@usepowerplant/cli 0.4.20 → 0.4.21

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9f447c4d-0ccb-5f45-8960-6853e28aadfb")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9ee35b05-7453-5338-85ff-5dc1b6010221")}catch(e){}}();
 const __cliNodeMajor = Number(process.versions.node.split('.')[0]);
 if (__cliNodeMajor < 20) {
   console.error(`powerplant needs Node 20 or newer — this is Node ${process.versions.node}.`);
@@ -23886,7 +23886,7 @@ var require_mock_interceptor = __commonJS({
 var require_mock_client = __commonJS({
   "../../node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/mock-client.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify2 } = __require("node:util");
+    var { promisify: promisify3 } = __require("node:util");
     var Client2 = require_client();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -23934,7 +23934,7 @@ var require_mock_client = __commonJS({
         this[kDispatches] = [];
       }
       async [kClose]() {
-        await promisify2(this[kOriginalClose])();
+        await promisify3(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -24147,7 +24147,7 @@ var require_mock_call_history = __commonJS({
 var require_mock_pool = __commonJS({
   "../../node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/mock-pool.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify2 } = __require("node:util");
+    var { promisify: promisify3 } = __require("node:util");
     var Pool = require_pool();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -24195,7 +24195,7 @@ var require_mock_pool = __commonJS({
         this[kDispatches] = [];
       }
       async [kClose]() {
-        await promisify2(this[kOriginalClose])();
+        await promisify3(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -59131,30 +59131,99 @@ var SECRET_QUERY_PARAM_PATTERN = /^(?:token|access_token|refresh_token|id_token|
 var BEARER_TOKEN_PATTERN = /\bBearer\s+[\w\-._~+/=]+/gi;
 var JWT_PATTERN = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var EMBEDDED_QUERY_SECRET_PATTERN = /([?&](?:token|access_token|refresh_token|id_token|api_key|apikey|key|code|signature|password|secret|client_secret|state)=)[^&\s#]+/gi;
-var URL_FIELD_NAMES = /* @__PURE__ */ new Set(["url", "to", "from", "href", "request_url"]);
+var URL_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "url",
+  "to",
+  "from",
+  "href",
+  "request_url",
+  "referer",
+  "url.full",
+  "http.url",
+  "http.target",
+  "url.path"
+]);
+var KEPT_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "accept",
+  "content-encoding",
+  "content-length",
+  "content-type",
+  "host",
+  "mcp-protocol-version",
+  "referer",
+  "user-agent",
+  "x-github-event",
+  "x-powerplant-cli-version"
+]);
+var KEPT_HTTP_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "http.method",
+  "http.request.method",
+  "http.request.method_original",
+  "http.route",
+  "http.status_code",
+  "http.status_text",
+  "http.response.status_code",
+  "http.scheme",
+  "http.host",
+  "http.flavor",
+  "http.request_content_length_uncompressed",
+  "url.scheme",
+  "url.full",
+  "http.url",
+  "http.target",
+  "url.path"
+]);
+var HTTP_ATTRIBUTE_PREFIX = /^(?:http|url)\./;
+var URL_PARTS = /^([a-z][a-z\d+.-]*:\/\/)([^/?#]*)([^?#]*)/i;
+var PATH_KEPT_HOSTS = /(?:^|\.)(?:supabase\.co|usepowerplant\.com)$/i;
+var OUTGOING_ROUTES = [
+  // GitHub REST API
+  "/app/installations/{installation_id}/access_tokens",
+  "/app/installations/{installation_id}",
+  "/installation/repositories",
+  "/orgs/{org}/memberships/{username}",
+  "/repos/{owner}/{repo}/contents/{path}",
+  "/user/installations",
+  "/user/{account_id}",
+  // GitHub sign-in
+  "/login/oauth/access_token",
+  // Cursor API
+  "/v1/agents",
+  "/v1/agents/{agent_id}",
+  "/v1/agents/{agent_id}/runs",
+  "/v1/agents/{agent_id}/runs/{run_id}",
+  "/v1/agents/{agent_id}/runs/{run_id}/stream",
+  "/teams/filtered-usage-events"
+];
+var OUTGOING_URL_FIELD_NAMES = ["url", "url.full", "http.url"];
+var OUTGOING_PATH_FIELD_NAMES = ["url.path", "http.target"];
 var MAX_DEPTH = 10;
 function scrubString(value) {
   return value.replace(POWERPLANT_TOKEN_PATTERN, REDACTED3).replace(BEARER_TOKEN_PATTERN, `Bearer ${REDACTED3}`).replace(JWT_PATTERN, REDACTED3).replace(EMBEDDED_QUERY_SECRET_PATTERN, `$1${REDACTED3}`);
 }
 function scrubUrl(url2) {
-  if (!url2) return url2;
-  const PLACEHOLDER_ORIGIN = "https://scrub.invalid";
-  let parsed;
-  try {
-    parsed = new URL(url2, PLACEHOLDER_ORIGIN);
-  } catch {
-    return url2;
-  }
-  let mutated = false;
-  for (const key of [...parsed.searchParams.keys()]) {
-    if (SECRET_QUERY_PARAM_PATTERN.test(key)) {
-      parsed.searchParams.set(key, REDACTED3);
-      mutated = true;
-    }
-  }
-  if (!mutated) return url2;
-  const result = parsed.toString();
-  return url2.startsWith(PLACEHOLDER_ORIGIN) || !url2.includes("://") ? result.replace(PLACEHOLDER_ORIGIN, "") : result;
+  const queryStart = url2.search(/[?#]/);
+  return queryStart === -1 ? url2 : url2.slice(0, queryStart);
+}
+function scrubOutgoingUrl(url2) {
+  const parts = URL_PARTS.exec(url2);
+  if (!parts) return REDACTED3;
+  const [, scheme = "", authority = "", path38 = ""] = parts;
+  const host = authority.slice(authority.lastIndexOf("@") + 1);
+  const origin = `${scheme}${host}`;
+  if (PATH_KEPT_HOSTS.test(host.replace(/:\d*$/, ""))) return `${origin}${path38}`;
+  const route = OUTGOING_ROUTES.find((template) => fitsRoute(path38, template));
+  return `${origin}${route ?? ""}`;
+}
+function fitsRoute(path38, template) {
+  const segments = path38.replace(/(.)\/$/, "$1").split("/");
+  const route = template.split("/");
+  const hasRest = route.at(-1) === "{path}";
+  const fixed = hasRest ? route.slice(0, -1) : route;
+  if (hasRest ? segments.length < fixed.length : segments.length !== fixed.length) return false;
+  return fixed.every(
+    (part, index) => part.startsWith("{") ? segments[index] !== "" : part === segments[index]
+  );
 }
 function scrubValue(value, depth = 0) {
   if (depth > MAX_DEPTH || value == null) return value;
@@ -59163,9 +59232,10 @@ function scrubValue(value, depth = 0) {
   if (typeof value !== "object") return value;
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (SECRET_KEY_PATTERN.test(key) || SECRET_QUERY_PARAM_PATTERN.test(key)) {
+    const name = key.toLowerCase();
+    if (SECRET_KEY_PATTERN.test(key) || SECRET_QUERY_PARAM_PATTERN.test(key) || HTTP_ATTRIBUTE_PREFIX.test(name) && !KEPT_HTTP_ATTRIBUTES.has(name)) {
       out[key] = REDACTED3;
-    } else if (URL_FIELD_NAMES.has(key.toLowerCase()) && typeof child === "string") {
+    } else if (URL_FIELD_NAMES.has(name) && typeof child === "string") {
       out[key] = scrubUrl(child);
     } else {
       out[key] = scrubValue(child, depth + 1);
@@ -59178,17 +59248,21 @@ function scrubSentryEvent(event) {
     if (typeof event.request.url === "string") {
       event.request.url = scrubUrl(event.request.url);
     }
-    if (typeof event.request.query_string === "string") {
-      event.request.query_string = scrubUrl(`?${event.request.query_string}`).replace(/^\?/, "");
+    if (event.request.query_string !== void 0) {
+      event.request.query_string = REDACTED3;
     }
     if (event.request.headers) {
-      event.request.headers = scrubValue(event.request.headers);
+      const headers = Object.entries(event.request.headers).map(([name, value]) => [
+        name,
+        KEPT_HEADER_NAMES.has(name.toLowerCase()) ? value : REDACTED3
+      ]);
+      event.request.headers = scrubValue(Object.fromEntries(headers));
     }
     if (event.request.cookies !== void 0) {
       event.request.cookies = REDACTED3;
     }
     if (event.request.data !== void 0) {
-      event.request.data = scrubValue(event.request.data);
+      event.request.data = REDACTED3;
     }
   }
   if (event.exception?.values) {
@@ -59210,14 +59284,45 @@ function scrubSentryEvent(event) {
   if (Array.isArray(event.breadcrumbs)) {
     event.breadcrumbs = event.breadcrumbs.map(scrubBreadcrumb);
   }
+  for (const span of event.spans ?? []) {
+    if (typeof span.description === "string") {
+      span.description = scrubString(span.description);
+    }
+    if (span.data) {
+      span.data = scrubValue(span.data);
+    }
+    if (span.op === "http.client") {
+      scrubOutgoingRequestSpan(span);
+    }
+  }
   return event;
 }
+function scrubOutgoingRequestSpan(span) {
+  if (typeof span.description === "string") {
+    const [method, ...target] = span.description.split(" ");
+    if (target.length > 0) {
+      span.description = `${method} ${scrubOutgoingUrl(target.join(" "))}`;
+    }
+  }
+  const data = span.data;
+  if (!data) return;
+  for (const name of OUTGOING_URL_FIELD_NAMES) {
+    const value = data[name];
+    if (typeof value === "string") data[name] = scrubOutgoingUrl(value);
+  }
+  for (const name of OUTGOING_PATH_FIELD_NAMES) {
+    if (name in data) data[name] = REDACTED3;
+  }
+}
 function scrubBreadcrumb(breadcrumb) {
   if (typeof breadcrumb.message === "string") {
     breadcrumb.message = scrubString(breadcrumb.message);
   }
   if (breadcrumb.data) {
     breadcrumb.data = scrubValue(breadcrumb.data);
+    if (breadcrumb.category === "http" && typeof breadcrumb.data.url === "string") {
+      breadcrumb.data.url = scrubOutgoingUrl(breadcrumb.data.url);
+    }
   }
   return breadcrumb;
 }
@@ -59416,9 +59521,10 @@ function parseCodexChildThread(sessionMeta) {
 // ../core/src/recentSessionPage.ts
 var RECENT_SESSION_WINDOW_MS = 72 * 60 * 60 * 1e3;
 var RECENT_SESSION_VISIBLE_LIMIT = 12;
+var RECENT_SESSION_PAGE_MAX = 40;
 var recentSessionOptionsSchema = external_exports.object({
   windowHours: external_exports.coerce.number().int().min(1).max(120).default(72),
-  limit: external_exports.coerce.number().int().min(1).max(40).default(12)
+  limit: external_exports.coerce.number().int().min(1).max(RECENT_SESSION_PAGE_MAX).default(12)
 });
 var recentSessionCursorSchema = external_exports.object({
   at: external_exports.iso.datetime({ offset: true }),
@@ -86582,40 +86688,45 @@ function readCodexTranscriptDiscoveryRecords(home, roots) {
   } catch {
     return [];
   }
-  const result = [];
-  for (const file2 of files) {
-    if (!/^[a-f0-9]{64}\.json$/.test(file2)) continue;
+  return files.flatMap((file2) => {
+    if (!/^[a-f0-9]{64}\.json$/.test(file2)) return [];
+    const record2 = readRecord(path2.join(dir, file2), roots);
+    return record2 === null ? [] : [record2];
+  });
+}
+function readCodexTranscriptDiscoveryRecord(home, sessionId, roots) {
+  return readRecord(codexTranscriptRecordPath(home, sessionId), roots);
+}
+function readRecord(recordPath, roots) {
+  try {
+    if (!lstatSync(recordPath).isFile()) return null;
+    const fd = openSync(recordPath, "r");
+    let text;
     try {
-      const recordPath = path2.join(dir, file2);
-      if (!lstatSync(recordPath).isFile()) continue;
-      const fd = openSync(recordPath, "r");
-      let text;
-      try {
-        const buffer = Buffer.alloc(32 * 1024 + 1);
-        const read = readSync(fd, buffer, 0, buffer.length, null);
-        if (read === buffer.length) continue;
-        text = buffer.subarray(0, read).toString("utf8");
-      } finally {
-        closeSync(fd);
-      }
-      const record2 = transcriptDiscoveryRecordSchema.parse(JSON.parse(text));
-      if (file2 !== `${createHash("sha256").update(record2.sessionId).digest("hex")}.json`) continue;
-      if (record2.transcriptPath === null || !path2.isAbsolute(record2.transcriptPath)) continue;
-      const rolloutPath = path2.normalize(record2.transcriptPath);
-      if (path2.extname(rolloutPath) !== ".jsonl") continue;
-      const rootIndex = roots.findIndex((root2) => {
-        const relative2 = path2.relative(root2, rolloutPath);
-        return relative2 !== "" && relative2 !== ".." && !relative2.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative2);
-      });
-      if (rootIndex < 0 || !lstatSync(rolloutPath).isFile()) continue;
-      const root = roots[rootIndex];
-      if (realpathSync(rolloutPath) !== path2.join(realpathSync(root), path2.relative(root, rolloutPath)))
-        continue;
-      result.push({ rolloutPath, sessionId: record2.sessionId, archived: rootIndex === 1 });
-    } catch {
-    }
+      const buffer = Buffer.alloc(32 * 1024 + 1);
+      const read = readSync(fd, buffer, 0, buffer.length, null);
+      if (read === buffer.length) return null;
+      text = buffer.subarray(0, read).toString("utf8");
+    } finally {
+      closeSync(fd);
+    }
+    const record2 = transcriptDiscoveryRecordSchema.parse(JSON.parse(text));
+    if (path2.basename(recordPath) !== `${createHash("sha256").update(record2.sessionId).digest("hex")}.json`) return null;
+    if (record2.transcriptPath === null || !path2.isAbsolute(record2.transcriptPath)) return null;
+    const rolloutPath = path2.normalize(record2.transcriptPath);
+    if (path2.extname(rolloutPath) !== ".jsonl") return null;
+    const rootIndex = roots.findIndex((root2) => {
+      const relative2 = path2.relative(root2, rolloutPath);
+      return relative2 !== "" && relative2 !== ".." && !relative2.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative2);
+    });
+    if (rootIndex < 0 || !lstatSync(rolloutPath).isFile()) return null;
+    const root = roots[rootIndex];
+    if (realpathSync(rolloutPath) !== path2.join(realpathSync(root), path2.relative(root, rolloutPath)))
+      return null;
+    return { rolloutPath, sessionId: record2.sessionId, archived: rootIndex === 1 };
+  } catch {
+    return null;
   }
-  return result;
 }
 
 // ../../apps/syncservice/src/diagnostics.ts
@@ -86624,7 +86735,7 @@ import { createHmac } from "node:crypto";
 // ../../apps/syncservice/src/http.ts
 var import_undici = __toESM(require_undici(), 1);
 var CLI_VERSION_HEADER = "x-powerplant-cli-version";
-var cliVersion = true ? "0.4.20" : "0.0.0-checkout";
+var cliVersion = true ? "0.4.21" : "0.0.0-checkout";
 function cliVersionHeaders() {
   return { [CLI_VERSION_HEADER]: cliVersion, "user-agent": `powerplant-cli/${cliVersion}` };
 }
@@ -87717,7 +87828,7 @@ function mayBeParentOf(parent, childMadeMs) {
 function mayBeChildOf(threadTimeMs, parentTimeMs) {
   return threadTimeMs === void 0 || parentTimeMs === void 0 || threadTimeMs + THREAD_ID_TIME_MARGIN_MS >= parentTimeMs;
 }
-var CodexThreadLinks = class {
+var CodexThreadLinks = class _CodexThreadLinks {
   /** `readLink` is a test seam for the first-record read. */
   constructor(readLink = readThreadLink) {
     this.readLink = readLink;
@@ -87743,6 +87854,19 @@ var CodexThreadLinks = class {
    * (settleRecoveries), with the session the last pass made of it and how
    * many uploads of it failed. */
   recovering = /* @__PURE__ */ new Map();
+  /** A copy for a pass that runs beside the watcher's own passes (the
+   * new-session pass), so neither changes what the other knows. It keeps
+   * what each rollout's first record showed, and leaves out the rollouts
+   * and threads owed another read or a corrected capture, which only the
+   * watcher's own passes settle. */
+  copyForSidePass() {
+    const copy = new _CodexThreadLinks(this.readLink);
+    for (const [rolloutPath, link] of this.byPath) copy.byPath.set(rolloutPath, link);
+    for (const [rolloutPath, changedMs] of this.failedAt) copy.failedAt.set(rolloutPath, changedMs);
+    for (const [rolloutPath, state] of this.incomplete) copy.incomplete.set(rolloutPath, { ...state });
+    for (const rolloutPath of this.faulted) copy.faulted.add(rolloutPath);
+    return copy;
+  }
   /** Keeps what another read of the same first record found. */
   remember(rolloutPath, link) {
     this.byPath.set(rolloutPath, link);
@@ -87980,7 +88104,7 @@ var CodexThreadLinks = class {
     return true;
   }
 };
-var CodexThreadReads = class {
+var CodexThreadReads = class _CodexThreadReads {
   byThread = /* @__PURE__ */ new Map();
   /** What a full read found when the thread's files were `files`
    * (threadFilesKey): its summary and prefix, null for a thread holding no
@@ -87992,6 +88116,14 @@ var CodexThreadReads = class {
   set(threadId2, files, read) {
     this.byThread.set(threadId2, { files, read });
   }
+  /** A copy for a pass that runs beside the watcher's own passes. Each read
+   * is kept for exactly the files it was made from, so a copy never serves
+   * a read of files that have since changed. */
+  copyForSidePass() {
+    const copy = new _CodexThreadReads();
+    for (const [threadId2, kept] of this.byThread) copy.byThread.set(threadId2, kept);
+    return copy;
+  }
   /** Forgets the threads no longer on this machine. */
   keepOnly(threadIds) {
     for (const threadId2 of this.byThread.keys()) if (!threadIds.has(threadId2)) this.byThread.delete(threadId2);
@@ -90295,8 +90427,10 @@ var collectorStatusSchema = external_exports.object({
   /** Last pass that completed without error — everything eligible had been
    * uploaded as of this time. */
   lastSyncAt: external_exports.string().optional(),
-  /** Last pass that upserted at least one session; missing = no session
-   * has uploaded in this daemon's lifetime, not "never". */
+  /** When the server last stored a changed session record, from any pass,
+   * a recent catch-up inside one included. The next run of the same
+   * enrollment carries it (carriedUploadClock). Missing: no upload in this
+   * run or the one before it, not "never". */
   lastUploadAt: external_exports.string().optional(),
   consecutiveFailures: external_exports.number().int().nonnegative(),
   /** Whether the hooks this daemon installed are firing, per harness
@@ -90867,7 +91001,7 @@ function saveCredentials(appEnv, credentials) {
 function loadCredentials(appEnv) {
   if (process.platform === "darwin") {
     const raw2 = new MacosCredentialStore(appEnv).load();
-    return raw2 === null ? null : parseStoredCredentials(raw2, appEnv);
+    return raw2 === null ? null : withCurrentApiUrl(appEnv, parseStoredCredentials(raw2, appEnv));
   }
   let raw;
   try {
@@ -90879,7 +91013,19 @@ function loadCredentials(appEnv) {
       { cause }
     );
   }
-  return parseStoredCredentials(raw, appEnv);
+  return withCurrentApiUrl(appEnv, parseStoredCredentials(raw, appEnv));
+}
+var RETIRED_API_URLS = {
+  production: { retired: "https://api.powerplant.sh", replacement: "https://api.usepowerplant.com" },
+  staging: {
+    retired: "https://staging.api.powerplant.sh",
+    replacement: "https://staging.api.usepowerplant.com"
+  }
+};
+function withCurrentApiUrl(appEnv, credentials) {
+  const moved = RETIRED_API_URLS[appEnv];
+  if (moved === void 0 || credentials.apiUrl !== moved.retired) return credentials;
+  return { ...credentials, apiUrl: moved.replacement };
 }
 function isCredentialStoreAbsent(cause) {
   return cause instanceof Error && "code" in cause && cause.code === "ENOENT";
@@ -90912,7 +91058,9 @@ import os14 from "node:os";
 
 // ../../apps/syncservice/src/upload.ts
 import { readFileSync as readFileSync10 } from "node:fs";
-import { gzipSync } from "node:zlib";
+import { setImmediate as yieldToEventLoop3 } from "node:timers/promises";
+import { promisify as promisify2 } from "node:util";
+import { gzip } from "node:zlib";
 
 // ../../apps/syncservice/src/claudeCode.ts
 import { readdirSync as readdirSync6 } from "node:fs";
@@ -91490,8 +91638,20 @@ async function uploadPreviewRegistration(apiUrl, machineToken, registration) {
   }
   return "registered";
 }
-function encodeRawTranscript(text) {
-  return gzipSync(redactJsonl(text));
+var gzipAsync = promisify2(gzip);
+var REDACT_SLICE_CHARS = 64 * 1024;
+async function encodeRawTranscript(text) {
+  const lines = text.split("\n");
+  let sliceChars = 0;
+  for (const [index, line] of lines.entries()) {
+    lines[index] = redactJsonl(line);
+    sliceChars += line.length;
+    if (sliceChars >= REDACT_SLICE_CHARS) {
+      await yieldToEventLoop3();
+      sliceChars = 0;
+    }
+  }
+  return gzipAsync(lines.join("\n"));
 }
 function readCollectedTranscript(file2, prefix) {
   return prefix === void 0 ? readFileSync10(file2, "utf8") : readTranscriptPrefix(file2, prefix, false);
@@ -91501,8 +91661,8 @@ function readUnchangedTranscript(file2, prefix) {
 }
 var BUNDLE_HEADER_BYTES = 256;
 var BUNDLE_HEADER_BYTES_PER_PART = 256;
-function rawUploadBody(session, readTranscript, maxBytes = MAX_RAW_UPLOAD_BYTES) {
-  const main2 = encodeRawTranscript(readTranscript(session.transcriptPath, session.transcriptPrefix));
+async function rawUploadBody(session, readTranscript, maxBytes = MAX_RAW_UPLOAD_BYTES) {
+  const main2 = await encodeRawTranscript(readTranscript(session.transcriptPath, session.transcriptPrefix));
   if (session.subagents === void 0) {
     return main2.byteLength > maxBytes ? "too-large" : { body: main2, main: main2, contentType: "application/gzip", skippedSubagentFiles: 0, unreadableSubagentFiles: 0 };
   }
@@ -91514,7 +91674,7 @@ function rawUploadBody(session, readTranscript, maxBytes = MAX_RAW_UPLOAD_BYTES)
   for (const file2 of session.subagents.files) {
     let body;
     try {
-      body = encodeRawTranscript(readTranscript(file2.path, file2.prefix));
+      body = await encodeRawTranscript(readTranscript(file2.path, file2.prefix));
     } catch (error63) {
       if (error63 instanceof TranscriptChangedError) throw error63;
       skipped += 1;
@@ -91588,7 +91748,7 @@ async function uploadRawSessions(apiUrl, machineToken, transcriptUploadSources,
       continue;
     }
     try {
-      const encoded = rawUploadBody(session, readTranscript);
+      const encoded = await rawUploadBody(session, readTranscript);
       if (encoded === "too-large") {
         summary.skippedTooLarge += 1;
         summary.outcomes.set(key, "too-large");
@@ -92523,7 +92683,16 @@ var codexLocal = {
   transcriptSession(transcriptPath) {
     const identity = rolloutIdentity(transcriptPath);
     return identity.page ? { hookId: identity.threadId } : { externalId: path18.basename(transcriptPath, ".jsonl") };
-  }
+  },
+  // The hook records the rollout of each thread before it appends the
+  // journal line (.claude/hooks/powerplant-codex-transcript.mjs).
+  hookTranscriptPath(threadId2, homeDir) {
+    const sessionsDir = path18.join(homeDir, ".codex", "sessions");
+    return readCodexTranscriptDiscoveryRecord(homeDir, threadId2, [sessionsDir, codexArchivedSessionsDir(sessionsDir)])?.rolloutPath;
+  },
+  // The Codex app holds the rollout of each open thread for writing
+  // (lsof, 2026-09-27), and macOS reports a write to it only on close.
+  holdsTranscriptOpen: true
 };
 var cursorLocal = {
   harness: "cursor-local",
@@ -93429,6 +93598,7 @@ function readIfExists2(p) {
 }
 
 // ../../apps/syncservice/src/previewRegistration.ts
+import { setImmediate as yieldToEventLoop4 } from "node:timers/promises";
 async function registerAnnouncedPreviews(apiUrl, machineToken, collected, memo2, deps = {}) {
   const readTranscript = deps.readTranscript ?? readIfExists;
   const upload = deps.upload ?? uploadPreviewRegistration;
@@ -93444,6 +93614,7 @@ async function registerAnnouncedPreviews(apiUrl, machineToken, collected, memo2,
     const state = memo2.get(key);
     if (state?.foreignOwner || state?.previewsOff) continue;
     if (state?.examinedMtimeMs === session.mtimeMs) continue;
+    await yieldToEventLoop4();
     try {
       const text = readTranscript(session.transcriptPath);
       if (text === null) continue;
@@ -93489,6 +93660,22 @@ async function registerAnnouncedPreviews(apiUrl, machineToken, collected, memo2,
 }
 
 // ../../apps/syncservice/src/sync.ts
+var RecordTurns = class {
+  last = Promise.resolve();
+  /** Waits for the passes ahead, then returns `end`, which lets the next
+   * pass take its turn. Calling `end` again does nothing. */
+  async take() {
+    let end = () => {
+    };
+    const ended = new Promise((resolve2) => {
+      end = resolve2;
+    });
+    const ahead = this.last;
+    this.last = ahead.then(() => ended);
+    await ahead;
+    return end;
+  }
+};
 var defaultPolicyDeps = {
   fetchPolicy: fetchCapturePolicy,
   load: loadCredentials,
@@ -93590,7 +93777,17 @@ async function resolveCapturePolicy(config2, credentials, log3, deps = defaultPo
     environment
   };
 }
-async function runSyncPassInternal(config2, options, diagnostic) {
+function recordTurn(turns) {
+  let end = () => {
+  };
+  return {
+    start: async () => {
+      if (turns) end = await turns.take();
+    },
+    end: () => end()
+  };
+}
+async function runSyncPassInternal(config2, options, diagnostic, turn) {
   const log3 = options.log ?? console.log;
   const credentials = loadCredentials(config2.appEnv);
   if (!credentials) {
@@ -93616,6 +93813,7 @@ async function runSyncPassInternal(config2, options, diagnostic) {
   diagnostic.sinceMs = sinceMs;
   diagnostic.deepSweep = window2.deepSweep;
   const maxSessions = window2.deepSweep ? DEEP_FIRST_SYNC_MAX_SESSIONS : void 0;
+  await turn.start();
   diagnostic.stage = "claude";
   const claude = await collectClaudeCodeSessions({
     sinceMs,
@@ -93726,12 +93924,14 @@ async function runSyncPassInternal(config2, options, diagnostic) {
     credentials.token,
     items
   );
+  turn.end();
   const foreignKeys = new Set(foreignOwned.map(sessionKey));
   const writable = collected.filter(({ item }) => !foreignKeys.has(sessionKey(item)));
   for (const { harness, harnessSessionId } of foreignOwned) {
     log3(`Skipped ${harness} session ${harnessSessionId}: already synced from another machine.`);
   }
   Object.assign(diagnostic, { upserted, unchanged, outOfPolicy, deferred });
+  if (upserted > 0) options.onRecordsUpserted?.();
   log3(
     `Uploaded: ${upserted} session(s) upserted` + (unchanged > 0 ? `, ${unchanged} unchanged (no writes issued)` : "") + "."
   );
@@ -93863,8 +94063,9 @@ async function runSyncPass(config2, options = {}) {
     }
   };
   notify();
+  const turn = recordTurn(options.recordTurns);
   try {
-    const result = await runSyncPassInternal(config2, options, diagnostic);
+    const result = await runSyncPassInternal(config2, options, diagnostic, turn);
     diagnostic.outcome = "complete";
     diagnostic.stage = "complete";
     diagnostic.upserted = result.upserted;
@@ -93877,6 +94078,7 @@ async function runSyncPass(config2, options = {}) {
     if (error63 instanceof Error) failedPasses.set(error63, diagnostic);
     throw error63;
   } finally {
+    turn.end();
     diagnostic.durationMs = Math.max(0, Date.now() - start);
     notify();
   }
@@ -93939,7 +94141,7 @@ function unsupportedVersionNotice(cliVersion2, oldestSupportedVersion) {
 }
 
 // ../../apps/syncservice/src/watch.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync11, watch as fsWatch2 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync11, watch as fsWatch3 } from "node:fs";
 import os19 from "node:os";
 import path21 from "node:path";
 
@@ -93973,7 +94175,7 @@ function defaultStat(file2) {
 }
 
 // ../../apps/syncservice/src/sessionStatusFeed.ts
-import { statSync as statSync5 } from "node:fs";
+import { statSync as statSync5, watch as fsWatch2 } from "node:fs";
 
 // ../../apps/syncservice/src/sessionStatusModel.ts
 function createSessionStatusModel(now = Date.now) {
@@ -94024,11 +94226,13 @@ function createSessionStatusModel(now = Date.now) {
 // ../../apps/syncservice/src/sessionStatusFeed.ts
 var TRANSCRIPT_WRITE_DELAY_MS = 500;
 var HELD_HOOK_ENTRIES_MAX = 500;
+var TRANSCRIPT_FILE_WATCHES_MAX = 32;
 var HOOK_ID_PAIRS_MAX = 1e4;
 var MAX_TIMER_MS = 2 ** 31 - 1;
 function createSessionStatusFeed(deps) {
   const now = deps.now ?? Date.now;
   const adapters = deps.adapters ?? HARNESS_ADAPTERS;
+  const watchFile = deps.watchFile ?? watchFileWrites;
   const model = createSessionStatusModel(now);
   const adapterOf = (harness) => adapters.find((adapter) => adapter.harness === harness);
   const hookIdOf = (harness) => adapterOf(harness)?.hookSessionId;
@@ -94040,8 +94244,34 @@ function createSessionStatusFeed(deps) {
   let readQueued = false;
   let readFailing = false;
   let statFailing = false;
+  let watchFailing = false;
   const writeTimers = /* @__PURE__ */ new Map();
+  const hookFilesRead = /* @__PURE__ */ new Set();
+  const reportedFiles = /* @__PURE__ */ new Map();
+  const fileWatches = /* @__PURE__ */ new Map();
   let stopped = false;
+  function applyJournalEntry(entry) {
+    if (learnFromHookFile(entry.harness, entry.sessionId)) releaseHeld();
+    apply(entry);
+  }
+  function learnFromHookFile(harness, hookId) {
+    const adapter = adapterOf(harness);
+    const hookIdOfStored = adapter?.hookSessionId;
+    const key = pairKey(harness, hookId);
+    if (adapter?.hookTranscriptPath === void 0 || hookIdOfStored === void 0 || hookFilesRead.has(key)) {
+      return false;
+    }
+    hookFilesRead.add(key);
+    const file2 = adapter.hookTranscriptPath(hookId, deps.home);
+    const session = file2 === void 0 ? void 0 : adapter.transcriptSession?.(file2);
+    if (file2 === void 0 || session === void 0) return false;
+    const fileHookId = "externalId" in session ? hookIdOfStored(session.externalId) : session.hookId;
+    if (pairKey(harness, fileHookId) !== key) return false;
+    const externalId = "externalId" in session ? session.externalId : storedIds.get(key);
+    if (externalId === void 0) return false;
+    reportFile(file2, { harness, externalId });
+    return "externalId" in session && learnPair(harness, externalId);
+  }
   function stored(entry) {
     if (hookIdOf(entry.harness) === void 0) return entry;
     const storedId = storedIds.get(pairKey(entry.harness, entry.sessionId));
@@ -94083,8 +94313,66 @@ function createSessionStatusFeed(deps) {
     if (mtimeMs === null) return;
     const learned = "externalId" in session && learnPair(harness, externalId);
     applyWrite(harness, externalId, mtimeMs);
+    reportFile(transcriptPath, { harness, externalId });
     if (learned) releaseHeld();
   }
+  function reportFile(file2, session) {
+    if (adapterOf(session.harness)?.holdsTranscriptOpen !== true) return;
+    reportedFiles.delete(file2);
+    reportedFiles.set(file2, session);
+  }
+  function needsFileWatch(session) {
+    const status = model.status(session.harness, session.externalId);
+    return status !== void 0 && status !== "ended";
+  }
+  function watchReportedFiles() {
+    for (const [file2, watched] of fileWatches) {
+      if (!needsFileWatch(watched)) closeFileWatch(file2);
+    }
+    const newest = [...reportedFiles].filter(([, session]) => needsFileWatch(session)).slice(-TRANSCRIPT_FILE_WATCHES_MAX);
+    reportedFiles.clear();
+    for (const [file2, session] of newest) {
+      const watched = fileWatches.get(file2);
+      if (watched === void 0) {
+        openFileWatch(file2, session);
+      } else {
+        fileWatches.delete(file2);
+        fileWatches.set(file2, watched);
+      }
+    }
+    while (fileWatches.size > TRANSCRIPT_FILE_WATCHES_MAX) closeFileWatch(fileWatches.keys().next().value);
+  }
+  function openFileWatch(file2, session) {
+    let close2;
+    try {
+      close2 = watchFile(
+        file2,
+        () => noteWrite(session.harness, file2),
+        (error63) => {
+          closeFileWatch(file2);
+          noteWatchFailure(error63);
+        }
+      );
+    } catch (error63) {
+      if (errorCode(error63) !== "ENOENT") noteWatchFailure(error63);
+      return;
+    }
+    if (watchFailing) deps.log("transcript files watched again");
+    watchFailing = false;
+    fileWatches.set(file2, { ...session, close: close2 });
+    const mtimeMs = modifiedMs(file2);
+    if (mtimeMs !== null) applyWrite(session.harness, session.externalId, mtimeMs);
+  }
+  function closeFileWatch(file2) {
+    fileWatches.get(file2)?.close();
+    fileWatches.delete(file2);
+  }
+  function noteWatchFailure(error63) {
+    if (!watchFailing) {
+      deps.log(`\u26A0 transcript file not watched (${errorCode(error63)}), its status waits for hook events and sync passes`);
+    }
+    watchFailing = true;
+  }
   function modifiedMs(transcriptPath) {
     try {
       const mtimeMs = statSync5(transcriptPath).mtimeMs;
@@ -94092,7 +94380,10 @@ function createSessionStatusFeed(deps) {
       statFailing = false;
       return mtimeMs;
     } catch (error63) {
-      if (errorCode(error63) === "ENOENT") return null;
+      if (errorCode(error63) === "ENOENT") {
+        closeFileWatch(transcriptPath);
+        return null;
+      }
       if (!statFailing) {
         deps.log(`\u26A0 transcript file not read (${errorCode(error63)}), its status waits for the next sync pass`);
       }
@@ -94111,8 +94402,10 @@ function createSessionStatusFeed(deps) {
     timer.unref?.();
     writeTimers.set(transcriptPath, timer);
   }
-  const journal = createLifecycleJournalReader(deps.home, void 0, apply);
+  const journal = createLifecycleJournalReader(deps.home, void 0, applyJournalEntry);
   function settle2() {
+    watchReportedFiles();
+    hookFilesRead.clear();
     armDeadline();
     if (!changedInBatch) return;
     changedInBatch = false;
@@ -94169,6 +94462,7 @@ function createSessionStatusFeed(deps) {
       const floorMs = lifecycleJournalRetentionFloorMs(now());
       model.forgetBefore(floorMs);
       held = held.filter((entry) => Date.parse(entry.at) >= floorMs);
+      settle2();
       journal.deleteExpired(now());
     },
     status: (harness, externalId) => model.status(harness, externalId),
@@ -94177,9 +94471,17 @@ function createSessionStatusFeed(deps) {
       if (deadlineTimer) clearTimeout(deadlineTimer);
       for (const timer of writeTimers.values()) clearTimeout(timer);
       writeTimers.clear();
+      for (const watched of fileWatches.values()) watched.close();
+      fileWatches.clear();
     }
   };
 }
+function watchFileWrites(file2, onWrite, onError2) {
+  const watcher = fsWatch2(file2, onWrite);
+  watcher.on("error", onError2);
+  watcher.unref();
+  return () => watcher.close();
+}
 function errorCode(error63) {
   return error63 instanceof Error && "code" in error63 && typeof error63.code === "string" ? error63.code : "unknown";
 }
@@ -94238,6 +94540,8 @@ function createWatchLoop(deps) {
   const newTranscripts = /* @__PURE__ */ new Map();
   let newSessionTimer = null;
   let newSessionPassDue = false;
+  let newSessionRunning = false;
+  let failedBesidePass = null;
   function onEvent(change) {
     if (stopped) return;
     if (change === "lifecycle") lifecycleChanged = true;
@@ -94269,12 +94573,19 @@ function createWatchLoop(deps) {
       newSessionPassDue = false;
       return;
     }
-    if (running || startupOwed || now() < retryNotBefore) return;
+    if (newSessionRunning) return;
+    if (now() < retryNotBefore) {
+      newSessionTimer ??= setTimeout(() => {
+        newSessionTimer = null;
+        void newSessionPass();
+      }, retryNotBefore - now());
+      return;
+    }
     newSessionPassDue = false;
     const transcripts = [...newTranscripts];
     newTranscripts.clear();
     if (transcripts.length === 0) return;
-    running = true;
+    newSessionRunning = true;
     deps.log(`${transcripts.length} new transcript file(s), uploading new session records now`);
     const startedAt = now();
     const known = new Set(knownSessions);
@@ -94284,21 +94595,22 @@ function createWatchLoop(deps) {
         isNew: (session) => !known.has(sessionKey(session.item))
       });
       for (const session of summary.sessions) rememberSession(session);
-      if (summary.upserted > 0) deps.onNewSessionsUploaded?.(now());
     } catch (error63) {
       const holdMs = Math.max(FAILED_PASS_RETRY_MS, retryAfterMs(error63) ?? 0);
       retryNotBefore = Math.max(retryNotBefore, now() + holdMs);
-      deps.onPassResult?.(failedPassResult("new-session", startedAt, error63));
+      const result = failedPassResult("new-session", startedAt, error63);
+      if (running) failedBesidePass = result;
+      else deps.onPassResult?.(result);
       deps.log(
         `new session records not uploaded (${describeError(error63)}), the next pass uploads them in ${describeDelay(holdMs)}`
       );
     }
     for (const [transcript] of transcripts) rememberTranscript(transcript);
-    running = false;
-    runNext("new-session");
+    newSessionRunning = false;
+    void newSessionPass();
   }
-  function runNext(finished) {
-    if (queued === null || finished === "regular" && newSessionPassDue) void newSessionPass();
+  function runNext() {
+    void newSessionPass();
     if (queued === null || running) return;
     const next = queued === "steady" ? "net" : "change";
     queued = null;
@@ -94385,6 +94697,7 @@ function createWatchLoop(deps) {
         upserted: summary.upserted,
         ...summary.diagnostic && { diagnostic: summary.diagnostic }
       });
+      if (failedBesidePass !== null && now() < retryNotBefore) deps.onPassResult?.(failedBesidePass);
     } catch (error63) {
       consecutiveFailures += 1;
       const signature = errorSignature(error63);
@@ -94400,7 +94713,7 @@ function createWatchLoop(deps) {
         Math.min(FAILED_PASS_RETRY_MS * 2 ** (streakCount - 1), FAILED_PASS_BACKOFF_CAP_MS),
         retryAfterMs(error63) ?? 0
       );
-      retryNotBefore = now() + holdMs;
+      retryNotBefore = Math.max(retryNotBefore, now() + holdMs);
       lifecycleChanged ||= consultLifecycle;
       deps.onPassResult?.(failedPassResult(kind, startedAt, error63));
       const failLine = `${kind} pass failed (${describeError(error63)})`;
@@ -94429,8 +94742,9 @@ function createWatchLoop(deps) {
       }
     }
     running = false;
+    failedBesidePass = null;
     scheduleCompletionCheck();
-    runNext("regular");
+    runNext();
   }
   function scheduleCompletionCheck() {
     if (completionTimer) {
@@ -94517,7 +94831,7 @@ function watchEventChange(root, filename) {
 }
 function watchSessionStores(roots, onEvent, onLost) {
   const watchers = roots.map((root) => {
-    const watcher = fsWatch2(root.dir, { recursive: root.recursive }, (_type, filename) => {
+    const watcher = fsWatch3(root.dir, { recursive: root.recursive }, (_type, filename) => {
       const change = watchEventChange(root, filename);
       if (change !== "ignore") onEvent(change);
     });
@@ -94531,10 +94845,12 @@ function watchSessionStores(roots, onEvent, onLost) {
 function newSessionSyncOptions(shared, sinceMs, isNew) {
   return {
     lifecycleJournal: shared.lifecycleJournal,
-    codexThreadLinks: shared.codexThreadLinks,
-    codexThreadReads: shared.codexThreadReads,
     log: shared.log,
     enrollCommand: shared.enrollCommand,
+    onRecordsUpserted: shared.onRecordsUpserted,
+    recordTurns: shared.recordTurns,
+    codexThreadLinks: shared.codexThreadLinks?.copyForSidePass(),
+    codexThreadReads: shared.codexThreadReads?.copyForSidePass(),
     explicitSince: String(STEADY_SYNC_WINDOW_DAYS),
     narrowSinceMs: sinceMs,
     isNewSession: isNew
@@ -94653,6 +94969,7 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
   });
   const writeStatus = (patch) => statusWriter.write(patch);
   writeStatus({});
+  const recordUpload = () => writeStatus({ lastUploadAt: (/* @__PURE__ */ new Date()).toISOString() });
   const diagnostics = createDiagnosticsReporter(() => loadCredentials(config2.appEnv));
   const checkIn = () => {
     let current;
@@ -94734,6 +95051,7 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
   const previewRegistrations = /* @__PURE__ */ new Map();
   const codexThreadLinks = new CodexThreadLinks();
   const codexThreadReads = new CodexThreadReads();
+  const recordTurns = new RecordTurns();
   const loop = createWatchLoop({
     runPass: async (options) => {
       let uploaded = 0;
@@ -94753,7 +95071,9 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
           uploaded += 1;
           if (uploaded === 1 || uploaded % 10 === 0)
             log3(`Transcript progress: ${uploaded} uploaded this pass.`);
-        }
+        },
+        onRecordsUpserted: recordUpload,
+        recordTurns
       };
       const catchUp = createRecentCatchup(async (narrowSinceMs) => {
         if (readCollectorControl(config2.appEnv, home).paused) return false;
@@ -94798,10 +95118,15 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
       }
       return summary;
     },
-    runNewSessionPass: ({ sinceMs, isNew }) => runSyncPass(config2, newSessionSyncOptions({ lifecycleJournal: journal, codexThreadLinks, codexThreadReads, log: log3, enrollCommand: runtime.enrollCommand }, sinceMs, isNew)),
-    // An upload changes what the menu shows, so this write wakes the menu,
-    // and the menu reads the new session from the server.
-    onNewSessionsUploaded: (at) => writeStatus({ lastUploadAt: new Date(at).toISOString() }),
+    runNewSessionPass: ({ sinceMs, isNew }) => runSyncPass(config2, newSessionSyncOptions({
+      lifecycleJournal: journal,
+      log: log3,
+      enrollCommand: runtime.enrollCommand,
+      onRecordsUpserted: recordUpload,
+      recordTurns,
+      codexThreadLinks,
+      codexThreadReads
+    }, sinceMs, isNew)),
     paused: () => readCollectorControl(config2.appEnv, home).paused,
     onPassResult: (result) => writeStatus({
       lastPass: {
@@ -94814,7 +95139,6 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
         ...result.diagnostic && { diagnostic: result.diagnostic }
       },
       ...result.ok && { lastSyncAt: new Date(result.at).toISOString() },
-      ...result.ok && result.upserted > 0 && { lastUploadAt: new Date(result.at).toISOString() },
       consecutiveFailures: result.ok ? 0 : statusWriter.current.consecutiveFailures + 1
     }),
     reportError: reportCollectorError,
@@ -95231,7 +95555,7 @@ function applyLocalSessionFlags(sessions, machineId, localFlags, localKey, claud
     };
   });
 }
-async function fetchMemberSessions(credentials, fetchImpl = fetch, options = { windowHours: RECENT_SESSION_WINDOW_MS / 36e5, limit: RECENT_SESSION_VISIBLE_LIMIT }) {
+async function fetchMemberSessions(credentials, fetchImpl = fetch, options = { windowHours: RECENT_SESSION_WINDOW_MS / 36e5, limit: RECENT_SESSION_PAGE_MAX }) {
   const { windowHours, limit } = recentSessionOptionsSchema.parse(options);
   try {
     const query = new URLSearchParams({ view: "recent", windowHours: String(windowHours), limit: String(limit) });
@@ -95457,7 +95781,7 @@ async function probeClaudeDesktopSessions(wanted, installed, reportFault, root =
 
 // src/menuModel.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { mkdirSync as mkdirSync17, rmSync as rmSync10, watch as fsWatch3 } from "node:fs";
+import { mkdirSync as mkdirSync17, rmSync as rmSync10, watch as fsWatch4 } from "node:fs";
 import path34 from "node:path";
 
 // src/menu.ts
@@ -95487,7 +95811,7 @@ import { accessSync, constants as constants2, readFileSync as readFileSync15 } f
 import path28 from "node:path";
 
 // src/version.ts
-var CLI_VERSION = true ? "0.4.20" : "0.0.0-checkout";
+var CLI_VERSION = true ? "0.4.21" : "0.0.0-checkout";
 var CLI_RELEASE_BUILD = true ? true : false;
 var CLI_PACKAGE_NAME = "@usepowerplant/cli";
 
@@ -96177,8 +96501,8 @@ function syncHeader(i) {
   if (i.credentials && (i.credentials.captureMode === "scope" || i.credentials.allowedRepos !== void 0 || i.credentials.scopePaths?.length || (i.credentials.workspacePolicies?.length ?? 0) > 1 || !i.credentials.allowedOwners?.length)) {
     details.push(describeStoredCaptureSummary(i.credentials));
   }
-  const lastSyncAt = "status" in i.daemon ? i.daemon.status.lastSyncAt : void 0;
-  if (!i.control.paused && (lastSyncAt === void 0 || i.now - Date.parse(lastSyncAt) > 36e5)) {
+  const uploadedAt = lastUploadTime(i);
+  if (!i.control.paused && (uploadedAt === void 0 || i.now - uploadedAt > 36e5)) {
     details.push(lastUploadLine(i));
   }
   return { type: "header", title, ...details.length > 0 && { subtitle: details.join(" \xB7 ") } };
@@ -96186,7 +96510,7 @@ function syncHeader(i) {
 var AGENT_TITLE_MAX = 48;
 function recentAgentItems(i) {
   if (i.memberSessions === null) return null;
-  const recent = i.memberSessions.filter((session) => i.now - Date.parse(session.lastActivityAt) < RECENT_SESSION_WINDOW_MS).filter((session) => session.archived !== true && session.subagent !== true && session.standaloneReview !== true).sort((a, b2) => Date.parse(b2.lastActivityAt) - Date.parse(a.lastActivityAt)).map((session) => agentRow(session, i));
+  const recent = i.memberSessions.filter((session) => i.now - Date.parse(session.lastActivityAt) < RECENT_SESSION_WINDOW_MS).filter((session) => session.archived !== true && session.subagent !== true && session.standaloneReview !== true).sort((a, b2) => Date.parse(b2.lastActivityAt) - Date.parse(a.lastActivityAt)).map((session) => agentRow(session, i)).filter((row) => row.agent?.status !== "ended");
   const rows = recent.length === 0 ? [{ type: "status", mark: "muted", title: i.memberSessionsIncomplete ? "No sessions found in the partial list" : "No eligible sessions in the latest results" }] : groupedAgentRows(recent.slice(0, RECENT_SESSION_VISIBLE_LIMIT));
   if (i.memberSessionsIncomplete) rows.push({
     type: "status",
@@ -96214,7 +96538,7 @@ function agentRow(session, i) {
   const harness = isLegacySessionSource(session.source) ? harnessFromLegacySessionSource(session.source) : null;
   const harnessName = harness?.kind === "harness" ? harness.harness : session.source;
   const status = localMachine && harness?.kind === "harness" && i.sessionStatus !== void 0 ? i.sessionStatus(harness.harness, session.externalId) ?? "unknown" : void 0;
-  const statusLabel = status === void 0 ? null : LOCAL_SESSION_STATUS_LABELS[status];
+  const statusLabel = status === "waiting" ? LOCAL_SESSION_STATUS_LABELS.waiting : null;
   const desktopSessionId = localMachine && session.source === "claude-code" ? i.claudeDesktopSessions?.get(session.externalId)?.sessionId : void 0;
   const app = desktopSessionId !== void 0 ? "Claude desktop" : isLegacySessionSource(session.source) ? describeSessionSource(session.source) : session.source;
   const links = sessionLinks(session, i.config.webUrl, {
@@ -96298,10 +96622,16 @@ function menuContentKey(payload) {
   });
   return JSON.stringify({ ...shown, desktopDiagnostic: void 0 });
 }
+function lastUploadTime(i) {
+  if (!("status" in i.daemon)) return void 0;
+  const { lastSyncAt, lastUploadAt } = i.daemon.status;
+  const times = [lastSyncAt, lastUploadAt].map((at) => Date.parse(at ?? "")).filter((at) => !Number.isNaN(at));
+  return times.length === 0 ? void 0 : Math.max(...times);
+}
 function lastUploadLine(i) {
-  const lastSyncAt = "status" in i.daemon ? i.daemon.status.lastSyncAt : void 0;
-  if (lastSyncAt === void 0) return "No successful upload yet";
-  return `Last upload ${ago(i.now - Date.parse(lastSyncAt))}`;
+  const uploadedAt = lastUploadTime(i);
+  if (uploadedAt === void 0) return "No successful upload yet";
+  return `Last upload ${ago(i.now - uploadedAt)}`;
 }
 function connectionRow(connection, envArgs, now) {
   const name = CLIENT_NAMES[connection.client];
@@ -97894,7 +98224,7 @@ function startMenuModel(sources) {
         const dir = path34.dirname(menuRefreshRequestPath(appEnv, host.home));
         mkdirSync17(dir, { recursive: true, mode: 448 });
         const openFile = path34.basename(menuOpenRequestPath(appEnv, host.home));
-        const watcher = fsWatch3(dir, (_event, filename) => onRequest(filename === openFile ? "menu-open" : "command"));
+        const watcher = fsWatch4(dir, (_event, filename) => onRequest(filename === openFile ? "menu-open" : "command"));
         watcher.on("error", onLost);
         return () => watcher.close();
       },
@@ -97960,7 +98290,7 @@ function renderDoctorReport(i) {
   );
   const unsupported = unsupportedVersionNotice(i.cliVersion, i.oldestSupportedVersion);
   if (unsupported !== null) lines.push(unsupported);
-  lines.push(`Environment: ${i.config.appEnv} (API ${i.config.apiUrl})`);
+  lines.push(`Environment: ${i.config.appEnv} (API ${i.credentials?.apiUrl ?? i.config.apiUrl})`);
   lines.push(`Node: ${i.nodeVersion} (${i.platform})`);
   lines.push(installLine(i.install));
   lines.push(enrollmentLine(i));
@@ -100093,4 +100423,4 @@ undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
 
-//# debugId=9f447c4d-0ccb-5f45-8960-6853e28aadfb
+//# debugId=9ee35b05-7453-5338-85ff-5dc1b6010221