@songsid/agend 2.2.0-beta.2 → 2.2.0-beta.4

package/dist/general-knowledge/skills/credential-profiles/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: credential-profiles
-description: Run agents on more than one subscription of the same backend. Use when someone asks for a worker on a different account, wants an agent moved to another subscription, or asks which subscription an agent is using. Currently kiro-cli and codex.
+description: Run agents on more than one subscription of the same backend. Use when someone asks for a worker on a different account, wants an agent moved to another subscription, or asks which subscription an agent is using. Currently kiro-cli, codex and claude-code.
 roles: [general]
 ---
 
@@ -10,15 +10,17 @@ One AgEnD fleet normally shares one login per backend. A **credential profile**
 is a named, separate login for the same backend, so two agents can run on two
 subscriptions at once.
 
-`kiro-cli` and `codex` have profiles today. For any other backend, say so rather
-than setting an option that will be ignored.
+`kiro-cli`, `codex` and `claude-code` have profiles today. For any other backend,
+say so rather than setting an option that will be ignored.
 
 **The two behave differently when you switch, and it is not a setting.** Kiro
 keeps its conversations inside the same database as its login, so a different
 subscription is a different set of them: switching is a new conversation. Codex
 keeps its login in one file beside conversation stores that carry no account, so
-switching leaves the history where it is and both subscriptions see it. Say
-which one you are talking about.
+switching leaves the history where it is and both subscriptions see it. Claude
+Code behaves like Kiro: the profile is its whole config directory, conversations
+included, so switching is a new conversation. Say which one you are talking
+about.
 
 ## Is a profile already set up?
 
@@ -34,15 +36,44 @@ the command, do not try to work around the refusal.
 Ask the operator to run this on the host once per subscription:
 
 ```
-XDG_DATA_HOME="${AGEND_HOME:-~/.agend}/credential-profiles/kiro-cli/<profile>" kiro-cli login
+XDG_DATA_HOME="${AGEND_HOME:-$HOME/.agend}/credential-profiles/kiro-cli/<profile>" kiro-cli login
 ```
 
 For codex the variable and the path are different:
 
 ```
-CODEX_HOME="${AGEND_HOME:-~/.agend}/credential-profiles/codex/<profile>" codex login
+CODEX_HOME="${AGEND_HOME:-$HOME/.agend}/credential-profiles/codex/<profile>" codex login
 ```
 
+For claude-code a fleet admin can do it **from chat**, no host access needed:
+
+```
+/login claude-code <profile>
+```
+
+It opens the same browser-terminal login as `/login claude-code`, for that
+profile only. Or on the host:
+
+```
+CLAUDE_CONFIG_DIR="${AGEND_HOME:-$HOME/.agend}/credential-profiles/claude-code/<profile>" claude auth login
+```
+
+Kiro and codex profiles cannot be signed in from chat yet: `/login kiro-cli <profile>`
+answers with the host command to run.
+
+A Claude Code profile keeps its own login, trust and conversations, and a
+`settings.json` that starts as a copy of the user's; the user's `CLAUDE.md`,
+agents, commands, skills, output styles and plugins are shared with it.
+
+**When a switch was refused, relay the command from the refusal, character for
+character** — never one you assembled from the templates above. It carries the
+exact absolute path AgEnD launches with. For claude-code this matters more than
+anywhere: on macOS the login is stored under a Keychain item named after that
+path string, so a login under a differently spelled path (a relative
+`AGEND_HOME`, a trailing slash, a `~` that was never expanded) lands in another
+item, and the agent still finds no login.
+For claude-code the refusal also names `/login claude-code <profile>`: offer that first, since it works from chat.
+
 ## Create a worker on another subscription
 
 ```
@@ -71,7 +102,7 @@ restarted for you** and the reply says `restarted: true`. A paused or stopped on
 is not started: the reply says `restarted: false`, and the switch applies at its
 next start.
 
-**For kiro**, a switch is always a **new conversation**, and the reply says so
+**For kiro and claude-code**, a switch is always a **new conversation**, and the reply says so
 (`conversation_carried_over: false`). kiro keeps its conversations in the same
 database as its login, so a different subscription has a different set of them
 and there is nothing to resume — AgEnD does not even try. What it does instead
@@ -132,6 +163,8 @@ and log it in, so report it as such rather than as a missing subscription.
 - Quotas only add up if the profiles are genuinely different billing accounts.
   Two profiles logged into the same account do not double anything, and it is
   worth saying so before someone sets this up expecting more headroom.
+- Claude Code profiles do not have usage rows of their own yet: the plain
+  `Claude` row reads the default login. Do not report it as a profile's quota.
 - Switching a profile does not carry the conversation across; the agent gets a
   summary of the work, not the transcript. Say anything that must survive
   verbatim in the channel before switching.
@@ -140,8 +173,8 @@ and log it in, so report it as such rather than as a missing subscription.
 
 - Do not invent a profile that has never been logged in and report success —
   the switch is refused, and the refusal tells you what to relay.
-- Do not set `credential_profile` for a backend other than `kiro-cli` or
-  `codex`; it is ignored, and the config validator warns about it.
+- Do not set `credential_profile` for a backend other than `kiro-cli`, `codex`
+  or `claude-code`; it is ignored, and the config validator warns about it.
 - Do not tell a codex user their conversation will definitely continue across a
   switch. Say the history is shared; that part is verified.
 - Do not use a profile name with slashes or spaces — it becomes a directory

package/dist/host-memory.d.ts

@@ -1,3 +1,9 @@
+export interface LinuxMemoryPsi {
+    someAvg60: number;
+    fullAvg10: number;
+}
+/** Kernel percentage averages; missing/ambiguous output is unavailable, not zero pressure. */
+export declare function parseLinuxMemoryPsi(output: string): LinuxMemoryPsi | null;
 export interface HostMemory {
     totalBytes: number;
     availableBytes: number | null;
@@ -8,12 +14,16 @@ export interface HostMemory {
     darwinPressureLevel?: 1 | 2 | 4 | null;
     /** Bounded diagnostic output; null when unavailable or not requested. */
     darwinPressureRaw?: string | null;
+    /** Linux pressure sampling only; null means PSI cannot be used. */
+    linuxPsi?: LinuxMemoryPsi | null;
 }
 interface HostMemoryDeps {
     platform: NodeJS.Platform;
     meminfo: () => string;
     totalmem: () => number;
     freemem: () => number;
+    includePressure: boolean;
+    psi: () => string;
 }
 /** Host memory, not the fleet's RSS/cgroup charge. Missing swap data is not zero swap. */
 export declare function readHostMemory(overrides?: Partial<HostMemoryDeps>): HostMemory;

package/dist/host-memory.js

@@ -1,15 +1,44 @@
 import { DarwinMemoryProbe } from "./darwin-memory.js";
 import { readFileSync } from "node:fs";
 import { freemem, totalmem, platform } from "node:os";
+/** Kernel percentage averages; missing/ambiguous output is unavailable, not zero pressure. */
+export function parseLinuxMemoryPsi(output) {
+    if (output.length > 4096)
+        return null;
+    const rows = new Map();
+    const lines = output.trim().split(/\r?\n/);
+    if (lines.length !== 2)
+        return null;
+    for (const line of lines) {
+        const match = /^(some|full) avg10=(\d+(?:\.\d+)?) avg60=(\d+(?:\.\d+)?) avg300=(\d+(?:\.\d+)?) total=\d+$/.exec(line);
+        if (!match || rows.has(match[1]))
+            return null;
+        const averages = match.slice(2).map(Number);
+        if (averages.some(n => !Number.isFinite(n) || n < 0 || n > 100))
+            return null;
+        rows.set(match[1], averages);
+    }
+    if (!rows.has("some") || !rows.has("full"))
+        return null;
+    return { someAvg60: rows.get("some")[1], fullAvg10: rows.get("full")[0] };
+}
 /** Host memory, not the fleet's RSS/cgroup charge. Missing swap data is not zero swap. */
 export function readHostMemory(overrides = {}) {
-    const deps = { platform: platform(), meminfo: () => readFileSync("/proc/meminfo", "utf8"), totalmem, freemem, ...overrides };
+    const deps = { platform: platform(), meminfo: () => readFileSync("/proc/meminfo", "utf8"), totalmem, freemem,
+        includePressure: false, psi: () => readFileSync("/proc/pressure/memory", "utf8"), ...overrides };
     // macOS keeps reclaimable pages in use. Its free count is not availability.
     // Synchronous readers cannot run the native probe; absence stays unknown.
     if (deps.platform === "darwin") {
         return { totalBytes: deps.totalmem(), availableBytes: null, availableKind: "unknown", swapTotalBytes: null, swapFreeBytes: null };
     }
     if (deps.platform === "linux") {
+        let linuxPsi = null;
+        if (deps.includePressure) {
+            try {
+                linuxPsi = parseLinuxMemoryPsi(deps.psi());
+            }
+            catch { /* Fall back to RAM, without inventing PSI. */ }
+        }
         try {
             const fields = new Map();
             for (const match of deps.meminfo().matchAll(/^(\w+):\s+(\d+)\s+kB\s*$/gm)) {
@@ -28,10 +57,13 @@ export function readHostMemory(overrides = {}) {
                     availableKind: fields.has("MemAvailable") ? "available" : "free",
                     swapTotalBytes: hasSwap ? swapTotal : null,
                     swapFreeBytes: hasSwap ? swapFree : null,
+                    ...(deps.includePressure ? { linuxPsi } : {}),
                 };
             }
         }
         catch { /* non-procfs Linux, or an unreadable snapshot: portable fallback */ }
+        return { totalBytes: deps.totalmem(), availableBytes: deps.freemem(), availableKind: "free", swapTotalBytes: null, swapFreeBytes: null,
+            ...(deps.includePressure ? { linuxPsi } : {}) };
     }
     return { totalBytes: deps.totalmem(), availableBytes: deps.freemem(), availableKind: "free", swapTotalBytes: null, swapFreeBytes: null };
 }

package/dist/host-memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-memory.js","sourceRoot":"","sources":["../src/host-memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAqBtD,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,YAAqC,EAAE;IACpE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IAC7H,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACpI,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;YACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;gBACtC,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,KAAK,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxC,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,SAAS,CAAC;gBAC3F,OAAO;oBACL,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS;oBAC5C,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;oBAChE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;oBAC1C,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;iBACzC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,oEAAoE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAC3I,CAAC;AAED,oFAAoF;AACpF,IAAI,qBAAqB,GAA6B,IAAI,CAAC;AAC3D,MAAM,UAAU,mBAAmB;IACjC,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACtE,qBAAqB,KAAK,IAAI,iBAAiB,EAAE,CAAC;IAClD,OAAO,qBAAqB,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"host-memory.js","sourceRoot":"","sources":["../src/host-memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAItD,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,4FAA4F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtH,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAyBD,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,YAAqC,EAAE;IACpE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO;QAC1G,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,uBAAuB,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC;IACnG,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACpI,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,QAAQ,GAA0B,IAAI,CAAC;QAC3C,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC;gBAAC,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;YACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;gBACtC,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,KAAK,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxC,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,SAAS,CAAC;gBAC3F,OAAO;oBACL,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS;oBAC5C,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;oBAChE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;oBAC1C,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;oBACxC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,oEAAoE,CAAC,CAAC;QAChF,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;YACpI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAC3I,CAAC;AAED,oFAAoF;AACpF,IAAI,qBAAqB,GAA6B,IAAI,CAAC;AAC3D,MAAM,UAAU,mBAAmB;IACjC,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACtE,qBAAqB,KAAK,IAAI,iBAAiB,EAAE,CAAC;IAClD,OAAO,qBAAqB,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC"}

package/dist/instance-lifecycle.d.ts

@@ -105,7 +105,13 @@ export interface LifecycleContext {
      * Offer a one-tap re-login beside an auth alert. Optional: contexts without
      * it (tests, lightweight fleets) still get the alert's written remedy.
      */
-    offerBackendLogin?(targetInstance: string, backend: string): Promise<void>;
+    /** `profile` (#1699 part 2): the button signs that credential profile in, not the backend's default login. */
+    offerBackendLogin?(targetInstance: string, backend: string, profile?: string): Promise<void>;
+    /**
+     * The credential profile an instance's CLI signs in with on `backend` (#1699 follow-up), or null for that backend's
+     * default login. Absent: every instance is on the default login (as before profiles).
+     */
+    credentialProfileOf?(name: string, backend: string): string | null;
     /** Notify a clean CLI exit and offer an admin-only restart action in General. */
     notifyNormalExit(name: string): Promise<void>;
     /** Tell every General, as an agent, that kiro-cli can no longer run this instance as configured. */
@@ -281,10 +287,10 @@ export declare class InstanceLifecycle {
     private activitySeedNow;
     /** When each instance was last woken or started for work — the pre-claim lease clock. */
     private wokeAt;
-    /** backend → last auth-error alert time, so one expiry sends one alert. */
+    /** login (backend, or backend:profile) → last auth-error alert time, so one expiry sends one alert. */
     private lastAuthAlertAt;
     /**
-     * backend → cached token-free auth verification (see AUTH_VERIFY_CACHE_MS).
+     * login (backend, or backend:profile) → cached token-free auth verification (see AUTH_VERIFY_CACHE_MS).
      * The PROMISE is cached, not the result: a shared credential expiring makes
      * every instance of the backend fire in the same tick, and they must join
      * one in-flight check instead of each spawning their own.
@@ -361,10 +367,20 @@ export declare class InstanceLifecycle {
      * CLI is not. Cached per backend so simultaneous alerts run one check.
      */
     private verifyAuthError;
+    /**
+     * The credential profile a running instance signs in with (#1699 follow-up): its login is that profile's, so its
+     * auth error is judged, cached and reported against that login — never the backend's default one, which can be fine
+     * while the profile's has expired.
+     */
+    private profileOf;
+    private static loginKey;
     private verifyCodexQuota;
     private verifyClaudeQuota;
-    /** Same verification keyed by backend (used by startup pre-flight priming). */
-    verifyBackendAuth(backend: string): Promise<"valid" | "invalid" | "unknown">;
+    /**
+     * Same verification keyed by login — a backend's default one, or one of its credential profiles, probed with that
+     * profile's environment (used by startup pre-flight priming).
+     */
+    verifyBackendAuth(backend: string, profile?: string | null): Promise<"valid" | "invalid" | "unknown">;
     /**
      * Startup pre-flight: warm the per-backend auth verification cache so the
      * detectors that fire seconds later (login-screen scan, MCP-died gate) get an
@@ -372,7 +388,10 @@ export declare class InstanceLifecycle {
      * anything, because e.g. codex on a custom provider runs fine while
      * `codex login status` reports logged out (live-verified on this fleet).
      */
-    primeAuthVerification(backends: Iterable<string>): void;
+    primeAuthVerification(logins: Iterable<{
+        backend: string;
+        profile: string | null;
+    }>): void;
     /**
      * One alert per backend per cooldown, naming every affected instance — a CLI's
      * credentials are shared, so N instances failing is ONE problem with ONE fix

package/dist/instance-lifecycle.js

@@ -19,6 +19,7 @@ import { reportProviderRateLimit } from "./usage/provider-alerts.js";
 import { isFleetStartCommandLine } from "./fleet-lock.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { BACKEND_AUTH_CHECKS, checkAuthStatus, LOGIN_FLOWS } from "./login-flows.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialProfileEnv, credentialProfileLoginCommand } from "./backend/credential-profile.js";
 import { fetchClaudeUsage, fetchCodexUsage } from "./usage/providers.js";
 import { assertExplicitInstanceRemoval, authorizeExplicitInstanceRemoval } from "./instance-removal.js";
 import { capturePendingTargetReconciliation, finishTargetReconciliation, reconcileTargetBeforeStart, RECONCILIATION_WRITE_DRAIN_TIMEOUT_MS, retireCapturedTargetWindows, } from "./delivery-reconciliation.js";
@@ -258,10 +259,10 @@ export class InstanceLifecycle {
     activitySeedNow = new Set();
     /** When each instance was last woken or started for work — the pre-claim lease clock. */
     wokeAt = new Map();
-    /** backend → last auth-error alert time, so one expiry sends one alert. */
+    /** login (backend, or backend:profile) → last auth-error alert time, so one expiry sends one alert. */
     lastAuthAlertAt = new Map();
     /**
-     * backend → cached token-free auth verification (see AUTH_VERIFY_CACHE_MS).
+     * login (backend, or backend:profile) → cached token-free auth verification (see AUTH_VERIFY_CACHE_MS).
      * The PROMISE is cached, not the result: a shared credential expiring makes
      * every instance of the backend fire in the same tick, and they must join
      * one in-flight check instead of each spawning their own.
@@ -370,7 +371,19 @@ export class InstanceLifecycle {
      * CLI is not. Cached per backend so simultaneous alerts run one check.
      */
     verifyAuthError(name) {
-        return this.verifyBackendAuth(this.backendOf(name));
+        const backend = this.backendOf(name);
+        return this.verifyBackendAuth(backend, this.profileOf(name, backend));
+    }
+    /**
+     * The credential profile a running instance signs in with (#1699 follow-up): its login is that profile's, so its
+     * auth error is judged, cached and reported against that login — never the backend's default one, which can be fine
+     * while the profile's has expired.
+     */
+    profileOf(name, backend) {
+        return this.ctx.credentialProfileOf?.(name, backend) ?? null;
+    }
+    static loginKey(backend, profile) {
+        return profile ? `${backend}:${profile}` : backend;
     }
     verifyCodexQuota() {
         if (this.codexQuotaVerifyInFlight)
@@ -396,14 +409,19 @@ export class InstanceLifecycle {
         });
         return promise;
     }
-    /** Same verification keyed by backend (used by startup pre-flight priming). */
-    verifyBackendAuth(backend) {
-        const cached = this.authVerifyCache.get(backend);
+    /**
+     * Same verification keyed by login — a backend's default one, or one of its credential profiles, probed with that
+     * profile's environment (used by startup pre-flight priming).
+     */
+    verifyBackendAuth(backend, profile = null) {
+        const key = InstanceLifecycle.loginKey(backend, profile);
+        const cached = this.authVerifyCache.get(key);
         if (cached && Date.now() - cached.at < AUTH_VERIFY_CACHE_MS)
             return cached.promise;
         const check = LOGIN_FLOWS[backend]?.authCheck ?? BACKEND_AUTH_CHECKS[backend];
-        const promise = check ? checkAuthStatus(check) : Promise.resolve("unknown");
-        this.authVerifyCache.set(backend, { at: Date.now(), promise });
+        const env = profile ? credentialProfileEnv(getAgendHome(), backend, profile) : null;
+        const promise = check ? (env ? checkAuthStatus(check, env) : checkAuthStatus(check)) : Promise.resolve("unknown");
+        this.authVerifyCache.set(key, { at: Date.now(), promise });
         return promise;
     }
     /**
@@ -413,11 +431,16 @@ export class InstanceLifecycle {
      * anything, because e.g. codex on a custom provider runs fine while
      * `codex login status` reports logged out (live-verified on this fleet).
      */
-    primeAuthVerification(backends) {
-        for (const backend of new Set(backends)) {
-            void this.verifyBackendAuth(backend).then(result => {
+    primeAuthVerification(logins) {
+        const seen = new Set();
+        for (const { backend, profile } of logins) {
+            const key = InstanceLifecycle.loginKey(backend, profile);
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            void this.verifyBackendAuth(backend, profile).then(result => {
                 if (result === "invalid") {
-                    this.ctx.logger.warn({ backend }, "Pre-flight auth check failed — marking backend as auth-suspect");
+                    this.ctx.logger.warn({ backend, profile }, "Pre-flight auth check failed — marking backend as auth-suspect");
                 }
             }).catch(() => { });
         }
@@ -430,27 +453,43 @@ export class InstanceLifecycle {
      */
     notifyAuthErrorOnce(name, message, notificationTarget = name) {
         const backend = this.backendOf(name);
+        // #1699 follow-up: a credential profile is a login of its own — its own alert, its own instances, its own fix.
+        const profile = this.profileOf(name, backend);
+        const key = InstanceLifecycle.loginKey(backend, profile);
         const now = Date.now();
-        const last = this.lastAuthAlertAt.get(backend) ?? 0;
+        const last = this.lastAuthAlertAt.get(key) ?? 0;
         if (now - last < AUTH_ALERT_COOLDOWN_MS) {
-            this.ctx.logger.info({ name, backend }, "auth error suppressed (backend already alerted)");
+            this.ctx.logger.info({ name, backend, profile }, "auth error suppressed (this login already alerted)");
             return;
         }
-        this.lastAuthAlertAt.set(backend, now);
-        const affected = [...this.daemons.keys()].filter(n => this.backendOf(n) === backend);
+        this.lastAuthAlertAt.set(key, now);
+        const affected = [...this.daemons.keys()].filter(n => this.backendOf(n) === backend && this.profileOf(n, backend) === profile);
         const others = affected.filter(n => n !== name);
+        const on = profile ? `\`${backend}\` profile \`${profile}\`` : `\`${backend}\``;
         const scope = others.length
-            ? `${affected.length} instances on \`${backend}\`: ${affected.join(", ")}`
-            : `\`${name}\` (${backend})`;
-        const remedy = backend === "opencode"
-            ? "Run `opencode auth login` in a terminal, then wake the affected instance(s)."
-            : `Use \`/login ${backend}\` to re-login remotely.`;
-        const dispatched = this.notifyIncident(notificationTarget, "auth_error", `🔑 ${message}\n\nAffects ${scope}. Credentials are shared per backend — one re-login restores all of them; affected instances pause until then. ${remedy}`);
+            ? `${affected.length} instances on ${on}: ${affected.join(", ")}`
+            : profile ? `\`${name}\` (${backend}, profile \`${profile}\`)` : `\`${name}\` (${backend})`;
+        // A profile is signed in with its own variable: `/login <backend>` would sign the DEFAULT login in. claude-code's
+        // can be signed in from chat (`/login <backend> <profile>`, #1699 part 2); the others' on the host.
+        const profileLogin = profile ? credentialProfileLoginCommand(getAgendHome(), backend, profile) : null;
+        const chatLogin = !!profileLogin && CHAT_PROFILE_LOGIN_BACKENDS.has(backend);
+        const remedy = chatLogin
+            ? `Use \`/login ${backend} ${profile}\` to sign that profile in remotely (or run \`${profileLogin}\` on the host).`
+            : profileLogin
+                ? `Run \`${profileLogin}\` on the host, then wake the affected instance(s).`
+                : backend === "opencode"
+                    ? "Run `opencode auth login` in a terminal, then wake the affected instance(s)."
+                    : `Use \`/login ${backend}\` to re-login remotely.`;
+        const shared = profile
+            ? "Credentials are shared per profile — one sign-in restores all of them; affected instances pause until then."
+            : "Credentials are shared per backend — one re-login restores all of them; affected instances pause until then.";
+        const dispatched = this.notifyIncident(notificationTarget, "auth_error", `🔑 ${message}\n\nAffects ${scope}. ${shared} ${remedy}`);
         // Only alongside an alert somebody actually saw: a button on its own, or one
-        // trailing a suppressed alert, is a control with no explanation next to it.
-        if (dispatched) {
-            void this.ctx.offerBackendLogin?.(notificationTarget, backend)
-                .catch(err => this.ctx.logger.warn({ err, backend }, "Could not offer the re-login button"));
+        // trailing a suppressed alert, is a control with no explanation next to it. For a profile only where its login
+        // runs from chat, and then the button carries the profile — the plain button signs the default login in.
+        if (dispatched && (!profileLogin || chatLogin)) {
+            void (profile ? this.ctx.offerBackendLogin?.(notificationTarget, backend, profile) : this.ctx.offerBackendLogin?.(notificationTarget, backend))
+                ?.catch(err => this.ctx.logger.warn({ err, backend, profile }, "Could not offer the re-login button"));
         }
     }
     /**
@@ -804,6 +843,14 @@ export class InstanceLifecycle {
             // (Kept `description` for kind === "dialog" rather than a dedicated
             // kiro interactionKind: a new union member would flow into the category
             // labels, summaries and every exhaustive match for one picker's text.)
+            // #1691: a prompt no table knows — what it asks (one sanitised, bounded line from the daemon, never the pane), and
+            // that AgEnD will not press anything.
+            if (data.unrecognised) {
+                const asked = data.question ? t("inst.unrecognised_prompt_question", data.question) : "";
+                this.notifyIncident(name, "dialog_parked", t("inst.unrecognised_prompt", name, asked));
+                this.ctx.notifyFleetError?.(t("fleet.unrecognised_prompt", name, asked));
+                return;
+            }
             const category = data.kind && data.kind !== "dialog" ? interactionCategory(data.kind, data.backend) : null;
             const text = category ? t("inst.interaction_parked", name, category) : data.holdOnly
                 ? t("inst.dialog_parked_hold", name, data.description)