@scrylog/cli 0.2.0 → 0.3.0

package/README.md

@@ -1,6 +1,6 @@
 # scrylog
 
-`scrylog` is a Bun-based terminal dashboard and daemon for monitoring AI coding sessions in `tmux` and as standalone processes.
+`scrylog` is a Bun-based terminal dashboard and daemon for monitoring AI coding sessions in `tmux`, herdr, and as standalone processes.
 
 It ships four commands:
 
@@ -14,12 +14,14 @@ It ships four commands:
 ## Features
 
 - `tmux` monitoring for OpenCode, Codex, Copilot, and shell panes
+- herdr default-session monitoring through its structured agent and pane API
 - OpenCode integration in `hooks` or `sse` mode
 - Claude transcript collection
 - Codex transcript collection and hook-based state tracking
 - Local daemon with Unix socket IPC on macOS and Linux, TCP fallback on Windows
 - Optional TCP REST API exposure (enabled by default on Windows)
 - Optional MCP HTTP exposure with bearer token support
+- Responsive OpenTUI dashboard with Sessions and provider-usage views
 - User-service installation on macOS and Linux
 - Interactive setup wizard and diagnostics
 
@@ -27,6 +29,7 @@ It ships four commands:
 
 - [Bun](https://bun.sh) `>= 1.3.0`
 - `tmux` if you want `tmux` monitoring
+- [herdr](https://herdr.dev) if you want herdr monitoring; absence is handled automatically
 - OpenCode if you want OpenCode monitoring
 - `ps` on Unix or `wmic` on Windows for process auto-discovery
 
@@ -38,6 +41,35 @@ It ships four commands:
 | Tier 2 | Linux / WSL 2 | Compatible | Claude OAuth via `~/.claude/.credentials.json`, Chrome/Chromium cookies, systemd service when available |
 | Tier 3 | Windows (native) | Experimental / not recommended | TCP IPC, `wmic` process scan, degraded service status. Chrome cookie decryption not available (DPAPI not implemented). Primary use is ad-hoc debugging, not daily monitoring. |
 
+## Terminal Icon Rendering
+
+The Usage view renders provider icons with one of these values for `tui.providerIcons`:
+
+| Mode | Behavior |
+| --- | --- |
+| `blocks` (default) | Bundled pixel-art PNGs rendered with Unicode half-blocks on the Usage cards. Works in any terminal, including multiplexers. |
+| `graphics` | Full artwork. Probes the terminal (`XTVERSION`, kitty graphics query, Sixel support) and falls back to `blocks` when nothing is confirmed. |
+| `kitty` / `sixel` | Force a specific image protocol even when detection does not confirm it (useful for terminals whose detection response is ambiguous). |
+| `text` | Two-letter provider monogram on Usage cards. Never uses images. |
+
+In the sessions list the Tool column also depends on the mode: image modes render 2x1-cell mini icons, `blocks` shows the colored brand monogram (`CL`, `CX`, `OC`, ...) plus child-session badges, and `text` keeps the full tool name. Press `?` in the dashboard to see a legend mapping each icon or monogram to its tool name (legend shown only when an image mode is active).
+
+Compatibility of `graphics` by environment:
+
+| Environment | Works | Detail |
+| --- | --- | --- |
+| Ghostty | Yes | Kitty graphics protocol (`TERM=xterm-ghostty`) |
+| Kitty | Yes | Kitty graphics protocol (reference implementation) |
+| WezTerm | Yes | Kitty graphics and Sixel |
+| iTerm2 | Yes | Inline images and Sixel |
+| Konsole, Foot | Yes | Sixel, requires pixel-resolution detection to confirm |
+| Direct SSH (no multiplexer) | Yes | Inherits the local terminal's protocol support |
+| tmux / herdr | Forced `blocks` | The multiplexer sits between the client and the terminal; passthrough is not reliable, so rendering degrades to `blocks` |
+| Alacritty, Terminal.app, GNOME Terminal | No | No image protocol; falls back to `blocks` |
+| Windows native (Tier 3) | No | Sixel support is partial/experimental; falls back to `blocks` |
+
+Run `scrylog doctor` for a "Terminal graphics" section with detected capabilities and the recommended value for the current terminal.
+
 ## WSL 2 Notes
 
 - The daemon runs as a Linux process and uses the same paths as native Linux.
@@ -130,8 +162,11 @@ For most users on macOS or Linux:
 ```bash
 scrylog
 scrylog --config ~/.config/scrylog/config.json
+scrylog --include-unknown
 ```
 
+By default, sessions whose tool could not be identified (`tool: "unknown"`) are hidden from the dashboard and API. Launch with `--include-unknown` to request them from the daemon for the current run.
+
 Keyboard shortcuts:
 
 | Key | Action |
@@ -139,7 +174,7 @@ Keyboard shortcuts:
 | `↑` / `k` | Move selection up |
 | `↓` / `j` | Move selection down |
 | `Enter` | Open session detail |
-| `t` | Attach to selected `tmux` session |
+| `t` | Attach to selected `tmux` or herdr session |
 | `/` | Search |
 | `f` | Cycle filters |
 | `a` | Show actionable sessions only |
@@ -299,7 +334,8 @@ Example config:
     "refreshMs": 5000,
     "showStandalone": true,
     "usePushUpdates": true,
-    "standaloneMaxAgeHours": 6
+    "standaloneMaxAgeHours": 6,
+    "providerIcons": "blocks"
   },
   "mcp": {
     "stdioEnabled": true,
@@ -336,7 +372,10 @@ Notes:
 - `daemon.commandTimeoutMs` bounds daemon-owned commands such as `ps`, `tmux`, `git`, `lsof`, and `pgrep`.
 - `daemon.networkTimeoutMs` bounds daemon-owned usage/integration network requests.
 - `usage.enabled: false` disables periodic Claude/OpenCode usage probes without disabling session monitoring.
+- In the dashboard, use `Tab`, `u`, or `s` to switch between Sessions and Usage. Every usage window uses the complete card width. When provider cards exceed the terminal height, scroll with `↑`/`↓`, `j`/`k`, Page Up/Page Down, or the mouse wheel. `tui.providerIcons` accepts `blocks` (portable pixel-art PNGs, the default), `graphics` (official artwork with automatic kitty/Sixel negotiation), `kitty` or `sixel` (force a specific image protocol), or `text` (two-letter monogram); all assets are bundled for offline rendering. See [Terminal icon rendering](#terminal-icon-rendering) for environment compatibility.
 - `retention` limits in-memory state. Active `working` and `waiting-input` sessions are preserved even when old.
+- `retention` applies only to standalone sessions: tmux and herdr panes are never pruned by age or count, and `tool: "unknown"` sessions do not consume `retention.maxSessions` capacity (unknown standalone sessions are still pruned by age).
+- Native agent collectors remain authoritative for state and summaries, but matching sessions retain `source: "herdr"` and herdr attach metadata while their pane remains in a successful herdr snapshot. Tmux takes precedence for nested sessions.
 - The daemon log file is always JSONL and rotates by size: `scrylogd.log`, `scrylogd.1.log`, `scrylogd.2.log` by default.
 - The current CLI preserves an existing legacy config path when updating config, so older `~/.scrylog.json` users are not forced onto a new file immediately.
 
@@ -346,7 +385,7 @@ Notes:
 
 | Setting | Default | Effect |
 | --- | ---: | --- |
-| `retention.maxSessions` | `500` | Prunes oldest inactive sessions above this count |
+| `retention.maxSessions` | `500` | Prunes oldest inactive identified standalone sessions above this count (tmux/herdr/unknown rows never count) |
 | `retention.standaloneMaxAgeHours` | `168` | Prunes inactive standalone sessions older than 7 days |
 | `retention.cacheMaxEntries` | `1000` | Bounds internal path/project caches |
 | `retention.transcriptMaxBytes` | `10485760` | Parses only a bounded tail for very large Claude transcripts |
@@ -567,8 +606,8 @@ Endpoints:
 | Method | Path | Returns |
 | --- | --- | --- |
 | `GET` | `/api/health` | daemon health, timestamps, collector status |
-| `GET` | `/api/status` | visible counts, collector status, generated timestamp |
-| `GET` | `/api/sessions` | visible session tree plus counts |
+| `GET` | `/api/status` | visible counts, collector status, generated timestamp (`?includeUnknown=true` opts in) |
+| `GET` | `/api/sessions` | visible session tree plus counts (`?includeUnknown=true` opts in; unknown-tool rows hidden by default) |
 | `GET` | `/api/sessions/:id` | full session detail |
 | `GET` | `/api/sessions/:id/children` | visible child sessions |
 | `GET` | `/api/sessions/:id/messages` | recent messages when available |
@@ -834,7 +873,7 @@ Publish-readiness checks:
 bun run release:check
 ```
 
-Public packages are versioned with Changesets and validated through Turborepo. The release workflow creates a version PR on `main`; merging that PR publishes `@scrylog/cli` and `@scrylog/opencode-plugin` to npm.
+Public packages are versioned with Changesets and validated through Turborepo. Manually running the Release workflow in `version` mode creates a version PR on `main`; merging that PR publishes `@scrylog/cli` and `@scrylog/opencode-plugin` to npm.
 
 ## OpenSpec
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrylog/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Terminal dashboard for monitoring tmux sessions running AI coding agents",
   "license": "MIT",
   "type": "module",
@@ -31,7 +31,7 @@
     "bun": ">=1.3.0"
   },
   "bin": {
-    "scrylog": "src/tui/index.ts",
+    "scrylog": "src/cli/index.ts",
     "scrylogd": "src/daemon/index.ts",
     "scrylog-mcp": "src/mcp/index.ts",
     "scrylog-claude-hook": "src/hooks/claude.ts",
@@ -49,29 +49,32 @@
   "scripts": {
     "clean": "rm -rf .turbo && rm -rf dist",
     "clean:node-modules": "rm -rf node_modules",
-    "dev": "bun run src/tui/index.ts",
-    "dev:daemon": "bun run src/daemon/index.ts",
-    "start": "bun run src/tui/index.ts",
+    "dev": "bun run src/cli/index.ts",
+    "dev:daemon": "bun run src/daemon/index.ts --loglevel debug",
+    "start": "bun run src/cli/index.ts",
+    "postinstall": "bun src/postinstall.cjs",
     "check-types": "tsc --noEmit",
     "test": "bun test",
-    "prepublishOnly": "bun run ../../scripts/resolve-catalogs.ts",
-    "postpublish": "bun run ../../scripts/restore-catalogs.ts",
-    "pack:dry-run": "bun run ../../scripts/resolve-catalogs.ts && npm pack --dry-run && bun run ../../scripts/restore-catalogs.ts"
+    "pack:dry-run": "bash ../../scripts/npm-pack.sh \"$PWD\" \"\" --dry-run"
   },
   "dependencies": {
     "@hono/zod-openapi": "^1.3.0",
+    "@joeldmtz/prtl-core": "^0.3.0",
     "@modelcontextprotocol/sdk": "^1.0.0",
+    "@opentui/core": "0.5.11",
+    "@opentui/react": "0.5.11",
     "@opencode-ai/sdk": "1.4.10",
     "@scalar/hono-api-reference": "^0.10.11",
     "@scalar/openapi-to-markdown": "^0.5.9",
+    "commander": "15.0.0",
     "hono": "^4.12.15",
-    "neo-blessed": "^0.2.0",
+    "react": "19.2.7",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@types/blessed": "^0.1.27",
     "@types/bun": "^1.3.14",
     "@types/node": "^24.3.0",
+    "@types/react": "19.2.17",
     "typescript": "5.9.3"
   }
 }

package/src/api/docs/sessions.ts

@@ -1,5 +1,5 @@
 import type { RouteConfig } from "@hono/zod-openapi";
-import { ApiErrorSchema, SessionIdParamSchema } from "../schemas/common";
+import { ApiErrorSchema, IncludeUnknownQuerySchema, SessionIdParamSchema } from "../schemas/common";
 import {
   SessionsResponseSchema,
   SessionDetailResponseSchema,
@@ -16,6 +16,7 @@ export const SessionRoutes = {
     summary: "List sessions",
     description: "Returns the full session tree with counts.",
     security: [{ BearerAuth: [] }],
+    request: { query: IncludeUnknownQuerySchema },
     responses: {
       200: {
         content: { "application/json": { schema: SessionsResponseSchema } },
@@ -29,7 +30,7 @@ export const SessionRoutes = {
     tags: ["Sessions"],
     summary: "List session children",
     security: [{ BearerAuth: [] }],
-    request: { params: SessionIdParamSchema },
+    request: { params: SessionIdParamSchema, query: IncludeUnknownQuerySchema },
     responses: {
       200: {
         content: { "application/json": { schema: SessionChildrenResponseSchema } },

package/src/api/docs/system.ts

@@ -1,5 +1,6 @@
 import { z } from "@hono/zod-openapi";
 import type { RouteConfig } from "@hono/zod-openapi";
+import { IncludeUnknownQuerySchema } from "../schemas/common";
 import { SystemRouteKey } from "./system.keys";
 
 export const SystemRoutes = {
@@ -14,6 +15,7 @@ export const SystemRoutes = {
           "application/json": {
             schema: z.object({
               ok: z.literal(true),
+              version: z.string(),
               startedAt: z.number(),
               refreshedAt: z.number(),
               collectors: z.record(z.string(), z.unknown()),
@@ -30,6 +32,7 @@ export const SystemRoutes = {
     tags: ["System"],
     summary: "Session counts and collector status",
     security: [{ BearerAuth: [] }],
+    request: { query: IncludeUnknownQuerySchema },
     responses: {
       200: {
         content: {

package/src/api/docs/usage.ts

@@ -8,7 +8,7 @@ export const UsageRoutes = {
     method: "get",
     path: "/usage",
     tags: ["Usage"],
-    summary: "Get subscription usage limits",
+    summary: "Get subscription usage and extra-use credits",
     security: [{ BearerAuth: [] }],
     responses: {
       200: {
@@ -17,7 +17,7 @@ export const UsageRoutes = {
             schema: UsageResponseSchema,
           },
         },
-        description: "Current usage data for all configured providers",
+        description: "Current limits, extra-usage spend, and balances for configured providers",
       },
     },
   },

package/src/api/routes/sessions.ts

@@ -10,18 +10,22 @@ export function createSessionsRouter(store: DaemonStore, config: ScrylogConfig):
   const router = new OpenAPIHono();
 
   router.openapi(defineRoute(SessionRouteKey.LIST_SESSIONS), (c) => {
-    const view = buildSessionView(store.getSessions(), config);
+    const { includeUnknown } = c.req.valid("query");
+    const view = buildSessionView(store.getSessions(), config, Date.now(), { includeUnknown: includeUnknown === "true" });
     return c.json({ sessions: view.sessions, counts: view.counts, generatedAt: store.getState().refreshedAt }, 200);
   });
 
   // Must be registered before /:id to avoid the wildcard swallowing the path
   router.openapi(defineRoute(SessionRouteKey.SESSION_CHILDREN), (c) => {
     const { id } = c.req.valid("param");
+    const { includeUnknown } = c.req.valid("query");
     const parent = store.getSession(id);
     if (!parent) {
       throw new NotFoundError("Session", id);
     }
-    const children = buildSessionView(store.getSessions(), config).sessions.find((s) => s.id === id)?.children ?? [];
+    const children = buildSessionView(store.getSessions(), config, Date.now(), {
+      includeUnknown: includeUnknown === "true",
+    }).sessions.find((s) => s.id === id)?.children ?? [];
     return c.json({ sessionId: id, children }, 200);
   });
 

package/src/api/routes/system.ts

@@ -6,6 +6,7 @@ import type { Logger } from "../../shared/logger";
 import { buildSessionView } from "../../shared/session-view";
 import { SystemRouteKey } from "../docs/system.keys";
 import { defineRoute } from "../lib/route";
+import { getInstalledVersion } from "../../shared/version";
 
 export function createSystemRouter(store: DaemonStore, config: ScrylogConfig, logger: Logger): OpenAPIHono {
   const router = new OpenAPIHono();
@@ -14,6 +15,7 @@ export function createSystemRouter(store: DaemonStore, config: ScrylogConfig, lo
     const state = store.getState();
     return c.json({
       ok: true as const,
+      version: getInstalledVersion(),
       startedAt: state.startedAt,
       refreshedAt: state.refreshedAt,
       collectors: state.collectorStatus,
@@ -22,7 +24,8 @@ export function createSystemRouter(store: DaemonStore, config: ScrylogConfig, lo
 
   router.openapi(defineRoute(SystemRouteKey.STATUS), (c) => {
     const state = store.getState();
-    const view = buildSessionView(state.sessions, config);
+    const { includeUnknown } = c.req.valid("query");
+    const view = buildSessionView(state.sessions, config, Date.now(), { includeUnknown: includeUnknown === "true" });
     return c.json({
       counts: view.counts,
       collectorStatus: state.collectorStatus,

package/src/api/routes/webhooks/claude.ts

@@ -7,6 +7,7 @@ import { isMetadataOnlyEvent } from "../../services/claude-session";
 import { ValidationError } from "../../lib/errors";
 import { WebhookRouteKey } from "../../docs/webhooks.keys";
 import { defineRoute } from "../../lib/route";
+import { isKnownClaudeProbePath } from "../../../shared/session-exclusions";
 
 export function createClaudeWebhookRouter(store: DaemonStore, logger: Logger, gitCollector?: GitCollector): OpenAPIHono {
   const router = new OpenAPIHono();
@@ -44,6 +45,13 @@ export function createClaudeWebhookRouter(store: DaemonStore, logger: Logger, gi
     }
 
     const storeId = `claude:${sessionId}`;
+    if (isKnownClaudeProbePath(currentPath) || isKnownClaudeProbePath(transcriptPath)) {
+      store.markLocalCommand(sessionId);
+      store.removeSession(storeId);
+      logger.debug("webhook", "claude probe excluded", { event: "session.excluded", tool: "claude", sessionId });
+      return c.json({ ok: true as const, skipped: "claude-probe" }, 200);
+    }
+
     if (eventType === "SessionEnd") {
       store.markLocalCommand(sessionId);
       store.removeSession(storeId);

package/src/api/routes/webhooks/opencode.ts

@@ -71,6 +71,7 @@ export function createOpencodeWebhookRouter(store: DaemonStore, config: ScrylogC
           project: resolvedProject ?? existing.project,
           parentSessionId,
           lastActivity: stateChanged ? Date.now() : Math.max(existing.lastActivity, timeUpdated),
+          detectionSource: "opencode-hook",
           opencode: {
             ...existing.opencode,
             sessionId: rawId,

package/src/api/schemas/common.ts

@@ -19,3 +19,11 @@ export const SessionIdParamSchema = z.object({
     .regex(/^[a-zA-Z0-9:_\-.]+$/, "Invalid session ID")
     .openapi({ param: { name: "id", in: "path" }, example: "claude:abc-123" }),
 });
+
+export const IncludeUnknownQuerySchema = z.object({
+  includeUnknown: z.enum(["true", "false"]).optional().openapi({
+    param: { name: "includeUnknown", in: "query" },
+    example: "true",
+    description: "Include sessions whose tool could not be identified",
+  }),
+});

package/src/api/schemas/sessions.ts

@@ -17,11 +17,23 @@ const TmuxInfoSchema = z.object({
   session: z.string(),
   window: z.string(),
   pane: z.string(),
+  windowName: z.string().optional(),
+});
+
+const HerdrInfoSchema = z.object({
+  paneId: z.string(),
+  terminalId: z.string().optional(),
+  workspaceId: z.string().optional(),
+  workspace: z.string().optional(),
+  tabId: z.string().optional(),
+  tab: z.string().optional(),
+  name: z.string().optional(),
+  agent: z.string().optional(),
 });
 
 export const SessionListItemSchema = z.object({
   id: z.string(),
-  source: z.enum(["tmux", "standalone"]),
+  source: z.enum(["tmux", "herdr", "standalone"]),
   tool: SessionToolSchema,
   state: SessionStateSchema,
   summary: z.string(),
@@ -30,8 +42,10 @@ export const SessionListItemSchema = z.object({
   hasAttention: z.boolean().optional(),
   detectionSource: z.string().optional(),
   parentSessionId: z.string().optional(),
+  displayName: z.string().optional(),
   project: ProjectInfoSchema.optional(),
   tmux: TmuxInfoSchema.optional(),
+  herdr: HerdrInfoSchema.optional(),
   currentPath: z.string().optional(),
   activeTool: z.string().optional(),
   childCount: z.number().optional(),

package/src/api/schemas/usage.ts

@@ -16,6 +16,7 @@ export const ProviderCostSnapshotSchema = z.object({
   limit: z.number(),
   currency: z.string(),
   period: z.string(),
+  balance: z.number().optional(),
   resetsAt: z.string().datetime().nullable().optional(),
   updatedAt: z.string().datetime(),
 });

package/src/cli/commands.ts

@@ -9,12 +9,27 @@ import { getDaemonLogPath } from "../shared/paths";
 import { createPromptSession } from "./prompt";
 import { getServiceManagerOrThrow } from "../service/manager";
 import { createDaemonFetch, getSocketPath } from "../shared/ipc";
-import { IS_WINDOWS, whichCommand } from "../shared/platform";
+import { adviseProviderIcons, probeTerminalGraphics } from "../shared/terminal-capabilities";
+import { IS_MAC, IS_WINDOWS, whichCommand } from "../shared/platform";
+import { formatVersionDiagnostics, getInstalledVersion } from "../shared/version";
+import { listSessions } from "@joeldmtz/prtl-core";
+import type { ListSessionsOptions, PrtlListResult } from "@joeldmtz/prtl-core";
 
 export interface GlobalCliOptions {
   configPath?: string;
 }
 
+type HerdrList = (options?: ListSessionsOptions) => Promise<PrtlListResult>;
+
+export async function isHerdrAvailable(timeoutMs: number, list: HerdrList = listSessions): Promise<boolean> {
+  try {
+    const result = await list({ provider: "herdr", timeoutMs });
+    return result.metadata.providers.herdr?.available === true;
+  } catch {
+    return false;
+  }
+}
+
 export async function runDaemonCommand(action: string, options: GlobalCliOptions): Promise<void> {
   const manager = getServiceManagerOrThrow();
   if (action === "install") {
@@ -102,8 +117,32 @@ export async function runLogsCommand(_options: GlobalCliOptions): Promise<void>
   process.stdout.write(`${recent.join("\n")}\n`);
 }
 
-export async function runDoctor(options: GlobalCliOptions): Promise<void> {
-  const configPath = getResolvedConfigPath(options.configPath);
+interface ClaudeCredentialDiagnostics {
+  state: "missing" | "expired" | "valid";
+}
+
+/**
+ * Claude credential state for doctor diagnostics, derived from the running
+ * daemon's usage state. Reports only the state — never prints token material.
+ * Returns null when the daemon is unreachable (no line is printed).
+ */
+async function claudeCredentialState(daemonFetch: Awaited<ReturnType<typeof createDaemonFetch>>): Promise<ClaudeCredentialDiagnostics | null> {
+  try {
+    const usage = await daemonFetch("/api/usage") as { providers?: Array<{ provider: string; status: string; errors?: string[] }> };
+    const claude = usage.providers?.find((provider) => provider.provider === "claude");
+    if (!claude) return null;
+    if (claude.status === "ok") return { state: "valid" };
+    if (claude.status === "unavailable") {
+      const expired = (claude.errors ?? []).some((message) => message.includes("expired") || message.includes("re-login"));
+      return { state: expired ? "expired" : "missing" };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export async function runDoctor(options: GlobalCliOptions): Promise<void> {  const configPath = getResolvedConfigPath(options.configPath);
   const config = loadConfig(options.configPath);
   const daemonFetch = createDaemonFetch({
     host: config.api.host,
@@ -121,12 +160,33 @@ export async function runDoctor(options: GlobalCliOptions): Promise<void> {
   process.stdout.write(`Retention max sessions: ${config.retention.maxSessions}\n`);
   process.stdout.write(`Retention standalone max age hours: ${config.retention.standaloneMaxAgeHours}\n`);
   process.stdout.write(`Usage enabled: ${config.usage.enabled}\n`);
+  if (IS_MAC && config.usage.enabled) {
+    process.stdout.write(`Keychain prompts allowed: ${config.usage.auth.allowKeychainPrompts}\n`);
+    process.stdout.write("Keychain items the daemon may read: claude-api-oauth, Claude Code-credentials, Claude Safe Storage, per-browser Safe Storage (Chrome, Brave, Edge, Arc, Vivaldi, Chromium)\n");
+    process.stdout.write("Keychain note: macOS authorization is granted per item — you have about 90 seconds to answer each dialog; click \"Always Allow\" once per item. Successful reads are memoized for the daemon's lifetime, so each item prompts at most once per daemon run, and an unanswered dialog retries after 10 minutes. Set usage.auth.allowKeychainPrompts to false to suppress all keychain prompts.\n");
+
+    const claudeCredential = await claudeCredentialState(daemonFetch);
+    if (claudeCredential?.state === "valid") {
+      process.stdout.write("Claude credential: valid (OAuth session active)\n");
+    } else if (claudeCredential?.state === "expired") {
+      process.stdout.write("Claude credential: expired — run \"claude\" and log in to refresh, then restart the daemon\n");
+    } else if (claudeCredential?.state === "missing") {
+      process.stdout.write("Claude credential: not found — run \"claude\" and log in to enable the Claude OAuth usage source\n");
+    }
+  }
 
   try {
     const health = await daemonFetch("/api/health");
     process.stdout.write(`Local daemon reachable: ${health.ok}\n`);
+    if (health.ok) {
+      const body = await health.json().catch(() => ({})) as { version?: string };
+      process.stdout.write(formatVersionDiagnostics(getInstalledVersion(), body.version));
+    } else {
+      process.stdout.write(`CLI version: ${getInstalledVersion()}\n`);
+    }
   } catch {
     process.stdout.write("Local daemon reachable: false\n");
+    process.stdout.write(`CLI version: ${getInstalledVersion()}\n`);
   }
 
   process.stdout.write(`TCP API enabled: ${config.api.tcpEnabled}\n`);
@@ -155,6 +215,27 @@ export async function runDoctor(options: GlobalCliOptions): Promise<void> {
     process.stdout.write(`CORS origins: ${config.cors.origins.join(", ")}\n`);
   }
 
+  const graphics = await probeTerminalGraphics();
+  const advice = adviseProviderIcons(graphics);
+  process.stdout.write("\nTerminal graphics:\n");
+  if (graphics.probeFailed) {
+    const reason = graphics.probeFailedReason === "raw-unavailable"
+      ? "raw mode is unavailable in this stdin (try the interactive scrylog binary)"
+      : graphics.probeFailedReason === "no-answer"
+      ? "the terminal did not answer any probe (graphics detection is unknown)"
+      : "stdin is not an interactive TTY — attach one to test";
+    process.stdout.write(`  Probe: unavailable (${reason})\n`);
+  } else {
+    process.stdout.write(`  Terminal: ${graphics.terminalName ?? "(no XTVERSION response)"}\n`);
+    process.stdout.write(`  TERM: ${graphics.term ?? "(unset)"}\n`);
+    process.stdout.write(`  Multiplexer: ${graphics.multiplexer}\n`);
+    process.stdout.write(`  Kitty graphics: ${graphics.kittyGraphics}\n`);
+    process.stdout.write(`  Sixel: ${graphics.sixel}\n`);
+    process.stdout.write(`  Window pixel resolution: ${graphics.pixelResolution ? `${graphics.pixelResolution.width}x${graphics.pixelResolution.height}` : "(not reported)"}\n`);
+  }
+  process.stdout.write(`  providerIcons config: ${config.tui.providerIcons}\n`);
+  process.stdout.write(`  Recommended providerIcons: ${graphics.probeFailed ? `run again from an interactive terminal (${advice} is the safe default)` : advice}\n`);
+
   process.stdout.write(`MCP HTTP enabled: ${config.mcp.httpEnabled}\n`);
   if (config.mcp.httpEnabled) {
     try {
@@ -184,6 +265,7 @@ export async function runDoctor(options: GlobalCliOptions): Promise<void> {
 
   const tmux = Bun.spawnSync(["tmux", "-V"], { stdout: "pipe", stderr: "pipe" });
   process.stdout.write(`tmux available: ${tmux.exitCode === 0}\n`);
+  process.stdout.write(`herdr available: ${await isHerdrAvailable(config.daemon.commandTimeoutMs)}\n`);
 
   if (config.opencode.mode === "hooks") {
     process.stdout.write("OpenCode mode: hooks\n");

package/src/cli/index.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env bun
+import { CommanderError } from "commander";
+import { createProgram } from "./program";
+
+export async function main(argv = process.argv): Promise<void> {
+  await createProgram().parseAsync(argv);
+}
+
+if (import.meta.main) {
+  main().catch((error) => {
+    if (error instanceof CommanderError) {
+      process.exitCode = error.exitCode;
+      return;
+    }
+    process.stderr.write(`scrylog: fatal: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  });
+}