@remits/remits-cli 0.1.104 → 0.1.107

package/index.js

@@ -29,6 +29,7 @@ const ACCOUNT_REPO_INDEX_FILE = path.join(SESSION_DIR, 'account-repos.json');
 const SERVICE_STATE_FILE = path.join(SESSION_DIR, 'service-state.json');
 const ISSUES_DIR = path.join(SESSION_DIR, 'issues');
 const WEBSOCKET_STATE_FILE = path.join(SESSION_DIR, 'websocket-state.json');
+const LISTENER_REGISTRATION_STATE_FILE = path.join(SESSION_DIR, 'listener-registration-state.json');
 const AUTO_UPDATE_LOCK_DIR = path.join(SESSION_DIR, 'auto-update.lock');
 const AUTO_UPDATE_DISABLED_VALUES = new Set(['0', 'false', 'no', 'off']);
 const REMITS_CLI_PACKAGE_NAME = '@remits/remits-cli';
@@ -45,6 +46,10 @@ const WEBSOCKET_RECONNECT_DELAY_MS = Number(process.env.REMITS_CLI_WEBSOCKET_REC
 const WEBSOCKET_HEARTBEAT_MS = Number(process.env.REMITS_CLI_WEBSOCKET_HEARTBEAT_MS || 10000);
 const WEBSOCKET_CONNECTION_TIMEOUT_MS = Number(process.env.REMITS_CLI_WEBSOCKET_CONNECTION_TIMEOUT_MS || 15000);
 const WEBSOCKET_WATCHDOG_GRACE_MS = Number(process.env.REMITS_CLI_WEBSOCKET_WATCHDOG_GRACE_MS || 30000);
+const SUPPORT_TICKET_DASHBOARD_REFRESH_MS = Number(process.env.REMITS_CLI_SUPPORT_TICKET_REFRESH_MS || 30000);
+const SUPPORT_TICKET_DASHBOARD_LIMIT = Number(process.env.REMITS_CLI_SUPPORT_TICKET_LIMIT || 20);
+const LISTENER_REGISTRATION_INTERVAL_MS = Number(process.env.REMITS_CLI_REGISTRATION_INTERVAL_MS || 5 * 60 * 1000);
+const LISTENER_REGISTRATION_MIN_INTERVAL_MS = Number(process.env.REMITS_CLI_REGISTRATION_MIN_INTERVAL_MS || 5 * 60 * 1000);
 const ACCOUNT_SCAN_EXCLUDE_DIRS = new Set([
   '.git',
   '.gradle',
@@ -74,7 +79,7 @@ const ACCOUNT_SCAN_EXCLUDE_DIRS = new Set([
 
 // Flags that are legitimately repeatable accumulate into an array instead of last-wins. Every other
 // flag keeps last-wins so existing callers are unaffected.
-const REPEATABLE_FLAGS = new Set(['expected-removed', 'expectedRemoved']);
+const REPEATABLE_FLAGS = new Set(['expected-removed', 'expectedRemoved', 'names']);
 
 function parseArgs(argv) {
   const out = { _: [] };
@@ -1273,6 +1278,156 @@ function discoverAccountRepos() {
   };
 }
 
+function listenerRegistrationRepoAccounts() {
+  return listAccountRepoEntries(readAccountRepoIndex())
+    .sort((a, b) => Number(a.accountId) - Number(b.accountId))
+    .map((entry) => ({
+      accountId: Number(entry.accountId),
+      name: entry.name || null,
+      type: entry.type || null,
+      platformAccountId: entry.platformAccountId || null,
+      routingScope: ['PLATFORM', 'PRODUCT'].includes(String(entry.type || '').toUpperCase())
+        ? 'self_and_descendants'
+        : 'self',
+      source: entry.source || null,
+      updatedAt: entry.updatedAt || null
+    }));
+}
+
+function readListenerRegistrationState() {
+  if (!fs.existsSync(LISTENER_REGISTRATION_STATE_FILE)) {
+    return {};
+  }
+  try {
+    const data = JSON.parse(fs.readFileSync(LISTENER_REGISTRATION_STATE_FILE, 'utf8'));
+    return data && typeof data === 'object' ? data : {};
+  } catch (_) {
+    return {};
+  }
+}
+
+function writeListenerRegistrationState(data) {
+  ensureSessionDir();
+  atomicWriteFile(LISTENER_REGISTRATION_STATE_FILE, JSON.stringify(data || {}, null, 2));
+}
+
+function listenerRegistrationStateKey(session) {
+  const baseUrl = normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL);
+  const userId = session.user && session.user.id ? session.user.id : 'unknown';
+  return baseUrl + '|' + String(userId);
+}
+
+function serviceRegistrationState() {
+  const state = readServiceState();
+  return {
+    running: isListenerRunning(),
+    pid: state && state.pid ? state.pid : (fs.existsSync(LISTENER_PID_FILE) ? fs.readFileSync(LISTENER_PID_FILE, 'utf8').trim() : null),
+    startedAt: state && state.startedAt ? state.startedAt : runtimeState.service.startedAt,
+    dashboardUrl: state && state.dashboardUrl ? state.dashboardUrl : runtimeState.service.dashboardUrl
+  };
+}
+
+function listenerRegistrationPayload(session, options = {}) {
+  const service = serviceRegistrationState();
+  return {
+    client: 'remits-cli',
+    reason: options.reason || 'heartbeat',
+    baseUrl: normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL),
+    accountId: Number(session.accountId),
+    dataMode: normalizeDataMode(session.dataMode),
+    websocketTopic: session.websocketTopic || (session.user && session.user.uuid ? String(session.user.uuid).replace(/-/g, '') : null),
+    dashboardUrl: service.dashboardUrl || null,
+    agent: getPreferredAgent(),
+    service,
+    repoAccounts: listenerRegistrationRepoAccounts()
+  };
+}
+
+function listenerRegistrationSignature(payload) {
+  return sha256(stableStringify({
+    baseUrl: payload.baseUrl,
+    accountId: payload.accountId,
+    dataMode: payload.dataMode,
+    websocketTopic: payload.websocketTopic,
+    dashboardUrl: payload.dashboardUrl,
+    agent: payload.agent,
+    serviceRunning: payload.service && payload.service.running,
+    repoAccounts: (payload.repoAccounts || []).map((entry) => ({
+      accountId: entry.accountId,
+      type: entry.type,
+      routingScope: entry.routingScope,
+      updatedAt: entry.updatedAt
+    }))
+  }));
+}
+
+function shouldRegisterCliListener(session, payload, options = {}) {
+  if (options.force === true) {
+    return true;
+  }
+  const state = readListenerRegistrationState();
+  const key = listenerRegistrationStateKey(session);
+  const existing = state[key];
+  if (!existing) {
+    return true;
+  }
+  const lastRegisteredAtMs = Number(existing.lastRegisteredAtMs || 0);
+  if (!lastRegisteredAtMs || Date.now() - lastRegisteredAtMs >= LISTENER_REGISTRATION_MIN_INTERVAL_MS) {
+    return true;
+  }
+  return existing.signature !== listenerRegistrationSignature(payload);
+}
+
+function rememberCliListenerRegistration(session, payload) {
+  const state = readListenerRegistrationState();
+  const key = listenerRegistrationStateKey(session);
+  state[key] = {
+    baseUrl: payload.baseUrl,
+    userId: session.user && session.user.id ? session.user.id : null,
+    signature: listenerRegistrationSignature(payload),
+    accountCount: Array.isArray(payload.repoAccounts) ? payload.repoAccounts.length : 0,
+    lastRegisteredAt: new Date().toISOString(),
+    lastRegisteredAtMs: Date.now()
+  };
+  writeListenerRegistrationState(state);
+}
+
+async function registerCliListenerSession(session, options = {}) {
+  if (!session || !session.token) {
+    return null;
+  }
+  const baseUrl = normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL);
+  const payload = listenerRegistrationPayload(session, options);
+  if (!shouldRegisterCliListener(session, payload, options)) {
+    return { success: true, skipped: true, reason: 'recently_registered' };
+  }
+  const api = buildAxios(baseUrl, session.token, parsePositiveInt(options.timeoutMs, 5000));
+  const response = await api.post('/cli/register', payload);
+  rememberCliListenerRegistration(session, payload);
+  return response.data;
+}
+
+async function bestEffortRegisterCliListeners(options = {}) {
+  const sessions = listSessionsFromStore(readAllSessions()).filter((session) => session && session.token);
+  if (!sessions.length) {
+    return [];
+  }
+  const results = await Promise.all(sessions.map(async (session) => {
+    try {
+      const data = await registerCliListenerSession(session, options);
+      return { success: true, accountId: session.accountId, baseUrl: session.baseUrl, data };
+    } catch (err) {
+      appendGlobalActivityLog('listener', 'registration.failed', {
+        accountId: session.accountId,
+        baseUrl: normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL),
+        error: describeError(err)
+      }, 'error');
+      return { success: false, accountId: session.accountId, baseUrl: session.baseUrl, error: describeError(err) };
+    }
+  }));
+  return results;
+}
+
 function resolvePreferredAccountId(cwd, flags, session) {
   // Explicit --account-id wins over the repo's account-info.json so users can
   // target a child account (e.g. a customer) from a parent-account repo.
@@ -1572,6 +1727,42 @@ function changedComponentsFromWorkingTree(cwd) {
   });
 }
 
+/**
+ * Components touched by commits between `ref` and HEAD.
+ *
+ * `changedComponentsFromWorkingTree` reads `git status`, i.e. UNCOMMITTED edits only — which is empty
+ * at exactly the moment `--changed-only` is meant to run, because the documented flow is
+ * commit -> push -> sync (sync reads the pushed remote, so it cannot see uncommitted work at all).
+ * The gate was therefore unusable in the flow it exists to guard: it refused every plan with
+ * "plan touches N component(s) this working tree did not edit". `--changed-since <ref>` supplies the
+ * base so the same guard works after the commit.
+ */
+function changedComponentsSinceRef(cwd, ref) {
+  let output = '';
+  try {
+    output = execSync('git diff --name-only ' + JSON.stringify(ref) + '...HEAD -- components', {
+      cwd,
+      stdio: ['ignore', 'pipe', 'pipe']
+    }).toString();
+  } catch (_) {
+    return null;
+  }
+  const byKey = new Map();
+  for (const rawLine of output.split(/\r?\n/)) {
+    const filePath = rawLine.trim();
+    if (!filePath) continue;
+    const info = componentPathInfo(cwd, filePath);
+    if (!info) continue;
+    if (!byKey.has(info.key)) {
+      byKey.set(info.key, { type: info.type, id: info.id, name: info.name, fields: [], paths: [] });
+    }
+    const entry = byKey.get(info.key);
+    if (!entry.fields.includes(info.field)) entry.fields.push(info.field);
+    if (!entry.paths.includes(info.path)) entry.paths.push(info.path);
+  }
+  return Array.from(byKey.values());
+}
+
 function parsePositiveInt(value, fallback) {
   const parsed = Number(value);
   return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
@@ -1951,6 +2142,9 @@ async function authCommand(flags) {
   });
   console.log('Authenticated as user', session.user ? session.user.id : 'unknown', 'for account', session.accountId);
   console.log('Data mode:', session.dataMode);
+  try {
+    await bestEffortRegisterCliListeners({ cwd, reason: 'auth' });
+  } catch (_) { /* best-effort */ }
 
   try {
     const branchName = currentBranch(cwd);
@@ -2309,7 +2503,7 @@ async function syncComponentsCommand(flags) {
       throw new Error(previewResponse.message || 'Server sync dry-run failed');
     }
 
-    preflightGate = evaluateSyncGates(previewResponse, flags, changedFromWorkingTree);
+    preflightGate = evaluateSyncGates(previewResponse, flags, changedFromWorkingTree, cwd);
 
     if (namesOnly) {
       printSessionResolutionWarning(sessionContext);
@@ -2332,7 +2526,7 @@ async function syncComponentsCommand(flags) {
   }
 
   const summary = buildSyncSummary(response);
-  const gate = preflightGate || evaluateSyncGates(response, flags, changedFromWorkingTree);
+  const gate = preflightGate || evaluateSyncGates(response, flags, changedFromWorkingTree, cwd);
   summary.gates = gate.checks;
 
   if (flagEnabled(flags.json)) {
@@ -2505,7 +2699,7 @@ function parseExpectedRemoved(flags) {
 }
 
 // Fail-closed gates. Each returns a violation string or null; the command exits non-zero if any fire.
-function evaluateSyncGates(response, flags, changedFromWorkingTree) {
+function evaluateSyncGates(response, flags, changedFromWorkingTree, cwd) {
   const entries = syncPlanEntries(response);
   const results = ((response && response.sync) || {}).syncResults || {};
   const removed = entries.filter((e) => e.bucket === 'removed');
@@ -2536,13 +2730,19 @@ function evaluateSyncGates(response, flags, changedFromWorkingTree) {
   }
 
   if (flagEnabled(flags['changed-only']) || flagEnabled(flags.changedOnly)) {
-    if (changedFromWorkingTree === null) {
+    const since = flags['changed-since'] || flags.changedSince;
+    const fromRef = since ? changedComponentsSinceRef(cwd, String(since)) : null;
+    if (since && fromRef === null) {
+      violations.push('--changed-since: could not diff against "' + since + '". Check the ref exists (git fetch first for a remote ref).');
+      checks.changedOnly = false;
+    } else if (changedFromWorkingTree === null && fromRef === null) {
       violations.push('--changed-only: this checkout is not a git working tree, so the changed set cannot be established.');
       checks.changedOnly = false;
     } else {
+      const changedSet = (changedFromWorkingTree || []).concat(fromRef || []);
       // A component the checkout edited is identified by type + id, or type + name for `new_` files.
-      const allowedIds = new Set(changedFromWorkingTree.filter((c) => c.id != null).map((c) => c.type + ':' + c.id));
-      const allowedNames = new Set(changedFromWorkingTree.filter((c) => c.name).map((c) => c.type + ':' + String(c.name).toLowerCase()));
+      const allowedIds = new Set(changedSet.filter((c) => c.id != null).map((c) => c.type + ':' + c.id));
+      const allowedNames = new Set(changedSet.filter((c) => c.name).map((c) => c.type + ':' + String(c.name).toLowerCase()));
       const unexpected = entries.filter((entry) => {
         if (entry.id != null && allowedIds.has(entry.type + ':' + entry.id)) return false;
         if (entry.name && allowedNames.has(entry.type + ':' + String(entry.name).toLowerCase())) return false;
@@ -2550,8 +2750,15 @@ function evaluateSyncGates(response, flags, changedFromWorkingTree) {
       });
       checks.changedOnly = unexpected.length === 0;
       if (unexpected.length) {
-        violations.push('--changed-only: plan touches ' + unexpected.length + ' component(s) this working tree did not edit: ' +
-          unexpected.slice(0, 20).map(syncEntryToken).join(', ') + (unexpected.length > 20 ? ', ...' : ''));
+        // Name the most likely cause instead of only the symptom. An empty changed set with a non-empty
+        // plan is the ordinary post-commit state, not evidence that the plan is dangerous.
+        const hint = (!changedSet.length && !since)
+          ? '\n    The changed set is EMPTY: --changed-only reads UNCOMMITTED edits, and the documented flow ' +
+            'commits and pushes before syncing. Pass --changed-since <ref> (e.g. the commit you branched ' +
+            'from, or origin/main) so the gate can see committed work.'
+          : '';
+        violations.push('--changed-only: plan touches ' + unexpected.length + ' component(s) this checkout did not change: ' +
+          unexpected.slice(0, 20).map(syncEntryToken).join(', ') + (unexpected.length > 20 ? ', ...' : '') + hint);
       }
     }
   }
@@ -2571,6 +2778,36 @@ function buildSyncSummary(response) {
   const errors = Array.isArray(results.errors) ? results.errors : [];
   const skipped = Array.isArray(results.skipped) ? results.skipped : [];
 
+  // A sync that SHORT-CIRCUITED on the cached branch SHA did no work at all, and the server says so
+  // (`skipped: true` plus a message). Rendering it through the normal shape below printed
+  // `overridden: 0, added: 0, removed: []` — which is what a sync that ran and found nothing to do
+  // prints, so the two were indistinguishable. That matters because the cache can hold a SHA whose
+  // overlays were since removed by another path: an ordinary re-sync then reports zeros forever and
+  // the operator has no reason to suspect the branch was never re-read. Report the skip as itself.
+  // `syncResults` absent is the fallback signal, so this still reads correctly against a server that
+  // predates the explicit `skipped` flag rather than silently falling back to the misleading zeros.
+  const shortCircuited = sync.skipped === true
+    || (sync.syncResults == null && !!sync.message && sync.dryRun !== true);
+  if (shortCircuited) {
+    return {
+      success: response && response.success === true,
+      accountId: response && response.accountId,
+      branchName: sync.branchName || (response && response.branchName),
+      mode: sync.mode || 'variant',
+      skipped: true,
+      reason: sync.message || 'branch head matches the cached sync SHA; the branch was not re-read',
+      branchHeadSha: sync.branchHeadSha || sync.postSyncSha || null,
+      warnings: [
+        // Scoped to COMPONENTS deliberately: the short-circuit still refreshes the delivered guides and
+        // account metadata, so "nothing happened" would be its own small untruth.
+        'NO COMPONENTS WERE SYNCED. This is the cached-SHA short-circuit, not an empty plan — the ' +
+          'branch was never re-read.',
+        'Use --dry-run to see the real plan (a dry run always re-reads the branch), or ' +
+          '--force-tombstones to re-read and apply it.'
+      ]
+    };
+  }
+
   // A TRUNK sync and a VARIANT sync report in different vocabularies, and this summary only ever spoke
   // variant. So the single most consequential line of a promotion — "component X was CREATED on trunk as
   // id N" — printed as `added: 0`, and the runbook's definition of done ("components created, with their
@@ -3153,7 +3390,26 @@ async function testCommand(flags) {
     throw new Error('Missing --test <id-or-name>');
   }
 
-  const names = flags.names ? String(flags.names).split(',').map((s) => s.trim()).filter(Boolean) : [];
+  // Test case names are English prose, so COMMAS occur in them naturally. A comma-delimited selector
+  // therefore split a legitimate name in half, matched nothing, and (before the server learned to
+  // report unmatched selectors) reported a clean run of zero cases. `|` is the delimiter now; the
+  // comma still works when no `|` is present, so existing invocations keep behaving as before.
+  // `--names` may also be repeated, which needs no delimiter at all.
+  const rawNames = flags.names === undefined || flags.names === null
+    ? []
+    : (Array.isArray(flags.names) ? flags.names : [flags.names]);
+  const repeated = rawNames.length > 1;
+  const names = rawNames
+    .flatMap((value) => {
+      const text = String(value);
+      if (text.includes('|')) return text.split('|');
+      // Comma-splitting is the legacy behaviour, kept so existing invocations still work. It is applied
+      // ONLY to a single --names value: repeating the flag is already unambiguous, so splitting there
+      // would take a deliberate literal name back apart.
+      return repeated ? [text] : text.split(',');
+    })
+    .map((s) => s.trim())
+    .filter(Boolean);
 
   const api = buildAxios(baseUrl, session.token);
   // --as-account runs the Test AS a (descendant) subscriber account, so that account's relationship
@@ -3209,6 +3465,23 @@ async function testCommand(flags) {
   }
 
   console.log('Final status:', JSON.stringify(status, null, 2));
+
+  // A selector that matched no case is a mis-specified run, not a passing one. Say so in the terminal
+  // and exit non-zero, or "0 passed, 0 failed" reads exactly like a suite where everything passed.
+  const unmatched = (status.result && status.result.unmatchedTestNames) || [];
+  if (unmatched.length) {
+    console.error('');
+    console.error('No test case matched: ' + unmatched.map((n) => '"' + n + '"').join(', '));
+    const declared = (status.result && status.result.declaredTestNames) || [];
+    if (declared.length) {
+      console.error('Cases declared by this suite:');
+      declared.forEach((n) => console.error('  - ' + n));
+    }
+    console.error('--names is delimited by "|" (a comma still works when no "|" is present), so a case');
+    console.error('name containing a comma must be passed with "|" or by repeating --names.');
+    process.exitCode = 1;
+  }
+
   if (status.status !== 'completed') {
     process.exitCode = 1;
   } else if (status.result && status.result.failed > 0) {
@@ -3912,6 +4185,10 @@ let runtimeState = {
   websocket: {},
   lastAction: null
 };
+let supportTicketSnapshotCache = {
+  fetchedAtMs: 0,
+  value: null
+};
 
 function listenerSessionEntriesFromStore(store) {
   return listSessionsFromStore(store).filter((session) => session && session.token && session.websocketTopic);
@@ -4299,6 +4576,7 @@ function exportIssueBundle(snapshot) {
   copyFileIfExists(SESSIONS_FILE, path.join(globalDir, 'sessions.json'));
   copyFileIfExists(CONFIG_FILE, path.join(globalDir, 'config.json'));
   copyFileIfExists(SERVICE_STATE_FILE, path.join(globalDir, 'service-state.json'));
+  copyFileIfExists(LISTENER_REGISTRATION_STATE_FILE, path.join(globalDir, 'listener-registration-state.json'));
   copyFileIfExists(ACCOUNT_REPO_INDEX_FILE, path.join(globalDir, 'account-repos.json'));
   copyFileIfExists(DISPATCH_STATE_FILE, path.join(globalDir, 'dispatch-panes.json'));
   copyFileIfExists(TMUX_ACTIVITY_LOG_FILE, path.join(globalDir, 'tmux-activity.log'));
@@ -4340,6 +4618,7 @@ function buildGlobalFileSnapshot() {
     { label: 'config.json', path: CONFIG_FILE, mode: 'json' },
     { label: 'service-state.json', path: SERVICE_STATE_FILE, mode: 'json' },
     { label: 'websocket-state.json', path: WEBSOCKET_STATE_FILE, mode: 'json' },
+    { label: 'listener-registration-state.json', path: LISTENER_REGISTRATION_STATE_FILE, mode: 'json' },
     { label: 'dispatch-panes.json', path: DISPATCH_STATE_FILE, mode: 'json' },
     { label: 'account-repos.json', path: ACCOUNT_REPO_INDEX_FILE, mode: 'json' },
     { label: 'tmux-activity.log (tail)', path: TMUX_ACTIVITY_LOG_FILE, mode: 'tail' }
@@ -4396,7 +4675,140 @@ function buildRepoSnapshot(entry) {
   };
 }
 
-function collectDashboardSnapshot() {
+function compactSupportTicketRow(row) {
+  if (!row || typeof row !== 'object') {
+    return null;
+  }
+  return {
+    ticketId: row.ticketId || row.id || null,
+    accountId: row.accountId || row.account_id || null,
+    accountName: row.accountName || null,
+    subject: row.subject || null,
+    priority: row.priority || null,
+    status: row.status || null,
+    type: row.type || null,
+    source: row.source || null,
+    assignedTo: row.assignedTo || null,
+    implementationAccountId: row.implementationAccountId || null,
+    implementationAccountName: row.implementationAccountName || null,
+    affectedComponent: row.affectedComponent || null,
+    updatedAt: row.updatedAt || row.updated || row.lastActivityAt || null,
+    activityAt: row.activityAt || row.lastActivityAt || null,
+    activityLabel: row.activityLabel || null
+  };
+}
+
+function supportTicketQueueInput(session) {
+  return {
+    action: 'list',
+    accountId: Number(session.accountId),
+    includeChildren: true,
+    includeRoot: true,
+    sortBy: 'triage',
+    limit: Math.min(Math.max(parsePositiveInt(SUPPORT_TICKET_DASHBOARD_LIMIT, 20), 1), 100)
+  };
+}
+
+async function fetchSupportTicketQueueForSession(session) {
+  const baseUrl = normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL);
+  const api = buildAxios(baseUrl, session.token, 12000);
+  const response = await api.post('/cli/tool', {
+    token: session.token,
+    accountId: Number(session.accountId),
+    branchName: '',
+    dataMode: 'prod',
+    name: 'mcp_support_ticket_queue',
+    callId: 'dashboard-support-ticket-queue-' + crypto.randomUUID(),
+    input: supportTicketQueueInput(session)
+  }).then((r) => r.data);
+
+  const result = response && response.result ? response.result : {};
+  const tickets = Array.isArray(result.tickets)
+    ? result.tickets.map(compactSupportTicketRow).filter(Boolean)
+    : [];
+  return {
+    success: response && response.success !== false && response.toolSuccess !== false && result.success !== false,
+    baseUrl,
+    accountId: Number(session.accountId),
+    userId: session.user && session.user.id ? session.user.id : null,
+    dataMode: result.dataMode || response.dataMode || 'prod',
+    totalCount: result.totalCount || tickets.length,
+    count: result.count || tickets.length,
+    counts: result.counts || {},
+    recommendedTicket: compactSupportTicketRow(result.recommendedTicket),
+    tickets,
+    searchedAccounts: result.searchedAccounts || [],
+    message: response.toolMessage || result.message || null
+  };
+}
+
+async function collectSupportTicketSnapshot() {
+  const nowMs = Date.now();
+  if (supportTicketSnapshotCache.value &&
+      nowMs - supportTicketSnapshotCache.fetchedAtMs < SUPPORT_TICKET_DASHBOARD_REFRESH_MS) {
+    return supportTicketSnapshotCache.value;
+  }
+
+  const sessions = listSessionsFromStore(readAllSessions())
+    .filter((session) => session && session.token && session.accountId);
+  const seen = new Set();
+  const queueSessions = sessions.filter((session) => {
+    const key = normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL) + '|' + String(session.accountId) + '|' +
+      String(session.user && session.user.id ? session.user.id : '');
+    if (seen.has(key)) {
+      return false;
+    }
+    seen.add(key);
+    return true;
+  }).slice(0, 12);
+
+  const queues = [];
+  const errors = [];
+  await Promise.all(queueSessions.map(async (session) => {
+    try {
+      queues.push(await fetchSupportTicketQueueForSession(session));
+    } catch (err) {
+      errors.push({
+        baseUrl: normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL),
+        accountId: Number(session.accountId),
+        userId: session.user && session.user.id ? session.user.id : null,
+        message: describeError(err)
+      });
+    }
+  }));
+
+  const ticketsById = {};
+  for (const queue of queues) {
+    for (const ticket of queue.tickets || []) {
+      const key = String(ticket.ticketId || '');
+      if (!key || ticketsById[key]) {
+        continue;
+      }
+      ticketsById[key] = {
+        ...ticket,
+        queueAccountId: queue.accountId,
+        baseUrl: queue.baseUrl
+      };
+    }
+  }
+
+  const value = {
+    fetchedAt: new Date(nowMs).toISOString(),
+    refreshMs: SUPPORT_TICKET_DASHBOARD_REFRESH_MS,
+    queueCount: queues.length,
+    totalCount: queues.reduce((sum, queue) => sum + Number(queue.totalCount || 0), 0),
+    tickets: Object.values(ticketsById).slice(0, Math.min(Math.max(parsePositiveInt(SUPPORT_TICKET_DASHBOARD_LIMIT, 20), 1), 100)),
+    queues,
+    errors
+  };
+  supportTicketSnapshotCache = {
+    fetchedAtMs: nowMs,
+    value
+  };
+  return value;
+}
+
+async function collectDashboardSnapshot() {
   const accountRepoIndex = readAccountRepoIndex();
   const repoEntries = listAccountRepoEntries(accountRepoIndex)
     .sort((a, b) => String(a.name || '').localeCompare(String(b.name || '')))
@@ -4451,6 +4863,7 @@ function collectDashboardSnapshot() {
     globalFiles,
     repos: repoEntries,
     platformRepo,
+    supportTickets: await collectSupportTicketSnapshot(),
     issues,
     lastAction: runtimeState.lastAction
   };
@@ -4506,6 +4919,9 @@ function renderDashboardHtml(snapshot) {
           '<div id="last-action" class="empty">No dashboard actions have been triggered yet.</div>' +
         '</section>' +
       '</div>' +
+      '<div class="section-grid">' +
+        '<section class="panel"><h2>Support Tickets</h2><div id="support-ticket-section" class="accordion"></div></section>' +
+      '</div>' +
       '<div class="section-grid">' +
         '<section class="panel"><h2>Issues & Escalation</h2><div id="issues-section" class="accordion"></div></section>' +
       '</div>' +
@@ -4536,9 +4952,10 @@ function renderDashboardHtml(snapshot) {
         'function summaryItem(key,value){return \'<div class="summary-item"><span class="k">\'+escapeHtml(key)+\'</span><span class="v">\'+escapeHtml(value)+\'</span></div>\';}' +
         'function codeBlock(key,content,extraClass){return \'<pre class="code-block \'+(extraClass||"")+\'" data-scroll-key="\'+escapeHtml(key)+\'">\'+escapeHtml(content||"[missing]")+\'</pre>\';}' +
         'function detailsBlock(key,title,meta,bodyHtml,openByDefault){return \'<details class="item" data-key="\'+escapeHtml(key)+\'"\'+(openByDefault?" open":"")+\'><summary><div class="summary-main"><div class="summary-text"><span class="summary-title">\'+escapeHtml(title)+\'</span><span class="summary-meta">\'+meta+\'</span></div></div><span class="summary-caret">›</span></summary><div class="item-body">\'+bodyHtml+\'</div></details>\';}' +
-        'function renderStatusCards(state){const wsValues=Object.values((state.websocket&&state.websocket.connections)||{});const connectedCount=wsValues.filter(function(entry){return entry.status==="connected";}).length;const warnCount=wsValues.filter(function(entry){return entry.status==="connecting";}).length;const errorCount=wsValues.filter(function(entry){return entry.status==="error"||entry.status==="disconnected";}).length;const repoCount=(state.repos||[]).length;const issueCount=(state.issues||[]).length;const criticalIssueCount=(state.issues||[]).filter(function(issue){return issue.severity==="bad";}).length;const tmuxHealthy=state.tmux&&state.tmux.available&&state.tmux.sessionExists;const cards=[' +
+        'function renderStatusCards(state){const wsValues=Object.values((state.websocket&&state.websocket.connections)||{});const connectedCount=wsValues.filter(function(entry){return entry.status==="connected";}).length;const warnCount=wsValues.filter(function(entry){return entry.status==="connecting";}).length;const errorCount=wsValues.filter(function(entry){return entry.status==="error"||entry.status==="disconnected";}).length;const repoCount=(state.repos||[]).length;const issueCount=(state.issues||[]).length;const criticalIssueCount=(state.issues||[]).filter(function(issue){return issue.severity==="bad";}).length;const ticketState=state.supportTickets||{};const ticketErrors=(ticketState.errors||[]).length;const ticketTotal=ticketState.totalCount||0;const tmuxHealthy=state.tmux&&state.tmux.available&&state.tmux.sessionExists;const cards=[' +
           '{title:"Service",value:state.service&&state.service.running?"Running":"Stopped",label:"Daemon status",tone:statusTone(state.service&&state.service.running),sub:(state.service&&state.service.dashboardUrl?state.service.dashboardUrl:"No dashboard URL yet")},' +
           '{title:"Websockets",value:String(connectedCount)+"/"+String(wsValues.length||0),label:"Connected topics groups",tone:errorCount? "bad" : (warnCount? "warn" : "ok"),sub: errorCount? String(errorCount)+" unhealthy connection(s)" : (warnCount? String(warnCount)+" connecting" : "All connections healthy")},' +
+          '{title:"Tickets",value:String(ticketTotal),label:"Open support queue",tone:ticketErrors?"warn":"ok",sub:ticketErrors?String(ticketErrors)+" queue fetch error(s)":"Fetched "+String(ticketState.queueCount||0)+" queue(s)"},' +
           '{title:"Tmux",value:tmuxHealthy?"Ready":"Attention",label:"Dispatch workspace",tone:tmuxHealthy?"ok":(state.tmux&&state.tmux.available?"warn":"bad"),sub:state.tmux&&state.tmux.available?(state.tmux.sessionExists?String((state.tmux.livePanes||[]).length)+" live pane(s)":"tmux installed, session missing"):"tmux not installed"},' +
           '{title:"Issues",value:String(issueCount),label:"Detected escalation signals",tone:criticalIssueCount?"bad":(issueCount?"warn":"ok"),sub:issueCount?(criticalIssueCount?String(criticalIssueCount)+" critical signal(s)":"Review before continuing"):"No issue signals detected"},' +
           '{title:"Repos",value:String(repoCount),label:"Indexed account repos",tone:repoCount?"ok":"warn",sub:"Last scan: "+formatTime(state.discovery&&state.discovery.scannedAt)}' +
@@ -4549,15 +4966,18 @@ function renderDashboardHtml(snapshot) {
           'summaryItem("Repo Matches",String(state.discovery&&state.discovery.matches||0)),' +
           'summaryItem("Connections",String(ws.length)),' +
           'summaryItem("Topics",String(topics)),' +
+          'summaryItem("Open Tickets",String(state.supportTickets&&state.supportTickets.totalCount||0)),' +
           'summaryItem("Tracked Panes",String(tracked))' +
         '].join("");}' +
         'function renderLastAction(state){const target=document.getElementById("last-action");if(!state.lastAction){target.className="empty";target.textContent="No dashboard actions have been triggered yet.";return;}target.className="summary-item";target.innerHTML=\'<span class="k">Last Action</span><span class="v">\'+escapeHtml(state.lastAction.action||"unknown")+\'</span><div class="muted" style="margin-top:8px;">\'+escapeHtml(formatTime(state.lastAction.at))+\'</div>\'+(state.lastAction.bundlePath?\'<div class="muted" style="margin-top:8px;word-break:break-word;"><strong>Bundle:</strong> \'+escapeHtml(state.lastAction.bundlePath)+\'</div>\':"");}' +
         'function renderIssues(state){const target=document.getElementById("issues-section");const issues=state.issues||[];if(!issues.length){target.innerHTML=\'<div class="empty">No automatic issue signals are currently detected. If something still feels wrong, you can still click "Export Issue Bundle" to prepare a package for a Remits system admin.</div>\';return;}target.innerHTML=issues.map(function(issue,index){const tone=issue.severity==="bad"?"bad":"warn";const meta=badge(issue.severity==="bad"?"critical":"warning",tone)+\' <span class="muted">\'+escapeHtml(issue.scope+(issue.repoAccountId?(" account "+issue.repoAccountId):""))+\'</span>\';const evidence=(issue.evidence||[]).map(function(line){return "<li>"+escapeHtml(line)+"</li>";}).join("");const body=\'<div class="stack"><div class="muted">\'+escapeHtml(issue.summary||"")+\'</div><div class="mini-card"><strong>Recommendation</strong>\'+escapeHtml(issue.recommendation||"") + \'</div><div><strong style="display:block;margin-bottom:8px;">Evidence</strong><ul style="margin:0;padding-left:18px;display:grid;gap:8px;">\'+(evidence||"<li>No evidence lines captured.</li>")+\'</ul></div></div>\';return detailsBlock("issue:"+issue.id,(index+1)+". "+issue.title,meta,body,index===0);}).join("");}' +
+        'function renderSupportTickets(state){const target=document.getElementById("support-ticket-section");const support=state.supportTickets||{};const tickets=support.tickets||[];const queues=support.queues||[];const errors=support.errors||[];let html=\'<div class="mini-grid"><div class="mini-card"><strong>Total Open</strong>\'+escapeHtml(String(support.totalCount||0))+\'</div><div class="mini-card"><strong>Queues</strong>\'+escapeHtml(String(support.queueCount||0))+\'</div><div class="mini-card"><strong>Fetched</strong>\'+escapeHtml(formatTime(support.fetchedAt))+\'</div></div>\';if(errors.length){html+=detailsBlock("support:errors","Queue fetch errors",badge(String(errors.length)+" error(s)","warn"),codeBlock("support-errors",JSON.stringify(errors,null,2),"log"),false);}if(!queues.length&&!errors.length){target.innerHTML=html+\'<div class="empty">No authenticated support-ticket queue is available yet.</div>\';return;}const recs=queues.map(function(queue){return queue.recommendedTicket?Object.assign({queueAccountId:queue.accountId,baseUrl:queue.baseUrl},queue.recommendedTicket):null;}).filter(Boolean);if(recs.length){const recBody=recs.map(function(ticket,index){return supportTicketDetails(ticket,"support-rec:"+index);}).join("");html+=detailsBlock("support:recommended","Recommended next tickets",badge(String(recs.length)+" queue(s)","ok"),recBody,true);}if(tickets.length){html+=tickets.map(function(ticket,index){const meta=badge(ticket.priority||"priority","warn")+\' \'+badge(ticket.status||"status",ticket.status==="open"?"ok":"warn")+\' <span class="muted">\'+escapeHtml(ticket.accountName||ticket.accountId||"unknown account")+\'</span>\';return detailsBlock("support-ticket:"+ticket.ticketId,String(ticket.ticketId||"ticket")+" "+(ticket.subject||""),meta,supportTicketDetails(ticket,"support-ticket:"+index),index===0&&!recs.length);}).join("");}else{html+=\'<div class="empty">No open support tickets were returned by the current queues.</div>\';}target.innerHTML=html;}' +
+        'function supportTicketDetails(ticket,key){const command="remits-cli tool --name mcp_support_ticket --input "+JSON.stringify(JSON.stringify({action:"read",ticketId:String(ticket.ticketId||"")}))+" --data-mode prod";return \'<div class="stack"><div class="mini-grid"><div class="mini-card"><strong>Ticket</strong>\'+escapeHtml(ticket.ticketId||"n/a")+\'</div><div class="mini-card"><strong>Account</strong>\'+escapeHtml((ticket.accountName||"n/a")+" ("+(ticket.accountId||"n/a")+")")+\'</div><div class="mini-card"><strong>Type</strong>\'+escapeHtml(ticket.type||"n/a")+\'</div><div class="mini-card"><strong>Assigned</strong>\'+escapeHtml(ticket.assignedTo||"unassigned")+\'</div><div class="mini-card"><strong>Implementation</strong>\'+escapeHtml((ticket.implementationAccountName||"n/a")+" ("+(ticket.implementationAccountId||"n/a")+")")+\'</div><div class="mini-card"><strong>Activity</strong>\'+escapeHtml(ticket.activityLabel||formatTime(ticket.activityAt||ticket.updatedAt))+\'</div></div><div class="muted">\'+escapeHtml(ticket.affectedComponent||"No affected component recorded.")+\'</div>\'+codeBlock(key+":cmd",command)+\'</div>\';}' +
         'function renderWebsockets(state){const entries=Object.entries((state.websocket&&state.websocket.connections)||{});const target=document.getElementById("websocket-section");if(!entries.length){target.innerHTML=\'<div class="empty">No websocket connections are registered yet.</div>\';return;}target.innerHTML=entries.map(function(pair){const baseUrl=pair[0];const info=pair[1]||{};const topicEntries=Object.entries(info.topics||{});const recentMessages=Array.isArray(info.recentMessages)?info.recentMessages:[];const tone=info.status==="connected"?"ok":(info.status==="connecting"?"warn":"bad");const summaryMeta=badge(info.status||"unknown",tone)+\' <span class="muted">\' + escapeHtml(String(topicEntries.length)) + \' topic(s)</span>\' + \' <span class="muted">\' + escapeHtml(String(recentMessages.length)) + \' recent message(s)</span>\';const topicBody=topicEntries.length?topicEntries.map(function(topicPair){const topic=topicPair[0];const topicInfo=topicPair[1]||{};const mini=\'<div class="mini-grid"><div class="mini-card"><strong>Accounts</strong>\'+escapeHtml((topicInfo.accountIds||[]).join(", ")||"n/a")+\'</div><div class="mini-card"><strong>Subscribed</strong>\'+escapeHtml(formatTime(topicInfo.subscribedAt))+\'</div><div class="mini-card"><strong>Last Message</strong>\'+escapeHtml(formatTime(topicInfo.lastMessageAt))+\'</div></div>\';return detailsBlock("ws-topic:"+baseUrl+":"+topic,topic,"topic subscription",mini,false);}).join(""):\'<div class="empty">No topic subscriptions recorded.</div>\';const messageBody=recentMessages.length?recentMessages.map(function(message,index){const messageMeta=badge(message.duplicate?"duplicate":"handled",message.duplicate?"warn":"ok")+\' <span class="muted">\'+escapeHtml(message.source||"live")+\'</span>\' + \' <span class="muted">\'+escapeHtml(message.type||"unknown-type")+\'</span>\';const body=\'<div class="stack"><div class="mini-grid"><div class="mini-card"><strong>Message ID</strong>\'+escapeHtml(message.messageId||"n/a")+\'</div><div class="mini-card"><strong>Timestamp</strong>\'+escapeHtml(message.timestamp?String(message.timestamp):"n/a")+\'</div><div class="mini-card"><strong>Received</strong>\'+escapeHtml(formatTime(message.receivedAt))+\'</div><div class="mini-card"><strong>Accounts</strong>\'+escapeHtml((message.accountIds||[]).join(", ")||"n/a")+\'</div></div>\'+codeBlock("ws-msg:"+baseUrl+":"+(message.messageId||index),JSON.stringify(message.payload||{},null,2)) + \'</div>\';return detailsBlock("ws-message:"+baseUrl+":"+(message.messageId||index),(message.type||"message")+" "+(message.messageId||""),messageMeta,body,false);}).join(""):\'<div class="empty">No recent websocket messages have been recorded yet.</div>\';const body=\'<div class="stack"><div class="mini-grid"><div class="mini-card"><strong>Status</strong>\'+escapeHtml(info.status||"unknown")+\'</div><div class="mini-card"><strong>Connected</strong>\'+escapeHtml(formatTime(info.connectedAt))+\'</div><div class="mini-card"><strong>Last Message</strong>\'+escapeHtml(formatTime(info.lastMessageAt))+\'</div><div class="mini-card"><strong>Last Error</strong>\'+escapeHtml(info.lastError||"none")+\'</div></div><div class="stack">\'+detailsBlock("ws-recent:"+baseUrl,"Recent messages","latest live and missed-message traffic",messageBody,false)+topicBody+\'</div></div>\';return detailsBlock("ws:"+baseUrl,baseUrl,summaryMeta,body,entries.length===1);}).join("");}' +
         'function renderTmux(state){const target=document.getElementById("tmux-section");const panes=state.tmux&&state.tmux.livePanes||[];const trackedText=state.tmux&&state.tmux.trackedPanes?state.tmux.trackedPanes:"{}";const launchSupported=state.tmux&&state.tmux.terminalLaunchSupported;const attachCommand="tmux attach -t "+(state.tmux&&state.tmux.sessionName||"remits-listener");const health=\'<div class="mini-grid"><div class="mini-card"><strong>tmux Installed</strong>\'+escapeHtml(String(state.tmux&&state.tmux.available))+\'</div><div class="mini-card"><strong>Session Exists</strong>\'+escapeHtml(String(state.tmux&&state.tmux.sessionExists))+\'</div><div class="mini-card"><strong>Session Name</strong>\'+escapeHtml(state.tmux&&state.tmux.sessionName||"n/a")+\'</div><div class="mini-card"><strong>Live Panes</strong>\'+escapeHtml(String(panes.length))+\'</div><div class="mini-card"><strong>Open from Dashboard</strong>\'+escapeHtml(launchSupported?"supported":"not supported")+\'</div></div><div class="muted" style="margin-bottom:14px;">\'+escapeHtml(launchSupported?"Use the Open Tmux Terminal button to bring Terminal forward and attach automatically.":"Dashboard-to-terminal launch is not supported on this platform. Run the attach command manually.")+\'</div>\';const quickAttach=detailsBlock("tmux:attach","Quick attach command","manual fallback",codeBlock("tmux-attach-cmd",attachCommand),false);const paneSection=detailsBlock("tmux:panes","Live panes",escapeHtml(String(panes.length))+" pane(s)",codeBlock("tmux-live-panes",JSON.stringify(panes,null,2),"log"),false);const trackedSection=detailsBlock("tmux:tracked","Tracked pane routing","ticket/task to pane mapping",codeBlock("tmux-tracked",trackedText),false);const logFile=(state.globalFiles||[]).find(function(file){return file.label==="tmux-activity.log (tail)";});const logSection=detailsBlock("tmux:activity","Activity tail","stream of tmux and websocket events",codeBlock("tmux-log",logFile&&logFile.content||"[missing]","log"),true);target.innerHTML=health+quickAttach+paneSection+trackedSection+logSection;const openButton=document.querySelector(\'[data-action="open-tmux"]\');if(openButton){openButton.disabled=!launchSupported||!(state.tmux&&state.tmux.available);}}' +
         'function renderGlobalFiles(state){const target=document.getElementById("global-files");const files=(state.globalFiles||[]).filter(function(file){return file.label!=="tmux-activity.log (tail)";});if(!files.length){target.innerHTML=\'<div class="empty">No global files found.</div>\';return;}target.innerHTML=files.map(function(file){const tone=file.exists?"ok":"warn";const meta=badge(file.exists?"present":"missing",tone)+\' <span class="muted">\'+escapeHtml(file.updatedAt?formatTime(file.updatedAt):"not found")+\'</span>\';const body=\'<div class="stack"><div class="mini-grid"><div class="mini-card"><strong>Path</strong>\'+escapeHtml(file.path||"")+\'</div><div class="mini-card"><strong>Size</strong>\'+escapeHtml(String(file.size||0))+\' bytes</div><div class="mini-card"><strong>Updated</strong>\'+escapeHtml(formatTime(file.updatedAt))+\'</div></div>\'+codeBlock("global:"+file.label,file.content)+(file.label==="service-state.json"?\'<div class="muted">Use this file to discover the dashboard URL and runtime websocket summary.</div>\':"")+\'</div>\';return detailsBlock("global:"+file.label,file.label,meta,body,false);}).join("");}' +
         'function renderRepos(state){const target=document.getElementById("repo-section");const repos=state.repos||[];if(!repos.length){target.innerHTML=\'<div class="empty">No indexed account repos were found. Use "Rescan Account Repos" to rebuild the index.</div>\';return;}target.innerHTML=repos.map(function(repo){const tone=repo.exists?"ok":"warn";const meta=badge(repo.exists?"available":"missing",tone)+\' <span class="muted">type: \'+escapeHtml(repo.type||"n/a")+\'</span>\';const files=(repo.files||[]).map(function(file){const fileMeta=badge(file.exists?"present":"missing",file.exists?"ok":"warn")+\' <span class="muted">\'+escapeHtml(file.updatedAt?formatTime(file.updatedAt):"not found")+\'</span>\';const body=\'<div class="stack"><div class="mini-grid"><div class="mini-card"><strong>Path</strong>\'+escapeHtml(file.path||"")+\'</div><div class="mini-card"><strong>Size</strong>\'+escapeHtml(String(file.size||0))+\' bytes</div><div class="mini-card"><strong>Updated</strong>\'+escapeHtml(formatTime(file.updatedAt))+\'</div></div>\'+codeBlock("repo:"+repo.accountId+":"+file.label,file.content,file.label.indexOf("session log")>=0?"log":"")+\'</div>\';return detailsBlock("repo-file:"+repo.accountId+":"+file.label,file.label,fileMeta,body,false);}).join("");const body=\'<div class="stack"><div class="mini-grid"><div class="mini-card"><strong>Directory</strong>\'+escapeHtml(repo.directory||"")+\'</div><div class="mini-card"><strong>Source</strong>\'+escapeHtml(repo.source||"n/a")+\'</div><div class="mini-card"><strong>Platform Account</strong>\'+escapeHtml(String(repo.platformAccountId||"n/a"))+\'</div></div><div class="repo-files">\'+files+\'</div></div>\';return detailsBlock("repo:"+repo.accountId,(repo.name||"Unknown")+" ("+repo.accountId+")",meta,body,false);}).join("");}' +
-        'function renderAll(state){const detailState=saveDetailsState();const scrollState=saveScrollState();dashboardState=state;document.getElementById("generated-at").textContent=formatTime(state.generatedAt);renderStatusCards(state);renderSummary(state);renderLastAction(state);renderIssues(state);renderWebsockets(state);renderTmux(state);renderGlobalFiles(state);renderRepos(state);restoreDetailsState(detailState);restoreScrollState(scrollState);}' +
+        'function renderAll(state){const detailState=saveDetailsState();const scrollState=saveScrollState();dashboardState=state;document.getElementById("generated-at").textContent=formatTime(state.generatedAt);renderStatusCards(state);renderSummary(state);renderLastAction(state);renderSupportTickets(state);renderIssues(state);renderWebsockets(state);renderTmux(state);renderGlobalFiles(state);renderRepos(state);restoreDetailsState(detailState);restoreScrollState(scrollState);}' +
         'async function fetchState(){const res=await fetch("/api/state",{cache:"no-store"});if(!res.ok)throw new Error("State refresh failed with "+res.status);return res.json();}' +
         'function showToast(message){const toast=document.getElementById("toast");toast.textContent=message;toast.classList.add("show");clearTimeout(showToast._timer);showToast._timer=setTimeout(function(){toast.classList.remove("show");},2400);}' +
         'async function triggerAction(action,button){if(actionInFlight)return;actionInFlight=true;button.disabled=true;try{const res=await fetch("/action",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","Accept":"application/json"},body:"action="+encodeURIComponent(action)});if(!res.ok)throw new Error("Action failed with "+res.status);const payload=await res.json();renderAll(payload.state);if(payload.result&&payload.result.bundlePath){showToast("Issue bundle prepared at "+payload.result.bundlePath);}else{showToast(action.replace(/-/g," ")+" complete");}}catch(err){showToast(err.message||String(err));}finally{actionInFlight=false;button.disabled=false;}}' +
@@ -4616,9 +5036,10 @@ function startDashboardServer(preferredPort) {
       const requestUrl = new URL(req.url, 'http://' + DASHBOARD_HOST + ':' + (runtimeState.service.dashboardPort || preferredPort));
       if (req.method === 'GET' && requestUrl.pathname === '/api/state') {
         try {
+          const snapshot = await collectDashboardSnapshot();
           res.statusCode = 200;
           res.setHeader('Content-Type', 'application/json');
-          res.end(JSON.stringify(collectDashboardSnapshot(), null, 2));
+          res.end(JSON.stringify(snapshot, null, 2));
         } catch (err) {
           sendDashboardError(res, err, true);
         }
@@ -4641,11 +5062,13 @@ function startDashboardServer(preferredPort) {
               at: new Date().toISOString()
             };
             if (action === 'export-issues') {
-              const bundlePath = exportIssueBundle(collectDashboardSnapshot());
+              const bundlePath = exportIssueBundle(await collectDashboardSnapshot());
               actionResult = { bundlePath };
               runtimeState.lastAction.bundlePath = bundlePath;
             } else if (action === 'rescan-repos') {
               recordDiscoverySummary(discoverAccountRepos());
+              supportTicketSnapshotCache = { fetchedAtMs: 0, value: null };
+              await bestEffortRegisterCliListeners({ reason: 'dashboard.rescan' });
             } else if (action === 'open-tmux') {
               openTmuxSessionForUser();
             } else if (action === 'start-tmux') {
@@ -4662,7 +5085,7 @@ function startDashboardServer(preferredPort) {
                 success: true,
                 action,
                 result: actionResult,
-                state: collectDashboardSnapshot()
+                state: await collectDashboardSnapshot()
               }));
               return;
             }
@@ -4678,9 +5101,10 @@ function startDashboardServer(preferredPort) {
 
       if (req.method === 'GET' && requestUrl.pathname === '/') {
         try {
+          const snapshot = await collectDashboardSnapshot();
           res.statusCode = 200;
           res.setHeader('Content-Type', 'text/html; charset=utf-8');
-          res.end(renderDashboardHtml(collectDashboardSnapshot()));
+          res.end(renderDashboardHtml(snapshot));
         } catch (err) {
           sendDashboardError(res, err, false);
         }
@@ -5209,14 +5633,15 @@ function processInboundWebsocketMessage(client, baseUrl, topic, accountIds, user
       const acctId = payload.accountId || accountIds[0];
       console.log('[ws][TestSuite][account:' + acctId + ']', JSON.stringify(payload));
     }
-  } else if (data.type === 'remits-cli') {
+  } else if (data.type === 'remits-cli' || data.type === 'cli_listener' || data.type === 'listener') {
     const payload = data.payload || data;
     const dispatchAccountId = resolveDispatchAccountId(payload, accountIds[0]);
-    console.log('[ws][remits-cli][account:' + dispatchAccountId + ']', JSON.stringify(payload));
-    appendGlobalActivityLog('tmux', 'dispatch.received', {
+    console.log('[ws][listener][account:' + dispatchAccountId + ']', JSON.stringify(payload));
+    appendGlobalActivityLog('tmux', 'listener_delivery.received', {
       baseUrl,
       topic,
       accountId: dispatchAccountId,
+      messageType: data.type,
       source,
       messageId,
       message: summarizeDispatchMessage(payload)
@@ -5618,6 +6043,8 @@ async function listenCommand(flags) {
   recordDiscoverySummary(discoverAccountRepos());
   const dashboardPort = Number(flags.port || flags.dashboardPort || DEFAULT_DASHBOARD_PORT);
   await startDashboardServer(dashboardPort);
+  await bestEffortRegisterCliListeners({ reason: 'listener.start' });
+  let lastListenerRegistrationAt = Date.now();
 
   // Create the tmux session immediately so the user can attach right away
   try {
@@ -5705,6 +6132,11 @@ async function listenCommand(flags) {
         activeSessionSignature = currentSignature;
       }
 
+      if (Date.now() - lastListenerRegistrationAt >= LISTENER_REGISTRATION_INTERVAL_MS) {
+        await bestEffortRegisterCliListeners({ reason: 'listener.heartbeat' });
+        lastListenerRegistrationAt = Date.now();
+      }
+
       await runManagedWebsocketWatchdog();
       updateRuntimeServiceState();
     } catch (err) {
@@ -5977,6 +6409,8 @@ function printComponentsHelp(subcommand) {
     console.log('');
     console.log('Agent safety gates (each exits non-zero instead of printing a wall of JSON):');
     console.log('  --changed-only            dry-run first; fail unless every planned write is a component this checkout changed');
+    console.log('  --changed-since <ref>     pair with --changed-only after committing: the changed set becomes');
+    console.log('                            the components touched between <ref> and HEAD, plus uncommitted edits');
     console.log('  --names-only              dry-run first; print only "type id name" lines and write nothing');
     console.log('  --fail-on-removed         dry-run first; fail if the plan removes/tombstones anything');
     console.log('  --fail-on-errors          dry-run first; fail if the server reported any per-component sync error');
@@ -6037,7 +6471,7 @@ function printComponentsHelp(subcommand) {
 }
 
 function printTestHelp() {
-  console.log('Usage: remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names name1,name2] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none]');
+  console.log('Usage: remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none]');
   console.log('');
   console.log('Runs a Test component against the staged/variant world for this checkout.');
   console.log('Examples:');
@@ -6045,7 +6479,8 @@ function printTestHelp() {
   console.log('  remits-cli test run --test "Merchant Statements" --names "managed account case"');
   console.log('');
   console.log('Notes:');
-  console.log('  --names is comma-delimited, so avoid commas in individual test case names.');
+  console.log('  --names is delimited by "|" (comma also works when no "|" is present), and may be repeated.');
+  console.log('    A selector that matches no case fails the run rather than reporting 0 passed / 0 failed.');
   console.log('  --as-account changes the execution account so subscriber branch edges apply.');
   console.log('  --variant-branch <name> probes a committed variant branch; use "none" or "trunk"');
   console.log('       to force production/subscription semantics from a variant checkout.');
@@ -6095,6 +6530,9 @@ async function main() {
 
   // Best-effort: update account-repo index whenever running from inside a remits repo
   try { updateAccountRepoIndex(process.cwd()); } catch (_) { /* not in account repo */ }
+  if (!wantsJson) {
+    try { await bestEffortRegisterCliListeners({ cwd: process.cwd(), reason: 'command' }); } catch (_) { /* best-effort */ }
+  }
 
   // Auto-start the background service if not already running.
   // Skip for lifecycle subcommands and help.
@@ -6146,7 +6584,7 @@ async function main() {
     console.log('  remits-cli components branch <name> --subscribe <accountId> [--dry-run] [--confirm-primary-edge]');
     console.log('  remits-cli components branch <name> --unsubscribe <accountId>    # return that account to trunk');
     console.log('  remits-cli components branch <name> --retire [--force]           # delete the branch\'s overlays');
-    console.log('  remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names name1,name2] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME]');
+    console.log('  remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME]');
     console.log('  remits-cli token [--base-url URL] [--branch BRANCH] [--path embeddable/path] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none]');
     console.log('  remits-cli token inspect --token <token|tokenKey|URL> [--base-url URL] [--account-id ID]');
     console.log('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.104",
+  "version": "0.1.107",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,

package/skills/remits-cli/SKILL.md

@@ -339,6 +339,14 @@ file is catastrophic.
 - Local branch is committed and pushed; sync will read the intended remote commit.
 - Local filenames and live inventory (`mcp_account_view`) **agree on id and name for every component**: no live
   component appears locally under a different id, and no expected component is missing a repo file.
+  > **Do not run this comparison against `account-info.json` alone — it will report false orphans.** That
+  > file omits `auxiliary: true` components by design, so every auxiliary component looks like a repo file
+  > with no DB row, i.e. exactly the "a trunk sync will CREATE a duplicate" signal this check exists to
+  > catch. It also omits README- and AGENT-purpose Prompts, which live at the repo root and as `.md`
+  > sidecars in `components/agents/` rather than in `components/prompts/`, so they look like DB rows with
+  > no repo file — the "will be DELETED" signal. Both are benign. Before treating a flagged component as
+  > drift, confirm against the live row: `mcp_component_view`, or
+  > `mcp_run_action controlAction:"describe"` for an Action. A component that answers is not an orphan.
 - You can state the expected create/update/delete set. **If any delete or renumber is unexpected, stop.**
 
 ### If something looks wrong — stop, don't paper over
@@ -895,7 +903,16 @@ Tests run on the platform against your staged snapshot. They stream results in r
 
 Important test-runner constraints:
 - `remits-cli test run` now defaults to `test` dataMode unless you explicitly pass `--data-mode prod`.
-- Do not put commas in individual `test("...")` names. The CLI `--names` filter is comma-delimited, so comma-bearing test names cannot be targeted cleanly as a single selected case.
+- **`--names` is delimited by `|`, and may be repeated.** A comma still splits a single `--names` value
+  (legacy behaviour), which is why a case name containing a comma used to be cut in half and match
+  nothing. Prefer `|` or repetition whenever a name might contain punctuation:
+  ```bash
+  remits-cli test run --test 13 --names "a case, with a comma|another case"
+  remits-cli test run --test 13 --names "a case, with a comma" --names "another case"
+  ```
+- **A selector that matches no case FAILS the run.** It used to report `0 passed, 0 failed`,
+  `completed`, and exit 0 — indistinguishable from a suite where everything passed. The run now names
+  the unmatched selectors and lists the cases the suite actually declared, and exits non-zero.
 
 If no relevant Test component exists yet, consider creating one. Test components live in `components/tests/` and follow the same component structure. They provide permanent regression protection — every test you write today saves debugging time tomorrow.
 
@@ -1617,6 +1634,15 @@ a confirm-gated override when the removal guard refuses. Preview there is the sa
 - A test/tool response reports `testComponentSource` as `staged` | `variant` | `db`, so you can see which
   layer the run resolved without reading logs.
 
+> **A populated staging cache makes a variant look broken.** Anything carrying a CLI `TestMode` — a
+> `remits-cli token` URL, `/s/<tokenKey>/...`, an `X-Auth-Token` request, a script-loader embed — resolves
+> the STAGED layer, which outranks the variant. So with components staged under the same branch/user, a
+> tokenized page reports `Component Branch: <branch>` but `Variant Applied: none` and renders trunk, while
+> an anonymous `?account_id=` request to the same page reports the variant. That is the documented
+> precedence (staged -> variant -> trunk) working correctly, and it reads exactly like "tokens break
+> variant resolution". **Run `remits-cli components clear --all` before verifying variant resolution
+> through any tokenized entry point**, or check `remits-cli components status` first.
+
 ## Production Support Workflow
 
 Switch to prod mode for investigations:
@@ -2804,7 +2830,7 @@ remits-cli data-mode [set test|prod]
 remits-cli components stage [--branch <name>] [--data-mode test|prod] [--json|--verbose]
 remits-cli components status [--branch <name>] [--component-type <type>] [--component-id <id>] [--json|--verbose]
 remits-cli components clear [--branch <name>] [--component-type <type>] [--component-id <id>] [--all] [--json|--verbose]   # id alone scopes to one component when unambiguous (ids are type-local; add --component-type if the same id is staged in multiple families); no filter clears the whole branch scope; --all forces the full wipe
-remits-cli components sync [--branch <name>] [--data-mode test|prod] [--force-tombstones] [--dry-run] [--summary]   # gated; on trunk = full repo->DB reconcile, on a variant branch = ComponentVariant overlays only
+remits-cli components sync [--branch <name>] [--data-mode test|prod] [--force-tombstones] [--dry-run] [--summary] [--changed-only [--changed-since <ref>]]   # gated; on trunk = full repo->DB reconcile, on a variant branch = ComponentVariant overlays only
 remits-cli components commit [--message "msg"] [--data-mode test|prod] [--force-tombstones]
 remits-cli components branches [--json]                                # branches carrying committed variants, with counts + drift
 remits-cli components branch <name> [--json]                           # one branch: overridden / added / removed, drift flags, subscribers
@@ -2813,7 +2839,7 @@ remits-cli components branch <name> --subscribers [--json]
 remits-cli components branch <name> --subscribe <accountId> [--parent-account <id>] [--domain <host>] [--dry-run] [--confirm-primary-edge]   # make an account resolve this branch
 remits-cli components branch <name> --unsubscribe <accountId>                          # return that account to trunk
 remits-cli components branch <name> --retire [--force]                                 # delete the branch's overlays
-remits-cli test run --test <id|name> [--branch <stagingScope>] [--names "a,b"] [--watch true|false] [--data-mode test|prod] [--as-account <ID>] [--variant-branch <name|none>]
+remits-cli test run --test <id|name> [--branch <stagingScope>] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account <ID>] [--variant-branch <name|none>]
 remits-cli token [--path <embeddablePathOrId>] [--data-mode test|prod] [--as-account <ID>] [--variant-branch <name|none>]
 remits-cli token inspect --token <token|tokenKey|URL>                  # inspect token metadata, safety/dataMode evidence, and full context
 remits-cli tools [--branch <name>] [--data-mode test|prod] [--variant-branch <name|none>]
@@ -2823,7 +2849,8 @@ remits-cli tool status --call-id <callId> [--data-mode test|prod]
 
 For tests specifically:
 - If `--data-mode` is omitted, `remits-cli test run` uses `test`.
-- `--names` is comma-delimited, so keep individual test names comma-free.
+- `--names` is `|`-delimited (a comma still splits a single value) and may be repeated; an unmatched
+  selector fails the run instead of reporting zero cases as success.
 - `--as-account <ID>` runs AS a descendant subscriber so its edge selects the component branch
   (*"what does customer X get?"*); `--variant-branch <name>` probes a branch from any checkout
   (*"what does branch Y look like?"*), and `--variant-branch none` forces production/subscription semantics.
@@ -2841,10 +2868,16 @@ For tests specifically:
 - **Fail-closed sync gates.** On non-trunk variant branches these flags now force a server dry-run first,
   evaluate that plan before any overlay row is written, and only then run the mutating sync when the plan
   passes. On trunk, there is no safe dry-run plan, so do not treat these as scoped commit controls:
-  - `--changed-only` — fail unless every planned write is a component **this checkout actually edited**.
+  - `--changed-only` — fail unless every planned write is a component **this checkout actually changed**.
     This is the strongest guard against a sync that quietly rewrites components you never touched. It
     also fails when the checkout is not a git working tree, because "git could not answer" must never
     be read as "nothing changed".
+    > **Pair it with `--changed-since <ref>` after you have committed.** On its own `--changed-only`
+    > reads UNCOMMITTED edits, and the documented flow commits and pushes *before* syncing (sync reads
+    > the pushed remote, so it cannot see uncommitted work at all) — so the changed set is empty at
+    > exactly the moment the gate runs, and it refuses the whole plan. `--changed-since origin/main`
+    > (or the commit you branched from) makes the changed set the components your commits touched.
+    > The refusal message says this when it detects the empty-set case.
   - `--fail-on-removed` — fail if the plan removes or tombstones anything.
   - `--expected-removed <type:id>` — whitelist the removals you intend (repeatable, or comma-delimited,
     e.g. `--expected-removed action:5,reader:9`). It **implies** `--fail-on-removed`, so any removal you
@@ -2902,6 +2935,8 @@ For tests specifically:
 | A component vanished for one account after a variant-branch sync | Its file is missing from that branch, so the sync created a **tombstone** that hides it from subscribers. Restore the file on the branch and re-sync. Trunk is unaffected. |
 | A variant Test suite fails wholesale, asserting trunk where you expect a variant | You are almost certainly running it from a **variant checkout**: `variantBranch` outranks every subscription, so the suite's own fixture accounts resolve YOUR branch. Re-run from trunk or with `--variant-branch none` before treating it as a regression. |
 | `components sync` on a branch says "No changes detected" but trunk has moved | Re-run it; a trunk sync now invalidates the branch's cached verdict. If it still skips, the branch genuinely matches trunk - check `components branch <name>` for what is actually stored. |
+| A sync summary reports `skipped: true` with `NO COMPONENTS WERE SYNCED` | The branch head matches the cached sync SHA, so the branch was never re-read — this is NOT an empty plan. It matters when something else changed the overlays at that same SHA: an ordinary re-sync then answers "nothing to do" forever. `--dry-run` always re-reads the branch and shows the real plan; `--force-tombstones` re-reads and applies it. |
+| A branch sync stores overlays for components you never edited on the branch | **Trunk moved.** Sparseness compares the branch against CURRENT trunk, so editing a component on trunk without merging trunk into the branch turns it into a branch overlay on the next branch sync. The branch did not change. Merge trunk in, push, re-sync — the overlays prune. Check `components promotion` for the phase. |
 | After promoting a `new_*` component to trunk, the branch still shows it as `added` | You have not re-synced the branch since the trunk sync. Merge trunk into the branch and `components sync`: the file adopts the promoted id and, if unchanged, removes its own overlay. If the branch carries BOTH `new_Foo.*` and `<id>_Foo.*`, the id file wins and the `new_` one is reported `skipped: superseded` - delete it. |
 | After promoting a standalone Prompt, the branch still shows `OVERRIDDEN prompt:<id>` with only `purpose` changed | The trunk Prompt row does not match repo metadata. Ensure the Prompt sidecar has `description` and `purpose: CUSTOM`, run a platform build that imports Prompt `purpose`, re-sync trunk, merge back, and re-sync the branch. |
 | A branch preview reports a `removed` component nobody deleted | Check whether that component has a file on **trunk**. A DB row with no trunk file is missing from every branch, so it reads as a removal everywhere (and the trunk sync tries to hard-delete it each run). Repair trunk, not the branch. |