract.js';
+import { EVENT_AGENT_RUN_REQUESTED, EVENT_MENTION_CREATED, EVENT_MESSAGE_TEAM_CHAT, RUN_ERROR_CANCELLED_BY_USER, eventData, heartbeatPathFor, isNoReply, parseRunRequest, } from './contract.js';
 import { ensureWorkspace, streamUrlFor, workspacePath } from './credentials.js';
 import { execAgent } from './exec.js';
 import { HeartbeatLoop } from './heartbeat.js';
@@ -257,6 +260,13 @@ function buildRuntime(options, log) {
             model,
         };
     }
+    const account = new HarnessAccount({
+        runtime: brain === 'claude' ? 'claude_code' : 'codex',
+        env: options.env,
+        initialLabel: options.credentials.account,
+        binary: brain === 'claude' ? (options.exec.trim().split(/\s+/)[0] ?? 'claude') : codexBinary(options.exec),
+        run: options.accountCommandRunner,
+    });
     const mcpUrl = options.credentials.mcp_url;
     let announced = '';
     const announce = (lines) => {
@@ -294,7 +304,7 @@ function buildRuntime(options, log) {
                 };
             }
         }
-        : codexMcpEntryProvider(options, log, workdir);
+        : codexMcpEntryProvider(options, log, workdir, () => account.spawnEnv());
     const tools = mcpUrl ? `, ProhostAI tools prepared per run as ${MCP_SERVER_NAME}` : '';
     const where = workdir ? ` (workspace: ${workdir})` : '';
     log(brain === 'claude'
@@ -310,7 +320,28 @@ function buildRuntime(options, log) {
             'access, on instructions from your workspace. Use --safe-tools to gate them.'
         : `${timestamp()} ⚙ --safe-tools: tools are permission-gated; anything needing ` +
             'approval will not run (nobody is at a terminal to approve it).');
-    return { workdir, sessions, brain, prepareMcp, skipPermissions, runtimeName, observe, model };
+    // The account is resolved before anything is prepared or spawned, and its
+    // environment rides every spawn of this run. A missing account fails the
+    // run closed, the same way an unprovable MCP boundary does.
+    const prepareWithAccount = () => {
+        const resolved = account.resolveForSpawn();
+        if (!resolved.ok)
+            return { mcpWired: false, error: resolved.error };
+        const prepared = prepareMcp();
+        return { ...prepared, execEnv: { ...account.spawnEnv(), ...prepared.execEnv } };
+    };
+    log(`${timestamp()} ⚙ account: ${account.label()}`);
+    return {
+        workdir,
+        sessions,
+        brain,
+        prepareMcp: prepareWithAccount,
+        skipPermissions,
+        runtimeName,
+        observe,
+        model,
+        account,
+    };
 }
 /**
  * The `runtime` a status frame names. A plain command is `custom` unless it is
@@ -328,11 +359,12 @@ function runtimeNameFor(brain, exec) {
  * Idle capacity source for the detected brain: the agent CLI itself, asked
  * through its own protocol so its own login answers. `plain` has none.
  */
-function defaultQuotaProvider(brain, exec) {
+function defaultQuotaProvider(brain, exec, env) {
     if (brain === 'claude')
-        return claudeQuotaProvider({ binary: exec.trim().split(/\s+/)[0] ?? 'claude' });
-    if (brain === 'codex')
-        return codexQuotaProvider({ binary: codexBinary(exec), clientVersion: CLI_VERSION });
+        return claudeQuotaProvider({ binary: exec.trim().split(/\s+/)[0] ?? 'claude', env });
+    if (brain === 'codex') {
+        return codexQuotaProvider({ binary: codexBinary(exec), clientVersion: CLI_VERSION, env });
+    }
     return undefined;
 }
 /**
@@ -342,12 +374,12 @@ function defaultQuotaProvider(brain, exec) {
  * extras file is the operator's live grant list. Fresh reads make both a new
  * configured server and a revoked extra visible to the very next run.
  */
-export function codexMcpEntryProvider(options, log, workdir) {
+export function codexMcpEntryProvider(options, log, workdir, accountEnv) {
     let announced = '';
     return () => {
         const extras = loadExtraMcpServers({ env: options.env });
         const lines = extras.warnings.map((warning) => `${timestamp()} ! ${warning}`);
-        const prepared = codexMcpEntries(options, extras.servers, (line) => lines.push(line), workdir);
+        const prepared = codexMcpEntries(options, extras.servers, (line) => lines.push(line), workdir, accountEnv?.());
         const said = lines.join('\n');
         if (said !== announced) {
             for (const line of lines)
@@ -362,12 +394,15 @@ export function codexMcpEntryProvider(options, log, workdir) {
  * verified switches that keep the operator's own servers out. Preparation is
  * fail-closed: an unprovable boundary never reaches an unsandboxed agent.
  */
-function codexMcpEntries(options, extraServers, log, workdir) {
+function codexMcpEntries(options, extraServers, log, workdir, accountEnv) {
     const fail = (detail) => {
         log(`${timestamp()} ! ${detail}`);
         return { mcpWired: false, error: detail };
     };
-    const probe = options.probeImpl ?? defaultProbe;
+    // Every probe asks the same CODEX_HOME the run will use — the MCP servers to
+    // isolate live in that account's config.toml, not the default one.
+    const baseProbe = options.probeImpl ?? defaultProbe;
+    const probe = (command, cwd) => accountEnv && Object.keys(accountEnv).length > 0 ? baseProbe(command, cwd, accountEnv) : baseProbe(command, cwd);
     if (codexShellSyntax(options.exec)) {
         return fail('--exec uses shell quoting, expansion, glob, comment, escape, or control syntax that the Codex ' +
             'isolation verifier cannot tokenize safely; use a plain argv-shaped Codex command');
@@ -493,10 +528,11 @@ function codexMcpEntries(options, extraServers, log, workdir) {
  * `cwd` must match the eventual run exactly, because Codex loads trusted
  * project `.codex/config.toml` layers from there.
  */
-function defaultProbe(command, cwd) {
+function defaultProbe(command, cwd, env) {
     const result = spawnSync(command, {
         shell: true,
         cwd,
+        ...(env ? { env: { ...process.env, ...env } } : {}),
         encoding: 'utf8',
         // Generous for a config read, short enough that a wedged binary delays
         // a run rather than wedging the daemon.
@@ -532,7 +568,12 @@ function partialStdout(tail) {
  * tell a failed turn from a successful one. A plain command's behaviour here is
  * byte-for-byte what it was before this function existed.
  */
-async function runTurn(run, prompt, options, runtime, mcp, control, log) {
+async function runTurn(run, prompt, options, runtime, mcp, control, log, 
+/**
+ * Where the streaming brain's tool-call events go, if anywhere. Only the
+ * Claude Code reader produces any; absent, they are simply never collected.
+ */
+toolEvents) {
     // `--timeout` is a ceiling on the run, not on each attempt: the retry below
     // must not let one run take twice what the operator allowed. Both attempts
     // share one deadline, which costs the retry nothing in practice — a rejected
@@ -590,6 +631,9 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
         const activity = reader.activity();
         if (activity)
             control.report(activity);
+        // The heartbeat line above is unchanged for older servers; the events are
+        // the richer channel a newer server renders beneath it.
+        toolEvents?.push(reader.drainToolEvents());
     };
     /**
      * Undo an eagerly recorded Claude session after an ordinary failed turn.
@@ -746,7 +790,7 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
         const output = parseCodexOutput(result.stdout);
         // Codex's `--json` stream carries neither model nor limits; its rollout
         // file for this thread does.
-        runtime.observe(readCodexObservation(output.sessionId, { ...process.env, ...options.env }));
+        runtime.observe(readCodexObservation(output.sessionId, { ...process.env, ...options.env, ...runtime.account?.spawnEnv() }));
         reportDenials(output.denials);
         if (!output.ok) {
             return {
@@ -764,6 +808,10 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
     // crash banner, a `claude` that ignored `--output-format` — is a failure, and
     // the whole-output parser is what says so in words.
     const parsed = (stream ?? readClaudeStream()).finish(result.stdout);
+    // `finish` handles a trailing event with no newline after it; a tool event
+    // in that tail is real and must not be lost to the drain timing.
+    if (stream)
+        toolEvents?.push(stream.drainToolEvents());
     reportDenials(parsed.denials);
     if (!parsed.ok) {
         forgetRecordedSession();
@@ -809,7 +857,21 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
         timeoutMs: options.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS,
         idleTimeoutMs: options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS,
     });
-    const result = await runTurn(run, prompt, options, runtime, mcp, control, log);
+    // Tool-call narration for the thread. A dry run makes no writes, so it gets
+    // no path and every event is dropped; so does a server that advertised none.
+    const toolEvents = new ToolEventQueue({
+        api,
+        path: options.dryRun ? undefined : run.events_path,
+        log,
+        label,
+    });
+    const result = await runTurn(run, prompt, options, runtime, mcp, control, log, toolEvents);
+    // Whatever the turn did, the timeline is whole BEFORE the reply is posted or
+    // the run is closed — a completion that beats its own last tool row would
+    // leave a `calling` row on a finished run. Never rejects, and after `stop`
+    // nothing straggling can post against a run the server has closed.
+    await toolEvents.flush();
+    toolEvents.stop();
     const seconds = (result.durationMs / 1000).toFixed(1);
     // Stopped from outside. Checked before the failure branch below, because a
     // stopped run *is* a failed command — reporting it as one would put "timed
@@ -865,6 +927,23 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
         log(`    [dry-run] nothing was sent and the run was left open`);
         return 'skipped';
     }
+    // The agent decided not to reply — the usual answer when it was woken as a
+    // bystander (`reply_expected: false`). A finished run, not a failure: nothing
+    // is posted, and the completion says so, so the server records a deliberate
+    // silence and clears the thinking indicator as one. Checked on every run, not
+    // only bystander ones: the literal token must never reach a thread.
+    if (isNoReply(reply)) {
+        log(`${timestamp()} ✓ ${label} chose not to reply (${seconds}s)`);
+        const completed = await completeWithRetry(api, run.completion_path, { ok: true, silent: true }, log, sleep, runtime.model());
+        if (!completed.ok) {
+            log(`    ! could not mark the run complete (${describeFailure(completed)})`);
+            return 'unreported';
+        }
+        if (result.sessionId) {
+            runtime.sessions.remember(sessionKeyFor(run), result.sessionId);
+        }
+        return 'succeeded';
+    }
     // A run with no reply surface is a legitimate outcome, not an error: it was
     // started by a trigger rather than by someone addressing the agent, so there
     // is nowhere to post. Complete it as succeeded so any thinking indicator
@@ -934,6 +1013,9 @@ export async function runAgentHarness(options) {
     const url = options.url ?? streamUrlFor(options.credentials, DEFAULT_WS_URL);
     const metrics = newMetrics();
     const runtime = buildRuntime(options, log);
+    // Keys this computer's accounts server-side; the label above is display
+    // only. Only a runtime that reports accounts needs one.
+    const machineIdValue = runtime.account ? machineId({ ...process.env, ...options.env }) : undefined;
     // A credential file written by 0.1.0 stores a socket URL on a host that only
     // ever answers 403. Upgrading the CLI would not have fixed those installs on
     // its own — the stored value wins over the constant — so say what happened
@@ -960,8 +1042,11 @@ export async function runAgentHarness(options) {
     const status = new RuntimeStatusReporter({
         runtime: runtime.runtimeName,
         provider: options.quotaProvider === undefined
-            ? defaultQuotaProvider(runtime.brain, options.exec)
+            ? defaultQuotaProvider(runtime.brain, options.exec, () => runtime.account?.spawnEnv() ?? {})
             : (options.quotaProvider ?? undefined),
+        accounts: runtime.account
+            ? () => runtime.account.snapshot([...accepted.values()].some((entry) => entry.executing))
+            : undefined,
         // A run in flight reports fresh numbers when it ends; don't probe beside it.
         isBusy: () => [...accepted.values()].some((entry) => entry.executing),
         log,
@@ -992,9 +1077,29 @@ export async function runAgentHarness(options) {
         status.observe({
             runtime_version: version,
             model: modelFromExec(options.exec) ??
-                (runtime.brain === 'codex' ? codexConfiguredModel({ ...process.env, ...options.env }) : undefined),
+                (runtime.brain === 'codex'
+                    ? codexConfiguredModel({ ...process.env, ...options.env, ...runtime.account?.spawnEnv() })
+                    : undefined),
         });
     };
+    /**
+     * An operator picked another account in ProhostAI. Applied from the next
+     * run: the run in flight (if any) finishes on the account it started on.
+     */
+    const applyAccountPick = (key, via, requestedAt) => {
+        if (!runtime.account)
+            return false;
+        const outcome = runtime.account.apply(key, requestedAt);
+        if (!outcome.applied) {
+            log(`${timestamp()} ! account change from ProhostAI ignored (${via}): ${outcome.reason}`);
+            return false;
+        }
+        if (outcome.changed) {
+            log(`${timestamp()} ⚙ account: ${outcome.record.label} (picked in ProhostAI) — used from the next run`);
+            status.accountsChanged();
+        }
+        return true;
+    };
     let queue = Promise.resolve();
     let fatal;
     let attempt = 0;
@@ -1151,6 +1256,7 @@ export async function runAgentHarness(options) {
                     type: 'auth',
                     api_key: options.credentials.api_key,
                     machine,
+                    ...(machineIdValue ? { machine_id: machineIdValue } : {}),
                     client_version: CLI_VERSION,
                     ...(options.credentials.subscription_id
                         ? { subscription_id: options.credentials.subscription_id }
@@ -1186,6 +1292,17 @@ export async function runAgentHarness(options) {
                         `${EVENT_AGENT_RUN_REQUESTED} (exec: ${options.exec})`);
                     // Only a server that says it understands the frame gets one; an
                     // older server may treat an unknown frame type as a protocol error.
+                    // A pick made while this agent was offline: the server repeats it on
+                    // every connect until a status frame reports the agent on it.
+                    // Its `requested_at` is the newest pick's stamp — a floor for any
+                    // live pick still in flight from before this connect.
+                    const pending = f.agent_config;
+                    if (pending && typeof pending === 'object') {
+                        if (pending.account_key !== undefined) {
+                            applyAccountPick(pending.account_key, 'on connect', pending.requested_at);
+                        }
+                        runtime.account?.noteRequestedAt(pending.requested_at);
+                    }
                     if (Array.isArray(f.features) && f.features.includes(RUNTIME_STATUS_FEATURE)) {
                         primeStatus();
                         status.attach((frame) => ws.send(JSON.stringify(frame)));
@@ -1220,6 +1337,21 @@ export async function runAgentHarness(options) {
                         /* best-effort */
                     }
                 };
+                if (frame.event === EVENT_AGENT_CONFIG_UPDATED) {
+                    // It changes which subscription this machine spends, so it is held to
+                    // the same signature rule as a run.
+                    if (!verifySignature(options.credentials.webhook_secret, frame.payload, frame.signature) &&
+                        !options.allowUnverified) {
+                        metrics.signatureRejections += 1;
+                        log(`${timestamp()} ✗ rejected ${EVENT_AGENT_CONFIG_UPDATED} — signature did not verify`);
+                        ack(ACK_REJECTED);
+                        return;
+                    }
+                    const data = eventData(frame.payload);
+                    const applied = applyAccountPick(data.account_key, 'live', data.requested_at);
+                    ack(applied ? ACK_ACCEPTED : ACK_IGNORED);
+                    return;
+                }
                 if (frame.event !== EVENT_AGENT_RUN_REQUESTED) {
                     if (frame.event === EVENT_MENTION_CREATED || frame.event === EVENT_MESSAGE_TEAM_CHAT) {
                         // "runs are triggered by mentions" was wrong twice over: the gate
@@ -1332,6 +1464,10 @@ export async function runAgentHarness(options) {
                     // whole of `handleRun`, including the ten minutes of completion
                     // retries at the end of it.
                     release(run.run_id);
+                    // An account picked mid-run was held back from the status frame
+                    // until this run (on the old account) was done; report it now.
+                    if (runtime.account?.changedSinceSpawn())
+                        status.accountsChanged();
                     // Both terminal outcomes reached the completion endpoint; only then
                     // is the run settled and safe to skip on redelivery.
                     if (outcome === 'succeeded')

package/dist/agent/runtime_status.d.ts

@@ -25,6 +25,7 @@
  * shapes belong to other tools and grow without asking us.
  */
 import { spawn as nodeSpawn } from 'node:child_process';
+import type { AccountBlock } from './accounts.js';
 /** Feature name the server lists in `auth_ok.features` when it accepts the frame. */
 export declare const RUNTIME_STATUS_FEATURE = "runtime_status";
 /** Routine report cadence while connected. */
@@ -39,13 +40,20 @@ export declare const MIN_FRAME_SPACING_MS = 31000;
 export declare const QUOTA_REFRESH_AFTER_MS: number;
 /** Ceiling on one idle quota probe. */
 export declare const PROVIDER_TIMEOUT_MS = 10000;
-export type QuotaKind = 'session' | 'weekly';
+export type QuotaKind = 'session' | 'weekly' | 'weekly_model';
 export interface QuotaWindow {
     kind: QuotaKind;
     /** 0–100. */
     used_percent: number;
-    /** ISO-8601. */
-    resets_at: string;
+    /**
+     * ISO-8601, or `null` for a window whose usage is known but which has not
+     * started — Claude's 5-hour window after five idle hours. Reported as such
+     * rather than dropped: "0%, starts on next use" is an answer, a missing
+     * window is not.
+     */
+    resets_at: string | null;
+    /** The model a `weekly_model` window is scoped to, e.g. `Fable`. */
+    model_label?: string;
 }
 /** What one source managed to learn. Every field is optional; absent means "didn't learn it". */
 export interface RuntimeObservation {
@@ -68,7 +76,17 @@ export declare function parseVersion(stdout: string): string | undefined;
  * The field is marked internal upstream, so an unexpected shape yields nothing.
  */
 export declare function fromClaudeRateLimitInfo(info: unknown): QuotaWindow[];
-/** Windows from a `get_usage` control response (0–100, ISO strings). */
+/**
+ * Windows from a `get_usage` control response (0–100, ISO strings).
+ *
+ * A window with a usage but a `null` reset is kept, with `resets_at: null` —
+ * that is how an idle account's 5-hour window reads, and dropping it is what
+ * left paired agents showing a weekly window and nothing else (B3).
+ *
+ * Per-model weekly windows come from `rate_limits.limits[]` rows of kind
+ * `weekly_scoped` (classified on `kind`, as the schema asks, never on a
+ * label), falling back to `model_scoped[]`.
+ */
 export declare function fromClaudeGetUsage(usage: unknown): QuotaWindow[];
 /** `get_usage.subscription_type` → display label; `undefined` for anything else. */
 export declare function claudePlanLabel(subscriptionType: unknown): string | undefined;
@@ -129,6 +147,8 @@ export declare function claudeQuotaProvider(options: {
     binary: string;
     spawnImpl?: SpawnFn;
     timeoutMs?: number;
+    /** Account environment, read at each probe so a switch applies to the next one. */
+    env?: () => NodeJS.ProcessEnv;
 }): QuotaProvider;
 /** Codex's `account/rateLimits/read` over `codex app-server` stdio JSON-RPC. */
 export declare function codexQuotaProvider(options: {
@@ -136,12 +156,42 @@ export declare function codexQuotaProvider(options: {
     clientVersion: string;
     spawnImpl?: SpawnFn;
     timeoutMs?: number;
+    /** Account environment, read at each probe so a switch applies to the next one. */
+    env?: () => NodeJS.ProcessEnv;
 }): QuotaProvider;
+/**
+ * Fold new windows into the ones already known, one KIND at a time.
+ *
+ * Sources see different slices: a run's `rate_limit_event` carries only the
+ * 5-hour and weekly windows (and omits one whose reset has passed), while the
+ * idle `get_usage` probe also carries the per-model weekly ones. Replacing the
+ * whole list with whatever arrived last is how a stream event used to erase
+ * the windows it simply didn't mention. A kind the observation names replaces
+ * every window of that kind; a kind it doesn't name is kept.
+ */
+export declare function mergeWindows(known: QuotaWindow[] | undefined, observed: QuotaWindow[]): QuotaWindow[];
+/** What the harness knows about accounts on this machine, for the frame. */
+export interface AccountsSnapshot {
+    /** The account this agent runs on. */
+    current?: AccountBlock;
+    /**
+     * Every account on the machine, identity and sign-in state only. Omitted
+     * when the list would be partial: the server treats it as authoritative
+     * and would forget whatever it doesn't name.
+     */
+    all?: AccountBlock[];
+}
 export interface RuntimeStatusReporterOptions {
     /** `claude_code` | `codex` | `goose` | `custom`. */
     runtime: string;
     /** Idle quota source; omit for a runtime that has none. */
     provider?: QuotaProvider;
+    /**
+     * Accounts on this machine and which one this agent uses. Re-read on the
+     * same cadence as the idle quota probe (it asks each login whether it is
+     * signed in), and straight away after {@link RuntimeStatusReporter.accountsChanged}.
+     */
+    accounts?: () => Promise<AccountsSnapshot | undefined>;
     /** A run is executing — it will bring fresh numbers, so don't probe beside it. */
     isBusy?: () => boolean;
     now?: () => number;
@@ -170,9 +220,25 @@ export declare class RuntimeStatusReporter {
     private cancelPending;
     private cancelTick;
     private refreshing;
+    private accountGeneration;
+    private accounts;
+    private accountsObservedAt;
     constructor(options: RuntimeStatusReporterOptions);
     /** Merge what a source learned. Absent fields keep their previous value. */
     observe(observation: RuntimeObservation | undefined): void;
+    /**
+     * Record the accounts snapshot. Moving to another account drops what was
+     * known about the previous one's capacity and plan — they describe a
+     * different subscription — and asks for fresh numbers straight away.
+     */
+    setAccounts(snapshot: AccountsSnapshot | undefined, options?: {
+        quiet?: boolean;
+    }): void;
+    /**
+     * The account choice changed (an operator picked one in ProhostAI): re-read
+     * accounts and capacity on the next tick rather than in fifteen minutes.
+     */
+    accountsChanged(): void;
     /** The model to report on a run's completion, when nothing more specific is known. */
     model(): string | undefined;
     /** Start reporting on a socket that advertised the feature. */