@songsid/agend 2.2.0-beta.4 → 2.2.0-beta.6

package/dist/update-marker.js

@@ -23,6 +23,64 @@ import { atomicWriteFileSync } from "./atomic-write.js";
  */
 export const UPDATE_MARKER_MAX_AGE_MS = 15 * 60_000;
 const FILE = "update-in-progress.json";
+export function updateReceiptOf(marker) {
+    if (!marker?.progress?.target?.messageId)
+        return null;
+    return { startedAt: marker.startedAt, messageId: marker.progress.target.messageId, operation: updateProgressOperation(marker.progress) };
+}
+function sameReceipt(a, b) {
+    return !!a && !!b && a.startedAt === b.startedAt && a.messageId === b.messageId && a.operation === b.operation;
+}
+export function updateMarkerIdentity(dataDir) {
+    const marker = readMarker(dataDir);
+    if (!marker)
+        return null;
+    return { startedAt: marker.startedAt, receipt: marker.progress ? updateReceiptOf(marker) : null };
+}
+/** The same marker: started at the same time, with the same receipt (or none on both). */
+export function sameUpdateMarker(a, b) {
+    if (!a || !b || a.startedAt !== b.startedAt)
+        return false;
+    return a.receipt === null ? b.receipt === null : sameReceipt(a.receipt, b.receipt);
+}
+/**
+ * Mark the current update as owing its retire outcome, before the restart
+ * that may let a new fleet consume this receipt. Returns the receipt the
+ * later write must still match.
+ */
+export function markCleanupPending(dataDir) {
+    const marker = readUpdateProgress(dataDir);
+    const receipt = updateReceiptOf(marker);
+    if (!receipt || !marker)
+        return null;
+    marker.pid = process.pid;
+    marker.progress = { ...marker.progress, cleanup: "pending" };
+    return writeMarker(dataDir, marker) ? receipt : null;
+}
+/**
+ * Record a retire outcome against the receipt captured before the restart.
+ * Refuses when the marker is gone (the new fleet already consumed it) or
+ * belongs to another operation (e.g. a later full-restart adopted it) — the
+ * warning was already printed to the updater's own output, so refusing here
+ * loses nothing the operator saw.
+ */
+export function writeCleanupOutcome(dataDir, receipt, outcome) {
+    if (!receipt)
+        return false;
+    const marker = readUpdateProgress(dataDir);
+    if (!marker || !sameReceipt(updateReceiptOf(marker), receipt))
+        return false;
+    marker.pid = process.pid;
+    marker.progress = {
+        ...marker.progress,
+        // Prose follows the same rule as setUpdateProgressStage; the command is
+        // verbatim so quoted paths survive byte-exact.
+        ...(outcome?.warning !== undefined ? { warning: outcome.warning.replace(/\s+/g, " ").trim().slice(0, 300) } : {}),
+        ...(outcome?.cleanupCommand !== undefined ? { cleanupCommand: outcome.cleanupCommand } : {}),
+        cleanup: "done",
+    };
+    return writeMarker(dataDir, marker);
+}
 function markerPath(dataDir) {
     return join(dataDir, FILE);
 }
@@ -91,6 +149,9 @@ export function setUpdateProgressStage(dataDir, stage, details = {}) {
         stage,
         ...(details.version !== undefined ? { version: details.version } : {}),
         ...(details.error !== undefined ? { error: details.error.replace(/\s+/g, " ").trim().slice(0, 300) } : {}),
+        ...(details.warning !== undefined ? { warning: details.warning.replace(/\s+/g, " ").trim().slice(0, 300) } : {}),
+        ...(details.cleanupCommand !== undefined ? { cleanupCommand: details.cleanupCommand } : {}),
+        ...(details.cleanup !== undefined ? { cleanup: details.cleanup } : {}),
         ...(stage === "failed" ? { failedStage: previousStage } : {}),
     };
     return writeMarker(dataDir, marker);

package/dist/update-marker.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-marker.js","sourceRoot":"","sources":["../src/update-marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAc,UAAU,EAAiB,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEpD,MAAM,IAAI,GAAG,yBAAyB,CAAC;AAoCvC,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAA0B,CAAC;QAC/F,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,OAAO,MAAsB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAoB;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAA4B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjG,WAAW,CAAC,OAAO,EAAE;QACnB,SAAS,EAAE,GAAG;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE;KAC9D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,MAA4B,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,WAAW,CAAC,OAAO,EAAE;QAC1B,SAAS,EAAE,GAAG;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,QAA6B;IACnE,OAAO,QAAQ,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAO,MAA0D,CAAC;AACpE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,KAA0B,EAC1B,UAAgD,EAAE;IAElD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC5C,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACzB,MAAM,CAAC,QAAQ,GAAG;QAChB,GAAG,MAAM,CAAC,QAAQ;QAClB,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IACvF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,OAAO,EAAE;QACnB,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;QACrC,GAAG;QACH,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC/F,8EAA8E;IAC9E,MAAM,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,wBAAwB,CAAC;AACpD,CAAC"}
+{"version":3,"file":"update-marker.js","sourceRoot":"","sources":["../src/update-marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAc,UAAU,EAAiB,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEpD,MAAM,IAAI,GAAG,yBAAyB,CAAC;AAgDvC,MAAM,UAAU,eAAe,CAAC,MAAiE;IAC/F,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3I,CAAC;AAED,SAAS,WAAW,CAAC,CAAuB,EAAE,CAAuB;IACnE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC;AAWD,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAA0D,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,CAA8B,EAAE,CAA8B;IAC7F,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACzB,MAAM,CAAC,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC7D,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,OAA6B,EAC7B,OAA6D;IAE7D,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACzB,MAAM,CAAC,QAAQ,GAAG;QAChB,GAAG,MAAM,CAAC,QAAQ;QAClB,wEAAwE;QACxE,+CAA+C;QAC/C,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM;KAChB,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAQD,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAA0B,CAAC;QAC/F,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,OAAO,MAAsB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAoB;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAA4B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjG,WAAW,CAAC,OAAO,EAAE;QACnB,SAAS,EAAE,GAAG;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE;KAC9D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,MAA4B,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,WAAW,CAAC,OAAO,EAAE;QAC1B,SAAS,EAAE,GAAG;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,QAA6B;IACnE,OAAO,QAAQ,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAO,MAA0D,CAAC;AACpE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,KAA0B,EAC1B,UAAyH,EAAE;IAE3H,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC5C,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACzB,MAAM,CAAC,QAAQ,GAAG;QAChB,GAAG,MAAM,CAAC,QAAQ;QAClB,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IACvF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,OAAO,EAAE;QACnB,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;QACrC,GAAG;QACH,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC/F,8EAA8E;IAC9E,MAAM,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,wBAAwB,CAAC;AACpD,CAAC"}

package/dist/usage/i18n-keys.d.ts

@@ -3,5 +3,5 @@
  * Keep this list explicit: the parity test rejects a key missing from either
  * locale surface before a mixed-language release can ship.
  */
-export declare const USAGE_I18N_KEYS: readonly ["usage.title", "usage.title_plain", "usage.empty_active", "usage.not_logged_in", "usage.error_fallback", "usage.no_data", "usage.reset.in", "usage.reset.soon", "usage.duration.days_hours", "usage.duration.hours_minutes", "usage.duration.minutes", "usage.metric.session", "usage.metric.weekly", "usage.metric.monthly", "usage.metric.days_window", "usage.metric.named", "usage.metric.named_session", "usage.metric.named_weekly", "usage.metric.named_monthly", "usage.metric.named_days", "usage.metric.extra_usage", "usage.metric.rate_limit_resets", "usage.ticket_expiry", "usage.metric.credits", "usage.metric.weekly_limit", "usage.metric.pay_as_you_go", "usage.metric.bonus_credits", "usage.metric.overage_charges", "usage.metric.pay_per_use", "usage.unit.available", "usage.unit.credits", "usage.metric.usage_monthly", "usage.note.used_limit_unit", "usage.note.bonus_codes", "usage.value.disabled", "usage.value.cap", "usage.value.unlimited", "usage.note.binding", "usage.note.binding_severity", "usage.note.busiest_model", "usage.note.busiest_models", "usage.metric.agy_claude_others", "usage.metric.agy_claude_others_session", "usage.metric.agy_claude_others_weekly", "usage.hint.statusline_now", "usage.hint.statusline_minutes", "usage.hint.claude_api_key", "usage.hint.login_claude", "usage.hint.login_agy", "usage.hint.no_quota", "usage.hint.login_codex", "usage.hint.codex_no_oauth", "usage.hint.login_grok", "usage.hint.grok_no_login", "usage.hint.login_kiro", "usage.hint.kiro_signed_out", "usage.hint.token_refreshing", "usage.hint.subscription_no_credit", "usage.hint.no_quota_account", "usage.error.unreachable", "usage.error.token_rejected", "usage.error.rate_limited", "usage.error.rate_limited_transient", "usage.stale_rate_limited", "usage.error.http", "usage.error.billing_http", "usage.error.invalid_response", "usage.error.invalid_billing_response", "usage.error.invalid_kiro_response", "usage.error.claude_token_expired", "usage.error.codex_token_expired", "usage.error.grok_expired", "usage.error.grok_response_changed", "usage.error.agy_cap", "usage.error.agy_no_refresh", "usage.error.agy_token_expired", "usage.error.agy_login_expired", "usage.error.agy_refresh_empty", "usage.error.grok_auth_readonly", "usage.error.grok_no_refresh", "usage.error.grok_refresh_unreachable", "usage.error.grok_invalid_refresh", "usage.error.grok_persist"];
+export declare const USAGE_I18N_KEYS: readonly ["usage.title", "usage.title_plain", "usage.empty_active", "usage.not_logged_in", "usage.error_fallback", "usage.no_data", "usage.reset.in", "usage.reset.soon", "usage.duration.days_hours", "usage.duration.hours_minutes", "usage.duration.minutes", "usage.metric.session", "usage.metric.weekly", "usage.metric.monthly", "usage.metric.days_window", "usage.metric.named", "usage.metric.named_session", "usage.metric.named_weekly", "usage.metric.named_monthly", "usage.metric.named_days", "usage.metric.extra_usage", "usage.metric.rate_limit_resets", "usage.ticket_expiry", "usage.metric.credits", "usage.metric.weekly_limit", "usage.metric.pay_as_you_go", "usage.metric.bonus_credits", "usage.metric.overage_charges", "usage.metric.pay_per_use", "usage.unit.available", "usage.unit.credits", "usage.metric.usage_monthly", "usage.note.used_limit_unit", "usage.note.bonus_codes", "usage.value.disabled", "usage.value.cap", "usage.value.unlimited", "usage.note.binding", "usage.note.binding_severity", "usage.note.busiest_model", "usage.note.busiest_models", "usage.metric.agy_claude_others", "usage.metric.agy_claude_others_session", "usage.metric.agy_claude_others_weekly", "usage.hint.statusline_now", "usage.hint.statusline_minutes", "usage.hint.claude_api_key", "usage.hint.login_claude", "usage.hint.login_agy", "usage.hint.no_quota", "usage.hint.login_codex", "usage.hint.codex_no_oauth", "usage.hint.login_grok", "usage.hint.grok_no_login", "usage.hint.login_kiro", "usage.hint.kiro_signed_out", "usage.hint.claude_profile_signed_out", "usage.hint.claude_profile_signed_out_chat", "usage.hint.token_refreshing", "usage.hint.subscription_no_credit", "usage.hint.no_quota_account", "usage.error.unreachable", "usage.error.token_rejected", "usage.error.rate_limited", "usage.error.rate_limited_transient", "usage.stale_rate_limited", "usage.error.http", "usage.error.billing_http", "usage.error.invalid_response", "usage.error.invalid_billing_response", "usage.error.invalid_kiro_response", "usage.error.claude_token_expired", "usage.error.codex_token_expired", "usage.error.grok_expired", "usage.error.grok_response_changed", "usage.error.agy_cap", "usage.error.agy_no_refresh", "usage.error.agy_token_expired", "usage.error.agy_login_expired", "usage.error.agy_refresh_empty", "usage.error.grok_auth_readonly", "usage.error.grok_no_refresh", "usage.error.grok_refresh_unreachable", "usage.error.grok_invalid_refresh", "usage.error.grok_persist"];
 export type UsageI18nKey = typeof USAGE_I18N_KEYS[number];

package/dist/usage/i18n-keys.js

@@ -20,7 +20,7 @@ export const USAGE_I18N_KEYS = [
     "usage.hint.statusline_now", "usage.hint.statusline_minutes", "usage.hint.claude_api_key",
     "usage.hint.login_claude", "usage.hint.login_agy", "usage.hint.no_quota",
     "usage.hint.login_codex", "usage.hint.codex_no_oauth", "usage.hint.login_grok",
-    "usage.hint.grok_no_login", "usage.hint.login_kiro", "usage.hint.kiro_signed_out",
+    "usage.hint.grok_no_login", "usage.hint.login_kiro", "usage.hint.kiro_signed_out", "usage.hint.claude_profile_signed_out", "usage.hint.claude_profile_signed_out_chat",
     "usage.hint.token_refreshing", "usage.hint.subscription_no_credit", "usage.hint.no_quota_account",
     "usage.error.unreachable", "usage.error.token_rejected", "usage.error.rate_limited", "usage.error.rate_limited_transient", "usage.stale_rate_limited",
     "usage.error.http", "usage.error.billing_http", "usage.error.invalid_response",

package/dist/usage/i18n-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"i18n-keys.js","sourceRoot":"","sources":["../../src/usage/i18n-keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB;IAC/E,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB;IAC7E,2BAA2B,EAAE,8BAA8B,EAAE,wBAAwB;IACrF,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,0BAA0B;IACjG,oBAAoB,EAAE,4BAA4B,EAAE,2BAA2B;IAC/E,4BAA4B,EAAE,yBAAyB,EAAE,0BAA0B;IACnF,gCAAgC,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,2BAA2B;IAC5G,4BAA4B,EAAE,4BAA4B,EAAE,8BAA8B;IAC1F,0BAA0B,EAAE,sBAAsB,EAAE,oBAAoB;IACxE,4BAA4B,EAAE,4BAA4B,EAAE,wBAAwB;IACpF,sBAAsB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB;IACxF,6BAA6B,EAAE,0BAA0B,EAAE,2BAA2B;IACtF,gCAAgC,EAAE,wCAAwC,EAAE,uCAAuC;IACnH,2BAA2B,EAAE,+BAA+B,EAAE,2BAA2B;IACzF,yBAAyB,EAAE,sBAAsB,EAAE,qBAAqB;IACxE,wBAAwB,EAAE,2BAA2B,EAAE,uBAAuB;IAC9E,0BAA0B,EAAE,uBAAuB,EAAE,4BAA4B;IACjF,6BAA6B,EAAE,mCAAmC,EAAE,6BAA6B;IACjG,yBAAyB,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,oCAAoC,EAAE,0BAA0B;IACrJ,kBAAkB,EAAE,0BAA0B,EAAE,8BAA8B;IAC9E,sCAAsC,EAAE,mCAAmC;IAC3E,kCAAkC,EAAE,iCAAiC;IACrE,0BAA0B,EAAE,mCAAmC,EAAE,qBAAqB;IACtF,4BAA4B,EAAE,+BAA+B,EAAE,+BAA+B;IAC9F,+BAA+B,EAAE,gCAAgC,EAAE,6BAA6B;IAChG,sCAAsC,EAAE,kCAAkC,EAAE,0BAA0B;CAC9F,CAAC"}
+{"version":3,"file":"i18n-keys.js","sourceRoot":"","sources":["../../src/usage/i18n-keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB;IAC/E,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB;IAC7E,2BAA2B,EAAE,8BAA8B,EAAE,wBAAwB;IACrF,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,0BAA0B;IACjG,oBAAoB,EAAE,4BAA4B,EAAE,2BAA2B;IAC/E,4BAA4B,EAAE,yBAAyB,EAAE,0BAA0B;IACnF,gCAAgC,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,2BAA2B;IAC5G,4BAA4B,EAAE,4BAA4B,EAAE,8BAA8B;IAC1F,0BAA0B,EAAE,sBAAsB,EAAE,oBAAoB;IACxE,4BAA4B,EAAE,4BAA4B,EAAE,wBAAwB;IACpF,sBAAsB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB;IACxF,6BAA6B,EAAE,0BAA0B,EAAE,2BAA2B;IACtF,gCAAgC,EAAE,wCAAwC,EAAE,uCAAuC;IACnH,2BAA2B,EAAE,+BAA+B,EAAE,2BAA2B;IACzF,yBAAyB,EAAE,sBAAsB,EAAE,qBAAqB;IACxE,wBAAwB,EAAE,2BAA2B,EAAE,uBAAuB;IAC9E,0BAA0B,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,sCAAsC,EAAE,2CAA2C;IACtK,6BAA6B,EAAE,mCAAmC,EAAE,6BAA6B;IACjG,yBAAyB,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,oCAAoC,EAAE,0BAA0B;IACrJ,kBAAkB,EAAE,0BAA0B,EAAE,8BAA8B;IAC9E,sCAAsC,EAAE,mCAAmC;IAC3E,kCAAkC,EAAE,iCAAiC;IACrE,0BAA0B,EAAE,mCAAmC,EAAE,qBAAqB;IACtF,4BAA4B,EAAE,+BAA+B,EAAE,+BAA+B;IAC9F,+BAA+B,EAAE,gCAAgC,EAAE,6BAA6B;IAChG,sCAAsC,EAAE,kCAAkC,EAAE,0BAA0B;CAC9F,CAAC"}

package/dist/usage/providers.d.ts

@@ -106,14 +106,43 @@ export declare function resolveClaudeAuth(file: {
  * even live?".
  */
 export declare function statuslineUsage(reading: StatuslineRateLimits, plan: string | null, now?: number): Omit<ProviderUsage, "id" | "name">;
+/** `security find-generic-password -w`: the item's secret, or null (no such item, locked, not macOS). */
+type KeychainRead = (service: string, account: string) => Promise<string | null>;
+declare let claudeKeychain: {
+    platform: NodeJS.Platform;
+    read: KeychainRead;
+    username: () => string;
+};
+/** Test seam (#1699): the platform, the Keychain read and the OS user name; null restores all three. */
+export declare function setClaudeKeychainForTests(seam: Partial<typeof claudeKeychain> | null): void;
+/**
+ * Whether a shell rc sets `CLAUDE_CODE_OAUTH_TOKEN` at all — any assignment, export or declaration that is not a
+ * comment, whatever its value: `"$OTHER"` or `${OTHER}` is a token once the pane's shell expands it, so unlike
+ * tokenFromShellRc (which must hand the API a literal bearer) this never discounts one it cannot read (#1713 review).
+ * Files those rcs `source` are not followed.
+ */
+export declare function shellRcSetsClaudeToken(read: (path: string) => string, home?: string, files?: readonly string[]): boolean;
 /**
  * Best-effort OAuth access token for direct Anthropic API calls (the /model
  * catalog probe). Same resolution order as the usage panel: credentials file →
- * CLAUDE_CODE_OAUTH_TOKEN → shell rc. Null when nothing usable exists.
+ * CLAUDE_CODE_OAUTH_TOKEN → shell rc. Null when nothing usable exists. With
+ * `storeHome` (a credential profile's config dir, #1699): that profile's login only.
+ */
+export declare function getClaudeOAuthToken(storeHome?: string): Promise<string | null>;
+/** Which subscription a Claude row is (#1699): a profile's (with its name), or the shared one beside profiles. */
+export interface ClaudeUsageScope {
+    profile?: string;
+    besideProfiles?: boolean;
+}
+/**
+ * Exported for tests — the statusline/API preference order is the subject.
+ *
+ * `storeHome` (#1699): a credential profile's config dir — the row reads that profile's login and only the rate
+ * limits its own instances wrote (their conversations are under its `projects/`); a profile with no login says so,
+ * with the line that signs it in, and never shows the shared account's numbers. Without it: the shared login as
+ * always; beside profiles (`besideProfiles`), its statusline fallback leaves the profiles' instances out.
  */
-export declare function getClaudeOAuthToken(): Promise<string | null>;
-/** Exported for tests — the statusline/API preference order is the subject. */
-export declare function fetchClaudeUsage(): Promise<Omit<ProviderUsage, "id" | "name">>;
+export declare function fetchClaudeUsage(storeHome?: string, scope?: ClaudeUsageScope): Promise<Omit<ProviderUsage, "id" | "name">>;
 interface AgyBucket {
     bucketId?: string;
     displayName?: string;
@@ -172,7 +201,7 @@ export declare function fetchKiroUsage(storeHome?: string): Promise<Omit<Provide
 type UsageProvider = {
     id: string;
     name: string;
-    fetch: (storeHome?: string) => Promise<Omit<ProviderUsage, "id" | "name">>;
+    fetch: (storeHome?: string, scope?: ClaudeUsageScope) => Promise<Omit<ProviderUsage, "id" | "name">>;
 };
 type UsageFleetConfig = Parameters<typeof listConfiguredProfiles>[0];
 /** Read the daemon-written, token-free Muse relay snapshot for active Muse instances. */

package/dist/usage/providers.js

@@ -20,13 +20,15 @@
  */
 import { readFile, writeFile, access, constants } from "node:fs/promises";
 import { readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve, sep } from "node:path";
+import { execFile } from "node:child_process";
 import { getAgendHome } from "../paths.js";
 import { loadFleetConfig } from "../config.js";
 import { classicProfile, profileName, readClassicBindings } from "../classic-bindings.js";
-import { credentialHomeSpec, credentialProfileStoreHome, instanceCredentialProfile, } from "../backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileLoginCommand, credentialProfileStoreHome, instanceCredentialProfile, } from "../backend/credential-profile.js";
+import { claudeKeychainService } from "../backend/claude-code.js";
 import { readKiroAuthTokens } from "../backend/kiro-auth-store.js";
-import { homedir } from "node:os";
+import { homedir, userInfo } from "node:os";
 import { getProviderRateLimit } from "./provider-alerts.js";
 import { MUSE_USAGE_STALE_MS, readMuseUsageSnapshot } from "../muse-usage-relay.js";
 import { readStatuslineRateLimits, } from "./statusline-usage.js";
@@ -216,43 +218,163 @@ export function statuslineUsage(reading, plan, now = Date.now()) {
         metrics,
     };
 }
+/** `claudeAiOauth` of a credentials document (the `.credentials.json` file, or the same JSON in a Keychain item). */
+function claudeOAuthOf(json) {
+    try {
+        const value = JSON.parse(json)?.claudeAiOauth;
+        return value && typeof value === "object" ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readClaudeCredentialsFile(dir) {
+    try {
+        return claudeOAuthOf(await readFile(join(dir, ".credentials.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+const readKeychainItem = (service, account) => new Promise(done => {
+    execFile("security", ["find-generic-password", "-a", account, "-w", "-s", service], { timeout: 5_000 }, (err, stdout) => {
+        done(err ? null : String(stdout).trim() || null);
+    });
+});
+const defaultKeychain = () => ({ platform: process.platform, read: readKeychainItem, username: () => userInfo().username });
+let claudeKeychain = defaultKeychain();
+/** Test seam (#1699): the platform, the Keychain read and the OS user name; null restores all three. */
+export function setClaudeKeychainForTests(seam) {
+    claudeKeychain = seam ? { ...claudeKeychain, ...seam } : defaultKeychain();
+}
 /**
- * Best-effort OAuth access token for direct Anthropic API calls (the /model
- * catalog probe). Same resolution order as the usage panel: credentials file →
- * CLAUDE_CODE_OAUTH_TOKEN → shell rc. Null when nothing usable exists.
+ * The account claude files its Keychain item under (2.1.296, as Prism read it from the official darwin bundle, #1713
+ * review): `$USER`, else the OS user name; one that cannot be read or is not `[a-zA-Z0-9._-]+` is "claude-code-user".
  */
-export async function getClaudeOAuthToken() {
-    const home = process.env.CLAUDE_HOME || join(homedir(), ".claude");
-    let file;
+function claudeKeychainAccount() {
+    let name;
     try {
-        file = JSON.parse(await readFile(join(home, ".credentials.json"), "utf8")).claudeAiOauth ?? null;
+        name = process.env.USER || claudeKeychain.username();
     }
     catch {
-        file = null;
+        name = undefined;
     }
-    const auth = resolveClaudeAuth(file);
-    return auth && "token" in auth ? auth.token : null;
+    return name && /^[a-zA-Z0-9._-]+$/.test(name) ? name : "claude-code-user";
 }
-/** Exported for tests — the statusline/API preference order is the subject. */
-export async function fetchClaudeUsage() {
-    const home = process.env.CLAUDE_HOME || join(homedir(), ".claude");
-    let file;
+/**
+ * A credential profile's own Claude login (#1699) — and nothing else: on macOS the Keychain item claude keeps for
+ * exactly this config dir (claudeKeychainService; the account is $USER, as claude names it), else — or when that has
+ * none — the dir's `.credentials.json`. Never the shared login, `CLAUDE_CODE_OAUTH_TOKEN` or a shell rc: those are
+ * another account's, and their numbers on this row would be a lie about this subscription.
+ */
+async function readClaudeProfileLogin(configDir) {
+    if (claudeKeychain.platform === "darwin") {
+        // As claude: a credentials document in the Keychain is THE login — one with no OAuth in it (say only MCP
+        // logins) means no OAuth login, and an older `.credentials.json` beside it is not consulted (#1713 review).
+        const secret = await claudeKeychain.read(claudeKeychainService(configDir), claudeKeychainAccount());
+        const document = secret ? credentialsDocument(secret) : null;
+        if (document)
+            return claudeOAuthOf(secret);
+    }
+    return readClaudeCredentialsFile(configDir);
+}
+/** A credentials document (any JSON object), or null — unparseable is no document, as claude reads its storage. */
+function credentialsDocument(json) {
     try {
-        file = JSON.parse(await readFile(join(home, ".credentials.json"), "utf8")).claudeAiOauth ?? null;
+        const v = JSON.parse(json);
+        return v && typeof v === "object" ? v : null;
     }
     catch {
-        file = null;
+        return null;
     }
+}
+/**
+ * Whether a token the profile's own login does not control can reach claude in a profile's pane: AgEnD sets only
+ * `CLAUDE_CONFIG_DIR` for a profile, so `CLAUDE_CODE_OAUTH_TOKEN` from the fleet's environment, or set in a shell rc
+ * the pane's shell reads, still signs it in — and outranks the stored login (#1713 review).
+ */
+function envTokenReachesClaude() {
+    return !!process.env.CLAUDE_CODE_OAUTH_TOKEN?.trim() || shellRcSetsClaudeToken((path) => readFileSync(path, "utf-8"));
+}
+/**
+ * Whether a shell rc sets `CLAUDE_CODE_OAUTH_TOKEN` at all — any assignment, export or declaration that is not a
+ * comment, whatever its value: `"$OTHER"` or `${OTHER}` is a token once the pane's shell expands it, so unlike
+ * tokenFromShellRc (which must hand the API a literal bearer) this never discounts one it cannot read (#1713 review).
+ * Files those rcs `source` are not followed.
+ */
+export function shellRcSetsClaudeToken(read, home = homedir(), files = SHELL_RC_FILES) {
+    const sets = [
+        /^[ \t]*(?:(?:export|readonly|local|declare|typeset)(?:[ \t]+-[a-zA-Z]+)*[ \t]+(?:[^#\n]*[ \t])?)?CLAUDE_CODE_OAUTH_TOKEN[ \t]*=/m,
+        /^[ \t]*(?:export|declare[ \t]+-[a-zA-Z]*x[a-zA-Z]*|typeset[ \t]+-[a-zA-Z]*x[a-zA-Z]*)[ \t]+(?:[^#\n]*[ \t])?CLAUDE_CODE_OAUTH_TOKEN\b/m,
+        /^[ \t]*setenv[ \t]+CLAUDE_CODE_OAUTH_TOKEN\b/m,
+    ];
+    for (const file of files) {
+        let content;
+        try {
+            content = read(join(home, file));
+        }
+        catch {
+            continue;
+        }
+        if (sets.some((re) => re.test(content)))
+            return true;
+    }
+    return false;
+}
+/** `path` is `dir` or inside it. */
+const isWithin = (path, dir) => { const p = resolve(path); return p === dir || p.startsWith(dir + sep); };
+/**
+ * Best-effort OAuth access token for direct Anthropic API calls (the /model
+ * catalog probe). Same resolution order as the usage panel: credentials file →
+ * CLAUDE_CODE_OAUTH_TOKEN → shell rc. Null when nothing usable exists. With
+ * `storeHome` (a credential profile's config dir, #1699): that profile's login only.
+ */
+export async function getClaudeOAuthToken(storeHome) {
+    const auth = storeHome !== undefined
+        ? resolveClaudeAuth(await readClaudeProfileLogin(storeHome), {}, () => null)
+        : resolveClaudeAuth(await readClaudeCredentialsFile(process.env.CLAUDE_HOME || join(homedir(), ".claude")));
+    return auth && "token" in auth ? auth.token : null;
+}
+/**
+ * Exported for tests — the statusline/API preference order is the subject.
+ *
+ * `storeHome` (#1699): a credential profile's config dir — the row reads that profile's login and only the rate
+ * limits its own instances wrote (their conversations are under its `projects/`); a profile with no login says so,
+ * with the line that signs it in, and never shows the shared account's numbers. Without it: the shared login as
+ * always; beside profiles (`besideProfiles`), its statusline fallback leaves the profiles' instances out.
+ */
+export async function fetchClaudeUsage(storeHome, scope = {}) {
+    const profileHome = storeHome !== undefined ? resolve(storeHome) : null;
+    const file = profileHome !== null
+        ? await readClaudeProfileLogin(profileHome)
+        : await readClaudeCredentialsFile(process.env.CLAUDE_HOME || join(homedir(), ".claude"));
     // Read before anything else: it costs one stat per instance, needs no token,
     // and it is what keeps the panel useful when the API path cannot run at all.
-    const statusline = readStatuslineRateLimits();
-    const auth = resolveClaudeAuth(file);
+    // A profile's: only readings written under its own `projects/` — and only when nothing but its own login can
+    // have signed those instances in. Where the conversation is says which config dir, not whose subscription: with
+    // a token in the environment the readings may be another account's, so none is this row's (#1713 review).
+    const profilesRoot = resolve(getAgendHome(), "credential-profiles", "claude-code");
+    const statusline = profileHome !== null
+        ? (envTokenReachesClaude() ? null : readStatuslineRateLimits(undefined, undefined, (path) => path !== null && isWithin(path, join(profileHome, "projects"))))
+        : readStatuslineRateLimits(undefined, undefined, scope.besideProfiles ? (path) => path === null || !isWithin(path, profilesRoot) : undefined);
+    const auth = profileHome !== null ? resolveClaudeAuth(file, {}, () => null) : resolveClaudeAuth(file);
     if (auth === null) {
         // No token anywhere — but the CLI itself is logged in somehow (including an
         // API key, which the usage endpoint rejects outright), and it wrote its
         // limits down. This is the case the whole statusline source exists for.
         if (statusline)
             return statuslineUsage(statusline, null);
+        if (profileHome !== null) {
+            // On screen (`ok`, as kiro's signed-out row), with what signs this profile in — never a fallback: from chat
+            // (`/login claude-code <profile>`, #1699 part 2), or the exact line on the host — the same words as the auth alert.
+            const host = (scope.profile && credentialProfileLoginCommand(getAgendHome(), "claude-code", scope.profile))
+                || `CLAUDE_CONFIG_DIR=${JSON.stringify(profileHome)} claude auth login`;
+            if (scope.profile && CHAT_PROFILE_LOGIN_BACKENDS.has("claude-code")) {
+                const chat = `/login claude-code ${scope.profile}`;
+                return { status: "ok", hint: `Not logged in — sign in with \`${chat}\` (or run \`${host}\` on the host).`, hintI18n: i18n("usage.hint.claude_profile_signed_out_chat", chat, host), metrics: [] };
+            }
+            return { status: "ok", hint: `Not logged in — sign in with: ${host}`, hintI18n: i18n("usage.hint.claude_profile_signed_out", host), metrics: [] };
+        }
         const hint = process.env.ANTHROPIC_API_KEY
             ? "API-key login has no subscription usage. Use `claude /login` or set CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`)."
             : "Log in with the Claude Code CLI (`claude`).";
@@ -1274,13 +1396,14 @@ export function providersForConfig(config, base = DEFAULT_PROVIDERS) {
             rows.push({
                 id: provider.id,
                 name: provider.id === "codex" ? `${provider.name} (default)` : provider.name,
-                fetch: () => provider.fetch(),
+                // Claude's shared row keeps its statusline fallback to the shared instances (#1699); others ignore the scope.
+                fetch: () => provider.fetch(undefined, { besideProfiles: true }),
             });
         }
         rows.push(...profiles.map(profile => ({
             id: `${provider.id}:${profile}`,
             name: `${provider.name} (${profile})`,
-            fetch: () => provider.fetch(credentialProfileStoreHome(getAgendHome(), backendName, profile)),
+            fetch: () => provider.fetch(credentialProfileStoreHome(getAgendHome(), backendName, profile), { profile }),
         })));
         return rows;
     });
@@ -1302,7 +1425,7 @@ function hasEffectiveSharedBinding(config, backendName) {
     const instances = config.instances ?? {};
     let sawEffectiveBinding = false;
     for (const instance of Object.values(instances)) {
-        const backend = instance.backend ?? defaults?.backend;
+        const backend = instance.backend ?? defaultBackend(defaults);
         if (backend !== backendName)
             continue;
         sawEffectiveBinding = true;
@@ -1313,12 +1436,20 @@ function hasEffectiveSharedBinding(config, backendName) {
     // backend is this provider and no profile was configured.  With no known
     // binding at all, preserve the pre-profile shared-provider behaviour.
     if (!sawEffectiveBinding) {
-        if (defaults?.backend === backendName && !instanceCredentialProfile(undefined, defaults, backendName))
+        if (defaultBackend(defaults) === backendName && !instanceCredentialProfile(undefined, defaults, backendName))
             return true;
         return Object.keys(instances).length === 0;
     }
     return false;
 }
+/**
+ * The backend an instance without one runs: the fleet default, else Claude Code — as the fleet launches it
+ * (fleet-manager's bindings). Claude Code is the backend instances most often leave unnamed, so without this a
+ * Claude profile on such an instance had no row of its own (#1699).
+ */
+function defaultBackend(defaults) {
+    return defaults?.backend ?? "claude-code";
+}
 /** Profiles on effective bindings only (not dormant backend_options on another backend). */
 function effectiveCredentialProfiles(config, backendName) {
     if (!config)
@@ -1326,14 +1457,14 @@ function effectiveCredentialProfiles(config, backendName) {
     const found = new Set();
     const defaults = config.defaults;
     for (const instance of Object.values(config.instances ?? {})) {
-        const backend = instance.backend ?? defaults?.backend;
+        const backend = instance.backend ?? defaultBackend(defaults);
         if (backend !== backendName)
             continue;
         const profile = bindingProfile(instance, defaults, backendName);
         if (profile)
             found.add(profile);
     }
-    if (Object.keys(config.instances ?? {}).length === 0 && defaults?.backend === backendName) {
+    if (Object.keys(config.instances ?? {}).length === 0 && defaultBackend(defaults) === backendName) {
         const profile = instanceCredentialProfile(undefined, defaults, backendName);
         if (profile)
             found.add(profile);
@@ -1387,6 +1518,8 @@ function usageBackendForProviderId(id) {
         return "kiro-cli";
     if (id === "codex")
         return "codex";
+    if (id === "claude")
+        return "claude-code";
     return null;
 }
 let PROVIDERS = DEFAULT_PROVIDERS;